# Global Behavior of a Computer Virus Propagation Model on Multilayer Networks

Authors: Chunming Zhang
Journal: Security and Communication Networks
 (2018)

---

## Abstract

This paper presents a new linear computer viruses propagation model on multilayer networks to explore the mechanism of computer virus propagation. Theoretical analysis demonstrates that the maximum eigenvalue of the sum of all the subnetworks is a vital factor in determining the viral prevalence. And then, a new sufficient condition for the global stability of virus-free equilibrium has been obtained. The persistence of computer virus propagation system has also been proved. Eventually, some numerical simulation results verify the main conclusions of the theoretical analysis.


---

## Body

## 1. Introduction

In 1987, the first computer viruses propagation model was proposed by Cohen [1]. Since then, numbers of typical computer viruses propagation models had been proposed, for instance, susceptible–infected–susceptible (SIS) models [2], susceptible–infected–removed (SIR) models [3, 4], susceptible–infected–recovered–susceptible (SIRS) models [5], susceptible–exposed–infected–removed–susceptible (SEIRS) models [6], susceptible–infected–patched–susceptible (SIPS) models [7], and susceptible–infected–external–susceptible (SIES) [8]. However, some of these models simply ignore the fact that the dominating majority of computer viruses have a quite long propagation period before breaking out which can vividly express the node with high infectious ability, while some other models assume that, during its latency, an infected computer just infected recently that has low infectious ability compared with breaking out nodes, also known as anE computer, has no infectivity. This, however, is inconsistent with the fact that, in general, an infected computer does possess infectivity [9]. To overcome these deficiencies, Yang et al. proposed a novel computer virus propagation model, called Susceptible–Latent–Breaking–Susceptible (SLBS) model, in which all the computers connected to the Internet are divided into three groups: virus-free computers, known as susceptive computer (S computer), infected computers that are latent (L computer), and infected computers in which the viruses are breaking out that means the computer with a high infectious level (B computer). One remarkable distinction between the SLBS model and the classical SEIS model is that a latent computer possesses infecting capability [9].While the mechanism of computer virus propagation on networks is an important research area, lots of network-based computer viruses propagation models ranging from susceptible–infected (SI) models [2, 10] and SIS models [3–5, 8, 11–14] to SIR models [5, 6, 13, 15, 16] and SLBS models [14] and SIPS models [7] have also been inspected. However, these studies mainly focus on single layer networks [11–13, 15, 17–24]. In reality, computer viruses can spread not only through single layer networks but also through multilayer networks; for example, mobile phone viruses (a type of computer virus) can utilize 3G network, 4G network, Wi-Fi network, and even Bluetooth network as their communication network.On the other hand, from the point of view of research methods, Markov chain method, which is proposed by Van Mieghem et al. [10, 25], can exactly describe computer viruses propagation process with constant transition rates between compartments on any networks. Nevertheless, this method is complex in mathematical analysis. For the purpose of overcoming this deficiency, several approximate methods of researching computer viruses propagation on networks are also proposed in recent years. For example, based on the assumption that the dynamic state of every node is statistically independent of the state of its nearest neighbors, Wang et al. [26], Youssef and Scoglio [27], and Yang et al. [14] proposed the so-called Individual-based mean-field theory (IBMF); based on the assumption that all nodes of degree k are statistically equivalent, Pastor-Satorras and Vespignani [28, 29] and Barthélemy et al. [30] proposed the so-called degree-based mean-field theory (DBMF), and so on.For the purpose of more accurately understanding the propagation mechanism of computer viruses on multilayer networks, in this paper, we propose a novel SLBS computer virus propagation model on multilayer network. Highlights of this paper are as follows.( 1 ) Based on the assumption of multilayer network, by applying the IBMF to the existing SLBS model, a high-dimensional computer virus propagation dynamic model, which is known as the individual-based SLBS model, is formulated. This model forms the foundation of this work. To our knowledge, there is no report about the spread of computer viruses on multilayer networks.( 2 ) To find out the influence of multilayer networks topology on computer virus spreading, by means of mathematical analysis, I find out that the propagation threshold is the maximum eigenvalue of the sum of all the subnetworks on multilayer networks. Then, the global stability of the virus-free equilibrium has been analyzed. The persistence of system has been proved. Extensive experiments confirmed the conclusions of the mathematical analysis.The subsequent materials of this paper are organized as follows. In Section2, we present the multilayer networks and computer viruses propagation model in detail; and then in Section 3 the model is analyzed comprehensively; numerical simulation results are given in Section 4; eventually, in Section 5, we outline this work.


## 2. Assumptions and Modeling

For the purpose of describing the model in detail, the following notations are proposed:(i)
G=V,E: the multilayer network, which consists of n subnetworks(ii)
Gs=(Vs,Es) (s=1,2,…,n): the sth layer subnetwork; each subnetwork Gs has N nodes(iii)
Vs: the set of nodes contained in Gs(iv)
Es: the set of edges contained in Gs(v)
aijs: the link from node i to node j in Gs, aijs∈0,1(vi)
As=aijsN×N: the corresponding parameterized adjacency matrix of graph Gs.In addition, a dynamic switching networkG=V,E also must satisfy the following conditions:(I)
V=V1=V2=⋯Vn.(II)
E=⋃s=1nEs and Es1∩Es2=⌀ for all s1≠s2.Condition (I) presents that nodes in all subnetworks are identical. Condition (II) shows that the edges of any two subnetworks are different.A simple example of a multilayer network is shown in Figure1.Figure 1
Multilayer network.As discussed above in the paper, the traditional SLBS model can divide the node into three parts: susceptive node (S node) used to be known as health node and uninfected node, latent node (L node) representing the node which is infected but only showing a low infectious ability, and breaking out node (B node). Compared with L node, B node has significant high infectious power. Let ξi(t) = 0 (1, 2) stand for the state of the node which is susceptible (latent, breaking out) at time t. Then the state of the multilayer network at time t can be expressed as follows:(1)ξt=ξ1t,…,ξnt∈0,1,2n.Letsi(t) (li(t),bi(t)) represent the probability that node i is S node (L node, B node) at time t:(2)sit=Prξit=0,lit=Prξit=1,bit=Prξit=2.Then, the following assumptions are given (see Figure2):Figure 2
State diagram of SLBS model in multilayer networks.(H1) In the sth layer subnetwork Gs, the probability that a susceptible node i is infected by a viral (including latent and breaking out) neighbor j is βsaijsbj(t)+lj(t), where βs denotes the infection rate in the sth layer subnetwork Gs. The probability that a susceptible node i is infected by a viral neighbor j in all layer subnetworks is ∑s=1nβsaijsbj(t)+lj(t). Then, the probability that a susceptible node i is infected by all viral neighbors in all subnetworks is ∑j=1N∑s=1nβsaijsbj(t)+lj(t).(H2) The probability that a latent node becomes a breaking out node is γ.(H3) The probability that a breaking out node becomes a susceptible node is η.(H4) The probability that a latent node becomes a susceptible node is α.LetΔt denote a short time interval. According to the total probability theorem, several formulas can be given from the above assumptions as follows (see Figure 2): (3)sit+Δt=sitPr⁡ξit+Δt=0∣ξit=0+litPr⁡ξit+Δt=0∣ξit=1+bitPr⁡ξit+Δt=0∣ξit=2,lit+Δt=sitPr⁡ξit+Δt=1∣ξit=0+litPr⁡ξit+Δt=1∣ξit=1+bitPr⁡ξit+Δt=1∣ξit=2,bit+Δt=sitPr⁡ξit+Δt=2∣ξit=0+litPr⁡ξit+Δt=2∣ξit=1+bitPr⁡ξit+Δt=2∣ξit=2.Hereo(Δt) represents time t higher-order infinitesimal. According to (H1)–(H4) and (3), we can derive the following equations:(4)Pr⁡ξit+Δt=0∣ξit=0=1-∑j=1N∑s=1nβsaijsbjt+ljtΔt+oΔt,Prξit+Δt=1∣ξit=0=∑j=1N∑s=1nβsaijsbjt+ljtΔt+oΔt,Prξit+Δt=2∣ξit=0=oΔt,Prξit+Δt=0∣ξit=1=αΔt+oΔt,Prξit+Δt=1∣ξit=1=1-αΔt-γΔt+oΔt,Prξit+Δt=2∣ξit=1=γΔt+oΔt,Prξit+Δt=0∣ξit=2=ηΔt+oΔt,Prξit+Δt=1∣ξit=2=oΔt,Prξit+Δt=2∣ξit=2=1-ηΔt+oΔt.Substituting (4) into the above formulas and letting Δt→0, we deduce the 3N-dimensional differential system as follows:(5)dsitdt=-∑j=1N∑s=1nβsaijsbjt+ljtsit+αlit+ηbit,dlitdt=∑j=1N∑s=1nβsaijsbjt+ljtsit-αlit-γlit,dbitdt=γlit-ηbit.Becausesi(t)+li(t)+bi(t)≡1, si(t) can be expressed by the following equation: si(t)=1-li(t)-bi(t). Then, the following 2N-dimensional subsystem can be derived: (6)dlitdt=∑j=1N∑s=1nβsaijsbjt+ljt1-lit-bit-αlit-γlit,dbitdt=γlit-ηbit,1≤i≤N.Without loss of generality, we introduce an infection matrixH=hij∈RN×N, where hij=β1aij1+β2aij2+⋯+βnaijn=∑s=1nβsaijs (or H=β1A1+β2A2+⋯+βnAn). We assume λmax represents the maximum eigenvalue of matrix H.Then, system (6) can be expressed as follows: (7)dlitdt=∑j=1Nhijbjt+ljt1-lit-bit-αlit-γlit,dbitdt=γlit-ηbit,1≤i≤N.


## 3. Theoretical Analysis

System (7) obviously has a unique virus-free equilibrium E0=(0,0,…,0)T2N×1. This section concentrates on the stability of the virus-free equilibrium and persistence of system (7).First, consider properties of the virus-free equilibrium of system (7).Let(8)Ω=X=x1,x2,…,x2NT∈R+2N∣xi+xi+N≤1,i=1,2,…,N.Let(9)xt=l1t,…,lNt,b1t,…,bNtT.Then, system (7) can be expressed in the form of a matrix as follows:(10)dxtdt=Wxt+Yxt,with initial condition x(0)∈Ω, where(11)W2N×2N=-αI-γI+HHγI-ηI,(12)Yxt2N×1=-l1t+b1t∑jh1jljt+bjt,…,-lNt+bNt∑jhNjljt+bjt,0,…,0︷NT.Let(13)R0=ηα+γη+γ.Theorem 1.
Consider linear system (7):(a)
The virus-free equilibriumE0=(0,0,…,0)T2N×1 is asymptotically stable if λmax<R0.(b)
The virus-free equilibriumE0=(0,0,…,0)T2N×1 is unstable if λmax>R0.Proof.
The characteristic equation of the Jacobian matrix of system (7) at E0 is(14)detλI-W=detλ+α+γI-H-H-γIλ+ηI2N×2N=det⁡λ+α+γλ+ηI-λ+γ+ηH=0.Equation (14) has two possible cases.
Case 1  (α=η). R0=η, and (14) is derived into(15)λ+η+γNdetλ+ηI-H=0.
This equation has a negative root-η-γ with multiplicity N; and the remaining N roots of the equation are λk-η, 1≤k≤N. If λmax<R0, then λk-η≤λmax-η<0 for all k. Hence, all the roots of (14) are negative. So, the virus-free equilibrium of system (7) is asymptotically stable. On the contrary, if λmax>R0, then λmax-η>0. So, (14) has a positive root. As a result, the virus-free equilibrium is unstable.
Case  2  (α≠η).-η-γ is not a root of (14). Thus,(16)detλ+α+γλ+ηλ+γ+ηI-H=0.
This means thatλ is a root of (14) if and only if λ is a root of(17)λ2+akλ+bk=0,where(18)ak=α+γ+η-λk,bk=α+γη-λkγ+η.If λmax<R0, we have ak>0 and bk>0. According to the Hurwitz criterion, the two roots of (17) both have negative real parts. So, all roots of (14) have negative real parts. Hence, the virus-free equilibrium is asymptotically stable. Otherwise, if λmax>R0, then(19)λ2+akλ+bk=0has a root with positive real part. As a result, (14) has a root with positive real part. Hence, the virus-free equilibrium is unstable.
The proof is complete.Then, we consider the global stability of the virus-free equilibrium of system (7).Lemma 2 (see [31]).
Consider a systemdx/dt=f(x) that is defined at least in a compact set C. Then, C is invariant if, for every point y on ∂C, the vector f(y) is tangent to or pointing to C.Lemma 3.
The set Ω is positively invariant for system (7). That is, x(0)∈Ω implies x(t)∈Ω for all t>0.Proof.
∂ Ω consists of the following 3N hyperplanes:(20)Si=x∈Ω∣xi=0,Ti=x∈Ω∣xi+N=0,Ui=x∈Ω∣xi+xi+N=1,which have (21)φi=0,…,0,-1i,0,…,0,ψi=0,…,0,-1i+N,0,…,0,ξi=0,…,0,1i,0,…,0,1i+N,0,…,0as their respective outer normal vectors. For 1≤i≤N, we have(22)dxdtx∈Si·φi=-1-xi+N∑j=1Nhijxj+xj+N<0,dxdtx∈Ti·ψi=-γxi<0,dxdtx∈Ui·ξi=-αxi-η1-xi<0.
Thus, the claimed result follows from Lemma2.Lemma 4 (see [31]).
Consider ann-dimensional autonomous system(23)dztdt=Azt+Qzt,z∈D,where A is an irreducible n×n matrix, D is a region containing the origin, Q(z)∈C, and limx→0Q(z)/z=0. We assume that there exists a positively invariant compact convex set [16] C⊂D containing the origin, a positive number r, and a real eigenvector ω of AT such that(C1)
z,ω≥rz for all z∈C,(C2)
Qz,ω≤0 for all z∈C,(C3)
the origin forms the largest positively invariant set [16] included in N={z∈C∣Qz,ω=0}.
Then, we have the following:(1)
ω<0 implies that the origin is globally asymptotically stable in C.(2)
ω>0 implies that there exists m>0 such that, for each z0∈C-{0}, the solution ϕ(t,z0) to system (7) satisfies limt→∞infϕ(t,z0)≥m.Theorem 5.
Consider system (7). The virus-free equilibrium E0=(0,0,…,0)T2N×1 is globally asymptotically stable in Ω if λmax<R0.Proof.
LetC=Ω, A=W, and Q=Y. As matrix WT is irreducible and all of its nondiagonal entries are nonnegative, from [31]AT has a positive eigenvector z=z1,z2,…,z2N corresponding to its eigenvalue ω.
Letr=minzi:1≤i≤2N>0. Then, (24)x,z≥r∑i=12Nxi=rx,Qx,z=-∑i=1Nzixi+xi+N∑jhijxj+xN+j≤0.Qx,z=0 implies that x=0. Hence, the claimed result follows from Lemma 4.Second, we investigate the properties of system (7) when λmax>R0. From Lemma 4 and Theorem 1, we can easily get the following results.Theorem 6.
Consider linear system (7). If λmax>R0, we have(25)∑ilit+bit>0⟹liminft→∞∑ilit+bit>0.Remark 7.
Theorem5 shows that the global stability of the virus-free equilibrium implies that the viruses will decline to extinction.Remark 8.
Theorem6 shows that if λmax>R0, then, computer viruses in the network will persist.


## 4. Numerical Simulations

In this section, the main theorems of this paper are verified by some numerical simulations. Letp(t) represent the percentage of infected nodes in all nodes at time t, p(t)=(1/N)∑i=1Nli(t)+bi(t).( 1 ) We consider a two-layer complete graph, which has 250 nodes, and the infection rate of the 1st and the 2nd layer subnetwork is β1 = 0.0005 and β2 = 0.0007, respectively. Then, λmax = 0.2988.Example 1.
Based on(1), Figure 3 shows the dynamic behavior of system (7) with α=0.4, γ=0.5, and η=0.4 for different initial conditions. By calculation, R0=0.4. Because of λmax<R0, computer virus would die out.Figure 3
The time plot ofp(t) for Example 1 with different initial values.Example 2.
Based on(1), Figure 4 reveals the dynamic behavior of system (7) with α=0.4, γ = 0.5, and η = 0.12 in different initial conditions. Then R0 = 0.1742. Because of λmax>R0, computer virus would persist.Figure 4
The time plot ofp(t) for Example 2 with different initial values.( 2 ) We take a three-layer Erdos–Renyi random graph, which has 250 nodes, with random connection probability 0.8. The infection rate of the 1st, 2nd, and 3rd layer subnetwork is β1 = 0.0005, β2 = 0.0006, and β3 = 0.0007, respectively. Then, λmax = 0.3583.Example 3.
Based on(2), Figure 5 illustrates the dynamic behavior of system (7) with α=0.4, γ = 0.5, and η = 0.6 for different initial conditions. By calculation, R0 = 0.4909. Because of λmax<R0, computer virus would die out.Figure 5
The time plot ofp(t) for Example 3 with different initial values.Example 4.
Based on(2), Figure 6 shows the dynamic behavior of system (7) with α=0.4, γ = 0.5, and η = 0.2 in different initial conditions. Then R0 = 0.2571. Because of λmax>R0, computer virus would persist.Figure 6
The time plot ofp(t) for Example 4 with different initial values.( 3 ) We take a two-layer Barabási–Albert (BA) scale-free graph, which has 250 nodes. The infection rate of the 1st and 2nd layer subnetwork is β1 = 0.02 and β2 = 0.03, respectively. Then, λmax = 0.2946.Example 5.
Based on(3), Figure 7 illustrates the dynamic behavior of system (7) with α=0.4, γ = 0.5, and η = 0.6 for different initial conditions. By calculation, R0 = 0.4909. Because of λmax<R0, computer virus would die out.Figure 7
The time plot ofp(t) for Example 5 with different initial values.Example 6.
Based on(3), Figure 8 shows the dynamic behavior of system (7) with α=0.4, γ = 0.5, and η = 0.1 in different initial conditions. Then R0 = 0.15. Because of λmax>R0, computer virus would persist.Figure 8
The time plot ofp(t) for Example 6 with different initial values.( 4 ) Consider a multilayer network consisting of three subnetworks; each subnetwork has 250 nodes. The subnetwork of the 1st, 2nd, and 3rd is complete connected network, random network, and scale-free network, respectively. And the connection probability of the random subnetworks is 0.7. Besides, the infection rate of the 1st, 2nd, and 3rd subnetwork is β1 = 0.0002, β2 = 0.0003, and β3 = 0.001, respectively. Then, λmax = 0.2760.Example 7.
Based on(4), Figure 9 illustrates the dynamic behavior of system (7) with α=0.4, γ = 0.5, and η = 0.6 for different initial conditions. By calculation, R0 = 0.4909. Because of λmax<R0, computer virus would die out.Figure 9
The time plot ofp(t) for Example 7 with different initial values.Example 8.
Based on(4), Figure 10 shows the dynamic behavior of system (7) with α=0.1, γ = 0.5, and η = 0.1 in different initial conditions. Then R0 = 0.1. Because of λmax>R0, computer virus would persist.Figure 10
The time plot ofp(t) for Example 8 with different initial values.( 5 ) The propagation threshold R0 plays a vital role in determining the dynamics of system (7). As ∂R0/∂α>0, ∂R0/∂η>0, R0 is strictly increasing with respect to the parameters α, η (see Figure 11). As ∂R0/∂γ=ηη-α/η+γ2, when η>α, R0 increases as γ increases; when η<α, R0 decreases as γ increases (see Figure 12).Figure 11
Values ofR0 as a function of varying α and γ with fixing the parameter η = 0.3.Figure 12
Values ofR0 as a function of varying η and γ with fixing the parameter α = 0.25.


## 5. Conclusions

To explore the propagation mechanism of computer viruses on multilayer network, a novel computer virus propagation model has been proposed. The theoretical analysis of model exhibited that computer viral prevalence is deeply determined by the maximum eigenvalue of the multilayer networks. Then, the global stability of virus-free equilibrium and the persistence of computer virus propagation have been proved. Some numerical simulations have also been given.As it is well known, the topology of the Internet is varying constantly rather than being static. A dynamic switching network is a network whose links will change (dissipate and emerge) and then the structure of the networks will be different in the distinct time. Therefore, it is of practical importance to understand the effect of dynamic switching networks on virus spreading. Our next work is to study the spreading behavior of computer viruses on dynamic switching networks.



---

*Source: 2153195-2018-04-12.xml*