Abstract and Applied Analysis

Volume 2013, Article ID 286209, 8 pages

http://dx.doi.org/10.1155/2013/286209

## An Impulse Dynamic Model for Computer Worms

School of Information Engineering, Guangdong Medical College, Dongguan 523808, China

Received 3 May 2013; Accepted 2 June 2013

Academic Editor: Luca Guerrini

Copyright © 2013 Chunming Zhang et al. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

#### Abstract

A worm spread model concerning impulsive control strategy is proposed and analyzed. We prove that there exists a globally attractive virus-free periodic solution when the vaccination rate is larger than . Moreover, we show that the system is uniformly persistent if the vaccination rate is less than . Some numerical simulations are also given to illustrate our main results.

#### 1. Introduction

Computer virus is a kind of computer program that can replicate itself and spread from one computer to others including viruses, worms, and trojan horses. Worms use system vulnerability to search and attack computers. As hardware and software technologies develop and computer networks become an essential tool for daily life, worms start to be a major threat. In June 2010, the Belarusian security firm Virus Block Ada discovered deadly Stuxnet worm. The Stuxnet worm is the first known example of a cyber-weapon that is designed not just to steal and manipulate data but to attack a processing system and cause physical damage. The Stuxnet worm is the first cyber-attack of its kind and has infected thousands of computer systems worldwide.

Consequently, the trial on better understanding the worm propagation dynamics is an important matter for improving the safety and reliability in computer systems and networks. Similar to the biological viruses, there are two ways to study this problem: microscopic and macroscopic. Following a macroscopic approach, since [1, 2] took the first step towards modeling the spread behavior of worms, much effort has been done in the area of developing a mathematical model for the worms propagation [3–13]. These models provide a reasonable qualitative understanding of the conditions under which viruses spread much faster than others and why.

In [7], the authors investigated a differential *SEIR* model by making the following assumptions (Figure 1).

A population size , that is, the total nodes at any time in the computer network, is partitioned into subclasses of nodes which are susceptible, exposed (infected but not yet infectious), infectious, and recovered with sizes denoted by , , , and , respectively.

One has where , , and are positive constants and , , , are nonnegative constants. The constant is the recruitment rate of susceptible nodes to the computer network, is the per capita natural mortality rate (i.e., the crashing of nodes due to the reason other than the attack of worms), is the rate constant for nodes leaving the exposed class for infective class , is the rate constant for nodes leaving the infective class for recovered class , is the disease related death rate (i.e., crashing of nodes due to the attack of worms) in the class , and is the rate constant for nodes becoming susceptible again after recovering.

In the *SEIRS* model, the flow is from class to class , class to class , class to class , and again class to class . For the vertical transformation, we assume that a fraction and a fraction of the new nodes from the exposed and the infectious classes, respectively, are introduced into the exposed class . Consequently, the birth flux into the exposed class is given by , and the birth flux into the susceptible class is given by .

As we know, antivirus software is a kind of computer program which can detect and eliminate known worm. There are two common methods to detect worms: using a list of worm signature definition and using a heuristic algorithm to find worm based on common behaviors. It has been observed that it does not always work in detecting a novel worm by using the heuristic algorithm. On the other hand, obviously, it is impossible for antivirus software to find a new worm signature definition on the dated list. So, to keep the antivirus software in high efficiency, it is important to ensure that it is updated. Based on the previous facts, we propose an impulsive system to model the process of periodic installing or updating antivirus software on susceptible computers at fixed time for controlling the spread of worm.

Based on the previous facts, we propose the following assumptions:

(*H*1) the antivirus software is installed or updated at time , where is the period of the impulsive effect;(

*H*2) computers are successfully vaccinated from class to class with rate .

According to the previous assumptions (*H*1)-(*H*2) and for the reason of simplicity, we propose the following model (Figure 2):
The total population size can be determined by to form the differential equation
which is derived by adding the equations in system (1). Thus the total population size may vary in time. From (2), we have
It follows that

The system (2) can be reduced to the equivalent system

The initial conditions for (6) are From physical considerations, we discuss system (6) in the closed set

The organization of this paper is as follows. In Section 2, we establish sufficient condition for the local and global attractivity of virus-free periodic solution. The sufficient condition for the permanence of the model is obtained in Section 3. Some numerical simulations are performed in Section 4. In the final section, a brief conclusion is given, and some future research directions are also pointed out.

#### 2. Global Attractivity of Virus-Free Periodic Solution

To prove our main results, we state three lemmas which will be essential to our proofs.

Lemma 1 (see [14]). *Consider the following impulsive differential equations:
**
where , , and . Then system (9) has a unique positive periodic solution
**
which is globally asymptotically stable; there .*

If , we have the following limit systems: When , there exists when , . From the third and sixth equations of system (11), we have . We have the following limit systems: According to Lemma 1, we know that periodic solution of system (12) is of the form and it is globally asymptotically stable, where .

Theorem 2. *Let be any solution of system (6) with initial values , , , and ; then is locally asymptotically stable, provided that and , where
*

*Proof. *The local stability of virus-free periodic solution may be determined by considering the behaviors of a small amplitude perturbation of the solution. Define , , , and , and then the linearized system of system (6) reads as
Let be the fundamental solution matrix of system (15), and then must satisfy
and , the identity matrix. We can easily see that two eigenvalues of the matrix are and , and the other two eigenvalues are determined by the 2 × 2 matrix . Denote the eigenvalues of as , , and then as , we have ,
Therefore, by the Floquet theorem [15], is locally asymptotically stable, provided that
When , the previous inequality is satisfied for .

The proof is complete.

Theorem 3. *If , and then is globally asymptotically stable for system (11), where
*

*Proof. *Because , for , we have
By Theorem 2, we know that is locally asymptotically stable. In the following, we will prove the global attraction of .

Let
Then
Therefore, is globally asymptotically stable, provided that
When , the previous inequality is satisfied.

The proof is complete.

Corollary 4. *The virus-free periodic solution of system (6) is globally attractive, if , where .*

Theorem 2 determines the global attractivity of (6) in **Ω** for the case . Its realistic implication is that the infected computers vanish, so the worms are removed from the network. Corollary 4 implies that the computer virus will disappear if the vaccination rate is less than .

#### 3. Permanence

In this section, we say that the worm is local if the infected population persists above a certain positive level for sufficiently large time. The local of worm can be well captured and studied through the notion of permanence.

*Definition 5. *System (6) is said to be uniformly persistent if there is an (independent of the initial data) such that every solution with initial conditions (8) of system (6) satisfies

Theorem 6. *Suppose that and . Then there is a positive constant such that each positive solution of system (6) satisfies , for t large enough.*

*Proof. *Now, we will prove that there exist and a sufficiently large such that holds for all . Suppose that for all . From the forth equation of (6), we have
From the second equation of (6), we have
As ,
From the first equation of (6), we have
Consider the following comparison system:
let , .

By Lemma 1, we know that there exists such that
From the second equation of (6), we have
From the third equation of (6); we have
Note that , we have
This contradicts . Hence, we can claim that for any , it is impossible that
By the claim, we are left to consider two cases. First, for large enough. Second, oscillates about for large enough. Obviously, there is nothing to prove for the first case. For the second case, we can choose , and satisfy
is uniformly continuous since the positive solutions of (6) are ultimately bounded, and is not affected by impulses.

Therefore, it is certain that there exists a (, and is independent of the choice of ) such that
In this case, we consider the following three possible cases in term of the sizes of , , and .*Case 1*. If , then it is obvious that , for . *Case 2*. If , then from the second equation of system (6), we obtain .

Since , it is obvious that , for .*Case 3*. If , it is easy to obtain that for . Then, proceeding exactly as the proof for the previous claim, we have that for .

Owing to the randomicity of , we can obtain that there exists such holds for all .

The proof of Theorem 6 is completed.

Theorem 7. *Suppose . Then system (6) is permanent.*

*Proof. *Let be any solution of system (6). First, from the first equation of system (6), we have
Consider the following comparison system:
By Lemma 1, we know that for any sufficiently small , there exists a ( is sufficiently large) such that
From (31), we have
From the third equation of (6), we have
It is easy to see that
We let , , , . By Theorem 6 and the previous discussions, we know that the set is a global attractor in , and of course, every solution of system (6) with initial conditions (8) will eventually enter and remain in region . Therefore, system (6) is permanent.

The proof of Theorem 7 is completed.

Corollary 8. *It follows from Theorem 6 that the system (6) is uniformly persistent, provided that , where .*

#### 4. Numerical Simulations

In this section we have performed some numerical simulations to show the geometric impression of our results.

To demonstrate the global attractivity of virus-free periodic solution of system (6), we take following set parameter values: , , , , , , , , , , and . In this case, we have . In Figures 3(a), 3(b), 3(c), and 3(d), we have displayed, respectively, the susceptible, exposed, infected and recovered population of system (6) with initial conditions: , , , and .

To demonstrate the permanence of system (6), we take the following set parameter values: , , , , , , , , , and . In this case, we have . In Figures 4(a), 4(b), 4(c), and 4(d), we have displayed, respectively, the susceptible, exposed, infected, and recovered populations of system (6) with initial conditions: , , and .

#### 5. Conclusion

We have analyzed the *SEIRS* model with pulse vaccination and varying total population size. We have shown that or implies that the worm will be local, whereas or implies that the worm will fade out. We have also established sufficient condition for the permanence of the model. Our results indicate that a large pulse vaccination rate will lead to eradication of the worm.

#### References

- J. O. Kephart and S. R. White, “Directed-graph epidemiological models of computer viruses,” in
*Proceedings of IEEE Symposium on Security and Privacy*, pp. 343–359, 1991. - J. O. Kephart, S. R. White, and D. M. Chess, “Computers and epidemiology,”
*IEEE Spectrum*, vol. 30, no. 5, pp. 20–26, 1993. View at Google Scholar - L. Billings, W. M. Spears, and I. B. Schwartz, “A unified prediction of computer virus spread in connected networks,”
*Physics Letters A*, vol. 297, no. 3-4, pp. 261–266, 2002. View at Publisher · View at Google Scholar · View at Zentralblatt MATH · View at MathSciNet - X. Han and Q. Tan, “Dynamical behavior of computer virus on Internet,”
*Applied Mathematics and Computation*, vol. 217, no. 6, pp. 2520–2526, 2010. View at Publisher · View at Google Scholar · View at Zentralblatt MATH · View at MathSciNet - B. K. Mishra and N. Jha, “Fixed period of temporary immunity after run of anti-malicious software on computer nodes,”
*Applied Mathematics and Computation*, vol. 190, no. 2, pp. 1207–1212, 2007. View at Publisher · View at Google Scholar - B. K. Mishra and D. Saini, “Mathematical models on computer viruses,”
*Applied Mathematics and Computation*, vol. 187, no. 2, pp. 929–936, 2007. View at Publisher · View at Google Scholar · View at Zentralblatt MATH · View at MathSciNet - B. K. Mishra and S. K. Pandey, “Dynamic model of worms with vertical transmission in computer network,”
*Applied Mathematics and Computation*, vol. 217, no. 21, pp. 8438–8446, 2011. View at Publisher · View at Google Scholar · View at Zentralblatt MATH · View at MathSciNet - J. R. C. Piqueira and V. O. Araujo, “A modified epidemiological model for computer viruses,”
*Applied Mathematics and Computation*, vol. 213, no. 2, pp. 355–360, 2009. View at Publisher · View at Google Scholar · View at Zentralblatt MATH · View at MathSciNet - J. R. C. Piqueira, A. A. Vasconcelos, C. E. C. J. Gabriel, and V. O. Araujo, “Dynamic models for computer viruses,”
*Computers & Security*, vol. 27, no. 7-8, pp. 355–359, 2008. View at Publisher · View at Google Scholar - J. Ren, X. Yang, L.-X. Yang, Y. Xu, and F. Yang, “A delayed computer virus propagation model and its dynamics,”
*Chaos, Solitons & Fractals*, vol. 45, no. 1, pp. 74–79, 2012. View at Publisher · View at Google Scholar · View at MathSciNet - J. Ren, X. Yang, Q. Zhu, L. X. Yang, and C. Zhang, “A novel computer virus model and its dynamics,”
*Nonlinear Analysis*, vol. 13, no. 1, pp. 376–384, 2012. View at Publisher · View at Google Scholar · View at Zentralblatt MATH · View at MathSciNet - J. C. Wierman and D. J. Marchette, “Modeling computer virus prevalence with a susceptible-infected-susceptible model with reintroduction,”
*Computational Statistics & Data Analysis*, vol. 45, no. 1, pp. 3–23, 2004. View at Publisher · View at Google Scholar · View at MathSciNet - H. Yuan and G. Chen, “Network virus-epidemic model with the point-to-group information propagation,”
*Applied Mathematics and Computation*, vol. 206, no. 1, pp. 357–367, 2008. View at Publisher · View at Google Scholar · View at Zentralblatt MATH · View at MathSciNet - S. Gao, L. Chen, and Z. Teng, “Impulsive vaccination of an SEIRS model with time delay and varying total population size,”
*Bulletin of Mathematical Biology*, vol. 69, no. 1, pp. 731–745, 2007. View at Publisher · View at Google Scholar - R. Shi and L. Chen, “Stage-structured impulsive $SI$ model for pest management,”
*Discrete Dynamics in Nature and Society*, Article ID 97608, 11 pages, 2007. View at Publisher · View at Google Scholar · View at Zentralblatt MATH · View at MathSciNet