Mathematical Problems in Engineering

Volume 2014 (2014), Article ID 784684, 14 pages

http://dx.doi.org/10.1155/2014/784684

## Stability and Bifurcation Analysis of a Modified Epidemic Model for Computer Viruses

^{1}College of Electronic and Information Engineering, Southwest University, Chongqing 400715, China^{2}Department of Mechanical and Biomedical Engineering, City University of Hong Kong, Hong Kong^{3}Department of Mathematics, Texas A&M University at Qatar, P.O. Box 23874, Doha, Qatar

Received 8 January 2014; Accepted 10 May 2014; Published 5 June 2014

Academic Editor: He Huang

Copyright © 2014 Chuandong Li et al. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

#### Abstract

We extend the three-dimensional SIR model to four-dimensional case and then analyze its dynamical behavior including stability and bifurcation. It is shown that the new model makes a significant improvement to the epidemic model for computer viruses, which is more reasonable than the most existing SIR models. Furthermore, we investigate the stability of the possible equilibrium point and the existence of the Hopf bifurcation with respect to the delay. By analyzing the associated characteristic equation, it is found that Hopf bifurcation occurs when the delay passes through a sequence of critical values. An analytical condition for determining the direction, stability, and other properties of bifurcating periodic solutions is obtained by using the normal form theory and center manifold argument. The obtained results may provide a theoretical foundation to understand the spread of computer viruses and then to minimize virus risks.

#### 1. Introduction

Computer viruses arose in the 1980s with the widespread use of Internet in a variety of fields, such as communication, Internet business, and commercial system [1, 2]. With the development of hardware and software technology, computer viruses started to be a major threat to the information security. Usually, computer viruses can cause severe damage to the individuals and the corporations by different ways, including acquiring confidential data from network users, attacking the whole system, and even causing fatal damage to the hardware [3]. So the behaviors of computer viruses have attracted much attention from the fundamental researchers to the network security professional.

It is well-known that computer virus is a malicious mobile code including virus, worm, Trojan horses, and logic bomb [4, 5]. Though different computer viruses vary in many respects, they all have many similar characteristics including infectivity, invisibility, latent, destructibility, and unpredictability [6]. The word “latent” means that the viruses hide themselves in the computers and spread them in the Internet through a period of time. Thus, in the construction of the system, the latent period should not be ignored [7–9].

Because of a lot of similarities between the computer viruses and the infectious diseases, many researchers choose the epidemic models to find out the rule in the computer viruses [10, 11] and much attention is now paid to the effect of topological structure of the network on the spread of the viruses. Among the epidemic models, the SIR, SEI, and SEIR epidemic models are some of the most famous ones. Inspired by these epidemic models, the models of the computer virus have been proposed in recent years [12, 13].

However, some shortcomings of such models arose due to the inevitable difference between computer viruses and infectious diseases. Consequently, the results obtained from the infectious diseases models cannot be carried over to computer viruses completely. As a result, we need to make some modifications in order to model the computer viruses.

From the discussion above, we will propose a modified epidemic model for computer viruses and make some dynamic analysis on it. Specifically, we will extend the three-dimensional SIR model to four-dimensional SIRA model. However, because of the increased dimension, the complexity of the proposed model increases highly. We will present several theoretical results for its stability property and bifurcation dynamics by the rigorous mathematical analysis.

#### 2. Model Description and Preliminaries

The present model is a modification of the original compartmental model [14]. Here, we assume that each node is denoted as one computer and the total population can be divided into the following four groups by the state of each node:(1) is the number of noninfected computers subjected to possible infection;(2) is the number of infected computers;(3) is the number of removed ones due to infection or not;(4) is the antidotal population representing computers equipped with fully effective antivirus programs [15].

In the present paper, we use the antivirus distribution strategy; namely, we convert the susceptible into antidotal, which is proportional to the product and with a controlled parameter . In addition, the infected computers can be fixed by using antivirus programs, by which the infected computers can be converted into antidotal ones with a rate proportional to and a proportion factor given by , or we let the infected ones become useless and be removed with a rate controlled by because of the antivirus cost. Usually, the removed computers can be restored and converted into susceptible with a proportional factor . It is noticed that all the compartments have the mortality rate not due to the viruses. Here we assume all of them are the same and are denoted by the proportion coefficient . We further suppose that the influx rate represents the incorporation of new computers to the network.

It should be pointed out that the rate of the conversion from susceptible into infected ones is called incidence rate. It has been suggested by several authors that the viruses’ transmission process may have a nonlinear incidence rate. This allows one to include behavioral changes and prevent unbounded contact rates (e.g., [16]). In many epidemic models, the bilinear incidence rate and the standard incidence rate are frequently used. The bilinear incidence rate is based on the law of mass action. This contact law is more appropriate for communicable diseases such as influenza but not for point-to-point computer viruses. In the paper, we introduce the following saturated incidence rate into models, where tends to a saturation level when becomes large: where measures the infection force of the viruses and measures the inhibition effect from the behavioral change of the susceptible ones when their number increases or from the crowding effect of the infected ones. It is noticed that represents the latent period; it means a fixed time during which some viruses develop in a susceptible computer and it is only after that time the susceptible one is converted to an infected one.

Considering all these facts above, we can propose a new model with an economical use of the antivirus programs: For simplicity, let , , and .

#### 3. Mathematical Analysis

##### 3.1. Virus-Free Equilibrium Point

Under the condition of virus-free, namely, we assume , there is no need to equip the computers with the antivirus programs, which means . Then, bringing the equilibrium point into (2), we get

Based on (3), the virus-free equilibrium point can be calculated:

The characteristic equation of (2) at is given by the following:which equals where .

Clearly, (6) always has two negative eigenvalues , and two indefinite eigenvalues and . We let .

It is clear to see that if and , the other two eigenvalues must be negative too. So, the following theorem can be acquired.

Theorem 1. *For the system (2), if and are satisfied, then the virus-free equilibrium point is locally asymptotically stable. Besides, if , the equilibrium point is unstable.*

*Remark 2. *Theorem 1 investigates the local stability of the virus-free equilibrium point by analyzing the eigenvalues of the corresponding characteristic equation. We can see that when viruses do not appear, all computers in the network are subjected to possible infection.

##### 3.2. Endemic Equilibrium Points

Endemic equilibrium points are characterized by the existence of infected ones in the network; that is, . First, we consider the case when the network has no antidotal node; namely, . Then, it is not difficult to solve (3) when , and the solution is where

It indicates that when , . Consequently, the condition can avoid the existence of the equilibrium point .

Another more important case is when . Again, calculating (3) and the endemic point is given by

Bringing the point into the first equation of (3), this leads to

Then, we expand (10) and merge the similar terms; we let without confusion: where

Furthermore, a quadratic equation of the variable is obtained: where

From (13), we have the following result.

Theorem 3. *Suppose that , , , are all positive, and , . Then *(1)*if and hold, there exists unique positive solution (9) for (3), and ;*(2)*when always holds, then if and , there exist two positive solutions, where and ; if , there is only one positive solution with or with ; if and , there is only one positive solution ;*(3)*if and , there is only one positive solution ,**where , , , , and .*

*Remark 4. *Theorem 3 mainly focuses on the existence of the positive equilibrium point of the system. We can see that all conditions in the theorem are easily verified.

When the equilibrium point exists, the characteristic equation of (2) at the point is

We set , , , and . For notational simplicity, we use the in place of . Then, the following four-degree exponential polynomial equation is obtained: where

Multiplying on both sides of (16), it is obvious to get

Let , , and substituting this into (18), for the sake of simplicity, denote and by , , respectively; then (18) becomes

Separating the real and imaginary parts, we have

By simple calculation, the following equations are obtained: where

As is known to all that , we get where Denote ; (24) can be rewritten as We suppose that(H1)(26) has at least one positive real root.

Without loss of generality, we can assume the equation has () positive real roots, which are represented as (); then .

By (21), we get

From the early discussions, we know that the are a pair of purely imaginary roots of (16) with . Define

It is noted that when , (16) becomes

By virtue of the well-known Routh-Hurwitz criteria, a set of necessary and sufficient conditions for all roots of (29) to have the negative real part is given in the following form:

If (30)–(33) hold, (29) has four roots with negative real parts, and therefore when , system (2) is stable near the equilibrium point .

In order to give the main results, it is necessary to make the following assumption:(H2).

In order to calculate the derivative of with respect to in (18), it is followed by thus

When , are a pair of purely imaginary roots of (16). Substituting the , into (35) and denoting and by , for simplicity, then

We set ,

On the basis of (H_{2}), we can know that the roots of characteristic equation (16) cross the imaginary axis as continuously varies from a number less than to one greater than by Rouche’s theorem [17]. Therefore, the transversality condition holds and the conditions for Hopf bifurcation are then satisfied at .

Lemma 5 (see [18]). *Consider the exponential polynomial
**
where and are constants. As vary, the sum of the order of the zeros of on the open right plane can change only if a zero appears on or crosses the imaginary axis.**From Lemma 5, it is easy to get the theorem.*

Theorem 6. *Suppose that (H _{1}) and (H_{2}) hold; then *(1)

*for system (2), the equilibrium point is asymptotically stable for ;*(2)

*system (2) undergoes a Hopf bifurcation at the when . That is to say, it has a branch of periodic solutions bifurcating from the near , where can be calculated by (28).*

*Furthermore, we can investigate the stability and direction of bifurcating periodic solutions by analyzing higher order terms according to Hassard et al. [19].**Remark 7. *The analyses above study the existence of the Hopf bifurcation and obtain the critical value of the parameter . We can apply the theorem into the system; thus, through changing some parameters, some bad performances of the model can be avoided.

*Remark 8. *When we set , , , and , the present model can be transformed to the model in [14]. However, [14] only calculated the disease-free/endemic equilibrium points and analyzed the stability. This paper expands the model and makes a detailed analysis about the bifurcations.

*Remark 9. *In this paper, we propose a new group called antidotal population, that is, , which is more reasonable when we study the computer viruses. It is well known that when dealing with Hopf bifurcation, the complexity of computation increases significantly as the dimension of system increases. Sometimes, it even cannot be calculated, especially when nonlinear terms exist in our system. Partly because of this, the majority of the literatures published use the traditional SIR three-dimensional model to study the epidemic model or virus [7, 10, 20], which has some limitations.

*3.3. Stability and Direction of the Hopf Bifurcation*

*We have obtained the conditions under which a family of periodic solutions bifurcate from the positive equilibrium at the critical value of . In this subsection, the formulae for determining the direction of Hopf bifurcation and stability of bifurcating periodic solutions of system at will be presented by employing the normal form theory and the center manifold reduction [19, 21–24].*

*For convenience, let , , , , , and ; we drop the bars for simplification of notations. In the light of multivariate Taylor expansion, system (2) can be transformed into an FDE in as
where , and , are given, respectively, by
where , , and is a one-parameter family of bounded linear operators in .*

*By the Riesz representation theorem, there exists a function of bounded variation for , such that
In fact, we can choose
where is the Dirac delta function.*

*For , define
*

*Then, system (39) is equivalent to
where , for , and .*

*For , define
*

*In order to normalize the eigenvectors of operator and adjoint operator , the following bilinear inner product is needed to introduce
where .*

*From the early discussions, we know that are eigenvalues of and other eigenvalues have strictly negative real parts; thus, they are also eigenvalues of . Define that
which is the eigenvector of belonging to the eigenvalue ; namely, . Then, we can easily obtain
Hence, we obtain
Suppose that the eigenvector of belonging to the eigenvalue is
Similar to the calculation of (49), we can get
Let ; then
which leads to
*

*In the following, we apply the method in [19] to compute the coordinates describing the center manifold near . Let be the solution of (39) when . We define
*

*On the center manifold , we have , where
*

*In fact, and are local coordinates of center manifold in the direction of and , respectively. For solution of (44), since , we get
It is noted that
*

*By (54), we know that
*

*Considering (47) and (55), we have
*

*It follows that
Comparing the coefficients in (57) with those in (60), it follows that
*

*Since the and exist in (61), we need to compute them. From (44) and (54), we have
where
Substituting (55) and (63) into (62), we get
Taking the derivate of with respect to in (55), we have
Then, together with the two above equations, we obtain
By (62), we know that
We know that when , comparing the coefficients of the , in (63) and (67), respectively, we can find
Combining (66) with (68), it follows that
We solve (69) and get the solutions in the following form:
Next, we consider (66) again when ; we can see that
Furthermore, from (62) and (63), we have
*

*Substitute (70) and (72) into (71) and notice that
It is easy to yield
which leads to*

*
By the similar way we can get the as in the following:
*