Epidemiological Dynamic

Relevant DNS Data Features

Population

Number of hosts within the network.

Number of initial infections

Count of the initial (first, by date and time) infected host (s) on the network.

Transmission Time: Length of incubation period

Measured in days, the incubation period is from when a host is initially compromised (e.g. malware downloaded), to when the malware commences the action.

Transmission Time: Duration Host is Infectious

Time (days) in which the malware is undertaking actions, and/or has the potential to undertake actions to infect other hosts.

Fatality Rate

Percentage of hosts that have been irreversibly compromised or unable to perform its function and/or damaged beyond repair.

Time from end or incubation to death

Time (days) from when the malware commences an action, to the host becoming irreversibly compromised (“bricked”).

Recovery time

Time (days) from when the malware commences an action, to host recovery back to normal operations and a status of “not infected”.

Length of hospital stay

Time (days) in which the malware is undertaking actions.

Hospitalisation rate

Rate (count as a percentage) of hosts that demonstrate indicators of

compromise (IOCs) that are confirmed infected for some time where the malware is undertaking action.

Time to hospitalisation

Time (days) from hosts demonstrate indicators of compromise (IOCs) to when they are confirmed infected due to evidence of malware action.