Deciphering the Wave-Like Spread: The RTSS Model for SMS Worms

TL;DR

SMS worms don't spread in a smooth, predictable curve. Instead, they exhibit "uneven wave-like uplifts." This paper introduces the RTSS model, which bridges the gap between theoretical epidemiology and real-world mobile security by modeling node reputation, asymmetric edge trust, and the discrete-time human behavior of checking messages.

Background: Why the "Exponential Rise" is a Myth

For decades, the security community relied on variants of the SIR (Susceptible-Infectious-Recovered) model. While mathematically elegant, SIR assumes a "complete graph" where any node can infect any other. In the reality of mobile contact lists, propagation is constrained by:

1. Topology: You only send messages to your contacts.
2. Trust: You are more likely to click a link from a close friend than a stranger.
3. Timing: A worm can only infect a device when the user actually checks their phone.

Real data from notorious worms like xxShenQi (which hit over 200,000 devices) shows a jagged, wave-like infection pattern that traditional models simply cannot explain.

Methodology: The RTSS Innovation

The authors propose the RTSS (Reputation-Trust-Susceptible-States) model, which focuses on two pillars:

1. Asymmetric Social Trust (RT)

Unlike online social networks (OSNs) like Twitter, Contact Social Networks are deeply interpersonal. The model assigns a Reputation ($\gamma$) to nodes and a Trust Degree ($ϵ$) to edges.

• Insight: Reputation follows a Pareto distribution (the 80-20 rule)—a few users act as highly trusted hubs.
• Asymmetry: Just because User A has User B in their contacts doesn't mean the reverse is true. RTSS uses directed graphs to reflect this reality.

2. Human Dynamics (SS)

Traditional models assume a user is always "susceptible." RTSS splits this into:

• $sus0$: The user is idle.
• $sus1$: The user is actively checking messages.

The transition between these states is not random. It is governed by a Zeta Distribution, reflecting the "heavy-tailed" nature of human activity (most intervals are short, but some are very long), and a Diurnal Activity Function (people sleep at 3 AM and are active at 2 PM).

Figure: The state transition graph showing $sus0$ and $sus1$ dynamics.

Experiments & Real-World Validation

The authors validated RTSS against two massive real-world datasets: Cckun and xxShenQi.

SOTA Comparison

When compared to the SIR and Semi-Markov models, RTSS was the only one capable of locating the "inflection points" where infection rates spiked and dipped.

• Accuracy: RTSS maintained a deviation of roughly 5%, whereas SIR significantly overestimated the speed of spread by ignoring the "checking interval" bottleneck.

Figure: RTSS fits the jagged real-world data of Cckun far better than traditional smooth-curve models.

Key Insights from Ablation

• Source Position Matters: If a worm starts in 10 different "Propagation Domains" (communities), it spreads much faster and more smoothly than if it starts in a single community.
• The Power of Hubs: Infecting "popular nodes" (high out-degree) is significantly more effective for a worm than infecting random users.

Critical Insight & Conclusion

The RTSS model proves that in mobile security, human behavior is the protocol. The wave-like pattern of SMS worms is a direct reflection of our daily rhythms—the pulses of activity when we wake up, go to lunch, and finish work.

Limitations & Future Work

The model currently assumes a static snapshot of the contact list. In the era of dynamic social apps like WeChat or WhatsApp, contact relationships evolve. Future research should look into Hybrid Worms that jump between SMS and encrypted IM apps, which may bypass the trust-degree calculations defined here.

Takeaway: To stop a mobile worm, don't just patch the OS; understand the rhythm of the user.