A novel computer virus model and its dynamics

https://doi.org/10.1016/j.nonrwa.2011.07.048Get rights and content

Abstract

In this paper, we propose a novel computer virus propagation model and study its dynamic behaviors; to our knowledge, this is the first time the effect of anti-virus ability has been taken into account in this way. In this context, we give the threshold for determining whether the virus dies out completely. Then, we study the existence of equilibria, and analyze their local and global asymptotic stability. Next, we find that, depending on the anti-virus ability, a backward bifurcation or a Hopf bifurcation may occur. Finally, we show that under appropriate conditions, bistable states may be around. Numerical results illustrate some typical phenomena that may occur in the virus propagation over computer network.

Introduction

Applications based on computer networks are becoming more and more popular in our daily life. While bringing convenience to us, computer networks are exposed to various threats. Computer viruses, which are programs developed to attempt to attach themselves to a host and spread to other computers mainly through the Internet, can damage network resources. Consequently, understanding the law governing the spread of computer virus is of considerable interest.

Due to the high similarity between computer viruses and biological viruses [1], the classical SIR (Susceptible-Infected-Recovered) computer virus propagation model was proposed [2], [3], [4], which is formulated as the following system of differential equations: {dSdt=bλS(t)I(t)dS(t),dIdt=λS(t)I(t)εI(t)dI(t),dRdt=εI(t)dR(t). Here it is assumed that all the computers connected to the network in concern are classified into three categories: susceptible, infected and recovered computers. Let S(t), I(t) and R(t) denote their corresponding numbers at time t, respectively. This model involves four positive parameters: b denotes the rate at which external computers are connected to the network, ε denotes the recovery rate of infected computers due to the anti-virus ability of the network, d denotes the rate at which one computer is removed from the network, λ denotes the rate at which, when having a connection to one infected computer, one susceptible computer can become infected. For some variants of this model, see Refs. [5], [6], [7], [8], [9], [10], [11], [12], [13].

The use of anti-virus software is regarded as one of the most effective approaches to recovering infected computers [14]. The ability of an anti-virus software can be measured by the number of computers recovered from infected computers per unit time due to running the anti-virus software. In reality, the ability of an anti-virus software is usually proportional to its cost. Due to the limited software cost, the anti-virus ability of a network is limited. So, it is natural to consider the following recovery function: T(I)={εIif 0II0,mif I>I0, where ε is the recovery rate when the anti-virus ability is not fully utilized, m=εI0. In [15], [16], the susceptible individuals are assumed to have logistic growth with carrying capacity k>0 as well as an intrinsic growth rate r>0.

Inspired by the above mentioned work, this paper deals with a novel model of computer virus propagation, which is of the form {dSdt=rS(1Sk)λSIdS,dIdt=λSIT(I)dI,dRdt=T(I)dR. Because the first two equations in (1.3) are independent of R, we can consider the following reduced model: {dSdt=rS(1Sk)λSIdS,dIdt=λSIT(I)dI.

We carry out the global qualitative and bifurcation analysis for the model, and obtain rich dynamical properties. To our knowledge, this is the first time the effect of anti-virus ability is taken into account this way. First, we give the threshold value determining whether the virus dies out completely. Second, we study the existence of equilibria, and investigate their local and global asymptotic stability. Next, we find that, depending on the anti-virus ability, the system may undergo a backward bifurcation or a Hopf bifurcation, which is instructive for us when choosing an appropriate virus-controlling strategy. Finally, we prove that, under appropriate conditions, the system may admit bistable states: a stable virus-free equilibrium and a stable virus equilibrium, or two stable virus equilibria. In this case, the initial condition is critical for the eventual steady state of the system.

The remaining materials of this paper are organized this way: Section 2 studies the existence of equilibria of model (1.4); Section 3 examines the stability switch for a virus equilibrium, and analyzes the global stability and bistable states; Section 4 shows that the model admits Hopf bifurcation. We end the paper with a brief discussion in Section 5.

Section snippets

Equilibria

To obtain its equilibria, (1.4) can be written as {rS(1Sk)dSλSI=0,λSII(d+ε)=0,if 0II0, and {rS(1Sk)λSIdS=0,λSImdI=0,if I0<I.

(2.1) has a trivial equilibrium E0=(0,0) and a virus-free equilibrium E0=(k(rd)r,0). Let R0=kλ(rd)r(d+ε). If R0>1, then (2.1) admits a unique positive solution E(S,I), where S=k(rd)rR0,I=(R01)(rd)λR0. Obviously, E is a virus equilibrium of (2.1) if and only if 1<R01+λI0(rdλI0).

From (2.2) we get a quadratic equation in I: kλ2I2bI+mr=0, where b=kλ(r

Local stability

To examine the local stability of the equilibria of (1.4), for its Jacobian matrices at the equilibria (rd2rSkλIλSλIλS(d+ε))and(rd2rSkλIλSλIλSd), we need to find its eigenvalues. Clearly, det(E0)=[(rd)(d+ε)]<0,det(E0)=(rd)[λk(rd)r(d+ε)],tr(E0)=(rd)+[λk(rd)r(d+ε)].R0<1, which is equivalent to λk(rd)r(d+ε)<0, ensures the local asymptotic stability of E0. Analogously, E is locally asymptotically stable and E1 is a saddle if R0>1. det(E2)=[2kλ(rd)+(b+Δ)2kλ][2kλ(rd)(b+Δ)

Hopf bifurcation

In this section, we are concerned with the Hopf bifurcation of model (1.4). By Remark 3.2, we know that the Hopf bifurcation can emerge only at E2. Let x=SS2,y=II2, so that E2 is translated to (0, 0). Then (1.4) becomes: dxdt=a11x+a12y+f1(x,y),dydt=a21x+a22y+f2(x,y), where a11=r2rS2kdλI2,a12=λS2,a21=λI2,a22=λS2d,f1(x,y)=rkx2λxy,f2(x,y)=λxy. For our purpose, let us choose these parameters so that tr(E2)=0. Let x=a12v,y=ωua11v. Then (1.4) is reduced to dudt=ωv+f2(a12v,ωua11v)a11f1(a12

Concluding remarks

In this paper, we propose a novel computer virus propagation model over a network by taking into account the effect of anti-virus ability on the network. Our main contributions include the following: (1) We present some criteria for the existence and local asymptotic stability of virus-free equilibria and virus equilibria, one of them implying the existence of the backward bifurcation. (2) We find that a stability switch might exist. (3) We show that a bistable state might be around; in this

Acknowledgments

The authors are grateful to the anonymous reviewers for their constructive suggestions that greatly improve the quality of this paper. This work was supported in part by Major Program of NSFC (Grant No. 90818028), NSFC (Grant No. 10771227), NCET of Educational Ministry of China (Grant No. NCET-05-0759) and Fundamental Research Funds for the Central Universities (Grant No. CDJXS10181130).

References (17)

There are more references available in the full text version of this article.

Cited by (0)

View full text