Hopf Bifurcation in an SEIDQV Worm Propagation Model with Quarantine Strategy

Abstract

Worms exploiting zero-day vulnerabilities have drawn significant attention owing to their enormous threats to the Internet. In general, users may immunize their computers with countermeasures in exposed and infectious state, which may take a period of time. Through theoretical analysis, time delay may lead to Hopf bifurcation phenomenon so that the worm propagation system will be unstable and uncontrollable. In view of the above factors, a quarantine strategy is thus proposed in the study. In real network, unknown worms and worm variants may lead to great risks, which misuse detection system fails to detect. However, anomaly detection is of help in detecting these kinds of worm. Consequently, our proposed quarantine strategy is built on the basis of anomaly intrusion detection system. Numerical experiments show that the quarantine strategy can diminish the infectious hosts sharply. In addition, the threshold 𝜏₀ is much larger after using our quarantine strategy, which implies that people have more time to remove worms so that the system is easier to be stable and controllable without Hopf bifurcation. Finally, simulation results match numerical ones well, which fully supports our analysis.

1. Introduction

In recent years, with the rapid development of computer technologies and network applications, Internet has become a powerful mechanism for propagating malicious software programs.Systems running on network computers become more vulnerable to digital threats. In particular,worms that exploit zero-day vulnerabilities have brought severe threats to Internet security. To a certain extent, the propagation of worms in a system of interacting computers could be compared with infectious diseases in a population. Anderson and May discussed the spreading nature of biological viruses, parasites and so forth.leading to infectious diseases in human population through several epidemic models [1, 2]. The action of worms throughout a network can be studied by using epidemiological models for disease propagation [3–8]. Mishra and Saini [4] present a SEIRS model with latent and temporary immune periods, which can reveal common worm propagation. Dong et al. propose a computer virus model with time delay based on an SEIR model and regard time delay as bifurcating parameter to study the dynamical behaviors which include local asymptotical stability and local Hopf bifurcation [9]. Ren et al. give a novel computer virus propagation model and study its dynamic behaviors [10]. L.-X. Yang and X. Yang also investigates the propagation behavior of virus programs provided infected computers are connected to the Internet with positive probability [11]. Gan et al. examine the propagation behavior of computer virus under human intervention [12]. The use of a quarantine strategy has produced a tremendous effect on controlling disease. Inspired by this, quarantine strategy is also widely used in worm containment [13–18]. Based on the two-factor model, Zou et al. proposes a worm propagation model under dynamic quarantine defense [15]. Wang et al. proposes a novel epidemic model, which combines both vaccinations and dynamic quarantine methods, referred to as SEIQV model [18].

However, previous studies have failed to consider the appropriate quarantine strategy to eliminate the negative effect of time delay, which may lead to Hopf bifurcation phenomenon so that the worm propagation system will be unstable and uncontrollable. In this paper, time delay is introduced in a worm propagation model. Users may immunize their computers with countermeasures in exposed and infectious state, which may take a period of time. Through theoretical analysis, it is proved that the system is stable when time delay is less than the threshold 𝜏₀ and Hopf bifurcation appears when time delay is equal to or greater than the threshold. Moreover, unknown worms and worm-variants may lead to great risks. In order to make up the deficiency of vaccination strategy and eliminate the negative effect of time delay, a quarantine strategy is thus proposed in our study. The current quarantine strategy generally depends on the intrusion detection system, which can be classified into two categories: misuse and anomaly intrusion detection. While misuse detection system fails to detect unknown worms and worm-variants, anomaly detection is of help in detecting these kinds of worm. Consequently, our proposed quarantine strategy is on the basis of anomaly intrusion detection system. According to the above descriptions, we present an SEIDQV worm propagation model to study the behaviors of worm propagation in the real world. Then, the stability of the positive equilibrium and the critical value of Hopf bifurcation are studied. By analysis, the quarantine strategy can diminish the infectious hosts sharply. Moreover, the threshold 𝜏₀ is much larger after using our quarantine strategy, which implies that people have more time to remove worms so that the system is easier to be stable and controllable without Hopf bifurcation.

The rest of the paper is organized as follows. Section 2 provides an SEIDQV worm propagation model. In Section 3, we analyze the stability of the positive equilibrium and the threshold of Hopf bifurcation. Section 4 describes the numerical analysis of our model. In Section 5, we present simulation experiments based on slammer worm. The simulation results match well with numerical ones. Finally, Section 6 gives the conclusions.

2. Model Formulation

Considering worms exploiting zero-day vulnerabilities, none of effective and reliable safety patches could immunize the hosts.Susceptible hosts first go through a latent period (exposed) after infection before becoming infectious [9]. People may immunize their computers with countermeasures in exposed and infectious hosts, which may take a period of time. Since time delay exists, infectious hosts go through a temporary state (delayed) after vaccination before becoming vaccinated. What is more, unknown worms and worm-variants may lead to great risks. To our knowledge, quarantine strategies have produced a tremendous effect on controlling disease. Enlightened by this, quarantine strategies are also widely used in worm containment. In order to make up the deficiency of vaccination strategy and eliminate the negative effect of time delay, a quarantine strategy is thus proposed in the study. The current quarantine strategy generally depends on the intrusion detection system, which can be classified into two categories: misuse and anomaly intrusion detection. On one hand, misuse intrusion detection system, which constructs a database with the feather of known attack behaviors, can recognize invaders once their behaviors agree with one of the databases. Although the system can accurately detect known worms, it fails to detect unknown worms and worm variants. On the other hand, an attack can be detected by the anomaly detection system as long as its behavior differs from any database consisting of normal behaviors, which is of help in detecting unknown worms and worm variants. Consequently, our proposed quarantine strategy is on the basis of anomaly intrusion detection system. Meanwhile, anomaly detection system is accompanied by false-positive rates. The quarantine is implemented as follows: the infectious, exposed and susceptible hosts are detected by the anomaly intrusion detection system. The advantage of this strategy lies in detecting unknown worms and worm variants effectively. As anomaly detection system is accompanied by false-positive rates, the quarantine strategy adds two transitions as a result of the influence of the anomaly detection method. The false-positive rates of exposed and susceptible hosts detected by the anomaly detection method are set 𝜃₂ and 𝜃₃, respectively.

According to the descriptions above, we give an SEIDQV worm propagation model with quarantine strategy. Assume all hosts are in one of six states: Susceptible state (𝑆), Exposed state (𝐸), Infectious state (𝐼), Delayed state (𝐷), Quarantined state (𝑄), and Vaccinated state (𝑉). Let 𝑆(𝑡) denote the number of susceptible hosts at time 𝑡, 𝐸(𝑡) denote the number of exposed hosts at time 𝑡,𝐼(𝑡) denote the number of infectious hosts at time 𝑡, 𝐷(𝑡) denote the number of delayed hosts at time 𝑡, 𝑄(𝑡) denote the number of quarantined hosts at time 𝑡, and 𝑉(𝑡) denote the number of vaccinated hosts at time 𝑡. 𝛽 is the infection rate at which susceptible hosts are infected by infectious hosts, and 𝛾 is the rate of removal of infectious for circulation. 𝜇 is the rate that vaccinated hosts become susceptible. Time delay is denoted by 𝜏. More parameters are listed in Table 1. The states and state transition diagram of the SEIDQV model are given in Figure 1.

Table 1 

Notations in this paper.

Figure 1 

The states and state transitions in SEIDQV model.

In order to understand clearly, we list in Table 1 some frequently used notations in this paper.

From the above definitions in the paper, we write down the complete differential equations of the SEIDQV model: 𝑑𝑆(𝑡)(𝑡)𝐼(𝑡)𝑑𝑡=−𝛽𝑆−𝜃₃𝑆(𝑡)(𝑡),(𝑡)+𝜇𝑉𝑑𝐸(𝑡)𝐼(𝑡)(𝑡)𝑑𝑡=𝛽𝑆−𝛼𝐸−𝜃₂𝐸(𝑡)(),(𝑡)−𝜈𝐸𝑡−𝜏𝑑𝐼(𝑡)(𝑡)𝑑𝑡=𝛼𝐸−𝛾𝐼−𝜃₁𝐼(𝑡),𝑑𝐷(𝑡)(𝑡)(),(𝑡)𝑑𝑡=𝛾𝐼−𝛾𝐼𝑡−𝜏𝑑𝑄𝑑𝑡=𝜃₁𝐼(𝑡)+𝜃₂𝐸(𝑡)+𝜃₃𝑆(𝑡)(𝑡),(𝑡)−𝛿𝑄𝑑𝑉()()(𝑡)(𝑡).𝑑𝑡=𝜈𝐸𝑡−𝜏+𝛾𝐼𝑡−𝜏+𝛿𝑄−𝜇𝑉 (2.1)

As mentioned above, the population size is set 𝑁, which is set to unity 𝑆(𝑡)+𝐸(𝑡)+𝐼(𝑡)+𝐷(𝑡)+𝑄(𝑡)+𝑉(𝑡)=𝑁. (2.2)

3. Stability of the Positive Equilibrium and Bifurcation Analysis

Theorem 3.1. The system has a unique positive equilibrium 𝐸^∗(𝑆^∗,𝐸^∗,𝐼^∗,𝐷^∗,𝑄^∗,𝑉^∗) when it satisfies the following condition: 𝐻₁𝛼𝛽𝜇𝛿𝑁𝜇𝛿+𝜇𝜃₃+𝛿𝜃₃𝛾+𝜃₁𝛼+𝜃₂+𝜈>1,where𝑆^∗=𝛾+𝜃₁𝛼+𝜃₂+𝜈,𝐸𝛼𝛽_∗=𝛾+𝜃₁𝛼𝐼^∗,𝐷^∗=0,𝑄^∗=𝛼𝜃₁+𝜃₂𝛾+𝜃₁𝐼𝛼𝛿^∗+𝜃₃𝛿𝑆^∗,𝑉^∗=𝜈𝜇𝐸^∗+𝛾𝜇𝐼^∗+𝛿𝜇𝑄^∗. (3.1)

Proof. For system (2.1), if all the derivatives on the left of equal sign of the system are set to 0, which implies that the system becomes stable, we can derive 𝑆=𝛾+𝜃₁𝛼+𝜃₂+𝜈,𝛼𝛽𝐸=𝛾+𝜃₁𝛼𝐼^∗,𝐷=0,𝑄=𝛼𝜃₁+𝜃₂𝛾+𝜃₁𝐼𝛼𝛿^∗+𝜃₃𝛿𝑆^∗,𝜈𝑉=𝜇𝐸^∗+𝛾𝜇𝐼^∗+𝛿𝜇𝑄^∗. (3.2) Substituting the value of each variable in (3.2) for each of (2.2), then we can derive 𝑆^∗+𝛾+𝜃₁𝛼𝐼^∗+𝐼^∗+𝛼𝜃₁+𝜃₂𝛾+𝜃₁𝐼𝛼𝛿^∗+𝜃₃𝛿𝑆^∗+𝜈𝜇𝛾+𝜃₁𝛼𝐼^∗+𝛾𝜇𝐼^∗+𝛿𝜇𝑄^∗=𝑁. (3.3)
Obviously, if (𝐻₁) is satisfied, (3.3) has one unique positive root 𝐼^∗, and there is one unique positive equilibrium 𝐸^∗(𝑆^∗,𝐸^∗,𝐼^∗,𝐷^∗,𝑄^∗,𝑉^∗) of system (2.1). The proof is completed.

According to (2.2), 𝑄(𝑡)=𝑁−𝑆(𝑡)−𝐸(𝑡)−𝐼(𝑡)−𝐷(𝑡)−𝑉(𝑡), thus system (2.1) can be simplified to 𝑑𝑆(𝑡)(𝑡)𝐼(𝑡)𝑑𝑡=−𝛽𝑆−𝜃₃𝑆(𝑡)(𝑡),(𝑡)+𝜇𝑉𝑑𝐸(𝑡)𝐼(𝑡)(𝑡)𝑑𝑡=𝛽𝑆−𝛼𝐸−𝜃₂𝐸(𝑡)(),(𝑡)−𝜈𝐸𝑡−𝜏𝑑𝐼(𝑡)(𝑡)𝑑𝑡=𝛼𝐸−𝛾𝐼−𝜃₁𝐼(𝑡),𝑑𝐷(𝑡)(𝑡)(),(𝑡)𝑑𝑡=𝛾𝐼−𝛾𝐼𝑡−𝜏𝑑𝑉()()((𝑡)(𝑡)(𝑡)(𝑡)(𝑡(𝑡).𝑑𝑡=𝜈𝐸𝑡−𝜏+𝛾𝐼𝑡−𝜏+𝛿𝑁−𝑆−𝐸−𝐼−𝐷−𝑉))−𝜇𝑉 (3.4)

The Jacobi matrix of (3.4) about 𝐸^∗(𝑆^∗,𝐸^∗,𝐼^∗,𝐷^∗,𝑉^∗) is given by 𝐽𝐸^∗=−𝛽𝐼^∗−𝜃₃0−𝛽𝑆^∗0𝜇𝛽𝐼^∗−𝛼−𝜃₂−𝜈𝑒^−𝜆𝜏𝛽𝑆^∗000𝛼−𝛾−𝜃₁0000𝛾−𝛾𝑒^−𝜆𝜏00−𝛿𝜈𝑒^−𝜆𝜏−𝛿𝛾𝑒^−𝜆𝜏−𝛿−𝛿−𝛿−𝜇. (3.5) The characteristic equation of that matrix can be obtained by 𝑃(𝜆)+𝑄(𝜆)𝑒^−𝜆𝜏𝑃(𝜆)=0,=𝜆⁵+𝑝₄𝜆⁴+𝑝₃𝜆³+𝑝₂𝜆²+𝑝₁𝜆+𝑝₀,𝑄(𝜆)=𝑞₄𝜆⁴+𝑞₃𝜆³+𝑞₂𝜆²+𝑞₁𝜆+𝑞₀, (3.6) where 𝑝₄=𝛽𝐼^∗+𝛼+𝛿+𝜇+𝛾+𝜃₁+𝜃₂+𝜃₃,𝑝₃=𝛼+𝛾+𝜃₁+𝜃₂𝛿+𝜇+𝛽𝐼^∗+𝜃₃+𝛽𝐼^∗+𝜃₃𝛿+𝜇−𝛾+𝜃₁𝑝𝜈,₂=𝛽𝐼^∗+𝜃₃𝛼+𝛾+𝜃₁+𝜃₂𝜇+𝛿+𝛾+𝜃₁𝛼𝛽𝐼^∗+𝜃₂𝛽𝐼^∗−𝛿𝜈−𝜇𝜈−𝜃₃𝜈+𝛿𝜇𝛽𝐼^∗,𝑝₁=𝛾+𝜃₁𝛿+𝜇𝛼+𝜃₂𝛽𝐼^∗−𝜃₃𝜈+𝛼+𝛾+𝜃₁𝛿𝜇𝛽𝐼^∗,𝑝₀=𝛿𝛼𝜇𝛾𝛽𝐼^∗,𝑞₄=𝜈,𝑞₃=𝜈𝛿+𝜇+𝛽𝐼^∗+𝛾+𝜃₁+𝜃₃,𝑞₂=𝜈𝛽𝐼^∗+𝜃₃𝛿+𝜇+𝛾+𝜃₁𝛽𝐼^∗+𝜃₃+𝛿+𝜇−𝜇𝛽𝐼^∗,𝑞₁=𝛾+𝜃₁𝛽𝐼^∗+𝜃₃𝛿+𝜇𝜈−𝛼𝛾+𝛾𝜈+𝜃₁𝜈𝛿𝜇𝛽𝐼^∗,𝑞₀=−𝛿𝛼𝜇𝛾𝛽𝐼^∗. (3.7)

Theorem 3.2. The positive equilibrium 𝐸^∗ is locally asymptotically stable without time delay, if the following holds: 𝐻₂𝑝₄+𝑞₄>0,𝑑₁>0,𝑝₂+𝑞₂𝑑₁−𝑝₁+𝑞₁𝑝₄+𝑞₄²>0,𝑝₁+𝑞₁>0. (3.8)

Proof. If  𝜏=0, (3.6) reduces to 𝜆⁴+𝑝₄+𝑞₄𝜆³+𝑝₃+𝑞₃𝜆²+𝑝₂+𝑞₂𝜆+𝑝₁+𝑞₁=0. (3.9)
According to Routh-Hurwitz criterion, all the roots of (3.9) have negative real parts. Therefore, it can be deduced that the positive equilibrium 𝐸^∗ is locally asymptotically stable without time delay. The proof is completed.

Obviously, 𝜆=𝑖𝜔(𝜔>0) is a root of (3.6). After separating the real and imaginary parts, it can be written as 𝑝₄𝜔⁴−𝑝₂𝜔²+𝑝₀+𝑞₄𝜔⁴−𝑞₂𝜔²+𝑞₀cos(𝜔𝜏)+𝑞₁𝜔−𝑞₃𝜔³()𝜔sin𝜔𝜏=0,₅−𝑝₃𝜔³+𝑝₁𝜔−𝑞₄𝜔⁴−𝑞₂𝜔²+𝑞₀sin(𝜔𝜏)+𝑞₁𝜔−𝑞₃𝜔³cos(𝜔𝜏)=0, (3.10) which implies 𝜔⁸+𝐷₃𝜔⁶+𝐷₂𝜔⁴+𝐷₁𝜔²+𝐷₀=0, (3.11) where 𝐷₃=𝑝₄²−𝑞₄²−2𝑝₃,𝐷₂=𝑝₃²−𝑞₃²−2𝑝₂𝑝₄+2𝑞₂𝑞₄+2𝑝₁,𝐷₁=𝑝₂²−𝑞₂²+2𝑝₀𝑝₄−2𝑞₀𝑞₄−2𝑝₁𝑝₃+2𝑞₁𝑞₃,𝐷₀=𝑝₁²−𝑞₁²−2𝑝₀𝑝₂+2𝑞₀𝑞₂. (3.12)

Let 𝑧=𝜔², (3.11) can be written as ℎ(𝑧)=𝑧⁴+𝐷₃𝑧³+𝐷₂𝑧²+𝐷₁𝑧+𝐷₀ (3.13) Yang et al. [19] obtained the following results on the distribution of roots of (3.13). Denote 1𝑚=2𝐷₂−3𝐷16³²1,𝑛=𝐷32³³−18𝐷₃𝐷₂+𝐷₁𝑛,Δ=2²+𝑚3³√,𝜎=−1+3𝑖2,𝑦₁=³−𝑛2+√Δ+³−𝑛2−√Δ,𝑦₂=³−𝑛2+√Δ𝜎+³−𝑛2−√Δ𝜎²,𝑦₃=³−𝑛2+√Δ𝜎²+³−𝑛2−√Δ𝜎,𝑧_𝑖=𝑦_𝑖−3𝐷₃4(𝑖=1,2,3). (3.14)

Lemma 3.3. For the polynomial equation (3.13)(1)if 𝐷₀<0, then (3.13) has at least one positive root.(2)if 𝐷₀≥0 and Δ≥0, then (3.13) has positive roots if and only if 𝑧₁>0 and ℎ(𝑧₁)<0,(3)if 𝐷₀≥0 and Δ<0, then (3.13) has positive roots if and only if there exists at least one 𝑧^∗∈(𝑧₁,𝑧₂,𝑧₃), such 𝑧^∗>0 and ℎ(𝑧^∗)≤0.

Lemma 3.4. Suppose that (𝐻₂)𝑝₄+𝑞₄>0,𝑑₁>0,(𝑝₂+𝑞₂)𝑑₁−(𝑝₁+𝑞₁)(𝑝₄+𝑞₄)²>0,𝑝₁+𝑞₁>0 is satisfied.(1)If one of following holds: (a) 𝐷₀<0; (b) 𝐷₀≥0,Δ≥0,𝑧₁>0 and ℎ(𝑧₁)<0; (c) 𝐷₀≥0,Δ<0, and there exists at least 𝑧^∗∈(𝑧₁,𝑧₂,𝑧₃) such that 𝑧^∗>0 and ℎ(𝑧^∗)≤0, then all roots of (3.6) have negative real parts when 𝜏∈[0,𝜏₀), 𝜏₀ is a certain positive constant.(2)If the conditions (a)–(c) are not satisfied, then all roots of (3.6) have negative real parts for all 𝜏≥0.

Proof. When 𝜏=0, (3.6) can be reduced to 𝜆⁴+𝑝₄+𝑞₄𝜆³+𝑝₃+𝑞₃𝜆²+𝑝₂+𝑞₂𝜆+𝑝₁+𝑞₁=0. (3.15)
By the Routh-Hurwitz criterion,all roots of (3.9) have negative real parts and only if 𝑝₄+𝑞₄>0,𝑑₁>0,(𝑝₂+𝑞₂)𝑑₁−(𝑝₁+𝑞₁)(𝑝₄+𝑞₄)²>0,𝑝₁+𝑞₁>0.
From Lemma 3.3, it can be known that if (a)–(c) are not satisfied, then (3.6) has no roots with zero real part for all 𝜏≥0; if one of (a)–(c) holds, when 𝜏≥𝜏_𝑘^(𝑗)(𝑘=1,2,3,4,𝑗≥1), (3.6) has no roots with zero real part and 𝜏₀ is the minimum value of 𝜏, so (3.6) has purely imaginary roots. According to [20], one obtains the conclusion of the lemma.
When conditions (a)–(c) of Lemma 3.4 are not satisfied, ℎ(𝑧) always has no positive root. Therefore, under these conditions, (3.6) has no purely imaginary roots for any 𝜏>0, which implies that the positive equilibrium 𝐸^∗(𝑆^∗,𝐸^∗,𝐼^∗,𝐷^∗,𝑄^∗,𝑉^∗) of system (2.1) is absolutely stable. Therefore, the following theorem on the stability of positive equilibrium 𝐸^∗(𝑆^∗,𝐸^∗,𝐼^∗,𝐷^∗,𝑄^∗,𝑉^∗) can be easily obtained.

Theorem 3.5. Assume that (𝐻₁) and (𝐻₂) are satisfied, (a) 𝐷₀≥0,Δ≥0,𝑧₁<0 or ℎ(𝑧₁)>0; (b) 𝐷₀≥0,Δ<0, and there is no 𝑧^∗∈(𝑧₁,𝑧₂,𝑧₃), such that 𝑧^∗>0 and ℎ(𝑧^∗)≤0. Then the positive equilibrium 𝐸^∗(𝑆^∗,𝐸^∗,𝐼^∗,𝐷^∗,𝑄^∗,𝑉^∗) of system (2.1) is absolutely stable. Namely, 𝐸^∗(𝑆^∗,𝐸^∗,𝐼^∗,𝐷^∗,𝑄^∗,𝑉^∗) is asymptotically stable for any time delay 𝜏≥0.

Assume that the coefficients in ℎ(𝑧) satisfy the condition as follows:

(𝐻₃) (a) 𝐷₀≥0,Δ≥0,𝑧₁<0or ℎ(𝑧₁)>0; (b) 𝐷₀≥0,Δ<0, and there is no 𝑧^∗∈(𝑧₁,𝑧₂,𝑧₃), such that 𝑧^∗>0 and ℎ(𝑧^∗)≤0.

According to the previous lemma,it is proved that (3.13) has at least a positive root 𝜔₀, namely, the characteristic equation (3.6) has a pair of purely imaginary roots ±𝑖𝜔₀.

In view of the fact that (3.6) has a pair of purely imaginary roots ±𝑖𝜔₀, the corresponding 𝜏_𝑘>0 is given by eliminating sin(𝜔𝜏) in (3.10): 𝜏_𝑘=1𝜔₀𝑝arccos²𝜔₀²−𝑝₄𝜔₀⁴−𝑝₀𝑞₄𝜔₀⁴−𝑞₂𝜔₀²+𝑞₀+𝜔₀⁵−𝑝₃𝜔₀³+𝑝₁𝜔₀𝑞₃𝜔₀³−𝑞₁𝜔₀𝑞₄𝜔₀⁴−𝑞₂𝜔₀²+𝑞₀²+𝑞₃𝜔₀³−𝑞₁𝜔₀²+2𝑘𝜋𝜔₀(𝑘=0,1,2,…). (3.16) Let 𝜆(𝜏)=𝑣(𝜏)+𝑖𝜔(𝜏) be the root of (3.6), so that 𝑣(𝜏_𝑘)=0 and 𝜔(𝜏_𝑘)=𝜔₀ are satisfied when 𝜏=𝜏_𝑘.

Lemma 3.6. Suppose ℎ′(𝑧₀)≠0. If 𝜏=𝜏₀, then ±𝑖𝜔₀ is a pair of purely imaginary roots of (3.6). In addition, if the conditions in Lemma 3.4(1) are satisfied, then 𝑑(Re𝜆)𝑑𝜏_{𝜏=𝜏𝑘}>0. (3.17)

This signifies that it exists at least one eigenvalue with positive real part for 𝜏>𝜏_𝑘. Differentiating both sides of (3.6) with respect to 𝜏, it can be written as: 𝑑𝜆𝑑𝜏⁻¹=5𝜆⁴+4𝑝₄𝜆³+3𝑝₃𝜆²+2𝑝₂𝜆+𝑝₁𝑞₄𝜆⁴+𝑞₃𝜆³+𝑞₂𝜆²+𝑞₁𝜆+𝑞₀𝜆𝑒^−𝜆𝜏+4𝑞₄𝜆³+3𝑞₃𝜆²+2𝑞₂𝜆+𝑞₁𝑒^−𝜆𝜏𝑞₄𝜆⁴+𝑞₃𝜆³+𝑞₂𝜆²+𝑞₁𝜆+𝑞₀𝜆𝑒^−𝜆𝜏−𝑞₄𝜆⁴+𝑞₃𝜆³+𝑞₂𝜆²+𝑞₁𝜆+𝑞₀𝜏𝑒^−𝜆𝜏𝑞₄𝜆⁴+𝑞₃𝜆³+𝑞₂𝜆²+𝑞₁𝜆+𝑞₀𝜆𝑒^−𝜆𝜏=5𝜆⁴+4𝑝₄𝜆³+3𝑝₃𝜆²+2𝑝₂𝜆+𝑝₁𝑒^𝜆𝜏𝑞₄𝜆⁴+𝑞₃𝜆³+𝑞₂𝜆²+𝑞₁𝜆+𝑞₀𝜆+4𝑞₄𝜆³+3𝑞₃𝜆²+2𝑞₂𝜆+𝑞₁𝑞₄𝜆⁴+𝑞₃𝜆³+𝑞₂𝜆²+𝑞₁𝜆+𝑞₀𝜆−𝜏𝜆. (3.18) Therefore, sgn𝑑Re𝜆𝑑𝜏_{𝜏=𝜏𝑘}=sgnRe𝑑𝜆𝑑𝜏⁻¹_{𝜆=𝑖𝜔0}=sgnRe5𝜆⁴+4𝑝₄𝜆³+3𝑝₃𝜆²+2𝑝₂𝜆+𝑝₁𝑒^𝜆𝜏𝑞₄𝜆⁴+𝑞₃𝜆³+𝑞₂𝜆²+𝑞₁𝜆+𝑞₀𝜆+4𝑞₄𝜆³+3𝑞₃𝜆²+2𝑞₂𝜆+𝑞₁𝑞₄𝜆⁴+𝑞₃𝜆³+𝑞₂𝜆²+𝑞₁𝜆+𝑞₀𝜆−𝜏𝜆_{𝜆=𝑖𝜔0}𝜔=sgn⁰²𝐾4𝜔₀⁶+3𝐷₃𝜔₀⁴+2𝐷₂𝜔₀²+𝐷₁=sgnℎ^′𝜔₀², (3.19) where 𝐾=(𝑞₃𝜔₀⁴−𝑞₁𝜔₀²)²+(𝑞₄𝜔₀⁵−𝑞₂𝜔₀³+𝑞₀𝜔₀)², then it follows the hypothesis (𝐻₃) that ℎ^′(𝜔₀²)≠0.

Hence, 𝑑(Re𝜆)𝑑𝜏_{𝜏=𝜏𝑘}>0. (3.20) The root of characteristic equation (3.6) crosses from left to right on the imaginary axis as 𝜏 continuously varies from a value less than 𝜏_𝑘 to one greater than 𝜏_𝑘 according to Routh’s theorem. Therefore, according to Hopf bifurcation theorem for functional differential equations, the transverse condition holds and the conditions for Hopf bifurcation are satisfied at 𝜏=𝜏_𝑘. Then the following result can be obtained.

Theorem 3.7. Suppose that the conditions (𝐻₁) and (𝐻₂) are satisfied.(1)The equilibrium 𝐸^∗(𝑆^∗,𝐸^∗,𝐼^∗,𝐷^∗,𝑄^∗,𝑉^∗) is locally asymptotically stable when 𝜏∈[0,𝜏₀), but unstable when 𝜏>𝜏₀.(2)If condition (𝐻₃) is satisfied, the system will undergo a Hopf bifurcation at the positive equilibrium 𝐸^∗(𝑆^∗,𝐸^∗,𝐼^∗,𝐷^∗,𝑄^∗,𝑉^∗) when 𝜏=𝜏_𝑘(𝑘=0,1,2,…) where 𝜏_𝑘 is defined by (3.16).

This implies that when time delay 𝜏<𝜏₀, the system will stabilize at its infection equilibrium point, which is beneficial for us to implement a containment strategy; when time delay 𝜏>𝜏₀, the system will be unstable and worms cannot be effectively controlled.

4. Numerical Analysis

In order to simulate the real behavior of the spread of a worm, the parameters in the experiments are practical values. The slammer worm is selected for experiments. 750,000 hosts are picked as the population size, and the worm’s average scan rate is 3300 per second. The worm infection rate can be calculated as 𝛼=𝜂𝑁/2³²=0.5763. It means that average 0.5763 hosts of all the hosts can be scanned by one host. The infection rate is 𝛽=3300/2³²=0.00000077, the recovery rate of infectious hosts is set 𝛾=0.19, the quarantine rates of infectious, exposed and susceptible hosts are set 𝜃₁=0.15, 𝜃₂=0.0002, 𝜃₃=0.00002315. Other parameters are set 𝜇=0.031, 𝛼=0.45, 𝜈=0.0001, and 𝛿=0.04. At the beginning, there are 50 infectious hosts, while others are susceptible. Figures 2–5 show that the propagation trend of the five kinds of host and comparison of infectious hosts before and after adopting quarantine strategy when 𝜏<𝜏₀ and 𝜏>𝜏₀.

Figure 2 

Propagation trend of the five kinds of host when 𝜏<𝜏0.

Figure 3 

Comparison of infectious hosts before and after adopting quarantine strategy if 𝜏<𝜏0.

Figure 4 

Propagation trend of the five kinds of host when 𝜏>𝜏0.

Figure 5 

Comparison of infectious hosts before and after adopting quarantine strategy if 𝜏>𝜏0.

According to the above parameters, Figure 2 shows the curves of five kinds of hosts when 𝜏=5<𝜏₀. All of the five kinds of hosts get stable quickly, which illustrates that 𝐸^∗ is asymptotically stable. It implies that the number of infectious hosts maintain a relatively low value and can be predicted. Further strategies can be developed and utilized to eliminate worms. In Figure 3, when 𝜏=5<𝜏₀, the maximum of infectious hosts is diminished sharply. Finally, the number of infectious hosts is almost 18,000. It is much less than ones without using quarantine strategy. However, when time delay 𝜏 gets increased and then reached the threshold 𝜏₀, 𝐸^∗ will lose its stability and a bifurcation will occur. Figure 4 shows the susceptible, exposed, infectious, quarantined, and vaccinated hosts when 𝜏=100>𝜏₀. In this figure, we can clearly see that the number of infectious hosts will outburst after a short period of peace and repeat again and again but not in the same period, which is hard for us to predict the worm spread or eliminate worms. In Figure 5, when 𝜏=100>𝜏₀, it is clearly that the maximum of infectious hosts is diminished sharply from 170,000 to 40,000, which illustrates that quarantine strategy has much better inhibition impact than single vaccination.

In order to see the influence of time delay, 𝜏 is set to a different value each time with other parameters remaining the same. Figure 6 shows the number of infectious hosts in the same coordinate with time delay 𝜏=5,𝜏=25,𝜏=75,and𝜏=100.

Figure 6 

The number of infectious hosts when 𝜏 is changed in one coordinate.

Initially, the four curves are overlapped which means that time delay has little effect in the initial stage of worm propagation. With the increase of time delay, the curve begins to oscillate. When time delay passes through the threshold 𝜏₀, the infecting process gets unstable. Meanwhile, it can be discovered that the amplitude and period of the number infectious hosts increase.

Figure 7 shows the projection of the phase portrait of system (2.1) in (𝑆,𝐼,𝑉)-space when 𝜏=65,𝜏=80, respectively. In Figure 8, when 𝜏=65, it is clear that the curve converges to a fixed point, which suggests that the system is stable. When 𝜏=80, the curve converges to a limit circle, which implies that the system is unstable.

(a)

(b)

Figure 7 

The projection of the phase portrait of system (2.1) in (𝑆,𝐼,𝑉)-space.

(a)

(b)

Figure 8 

The phase portrait of susceptible hosts 𝑆(𝑡) and infectious hosts 𝐼(𝑡).

Figure 9 shows bifurcation diagram with 𝜏 from 1 to 60; Hopf bifurcation will occur when 𝜏=𝜏₀=42. In Figure 10, it shows bifurcation diagram with 𝜏 from 1 to 120; Hopf bifurcation will occur when 𝜏=𝜏₀=74. The threshold is greater than model without quarantine strategy, which illustrates that the model gets stable easier and the users have more time to remove worms.

Figure 9 

Bifurcation diagram of system (2.1) with 𝜏 from 1 to 60 without quarantine strategy.

Figure 10 

Bifurcation diagram of system (2.1) with 𝜏 from 1 to 120 with quarantine strategy.

5. Simulation Experiments

The discrete-time simulation is an expanded version of Zou’s program simulating Code Red worm propagation. The system in our simulation experiment consists of 750,000 hosts that can reach each other directly, which is consistent with the numerical experiments. At the beginning of simulation, 50 hosts are randomly chosen to be infectious and the others are all susceptible. In the simulation experiments, the implement of transition rates of the model is based on probability. Under the propagation parameters of the slammer worm, several simulation experiments are carried out. Figure 11 shows the comparisons between numerical and simulation curves of susceptible, infectious, quarantined and vaccinated hosts respectively, when 𝜏=5<𝜏₀, which indicate that the simulation curves match the numerical ones very well. When time delay passes the threshold, a bifurcation appears. Figure 12 shows the difference between simulation and numerical results of the four kinds of host when 𝜏=100>𝜏₀. In this figure, the periods of these two curves are well matched. But there is a difference in amplitudes. This mainly results from the precision of experiments. The number of hosts in numerical experiments can be either integers or decimals. However, in simulation experiments, the number of hosts must be integer. In addition, when the number of infectious hosts is very little, the tiny difference may result in a big gap.

(a)

(b)

(c)

(d)

Figure 11 

Comparisons between numerical and simulation curves of SEIDQV model when 𝜏<𝜏0.

(a)

(b)

(c)

(d)

Figure 12 

Comparisons between numerical and simulation curves of SEIDQV model when 𝜏>𝜏0.

6. Conclusions

By considering that time delay may lead to Hopf bifurcation phenomenon so that the worm propagation system will be unstable and uncontrollable, this paper proposes a quarantine strategy to control worm propagation. An SEIDQV worm propagation model is constructed for practical application. Then, the stability of the positive equilibrium and the critical value of Hopf bifurcation are studied. Through careful theoretical analysis, the following conclusions can be derived.(i)The critical time delay 𝜏₀ where Hopf bifurcation appears is obtained 𝜏_𝑘=1𝜔₀𝑝arccos²𝜔₀²−𝑝₄𝜔₀⁴−𝑝₀𝑞₄𝜔₀⁴−𝑞₂𝜔₀²+𝑞₀+𝜔₀⁵−𝑝₃𝜔₀³+𝑝₁𝜔₀𝑞₃𝜔₀³−𝑞₁𝜔₀𝑞₄𝜔₀⁴−𝑞₂𝜔₀²+𝑞₀²+𝑞₃𝜔₀³−𝑞₁𝜔₀²+2𝑘𝜋𝜔₀. (6.1)(ii)When time delay 𝜏<𝜏₀, the worm propagation system will stabilize at its infection equilibrium point, which is beneficial for us to implement a containment strategy to eliminate the worm completely.(iii)When time delay 𝜏≥𝜏₀, Hopf bifurcation appears, which implies the system will be unstable and the worm cannot be effectively controlled.(iv)The quarantine strategy can diminish the infectious hosts sharply. The threshold 𝜏₀ is much larger after using the proposed quarantine strategy, which implies that people have more time to remove worms so that the system is easier to be stable and controllable without Hopf bifurcation.

In order to control and predict the worm propagation, time delay 𝜏 should remain less than the threshold 𝜏₀ by decreasing the time of detecting and removing worm. In real world, various factors can affect worm propagation. The paper focuses on analyzing the influence of time delay. Other impact factors to worm propagation will be a major emphasis of our future research.

Acknowledgments

This paper is supported by the National Natural Science Foundation of China under NSFC no. 60803132 and by the Fundamental Research Funds of the Central Universities under no. N100404001.