Modeling Computer Virus and Its Dynamics

Abstract

Based on that the computer will be infected by infected computer and exposed computer, and some of the computers which are in suscepitible status and exposed status can get immunity by antivirus ability, a novel coumputer virus model is established. The dynamic behaviors of this model are investigated. First, the basic reproduction number 𝑅₀, which is a threshold of the computer virus spreading in internet, is determined. Second, this model has a virus-free equilibrium 𝑃⁰, which means that the infected part of the computer disappears, and the virus dies out, and 𝑃⁰ is a globally asymptotically stable equilibrium if 𝑅₀<1. Third, if 𝑅₀>1 then this model has only one viral equilibrium 𝑃^∗, which means that the computer persists at a constant endemic level, and 𝑃^∗ is also globally asymptotically stable. Finally, some numerical examples are given to demonstrate the analytical results.

1. Introduction

Computer virus is a malicious mobile code which including virus, Trojan horses, worm, and logic bomb. It is a program that can copy itself and attack other computers. And they are residing by erasing data, damaging files, or modifying the normal operation. Due to the high similarity between computer virus and biological virus [1], various computer virus propagation models are proposed [2–4]. This dynamical modeling of the spread process of computer virus is an effective approach to the understanding of the behavior of computer viruses because on this basis, some effective measures can be posed to prevent infection.

The computer virus has a latent period, during which individuals are exposed to a computer virus but are not yet infectious. An infected computer which is in latency, called exposed computer, will not infect other computers immediately; however, it still can be infected. Based on these characteristics, delay is used in some models of computer virus to describe that although the exposed computer does not infect other computers, it still has infectivity [5, 6]. Yang et al. [7, 8] proposed an SLB and SLBS models; in these models, the authors considered that the computer virus has latency, and the computer also has infectivity in the period of latency. However, they do not show the length of latency and take into account the impact of artificial immunization ways such as installing antivirus software. And the newly entered in the internet from the susceptible status to exposed status, the contact rate is the same as that of susceptible status entering into infected status. In this paper, a novel model of computer virus, known as SEIR model, is put forward to describe the susceptible computer which can be infected by the other infected or exposed computer and come into the exposed status. In the SEIR model, based on artificial immunity, we consider the bilinear incidence rate for the latent and infection status. Assume that the computers which newly entered the internet are susceptible, the computers correspond with exposed computers, and their adequate contact rate is denoted by  𝛽₁, and computers also correspond with infected computers, and their adequate contact rate is denoted by 𝛽₂. So, the fraction of the computer which newly entered the internet will enter the class 𝑅 by anti-virus software; the fraction of computers contact with exposed and infected computer will stay latent before becoming infectious and enter the class 𝐸. It is shown that the dynamic behavior of the proposed model is determined by a threshold  𝑅₀, and this model has a virus-free equilibrium  𝑃⁰, and 𝑃⁰  is a globally asymptotically stable equilibrium if  𝑅₀<1; if 𝑅₀>1  this model has only one viral equilibrium  𝑃^∗, and it is globally asymptotically stable.

This paper is organized as follows. Section 2 formulates a novel computer virus mode. Section 3 proves the global stability of the virus-free equilibrium. Section 4 discusses the stability of the viral equilibrium. In Section 5, numerical simulations are given to present the effectiveness of the theoretic results. Finally, Section 6 summarizes this work.

2. Model Formulation

At any time, a computer is classified as internal and external depending on weather it is connected to internet or not. At that time, all of the internet computers are further categorized into four classes: (1) susceptible computers, that is, uninfected computers and new computers which connected to network; (2) exposed computers, that is, infected but not yet broken-out; (3) infectious computers; (4) recovered computers, that is, virus-free computer having immunity. Let 𝑆(𝑡),  𝐸(𝑡),  𝐼(𝑡),  𝑅(𝑡) denote their corresponding numbers at time 𝑡, without ambiguity;  𝑆(𝑡),  𝐸(𝑡),  𝐼(𝑡),  𝑅(𝑡) will be abbreviated as  𝑆,  𝐸,  𝐼,  𝑅, respectively. The model is formulated as the following system of differential equations: 𝑆^′=1−𝑝𝑁−𝛽₁𝑆𝐼−𝛽₂𝐸𝑆𝐸−𝑝𝑆−𝜇𝑆,_′=𝛽₁𝑆𝐼+𝛽₂𝐼𝑆𝐸−𝑘𝐸−𝛼𝐸−𝜇𝐸,_′𝑅=𝛼𝐸−𝑟𝐼−𝜇𝐼,_′𝑁(𝑡)(𝑡)(𝑡)(𝑡)(𝑡).=𝑝𝑆+𝑘𝐸+𝑟𝐼,=𝑆+𝐸+𝐼+𝑅 (1)(2)

We may see that the first three equations in (1) are independent of the fourth equation, and therefore, the fourth equation can be omitted without loss of generality. Hence, system (1) can be rewritten as 𝑆^′=𝐴−𝛽₁𝑆𝐼−𝛽₂𝐸𝑆𝐸−𝑎𝑆,_′=𝛽₁𝑆𝐼+𝛽₂𝐼𝑆𝐸−𝑏𝐸,_′=𝛼𝐸−𝑐𝐼. (3)

Therefore, 𝑎=𝑝+𝜇,𝑏=𝑘+𝛼+𝜇,𝑐=𝑟+𝜇,1−𝑝𝑁=𝐴, (4) where 𝑁 denotes the rate at which external computers are connected to the network;  𝑝  denotes the recovery rate of susceptible computer due to the anti-virus ability of network;  𝑘  denotes the recovery rate of exposed computer due to the anti-virus ability of network;  𝛽₁  denotes the rate at which, when having a connection to one infected computer, one susceptible computer can become exposed but has not broken-out;  𝛽₂  denotes the rate of which, when having connection to one exposed computer, one susceptible computer can become exposed;  𝛼  denotes the rate of the exposed computers cannot be cured by anti-virus software and broken-out;  𝑟  denotes the recovery rate of infected computers that are cured;  𝜇  denotes the rate at which one computer is removed from the network. All the parameters are nonnegative.

Moreover, all feasible solutions of the system (3) are bounded and enter the region  𝐷, where 𝐷=(𝑆,𝐸,𝐼)∈𝑅³₊𝐴∣𝑆≥0,𝐸≥0,𝐼≥0,𝑆+𝐸+𝐼≤𝑎. (5)

Referring to [9], we define the basic reproduction number of the infection as 𝑅₀=𝐴𝛽₁𝛼+𝛽₂𝑐.𝑎𝑏𝑐 (6)

For system (3), there always exists the virus-free equilibrium which is  𝑃⁰(𝐴/𝑎,0,0); if  𝑅₀>1, then there also exists a viral equilibrium  𝑃^∗(𝑆^∗,𝐸^∗,𝐼^∗).

Therefore, 𝑆^∗=𝐴𝑎𝑅₀,𝐸^∗=𝐴𝑅₀−1𝑏𝑅₀,𝐼^∗=𝐴𝛼𝑅₀−1𝑏𝑐𝑅₀. (7)

3. The Virus-Free Equilibrium and Its Stability

Theorem 1. 𝑃⁰  is locally asymptotically stable if 𝑅₀<1. Whereas 𝑃⁰  is unstable if  𝑅₀>1.

Proof. The characteristic equation of (3) at  𝑃⁰  is given by det𝜆+𝑎−𝛽₂𝑆−𝛽₁𝑆0𝜆−𝛽₂𝑆−𝑏𝛽₁𝑆0𝛼𝜆+𝑐=0, (8) which equals to (𝜆+𝑎)𝜆²−𝛽₂𝑆⁰−𝑏−𝑐𝜆−𝑏𝑐𝑅₀−1=0. (9) Then, (9) has negative real part characteristic roots: 𝜆₁𝜆=−𝑎,_2,3=𝛽₂𝑆−𝑏−𝑐±𝛽₂𝑆−𝑏−𝑐²+4𝑎𝑏𝑐𝑅₀−12, (10) where 𝛽₂𝑆−𝑏−𝑐<0. (11)
When 𝑅₀<1, there are no positive real roots of (9) and thus 𝑃⁰ is a local asymptotically stable equilibrium. While  𝑅₀>1, (9) has positive real roots, which means 𝑃⁰ is unstable.
The proof is completed.

Theorem 2. 𝑃⁰ is globally asymptotically stable with respect to 𝐷  if  𝑅₀<1.

Proof. Let 𝐿=((𝛽₁𝑐+𝛽₂𝛼)/𝑏𝑐)𝐸+𝛽₂𝐼/𝑐.
Obviously 𝐿>0, (12) thus 𝐿^′=𝛽₁𝑐+𝛽₂𝛼𝐸𝑏𝑐^′+𝛽₂𝑐𝐼^′=𝛽₁𝑐+𝛽₂𝛼𝛽𝑏𝑐¹𝑆𝐼+𝛽₂+𝛽𝑆𝐸−𝑏𝐸²𝑐()=𝛽𝛼𝐸−𝑐𝐼₁𝑐+𝛽₂𝛼𝛽𝑏𝑐¹𝐼+𝛽₂𝐸𝛽𝑆−¹𝑐+𝛽₂𝛼+𝛽𝑏𝑐𝑏𝐸₂𝛼𝐸𝑐−𝛽₂𝐼=𝛽₁𝑐+𝛽₂𝛼𝛽𝑏𝑐¹𝐼+𝛽₂𝐸𝑆−𝛽₁𝐸−𝛽₂𝐼=𝛽₁𝐸+𝛽₂𝐼𝛽₁𝑐+𝛽₂𝛼=𝛽𝑏𝑐𝑆−1₁𝐸+𝛽₂𝐼1⋅𝐴𝑏𝑐𝑎⋅𝑅₀𝑎𝑏𝑐𝐴=𝛽−1₁𝐸+𝛽₂𝐼𝑅₀−1<0. (13) The proof is completed.

4. The Viral Equilibrium and Its Stability

Theorem 3. 𝑃^∗ is locally asymptotically stable if 𝑅₀>1.

Proof. The Jacobin matrix of system (3) about 𝑃^∗ is given by 𝐽^∗=−𝑎𝑅₀−𝛽₂𝑆^∗−𝛽₁𝑆^∗𝑎𝑅₀−1𝛽₂𝑆^∗−𝑏𝛽₁𝑆^∗0𝛼−𝑐, (14) which equals to 𝑓(𝜆)=𝑎₀𝜆³+𝑎₁𝜆²+𝑎₂𝜆+𝑎₃=0, (15) where 𝑎₀𝑎=1,₁=𝑎𝑅₀−𝛽₂𝑆^∗𝑎−𝑏−𝑐>0,₂=𝑎𝑏𝑅₀+𝑎𝑐𝑅₀−𝑎𝛽₂𝑆^∗>𝑎𝑏𝑅₀+𝑎𝑐𝑅₀()()𝑅−𝑎𝑏+𝑐=𝑎𝑏+𝑐₀−1>0, (16) where 𝛽₂𝑆^∗𝑎<𝑏+𝑐,₃=𝑎𝑏𝑐𝑅₀−1>0. (17) Thus, Δ₁=𝑎₁Δ>0,₂=𝑎₁1𝑎₃𝑎₂=𝑎₁𝑎₂−𝑎₃Δ>0,₃=𝑎₁𝑎10₃𝑎₂𝑎₁00𝑎₃=𝑎₃𝑎₁𝑎₂−𝑎₃>0. (18)
According to the Hurwitz criterion, all roots of (15) have negative real pats. Thus, the claimed result follows. The proof is completed.

The following result can be proved in the same way (see [9]).

Theorem 4. 𝑃^∗ is uniquely globally asymptotically stable if  𝑅₀>1.

Proof. The Jacobin matrix of system (3) about 𝑃^∗ is given by 𝐽^∗=−𝑎𝑅₀−𝛽₂𝑆^∗−𝛽₁𝑆^∗𝑎𝑅₀−1𝛽₂𝑆^∗−𝑏𝛽₁𝑆^∗0𝛼−𝑐. (19)
The second compound matrix 𝐽^[2] of the Jacobin matrix can be calculated as follows (see [10, 11]): 𝐽^[2]=−𝑎𝑅₀+𝛽₂𝑆^∗−𝑏𝛽₁𝑆^∗𝛽₁𝑆^∗𝛼−𝑎𝑅₀−𝑐−𝛽₂𝑆^∗0𝑎𝑅₀−1𝛽₂𝑆−𝑏−𝑐. (20) Set 𝑃 as the following diagonal matrix: 𝑃(𝑥)=𝐸1,𝐼,𝐸𝐼. (21)
Denote that 𝑃_𝑓𝑃⁻¹𝐸=diag0,^′𝐸−𝐼^′𝐼,𝐸^′𝐸−𝐼^′𝐼. (22)
Therefore, the matrix 𝐵=𝑃_𝑓𝑃⁻¹+𝑃𝐽^[2]𝑃⁻¹ can be written in the following block form: 𝐵𝐵=¹¹𝐵₁₂𝐵₂₁𝐵₂₂, (23) with 𝐵₁₁=−𝑎𝑅₀+𝛽₂𝑆^∗𝐵−𝑏,₁₂=𝐼𝐸𝛽₁𝑆^∗(),𝐵1,1₂₁=𝐸𝐼(𝛼,0)^𝑇,𝐵₂₂=𝐸^′𝐸−𝐼^′𝐼−𝑎𝑅₀+𝑐−𝛽₂𝑆^∗𝑎𝑅₀𝐸−1^′𝐸−𝐼^′𝐼+𝛽₂,𝑆∗−𝑏−𝑐 (24) thus 𝜇₁𝐵₁₁=𝛽₂𝑆^∗−𝑎𝑅₀𝜇−𝑏,₁𝐵₂₂𝐸=max^′𝐸−𝐼^′𝐼−𝑎𝑅₀−𝑐+𝑎𝑅₀𝐸−𝑎,_′𝐸−𝐼^′𝐼+𝛽₂𝑆∗−𝑏−𝑐−𝛽₂𝑆^∗=𝐸^′𝐸−𝐼^′𝐼−𝑐−𝑎. (25) The vector norm ‖⋅‖ in 𝑅³≅𝑅³² is choosen as ‖(𝑢,𝑣,𝑤)‖=max{|𝑢|,|𝑣+𝑤|}. (26) The Lozinskii measure 𝜇(𝐵) with respect to ‖⋅‖ is as follows (see [12]): 𝜇(𝐵)≤sup𝑔₁,𝑔₂, (27) where 𝑔₁=𝜇₁𝐵₁₁+𝐵₁₂=𝛽₂𝑆^∗−𝑎𝑅₀𝐼−𝑏+𝐸𝛽₁𝑆^∗,𝑔₂=𝜇₁𝐵₂₂+𝐵₂₁=𝐸^′𝐸−𝐼^′𝐼𝐸−𝑎−𝑐+𝐼𝛼. (28) From (3), we find that 𝐼𝐸𝛽₁𝑆^∗=𝐸^′𝐸−𝛽₂𝑆^∗𝐼+𝑏,_′𝐼=𝐸𝐼𝛼−𝑐, (29) thus 𝑔₁=𝐸^′𝐸−𝑎𝑅₀,𝑔₂=𝐸^′𝐸−𝑎. (30) Relations (28)–(30) imply that 𝜇(𝐵)≤𝐸^′𝐸−𝑎. (31) Thus, 1𝑡^𝑡₀𝜇(𝐵)1𝑑𝜏≤𝑡^𝑡₀𝐸^′𝐸1−𝑎𝑑𝜏=𝑡𝐸(𝑡)ln𝐸(0)−𝑎. (32)
If  𝑅₀>1, then the virus-free equilibrium is unstable by Theorem 1. Moreover,  the behavior of the local dynamic near  𝐷₀  as described in Theorem 1 implies that the system (3) is uniformly persistent in 𝐷; that is, there exists a constant 𝑐₁>0 and 𝑇>0, such that 𝑡>𝑇  implies that lim_𝑡→∞inf𝑆(𝑡)>𝑐₁,lim_𝑡→∞inf𝐸(𝑡)>𝑐₁,lim_𝑡→∞inf𝐼(𝑡)>𝑐₁,lim_𝑡→∞inf[1−𝑆(𝑡)−𝐸(𝑡)−𝐼(𝑡)]>𝑐₁. (33) For all (𝑆(0),𝐸(0),𝐼(0)∈𝐷) (see [13, 14]), 𝑞=lim_𝑡→∞supsup_𝑥∈𝐾1𝑡^𝑡₀𝜇(𝐵)𝑎𝑑𝜏≤−2<0. (34) The proof is complete.

5. Numerical Examples

For the system (3), Theorem 2 implies that the virus dies out if  𝑅₀<1, and Theorem 4 implies that the virus persists if  𝑅₀>1. Now, we present two numerical examples.

Let  𝑝=0.5,  𝜇=0.02,  𝑘=0.4,  𝛼=0.6,  𝑟=0.6,  𝑁=100,  𝛽₁=0.7,  𝛽₂=0.8,  then  𝑅₀=13.8>1 and  𝛽𝑆^∗<𝑏+𝑐; Figure 1 shows the solution of system (3) when  𝑅₀>1. We can see that the viral equilibrium 𝑃^∗ of system (3) is globally asymptotically stable.

Figure 1 

Dynamical behavior of system (3). Time series of susceptible, exposed, and infectious computers 𝑆(𝑡),  𝐸(𝑡),  𝐼(𝑡) with 𝑅0>1.

Let  𝑝=0.7,  𝜇=0.001,  𝑘=0.02,  𝛼=0.09,  𝑟=0.04,  𝑁=10,  𝛽₁=0.002,  𝛽₂=0.003,  then  𝑅₀=0.1808<1 and  𝛽₂𝑆⁰<𝑏+𝑐; Figure 2 shows the solution of system (3) when 𝑅₀<1. We can see that the virus-free equilibrium  𝑃⁰ of the system (3) is globally asymptotically stable.

Figure 2 

Dynamical behavior of system (3). Time series of susceptible, exposed, and infectious computers 𝑆(𝑡),  𝐸(𝑡),  𝐼(𝑡) with 𝑅0<1.

6. Conclusion

We assume that the virus process has a latent period and in these times the infected computers have infectivity also. A compartmental SEIR model for transmission of virus in computer network is formulated. In this paper, the dynamics of this model have been fully studied.

The results show that we should try our best to make 𝑅₀ less than 1. The most effective way is to increase the parameters 𝑝,  𝑘,  𝑟 and decrease 𝛽₁,  𝛽₂,  𝛼 and so on. Maybe in such way, the computer virus can be well predicted and thus controlled.

Acknowledgment

The work described in this paper was supported by the Science and Technology Project of Chongqing Education Committee under Grant KJ130519.