The Influence of User Protection Behaviors on the Control of Internet Worm Propagation

Abstract

Computer users’ reactions to the outbreak of Internet worm directly determine the defense capability of the computer and play an important role in the spread of worm. In this paper, in order to characterize the impacts of adaptive user protection behaviors, an improved SIS model is proposed to describe the Internet worm propagation. The results of theoretical analysis indicate that the protective campaigns of users can indeed reduce the worm’s reproduction number to values less than one. But it may not be sufficient to eradicate the worm. In certain condition, a backward bifurcation leading to bistability can occur. These are new findings in the worm propagation model that bring new challenges to control the spread of the worm and further demonstrate the importance of user behaviors in controlling the worm propagation. Corresponding to the analysis results, defense and control strategies are provided.

1. Introduction

A generalized Internet worm is a kind of computer program that can replicate itself and spread from one host to another through the network [1]. Internet worms are built to propagate without warning or user interaction with the characters of rapid pervasive speed, large invasive scale, and severe destructive power. In the modern information and network security, Internet worms have become one of the most serious security threats to the Internet [2].

In order to effectively defense the Internet worm attack and reduce the damage caused by them, the propagation mechanism and control strategies of Internet worms have become active research topics. Mathematical models have been an important tool for investigating and quantifying such effects. Many research efforts have focused on developing effective worm propagation model to understand their propagation mechanisms and examine the effects of defensive measures [3–7]. However, all of these studies are focused on the computer host [8–10] and ignore the user behavior which is closely related to the worm propagation [11].

As stated in [12], the most effective way to protect a host from worm is to patch. But it is almost impossible to achieve for some reasons, one of which is the lack of the security awareness of the computer user. It serves to show that user behaviors play an important role in the spread of Internet worm, and understanding the influence of these behaviors on the spread of worm can be a key to improve control efforts. Several studies have been carried out to evaluate the impact and role of the user behavior factors on worm propagation [13–19], but almost all of these studies are focused on the user’s habitual actions. However, in the real world, users can take actions to combat worm prevalence, and under different actions, there will be different worm prevalence processes [20]. Only a few recent attempts have considered the self-induced behavior changes users adopt during an outbreak. Some approaches model user behaviors by modifying infectious rate or removed rate [21, 22]. However, to fully understand the impact of user behaviors on worm dynamics, there still lacks a formulation of a general behavior worm model.

In the actual network environment, during the outbreak of the Internet worm, the computer users may filter and block suspicious messages with a firewall, no longer browse websites that are suspicious, update the antivirus software to new version timely, and so forth, which can be called user protection behaviors. Certainly, these protection measures can cause associated costs. For instance, some important information may be filtered out, or the speed of the computer operation can be slowed down. Moreover, these bring some inconvenience to normal activities. So users always compare the risk of worm infection with the associated cost of protection measures and then make a personal decision according to the current situation of worm propagation. As a consequence, the states of the computers switch between vulnerable state and protected state relying on the corresponding protection behaviors of users. From this new perspective, in this paper the computers are categorized according to the user behavioral responses to the spread of worm. The degree of protection is different because of the difference of user’s attitudes, belief systems, opinions, awareness of the worm, and environment. For the sake of simplicity, the computers that have not been infected by the worm are divided into two classes roughly, where one is the vulnerable computers and the other one is the protected computers. Incorporated with the worm dynamics, we study the effect of user protection behaviors on worm propagation and control.

The rest of this paper is organized as follows. In Section 2, a worm propagation model coupled with user protection behaviors is established. The basic reproduction number is obtained in Section 3, and the equilibria and the corresponding stability are studied. In Section 4, we carry out some sensitivity analysis about the parameters. In the following section are the simulation results and control strategies. Finally, we conclude in Section 6 with a summary of our findings.

2. The Worm Propagation Model

We focus on studying the impact of the user behaviors on the worm propagation and control so as to provide theoretical basis for the worm control. Therefore, we shall exclusively consider the random-scanning worm, regardless of the topological structure of the network. That is, all computer hosts in the network are mixing homogeneously and have the vulnerabilities that can be used by the worm.

All computers are divided into three classes: vulnerable computers (worm-free computers), protected computers, and infectious computers (computers that have been infected by the worm and can transmit it to the vulnerable computers). Let 𝑆₁(𝑡), 𝑆₂(𝑡), and 𝐼(𝑡) denote, at time 𝑡, the numbers of vulnerable, protected, and infectious computers, respectively. Then 𝑆₁(𝑡)+𝑆₂(𝑡)+𝐼(𝑡)=𝑁(𝑡) is the total number of computers.

By carefully considering the features of Internet worm, the following hypotheses are made.(H1) All newly connected computers are worm-free. These computers are connected to the Internet at positive constant ∧, of which a fraction 𝑝 is protected.(H2) Computers are disconnected from the Internet at rate 𝜇.(H3) Infectious computers are cured at positive constant rate 𝛾 by running with antivirus software or reinstalling the system, of which a fraction 𝑞 is protected.(H4) Compared to the vulnerable computers, the protected ones have the smaller infection rate by worm. We utilize the fraction 1−𝜎 to measure the effect of reducing the infection rate due to the protection behaviors. 𝜎=0 means the protection is completely effective in preventing infection, while 𝜎=1 means the protection is utterly ineffective. In fact, we know the protection may not be 100% or completely useless, so we consider the case 0<𝜎<1, which is more realistic. (H5) The transformation rate of a computer from vulnerable state to protected state is 𝜙. In the opposite direction, the transformation rate is 𝜃.

Integrating the user protection behaviors into the worm propagation, we have the following graphic of the state transition in Figure 1.

Figure 1 

The flowchart of computer worm spreading.

According to the flowchart, the worm propagation process that is coupled with the user protection behaviors can be described as the following model: 𝑆̇₁=1−𝑝∧−𝛽₀𝐼𝑆₁2³²−𝜇𝑆₁−𝜙𝑆₁+1−𝑞𝛾𝐼+𝜃𝑆₂,𝑆̇₂=𝑝∧+𝜙𝑆₁−𝜎𝛽₀𝐼𝑆₂2³²−𝜇𝑆₂+𝑞𝛾𝐼−𝜃𝑆₂,𝐼̇=𝛽₀𝐼𝑆₁2³²+𝜎𝛽₀𝐼𝑆₂2³²−𝜇𝐼−𝛾𝐼, (1) where 𝛽₀ denotes the infection rate of vulnerable computers due to the successful scans of an infectious computer per time step and 𝜎𝛽₀ is the infection rate of protected computers due to the successful scans of an infectious computer per time step. The probability of successfully finding a vulnerable computer (protected computer) in one scan is 𝑆₁/2³²(𝑆₂/2³²), where 2³² is the size of IPv4 address space (the scanning space). Then, 𝛽₀𝑆₁/2³²(𝜎𝛽₀𝑆₂/2³²) is the number of vulnerable computers (protected computers) infected by an infectious computer per time step. So 𝛽₀𝐼𝑆₁/2³²(𝜎𝛽₀𝐼𝑆₂/2³²) is the number of vulnerable computers (protected computers) infected by infectious computers per time step.

Summing up the three equations in system (1), we obtain 𝑑𝑁𝑑𝑡=∧−𝜇𝑁. (2) When 𝑡→+∞, 𝑁→∧/𝜇≜𝑁^∗. It is easy to see that system (1) can be shown to be mathematically well posed in the positive invariant region 𝔻={(𝑆₁,𝑆₂,𝐼)∣0≤𝑆₁+𝑆₂+𝐼≤𝑁^∗} and solutions in 𝔻 exist for all positive time.

Now, we take transformation 𝑥=𝑆₁/𝑁^∗, 𝑦=𝑆₂/𝑁^∗, 𝑧=𝐼/𝑁^∗ to system (1). For convenience, 𝑆₁, 𝑆₂, and 𝐼 are used to represent 𝑥, 𝑦, and 𝑧 in the following equations: 𝑆̇₁=1−𝑝𝜇−𝛽𝑆₁𝐼−𝜇𝑆₁−𝜙𝑆₁+1−𝑞𝛾𝐼+𝜃𝑆₂,𝑆̇₂=𝑝𝜇+𝜙𝑆₁−𝜎𝛽𝑆₂𝐼−𝜇𝑆₂+𝑞𝛾𝐼−𝜃𝑆₂,𝐼̇=𝛽𝑆₁𝐼+𝜎𝛽𝑆₂𝐼−𝜇𝐼−𝛾𝐼, (3) where 𝛽=𝛽₀𝑁^∗/2³² and 𝑆₁+𝑆₂+𝐼=1 is satisfied.

3. The Analysis of Dynamical Behaviors

The objective of this section is to perform theoretical analysis of system (3). We first give the basic reproduction number. Secondly, we study the equilibria and their stability. Finally, we prove the occurrence of saddle-node bifurcation.

3.1. The Basic Reproduction Number

Usually, the basic reproduction number, denoted as 𝑅₀, is “the expected number of secondary cases produced, in a completely susceptible population, by a typical infective individual” [23, 24]. Similarly, for a worm propagation model the basic reproduction number is defined as the average number of previously worm-free computers that are infected by a single infectious computer during its lifecycle. In our model, infectious computers come from two sources: those vulnerable (𝑆⁰₁) that get infected and those protected (𝑆⁰₂) that get infected. By the physical meanings of the system parameters in system (3) (or (1)), the following results are obtained:(a)the average lifetime of an infectious computer is 𝑇=1/(𝜇+𝛾);(b)an infectious computer converts a vulnerable computer to an infectious one at rate 𝛽;(c)an infectious computer converts a protected computer to an infectious one at rate 𝜎𝛽.

Thus, the modified basic reproduction number with the protection measures is obtained as 𝑅_pro=𝑇𝛽𝑆⁰₁+𝜎𝛽𝑆⁰₂=𝛽𝑆𝜇+𝛾⁰¹+𝜎𝑆⁰₂<𝛽𝜇+𝛾=𝑅₀, (4) where 𝑅₀=𝛽/(𝜇+𝛾) is the basic reproduction number of the SIS model which does not consider the user protection behaviors. The expressions of 𝑆⁰₁ and 𝑆⁰₂ are given in (5). Obviously, the protection behaviors do reduce the basic reproduction number 𝑅_pro.

3.2. Stability and Bifurcation Analysis

3.2.1. The Worm-Free Equilibrium and Its Stability

Equilibria are obtained by setting the right side of system (3) equal to zero. From the third equation in system (3), we can obtain 𝐼=0 or 𝛽𝑆₁+𝜎𝛽𝑆₂=𝜇+𝛾. If 𝐼=0, the model has a unique worm-free equilibrium: 𝐸₀=𝑆⁰₁,𝑆⁰₂,0, (5) where 𝑆⁰₁=((1−𝑝)𝜇+𝜃)/(𝜇+𝜃+𝜙), 𝑆⁰₂=(𝑝𝜇+𝜙)/(𝜇+𝜃+𝜙).

To study the local stability of the equilibria, we first give the Jacobian matrix of system (3) at an arbitrary equilibrium: 𝐽=−𝛽𝐼−𝜇−𝜙𝜃−𝛽𝑆₁+1−𝑞𝛾𝜙−𝜎𝛽𝐼−𝜇−𝜃−𝜎𝛽𝑆₂+𝑞𝛾𝛽𝐼𝜎𝛽𝐼𝛽𝑆₁+𝜎𝛽𝑆₂−𝜇+𝛾. (6) Then the corresponding characteristic polynomial at the worm-free equilibrium 𝐸₀ is derived as 𝑃(𝜆)=×𝜆+𝜇𝜆+𝜇+𝜃+𝜙𝜆+𝜇+𝛾−𝛽𝑆⁰₁−𝜎𝛽𝑆⁰₂, (7) so we obtained that the eigenvalues at the worm-free equilibrium 𝐸₀ are 𝜆₁=−𝜇, 𝜆₂=−(𝜇+𝜃+𝜙) and 𝜆₃=𝛽𝑆⁰₁+𝜎𝛽𝑆⁰₂−(𝜇+𝛾)=(𝜇+𝛾)(𝑅_pro−1), respectively. Consequentially, the following result is obtained.

Theorem 1. System (3) always has a trivial equilibrium 𝐸₀, and if 𝑅_𝑝𝑟𝑜≤1, 𝐸₀ is locally asymptotically stable.

3.2.2. The Existence and Stability of Endemic Equilibrium

In this section, we study the existence and stability of the endemic equilibria for system (3).

If 𝛽𝑆₁+𝜎𝛽𝑆₂=𝜇+𝛾, combined with the second equation of system (3), we can obtain 𝑆₁=𝜇+𝛾𝜎𝛽𝐼+𝜇+𝜃−𝜎𝑞𝛾𝛽𝐼−𝜎𝛽𝑝𝜇𝛽,𝑆𝜎𝛽𝐼+𝜇+𝜃+𝜎𝜙₂=𝑞𝛾𝛽𝐼+𝛽𝑝𝜇+𝜙𝜇+𝛾𝛽.𝜎𝛽𝐼+𝜇+𝜃+𝜎𝜙 (8) Then, substituting 𝑆₁ and 𝑆₂ into the first equation of system (3), a quadratic equation is given as 𝐴𝐼²+𝐵𝐼+𝐶=0 (9) in terms of 𝐼, where 𝐴=𝜎𝛽²,𝐵=𝛽𝜇+𝜃+𝜎𝜙+𝜎𝜇+𝛾+𝑞𝛾(1−𝜎)−𝜎𝛽,𝐶=𝜇+𝛾𝜇+𝜃+𝜙1−𝑅_pro. (10) Define Δ=𝐵²−4𝐴𝐶; the number of endemic equilibria is dependent on the sign of 𝐵, 𝐶, and Δ. After calculation, we can obtain the following results.

Theorem 2. For system (3), consider the following.(1) If 𝐶<0(𝑅_𝑝𝑟𝑜>1), (9) has a positive root 𝐼^∗=(−𝐵+√Δ)/2𝐴. Correspondingly, system (3) has one endemic equilibrium 𝐸^∗. (2) If 𝐶=0(𝑅_𝑝𝑟𝑜=1) and 𝐵<0, (9) also has a positive root 𝐼^∗=−𝐵/𝐴. Correspondingly, system (3) has one endemic equilibrium 𝐸^∗. (3) If 𝐶>0(𝑅_𝑝𝑟𝑜<1), 𝐵<0, there will be three cases.(i) If Δ>0, (9) has two positive roots 𝐼^∗1=(−𝐵+√Δ)/2𝐴 and 𝐼^∗2=(−𝐵−√Δ)/2𝐴. Correspondingly, system (3) has two endemic equilibria 𝐸^∗1=(𝑆₁^∗1,𝑆₂^∗1,𝐼^∗1) and 𝐸^∗2=(𝑆₁^∗2,𝑆₂^∗2,𝐼^∗2). (ii) If Δ=0, (9) has a positive root 𝐼^∗=−𝐵/2𝐴; then system (3) has one endemic equilibrium 𝐸^∗.(iii) If Δ<0, (9) has no positive root, and system (3) has no endemic equilibrium.

Now, we study the stability of endemic equilibria seriatim. Similar to Section 3.2.1, the corresponding characteristic polynomial of an arbitrary endemic equilibrium is derived as 𝑄(𝜆)=𝜆+𝜇𝜆²+𝜆+()𝐼.𝛽𝐼+𝜎𝛽𝐼+𝜇+𝜃+𝜙2𝐴𝐼+𝐵 (11) Obviously, for any endemic equilibrium, there is an eigenvalue 𝜆₁=−𝜇<0. In order to study the other ones, we set 𝑓(𝜆)=𝜆²+𝜆+()𝛽𝐼+𝜎𝛽𝐼+𝜇+𝜃+𝜙2𝐴𝐼+𝐵𝐼. (12) Then the signs of eigenvalues corresponding to the endemic equilibrium are dependent on the distribution of the roots of 𝑓(𝜆)=0.

Corresponding to the cases about the existence, we obtain the stability of endemic equilibrium in each case, which are stated as follows.

Theorem 3. For system (3), consider the following. (1)If 𝐶<0(𝑅_𝑝𝑟𝑜>1), then 𝐼^∗=(−𝐵+√Δ)/2𝐴, 2𝐴𝐼^∗+𝐵=√Δ>0. In this case, 𝑓(𝜆) has no intersection point with positive real axis; thus 𝐸^∗ is locally asymptotically stable. (2)If 𝐶=0(𝑅_𝑝𝑟𝑜=1) and 𝐵<0, then 𝐼^∗=−𝐵/𝐴, 2𝐴𝐼^∗+𝐵=−𝐵>0; same as case (1), 𝐸^∗ is locally asymptotically stable. (3)If 𝐶>0(𝑅_𝑝𝑟𝑜<1), 𝐵<0, there will be three cases.(i)If Δ>0, for the positive root 𝐼^∗1=(−𝐵+√Δ)/2𝐴, 2𝐴𝐼^∗1+𝐵=√Δ>0; same as the above, 𝐸^∗1=(𝑆₁^∗1,𝑆₂^∗2,𝐼^∗1) is a stable node. For 𝐼^∗2=(−𝐵−√Δ)/2𝐴, 2𝐴𝐼^∗2+𝐵=−√Δ<0; in this case, 𝑓(𝜆) has an intersection point with positive real axis, so 𝐸^∗2=(𝑆₁^∗2,𝑆₂^∗2,𝐼^∗2) is a saddle point.(ii)If Δ=0, then 𝐼^∗=−𝐵/2𝐴, 2𝐴𝐼^∗+𝐵=0; in this case, one of the eigenvalues corresponding to 𝐸^∗ is equal to zero, so 𝐸^∗ is a nonhyperbolic equilibrium.(iii)If Δ<0, system (3) has no endemic equilibrium.

3.2.3. The Saddle Node and Bifurcation

According to Theorems 2 and 3, we can see that under the conditions 𝐶>0(𝑅_pro<1), 𝐵<0, and Δ=0, system (3) has one endemic equilibrium 𝐸^∗, and it is a nonhyperbolic equilibrium. Utilizing the center manifold theorem [25, 26] and the existence theorem [27], we studied the dynamical behavior near the equilibrium 𝐸^∗. Taking 𝛽 as the bifurcation parameter, we prove that system (3) could experience saddle-node bifurcation. The detailed results are given as follows (the proofs of Theorems 4 and 5 are provided in Appendices A and B).

Theorem 4. If 𝐶>0(𝑅_𝑝𝑟𝑜<1), 𝐵<0, and Δ=0, system (3) has one positive equilibrium 𝐸^∗, and 𝐸^∗ is a saddle node.

Theorem 5. System (3) experiences saddle-node bifurcation at the equilibrium 𝑥₀=𝐸^∗ as the parameter 𝛽 passes through the bifurcation value.

From the above mathematical analysis, we can see that under certain parameter condition, system (3) would experience backward bifurcation. Combined with the theoretical results, we can rewrite the inequality conditions about 𝐶, 𝐵, and Δ=𝐵²−4𝐴𝐶 in terms of 𝛽: 𝐶<0𝑅_pro>1⟺𝛽>𝛽_𝐶≜𝜇+𝛾𝜇+𝜃+𝜙𝜇,1−𝑝+𝜃+𝜎𝜙+𝜎𝜇𝑝𝐵<0⟺𝛽>𝛽_𝐵≜𝜇+𝜃+𝜎𝜙+𝜎𝜇+𝛾+𝑞𝛾(1−𝜎)𝜎,Δ>0⟺𝛽>𝛽_Δ≜𝜎+()()−×(𝜎)𝜇+𝛾𝑝𝜇+𝑞𝛾1−𝜎+𝑝𝜇1−𝜎𝜇+𝜃+𝜎𝜙₋₁+2𝜎(+()×()−1−𝜎)𝜇+𝛾𝜙+𝑝𝜇𝑝𝜇+𝑞𝛾1−𝜎𝑝𝜇1−𝜎𝜇+𝜃+𝜎𝜙^1/2×(𝜎)⁻¹. (13)𝛽_𝐶, 𝛽_𝐵, and 𝛽_Δ satisfy the following relationship 𝛽_𝐶>𝛽_𝐵⟹𝛽_𝐶>𝛽_Δ>𝛽_𝐵. (14) Then 𝑅^′_pro≜𝑅_pro|_𝛽=𝛽Δ=𝛽_Δ⋅𝜇+𝛾1−𝑝𝜇+𝜃+𝜎𝑝𝜇+𝜙𝜇+𝜃+𝜙 (15) becomes one critical threshold for system (3), and 𝛽>𝛽_Δ⇔𝑅_pro>𝑅^′_pro. In addition, we can obtain 𝑅^′_pro=1−(𝐵²/4𝐴) if Δ=0. Obviously, 𝑅^′_pro<1.

From Theorems 1–5, we can obtain the following properties.

Corollary 6. For system (3),(1)if 𝛽_𝐶>𝛽_𝐵 and 𝛽_Δ<𝛽<𝛽_𝐶, then two endemic equilibria exist, one of which is locally stable and competes with the locally stable worm-free equilibrium, which is the backward bifurcation (see Figure 2(b));(2)otherwise, the worm-free equilibrium is the unique attractor when 𝑅_𝑝𝑟𝑜<1, which is the forward bifurcation (see Figure 2(a)).

(a)

(b)

Figure 2 

Bifurcation diagram. (a) Forward bifurcation case; (b) backward bifurcation case.

These results can also be given in terms of 𝜎, 𝜙, or 𝜃, and in practice, these parameters are easily controlled. However, the expressions are more complicated. Therefore, we only give corresponding regions in numerical simulation.

4. Sensitivity Analysis

In real world applications, our main objective is to control the percentage of infective computers or eradicate the worm by taking effective measures. In our model, parameters 𝜎, 𝜙, 𝜃, 𝑝, and 𝑞 are related to human behavioral responses. For our purpose, following Arriola and Hyman [28], the normalized forward sensitivity indices with respect to 𝜎, 𝜙, 𝜃, and 𝑝 are calculated, respectively, as follows: 𝜕𝑅_pro/𝑅_pro()=𝜎𝜕𝜎/𝜎𝜙+𝑝𝜇1−𝑝𝜇+𝜃+𝜎𝜙+𝜎𝑝𝜇>0,𝜕𝑅_pro/𝑅_pro𝛽𝜕𝜙/𝜙=−⋅(𝜇𝜇+𝛾1−𝜎)𝜃+1−𝑝𝜇+𝜃+𝜙²<0,𝜕𝑅_pro/𝑅_pro()=𝛽𝜕𝜃/𝜃⋅(𝜇+𝛾1−𝜎)𝜙+𝑝𝜇𝜇+𝜃+𝜙²>0,𝜕𝑅_pro/𝑅_pro𝛽𝜕𝑝/𝑝=−⋅()𝜇𝜇+𝛾1−𝜎𝜇+𝜃+𝜙<0. (16) It can be seen that, among these parameters, 𝑅_pro is an increasing function of 𝜎 and 𝜃. Opposed to this, 𝜙 and 𝑝 have an inversely proportional relationship with 𝑅_pro.

By now, for a general worm propagation model with forward bifurcation (Figure 2(a)), we can take measures to increase 𝜙 and decrease 𝜎, 𝜃 at the same time to make 𝑅_pro below one. However, for our model, the backward bifurcation (Figure 2(b)) appears under certain parameter values. In this case, reducing 𝑅_pro below one would not promise to eradicate the worm eventually. As shown in Figure 2(b), there exists a locally stable endemic equilibrium even if 𝑅_pro<1. In order to control the worm propagation, the involved parameter values must be further reduced or increased so far that 𝑅_pro<𝑅^′_pro, and 𝑅_pro enters the region where no endemic equilibria exist (see Figures 2(b) and 9). Therefore, the control of worm propagation is more difficult under the situation in which backward bifurcation appears.

5. Simulations and Control Strategies

Theoretical results have been provided in previous section; now we use numerical simulations to verify the above results. We fix 𝑁^∗=0.24×2³² [29], 𝜇=1/(5×24), and 𝛾=1/24 throughout this paper.

5.1. The Effect of Parameters

In Section 4, we have analyzed the effects of 𝜎, 𝜙, 𝜃, and 𝑝 on 𝑅_pro. To provide an intuitive impression, when 𝛽=250×0.24×0.0026, the influences of 𝜎, 𝜙, 𝜃, and 𝑝 on 𝐼(𝑡) are shown in Figure 3.

(a)

(b)

(c)

(d)

Figure 3 

The variations in the number of infectious computers 𝐼(𝑡) for different values of 𝜎, 𝜙, 𝜃, and 𝑝, respectively.

It can be observed that the effects of 𝜎, 𝜙, and 𝜃 are stronger and 𝑝 have little or almost no influence on 𝐼(𝑡). Moreover, we find that 𝜙 can influence not only the number of infectious computers but also the arrival time of the second peak. It is easy to see that the peak of the second outbreak would be postponed if 𝜙 is increasing. Generally, as the arrival time of the first peak of worm outbreak is very quick, it is too late to make any responses when we are aware of it. Thus, if the arrival time of the second peak of worm outbreak can be postponed, it can give security professionals more time to study the corresponding counter measures.

Although 𝑞 does not appear in the expression for 𝑅_pro, it is related to the user behavior. So, fixing 𝛽=250×0.24×0.0026, 𝑝=0.8, 𝜙=0.0003, 𝜃=0.0005, 𝜎=0.02 (this is the forward bifurcation case, 𝑅_pro=2.3235), we study the influences of 𝑞 on the changes of 𝐼(𝑡). From Figure 4, we can see an increase of 𝑞 would lead to a decrease of 𝐼(𝑡). That is, even if 𝑅_pro>1, the final size of infectious computers can be reduced to a low level by increasing 𝑞.

Figure 4 

The variations in the number of infectious computers 𝐼(𝑡) for different values of 𝑞.

In order to display the differences between the forward and backward bifurcation, in the following parts, we carry on numerical simulations for the two cases, respectively.

5.2. Forward Bifurcation

Firstly, to find better control strategies for worm infection, we perform some sensitivity analysis of 𝐼(𝑡) and the basic reproduction number 𝑅_pro in terms of the model parameters. Choosing 𝑝=0.8, 𝑞=0.5, 𝜙=0.0003, 𝜃=0.0005, 𝜎=0.02, we can obtain 𝛽_𝐶=0.0671. Assuming the value of 𝛽 is 250×0.24×0.0011, 250×0.24×0.002, and 250×0.24×0.0026, respectively, then the corresponding value of 𝑅_pro is 0.9830, 1.7873, and 2.3235. We show variations of 𝐼(𝑡) for different values of 𝑅_pro in Figure 5 with 𝐼(0)=10⁷. We can see that 𝑅_pro is really the threshold for the establishment of the worm in the susceptible pool, and the number of infectious computers increases with the increase of 𝑅_pro.

Figure 5 

The variations in the number of infectious computers 𝐼(𝑡) for different values of 𝑅pro.

Secondly, in Figure 6, we show the influences of initial conditions 𝐼(0) on the number of infectious computers 𝐼(𝑡) for the same 𝑅_pro. We can see 𝐼(0) has little or almost no influence on 𝐼(𝑡).

(a)

(b)

(c)

Figure 6 

The influences of initial conditions 𝐼(0) on the number of infectious computers 𝐼(𝑡) for different values of 𝐼(0) with the same 𝑅pro.

From the above analysis, we find that as long as we take measures to control the parameter values to make 𝑅_pro<1, we will be able to control the spread of the worm. However, we know that in real world the control measures corresponding to involved parameters may not be easy to carry out. Even if controlling parameter values cannot ensure that 𝑅_pro<1, the final size of infectious computers can be reduced by reducing the value of 𝑅_pro as far as possible.

5.3. Backward Bifurcation

Similarly, keeping other parameter values unchanged, we choose 𝜙=0.006, 𝜎=0.2, then 𝛽_𝐶=0.1589, 𝛽_𝐵=0.1336, 𝛽_Δ=0.1505, and 𝛽_𝐶>𝛽_𝐵, 𝑅^′_pro=0.9470. Assuming the value of 𝛽 is 250×0.24×0.0025, 250×0.24×0.0026, and 250×0.24×0.00275, respectively, then the corresponding value of 𝑅_pro is 0.9439, 0.9817, and 1.0383. The inequality 0.9439<𝑅^′_pro<0.9817<1.0383 is satisfied.

In Figure 7, we show the changes of 𝐼 with time for different 𝑅_pro. The initial values adopted in Figures 7(a) and 7(b) are 𝐼(0)=10⁷ and 𝐼(0)=3×10⁶, respectively.

(a)

(b)

Figure 7 

The variations in the number of infectious computers 𝐼(𝑡) for different values of 𝑅pro: (a) 𝐼(0)=107, (b) 𝐼(0)=3×106.

Comparing Figure 7(a) with Figure 5, we can find if at 𝑅_pro<1, 𝐼(𝑡) may still tend to a positive endemic level; that is, 𝑅_pro<1 is not sufficient to control the spread of Internet worm. Comparing Figure 7(a) with Figure 7(b), it can be observed that when 𝑅^′_pro<𝑅_pro=0.9817<1, the initial value 𝐼(0) can influence the evolutions of 𝐼 with time. But the initial value 𝐼(0) has no influence on the evolutions of 𝐼 with time when 𝑅_pro=1.0383>1 and 𝑅_pro=0.9439<𝑅^′_pro. Thus 𝑅_pro=1 is not the only threshold condition for the worm eradication, and 𝑅^′_pro also plays a key role.

In order to display the impacts of 𝐼(0) on the evolutions of 𝐼(𝑡) more clearly, in Figure 8, we assume the initial value of 𝐼(0) is 10⁶ : 10⁶ : 10⁷. From Figures 8(a)–8(c), we can see that when 𝑅^′_pro<𝑅_pro<1, for different 𝐼(0), 𝐼(𝑡) will tend to endemic equilibrium or worm-free equilibrium simultaneously, which puts forward new challenges to the worm control. Because the value of 𝐼(0) depends mainly on the hackers who write malicious code, it is hard to control. Then in order to eradicate the worm, we must take further measures to reduce 𝑅_pro, so that 𝑅_pro<𝑅^′_pro.

(a)

(b)

(c)

Figure 8 

The influences of initial conditions 𝐼(0) on the number of infectious computers 𝐼(𝑡) for different 𝑅pro.

(a)

(b)

(c)

Figure 9 

Bifurcation diagram in the (𝜎,𝜙), (𝜙,𝜃), and (𝜎,𝜃) planes (𝐶<0⇔𝑅pro>1).

For system (3), the parameters are in cooperation with each other. So in Figure 9, we give the region division of the distribution of endemic equilibria in (𝜎,𝜙), (𝜙,𝜃), and (𝜎,𝜃) planes. Thus the parameter space is divided into several parts. In the yellow area, system (3) has two endemic equilibria, one of which is locally asymptotically stable. In the “no endemic equilibrium” region, the worm-free equilibrium is globally asymptotically stable. In the “one endemic equilibrium” region, the unique endemic equilibrium is globally asymptotically stable. From Figure 9, we can obtain the corresponding value ranges of 𝜎, 𝜙, and 𝜃 just as 𝛽 easily. This can be an instruction to control parameter values and provides a good basis for the establishment of control measures in practical terms.

Synthesizing the above analysis and simulation results, some control strategies can be implemented: in both cases (forward and backward bifurcation), it is strongly recommended that one should periodically acquire and run antivirus software of the newest version. Filtering and blocking suspicious messages with a firewall is also suggested. Educational efforts should be rolled out to increase the public awareness of worm propagation. Especially in the case of backward bifurcation, in order to control the spread of the worm, one must further strengthen the implementation of these measures.

6. Conclusion

In the vast majority of Internet worm models [30–35], the basic reproduction number 𝑅₀ is the critical threshold condition. Various actions are taken to control the system parameter values so that 𝑅₀<1, then the solutions of the system will approach worm-free equilibrium finally; that is, the spread of worm can be controlled. In our paper, by characterizing the user protection behaviors, we propose a mathematical model which is coupled with the adaptive user protection behaviors for the Internet worm propagation. The theoretical analysis demonstrates that the protection behavior can reduce the value of the basic reproduction number to below one. Besides, we find that the simple model exhibits a very interesting and rich spectrum of dynamical behaviors, such as backward bifurcation, saddle-node bifurcation. Thus, in this case, the basic reproduction number below one is not the only threshold condition for the computer worm control. In the backward bifurcation case, one must further strengthen the protection to control the spread of worm. These results show that whether the user selects protection has an important effect on worm controlling. Moreover, enhancing the protection consciousness of users or speeding up the antivirus software upgrade can delay the arrival time of second peak of infectious computer, which is essential for the security professionals. To sum up, our results are new discoveries in the field of Internet worm propagation and can bring new perspectives to defense and control worm propagation.

Appendices

A. The Proof of Theorem 4

In this subsection, we investigate the dynamics near 𝐸^∗ in the second item of case (III) by the center manifold theorem [25, 26]. Firstly, using 𝑆₁+𝑆₂+𝐼=1, system (3) is qualitatively equivalent to 𝑆̇₂=𝑝𝜇+𝜙1−𝑆₂−𝐼−𝜎𝛽𝑆₂𝐼−𝜇𝑆₂+𝑞𝛾𝐼−𝜃𝑆₂,𝐼̇=𝛽1−𝑆₂−𝐼𝐼+𝜎𝛽𝑆₂𝐼−𝜇𝐼−𝛾𝐼. (A.1) From the previous analysis, we can obtain that the eigenvalues corresponding to 𝐸^∗ are Λ₁=0 and Λ₂=−(𝛽𝐼^∗+𝜎𝛽𝐼^∗+𝜇+𝜃+𝜙).

Secondly, shifting 𝐸^∗ to the origin via 𝑥₁=𝑆₂−𝑆^∗₂ and 𝑥₂=𝐼−𝐼^∗, system (A.1) can be transformed into 𝑥̇₁=−𝜎𝛽𝐼^∗+𝜇+𝜃+𝜙𝑥₁−𝜙+𝜎𝛽𝑆^∗₂−𝑞𝛾𝑥₂−𝜎𝛽𝑥₁𝑥₂,𝑥̇₂=−(1−𝜎)𝛽𝐼^∗𝑥₁−𝛽𝐼^∗𝑥₂−(1−𝜎)𝛽𝑥₁𝑥₂−𝛽𝑥²₂. (A.2)

Thirdly, define the transformation 𝑥₁𝑥₂𝑦=𝐻¹𝑦₂1,𝐻=𝜎𝛽𝐼^∗+𝜇+𝜃+𝜙(1−𝜎)𝛽𝐼^∗𝜎−11, (A.3) which transformed system (A.2) into the following standard form 𝑦̇₁=𝑓₁𝑦₁,𝑦₂,𝑦̇₂=Λ₂𝑦₂+𝑓₂𝑦₁,𝑦₂, (A.4) where 𝑓₁=(𝑐/𝑎)𝜎𝛽(1−𝜎)𝑦²₁−((𝑐𝜎𝛽(1−(𝑏/𝑐))+𝑏𝛽(1−(𝑏/𝑐)))/𝑎)𝑦₁𝑦₂+((𝑏𝛽+𝑏²𝛽/(1−𝜎)𝑐)/𝑎)𝑦²₂ and 𝑓₂=−(𝑐𝜎𝛽(1−𝜎)²/𝑎)𝑦²₁+((𝜎−1+(1+𝜎)(𝑏/𝑐))/𝑎)𝑦₁𝑦₂−((𝑏(1+𝜎)+𝑐𝛽)/𝑎)𝑦²₂, with 𝑎=𝛽𝐼^∗+𝜎𝛽𝐼^∗+𝜇+𝜃+𝜙, 𝑏=𝜎𝛽𝐼^∗+𝜇+𝜃+𝜙, 𝑐=𝛽𝐼^∗, 𝑑=𝜙+𝜎𝛽𝑆^∗₂−𝛾, and 𝑎=𝑏+𝑐, (1−𝜎)𝑑−𝑏=0 are satisfied.

By the existence theorem [27], there exists a center manifold for system (A.4), which can be expressed locally as follows: 𝑊^𝑐(0)=𝑦₁,𝑦₂∈ℝ²𝑦₂=ℎ𝑦₁,𝑦₁<𝛿,ℎ(0)=0,𝐷ℎ(0)=0𝛿>0, (A.5) with 𝛿 sufficiently small, and 𝐷ℎ is the derivative of ℎ with respect to 𝑦₁.

To compute the center manifold 𝑊^𝑐(0), we suppose ℎ(𝑦₁) has the form ℎ𝑦₁=ℎ₁𝑦²₁+ℎ₂𝑦³₁+ℎ₃𝑦⁴₁+ℎ₄𝑦⁵₁+⋯. (A.6) By the local center manifold theorem, the center manifold (A.6) satisfies 𝐷ℎ⋅𝑓₁𝑦₁,𝑦₂−𝜎₂𝑦₂−𝑓₂𝑦₁,𝑦₂=0, (A.7) where 𝐷ℎ(𝑦₁)=2ℎ₁𝑦₁+3ℎ₂𝑦²₁+4ℎ₃𝑦³₁+5ℎ₄𝑦⁴₁+⋯.

Rewrite 𝑓₁ and 𝑓₂ as 𝑓₁=𝑎₁𝑦²₁+𝑎₂𝑦₁𝑦₂+𝑎₃𝑦²₂ and 𝑓₂=𝑏₁𝑦²₁+𝑏₂𝑦₁𝑦₂+𝑏₃𝑦²₂, respectively, where 𝑎₁=𝑐𝑎(),𝑎𝜎𝛽1−𝜎₂=𝑐𝜎𝛽(1−(𝑏/𝑐))+𝑏𝛽(1−(𝑏/𝑐))𝑎,𝑎₃=𝑏𝛽+𝑏²𝛽/(1−𝜎)𝑐𝑎,𝑏₁()=−𝑐𝜎𝛽1−𝜎²𝑎,𝑏₂=𝜎−1+(1+𝜎)(𝑏/𝑐)𝑎,𝑏₃𝑏()=−1+𝜎+𝑐𝛽𝑎. (A.8) Substituting (A.4) into (A.7) and then equating coefficients on each power of 𝑦₁ to zero yields ℎ₁=1Λ₂,ℎ₂=2𝑎₁ℎ₁−𝑏₂ℎ₁Λ₂,ℎ₃=2𝑎₁ℎ²₁+3𝑎₁ℎ₂−𝑏₂ℎ₂−𝑏₃ℎ²₁Λ₂,ℎ₄=5𝑎₂ℎ₁ℎ₂+2𝑎₃ℎ³₁+4𝑎₁ℎ₃−𝑏₂ℎ₃−2𝑏₃ℎ₁ℎ₂Λ₂. (A.9) Then, we get the approximation for ℎ: 1ℎ=Λ₂𝑦²₁+2𝑎₁ℎ₁−𝑏₂ℎ₁𝑦³₁+2𝑎₁ℎ²₁+3𝑎₁ℎ₂−𝑏₂ℎ₂−𝑏₃ℎ²₁𝑦⁴₁+5𝑎₂ℎ₁ℎ₂+2𝑎₃ℎ³₁+4𝑎₁ℎ₃−𝑏₂ℎ₃−2𝑏₃ℎ₁ℎ₂𝑦⁵₁+⋯. (A.10) Substituting (A.10) in the first equation of system (A.4), we achieve 𝑦̇₁=𝑓₁𝑦₁,𝑦₂=(𝜎−1)𝜎𝛽²𝐼^∗Λ₂𝑦²₁+𝑐𝜎𝛽²(1−𝜎)²[𝑐𝜎(1−(𝑏/𝑐))+𝑏(1+(𝑏/𝑐))]𝑎³𝑦³₁+⋯. (A.11) So from (A.11) (see [36, page 338–340]), we get the following. If 𝐶>0(𝑅_pro<1), 𝐵<0, and Δ=0, system (3) has one positive equilibrium 𝐸^∗, and 𝐸^∗ is a saddle node.

B. The Proof of Theorem 5

From Section 3.2, we can see that when 𝐶>0(𝑅_pro<1), 𝐵<0, and if the sign of Δ changes, system (3) will experience a saddle-node bifurcation. In this part, we give the proof.

Let us consider 𝛽 as a control parameter, define 𝛽₀≜𝛽_Δ, 𝑥₀(𝑥^∗₁,𝑥^∗₂)=𝐸^∗(𝑆^∗₂,𝐼^∗), where 𝐼^∗=−𝐵/2𝐴.

Rewrite system (A.1) as ̇=𝑥𝑥=𝑓𝑥,𝛽𝑝𝜇+𝜙−𝜇+𝜃+𝜙₁+𝑞𝛾−𝜙𝑥₂−𝜎𝛽𝑥₁𝑥₂𝛽−𝜇+𝛾𝑥₂−(1−𝜎)𝛽𝑥₁𝑥₂−𝛽𝑥²₂. (B.1) Then we have 𝐷𝑓𝑥₀,𝛽₀=−𝜎𝛽₀𝑥^∗₂+𝜇+𝜃+𝜙𝑞𝛾−𝜙−𝜎𝛽₀𝑥^∗₁−(1−𝜎)𝛽₀𝑥^∗₂−𝛽₀𝑥^∗₂,𝑓_𝛽𝑥₀,𝛽₀=−𝜎𝑥^∗₁𝑥^∗₂𝑥^∗₂−(1−𝜎)𝑥^∗₁𝑥^∗₂−𝑥₂^∗2. (B.2)𝐷𝑓(𝑥₀,𝛽₀) has a simple eigenvalue 𝜆=0 with eigenvector 𝑣=[1,𝜎−1]^𝑇 and 𝐷^𝑇𝑓(𝑥₀,𝛽₀) has an eigenvector 𝑤=[−(𝛽₀𝑥^∗₂/(𝜎𝛽₀𝑥^∗₁+𝜙−𝑞𝛾)),1]^𝑇, corresponding to 𝜆=0. Furthermore, the following conditions are satisfied: 𝑤^𝑇𝑓_𝛽𝑥₀,𝛽₀=𝑥^∗₂𝜎𝛽₀𝑥^∗₁×()𝑥+𝜙−𝑞𝛾1−1−𝜎^∗₁−𝑥^∗₂𝜎𝛽₀𝑥^∗₁+𝜙−𝑞𝛾+𝜎𝛽₀𝑥^∗₁𝑥^∗₂𝑤≠0,_𝑇𝐷²𝑓𝑥₀,𝛽₀(𝑣,𝑣)=2𝜎𝛽²₀(𝜎−1)𝑥^∗₂𝜎𝛽₀𝑥^∗₁+𝜙−𝑞𝛾≠0. (B.3) According to the theorem (see [37, page 148]), we obtain the following result. System (3) experiences a saddle-node bifurcation at the equilibrium 𝑥₀=𝐸^∗ as the parameter 𝛽 passes through the bifurcation value 𝛽=𝛽₀.

Conflict of Interests

No conflict of interests exists in the submission of this paper, and the paper is approved by all authors for publication.

Acknowledgments

This work is supported by the National Natural Science Foundation of China (11171314, 61171179, 11247244, 61301259, and 61379125), Program for Basic Research of Shanxi province (2012011015-3).