Modeling and Analysis of Bifurcation in a Delayed Worm Propagation Model

Abstract

A delayed worm propagation model with birth and death rates is formulated. The stability of the positive equilibrium is studied. Through theoretical analysis, a critical value 𝜏₀ of Hopf bifurcation is derived. The worm propagation system is locally asymptotically stable when time delay is less than 𝜏₀. However, Hopf bifurcation appears when time delay 𝜏 passes the threshold 𝜏₀, which means that the worm propagation system is unstable and out of control. Consequently, time delay should be adjusted to be less than 𝜏₀ to ensure the stability of the system stable and better prediction of the scale and speed of Internet worm spreading. Finally, numerical and simulation experiments are presented to simulate the system, which fully support our analysis.

1. Introduction

In recent years, Internet is undoubtedly one of the fastest increasing scientific technologies, which brings about convenience in people’s daily work and changes people’s life in variety of aspects. With rapid development of network applications and the increase of network complexity, security problems emerge progressively. Among them, the problem of Internet worms has become the focus with its wide infection range, fast spread speed, and tremendous destruction. Enlightened by the researches in epidemiology, plenty of models have been constructed to predict the spread of worms and some containment strategies have been taken into consideration. In addition, birth and death rates are widely applied in epidemiology because individuals in the ecological system may die during the spread of diseases. Meanwhile baby individuals are born everyday and join the ecological system [1–3]. In the computer science field, computers are like individuals in an ecological system. As a result of being infected by Internet worms or quarantined by intrusion detection systems (IDS), hosts will get unstable and unreliable which will result in system reinstallation by their owners. Besides, when many new computers are brought, most of them are preinstalled with operating systems without newest safety patches. Furthermore, old computers are discarded and recycled at the same time. These phenomena are quite similar to the death and birth in epidemiology. Thus, in order to imitate the real world, birth and death rates should be introduced to worm propagation model.

Quarantine strategies have been exploited and applied in the control of disease. The implementation of quarantine strategy in computer field relies on the IDS [4]. The IDS include two major categories: misuse intrusion detection and anomaly intrusion detection system. The anomaly detection system is commonly used to detect malicious code such as computer virus and worms for its relatively better performance [5, 6]. Once a deviation from the normal behavior is detected, such behavior is recognized as an attack and appropriate response actions, such as quarantine or vaccination, are triggered.

Mechanism of time window was brought in IDS in order to balance the false negative rate and false positive rate [7]. The introduction of time window is used to decide whether an alarm is a true or false positive based on the number of abnormal behaviors detected in a time window. It implies that the size of time window affects both the number of true positive and false positive rates. However, the import of the time window leads to time delay. Therefore, in order to accord with actual condition, time delay should be considered. In this paper, time delay is introduced in the worm propagation model along with birth and death rates, and its stability is analyzed. Moreover, it is indicated that overlarge time delay may result in the bifurcation which would do little help to eliminate the worms. Consequently, in order to guarantee the simplification and stability of the worm propagation system, time delay should be decreased appropriately by a decrease in the window size.

The rest of the paper is organized as follows. In the next section, related work on time delay and birth is death rates and introduced. Section 3 gives a brief introduction of the simple worm propagation model and quarantine strategy. Afterwards we present the delayed worm propagation model with birth and death rates and analyze the stability of the positive equilibrium. In Section 4, numerical and simulation experiments are presented to support our theoretical analysis. Finally, Section 5 draws the conclusions.

2. Related Work

Due to the high similarity between the spread of infectious biological viruses and computer worms, some scholars have used epidemic model to simulate and analyze the worm propagation [8–14]. For instance, Staniford first constructs the propagation of Internet worms by imitating epidemic propagation models, called simple epidemic model (SEM) model [9]. susceptible-infected-removed (SIR) model plays a significant role in the research of worm propagation model [10]. On the basis of SIR model, Zou et al. propose a worm propagation model with two factors on Code Red [11]. Ren et al. give a novel computer virus propagation model and study its dynamic behaviors [12]. Mishra and Pandey formulate an e-epidemic SIRS model for the fuzzy transmission of worms in computer network [13]. L.-X. Yang and X. Yang investigate the propagation behavior of virus programs and propose that infected computers are connected to the Internet with positive probability [14]. Mathematical analysis and simulation experiment of these models are conducted, which are helpful to predict the speed and scale of Internet worm propagation. In addition, to our knowledge, the use of quarantine strategies has produced a great effect on controlling disease. Enlightened by this, quarantine strategies are also widely used in worm containment [15–18]. Yao et al. construct a worm propagation model with time delay under quarantine, and its stability of the positive equilibrium is analyzed [15, 16]. Yao also proposes a pulse quarantine strategy to eliminate worms and obtains its stability condition [17]. Wang et al. propose a novel epidemic model which combines both vaccinations and dynamic quarantine methods, referred to as SEIQV model [18].

Furthermore, some scholars have done some researches on time delay [19–21]. Dong et al. propose a computer virus model with time delay based on SEIR model [19]. By proposing an SIRS model with stage structure and time delays, Zhang et al. perform some bifurcation analysis of this model [20]. Zhang et al. also consider a delayed predator-prey epidemiological system with disease spreading in predator population [21]. In addition, the direction of Hopf bifurcations and the stability of bifurcated periodic solutions are studied, which are our extension direction in the future research.

3. Worm Propagation Model

3.1. The Simple Worm Propagation Model

Realizing the similarities between Internet worms and biological viruses in propagation characteristics, classical epidemic models have been applied to the research of worm propagation models. Initially, we introduce a simple propagation model, the Kermack Mckendrick model (KM model) [22], as the basis of our research.

The KM model assumes that all Internet hosts are in one of three states: susceptible state (𝑆), infectious state (𝐼), and removed state (𝑅). And hosts can only maintain one state at any given moment. Infectious hosts are converted from susceptible hosts by a worm infection and can shift to removed state through killing worms by antivirus softwares and installing safety patches. Once patches are installed, the hosts can no longer be infected by worms. The state transition diagram of the KM model is given in Figure 1.

Figure 1 

State transition diagram of the KM model.

𝑆(𝑡) denotes the number of susceptible hosts at time 𝑡, 𝐼(𝑡) denotes the number of infectious hosts at time 𝑡, and 𝑅(𝑡) denotes the number of removed hosts at time 𝑡. The total number of hosts in the network is 𝑁 and remains constant. 𝛽 is infection rate at which susceptible hosts are infected by infectious hosts, and 𝛾 is recovery rate at which infectious hosts get recovered. The KM model can be formulated by a set of differential equations from the state transition diagram as follows: 𝑑𝑆(𝑡)(𝑡)𝐼(𝑡),(𝑡)𝑑𝑡=−𝛽𝑆𝑑𝐼(𝑡)𝐼(𝑡)(𝑡),(𝑡)𝑑𝑡=𝛽𝑆−𝛾𝐼𝑑𝑅(𝑡).𝑑𝑡=𝛾𝐼 (1)

Although KM model adopts recovery feature and does generate some braking containment effect on the worm propagation, it only describes the initial stage of worm propagation and does not control the outbreaks of worms. More suppression strategies should be taken to further control the worm propagation.

3.2. The Worm Propagation Model with Quarantine Strategy

Quarantine strategy, which relies on the intrusion detection system, is an effective way to diminish the speed of worm propagation. On the basis of the KM model, quarantine strategy should be taken into consideration. Firstly, infectious hosts are detected by the systems and then get quarantined and patched. Moreover, considering that hosts could get patched whatever state the hosts stay, we add a new path from hosts in susceptible state to vaccinated state to accord with actual situation. The state transition diagram of the worm propagation model with quarantine strategy is given in Figure 2.

Figure 2 

State transition diagram of the quarantine model.

In this model, vaccinated state equals to removed state in KM model, and 𝑉(𝑡) denotes the number of vaccinated hosts at time 𝑡. Susceptible hosts can be infected by worms with an infection rate 𝛽 due to their vulnerabilities. After infection, the hosts become infectious hosts, which means the hosts can infect other susceptible hosts. The hosts can be directly patched into the vaccinated state before getting infected at rate 𝜔. By applying misuse intrusion detection system for its relatively high accuracy, we add a new state called quarantine state, but only infectious hosts will be quarantined. 𝑄(𝑡) denotes the number of quarantine hosts at time 𝑡. Infectious hosts will be quarantined at rate 𝛼 which depends on the performance of intrusion detection systems and network devices. When infectious hosts are quarantined, the hosts will get rid of worms and get patched at rate 𝜑. Meanwhile, infectious hosts can be manually patched into vaccinated state at recovery rate 𝛾. It can be perceived that if a host is patched, it has gained immunity permanently.

The differetial equations of this model are given as 𝑑𝑆(𝑡)(𝑡)𝑆(𝑡)(𝑡),(𝑡)𝑑𝑡=−𝛽𝐼−𝜔𝑆𝑑𝐼(𝑡)𝑆(𝑡)(𝑡)(𝑡),(𝑡)𝑑𝑡=𝛽𝐼−𝛾𝐼−𝛼𝐼𝑑𝑄(𝑡)(𝑡),(𝑡)𝑑𝑡=𝛼𝐼−𝜑𝑄𝑑𝑉(𝑡)(𝑡)(𝑡).𝑑𝑡=𝜔𝑆+𝛾𝐼+𝜑𝑄 (2)

The total number of this model is set to 𝑁=1, which means the sum of hosts in all four states is equal to one; that is 𝑆(𝑡)+𝐼(𝑡)+𝑄(𝑡)+𝑉(𝑡)=1. Then, the infection-free equilibrium of this model and its stability condition will be studied.

The first, second, and third equations in system (2) have no dependence on the last one; therefore, the last one can be omitted. System (2) can be rewritten as a three-demensional system 𝑑𝑆(𝑡)(𝑡)𝑆(𝑡)(𝑡),(𝑡)𝑑𝑡=−𝛽𝐼−𝜔𝑆𝑑𝐼(𝑡)𝑆(𝑡)(𝑡)(𝑡),(𝑡)𝑑𝑡=𝛽𝐼−𝛾𝐼−𝛼𝐼𝑑𝑄(𝑡)(𝑡).𝑑𝑡=𝛼𝐼−𝜑𝑄 (3)

Due to the infection-free state which the system holds in the end, the number of infectious hosts is equal to 0. Obviously, the number of susceptible hosts and number of quarantined hosts are both equal to 0, because all of the hosts in the network will get patched at last, no matter which way the hosts take. Thus the infection-free equilibrium point 𝐸^∗(0,0,0) of system (3) can be obtained. Since 𝑉(𝑡)=𝑁−𝑆(𝑡)−𝐼(𝑡)−𝑄(𝑡), the infection-free equilibrium of the model with quarantine strategy is 𝐸^∗(0,0,0,𝑁).

Although all infectious hosts in quarantine model convert to vaccinated hosts, in other words, worms have been eliminated, it is hardly appropriate for real world situation. Actually, not all the hosts will convert to vaccinated hosts, and no-patch hosts are still existing in the network and suffering high risk of worm attack. In addition, considering that hosts are consumer electronic products, the recycling of old hosts happens frequently every day. In order to imitate the facts in the real world, birth and death rates must be taken into consideration.

Additionally, due to the time windows of intrusion detection system, which decreases the number of false positives, time delay should be considered to accord with actual situation. Therefore, in the next section, the new model is proposed.

3.3. The Delayed Worm Propagation Model with Birth and Death Rates

By adding time delay, along with birth and death rates, the delayed worm propagation model with birth and death rates is presented. Figure 3 shows the state transition diagram of the delayed worm propagation model with birth and death rates.

Figure 3 

State transition diagram of the delayed model.

In this model, the total number of hosts denoted by 𝑁 is divided into five parts. Compared with quarantine model, a new state, delayed state, is added. The hosts do not have the ability to infect other susceptible hosts but are not quarantined yet. Therefore, a new state is needed to represent these hosts. 𝐷(𝑡) denotes the hosts in delayed state at time 𝑡. Furthermore, the hosts in susceptible, infected, quarantined, and removed states have the same rate 𝜇 to leave the network. If the hosts are quarantined by IDS, some of applications may not access to network because their ports are occupied by worms. At this moment, the users would like to reinstall OS and leave the network system. Thus, the birth and death rates are correlative to the number of infectious hosts and quarantined hosts in the network system. And the rate 𝜇 is 𝜇=𝜇₀𝐼(𝑡)+𝑄(𝑡)𝑁. (4)

The hosts in delayed state are not likely to leave the network, accounting for the activeness of these hosts. The newborn hosts enter the system with the same rate 𝜇, of which a portion 1−𝑝 is recovered by installing patches instantly at birth. This differs from the transition denoted by 𝜔, because the hosts are vaccinated at the time of entering the network by installing patched operating system. The transition 𝜔 represents the rate by which those susceptible in the network get vaccinated by installing patches later. The delayed differential equations are written as 𝑑𝑆(𝑡)(𝑁(𝑡)(𝑡(𝑡)𝑆(𝑡)(𝑡)(𝑡),(𝑡)𝑑𝑡=𝑝𝜇−𝐷))−𝛽𝐼−𝜔𝑆−𝜇𝑆𝑑𝐼(𝑡)𝑆(𝑡)(𝑡)(𝑡)(𝑡),(𝑡)𝑑𝑡=𝛽𝐼−𝛾𝐼−𝛼𝐼−𝜇𝐼𝑑𝐷(𝑡)(),(𝑡)𝑑𝑡=𝛼𝐼−𝛼𝐼𝑡−𝜏𝑑𝑄()(𝑡)(𝑡),(𝑡)𝑑𝑡=𝛼𝐼𝑡−𝜏−𝜑𝑄−𝜇𝑄𝑑𝑉=𝜇(𝑁(𝑡)(𝑡(𝑡)(𝑡)(𝑡)(𝑡).𝑑𝑡1−𝑝−𝐷))+𝜔𝑆+𝛾𝐼+𝜑𝑄−𝜇𝑉 (5)

Other notations are identical to those in the previous model. To understand them more clearly, the notations in this model are shown in Table 1.

Table 1 

Notations in this paper.

As mentioned in Table 1, the population size is set to 𝑁, which is set to unity: 𝑆(𝑡)+𝐼(𝑡)+𝐷(𝑡)+𝑄(𝑡)+𝑉(𝑡)=𝑁. (6)

3.4. Stability of the Positive Equilibrium and Bifurcation Analysis

Theorem 1. The system has a unique positive equilibrium 𝐸^∗(𝑆^∗,𝐼^∗,𝐷^∗,𝑄^∗,𝑉^∗), when the condition   (𝐻₁) (𝑝𝜇𝛽𝑁/(𝜇+𝛼+𝛾)(𝜇+𝜔))>1is satisfied, where 𝑆^∗=𝜇+𝛼+𝛾𝛽,𝐷^∗=𝛼𝜏𝐼^∗,𝑄^∗=𝛼𝐼^∗,𝑉𝜑+𝜇_∗=𝛾𝐼^∗+𝜔𝑆^∗+𝜑𝑄^∗+𝜇1−𝑝𝑁−𝐷^∗𝜇. (7)

Proof. From system (5), according to [23], if all the derivatives on the left of equal sign of the system are set to 0, which implies that the system becomes stationary, we can get 𝑆=𝜇+𝛼+𝛾𝛽,𝐷=𝛼𝜏𝐼^∗,𝑄=𝛼𝐼^∗,𝜑+𝜇𝑉=𝛾𝐼^∗+𝜔𝑆^∗+𝜑𝑄^∗+𝜇1−𝑝𝑁−𝐷^∗𝜇. (8) Substituting the value of each variable in (8) for each of (6), then we can get: 𝜇+𝛼+𝛾𝛽+𝐼+𝛼𝜏𝐼+𝛼𝐼𝜑+𝜇+𝑉=𝑁. (9) After solving this equation with respect to 𝐼^∗, a solution of 𝐼^∗ is obtained 𝐼=𝑝𝑁𝜇𝛽−𝜇+𝜔𝜇+𝛼+𝛾𝛽𝛼+𝜇𝑝𝛼𝜏+𝜇+𝛾. (10) Thus, if (𝐻₁) is satisfied, (10) has one unique positive root 𝐼^∗, and there is one unique positive equilibrium 𝐸^∗(𝑆^∗,𝐼^∗,𝐷^∗,𝑄^∗,𝑉^∗) of system (5). The proof is completed.

According to (6), 𝑉=𝑁−𝑆−𝐼−𝐷−𝑄, and thus system (5) can be simplified to 𝑑𝑆(𝑡)(𝑁(𝑡)(𝑡(𝑡)𝑆(𝑡)(𝑡)(𝑡),(𝑡)𝑑𝑡=𝑝𝜇−𝐷))−𝛽𝐼−𝑤𝑆−𝜇𝑆𝑑𝐼(𝑡)𝑆(𝑡)(𝑡)(𝑡)(𝑡),(𝑡)𝑑𝑡=𝛽𝐼−𝛾𝐼−𝛼𝐼−𝜇𝐼𝑑𝐷(𝑡)(),(𝑡)𝑑𝑡=𝛼𝐼−𝛼𝐼𝑡−𝜏𝑑𝑄()(𝑡)(𝑡).𝑑𝑡=𝛼𝐼𝑡−𝜏−𝜑𝑄−𝜇𝑄 (11) The Jacobi matrix of (11) about 𝐸^∗(𝑆^∗,𝐼^∗,𝐷^∗,𝑄^∗,𝑉^∗) is given by 𝐽𝐸^∗=𝑎₁𝑎₂𝑎₃𝑎₄𝛽𝐼^∗𝑎₅0𝑎₆0𝛼−𝛼𝑒^−𝜆𝜏000𝛼𝑒^−𝜆𝜏−𝑎₇0𝑎₈, (12) where 𝑎₁𝜇=−⁰𝐼^∗+𝑄^∗𝑁−𝜔−𝛽𝐼^∗,𝑎₂=𝑝𝜇₀𝑁−𝐷^∗𝑁−𝜇₀𝑆^∗𝑁−𝛽𝑆^∗,𝑎₃=−𝑝𝜇₀𝐼^∗+𝑄^∗𝑁,𝑎₄=𝑝𝜇₀𝑁−𝐷^∗−𝜇₀𝑆^∗𝑁,𝑎₅=𝛽𝑆^∗−𝛼−𝛾−2𝜇₀𝐼^∗+𝜇₀𝑄^∗𝑁,𝑎₆𝜇=−⁰𝐼^∗𝑁,𝑎₇=𝜇₀𝑄^∗𝑁,𝑎₈𝜇=−𝜑−⁰𝐼^∗+2𝜇₀𝑄^∗𝑁. (13) The characteristic equation of that matrix can be obtained by 𝑃(𝜆)+𝑄(𝜆)𝑒^−𝜆𝜏=0, (14) where 𝑃(𝜆)=𝜆⁴−𝑎₁+𝑎₅+𝑎₈𝜆³+𝑎₁𝑎₅+𝑎₁𝑎₈+𝑎₅𝑎₈+𝑎₆𝑎₇−𝑎₂𝛽𝐼^∗𝜆²+−𝑎₁𝑎₅𝑎₈−𝑎₁𝑎₆𝑎₇+𝑎₂𝑎₈𝛽𝐼^∗+𝑎₄𝑎₇𝛽𝐼^∗−𝑎₃𝛼𝛽𝐼^∗𝜆+𝑎₃𝑎₈𝛼𝛽𝐼^∗,𝑄(𝜆)=−𝑎₆𝛼𝜆²+𝑎₁𝑎₆𝛼−𝑎₄𝛼𝛽𝐼^∗+𝑎₃𝛼𝛽𝐼^∗𝜆−𝑎₃𝑎₈𝛼𝛽𝐼^∗. (15) Let 𝑏₃=−𝑎₁+𝑎₅+𝑎₈,𝑏₂=𝑎₁𝑎₅+𝑎₁𝑎₈+𝑎₅𝑎₈+𝑎₆𝑎₇−𝑎₂𝛽𝐼^∗𝑏₁=−𝑎₁𝑎₅𝑎₈−𝑎₁𝑎₆𝑎₇+𝑎₂𝑎₈𝛽𝐼^∗+𝑎₄𝑎₇𝛽𝐼^∗−𝑎₃𝛼𝛽𝐼^∗,𝑏₀=𝑎₃𝑎₈𝛼𝛽𝐼^∗,𝑐₂=−𝑎₆𝛼𝑐₁=𝑎₁𝑎₆𝛼−𝑎₄𝛼𝛽𝐼^∗+𝑎₃𝛼𝛽𝐼^∗,𝑐₀=−𝑎₃𝑎₈𝛼𝛽𝐼^∗. (16) Then 𝑃(𝜆)=𝜆⁴+𝑏₃𝜆³+𝑏₂𝜆²+𝑏₁𝜆+𝑏₀,𝑄(𝜆)=𝑐₂𝜆²+𝑐₁𝜆+𝑐₀. (17)

Theorem 2. The positive equilibrium 𝐸^∗ is locally asymptotically stable without time delay, if the following holds: (𝐻₂) 𝑏₃>0,𝑑₁>0,𝑏₁+𝑐₁>0,where 𝑑₁=𝑏₃𝑏₂+𝑐₂−𝑏₁+𝑐₁ (18) is satisfied.

Proof. If 𝜏=0, then (14) reduces to 𝜆⁴+𝑏₃𝜆³+𝑏₂+𝑐₂𝜆²+𝑏₁+𝑐₁𝜆+𝑏₀+𝑐₀=0. (19) Because 𝑏₀+𝑐₀=0, equation (19) can be further reduced to 𝜆³+𝑏₃𝜆²+𝑏₂+𝑐₂𝜆+𝑏₁+𝑐₁=0. (20)
According to Routh-Hurwitz criterion, all the roots of (20) have negative real parts. Therefore, it can be deduced that the positive equilibrium 𝐸^∗ is locally asymptotically stable without time delay. The proof is completed.

Obviously, 𝜆=𝑖𝜔 (𝜔>0) is a root of (14). After separating the real and imaginary parts, it can be written as 𝜔⁴−𝑏₂𝜔²+𝑏₀+𝑐₀−𝑐₂𝜔²cos(𝜔𝜏)+𝑐₁𝜔sin(𝜔𝜏)=0,−𝑏₃𝜔³+𝑏₁𝜔+𝑐₂𝜔²−𝑐₀sin(𝜔𝜏)+𝑐₁𝜔cos(𝜔𝜏)=0. (21)

From the two equations of (21), the following equation can be obtained: 𝑐²₁𝜔²+(𝑐²₂𝜔²−𝑐₀)²=𝜔⁴−𝑏₂𝜔²+𝑏₀²+𝑏₁𝜔−𝑏₃𝜔³², (22) which implies that 𝜔⁸+𝑚₃𝜔⁶+𝑚₂𝜔⁴+𝑚₁𝜔²+𝑚₀=0, (23) where 𝑚₃=𝑏²₃−2𝑏₂,𝑚₂=𝑏²₂+2𝑏₀−2𝑏₁𝑏₃−𝑐²₂,𝑚₁=𝑏²₁−𝑐²₁−2𝑏₂𝑏₀+2𝑐₀𝑐₂,𝑚₀=𝑏²₀−𝑐²₀. (24) Then (23) reduces to 𝜔⁶+𝑚₃𝜔⁴+𝑚₂𝜔²+𝑚₁=0. (25) Let 𝑧=𝜔². Then (25) can be written as ℎ(𝑧)=𝑧³+𝑚₃𝑧²+𝑚₂𝑧+𝑚₁, (26)Δ is defined as Δ=𝑚²₃−3𝑚₂. And we can get a solution 𝑧^∗=(√Δ−𝑚₃)/3 of ℎ(𝑧).

Lemma 3. Suppose that (𝐻₂)   𝑏₃>0,𝑑₁>0,   𝑏₁+𝑐₁>0 is satisfied.(i)If one of followings holds: (a) Δ>0, 𝑧^∗<0; (b) Δ>0, 𝑧^∗>0, and ℎ(𝑧^∗)>0, then all roots of (14) have negative real parts when 𝜏∈[0,𝜏₀), and 𝜏₀ is a certain positive constant.(ii)If the conditions (a) and (b) are not satisfied, then all roots of (14) have negative real parts for all 𝜏≥0.

Proof. When 𝜏=0, equation (14) can be reduced to 𝜆³+𝑏₃𝜆²+𝑏₂+𝑐₂𝜆+𝑏₁+𝑐₁=0. (27)
By the Routh-Hurwitz criterion, all roots of (20) have negative real parts if and only if 𝑏₃>0, 𝑑₁>0, and 𝑏₁+𝑐₁>0.
Considering (26), it is easy to see from the characters of cubic algebra equation that ℎ(𝑧) is a strictly monotonically increasing function if Δ≤0. If Δ>0 and 𝑧^∗<0 or Δ>0, 𝑧^∗>0 but ℎ(𝑧^∗)>0, then ℎ(𝑧) has no positive root. Thus, under these conditions, equation (14) has no purely imaginary roots for any 𝜏>0. In addition, this also implies that the positive equilibrium 𝐸^∗(𝑆^∗,𝐼^∗,𝐷^∗,𝑄^∗,𝑉^∗) of system (5) is absolutely stable. Therefore, the following theorem on the stability of positive equilibrium 𝐸^∗(𝑆^∗,𝐼^∗,𝐷^∗,𝑄^∗,𝑉^∗) can be easily obtained.

Theorem 4. Assume that (𝐻₁) and (𝐻₂) are satisfied and Δ>0 and 𝑧^∗<0 or Δ>0, 𝑧^∗>0, and ℎ(𝑧^∗)>0. Then the positive equilibrium 𝐸^∗(𝑆^∗,𝐼^∗,𝐷^∗,𝑄^∗,𝑉^∗) of system (5) is absolutely stable; that is to say 𝐸^∗(𝑆^∗,𝐼^∗,𝐷^∗,𝑄^∗,𝑉^∗) is asymptotically stable for any time delay 𝜏≥0.
It is assumed that the coefficients in ℎ(𝑧) satisfy the condition as follows: (𝐻₃) Δ>0,𝑧^∗>0,ℎ(𝑧^∗)<0.
Then, according to lemma in [15], it is known that (26) has at least a positive root 𝜔₀; namely, the characteristic equation (14) has a pair of purely imaginary roots ±𝑖𝜔₀.
In view of the fact that (14) has a pair of purely imaginary roots ±𝑖𝜔₀, the corresponding 𝜏_𝑘>0 is given by eliminating sin(𝜔𝜏) in (21): 𝜏_𝑘=1𝜔₀𝑏arccos²𝜔²₀−𝜔⁴₀−𝑏₀𝑐₀−𝑐₂𝜔²₀(𝑐₀−𝑐₂𝜔²₀)²+𝜔𝑏₃𝜔²−𝑏₁−𝑐₁+2𝑘𝜋𝜔₀(𝑘=0,1,2,…). (28)
Let 𝜆(𝜏)=𝑣(𝜏)+𝑖𝜔(𝜏) be the root of (14) so that 𝑣(𝜏_𝑘)=0 and 𝜔(𝜏_𝑘)=𝜔₀ are satisfied when 𝜏=𝜏_𝑘.

Lemma 5. Suppose that ℎ^′(𝑧₀)≠0. If 𝜏=𝜏₀, then ±𝑖𝜔₀ is a pair of simple purely imaginary roots of (14). In addition, if the conditions in Lemma 3 are satisfied, then 𝑑(Re𝜆)𝑑𝜏_{𝜏=𝜏𝑘}>0. (29)
This signifies that there exists at least one eigenvalue with positive real part for 𝜏>𝜏_𝑘. Differentiating both sides of (14) with respect to τ, it can be written as 𝑑𝜆𝑑𝜏⁻¹=4𝜆³+3𝑏₃𝜆²+2𝑏₂𝜆+𝑏₁+𝑐₁𝑒^−𝜆𝜏−𝑐₁𝜆+𝑐₀𝜏𝑒^−𝜆𝜏×𝑐₁𝜆+𝑐₀𝜆𝑒^{−𝜆𝜏−1}. (30) Therefore sgn𝑑Re𝜆𝑑𝜏_{𝜏=𝜏𝑘}=sgnRe𝑑𝜆𝑑𝜏⁻¹_{𝜆=𝑖𝜔0}𝜔=sgn²⁰Λ4𝜔⁶₀+3𝑚₃𝜔⁴₀+2𝑚₂𝜔²₀+𝑚₁𝜔=sgn²⁰Λℎ^′𝜔²₀=sgnℎ^′𝜔²₀, (31) where Λ=𝑐²₁𝜔⁴₀+𝑐₀𝜔²₀. Then it can be derived that 𝑑(Re𝜆)𝑑𝜏_{𝜏=𝜏𝑘}>0. (32)

It follows the hypothesis (𝐻₃) that ℎ^′(𝜔²₀)≠0. Therefore, transversality condition holds and the conditions for Hopf bifurcation are satisfied when 𝜏=𝜏_𝑘, according to Hopf bifurcation theorem [24] for functional differential equations. Then the following results can be obtained.

Theorem 6. Suppose that the conditions (𝐻₁) and (𝐻₂) are satisfied.(i)For system (5), the equilibrium 𝐸^∗(𝑆^∗,𝐼^∗,𝐷^∗,𝑄^∗,𝑉^∗) is locally asymptotically stable when 𝜏∈[0,𝜏₀) but unstable when 𝜏>𝜏₀.(ii)When condition (𝐻₃) is satisfied, system (5) will undergo a Hopf bifurcation at the positive equilibrium 𝐸^∗(𝑆^∗,𝐼^∗,𝐷^∗,𝑄^∗,𝑉^∗) when 𝜏=𝜏_𝑘 (𝑘=0,1,2,…), where 𝜏_𝑘 is defined by (28).

Theorem 2 implies to us that when birth and death rates and the mechanism of time window in intrusion detection system are considered, the length of time window is crucial for the stability of the propagation process. When time delay is less than the threshold 𝜏₀, the system will stabilize at its infection equilibrium point, which is beneficial to further implement containment strategies to eliminate worms. However, when time delay is greater than the threshold, the system will be unstable and undergo a bifurcation. Although the propagation of worm presents a periodical phenomenon, in real world, complicated environment may make the propagation pass the critical state and reach to an unpredictable chaos.

4. Numerical and Simulation Experiments

4.1. Numerical Experiments

The parameters of the delayed model will be chosen properly, according to the stability of the positive equilibrium, bifurcation analysis, and the practical environment. 500,000 hosts are picked as the population size, and the worm’s average scan rate is 𝜂=4000 per second. The worm infection rate can be calculated as 𝜀=𝜂𝑁/2³²=0.4657 [11], which means that average 0.4657 hosts of all the hosts can be scanned by one host. The infection ratio is 𝛽=𝜂/2³²=0.0000053. The rest of the parameters are 𝛾=0.03, 𝜇₀=0.026, 𝜔=0.00001, 𝛼=0.56, 𝜑=0.0009, and 𝑝=0.99. Initially, 𝐼(0)=50, which means that there are 50 infectious hosts while the rest of the hosts are susceptible at the beginning.

Figure 4 shows the curves of five kinds of hosts when 𝜏=5<𝜏₀. All of the five kinds of hosts get stable within 4 minutes, which illustrates that 𝐸^∗ is asymptotically stable. It implies that the number of infectious hosts maintain a constant level and thus can be predicted. Further strategies can be developed and utilized to eliminate worms. But when time delay 𝜏 gets increased and then reach the threshold 𝜏₀, 𝐸^∗ will lose its stability and a bifurcation will occur. Figure 5 shows the susceptible, infected, and recovered hosts when 𝜏>𝜏₀. In this firgure, we can clearly see that the number of infectious hosts will outburst after a short period of peace and repeat again and again but not in the same period.

Figure 4 

Worm propagation trend of the model when 𝜏<𝜏0.

Figure 5 

Worm propagation trend of the model when 𝜏>𝜏0.

In order to see the influence of time delay, 𝜏 is set to a different value each time with other parameters remaining the same. Figure 6 shows the number of infected hosts in the same coordinate with time delays 𝜏=5, 𝜏=15, 𝜏=45, and 𝜏=90, respectively.

Figure 6 

The number of 𝐼(𝑡) when 𝜏 is changed.

Figure 7 gives the four curves in four coordinates. In these two figures, the impact of time delay on infected hosts is evident. Initially, the four curves are overlapped which means that time delay has little effect in the initial stage of worm propagation. With the increase of time delay, the curve begins to oscillate. When time delay passes through the threshold 𝜏₀, the infecting process gets unstable. Then simultaneously, it can be discovered that the amplitude and period of the number of infected hosts get increased.

(a)

(b)

(c)

(d)

Figure 7 

The number of 𝐼(𝑡) when 𝜏 is changed.

Figure 8(a) shows the projection of the phase portrait of system (5) when 𝜏=15<𝜏₀ in (𝑆,𝐼,𝑉)-space. The curve converges to a fixed point which suggests that the system is stable. Figure 8(b) shows the projection of the phase portrait of system (5) when 𝜏=25>𝜏₀ in (𝑆,𝐼,𝑉)-space. The curve converges to a limit circle which implies that the system is unstable. Figures 8(c) and 8(d) show the phase portraits of susceptible 𝑆(𝑡) and infected 𝐼(𝑡) as 𝜏=15<𝜏₀ and 𝜏=25>𝜏₀, respectively.

(a) The projection of the phase portrait in (𝑆,𝐼,𝑅)-space when 𝜏<𝜏0

(b) The projection of the phase portrait in (𝑆,𝐼,𝑅)-space when 𝜏>𝜏0

(c) The phase portrait of susceptible 𝑆(𝑡) and infected 𝐼(𝑡) when 𝜏<𝜏0

(d) The phase portrait of susceptible 𝑆(𝑡) and infected 𝐼(𝑡) when 𝜏>𝜏0

Figure 8 

The phase portrait when 𝜏<𝜏0 and 𝜏>𝜏0.

4.2. Simulation Experiments

The discrete-time simulation is an expanded version of Zou’s program simulating Code Red worm propagation and has been modified to run on a Linux server. The system in our simulation experiment consists of 500,000 hosts that can reach each other directly, which is consistent with the numerical experiments, and there is no topology issue in our simulation. At the beginning of simulation, 50 hosts are randomly chosen to be infectious and the others are all susceptible.

Identical with the results of numerical experiments, Figure 9 shows all five kinds of hosts when 𝜏=5<𝜏₀. We find that the model will reach a stable state after a short period of time, which suggests that the number of infetious hosts can be predicted and we can develop further strategy to eliminate worms.

Figure 9 

Simulation result of the five kinds of hosts when 𝜏<𝜏0.

When time delay increases but is less than the threshold derived from theoretical analysis, the number of infectious hosts and other hosts present a damped oscillation and finally reach an approximately stable state. Figure 10 shows the number of five kinds of hosts when 𝜏=15<𝜏₀. An interesting result is that the number of each host maintain a slight random vibration. However, the overall amplitude is only 0.273% to the population size, and the maximum amplitude is only 0.953% to the population size. The reason why this phenomenon occurs is due to the random events in simulation experiments. The implement of transition rates of the model is based on probability. That is to say, when the removal rate of infectious hosts is set to 0.03, it means that the probability of transition from infectious hosts to vaccinated state is 3%; it also means that infectious hosts get patched with probability of 3%. To investigate this phenomenon, phase portrait of susceptible 𝑆(𝑡) and infected 𝐼(𝑡) is depicted when 𝜏=15<𝜏₀ as shown Figure 11. It shows that the curve is converged to a fixed point, which means that the system gets stable.

Figure 10 

Simulation result of the five kinds of hosts when 𝜏=15.

Figure 11 

The phase portrait of susceptible 𝑆(𝑡) and infected 𝐼(𝑡) when 𝜏=15.

When time delay passes the threshold, a bifurcation appears. Figure 12 shows the number of susceptible, infectious and vaccinated hosts when 𝜏>𝜏₀. Figure 13 shows the difference between simulation and numerical results of susceptible and infectious hosts, respectively. In this figure, the periods of these two curves are well matched, which suggests that the results of numerical and simulation experiments are identical. But there is a difference of 9.6% of total population size in amplitudes. This mainly results from the precision of experiments. The number of hosts in numerical experiments can be either integers or decimals because it is the solution of differential equations. However, in simulation experiments, the number of hosts must be integers. Furthermore, when the number of infectious hosts are very little, this tiny difference will result in a big gap afterwards.

Figure 12 

Simulation result of the three kinds of hosts when 𝜏>𝜏0.

(a) The comparison of the number of susceptible hosts

(b) The comparison of the number of infectious hosts

Figure 13 

The comparison of numerical and simulation experiments.

5. Conclusions

In order to accord with actual facts in the real world, time delay generated by time window in IDS is introduced to construct the worm propagation model. Dynamic birth and death rates are considered in this paper, accounting for the reinstallation of OS which users are more likely to do after when the hosts suffer worm’s destruction or quarantined to the Internet. In addition, combined with birth and death rates, time delay may lead to bifurcation and make the worm propagation system unstable.

In this paper, a delayed worm propagation model with birth and death rates is studied. Next, the stability of the positive equilibrium is analyzed. Through theoretical analysis and numerical and simulation experiments, the following conclusions can be derived.(i)The introduction of time window in IDS may lead to time delay in worm propagation model, which results in bifurcation. The critical time delay 𝜏₀ where the bifurcation appears is obtained.(ii)The worm propagation system is stable when time delay 𝜏<𝜏₀. In this situation, the worm propagation can be easily predicted and eliminated.(iii)A bifurcation emerges when time delay 𝜏≥𝜏₀, which means the worm propagation is unstable and may be out of control.

Consequently, time delay 𝜏 should remain less than 𝜏₀ by decreasing the time window in IDS, which is helpful to predict the worm propagation and even eliminate the worm.

In this paper, we have only discussed the cases which satisfy conditions (𝐻₁), (𝐻₂), and (𝐻₃). But for cases that satisfy (𝐻₁), (𝐻₂), and (𝐻₃), the dynamical behavior of this model has not been studied. These issues will be studied and discussed in our future work.

Acknowledgments

The authors are very grateful to the anonymous referee for many valuable comments and suggestions which led to a significant improvement of the original paper. This paper is supported by the National Natural Science Foundation of China under Grant no. 60803132; the Natural Science Foundation of Liaoning Province of China under Grant no. 201202059; Program for Liaoning Excellent Talents in University under LR2013011; the Fundamental Research Funds of the Central Universities under Grant nos. N120504006 and N100704001; and MOE-Intel Special Fund of Information Technology (MOE-INTEL-2012-06).