Mathematical Problems in Engineering

Volume 2014, Article ID 475934, 9 pages

http://dx.doi.org/10.1155/2014/475934

## Stability and Bifurcation of a Computer Virus Propagation Model with Delay and Incomplete Antivirus Ability

^{1}College of Computer, Jiangsu Normal University, Xuzhou 221116, China^{2}College of Live Science, Jiangsu Normal University, Xuzhou 221116, China

Received 12 March 2014; Revised 11 August 2014; Accepted 11 August 2014; Published 30 September 2014

Academic Editor: José R. C. Piqueira

Copyright © 2014 Jianguo Ren and Yonghong Xu. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

#### Abstract

A new computer virus propagation model with delay and incomplete antivirus ability is formulated and its global dynamics is analyzed. The existence and stability of the equilibria are investigated by resorting to the threshold value . By analysis, it is found that the model may undergo a Hopf bifurcation induced by the delay. Correspondingly, the critical value of the Hopf bifurcation is obtained. Using Lyapunov functional approach, it is proved that, under suitable conditions, the unique virus-free equilibrium is globally asymptotically stable if , whereas the virus equilibrium is globally asymptotically stable if . Numerical examples are presented to illustrate possible behavioral scenarios of the mode.

#### 1. Introduction

With the rapid developments of information and communication technologies, computer has brought great convenience to our life. While enjoying the convenience from Internet, people have to confront the threat of virus intrusions. As the damaging programs, computer viruses parasitize themselves on a host mainly through the Internet and have also become an enormous threat to computers and network resources. So, understanding and predicting the dynamics of computer virus propagation are, therefore, an important pursuit. Consequently, a number of computer virus propagation models, ranging from conventional* SIR* compartment model [1–3] to its extensions [4–16], were proposed by borrowing from classical epidemic models to investigate the behaviors of computer virus propagation over network.

There is something strikingly different between computer viruses and biological viruses: computer viruses in latent status possess infectivity [17–19]. Consequently, recently proposed models can distinguish latent computers from infected ones by introducing the and compartments [17–19], named as the* S*(susceptible)-*L*(latent)-*B*(breaking-out)-*S*(susceptible) model, which represents the dynamics of virus by systems of ordinary differential equations.

One common feature shared by a computer virus is latency [20], which means that, when viruses enter in a host, they do not always immediately break out, but they hide themselves and only become active after a certain period. It is therefore easy to show that there is an inevitable delay from virus invasion to its outbreak. On the other hand, in real networks, the limited cost results in the incomplete antivirus ability. Indeed, when attempting to model computer virus propagation, some of characteristics of viruses and networks should be taken into consideration.

In this paper, a new computer virus propagation model, which incorporates simultaneously the above-mentioned aspects, is established. The aim is to extend and analyze the* SLBS* computer virus propagation model without delay and incomplete antivirus ability first proposed by Yang et al. [17–19]. This study is motivated by the fact that the delay plays a key role and is inevitably a complex impact on the investigation of computer virus spreading behaviors [21]. The incorporation of the delay and incomplete antivirus ability of networks makes the model more realistic but its mathematical qualitative analysis may be difficult. In our model, the existence and stability of the equilibria are investigated by resorting to the threshold value , a certain condition. By analysis, it is found that the model may undergo a Hopf bifurcation induced by the delay. Correspondingly, the critical value of the Hopf bifurcation is obtained. When delay , the virus spreading is stable and easy to protect; whereas , the virus spreading is unstable and out of control. Applying Lyapunov functional approach, it is proven that the unique virus-free equilibrium is globally asymptotically stable under certain condition if , whereas the virus equilibrium is globally asymptotically stable if . Numerical examples are presented to demonstrate the analytical results and to illustrate possible behavioral scenarios of the mode. Our results may provide some understanding of the spreading behaviors of computer viruses.

The organization of this paper is as follows. In the next section, we present the mathematical model to be discussed. In Section 3, we study the existence and local and global stability of the virus-free and virus equilibria, respectively, and investigate the Hopf bifurcation. In Section 4, numerical examples are presented to demonstrate the analytical results. Finally, some conclusions are given in Section 5.

#### 2. Mathematical Model

Consider the typical* SLBS* mode [17–19], which is formulated as the following system of ordinary differential equations:
Here, it is assumed that a computer (or node) is categorized as internal or external depending on whether or not it is currently connected to the network. The total number of computers connected to the network is divided into three compartments: internal uninfected compartment, (*i.e.*, virus-free computers), internal infected compartment where computers are currently latent (latent computers, for short), and internal infected compartment where computers are currently breaking out (breaking-out computers, for short). Let , , and denote their corresponding percentages at time , respectively. This model involves four positive parameters: denotes the rate at which external virus-free computers are connected to the network and at which an internal node is disconnected from the network; denotes the rate at which, when having connection to one latent or breaking-out computer, one virus-free computer can become infected; denotes the rate at which a breaking-out computer gets a scan by running the antivirus software; denotes the rate at which the latent computer is triggered.

By carefully considering the natures of computer virus, the following assumptions are made.(i)At time , the transition from the latent to the breaking-out is given by , which means a latent computer moves into the breaking-out compartment after a period of time .(ii)Since the antivirus ability is incomplete, at time , the breaking-out computers may either be temporarily suppressed in their latency with probability or be cured into the virus-free ones with probability , where is a constant. If , then the antivirus ability is fully effective, whereas means that antivirus ability is utterly ineffective.Based on the assumptions above, one can obtain the following computer virus propagation model: Let . Thus, model (2) can be written as the following: All the parameters are positive constants. The initial conditions are where .

#### 3. Model Analysis

In this section, we intended to study the dynamical behaviors of model (3). First, a threshold value is defined as the number of virus-free computers that are infected by a single computer virus during its lift span. The threshold value plays a key role in the epidemic dynamics. By resorting to it, the existence and stability of the equilibria can be determined. Generally speaking, if , the virus-free equilibrium is globally asymptotically stable, and when , the virus equilibrium exists and is globally asymptotically stable. A direct computation gives

##### 3.1. Stability of Virus-Free Equilibrium

It is clear that model (3) always admits unique virus-free equilibrium . We first consider its stability. For model (3), the corresponding characteristic equation at is which is similar to the relative forms in [22–24], where Our aim is to investigate the stability behavior in the case . Obviously, (6) is a transcendental equation, and is its root if and only if satisfies Separating the real and imaginary parts, we have Eliminating by squaring and adding (9), we obtain a polynomial in as where Clearly, if , then and . It follows from the Hurwitz criterion that the roots of (10) have negative real parts. Hence, we have the following.

Theorem 1. *When , the virus-free equilibrium is locally asymptotically stable for all provided that .**Now, it is the turn to examine the global stability of virus-free equilibrium. The following theorem is obtained.*

Theorem 2. *When , the virus-free equilibrium is globally asymptotically stable for all .*

*Proof. *By use of the Lyapunov Direct Method, consider the following function:
It is clear that is a positive definite. Then the derivative of is
If hold, then . Furthermore, by the Lyapunov-LaSalle type theorem shows that and . Hence, when , the virus-free equilibrium is globally asymptotically stable.

##### 3.2. Stability of Virus Equilibrium

Next, we examine the stability of virus equilibrium. After direct computations, the unique virus equilibrium of model (3) reads If , the does not exist. It suffices to show the local asymptotical stability of for model (3). Indeed, the Jacobian matrix of the linearized system of this system evaluated at is Its characteristic equation is where In the case , for our purpose, if is a solution of (16), separating real and imaginary parts, we derive that Separating the real and imaginary parts yields Eliminating by squaring and adding (19), we obtain a polynomial in as For convenience, let and . If and , then both of the two roots of (20) have negative real parts. By the Hurwitz criterion, is locally asymptotically stable for all . However, if and , then (20) has the positive root . It follows that (16) has a positive root. Say, the characteristic equation (16) has a pair of imaginary roots , and corresponding delay is given by (19): Furthermore, we can also verify the transversality condition . Then, we establish the following theorem.

Theorem 3. *With , model (3) has a unique virus equilibrium . Furthermore,*(1)* is locally asymptotically stable when and is unstable when , where
*(2)*when , the model (3) undergoes a Hopf bifurcation.**Now, we are ready to examine the global stability of virus equilibrium . Then we have the following.*

Theorem 4. *When , the virus equilibrium is globally asymptotically stable.*

*Proof. *We consider the following function:
where is a positive constant to be determined. The derivative of is
Let
That is,
under the condition of , from which we can conclude that . In addition, suppose that is small enough, then . They lead to . Applying the Lyapunov-LaSalle type theorem, it shows that and . Hence, when , the virus equilibrium is globally asymptotically stable.

#### 4. Numerical Simulations and Discussion

In this section, numerical simulations are carried out to support the analytical conclusion and to illustrate possible behavioral scenarios of the model. Figure 1 exhibits the evolutions of and with time, where the virus-free equilibrium is globally asymptotically stable, consistent with Theorem 2. Furthermore, an equilibrium is virus-free if and only if , which means that the virus would be extinct in the network, as shown in Figure 2. Figure 3 plots the evolutions of and with time. One can observe that, for any initial state, the solution would approach a fixed level; that is, the virus equilibrium is globally asymptotically stable. Besides, an equilibrium is viral if and only if , and its global asymptotical stability means that the virus spreads in the network continuously and stably, as shown in Figure 4. Figure 5 illustrates the complex impacts of delay on the spreading behavior of the virus. The evolutions of comparing with between and are carried out. It can be seen that, virus equilibrium is stable when and then when delay increases to the critical value , it loses its stability and a Hopf bifurcation arises; then it exceeds the value of beyond which the virus propagation will become unstable, in agreement with Theorem 3. In Figure 6, the effect of delay with on the number of latent and breaking-out computers is illustrated. The role of key parameters and in the variation of the latent and breaking-out compartments is shown in Figures 7-8. As expected, one can observe that, for higher value of scan rates , the percentage of latent computers increases, in contrast to that of breaking-out ones. However, the percentages of both latent and breaking-out computers rise as increases. Figure 9 shows the appearance of periodic solutions with the transmission from the stable state to the unstable one.

#### 5. Conclusions

In real networks, the outbreak of computer virus usually lags and the antivirus ability of network is not fully complete. Aiming at characterizing these situations, a new computer virus propagation model is established. By theoretical analysis, the following conclusions can be obtained.(1)If hold, the virus-free equilibrium is globally asymptotically stable under certain conditions for all , which implies that the virus would be extinct in the network. In such conditions, it is unnecessary for us to take practices in a real network. Say, the virus should be left alone.(2)If hold, the virus equilibrium is globally asymptotically stable, which means that the viruses spread in the network continuously and stably. In this case, some efforts can be made to keep the virus prevalence to below a proper level.(3)The critical delay where the Hopf bifurcation occurs is obtained, where (4)When the delay , the virus propagation is stable. In such conditions, the spreading behavior of virus would be divinable.(5)When the delay , the virus propagation is unstable. In such conditions, the virus spreading would be out of control.Moreover, numerical simulations are presented to demonstrate the analytical results and to illustrate possible behavioral scenarios of the model. It is shown that(1)For virus equilibrium, the larger the delay is, the longer it takes to settle down towards its steady states.(2)As expected, the increase of the scan rate can reduce the percentage of the breaking-out computers but increase the percentage of the latent ones, which suggests that we run the antivirus software as often as possible.(3)As expected, the increase of the antivirus ability of the software can reduce the percentage of the infected (latent and breaking-out) computers in the network, which suggests that we invest more in their developments.Our results may provide some understanding of the spreading behaviors of computer viruses.

#### Conflict of Interests

The authors declare that there is no conflict of interests regarding the publication of this paper.

#### Acknowledgments

This work is supported by the National Natural Science Foundation of China under Grant no. 61304117, the Natural Science Foundation of the Jiangsu Higher Education Institutions of China under Grant no. 13KJB520008, and the Doctorate Teacher Support Project of Jiangsu Normal University under Grant no. 12XLR021.

#### References

- J. O. Kephart, T. Hogg, and B. A. Huberman, “Dynamics of computational ecosystems,”
*Physical Review A*, vol. 40, no. 1, pp. 404–421, 1989. View at Publisher · View at Google Scholar · View at MathSciNet · View at Scopus - J. C. Wierman and D. J. Marchette, “Modeling computer virus prevalence with a susceptible-infected-susceptible model with reintroduction,”
*Computational Statistics and Data Analysis*, vol. 45, no. 1, pp. 3–23, 2004. View at Publisher · View at Google Scholar · View at Zentralblatt MATH · View at Scopus - J. R. C. Piqueira and V. O. Araujo, “A modified epidemiological model for computer viruses,”
*Applied Mathematics and Computation*, vol. 213, no. 2, pp. 355–360, 2009. View at Publisher · View at Google Scholar · View at Zentralblatt MATH · View at MathSciNet · View at Scopus - J. G. Ren, X. F. Yang, Q. Y. Zhu, L. X. Yang, and C. Zhang, “A novel computer virus model and its dynamics,”
*Nonlinear Analysis: Real World Applications*, vol. 13, no. 1, pp. 376–384, 2012. View at Publisher · View at Google Scholar · View at MathSciNet · View at Scopus - B. K. Mishra and D. K. Saini, “SEIRS epidemic model with delay for transmission of malicious objects in computer network,”
*Applied Mathematics and Computation*, vol. 188, no. 2, pp. 1476–1482, 2007. View at Publisher · View at Google Scholar · View at MathSciNet · View at Scopus - M. Draief, A. Ganesh, and L. Massoulié, “Thresholds for virus spread on networks,”
*The Annals of Applied Probability*, vol. 18, no. 2, pp. 359–378, 2008. View at Publisher · View at Google Scholar · View at MathSciNet · View at Scopus - B. K. Mishra and N. Jha, “SEIQRS model for the transmission of malicious objects in computer network,”
*Applied Mathematical Modelling*, vol. 34, no. 3, pp. 710–715, 2010. View at Publisher · View at Google Scholar · View at MathSciNet · View at Scopus - B. K. Mishra and N. Jha, “Fixed period of temporary immunity after run of anti-malicious software on computer nodes,”
*Applied Mathematics and Computation*, vol. 190, no. 2, pp. 1207–1212, 2007. View at Publisher · View at Google Scholar · View at Zentralblatt MATH · View at Scopus - Q. Zhu, X. Yang, and J. Ren, “Modeling and analysis of the spread of computer virus,”
*Communications in Nonlinear Science and Numerical Simulation*, vol. 17, no. 12, pp. 5117–5124, 2012. View at Publisher · View at Google Scholar · View at MathSciNet · View at Scopus - C. Gan, X. Yang, W. Liu, Q. Zhu, and X. Zhang, “An epidemic model of computer viruses with vaccination and generalized nonlinear incidence rate,”
*Applied Mathematics and Computation*, vol. 222, pp. 265–274, 2013. View at Publisher · View at Google Scholar · View at MathSciNet · View at Scopus - C. Zhang, Y. Zhao, and Y. Wu, “An impulse model for computer viruses,”
*Discrete Dynamics in Nature and Society*, vol. 2012, Article ID 260962, 13 pages, 2012. View at Publisher · View at Google Scholar · View at Scopus - S. Kondakci, “Epidemic state analysis of computers under malware attacks,”
*Simulation Modelling Practice and Theory*, vol. 16, no. 5, pp. 571–584, 2008. View at Publisher · View at Google Scholar · View at Scopus - F. G. Wang, Y. K. Zhang, C. G. Wang, J. F. Ma, and S. J. Moon, “Stability analysis of a SEIQV epidemic model for rapid spreading worms,”
*Computers and Security*, vol. 29, no. 4, pp. 410–418, 2010. View at Publisher · View at Google Scholar · View at Scopus - L. P. Song, Z. Jin, G. Q. Sun, J. Zhang, and X. Han, “Influence of removable devices on computer worms: dynamic analysis and control strategies,”
*Computers & Mathematics with Applications*, vol. 61, no. 7, pp. 1823–1829, 2011. View at Publisher · View at Google Scholar · View at MathSciNet · View at Scopus - J. Amador, “The stochastic SIRA model for computer viruses,”
*Applied Mathematics and Computation*, vol. 232, pp. 1112–1124, 2014. View at Publisher · View at Google Scholar · View at MathSciNet - K. M. Fuhrman, G. A. Pinter, and J. A. Berges, “Dynamics of a virus-host model with an intrinsic quota,”
*Mathematical and Computer Modelling*, vol. 53, no. 5-6, pp. 716–730, 2011. View at Publisher · View at Google Scholar · View at Zentralblatt MATH · View at MathSciNet · View at Scopus - L. Yang, X. Yang, L. Wen, and J. Liu, “A novel computer virus propagation model and its dynamics,”
*International Journal of Computer Mathematics*, vol. 89, no. 17, pp. 2307–2314, 2012. View at Publisher · View at Google Scholar · View at Zentralblatt MATH · View at MathSciNet · View at Scopus - X. Yang and L.-X. Yang, “Towards the epidemiological modeling of computer viruses,”
*Discrete Dynamics in Nature and Society*, vol. 2012, Article ID 259671, 2012. View at Publisher · View at Google Scholar · View at Scopus - L. Yang, X. Yang, Q. Zhu, and L. Wen, “A computer virus model with graded cure rates,”
*Nonlinear Analysis: Real World Applications*, vol. 14, no. 1, pp. 414–422, 2013. View at Publisher · View at Google Scholar · View at MathSciNet · View at Scopus - Y. B. Kafai, “Understanding virtual epidemics: children’s folk conceptions of a computer virus,”
*Journal of Science Education and Technology*, vol. 17, no. 6, pp. 523–529, 2008. View at Publisher · View at Google Scholar · View at Scopus - Z. H. Zuo, Q. X. Zhu, and M. T. Zhou, “On the time complexity of computer viruses,”
*IEEE Transactions on Information Theory*, vol. 51, no. 8, pp. 2962–2966, 2005. View at Publisher · View at Google Scholar · View at MathSciNet · View at Scopus - D. Li and W. Ma, “Asymptotic properties of a HIV-1 infection model with time delay,”
*Journal of Mathematical Analysis and Applications*, vol. 335, no. 1, pp. 683–691, 2007. View at Publisher · View at Google Scholar · View at MathSciNet · View at Scopus - R. Naresh, A. Tripathi, and D. Sharma, “A nonlinear AIDS epidemic model with screening and time delay,”
*Applied Mathematics and Computation*, vol. 217, no. 9, pp. 4416–4426, 2011. View at Publisher · View at Google Scholar · View at MathSciNet · View at Scopus - J. Wang, J. Zhang, and Z. Jin, “Analysis of an SIR model with bilinear incidence rate,”
*Nonlinear Analysis: Real World Applications*, vol. 11, no. 4, pp. 2390–2402, 2010. View at Publisher · View at Google Scholar · View at MathSciNet · View at Scopus