Slashdot Mirror
Researchers Develop Algorithm To Trace Malware, Epidemics, More
hypnosec writes "Want to trace the source of a virus that has infected your computer? Researchers at the Federal Institute of Technology in Lausanne in Switzerland have the answer. The scientists have devised software capable of tracing computer viruses back to their source. Beyond computer viruses, the software can also trace terror suspects, rumor-mongering and even infectious diseases back to their source. Pedro Pinto, one of the researchers, explained that the algorithm works by going through information in a reverse direction back to the original source. He said, 'Using our method, we can find the source of all kinds of things circulating in a network just by "listening" to a limited number of members of that network.' The team tested their software on a known data maze to check if their research actually pinpoints the individuals behind the 9/11 attacks and they were able to pin-point three suspects, out of which one was the mastermind behind the attacks."
From TFA:
Taking social networking sites as another example, Pinto said individuals could use the algorithm to find out who had started a rumour posted to 500 contacts by looking at posts received by just 15 to 20 of them.
In other words, after creating a mathematical model of the right 500 people, and after planting 15 or 20 agents inside that 500 person network and monitoring their network traffic for a while, they were able to trace a rumor back to the originator.
The impressed button, I will not be pushing it tonight.
John
I don't believe this story, I think these kids are fake.
The purpose of existence is to make money.
The articles seem rather scant on details, and the second link seems to be a repost of the same information in the first article. My first inclination was that the story was BS - I couldn't see any way that they can accomplish what they claim to accomplish, so perhaps the news agency just really screwed up the story. After researching a few other articles about this, my judgement is that they're tracing this stuff back to the source based on listening in on messages being sent around a bunch of connected nodes. A number of nodes would need to be monitored in advance (or at least have relatively good time-frames for when it arrived at various nodes) before the information could be traced back.
More articles on the subject:
The Original Article: http://physics.aps.org/articles/v5/89
A second article with different details: http://www.ibtimes.com/articles/372537/20120810/facebook-rumor-math-terrorism-algorithm.htm
As in the peeps behind 9/11. Sounds like wonderful research. Full scholarships for everybody!
Old News.
I have considered this problem previously and what looks to be between doable and feasible quickly falls away in the chaotic face of reality. I believe AC has hit this one right on the head - the quest for grants and scholarships is the only basis for these claims.
I said - don't look Ethel!..., but it was too late..., she'd already looked.
Not that serious a limitation. The governements of many countries already store a detailed description of all of internet traffic for a period of years. A few of them even admit to doing so.
If the software was able to detect Dick Cheney et al as the master minds behind 9/11, I'll be impressed. Otherwise massive fail.
A 15% success rate isn't anything to be crowing about, unless the false positive rate is near zero.
After reading TFS and the articles linked therein, I could find no mention of false positives. This is a critical issue for any classification system which is attempting to identify a small subset of a large population, especially when there are serious consequences for those identified. In fact, the articles did not even mention whether the classification was into positive-vs-unclassified, or positive-vs-unclassified-vs-negative. In the latter case, the rate of false negatives would also be of interest.
Those who can make you believe absurdities can make you commit atrocities. - Voltaire
It's a pity neither of those editorial articles mentions what the false positive rate is. This is critical.
Actually, they don't even mention whether the algorithm identifies negatives as well as positives (i.e. those who can be ruled out of any follow-up investigations etc.), and if so, what the false negative rate is. This is also critical.
The article itself in Phys. Rev. Lett. is behind a paywall. Maybe it addresses the false positive issue, and the positive vs negative issue.
Those who can make you believe absurdities can make you commit atrocities. - Voltaire
Trace me. Send me my current whereabouts ftw. Bonus points for GPS coordinates. You have 1 hour. Go.
You are directly above the center of the Earth.
This representation of your whereabouts is accurate to millimeters. Now pay up...
Those who can make you believe absurdities can make you commit atrocities. - Voltaire
The article is indeed behind a paywall but one of the authors (Pinto) makes it available from his personal website.
Here is the link to the Physical Review Letters article: http://www.pedropinto.org.s3.amazonaws.com/publications/locating_source_diffusion_networks.pdf
and here is the link to some supplemental material like proofs, algorithm, complexity analysis, and application to a cholera outbreak in Kwazul-Natal to locate the source of the outbreak.
Maybe with this technology we will finally find out who is Cartman's mom or dad (or both).
No, because the network is almost trivial, due to the large number of connections.
Many antivirus companies have honeypots to detect new virii. It would be extremely interesting to independently trace the origin of things like Stuxnet.
Too broke to purchase the original article but the free article says they deal with 'nodes in a plane' and the African example uses waterways so they are essentially using a tree there. These are npot the most complex data structures imaginable.
Also the means of defeating their algorithm is easy to figure out. Just make it look like the virus came from a well-connected user. These are likely pwned already, anyhow.