1. Introduction 1.1. Malicious Attacks and Examples 1.2. Propagation of Malicious Attacks 1.3. Source Identification of Malicious Attacks 1.4. Outline and Book Overview 2. Preliminary of Modeling Malicious Attacks and Source Identification 2.1. Complex Network Representation 2.1.1. Network Generating Models 2.1.2. Evaluating the Importance of Nodes 2.1.3. Structural Features of Complex Networks 2.2. Epidemic Diffusion Models 2.2.1. Differential Equation Based Models 2.2.2. Difference Equation Based Models 2.3. Epidemic Tracing Back Techniques 2.3.1. Minimum Spanning Tree Based Approaches 2.3.2. Sample Path Based Approaches 2.3.3. Bayesian Belief Based Approaches 3. Observation Categories of Malicious Attacks in Cyber Networks 3.1. Complete Observation 3.2. Snapshot Observation 3.2.1. Infection Status Partially Revealed 3.2.2. Undistinguishable Statuses Involved 3.2.3. Partial Nodes' Status Available 3.3. Sensor Observation 4. Source Identification Based on Complete Observations 4.1. Rumor Center Based Approaches 4.1.1. Single Rumor Center 4.1.2. Multiple Rumor Centers 4.1.3. Local Rumor Centers 4.2. Eigen Vector Based Approaches 4.2.1. Dynamic Age 4.2.2. Minimum Description Length 4.3. Summary on Complete Observation Based Approaches 5. Source Identification Based on Snapshots 5.1. Jorden Center Based Approaches 5.1.1. Jorden Center With SIR Model 5.1.2. Jorden Center With SI Model 5.1.3. Jorden Center With SIS Model 5.2. Message Passing Based Approach 5.2.1. Dynamic Message Passing 5.3. Concentricity Based Approach 5.3.1. Effective Distance 5.4. Summary on Snapshot Based Approaches 6. Source Identification Based on Sensor Observation 6.1. Statistical Based Approaches 6.1.1. Bayesian Belief Propagation 6.1.2. Gaussian Estimator 6.1.3. Moon Walk 6.2. Greedy Rule Based Approaches 6.2.1. Monte Carlo Method 6.2.2. Four-Metric Method 6.3. Summary on Sensor Observation Based Approaches 7. Malicious Attack Source Identification in Time-varying Networks 7.1. Introduction 7.2. Time-Varying Networks 7.2.1. Time-varying Topology 7.2.2. Security States of Individual Nodes 7.2.3. Observations on Time-varying Social Networks 7.3. Narrowing Down the Suspects 7.3.1. Reverse Dissemination Method 7.3.2. Performance Evaluation 7.4. Determining the Real Source 7.4.1. Maximum-likelihood (ML) Based Method Monte Carlo Method 7.4.2. Propagation Model 7.5. Evaluation 7.5.1. Accuracy of Malicious Attack Source Identification 7.5.2. Effectiveness Justification 7.6. Summary 8. Identifying Multiple Malicious Attack Sources 8.1. Introduction 8.2. Preliminaries 8.2.1. Epidemic Model 8.2.2. Effective Distance 8.3. Problem Formulation 8.4. K-center Method 8.4.1. Network Partition with Multiple Sources 8.4.2. Identifying Diffusion Sources and Regions 8.4.3. Predicting Spreading Time 8.4.4. Unknown Number of Diffusion Sources 8.5. Evaluation 8.5.1. Accuracy of Identifying Malicious Attack Sources 8.5.2. Es Skryť popis