Discrete Dynamics in Nature and Society

Volume 2018, Article ID 1656907, 13 pages

https://doi.org/10.1155/2018/1656907

## The Dynamical Modeling Analysis of the Spreading of Passive Worms in P2P Networks

^{1}School of Mechatronic Engineering, North University of China, Taiyuan 030051, Shanxi, China^{2}School of Data Science and Technology, North University of China, Taiyuan 030051, Shanxi, China^{3}Complex Systems Research Center, Shanxi University, Taiyuan 030006, Shanxi, China^{4}Shanxi Key Laboratory of Mathematical Techniques and Big Data Analysis on Disease Control and Prevention, Shanxi University, Taiyuan 030006, Shanxi, China

Correspondence should be addressed to Zhen Jin; ten.362@nhznij

Received 22 May 2018; Accepted 3 September 2018; Published 20 September 2018

Academic Editor: Zhengqiu Zhang

Copyright © 2018 Shujuan Zhang et al. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

#### Abstract

Passive worms are prone to spreading through Peer-to-Peer networks, and they pose a great threat to the security of the network. In this paper, considering network heterogeneity and the number of hops a search can reach, we propose a novel mathematical model to study the dynamics of the propagation of passive worms. For the proposed model, the basic reproduction number is derived by employing the existence of the positive equilibrium. And the stabilities of the worm-free equilibrium and positive equilibrium are analyzed. Moreover, we verify the rationality of the model established by comparing the stochastic simulation with the numerical simulation. Finally, we examine the effect of the number of hops on the spread of passive worms and discuss the various immunization strategies. We find that if , the propagation speed of passive worms is accelerated with the increase of hop count ; if , the number of infected peers decreases rapidly with the increase of the value of and drops to zero eventually. Results show that the network topology and the number of hops can affect the spread of passive worms.

#### 1. Introduction

Peer-to-Peer (P2P) networks are composed of connected computers, which can function as both clients and servers. Each computer in the P2P network can request information and also offer information to other computers. P2P networks provide a very convenient way for people to share the information and gain widespread popularity. The rapid development of P2P networks has attracted the attention of the creators of viruses, worms, and other security threats. A number of viruses and worms are prone to spreading through P2P networks. A worm in P2P networks is a program that replicates itself and propagates through the network from one computer to another to infect healthy computers. According to spreading approach [1, 2], P2P worms can be divided into three categories: passive worms, reactive worms and proactive worms. Passive worms can hide themselves in files and spread as the files are downloaded and executed on healthy computers. Reactive worms propagate by using security vulnerabilities, and this propagation can occur through legitimate network behaviors. Proactive worms can automatically connect and infect neighbor computers by exploiting topological information acquired from infected ones. In this paper, we only focus on passive worms.

The propagation behavior of passive worms is similar to that of biological viruses. There have been many studies on modeling the propagation of passive worms in recent years. In 2006, the epidemiological models in P2P networks were proposed by Thommes and Coates in [3]. The models characterized the P2P virus propagation and pollution dissemination, respectively. In 2007, Zhou et al. [4] proposed a mathematical model for the propagation of passive worms based on the two-factor model [5] and analyzed the dynamics of passive worms. In 2008, Feng et al. [6] proposed three models of passive worm propagation: the SI model, SIS model, and SIR model. The key difference among the three models is the state transitions of peers. In 2009, Wang et al. [7] proposed a passive worm propagation model in unstructured P2P networks. And defense method was also studied based on healthy file dissemination. In 2010, Fan et al. [8] presented a logic matrix approach for modeling the spreading of P2P worms. This proposed model was essentially discrete-time deterministic spreading model. In 2012, Rasheed [9] defined an SEI model based on the study of epidemiology and used a P2P simulator to implement this model in P2P networks. In 2014, Chen et al. [10] proposed a four-factor propagation model for passive worms. In this model, four factors were considered: address hiding, configuration diversity, online/offline behaviors, and download duration. In the same year, Yang et al. [11] proposed two propagation models of passive worms: the static model and the dynamic model. In 2015, Feng et al. [12] proposed an analytical model for modeling the propagation of passive worms by adopting epidemiological approaches. In the proposed model, they considered the dynamic characteristics of the P2P network. In 2018, Rguibi et al. [13] presented a propagation model of passive worms in P2P networks. In this proposed model, the hesitation to open a new downloaded file was considered.

However, the above models ignore the influences of network heterogeneity [14, 15] on the propagation of passive worms. In a P2P network, each node represents a peer (i.e., a computer), and each edge between two nodes stands for a connection. Different peers have different connections with others, which exhibits an obvious heterogeneity. Additionally, the node degree distribution of unstructured P2P networks follows a power-law distribution, so it is of practical significance to study the propagation of passive worms in heterogeneous networks. On the other hand, a healthy peer that can be infected within a distance of TTL (Time to Live) hops from it [7, 16]. Here TTL is the threshold representing the number of hops a search can reach. For convenience, we use to stand for the number of hops in the following sections. In this paper, we take the above two aspects into account and propose a novel dynamical model to study the dynamics of passive worm propagation in P2P networks. For the proposed model, we first derive the basic reproduction number . Additionally, by using epidemiological approaches, it is proved that if , the worm-free equilibrium is globally asymptotically stable; when , there exists a positive equilibrium, which is globally asymptotically stable. And then we verify the rationality of the proposed model by comparing the stochastic simulation with the numerical simulation and investigate the effects of network topology and hop count on passive worm propagation. Finally, some immunization strategies are discussed.

The rest of this paper is organized as follows. In Section 2, we propose a novel network-based SIS passive worm propagation model. In Section 3, the basic reproduction number is derived by employing the existence of the positive equilibrium. In Section 4, we investigate the global stabilities of the worm-free equilibrium and positive equilibrium. In Section 5, the numerical simulations are given to interpret the theoretical results, and the stochastic simulations are carried out to verify the rationality of the model. In Section 6, we discuss some immunization strategies and make a conclusion.

#### 2. The Model Formulation

##### 2.1. Modeling Background

To further study the propagation of passive worms, we first need to know the search mechanisms employed by P2P networks. In unstructured P2P networks, such as Gnutella, the most common mechanism is flooding. According to this mechanism, a peer searching for a file sends a query to each of its neighbors. And then each neighbor checks that it has the file matching the query. If it does, it responds to this request and then checks the number of hops the query can reach. The query is forwarded once, and the number of hops is reduced by 1. When hop count is greater than zero, it forwards the query to its neighbors; otherwise, the query is stopped. In particular, when we search for the files in the infected peers, they always respond for all the queries received. Figure 1 illustrates this process visually when hop count . From Figure 1, it can be seen that there are infected peers in the responding ones. Thus worms can spread easily from infected peers to uninfected ones. In order to model the spreading of passive worms, we need to quantify the search neighborhood.