A Novel Computer Virus Model and Its Stability€¦ · virus, Trojan horses, worm, logic bomb and...

A Novel Computer Virus Model and Its Stability

Mei Peng and Huajian Mou College of Mathematics and Computer Science, Yangtze Normal University, Chongqing, China

Email: [email protected], [email protected]

Abstract—Computer virus is a malicious code which can

causes great damage. A SEIR model is proposed which

considered that the newly entered computer in the network

has been infected by other ways. It is concerned with the

constant immigration, which includes susceptible, exposed

and infectious, the threshold and equilibrium of this model

are investigated. The locally and globally asymptotical

stable results of virus-free equilibrium and viral equilibrium

were being proved. Finally, some numerical examples are

given to demonstrate the analytical results.

Index Terms—Computer Virus; Equilibrium; Locally

Asymptotically; Simulation

I. INTRODUCTION

Computer virus is a malicious code which including

virus, Trojan horses, worm, logic bomb and so on. It is a

program that can copy itself and attack other computers.

And they are residing by erasing data, damage files, or

modifying the normal operation. In recent years, some

models of the computer virus is proposed [1-3, 5-12]. The

action of computer virus throughout a network can be

studied by using epidemiological models for disease propagation [4]. Based on the Kermack and Mckendrick

SIR classical epidemic model, dynamical models for

malicious objects propagation were proposed [5-11].

These dynamical modeling of the spread process of

computer virus is an effective approach to the

understanding of behavior of computer viruses because

on this basis, some effective measures can be posed to

prevent infection. The computer virus has latent ability. An infected

computer which is in latency, called exposed computer.

Based on these characteristics, delay is used in some

models to describe the latent ability of computer virus [7-

9]. And some models proposed SEIR or SLBS to describe

the latent of the computer virus [5-6, 10-11]. They are all

assuming that the computer which is newly entered in the

network are all infectious. In this paper, a novel model of computer virus, known as SEIR model, is put forward to

describe before enter in the network, the computer has

been infected computer virus by other ways such as

removable media etc. ( ), ( ), ( ), ( )S t E t I t R t denote the

classes of , , ,S E I R at time t . The total number of new

infectious at a time is given by SI , with as the mass

action coefficient and is used to incidence. In this paper,

we assume that a fraction a and b of the computers

which newly entered in the network flux into the exposed

class E and the infected class .I The computers which

have been infected computer virus flux into exposed class

E is given by aN and flux into infectious class I is

given by bN . The susceptible computer which flux into

the susceptible class S is given by (1 )aN bN . If

0 1a b , the model has only one viral equilibrium

and it is globally asymptotically stable; If 0a b , the

model has only one virus-free equilibrium if 0 1R , and

if 0 1R the system has another viral equilibrium and

they are globally asymptotically stable; If 1a b , the

model has only one viral equilibrium and it is globally

asymptotically. In this paper, the dynamics of this model

has been fully studied through some numerical examples. This paper is organized as follows. Section 2

formulates a novel computer virus model. Section 3,

investigate the stability of the equilibriums. Section 4

some numerical examples are given to present the

effectiveness of the theoretic results. Finally, Section 5

summarizes this work.

II. MODEL FORMULATIONS

At any time, a computer is classified as internal and external depending on weather it is connected to internet

or not. At that time all to the internet computers are

further categorized into four classes: (1) Susceptible

computers, that is, uninfected computers and new

computers which connected to network; (2) Exposed

computers, that is, infected but not yet broken-out; (3)

Infectious computers; (4) Recovered computers, that is,

virus-free computer having immunity. Let

( ), ( ), ( ), ( )S t E t I t R t denote their corresponding numbers

at time t, without ambiguity, ( ), ( ), ( ), ( )S t E t I t R t will be

abbreviated as , , ,S E I R , respectively. Our assumption

on the dynamical transfer of the computers is depicted in

Fig. 1, and the model is formulated as following system

of differential equations:

(1 ) ,

( ) ,

( ) ,

.

S a b N SI dS

E aN SI r d E

I bN rE d I

R I dR

(1)

( ) ( ) ( ) ( ) ( ).N t S t E t I t R t (2)

We may see that first three equations in (1) are

independent of the fourth equation, and therefore, the

JOURNAL OF NETWORKS, VOL. 9, NO. 2, FEBRUARY 2014 367

© 2014 ACADEMY PUBLISHERdoi:10.4304/jnw.9.2.367-374

fourth equation can be omitted without loss of generality.

Hence, system (1) can be rewritten as

(1 ) ,

( ) ,

( ) .

S a b N SI dS

E aN SI r d E

I bN rE d I

(3)

Figure 1. Schematic diagram for the flow of virus in computer

network.

where N denotes the rate at which external computers

are connected to the network; a denotes the rate of the

new computer which has been infected computer virus

but hasn’t been broken; b denotes the rate of the new

computer which has been infected computer virus and it

is has been broken; denotes the rate at which, when

having a connection to one infected computer, one susceptible computer can be become exposed; r denotes

the rate of which, the exposed computer is broken and

come into the infectious state; denotes the rate

recovery rate of infected computers are cured; denotes

the rate at which one computer is removed from the

network. All the parameters are nonnegative. When having connection to one expose computer, one

susceptible computer can be become exposed, and its

infectious rate is SI ; aN is the number of the new

enter the network has been infected but hasn’t broken;

bN is the number of the new enter the network has been

infected;

Moreover, all feasible solutions of the system (3) are

bounded and enter the region D , where

3{( , , ) | 0, 0, 0, }.N

D S E I R S E I S E Id

Refer to [12], we analysis the threshold 0R of the

system (3) .

Let

( , , ) ,Tx E I S then, the system (3) can be written as

( ) ( ),i ix F x V x where ( ) 0 ,

0

i

SI

F x

( )

( ) ( )

0

i

r d E aN

V x rE d I bN

.

The Jacobin matrices of ( )F x and ( )V x at the

0 (1 )( , , )

a b NP aN bN

d

are

0 0( ) ,

0 0

N

F DF P d

0,

r dV

r d

then

101

,( )( )

dV

r r dd r d

Thus

1 0

0 ( )( )( )

S rR FV

r d d

(1 ).

( )( )

r a b N

d d r d

Especially, when 0,a b obviously 0,a b the

system (3) can be revised as

,

( ) ,

( ) .

S N SI dS

E SI r d E

I rE d I

(4)

And there

0 .( )( )

rNR

d d r d

For the system (4), if 0 1R , there always exists the

virus-free equilibrium is 0 0 0

1 1 1( ,0,0) ( ,0,0)N

P S Pd

; if

0 1R , there also exists an virus-free equilibrium is

0

1 ( ,0,0)N

Pd

and a viral equilibrium is

* * *

1 1 1

( )( ) ( )( , , ),

r d d dP I I

r r

there

*

1

( )( ).

( )( )

N r d r d dI

r r d d

When 1,a b the system (3) can be revised as

,

( ) ,

( ) .

S SI dS

E aN SI r d E

I bN rE d I

(5)

For the system (5), there has only one viral equilibrium

*

2

( )(0, , ).

( ) ( )( )

aN bN r d aNrP

r d r d d

When 0 1a b , the system (2.3) has only a viral

equilibrium * *

* * 3 3

3 3 *

3

[ ]( , , ).

( ) ( )( )

aN S I ar br bd NP S

r d d r d rS

Let

* * * *

3 3 3 3( ) (1 ) ,G S a b N S I dS (6)

368 JOURNAL OF NETWORKS, VOL. 9, NO. 2, FEBRUARY 2014

© 2014 ACADEMY PUBLISHER

when *

3

(1 )(0, ),

a b NS

d

discuss the roots of equation

*

3( ) 0G S .

For system (3), we have * *

3 3( )G S d I

*

3

[ ]

( )( )

ar br bd Nd

d r d rS

*

3

* 2

3

[ ] .0,

[( )( ) ]

ar br bd N rSd

d r d rS

thus

we get 3( )G S

monotone decreasing in

(1 )(0, ).

a b N

d

Case (1): If 0

(1 )1,

( )( )

r a b NR

d d r d

from (6), we get

(0) (1 ) 0G a b N ,

(1 )( )

a b NG

d

* *

3 3 ,S I

there

*

3 *

3

[ ]0,

( )( )

ar br bd NI

d r d rS

thus

(1 )( )

a b NG

d

>0.

3( ) 0G S has no real root in (1 )

(0, )a b N

d

if

0 1.R

Case (2): If 0

(1 )1,

( )( )

r a b NR

d d r d

*

3 *

3

[ ]0,

( )( )

ar br bd NI

d r d rS

thus

(0) (1 ) 0,G a b N

(1 )( ) 0.

a b NG

d

For that 3( )G S monotone decreasing in

(1 )(0, ),

a b N

d

the equation 3( ) 0G S has only one

positive root if 0 1.R

From the case, the system (3) has only one viral

equilibrium * *

* * 3 3

3 3 *

3

[ ]( , , )

( ) ( )( )

aN S I ar br bd NP S

r d d r d rS

if 0 1.R

III. STABILITY OF THE EQUILIBRIUMS

Theorem 3.1.1. 0

1P is locally asymptotically stale

if 0 1R . Whereas 0

1P is unstable if 0 1.R

Proof. The Jacobin matrix of system (2.4) about 0

1P is

given by

0

1

0 0

1 1

0

0 ( ) ,

0 ( )

d S

J r d S

r d

which equals to

2 0

1 2 1( ) ( )( ) 0,f d a a S r (7)

where

1 ( ) ( ),a r d d

2 ( )( ).a r d d

then, Eq. (7) has negative real parts roots

1

2

1 1 2 0

2

2

1 1 2 0

3

0,

4 (1 )0,

2

4 (1 ),

2

d

a a a R

a a a R

when 0 1,R 3 0 , and When

0 1R , 3 0.

Then there are no positive real roots of (7), thus 0

1P is

a locally asymptotically stable equilibrium if 0 1,R and

0

1P is unstable if0 1.R

The proof is completed.

Theorem 3.1.2. 0

1P is globally asymptotically stale

with respect to D if 0 1R .

Proof. Let ,( )

rL E I

d

obviously 0,L

thus

( )

rL E I

d

0

[ ( ) ] ( )( )

( )( )

( )

( )( 1)

0.

rSI r d E rE d I

r d

Nr r d d

d r d

d R


Theorem 3.1.3. *

2P is globally asymptotically stable.

Proof. Let ,L S

obviously 0,L

then

0.L SI dS


Theorem 3.1.4 The viral equilibrium * * * *

1 1 1 1( , , )P S E I

and * * * *

1 3 3 3( , , )P S E I is locally asymptotically stable.

Proof. Denote * * * *

1 1 1 1( , , )P S E I and * * * *

1 3 3 3( , , )P S E I

as *P .

The Jacobin matrix of the system (3) about *P is given

by



* *

* *

0

( ) * ,

0 ( )

I d S

J I r d S

r d

which equals is

3 2

0 1 2 3( ) 0,f A A A A (8)

where

0 1,A

*

1 {( ) [( ) ( )]},A I d r d d

* *

2 [( ) ( )]( ) [( )( ) ],A r d d I d r d d S r

* *

3 ( )( )( ) .A r d d I d S dr

Case (1): When 0a b and 0 1R ,

0 1 0,A

*

1 1{( ) [( ) ( )]} 0,A I d r d d *

2 1( )[( ) ( )] 0,A I d r d d

*

3 1( )( ) 0,A r d d I

then

1 2 3 0.A A A

According to the Hurwitz criterion, all roots of Eq. (8)

have negative real parts. Thus the equilibrium *

1P is

locally asymptotically stable.

Case (2): When 0 1a b and 0 1R ,

0 1,A *

1 3{( ) [( ) ( )]} 0,A I d r d d * *

2 3 3[( ) ( )]( ) [( )( ) ] 0,A r d d I d r d d S

* *

3 3 3( )( ) [( )( ) ] 0,A r d d I d r d d S r

then 1 2 3 0.A A A

According to the Hurwitz criterion, all roots of Eq. (8)

have negative real parts. Thus the equilibrium *

3P is

locally asymptotically stable. The proof is completed.

Now, let us examine the global stability of *P with

respect to the D by means of a classical geometric

approach [13]. For our proposed, the following obvious

result will be useful.

Lemma 3.1. If 0 1R , the system (3) is uniformly

persistent, i.e., there exists 1 0c (independent of initial

conditions), such that

1liminf ( ) ,t

S t c

1liminf ( ) ,t

E t c

1liminf ( ) .t

I t c

Remark 1. We have proved that the virus-free

equilibrium 0

1P is unstable if 0 1R when 0a b and

the system (3) has no virus-free equilibrium when

0 1a b . Furthermore, the instability of 0

1P , together

with 0

1P 0

1P D ( D denotes the boundary of D ),

imply the uniform persistence of the satiate variable. The

uniform persistence of system (3) is to show the existence

of a compact absorbing set in int D (int D denotes the

interior of D ), Which is a necessary condition for

proving the global stability by using the geometric

approach.

Theorem 3.1.4 *P is globally asymptotically stable if

0 1.R

Proof. The second compound matrix of the Jacobin

matrix *J can be calculated as follows [14-16]: * *

[2] *

*

( ) ( ) *

( ) ( ) 0 .

0 ( ) ( )

I d r d S S

J r I d d

I r d d

Set P as the following diagonal matrix

( ) (1, , ).E E

P xI I

Denote

1 (0, , ),f

E I E IP P diag

E I E I

Therefore, the matrix 1 [2] 1

fB P P AJ A can be

written in the following block form:

11 12

21 22

,B B

BB B

with *

11 ( ) ( ),B I d r d

*

12 (1,1),I

B SE

21 ( ,0) ,TEB r

I

*

22

*

( ) ( ) 0

,

( ) ( )

E II d r d

E IB

E II r d d

E I

thus

1 1 11 12

2 1 22 21

( ) ,

( ) ,

g B B

g B B

(9)

there *

1 11( ) ( ) ( ),B I d r d

* *

1 22( ) max{ ( ) ( ) ,E I

B I d r d IE I

( ) ( )}E I

r d dE I

= ( ) .E I

r d dE I

The vector norm in

3

23R R

is chose as

( , , ) {max , }.u v W u v w

The Lozinskii measure ( )B with respected to as

follows (17)

1 2( ) sup{ , }B g g ,

there

* *

1

2

( ) ( ) (1,1) ,

( ) ( ,0) .T

Ig I d r d S

E

E I Eg d d r

E I I

(10)



Figure 2. Dynamical behavior of system (2.4) with 0.a b Time series of ( ), ( ), ( )S t E t I t with 0 1R .

Figure 3. Dynamical behavior of system (2.4) with 0.a b Time series of ( ), ( ), ( )S t E t I t with 0 1R .

Figure 4. Dynamical behavior of system (5) with 1a b . Time series of ( ), ( ), ( )S t E t I t .



Figure 5. Dynamical behavior of system (5) with 0 1a b , Time series of ( ), ( ), ( )S t E t I t if

0.3, 0.3, 0.0001, 100, 0.8, 0.01, 0.8a b N r d n and then 0 4.9875 1R


0.1, 0.1, 0.0001, 100, 0.8, 0.001, 0.8a b N r d n and then 0 9.9750 1.R


0.1, 0.1, 0.0001, 100, 0.6, 0.001, 0.6a b N r d n and then 0 13.2890 1.R



From the system (2.3), we find that

* ( ),

( ).

I E aNS r d

E E E

I bN Er d

I I I

(11)

Thus

*

1

2

( ),

.

E aNg I d

E E

E bNg d

E I

(12)

Relations (9)-(12) imply

( ) ,E

B dE

thus

0 0

1 1 1 ( )( ) ( ) ln .

(0)

t t E E tB d d d d

t t E t E

(13)

If 0 1R , then the virus-frees equilibrium is unstable

by the Theorem 3.1.2, Moreover, the behavior of the local

near 0D as describe in Theorem 3.1.2 implies that the

system (3) is uniformly persistent in D , i.e. there exists a

constant 1 0c and 0T , such that t T implies

1

1

1

liminf ( ) ,

liminf ( ) ,

liminf ( ) ,

t

t

t

S t c

E t c

I t c

And

1liminf[1 ( ) ( ) ( )]t

S t E t I t c

For all ( ( (0), (0), (0))S E I D [18, 19]

0

1limsupsup ( ) 0.

2

t

t x K

dq B d

t

(14)

The claimed result follows by combining Theorem

3.1.1, Lemma 3.1 and the negativity of .q


IV. SIMULATION

Now, we would analysis the locally asymptotically

stable of the equilibriums through some numerical

examples.

Case 1: For the system (4), if 0 1R , there exists the

virus-free equilibrium 0

1P . Let

0, 0, 0.0001, 10, 0.8, 0.01,a b N r d 0.8,n

and then 0 0.0122 1R , Fig. 2 shows the solution of

system (4) if 0 1R . Case 2: For the system (4), if 0 1R , there exists the

viral equilibrium *

1P . Let

0, 0, 0.001, 10, 0.5, 0.01, 0.5,a b N r d n

and then 0 19.92 1R . Fig. 3 shows the solution of

system (4) if 0 1R .

Case 3: For the system (5), there exists the viral

equilibrium *

2P , Let

0.5, 0.5, 0.01,a b 0.05, 0.001,r d 0.1,n Fig.

4 shows the solution of system (5) if 0a b .

Case 4: For the system (3), there exists the viral

equilibrium *

3P . Fig. 5-Fig. 7 shows the solution of

system (3) if 0 1a b .

From the Fig. 2, We can see that the virus-free

equilibrium 0

1P of system (4) is locally asymptotically

stable if 0 1R .

From the Fig. 3, We can see that the viral equilibrium *

1P of the system (4) is locally asymptotically stable

0 1R .

From the Fig. 4, We can see that the viral equilibrium *

2P of the system (5) is locally asymptotically stable.

From the Fig. 5-Fig. 7, We can see that the viral

equilibrium *

3P of the system (3) is locally asymptotically

stable.

For the system (3), from the Fig. 5 and Fig. 6, we can

see that the number of computer virus is not affected by

the parameters a and b . If we’re keeping a and b the

same, from the Fig. 6 and Fig. 7, we can see that the

number of computer virus actually decreases as we

reduce the 0R .

V. CONCLUSION

We considering the fact, the computers which is newly

entered in the network computer has been infected by

other ways such as removable media, a novel computer

virus model is proposed. Denotes a is the rate of the new

computer which has been infected computer virus but

hasn’t been broken; b denotes the rate of the new

computer which has been infected computer virus and it

is has been broken. If 0 1a b , the system (3) has

only one viral equilibrium and it is locally asymptotically

stable; If 0a b , the system (3) can rewritten as

system (4) and it has only one virus-free equilibrium if

0 1R , and if 0 1R the system has a viral equilibrium

and which are locally asymptotically stable; If 1a b ,

the System (3) can be rewritten as system (5) and it has

only one viral equilibrium which is locally asymptotically.

In this paper, the dynamics of this model has been fully

studied through some numerical examples.

REFERENCES

[1] Wei Yang, Gui-RAN Cheng, Yu Yao, Xiao-meng Shen,

Stability Analysis of P2P Worm Propagation Model with Dynamic Quarantine Defence, Journal of networks, Vol. 6, No. 1 (2011), pp. 153-162, Jan 2011.

[2] Juan Du, Su-li Chen, Research of Improved Network Malicious Information Filtering model Based on SVM, Journal of Networks, Vol. 8, No. 5 (2013), pp. 1012-1018, May 2013.



[3] Hui Xu, Xiang Gu, Extensive Design for Attack’s Recognition and Resistance of Survivable Network.

Journal of Networks, Vol. 7, No. 2 (2012), 222-228, Feb 2012.

[4] C Sun, YH Hsieh Global analysis of an SEIR model with varying population size and vaccination. In: Applied Mathematical Modelling 34 (2010) pp. 2685-2697.

[5] LP Song, Z Jin, Gq Sun, Modelling and analysing of botnet interactions. In: Physical A 390 (2011) pp. 347-358.

[6] BK Mishra, SK Pandey Dynamic model of worms with vertical transmission in computer network. In: Applied Mathematics and Computation 217 (2011) pp. 8438-8446.

[7] JG Ren, XF Yang, LX Yang, YH Xu, FZ Yang, A delayed

computer virus propagation model and its dynamics, Chaos, Solutions& Fractals 45 (2012) pp. 74-79.

[8] X Han, Q Tan, Dynamical behavior of computer virus on Internet, Applied Mathematics and Computation xxx (2010) xxx-xxx.

[9] Q Zhu, X Yang, J Ren, Modeling and analysis of the spread of computer virus, Communications Nonlinear Science Numerical Simulation 17 (2012) pp. 5117-5124.

[10] LX Yang, X Yang, Q Zhu, L Wen. A computer virus model with graded cure rats, Nonlinear Analysis: Real World Applications.

[11] LX Yang, X Yang, L W, J L, A novel computer virus

propagation model and its dynamics, International Journal of Computer Mathematic, Vol. 00, No. 00, Month 200x, 1-8.

[12] P. Van den Driessche, J watmough, Reproduction numbers and sub-threshold endemic equilibrium for compartmental models of disease transmission, Mathematical Biosciences 180 (2002) pp. 29-48.

[13] Michael Y. Li and James S. Muldowney, A Geometric Approach to Global Stability Problems, SIAM J. Math. Anal, Vol. 27, No. 4, pp. 1070-1083, July 1996.

[14] M. Fiedler, Additive compound matrices and inequality for eigenvalues of stochastic matrices, Czechoslovak Math. J

99 (1974) pp. 392-402. [15] J. S. Muldowney, Compound matrices and ordinary

differential equations, Rocky Mountain J. Math 20 (1990) pp. 857-872.

[16] Martin Jr R H, Logarithmic norms and projections applied to linear differential system, J Math Anal App., 1974(45) pp. 432-454.

[17] G. J. Butler, P. Waltman, Persistence in dynamical systems, Proc. Amer. Math, Soc 96 (1986) pp. 425-430.

[18] H. I. Freedman, M. X Tang, S. G. Ruan, Uniform persistence and flows near a closed positive invariant set,

Journal of Dynamics and Differential Equations 6 (1994) pp. 583-600.

[19] P. Waltman, A brief survey of persistence in dynamical systems, In: S. Busenberg, M. Martelli (Eds.), Delay Differential Equations and Dynamical Systems, Springer-Verlag, New York, 1991, pp. 31-40.

Mei Peng is a lecturer in College of Mathematics and Computer Science, Yangtze Normal University, Chongqing, China. She received her master degree in stochastic system analysis from

the Chongqing Normal University, China. Her interest in the area of the computer virus propagation model.

Huajian Mou is a assistant in College of Mathematics and Computer Science, Yangtze Normal University, Chongqing, China. He interest in the area of the computer Software Programming.



app:ds:%20%20stochastic%20system

A Novel Computer Virus Model and Its Stability€¦ · virus, Trojan horses, worm, logic bomb and...

Documents

Transcript of A Novel Computer Virus Model and Its Stability€¦ · virus, Trojan horses, worm, logic bomb and...