Discrete Dynamics in Nature and Society

Volume 2017, Article ID 3540278, 13 pages

https://doi.org/10.1155/2017/3540278

## Deterministic and Stochastic Study for an Infected Computer Network Model Powered by a System of Antivirus Programs

Laboratory of Computer Sciences, Modeling and Systems, Department of Mathematics, Faculty of Sciences, Sidi Mohamed Ben Abdellah University, Dhar-Mahraz, BP 1796, Atlas, Fez, Morocco

Correspondence should be addressed to Youness El Ansari; moc.liamg@4irasnale.y

Received 13 June 2017; Revised 29 August 2017; Accepted 5 September 2017; Published 18 October 2017

Academic Editor: Yong Zhou

Copyright © 2017 Youness El Ansari et al. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

#### Abstract

We investigate the various conditions that control the extinction and stability of a nonlinear mathematical spread model with stochastic perturbations. This model describes the spread of viruses into an infected computer network which is powered by a system of antivirus software. The system is analyzed by using the stability theory of stochastic differential equations and the computer simulations. First, we study the global stability of the virus-free equilibrium state and the virus-epidemic equilibrium state. Furthermore, we use the Itô formula and some other theoretical theorems of stochastic differential equation to discuss the extinction and the stationary distribution of our system. The analysis gives a sufficient condition for the infection to be extinct (i.e., the number of viruses tends exponentially to zero). The ergodicity of the solution and the stationary distribution can be obtained if the basic reproduction number is bigger than , and the intensities of stochastic fluctuations are small enough. Numerical simulations are carried out to illustrate the theoretical results.

#### 1. Introduction

A computer virus is a small malicious program that spreads from host to host and has a great ability to replicate itself into or over data files during the execution of programs. On a computer network, the interconnectivity of workstations makes the spread of viruses easier. In fact, an infected computer can spread viruses (malware) through the other connected nodes, which causes severe damage like reformatting the hard drive, unexplained data loss, slowing computer performance, corrupting databases, and so forth. Consequently, mathematics specialists are becoming more aware of the importance of protecting systems. To clean and protect the network, an antivirus is a computer program designed to identify and erase malicious software in the system.

Similar to the biological virus systems, many mathematical models have been proposed to describe quantitatively the spread of infections into a computer network [1–9]. Following a deterministic approach, Mishra and Jha [1] have formulated and analyzed the effect of quarantine on recovered nodes. Yuan and Chen [2] discussed an network virus-epidemic model using the theory of stability in differential equations. Shukla et al. [3] modeled and studied the effect of antivirus software on infected computer network; they proved that, under certain conditions, the used antivirus can successfully clean the system.

Other authors have followed the stochastic approach to describe the spread of viruses in a computer network [4, 5]. Zhang et al. [4] proposed and investigated a stochastic computer virus spread model. By constructing a suitable Lyapunov function, they established the necessary conditions for the virus-free equilibrium and viral equilibrium to be stabilized.

To study the effect of antivirus software on its ability to clean an infected computer network, Shukla et al. [3] have proposed the following deterministic system: here denotes the number of susceptible nodes at time , the number of infected nodes, the number of protected nodes, and the number of antivirus programs used to clean the network, which is considered to be proportional with the number of infected nodes. The total number of nodes in the network is . The significance of each parameter in the model is as follows: is the inflow rate of susceptible nodes, is the transition rate from to resulting from the contact between susceptible and infected nodes, is the rate at which nodes are crashed by another cause other than being attacked by viruses, is the constant rate at which the nodes are being protected by another antivirus software, is the rate at which infected nodes become incapable of infecting susceptible nodes, is the rate at which infected nodes are recovered and become susceptible again, is the growth rate of antivirus software used to clean the network, is the rate by which it fails to work efficiently, and is the number of antivirus programs permanently present in the system to protect the existing software; all these parameters are assumed to be positive.

In real life, the number of contacts of a susceptible node per unit time cannot always increase linearly with , especially when the number of infectious nodes is large [6], so for more realism, we first suppose that the saturated incidence rate is nonlinear and takes the form . Model (1) becomes where is a positive function satisfying and . Such function enables the introduction of several effects, like the psychological effects (e.g., see [7]). Conforming to the biological epidemic models, this effect is manifested when the number of infected nodes is very large; the infection force may decrease as the number of infections increases. In relation to our model, in the presence of a very large number of infectious nodes, the users of computers in the network may tend to reduce the number of contacts of their computers.

In the real world, the parameters of a compartmental model are always subject of random variability that affects the dynamic of the population. There exist several types of noise that may represent the environmental random variability; many studies showed that the white noise is an appropriate representation of environmental random variability in terrestrial systems (see Steele 1985 [10]; Vasseur and Yodzis 2004 [11]). For this reason, we introduce a Gaussian white noise disturbance into this model by considering the case where the parameters and are subject to random fluctuations. Hence, by using the technique of parameter perturbation, which represents the commonly used procedure in constructing SDE models (e.g., Zhang et al. [4], Ji et al. [12]), we replace by and by , where and are standard one-dimensional independent Brownian motions and and their intensities. The other parameters are the same as in system (1). We obtain the following stochastic system:

The added value of this paper is summarized in the fact that presents a deterministic and stochastic study of a global model that takes into consideration the effect of antivirus programs in the spread of malware in a computer network. Also, it contains a global nonlinear saturated incidence rate which reflects more realism.

The remainder of this paper is as follows: in Section 2, we present some preliminary results related to the following study. We investigate in Section 3 the stability of the two equilibrium states of the deterministic system (2). In Section 4, we show that system (3) admits a global and unique positive solution, starting from the initial values . Next in Section 5, we give a sufficient condition for the system to be extinct. In Section 6, sufficient condition for the existence of a unique stationary distribution is obtained. We conclude in Section 7 by presenting some numerical simulations to illustrate our results.

#### 2. Preliminaries

Throughout the rest of this paper, we let be a complete probability space with a filtration satisfying the usual conditions (i.e., it is increasing and right continuous while contains all -null sets). are defined on this complete probability space, we also denote

In general, consider the dimensional stochastic differential equation with initial value . denotes an -dimensional standard Brownian motion defined on the complete probability space . We denote by the family of all nonnegative functions defined on such that they are continuously twice differentiable in and once in . The differential operator is defined in [13].

Let be a homogeneous Markov process in ( denotes the -dimensional Euclidean space) and be described by the following stochastic differential equation:

The diffusion matrix is defined as follows:

The following lemma is used to prove the theorem related to the stationary distribution for SDE (3) (see [14], Theorem 3.13, p. 1164, Remark 3.2, p. 1160, Theorem 4.3, p. 1168, and Theorem 4.4, p. 1169).

Lemma 1. *System (6) is positive recurrent if there is a bounded open subset of with a regular boundary, and the following holds:*(B1) *There exist some and a positive constant such that *(B2) *There exists a nonnegative function such that is twice continuously differentiable and that for some **Moreover, the positive recurrent process has a unique stationary distribution with density in such that for any Borel set for all , where is a function integrable with respect to the measure .*

*3. Equilibrium Analysis and Global Stability of Equilibria*

*The basic reproduction number is the number of secondary infectious cases produced by an infectious individual during his or her effective infectious period when introduced in a population of susceptibles [15]. For model (2) the basic reproduction number is where acts as a sharp threshold between extinction and invasion of the disease.*

*Proposition 2. System (2) admits the virus-free equilibrium state , which exists for all parameters values, and a unique virus-epidemic equilibrium state which exists if .*

*Proof. *System (2) has the virus-free equilibrium state ; this equilibrium is obtained by giving (i.e., absence of infection). The positive virus-epidemic equilibrium state is the solution of the following system (equivalent to system (2), except ): Substituting and by their expression in the first equation of system (12), we get the following equation of :since , then is decreasing. Moreover, we haveThus and also, we have ; then where is decreasing; then (15) and (16) imply that has a unique positive zero if and only if .

*The following theorem gives sufficient conditions for the global stability of equilibria of model (2).*

*Theorem 3. If , then the virus-free equilibrium state is globally asymptotically stable. While if , then the virus-epidemic equilibrium state is globally asymptotically stable.*

*Proof. *Using the Lyapunov asymptotic theorem [16] to prove the global asymptotic stability of . Let us consider the function where is the virus-free equilibrium state determined in the precedent theorem. , , , , and are positive constants that will be determined later. We haveThe time derivative of along solutions of system (2) is At , we have Then Let Then We have for all ; then Thus Thus, if then for all . Hence by Lyapunov asymptotic theorem [16], is globally asymptotically stable.

For the stability of the virus-epidemic equilibrium state , we refer the reader to Remark 13 in Section 6.

*Remark 4. *Theorem 3 showed that the basic reproductive number acts as a sharp threshold determining when the disease (i.e., spread of computer viruses) becomes endemic for model (2). Furthermore, the disease is permanent with simple dynamics whenever .

*4. Existence and Uniqueness of the Global Nonnegative Solution*

*The solution of (3) presents the sizes of susceptible nodes, infected nodes, protected nodes, and antivirus programs used to clean the network at time , respectively. Then, they should all be nonnegative. For this reason, and to study the dynamical behavior of system (3), the first concern is whether the solution is of global and positive existence.*

*Theorem 5. Let ; then there is a unique positive solution to SDE (3) on ; this solution remains in with probability 1.*

*Proof. *Since the coefficients of system (3) are locally Lipschitz continuous, for any given initial value then, there is a unique local solution on , where is the explosion time [13]. We show next that almost surely. For this purpose, we define the stopping timeThroughout this paper we set , where denotes the empty set. One can see that , if we prove that a.s.; then, a.s.; thus a.s. If this statement is false, then there is a pair of constants and such that . We define a -function for by . Setting and using Itô’s formula we get, for all and , where We know that is a positive function that verifies and for all ; then Therefore, we getwhere Thereafter, we get Note that, for , there is at least one of , , and that equal . TherebyLetting , in (32), leads to the contradiction that So a.s. This completes the proof of Theorem 5.

*5. Extinction*

*One of the main interests of epidemiology is how to control the disease dynamics so that it will be eliminated in a long term. In this section, we shall establish sufficient conditions for the extinction of viruses in the stochastic model of computer network alimented by a system of antivirus software (3).*

*Lemma 6. Let be the solution of system (3). Then with any initial value , we have Moreover *

*Proof. *Let and , where will be chosen later. Using Itô’s formula, we getwhere Let such that ; then so and let ; we have and thus where herethus from (42)thereforein addition to this result, is continuous, which implies that there exists a constant , such that with (47), we can proceed as in [8] to complete the proof.

*Lemma 7. For any initial value , the solution of system (3) verifies *

*Proof. *Let and . By using the Burkholder-Davis-Gundy inequality [13] and (47), we have Let be an arbitrary positive constant; then according to Chebyshev’s inequality we have an application of Doob’s martingale inequality, and the Borel-Cantelli lemma [13] gives, for almost all and for all except finitely many , and then, for almost , there exists an integer such that, for all , (51) holds. Thus, if and , we get Consequently and by letting , we obtain therefore, for arbitrary small constant , such that , there exists a constant and a set , such that and for all , thus together with , yields So Taking and using the same arguments, we can show that This completes the proof of Lemma 7.

*Theorem 8. Let be the solution of system (3) with any positive initial value ; then Assume that ; then tends to zero exponentially almost surely (i.e., the disease dies out with probability one).*

*Proof. *By application of Itô’s formula to system (3) we get and then wherethen therefore, by dividing both sides of (64) by , we obtain Using the strong law of large numbers [13], we obtain , and by (Lemma 7), we have taking the limit superior of both sides of (65) and the condition leads to thus , a.s. This completes the proof of Theorem 8.

*Remark 9. *Theorem 8 shows that the number of infected nodes goes to extinction almost surely, where . Namely, large white noise stochastic disturbances conduct to control the infection of nodes.

*6. Stationary Distribution and Positive Recurrence*

*The following theorem investigates the stability in a stochastic sense; it gives a sufficient condition for the existence of an asymptotically invariant distribution for the solution of model (3). The proof is based on Lemma 1 and uses the Lyapunov function method. However, there exist some other methods to investigate the stationary distribution, like the method based on the Markov semigroups theory (see Rudnicki and Pichór [17], Lin et al. [18]). Furthermore, some other authors have given the explicit expression of the density of the stationary distribution through solving the Fokker Planck equation of their proposed model (see Buonocore et al. [19], Xu [20]).*

*Theorem 10. Consider the stochastic system (3) with positive initial value; suppose that and where Then the solution is positive recurrent and admits a unique ergodic stationary distribution.*

*Remark 11. *One can see that condition (68) can be verified for sufficiently small environmental noises and . In fact, we have while

*Proof. *We consider the Lyapunov function defined for by where , and are positive functions defined for by and , , , , and are well defined in (70). By applying the differential operator to , we obtainAt the equilibrium state , we get ; thenAn application of the inequality for all yields For the function , we haveat the equilibrium state we have ; hence Therefore Now, we calculate At the equilibrium state , we have ; then thus For , we have we have at the equilibrium state , ; hencethe function is chosen to verify that is nondecreasing and ; thus Thus Next, we calculate