Abstract
This paper intends to investigate the impact of external computers and removable devices on virus spread in a network with heterogeneous immunity. For that purpose, a new dynamical model is presented and discussed. Theoretical analysis reveals the existence of a unique viral equilibrium that is locally and globally asymptotically stable with no criteria. This result implies that efforts to eliminate viruses are not possible. Therefore, sensitivity analysis is performed to have more insight into parameters’ impact on virus prevalence. As a result, strategies are suggested to contain virus spread to an acceptable level. Finally, to rationalize the analytical results, we execute some numerical simulations.
1. Introduction
Virus propagation in networks is one of the areas of focus in computer science due to the rapid developments in network applications. A computer virus is a type of malware that transmits its harmful code by copying itself into programs and applications. After a computer is infected with these copies of malicious code, the infection spreads to other computers when transferring the infected host file from one computer to another. The most common ways to spread viruses are through e-mail attachments, visiting an infected website, viewing an infected ad, or clicking on an infected executable file. Also, the infection spreads while communicating with already infected external computers or removable storage devices, such as USB and hard drives. According to the Internet Security Threat Report, 1 in 10 URLs analyzed in 2018 were identified as malicious, rising from 1 in 16 URLs in 2017. Moreover, they found that spam levels continued to increase as 55% of e-mails received in 2018 were spam [1].
Computer virus research and development projects are still ongoing in government, industry, and academia. Today, antivirus and firewall software are the most effective protection measures to safeguard computer systems. However, the latest updates of antivirus programs are sometimes unable to detect a new virus, and therefore the development of antivirus programs, in turn, is lagging behind the development of the virus.
Mathematical models have been established to comprehend the propagation of computer viruses. These models rely on interesting similarities among computer viruses and their biological equivalents such as COVID-19 models [2–4]. As a result, models were developed to study computer virus infection [5–8], virus latency [9, 10], virus control [11–13], virus vaccination [14–16], immunization against virus [17, 18], and virus delay [19, 20].
The assumption in the previous models is that when connecting computers for the first time to the Internet, they are uninfected. In fact, infected computers are very likely to be online and offline. For this reason, other models have incorporated the offline reality for all types of computers: susceptibles, infected, and recovered. They refer to a computer of any type which is not connected to the Internet as an external computer. The models in [21–23] are formulated by considering external computers as a compartment, therefore dividing the population of computers into susceptibles, infected, and externals (SIES). On the other hand, the models in [24, 25] do not contain a single compartment for external computers, but rather each compartment exits (offline) and enters (online) the model at a specific rate. All of these models studied the influence of external infected computers on virus spread. In addition, some models included the effect of removable media as well ([23–25]).
In this paper, a new model is proposed to investigate the dynamics of virus propagation regarding the effect of external computers and removable devices. Our model accounts for the heterogeneity of susceptible computers. Because network security is highly dependent on users, susceptible computers are divided into two subcompartments based on user awareness [17]. Computers with users of high-security awareness are strongly protected, while computers with users of low-security awareness are weakly protected. We study the dynamics of this model thoroughly. Qualitative analysis shows that the proposed model admits a unique viral equilibrium, which is globally asymptotically stable similar to those models in [21–25]. This implies that no elimination of viruses on the Internet is possible. Consequently, parameter analysis is performed to suggest strategies to contain virus prevalence.
The layout of the study is as follows: The model is formulated in Section 2, where notations and assumptions are described. In Section 3, the equilibrium point is obtained, and its stability is investigated. To substantiate the qualitative results, we illustrate numerical simulations in Section 4. Moreover, parameter analysis is performed to examine the influencing parameters that affect the steady level of infected computers. Finally, Section 5 gives a brief conclusion.
2. Mathematical Model
We assume that, for every pair of computers on the network, the Internet provides a Peer-to-Peer Service (P2P). Consequently, there is no need for a central server to share files between computers. Online computers are identified as internal, whereas offline computers are considered to be external. Moreover, computers with capable installed security software are strongly protected; otherwise, they are weakly protected. We shall abbreviate computers as nodes.
According to our model, the total number of nodes, , is divided into four compartments: . Here, represents strongly protected susceptible nodes that are protected by up-to-date antivirus software. represents weakly protected susceptible nodes that have weak antivirus software or no security software installed. represents infective nodes that are currently infected by the virus and can transmit it to susceptible nodes. Lastly, represents external nodes that are disconnected from the Internet. Let , and denote the number of strongly protected, weakly protected susceptible, infected, and external nodes at time t, respectively. Thus, . The dynamics of the model is illustrated in Figure 1. The models’ notations are summarized in Table 1.
We base our model on the following assumptions:(H1)The total number of computers is constant.(H2)An antivirus program that has latest updates intalled is strong enough to keep the -node immune from viruses.(H3)Every node is out of use at a rate of .(H4)-node is infected when contacted with an infected node with probability per unit time.(H5)An infected removable device infects -node at a rate of .(H6)-node goes to -node with the rate when its antivirus software is expired or does not have latest updates installed.(H7)When -node is installed by updated antivirus software, it becomes -node with rate .(H8)Infected node is recovered with a rate of , owing to efficient antivirus software.(H9)All newly accessed computers are external.(H10)An internal node becomes offline at a rate of .(H11)An external node is either an -node, a -node, or an infected node before it becomes online.(H12)When connecting an external node to the Internet, the node transfers to either an -node, a -node, or an infected node with rates , respectively.
Under the above assumptions, the dynamical model can be represented by the following system of nonlinear ordinary differential equations:
From assumption (H1), the total number of computers is constant ; that is, for all . Thus, we can normalize model (1) by setting the state variables as follows: , and . Consequently, model (1) has the equivalent form:with initial conditions , and .
Because , system (2) can be reduced towith initial conditions , and .
Let
Solving the third equation of system (3), we get . System (3) can be reduced to the limiting system [26].
Theorem 1. For system (5), there exists a positively invariant setwhere .
Proof. First, we evaluateThis implies that all solutions that are nonnegative remain nonnegative for .
Next, if we combine the first and second equations of system (5), we getwhere . The above inequality can be rewritten aswhere . Using the integrating factor method, we multiply both sides of the above inequality by , and we getIntegration over time interval givesThis implies thatThis proves that all solutions of system (5) are bounded. Hence, is positively invariant.
3. Mathematical Analysis of the Model
In this section, we find the equilibrium point of model (5) and examine its stability both locally by linearization method [27] and globally by using the generalized Poincare-Bendixson theorem [28].
To find the equilibrium point, we equate the rates in system (5) to zero; that is,
Clearly, system (5) has no feasible virus-free equilibrium. Solving system (13), we find that the system has a unique endemic equilibrium point , whereHere,
Since and , then , which leads to . As a result, . Consequently, always exists.
Theorem 2. is locally asymptotically stable with respect to .
Proof. First, we linearize system (5) by evaluating the Jacobian matrix at the equilibrium :To find the eigenvalues, we solve the following characteristic equation:whereClearly ; therefore, all the eigenvalues have negative real parts. Hence, is locally asymptotically stable.
Lemma 1. System (5) admits no periodic orbit with respect to .
Proof. LetDefine . Then,Hence, by Bendixson-Dulac criterion [28], the system has no periodic orbit in the interior of .
Lemma 2. System (5) admits no periodic orbit that passes through a point on , the boundary of .
Proof. Let be an arbitrary point on the boundary of . Then there are three possibilities:(i)Case 1: , and ; then we have , implying that the orbit that passes through is directed into the region .(ii)Case 2: , and ; then we have . Also, the orbit here is pointed into .(iii)Case 3: , and ; then we haveThis implies that the orbit, in this case, is either pointed into the region or tangent to the at this point. Note that . Hence, we conclude that there is no periodic orbit that passes through a point on .
Now, we state the following theorem.
Theorem 3. is globally asymptotically stable with respect to .
Proof. By combining the generalized Poincare-Bendixson theorem [28] with Theorem 2 and Lemmas 1 and 2, the global asymptotic stability of is proved.
4. Numerical Simulations and Analysis
In this section, we support the analytical results by illustrating some numerical examples. It is concluded that our model admits a unique viral equilibrium and has no virus-free equilibrium. This means that any effort to eliminate viruses cannot succeed. For this reason, we examine the effect of the parameters on the equilibrium number of infected computers to keep this number as minimum as possible.
In the following examples, we demonstrate numerical experiments by assigning parameters to values empirically.
Example 1. Let the parameters in model (5) be as follows: and . Also, let the initial condition take the following different values: , and , which lie in . Direct calculations yield .
Example 2. Here, we change some of the parameters in Example 1 to be as follows: and . Moreover, we set the initial condition to the following values: , and , which lie in . Direct calculations give .
Figures 2 and 3 illustrate the numerical solution of model (5) for initial conditions and parameters set as in Examples 1 and 2, respectively. The time evolution of the compartments shows that both the infected and weakly protected computers eventually reach an equilibrium level. Thus, the solution curves converge to the endemic equilibrium. Hence, the numerical solution is consistent with the qualitative result in Theorem 3.
Now, let us check the dependency of the steady virus prevalence () on the different parameters of the model. Since in 14 depends on , we must first examine the effect of the parameters on . From (4), we haveThus, the dependency of on the parameters is stated in the following theorem.
Theorem 4. The following hold true for in system (3):(i) remains unchanged with parameters: , and (ii) is increasing with parameters: and (iii) is decreasing with parameters: , and
Now, solving the two equations in (13) for and using (3) yieldwhere
Implicit differentiation of in (23) with respect to any parameter, say , giveswhere . We investigate the dependency of on the models’ parameters in the case where . Accordingly, we have the following:(i)Parameter : Since , then Using this and (4), we get(ii)Parameter : Here, we have used the fact that the equilibrium point satisfies the second equation in (13).(iii)Parameter : Again, we have used the fact that the equilibrium point satisfies the second equation in (13).(iv)Parameter :(v)Parameter : Again, since , then(vi)Parameters and :(vii)Parameter :(viii)Parameter :(ix)Parameter :
Hence, we state the following theorem.
Theorem 5. If , then the following statements hold true for in system (5):(i) is increasing with the parameters: , and (ii) is decreasing with the parameters: and (iii) is increasing or decreasing with and according to or (iv) is increasing or decreasing with according to or (v) is increasing or decreasing with according to or (vi) is increasing or decreasing with according to or
Next, we fix all values of the models’ parameters to 0.1. Then we simulate the variation of the steady virus prevalence with each parameter at a time by allowing this parameter to take the values from 0 to 1. Figure 4 illustrates the rise in with parameters: , , , , and . We see that increases to the largest value as increases, that is, as the rate of connecting infected external nodes to the Internet increases. On the other hand, Figure 5 demonstrates the decline in with parameters: , , , , and . By comparing the effects of these parameters on , is the one that decreases to the lowest value. This means that as the recovery rate of infected nodes increases, decreases to a minimum value. The simulations are consistent with Theorem 5 for the parameters: , and . As for the other parameters, the simulations are intuitively consistent.
(a)
(b)
(c)
(d)
(e)
(a)
(b)
(c)
(d)
(e)
Furthermore, Figure 6 illustrates the effect of and on . We see that reaches a larger value with increasing than with increasing . A similar effect is shown in Figure 7 with the parameters and . This points out the impact of connecting an infected external computer to the Internet. As shown in the figures, virus spread accelerates when external infected computers are connected to the Internet, much higher than the virus spread caused by removable devices or infected internal computers. On the contrary, Figure 8 shows a decline in the size of as the parameters and increase. However, with increasing , the size of is less than that with increasing . This means that although disconnecting all types of computers from the Internet drops the level of infected internal computers, recovering infected computers on the Internet had a better result.
Figure 9 demonstrates the effect of user awareness toward computer immunization against viruses on virus spread. We find that weak immunization () increases the spread of the virus, unlike strong immunization (). Besides, we observe in Figure 10 that strong immunization compared to disconnecting computers from the Internet is a better strategy for reducing virus prevalence.
From the sensitivity analysis, we conclude that infected external computers will pose a more significant threat to internal computers than infected removable devices. Moreover, the critical parameters to control the breakout of viruses are , the recovery rate of infected computers; , the rate of weak computers becoming strong; and , the Internet disconnection rate.
Based on this analysis and the simulation results, we propose the following suggestions to reduce the virus spread:(i)Improving users’ awareness to keep their computers strongly protected with up-to-date antivirus helps in reducing the w-node conversion rate and increasing the s-node conversion rate .(ii)Disconnecting computers from the Internet whenever they are unused (i.e., increasing the disconnection rate ) helps in reducing the spread of viruses.(iii)Recovering infected computers () by reinstalling well-known real-time security software helps in reducing virus spread.(iv)Running antivirus software on external computers before connecting to the Internet helps in reducing . Similar action performed on removable devices reduces .
5. Conclusion
In this work, a new deterministic model has been proposed to study the effect of external computers and removable storage on the dynamics of computer viruses with heterogeneous immunity. In reality, the immunization of computers depends on users’ awareness. A thorough analytical investigation of the model was carried out, and numerical inspections followed to confirm the analytical results. Also, a sensitivity analysis was executed to find the impact of the models’ parameters on virus propagation. We conclusively list some of the main results of the model:(i)Model (5) produced a unique viral equilibrium point () and admitted no virus-free equilibrium. always exists with no conditions.(ii)The viral equilibrium is locally and globally asymptotically stable with no criteria.(iii)Since always exists, then any attempt to eradicate viruses from the network is not possible. However, efforts to lower the virus prevalence may be accomplished.(iv)Sensitivity analysis revealed the parameters that limit the spread of the virus; they are , and .(v)However, the parameters , and increase virus prevalence.(vi)Analytical results are in good agreement with numerical simulations.(vii)External infected computers were found to be the greatest threat to computer networks.
Several suggestions have been made to contain virus spreading, specifically, elevating user awareness to regularly protect computers with updated antivirus, disconnecting computers when not in use, restoring internal infected computers, and checking external computers and removable devices before connecting to a network.
This study may be extended by assuming different disconnection rate for each node and, thus, enabling the examination of the effect of disconnecting only infected computers from the Internet on virus spread.
Data Availability
No data were used to support this study.
Conflicts of Interest
The authors declare that they have no conflicts of interest.