Abstract

Internet worms exploiting zero-day vulnerabilities have drawn significant attention owing to their enormous threats to Internet in the real world. To begin with, a worm propagation model with time delay in vaccination is formulated. Through theoretical analysis, it is proved that the worm propagation system is stable when the time delay is less than the threshold and Hopf bifurcation appears when time delay is equal to or greater than . Then, a worm propagation model with constant quarantine strategy is proposed. Through quantitative analysis, it is found that constant quarantine strategy has some inhibition effect but does not eliminate bifurcation. Considering all the above, we put forward impulsive quarantine strategy to eliminate worms. Theoretical results imply that the novel proposed strategy can eliminate bifurcation and control the stability of worm propagation. Finally, simulation results match numerical experiments well, which fully supports our analysis.

1. Introduction

With the rapid growth of information technologies and network applications, severe challenges, in form of requirement of a suitable defense system, have been posed to make sure of the safety of the valuable information stored on system and in transit. For example, worms that exploit zero-day vulnerabilities have brought severe threats to Internet security in the real world. To date, none of the patches could effectively and reliably immunize the hosts thoroughly against being attacked by those worms. It may take a period of time for users to immunize their computers if they are in infected state. In addition, the failure of some vaccination measures or worm-variants may also lead to high risks that the hosts being immunized would be infected again. On the other hand, the propagation of worms in a system of interacting computers could be compared to contagious diseases in human population. In computer science field, computers are like individuals in an ecological system and thus the same mechanism of birth and death should be considered. Being infected by network worms or quarantined by IDS (intrusion detection systems), hosts will become dangerous and their owners will have to reinstall the system. Another factor to consider is that when new computers are brought, most of them have preinstalled operating systems but without newest safety patches while old computers are discarded and recycled. Consequently, in order to imitate the real world, birth and death rates should be introduced to worm propagations model.

Considering all the above, we firstly construct a worm propagation model with time delay in vaccination based on the classical epidemic Kermack-Mckendrick model [1] to describe the current situation. Through theoretical analysis, it is proved that Hopf bifurcation appears when time delay is equal to or greater than the threshold , which leads the number of infected hosts to be unpredictable and the propagation of worms to be out of control. In order to make up the deficiency of vaccination strategy and eliminate the negative impact of time delay, quarantine strategies are proposed to improve vaccination effect and eliminate bifurcation. The current quarantine strategy generally depends on the intrusion detection system, which can be classified into two categories: misuse and anomaly intrusion detection. Misuse intrusion detection system can accurately detect known worms. Based on misuse intrusion detection system, we propose constant quarantine strategy. Although it does improve vaccination effect, the system is still out of control and Hopf bifurcation is not eliminated either. Furthermore, the system fails to detect unknown worms and worm-variants. Anomaly intrusion detection system is of help in detecting these kinds of worm. However, it is always accompanied by high false-positive rate.

Consequently, this paper proposes a worm propagation model with impulsive quarantine strategy based on a hybrid intrusion detection system that combines both misuse and anomaly intrusion detection to make up for the gaps existing in the two systems. After adoption impulsive quarantine strategy, it is clearly proved that Hopf bifurcation is eliminated thoroughly so that the system is stable.

The rest of the paper is organized as follows. In the next section, related work on time delay and quarantine strategy is introduced. Section 3 provides a worm propagation model with time delay in vaccination. In Section 4, we construct a delayed worm propagation model with constant quarantine and analyze it in detail. Then, in Section 5, a delayed worm propagation model using impulsive quarantine strategy is proposed, and its analysis is performed. Section 6 presents numerical analyses and simulation experiments based on Slammer worm. Simulation results match well with numerical ones. Finally, Section 7 gives the conclusions.

2. Related Work

With the similarity between Internet worms and biological diseases, epidemiological models have been widely used in modeling the propagation of worms [2–6]. To make the worm transmission in computer network work as in the real word, the research within the data-driven framework has been done [7–9]. Although some human factors are included, these models cannot restrain worms effectively. Thus, a variety of containment strategies have been applied to worm propagation models. As far as we know, the use of quarantine strategies has produced a great effect on controlling disease. People use quarantine strategies widely in worm containment enlightened by this [10–16]. In addition, some scholars have done research on time delay [17–19].

However, previous studies have failed to consider the appropriate quarantine strategy to eliminate the negative effect of time delay. For instance, the pulse quarantine strategy that Yao has proposed [12] does lead to worm elimination with a relatively low value, but time delay is not considered, which leads to Hopf bifurcation so that the worm propagation system will be unstable and out of control. In this paper, constant quarantine and impulsive quarantine strategies are proposed to constrain the worms spreading and even eliminate Hopf bifurcation.

3. Worm Propagation Model with Time Delay in Vaccination

With regard to worms exploiting zero-day vulnerabilities, none of the patches could effectively and reliably immunize the hosts. After the hosts are being infected, some measures, such as cutting off the network connection, running manual antivirus, or setting firewall, are taken to remove the worms. With these measures being carried out, the hosts cannot further infect other susceptible hosts, but they are in fact not vaccinated completely. Namely, detecting and cleaning worms take a period of time. Therefore, time delay should be considered in actual conditions. Since time delay exists, infected hosts go through a temporary state (delayed) after vaccination. Consequently, on the basis of KM model, we give a worm propagation model with time delay in vaccination. We assume all hosts are in one of four states: susceptible state (S), infected state (I), delayed state (D), and vaccinated state (V). The state transition diagram of the delayed model is given in Figure 1.

Figure 1 

State transition diagram of delayed model.

Let denote the number of susceptible hosts at time , denote the number of infected hosts at time , denote the number of delayed hosts at time , and denote the number of vaccinated hosts at time . is the infection rate at which susceptible hosts are infected by infected hosts and is the rate of removal of infected from circulation. As worms and worm-variants exist, is the rate that vaccinated hosts back to susceptible hosts. The newborn hosts enter the system with the same rate , of which a portion is recovered by installing patches at birth. Time delay is denoted by .

In order to show it clearly, we list in Notations section some frequently used notations in this paper.

3.1. Description of Delayed Model

From the above definitions in the paper, we write down the complete differential equations of the delayed model: As mentioned above, the population size is set , which is set to unity:

3.2. Stability of the Positive Equilibrium and Bifurcation Analysis

Theorem 1. The system has a unique positive equilibrium when it satisfies the following condition: , where , , .

Proof. For system (1), if all the derivatives on the left of equal sign of the system are set to 0, which implies that the system becomes stable, we can derive Substituting the value of each variable in (3) for each of (2), then we can derive
Obviously, if is satisfied, (4) has one unique positive root and there is one unique positive equilibrium of system (1). The proof is completed.

According to (2), ; thus, system (1) can be simplified to The Jacobi matrix of (5) about is given by The characteristic equation of that matrix can be obtained by Let Then , .

Theorem 2. The positive equilibrium is locally asymptotically stable without time delay, if the following holds:.

Proof. If , (7) reduces to
According to Routh-Hurwitz criterion, all the roots of (9) have negative real parts. Therefore, it can be deduced that the positive equilibrium is locally asymptotically stable without time delay. The proof is completed.

Obviously, is a root of (7). After separating the real and imaginary parts, it can be written as which implies where

Let ; (12) can be written as is defined as . Hence, we can get a solution of .

Lemma 3. Suppose that , ; is satisfied.(1)If one of the following holds: (a) , ; (b) , ; and , then all roots of (7) have negative real parts when and is a certain positive constant.(2)If the conditions (a) and (b) are not satisfied, then all roots of (7) have negative real parts for all .

Proof. When , (7) can be reduced to
By the Routh-Hurwitz criterion, all roots of (9) have negative real parts and only if
Considering (14), it is easy to see from the characters of cubic algebraic equation that is a strictly monotonically increasing function if . If , or , and , then has no positive root. Hence, (7) has no purely imaginary roots for any , which implies that the positive equilibrium of system (1) is absolutely stable. Therefore, the following theorem on the stability of positive equilibrium can be easily obtained.

Theorem 4. Assume that and are satisfied, and , or , . and , then the positive equilibrium of system (1) is absolutely stable. Namely, is asymptotically stable for any time delay .

Assume that the coefficients in satisfy the condition as follows:, .

According to lemma, it is proved that (14) has at least a positive root , namely, the characteristic equation (7) has a pair of purely imaginary roots .

In view of the fact that (7) has a pair of purely imaginary roots , the corresponding is given by eliminating in (10) and (11): Let be the root of (7), so that and are satisfied when .

Lemma 5. Suppose . If , then is a pair of purely imaginary roots of (7). In addition, if the conditions in Lemma 3 are satisfied, then
This signifies that there exists at least one eigenvalue with positive real part for . Differentiating both sides of (7) with respect to , it can be written as Therefore, where ; then it follows the hypothesis that .
Hence,
The root of characteristic equation (7) crosses from left to right on the imaginary axis as continuously varies from a value less than to one greater than according to Routh’s theorem. Therefore, according to the Hopf bifurcation theorem [20] for functional differential equations, the transverse condition holds and the conditions for Hopf bifurcation are satisfied at . Then the following result can be obtained.

Theorem 6. Suppose that the conditions and are satisfied.(1)The equilibrium is locally asymptotically stable when , but unstable when .(2)If condition is satisfied, the system will undergo Hopf bifurcation at the positive equilibrium when , where is defined by (17).
This implies that when time delay , the system will stabilize at its infection equilibrium point, which is beneficial to implement a containment strategy; when , the system will be unstable and worms cannot be effectively controlled.

4. A Delayed Worm Propagation Model with Constant Quarantine

Enlightened by the methods in disease control, quarantine is selected as an effective way to diminish the speed of worm propagation. The current quarantine strategy generally depends on the intrusion detection system, which can be classified into two categories: misuse and anomaly intrusion detection [12]. As the delayed model cannot make sure of the system stable and controlled, quarantine strategies should be taken into consideration to further control the worm propagation.

4.1. Using Constant Quarantine Strategy to Model a Delayed Worm Propagation

Misuse intrusion detection system builds a database with the feature of known attack behaviors. The system can recognize the invaders once their behaviors agree with one of the databases and accurately detect known worms [12]. By applying misuse intrusion detection system for its relatively high accuracy, we add a new state called quarantine state () [9], but only infected hosts will be quarantined. denote the number of quarantined hosts at time . Unlike the quarantine strategy against epidemics, the implementation of constant quarantine strategy depends on the misuse intrusion detection system. Infected hosts will be quarantined at rate which depends on the performance of intrusion detection system and network devices. When infected hosts are quarantined, they will get rid of worms and get patched at rate . The state transition diagram of constant quarantine model is given in Figure 2.

Figure 2 

State transition diagram of constant quarantine model.

4.2. Description of Constant Quarantine Model

According to the definitions above in the paper, the differential equations of constant quarantine model are given as follows: Similarly,

4.3. Stability of the Positive Equilibrium and Bifurcation Analysis

Theorem 7. The system has a unique positive equilibrium when it satisfies the following condition:, where , , , .

Proof. For system (22), if all the derivatives on the left of equal sign of the system are set to 0, which implies that the system becomes stable, we can get
Substituting the value of each variable in (24) for each of (23), then we can get
Obviously, if is satisfied, (25) has one unique positive root , and there is one unique positive equilibrium of system (22). The proof is completed.

According to (23), ; thus, system (22) can be simplified to The Jacobi matrix of (26) about is given by The characteristic equation of that matrix can be obtained by Let where then

Theorem 8. The positive equilibrium is locally asymptotically stable without time delay, if the following holds:, , ,where

Proof. If , (28) reduces to
According to Routh-Hurwitz criterion, all the roots of (33) have negative real parts. Therefore, it can be deduced that the positive equilibrium is locally asymptotically stable without time delay. The proof is completed.

Obviously, is a root of (28). After separating the real and imaginary parts, it can be written as which implies where

Let , and (35) can be written as is defined as . Hence, we can get a solution of .

Lemma 9. Suppose that , , and ; is satisfied.(1)If one of the following holds: (a) , ; (b) , and . Then all roots of (28) have negative real parts when , is a certain positive constant.(2)If the conditions (a) and (b) are not satisfied, then all roots of (28) have negative real parts for all .

Proof. when , (28) can be reduced to
By the Routh-Hurwitz criterion, all roots of (33) have negative real parts and only if
Considering (37), it is easy to see from the characters of cubic algebraic equation that is a strictly monotonically increasing function if . If , or , and , then has no positive root. Hence, (28) has no purely imaginary roots for any , which implies that the positive equilibrium of system (22) is absolutely stable. Therefore, the following theorem on the stability of positive equilibrium can be easily obtained.

Theorem 10. Assume that and are satisfied, and , or , , and , then the positive equilibrium of system (22) is absolutely stable. Namely, is asymptotically stable for any time delay .
Assume that the coefficients in satisfy the condition as follows:.
According to lemma, it is proved that (37) has at least a positive root , namely, the characteristic equation (28) has a pair of purely imaginary roots .
In view of the fact that (28) has a pair of purely imaginary roots , the corresponding is given by eliminating in (34): Let be the root of (28), so that and are satisfied when .

Lemma 11. Suppose . If , then is a pair of purely imaginary roots of (28). In addition, if the conditions in Lemma 9 are satisfied, then
This signifies that there exists at least one eigenvalue with positive real part for . Differentiating both sides of (28) with respect to , it can be written as Therefore where ; then it follows the hypothesis that .
Hence,
The root of characteristic equation (28) crosses from left to right on the imaginary axis as continuously varies from a value less than to one greater than according to Routh’s theorem. Therefore, according to the Hopf bifurcation theorem for functional differential equations, the transverse condition holds and the conditions for Hopf bifurcation are satisfied at . Then the following result can be obtained.