# An Advanced Persistent Distributed Denial-of-Service Attacked Dynamical Model on Networks

Authors: Chunming Zhang; Junbiao Peng; Jingwei Xiao
Journal: Discrete Dynamics in Nature and Society
 (2019)

---

## Abstract

The advanced persistent distributed denial-of-service (APDDoS) attack does a serious harm to cyber security. Establishing a mathematical model to accurately predict APDDoS attack on networks is still an important problem that needs to be solved. Therefore, to help us understand the attack mechanisms of APDDoS on networks, this paper first puts forward a novel dynamical model of APDDoS attack on networks. A systematic analysis of this new model shows that the maximum eigenvalue of the networks is a vital factor that determines the success or failure of the attack. What is more, a new sufficient condition for the global stability of attack-free equilibrium is obtained. The global attractivity of attacked equilibrium has also been proved. Eventually, this paper gives some numerical simulations to show the main results.


---

## Body

## 1. Introduction

Cyber-attack overwhelmingly invades every aspect of our life, which causes huge threats and enormous damage to thousands of industries. According to the report [1], the percentage of cyber-attack motivated by Cyber Crime has risen to 72.1% in 2017. And nowadays, there are a lot of attack ways, such as DDoS attack, DoS attack, and so on. Here, let us discuss some attacked means to achieve a better understanding of the cyber-attack. DoS attack, which is known as the denial-of-service attack, is an important means of attack. It always launches attacks of blocking the buffer of the host of service providers so as to make legal guests can not access the server. And among the cyber-attacks in 2016, about 11.3% attacks were DoS attacks. Different from the DoS attack, in a distributed denial-of-service attack (DDoS attack), the incoming traffic flooding the victim originates from many different sources [2]. In addition, APT (Advanced Persistent Threat), which is a stealthy and continuous computer hacking process, usually has the characteristics of strong concealment, sophisticated techniques, and continuous monitoring [3]. Most importantly, this paper mainly talks about APDDoS (advanced persistent distributed denial-of-service) attack which is DDoS attack equipped with the advance of APT. With the characters of advanced reconnaissance, clear motive, tactical execution, outstanding computing power, and long-term durability [4], it has caused great losses to the world. During the opening ceremonies of the PyeongChang Winter Olympics in February 2018, TV and web services were affected by an APDDoS attack for about 12 hours [5]. In February 2018, GitHub (the world's largest code hosting website) suffered a serious APDDoS attack; the peak flow rate reached 1.35Tbps [6]. It is easy to know that the APDDoS attack is being more and more harmful and it has a profound impact on the world.To fully understand the APDDoS attack, its steps must be introduced. First, attacker will invade as many infected computers as possible by inserting or injecting computer malware into phishing websites or phishing texts. So, if the visitor opens it, his/her computer would be infected. And then, the infected computers will be composed into a botnet that is controlled by the attacker. When there are enough infected computers, the attacker can launch flood attack to targeted IPs (services of host) which will be blocked or broken down soon after the attack.The cyber-attack process on the network can be accurately expressed as a continuous-time Markov chain which is proposed by Van Mieghem [7, 8]. However, this method is difficult in mathematical analysis. In order to overcome these difficulties, some approximation methods are proposed, such as individual-based mean-field theory (IBMF) and degree-based mean-field theory (DBMF) [9, 10]. ForIBMF, any node can be regarded as a computer or local network in the network is statistically independent from its neighboring nodes [11–14]. ForDBMF, any vertex classified by degree is connected to the set of nodes with different degree with the special probability [15–17].To better understand the impact of network topology on APDDoS attack, in this paper we propose a novel APDDoS attack model on networks withIBMF. Then we found that the global stability of attack-free equilibrium and the global attractivity of attacked equilibrium depend on the value of the maximum eigenvalue of the attack network.In Section2, the paper proposes the APDDoS attack model. Its threshold and the equilibriums are calculated in Section 3. Further Discussions are given in Section 4. Next, the paper shows some numerical simulations in Section 5. Finally, a brief summary of the full paper is given.


## 2. Model Descriptions

According to the ability of computers to defend against malicious software on the network, the paper divides the computers into two groups: Weak-Protected group and Strong-Protected group. Here, we can divide computers into two groups by checking whether the computer has firewall.The Weak-Protected group (WP), which lacks firewall protection, is vulnerable to malware attacks, such as computer worm, Trojan, and so on. The Weak-Protected group consists of two kinds of computers, which includes susceptible computers (S-node) and infected computers (I-node). The susceptible computers (S-node) are weak in preventing malware attacks but have not been infected yet, while the infected computers (I-node) refers to the computers which has been infected by malwares and controlled by hackers.However, because the existence of the firewall, the Strong-Protected group (SP) can defend against many kinds of attacks, but it also can be attacked by APDDoS attack. The Strong-Protected group also consists of two kinds of computers, tolerant computers (T-node), and missed computers (M-node). Tolerant computers (T-node) represent computers with a firewall (which usually means servers) and works normally, while missed computers (M-node) denote the computers with a firewall but cannot respond to the request and become missed for the visitors due to the APDDoS attacks (see Figure 1).Figure 1
Schematic diagram of APDDoS attack.Based on the above facts, some constants can be defined as follows:(i)
G= (V,E): the network structure of the computers on network, andG can be represented as an undirected, connected, and nonlooped graph.(ii)
N: the scale of networkG, which is also the whole number of the computer in theG.(iii)
A: the matrix of the network connection situation.Ais a symmetric matrix with zero diagonal. A=aij, 1≤i, j≤N.(iv)
λk: the spectrum ofA, 1≤k≤N. AsA is real and symmetric, we may assume λmax≥λ1≥λ2≥⋯≥λN.(v)
Si(t): the ith node, which is susceptible(S-node) at timet.(vi)
Ii(t): the ith node, which is infected(I-node) at timet.(vii)
Ti(t): the ith node, which is tolerant(T-node) at timet.(viii)
Li(t): the ith node, which is missed(M-node) at timet.Next, some reasonable assumptions are proposed as follows [18–21].(H1) As executing some operations that do harm to the computer security, like browsing the phishing websites or opening the phishing email, etc., anySi infected by the neighboringI-nodes with probability β, the average probability of eachSi gets infected per unit time, is β∑jaijIj.(H2) By installing some antivirus soft-wares, anyIi(t) recovers to the state of susceptible, which also means becomingSi(t) with the probability γ.(H3) As occurring APDDoS attacks, anyTi(t) can be attacked by neighboringI-nodes with the probability α. By calculating, the average probability of eachTi(t) turns into theMi(t) per unit time is α∑jaijIj.(H4) As changing the hardware of computers and strengthen the firewall, anyMi(t) restarts or recovers with the probabilityη.(H5) As the two groups of the computer are separated, the paper usesϕ to denote the proportion of the Weak-Protected group and then 1-ϕ is the proportion of the Strong-Protected group; also there areSi(t)+Ii(t)=ϕ andTi(t)+Mi(t)=1-ϕ.Let(1)Sit=PrXit=0,Iit=PrXit=1,Tit=PrXit=2,Mit=PrXit=3.Also, the following equations can be obtained:(2)Sit+Δt=SitPr⁡Xit+Δt=0∣Xit=0+IitPr⁡Xit+Δt=0∣Xit=1+TitPrXit+Δt=0∣Xit=2+MitPrXit+Δt=0∣Xit=3,Iit+Δt=SitPrXit+Δt=1∣Xit=0+IitPrXit+Δt=1∣Xit=1+TitPrXit+Δt=1∣Xit=2+MitPrXit+Δt=1∣Xit=3,Tit+Δt=SitPrXit+Δt=2∣Xit=0+IitPrXit+Δt=2∣Xit=1+TitPrXit+Δt=2∣Xit=2+MitPrXit+Δt=2∣Xit=3,Mit+Δt=SitPrXit+Δt=3∣Xit=0+IitPrXit+Δt=3∣Xit=1+TitPrXit+Δt=3∣Xit=2+MitPrXit+Δt=3∣Xit=3.In order to satisfy these above equations,β and α should be far less than 1. Let∆t be a very small interval. According to the assumptions given above, the following equations can be got:(3)PrXit+Δt=0∣Xit=1=γΔt+oΔt,PrXit+Δt=2∣Xit=3=ηΔt+oΔt,PrXit+Δt=1∣Xit=1=1-γΔt+oΔt,PrXit+Δt=3∣Xit=3=1-ηΔt+oΔt.PrXit+Δt=1∣Xit=0=β∑jaijIjΔt+oΔt,PrXit+Δt=3∣Xit=2=α∑jaijIjΔt+oΔt,PrXit+Δt=2∣Xit=2=1-α∑jaijIjΔt+oΔt,PrXit+Δt=0∣Xit=0=1-β∑jaijIjΔt+oΔt,PrXit+Δt=0∣Xit=2=PrXit+Δt=0∣Xit=3=oΔt,PrXit+Δt=1∣Xit=2=PrXit+Δt=1∣Xit=3=oΔt,PrXit+Δt=2∣Xit=0=PrXit+Δt=2∣Xit=1=oΔt,PrXit+Δt=3∣Xit=0=PrXit+Δt=3∣Xit=1=oΔt.Substituting these equations into the above relations and lettingΔt>0, the following 4N-dimensional dynamic system has been proposed:(4)dSitdt=-β∑jaijIjt·Sit+γIit,dIitdt=β∑jaijIjt·Sit-γIit,dTitdt=-α∑jaijIjt·Tit+ηMit,dMitdt=α∑jaijIjt·Tit-ηMit.1≤i≤N,with the initial conditions that 0≤Sit, Iit≤ϕ, 0≤Tit, Mit≤1-ϕ.According to Assumption (H5) that Sit+Iit=ϕ, Tit+Mit=1-ϕ, system (4) can be rewritten into the following 2N-dimensional dynamic system:(5)dIitdt=β∑jaijIjt·ϕ-Iit-γIit,dMitdt=α∑jaijIjt·1-ϕ-Mit-ηMit,1≤i≤N,with the initial conditions 0≤Iit≤ϕ, 0≤Mit≤1-ϕ.Since the firstN equations of system (5) are independent ofM, so system (5) can be simplified into the following form:(6)dIitdt=β∑jaijIjt·ϕ-Iit-γIit,1≤i≤N,with the initial conditions 0≤Iit≤ϕ.


## 3. Model Analysis

This section aims to understand the dynamical behavior of system (5) and system (6) which was proposed in the previous section.Clearly, there is a unique attack-free equilibriumP0=0,⋯,02N×1T in system (5). First, consider properties of the attack -free equilibrium of system (5).To achieve that, let(7)Ω=x=x1,…,x2NT∈R+2N∣xi≤ϕ,xi+N≤1-ϕ,i=1,…,N.Letx(t)=(I1(t), …,IN(t),M1(t), …,MN(t))T, and rewrite system (5) as the following notation: (8)dxtdt=Bxt+Gxt,with the initial condition x(0)∈Ω, where (9)B=βϕA-γΕNON×Nα1-ϕA-ηΕN,Gxt=-βI1t∑jaijIjt,…,-βINt∑jaijIjt,-αM1t∑jaijIjt,…,-αMNt∑jaijIjt.Let(10)R0=γβϕ.Theorem 1.
Consider system (5) that (a)
the attack-free equilibriumP0 is locally asymptotically stable if λmax<R0;(b)
the attack-free equilibriumP0 is a saddle point.Proof.
The characteristic equation with respect toP0 is(11)detρΕ2N-B=detρ+γΕN-βϕAON×N-α1-ϕAρ+ηΕN=detρ+γρ+ηΕN-βϕρ+ηA=ρ+ηNdetρ+γΕN-βϕA=0.
Equation (11) has negative roots -η with multiplicityN and has βϕλk-γ,1≤k ≤N as the remainingN roots. When λmax<γ/βϕ=R0, then λk-γ/βϕ≤λmax-γ/βϕ<0 for allk. So, all the roots of (11) are negative, implying that the attacked-free equilibrium of system (5) is locally asymptotically stable. Otherwise, if λmax>γ/βϕ=R0, then the attack-free equilibrium is a saddle point.
Remark 2. This theorem can also be formulated as (a) λmax<R0⇒s(B)<0, and (b) λmax>R0⇒s(B)>0.
Next, study the global stability of the attack-free equilibrium of system (6).
Let(12)Ψ=y=y1,…,yNT∈R+N∣yi≤ϕ,i=1,…,N.
Lety(t)=(I1(t), …,IN(t))T, and rewrite system (6) as the following notation: (13)dytdt=Cyt+Hxt,with the initial condition y(0)∈Ψ, where (14)C=βϕA-γΕN,Hyt=-βI1t∑jaijIjt,…,-βINt∑jaijIjt.
Lemma 3 (see [22]).Consider a smooth dynamical systemdy(t)/dt=gy(t)that is defined at least in a compact set U. Then, U is positively invariant if for any smooth pointwon∂U, the vector g(w) is tangent to or pointing into U.
Lemma 4 (see [23, 24]).Consider an n-dimensional autonomous system(15)dxtdt=Dxt+Yxt,x∈D,where Γ is a region that contains the origin,Y(x)∈C1Γ,limx→0Yx/x=0. Suppose there is a positively invariant compact convex setC⊂Γthat contains the origin, and a real eigenvectorωofDT, a positive number r such that
(C1) x , ω ≥ r x for all x ∈ Γ,
(C2) Y x , ω ≤ 0 for all x ∈ Γ,
(C3) the origin forms the largest positively invariant set that is included in the set x ∈ C ∣ Y x , ω = 0.
Then we have
(  1) s D T < 0 implies that the origin is globally asymptotically stable in C,
(  2) s D T > 0 implies there exists m > 0 such that x ( 0 ) ∈ C - { 0 } implies l i m  i n f t → ∞ x t ≥ m.
Lemma 5.The set of Ψ is positively invariant for system (6). That is,y0∈Ψimpliesy(t)∈Ψfor allt>0.(16)Ti=y∈Ψ∣yi=ϕ,i=1,…,N,Wi=y∈Ψ∣yi=0,i=1,…,N,and for i=1,…,N,Ti,Wi.We have(17)ξi=0,…,0,-1i,0,…,0,ζi=0,…,0,1i,0,…,0,as their respective outer normal vectors. Let y be a smooth point of∂Ψ.The paper distinguishes among two possibilities.(18)dydt∣y∈Ti,ζi=-γϕ≤0,dydt∣y∈Wi,ξi=-βϕ∑jaijIjt≤0.Combining the above discussions, we get that g(w) is pointing into∂Ψ. The claimed result then follows from Lemma 3. The proof is completed.Theorem 6.
The attacked-free equilibrium of system (6) is globally and asymptotically stable if λmax<R0.Proof.
Look at system (13). As matrix  CT is irreducible and its off-diagonal entries are all nonnegative, it follows from [23] that  CT has a positive eigenvectorz= (z1, …,zN) belonging to its eigenvalues(CT). Letr=minizi(r>0). Then, for all y∈Ψ, we have (19)y,z≥r∑iyi=ry1,Hy,z=-β∑i=1NziIit∑jaijIjt≤0.Moreover, <H(y),z> = 0 implies thaty=0. In view of Theorem 1 and Lemma 5, the claimed result follows from Lemma 4. The proof is complete.Theorem 7.
The attacked-free equilibrium of system (5) is globally and asymptotically stable if λmax<R0 (see Figures 2, 4, 6, and 8).Figure 2
Status transition graph of the basic model (the dashed line on the graph means the attack fromI-node toT-node).Proof.
It follows from Theorem6, which implies that(20)limt→∞Iit=0,1≤i≤N.for anyε> 0 there exists timeT1 such that, for all t⩾T1, we have(21)Iit<ε,1≤i≤N.
From the lastN equations of system (5), we get that for 1≤i≤N. And for t≥T1,(22)dMitdt≤α∑jaijε1-ϕ-α∑jaijε+ηMit,
As the comparison system(23)dyitdt=α∑jaijε1-ϕ-α∑jaijε+ηyit,
has a globally asymptotically stable equilibriumα∑jaijε(1-ϕ)/α∑jaijε+η, we get that, for anyε> 0, there existsT2> 0 such that, for allt≥T2,(24)Mit≤α∑jaijε1-ϕα∑jaijε+η.
This implies that(25)limt→∞Mit=0,1≤i≤N.
The proof is complete.The following corollary can be obtained easily based on Lemma 4 and Theorem7.Corollary 8.
System (5) is uniformly persistent ifλmax>R0.
Second, consider properties of the attacked equilibrium of system (5).Theorem 9.
System (5) has an attacked equilibrium P∗=P1∗,P2∗⋯,P2N∗T if λmax>R0.Proof.
Note that any solution of system (5) is bounded. Hence, the claimed result follows easily from Corollary 8 [25].Theorem 10.
The attacked equilibriumP∗=P1∗,P2∗,…,P2N∗T is globally attractive if λmax>R0.Proof.
For any solutionP(t) to system (5), let (26)FPt=max⁡PktPk∗:1≤k≤2N,fPt=min⁡PktPk∗:1≤k≤2N.
Clearly,F(P(t)), f(P(t)) are continuous and have right-hand derivatives. For somet0 and ε> 0, we may assume Pk0(t)/Pk0∗≥Pk(t)/Pk∗,1≤k≤2N,t∈t0,t0+ε, then(27)F′Pt≔limh→0+supFPt+h-FPth=P′k0Pk0∗,t∈t0,t0+ε.
IfF(P(t0))>1, then Pk0t>Pk0∗.
When1<k<N,(28)Pk0∗P′k0t0Pk0t0=Pk0∗Pk0t0β∑j=1Nαk0jPkt0ϕ-Pk0t-γPk0t0≤Pk0∗Pk0t0β∑j=1Nαk0jPj∗Pkt0Pk0∗ϕ-Pk0t-γPk∗t0≤Pk0∗Pk0t0β∑j=1Nαk0jPj∗Pkt0Pk0∗ϕ-Pk0∗-γPk∗t0≤β∑j=1Nαk0jPj∗ϕ-Pk0∗-γPk∗t0=0.
WhenN<k<2N,(29)Pk0∗P′k0t0Pk0t0=Pk0∗Pk0t0α∑j=1Nαk0jPk-Nt01-ϕ-Pk0t-ηPk0t0≤Pk0∗Pk-Nt0α∑j=1Nαk0jPk∗Pk-Nt0Pk0∗1-ϕ-Pk0t-ηPk∗t0≤Pk0∗Pk-Nt0α∑j=1Nαk0jPk∗Pk-Nt0Pk0∗1-ϕ-Pk0∗-ηPk∗t0≤α∑j=1Nαk0jPk∗1-ϕ-Pk0t-ηPk∗t0=0.
AsPj0∗, Pj0t>0, we know that P′(t)<0, implying F′(P(t0))<0. Likewise, F(P(t0))=1 implies F′(P(t0))≤0;f(P(t0))≤1 implies f′(P(t0))>0, and f(P(t0))=1 implies f′(P(t0))≥0.
Let(30)UPt=max⁡FPt-1,0,VPt=min⁡1-fPt,0.Obviously, UPt and VPt are continuous and nonnegative.
Besides,(31)U′Pt≤0,V′Pt≤0.
Let(32)HU=Pt∈Ω:U′Pt=0,HV=Pt∈Ω:V′Pt=0.
Then(33)HU=Pt:0≤Pt≤Pj∗∪0,HV=Pt:0≤Pt≤1∪0.
Any solution of system (5) starting in Ω approaches HU∩HV=P∗∪0 follows from the LaSalle Invariance Principle [26]. Therefore, the claimed follows from Pj∗>0 is globally attractive.Conjecture 11.
The attacked equilibriumP∗=P1∗,P2∗⋯,P2N∗T is globally asymptotically stable if λmax>R0.


## 4. Further Discussions

In order to control APDDoS attack,λmax<R0 must be satisfied. To different parameters on R0. Let us do the following calculations:(34)∂R0∂γ=1βϕ>0,∂R0∂β=-γβ2ϕ<0,∂R0∂ϕ=-γβ2ϕ<0.From these computational results, the following conclusions can be got:(a)
Reducing the infection rateβ could be help to control APDDoS attack.(b)
Raising the cure rateγ conduces to the suppression of APDDoS attack.(c)
Reducing the rateϕ conduces to the suppression of APDDoS attack.(d)
Reducing the value ofλmax leads to the restraint of APDDoS attack.Based on the above discussions, the corresponding practical suggestions are as follows:(i)
Install antivirus software or firewall and update it regularly.(ii)
Improve the defensive level of computer.(iii)
Filter IP addresses so as to reduce the number of IP addresses that can access computer on networks.


## 5. Numerical Simulations

This section gives some examples about equilibriums of system (5) under the distinguish networks and optimal dynamic control strategies for disrupting APDDoS attack.The paper discusses the equilibrium of system on four different kinds of networks: full-connected network, stochastic network, scale-free network which uses Barabasi-Albert method, and realistic network.First, consider system (5) under the fully connected network.Example 1.
Consider a network with 200 nodes and every node is connected to other nodes, which is full-connected network. Withβ= 0.004, α= 0.01, γ= 0.4, η=0.1, ϕ=0.5 where the threshold of the system is 200>λmax =199, the attack-free equilibrium is globally stable (see Figure 3).Figure 3
Global stability of attack-free solution on full-connected network.Figure 4
Global attractivity of attacked solution on full-connected network.Example 2.
Consider a network that nodes are fully connected to other with 200 nodes. Withβ= 0.01, α = 0.01, γ = 0.75, η =0.1, ϕ=0.5 where the threshold of the system is 150<λmax=199, the attacked equilibrium is attractivity (see Figure 4).Then consider system (5) under the network of stochastic network.Example 3.
Consider a network that nodes are connected randomly to other with 200 nodes. Withβ= 0.01, α= 0.01, γ= 0.5, η=0.1, ϕ=0.5 where the threshold of the system is 100>λmax=99.305, the attack-free equilibrium is globally stable (see Figure 5).Figure 5
Global stability of attack-free solution on stochastic network.Figure 6
Global stability of attack-free solution on stochastic network.Example 4.
Consider a network whose nodes are connected randomly to other with 200 nodes. Withβ = 0.017, α= 0.01, γ= 0.75, η=0.1, ϕ=0.5 where the threshold of the system is 74.117<λmax=99.305, the attacked equilibrium is attractivity (see Figure 6).Now, let us consider system (5) under the network of scale-free network.Example 5.
Consider a network whose nodes are connected to other with 200 nodes. Withβ = 0.001, α= 0.002, γ= 0.0035, η=0.1, ϕ=0.5 where the threshold of the system is 7.0>λmax=5.894, the attack-free equilibrium is globally stable(see Figure 7).Figure 7
Global stability of attack-free solution on scale-free network.Figure 8
Global stability of attack-free solution on scale-free network.Example 6.
Consider a network whose nodes are connected to other with 200 nodes. Withβ = 0.001, α= 0.002, γ= 0.0026, η=0.1, ϕ=0.5 where the threshold of the system is 5.2<λmax=5.894, the attacked equilibrium is attractivity(see Figure 8).Finally, consider system (5) under realistic network [27].Example 7.
Consider a network whose nodes are connected to other with 300 nodes. Withβ = 0.01, α= 0.013, γ= 0.18, η=0.1, ϕ =0.5 where the threshold of the system is 36.0>λmax=34.4732, the attack-free equilibrium is globally stable(see Figure 9).Figure 9
Global stability of attack-free solution on realistic network.Example 8.
Consider a network that nodes are connected randomly to other with 300 nodes. Withβ = 0.01, α= 0.013, γ= 0.05, η=0.1, ϕ =0.5 where the threshold of the system is 10.0<λmax=34.4732, the attacked equilibrium is attractivity(see Figure 10).Figure 10
Global stability of attack-free solution on realistic network.


## 6. Conclusion

This paper puts forward a novel dynamical model of APDDoS attack on networks. Then, a systematic analysis of this model is showed. After that, a new sufficient condition for the global stability of attack-free equilibrium is obtained. Next, the sufficient condition for the global attractivity of attacked equilibrium also is studied. Eventually, some numerical simulations are given to show the main results of this paper.



---

*Source: 2051489-2019-02-03.xml*