Study of the antivirus patch testing problem through optimal control modeling.

Abstract

The lag of antivirus (AV) software development relative to malware development makes it necessary to constantly release AV patches. In practice, an AV patch can be deployed on an organization's intranet only when it passes compatibility test. In this context, a subset of hosts may be assigned to perform the test. The function of the fraction of the assigned hosts with respect to time is referred to as an AV patch testing (AVPT) policy, and the problem of finding a satisfactory AVPT policy in terms of the cost benefit is referred to as the AVPT problem. This paper addresses the AVPT problem through optimal control modeling. A new mathematical model of characterizing the evolution of the intranet's expected state is introduced by incorporating the effect of AV patch testing. On this basis, the AVPT problem is modeled as an optimal control problem (the AVPT model). By applying the Pontryagin Maximum Principle to this model, an iterative algorithm of solving the model is presented. The usability of the algorithm, including its convergence and effectiveness, is validated. Finally, the effect of a pair of controllable factors is inspected. This work initiates the study of patch testing-related issues through optimal control modeling.