# Modeling and Analysis in Peer-To-Peer Botnet with Virtual Patching and Quarantine Strategy

Authors: Wei Yang; Qiang Fu; Yu Yao; Wei Sun
Journal: Mathematical Problems in Engineering
 (2022)

---

## Abstract

Botnets, especially peer-to-peer (P2P) botnets have become the root because of many Internet attacks recently. To effectively suppress P2P botnets, quarantine and virtual patching strategy are proposed and two dynamical models (SIIQR model and SIIQPR model) are given based on the SIIR model. The two models can examine the impact of different containment strategies on the growth of the P2P botnets. In addition, the stability of equilibrium is investigated and the basic reproduction number is obtained, which governs whether or not P2P botnets are extinct. The virtual patching strategy and quarantine strategy can effectively contain the propagation of the P2P botnets. Numerical and simulation results show the effectiveness of our models, larger infected rate, and larger deploying rate of virtual patching can control the number of infected hosts more effectively.


---

## Body

## 1. Introduction

### 1.1. Motivation

The peer-to-peer (P2P) botnet is a new generation of self-organizing botnet that has replaced the old centralized IRC/HTTP (Internet Relay Chat/Hyper Text Transfer Protocol)-based botnet to avoid a single point of failure and avoid detection during command and control (C&C) connection [1]. A P2P botnet adopts a decentralized architecture using an overlay network exchanging command and control data between the bot-masters and the bots. A bot-master in P2P botnet recruits new vulnerable hosts (bots) to run malicious software by all kinds of attacking techniques such as Trojan, worms, and virus [2]. A host in P2P botnet can act as a bot-master and a bot, which makes the detection of P2P botnet even more difficult and the effect of P2P botnet more harmful [3, 4]. P2P botnets, such as Peacomm, Storm botnet [5], Waledac botnet [6], Miner botnet [7], Kelihos botnet [8], and Zero Access botnet [9] have emerged and gradually escalated in recent years.Threats of P2P botnets to the Internet security have drawn widespread attention by researchers. Some traditional epidemic models of infectious diseases were used to describe the propagation of P2P botnet. Kolesnichenko et al. develop the mean-field model to analyse behaviours of P2P botnet and compared it with simulations obtained from the Mobius tool [10]. Sanders et al. develop a stochastic model of P2P botnet to examine how different factors impact the total propagation bots which provides insight on possible defence tactics [11]. Feng et al. use dynamical models to portray the process of formation of P2P botnets in micro- and macro-level and also propose a mathematical model that combines the scale-free trait of Internet with the formation of P2P botnet presented [12, 13]. Even though there are quite a few ways to evade the attacks, there is a crucial need for one which can turn table on attacker by using active approach. Virtual patching is a very suitable solution, and the effect of virtual patching on the P2P botnet also need to be studied.Virtual patching is a remediation technique using in the network security field. Virtual patching gives a temporary protection for the vulnerable hosts to survive the spanning time of updating the software or releasing the new patching of application. If a vulnerability is identified, the customer most likely will not be able to modify the source code themselves and have to wait for an official patch to be released, it means that an officially supported patch may not be available for an extended period of time. Virtual patching is the process of creating and implementing a temporary policy that is used to mitigate exploitation risks associated with the discovery of new security vulnerabilities [14]. It eliminates the potential threat of application or system security loopholes being identified and exploited by hackers.


### 1.2. Related Works

To effectively fight against P2P botnets, some research results achieved mainly on the detection of P2P botnet. Su et al. propose an effective framework by integrating SDN and machine learning to detect and categorize P2P network traffics, which can automatically analyse network traffic and flexibly change flow entries in OpenFlow switches through the SDN controller [15]. Yang and Wang extract the data packet size and the symmetric intervals in flow according to the concept of graphic symmetry. They combine with flow information entropy and session features to detect the P2P botnet and get a high detection accuracy [16]. Dehkordi and Sadeghiyan propose an effective node-removal method against P2P botnets [17]. Xing et al. propose an unstructured P2P botnet detection framework based on SAW community discovery [18]. Zhuang and Chang propose an enhanced PeerHunter, a network-flow level community behaviour analysis based system, to detect P2P botnets [19]. Khan et al. propose a hybrid technique to detect botnets based on P2P traffic similarity [20]. As the development of botnets, P2P botnets are more robust and difficult for security community to defend.Although most of previous works can offer useful insight into the propagation and detection of the P2P botnet, some of them ignore or fail to discuss the effect of containment strategies to the P2P botnets. In the past decades, some traditional epidemic models of infectious diseases are used to describe the propagation of Internet worms [21], Lloyd and May put forward a point that the spreading process of computer viruses is similar to the spreading model of human infectious diseases [22]. Then, the SIS model [23] and SIR model [24] have been proposed later inspired by human infectious disease. Dynamic quarantine is one of the common containment strategy of Internet worm and first proposed by Zou et al. [25]. Dynamic quarantine is an active defence method and a host is quarantined whenever its behaviour looks suspicious by blocking traffic on its anomaly port. The quarantined host will be released after a short time, and the experiment has proved that the dynamic quarantine will raise a worm’s epidemic threshold, which will reduce the chance for a worm to spread out. Chen studies the effectiveness of partial quarantine for simple epidemics and derive the critical threshold for networks to have herd immunity [26]. Fan presents a study on modeling the propagation of P2P worms under quarantine using logic matrix [27]. Yao et al. model and analyse the quarantine strategy with time delay and variable infection rate [28]. Martín del Rey et al. propose a malware propagation model based on random complex networks, it is based on individuals and described by cellular automata [29]. Sheng et al. study the spread of industrial viruses with intelligent honeynet model [30]. Liu et al. study the characteristics of key nodes in complex networks [31]. Sardar et al. propose and analyse a conceptual mathematical model for the tumor-immune interaction [32]. Masood et al. develop an autonomous epidemic virus model to depict the transmission of malicious computer code in active networks with preexisting immunity and quarantine as effective control strategies [33]. However, the topology and the node equipment of the ICS network are quite different with that in the P2P botnets. The topology of the ICS network is approximately regarded as a power law distribution, and it is mainly composed of PLCs and honeypots. Therefore, the epidemic dynamic is quite different in the two networks. However, the effectiveness of P2P botnet quarantine has not yet been studied in detail.In this paper, according to the life cycle of P2P botnet, a P2P botnet model called Susceptible-Infected-Infected-Recovered (SIIR) model is proposed to reflect the formation of P2P botnets. On this basis, two mathematical models (SIIQR, SIIQPR) are proposed and analysed with quarantine strategy and virtual patching, respectively. The bot-free equilibrium point is analysed and the basic reproduction number is derived to quantify the guideline for effective defence of P2P botnets. The simulation and numerical experiments are conducted to verify the correctness and effectiveness of our models. Through the comparative experiments, the model with both quarantine strategy and virtual patching can restrain the propagation of the P2P botnets the best, and for the SIIQPR model, larger infected rate that the bot-masters recruit new hosts and larger deploying rate of virtual patching can control the number of infected hosts more effectively. The paper can give effective strategy into predicting and restraining of the P2P botnet.The rest of the paper is organized as follows. In Section2, the propagation models of P2P botnet are presented combining the P2P botnet formation process and the dynamic quarantine and virtual patching strategy. Section 3 analyses the stability of equilibrium and obtained the basic reproduction number. In Section 4, the numerical analysis and simulation experiments of our models are carried out. Section 5 summarized the paper with some future directions.


## 1.1. Motivation

The peer-to-peer (P2P) botnet is a new generation of self-organizing botnet that has replaced the old centralized IRC/HTTP (Internet Relay Chat/Hyper Text Transfer Protocol)-based botnet to avoid a single point of failure and avoid detection during command and control (C&C) connection [1]. A P2P botnet adopts a decentralized architecture using an overlay network exchanging command and control data between the bot-masters and the bots. A bot-master in P2P botnet recruits new vulnerable hosts (bots) to run malicious software by all kinds of attacking techniques such as Trojan, worms, and virus [2]. A host in P2P botnet can act as a bot-master and a bot, which makes the detection of P2P botnet even more difficult and the effect of P2P botnet more harmful [3, 4]. P2P botnets, such as Peacomm, Storm botnet [5], Waledac botnet [6], Miner botnet [7], Kelihos botnet [8], and Zero Access botnet [9] have emerged and gradually escalated in recent years.Threats of P2P botnets to the Internet security have drawn widespread attention by researchers. Some traditional epidemic models of infectious diseases were used to describe the propagation of P2P botnet. Kolesnichenko et al. develop the mean-field model to analyse behaviours of P2P botnet and compared it with simulations obtained from the Mobius tool [10]. Sanders et al. develop a stochastic model of P2P botnet to examine how different factors impact the total propagation bots which provides insight on possible defence tactics [11]. Feng et al. use dynamical models to portray the process of formation of P2P botnets in micro- and macro-level and also propose a mathematical model that combines the scale-free trait of Internet with the formation of P2P botnet presented [12, 13]. Even though there are quite a few ways to evade the attacks, there is a crucial need for one which can turn table on attacker by using active approach. Virtual patching is a very suitable solution, and the effect of virtual patching on the P2P botnet also need to be studied.Virtual patching is a remediation technique using in the network security field. Virtual patching gives a temporary protection for the vulnerable hosts to survive the spanning time of updating the software or releasing the new patching of application. If a vulnerability is identified, the customer most likely will not be able to modify the source code themselves and have to wait for an official patch to be released, it means that an officially supported patch may not be available for an extended period of time. Virtual patching is the process of creating and implementing a temporary policy that is used to mitigate exploitation risks associated with the discovery of new security vulnerabilities [14]. It eliminates the potential threat of application or system security loopholes being identified and exploited by hackers.


## 1.2. Related Works

To effectively fight against P2P botnets, some research results achieved mainly on the detection of P2P botnet. Su et al. propose an effective framework by integrating SDN and machine learning to detect and categorize P2P network traffics, which can automatically analyse network traffic and flexibly change flow entries in OpenFlow switches through the SDN controller [15]. Yang and Wang extract the data packet size and the symmetric intervals in flow according to the concept of graphic symmetry. They combine with flow information entropy and session features to detect the P2P botnet and get a high detection accuracy [16]. Dehkordi and Sadeghiyan propose an effective node-removal method against P2P botnets [17]. Xing et al. propose an unstructured P2P botnet detection framework based on SAW community discovery [18]. Zhuang and Chang propose an enhanced PeerHunter, a network-flow level community behaviour analysis based system, to detect P2P botnets [19]. Khan et al. propose a hybrid technique to detect botnets based on P2P traffic similarity [20]. As the development of botnets, P2P botnets are more robust and difficult for security community to defend.Although most of previous works can offer useful insight into the propagation and detection of the P2P botnet, some of them ignore or fail to discuss the effect of containment strategies to the P2P botnets. In the past decades, some traditional epidemic models of infectious diseases are used to describe the propagation of Internet worms [21], Lloyd and May put forward a point that the spreading process of computer viruses is similar to the spreading model of human infectious diseases [22]. Then, the SIS model [23] and SIR model [24] have been proposed later inspired by human infectious disease. Dynamic quarantine is one of the common containment strategy of Internet worm and first proposed by Zou et al. [25]. Dynamic quarantine is an active defence method and a host is quarantined whenever its behaviour looks suspicious by blocking traffic on its anomaly port. The quarantined host will be released after a short time, and the experiment has proved that the dynamic quarantine will raise a worm’s epidemic threshold, which will reduce the chance for a worm to spread out. Chen studies the effectiveness of partial quarantine for simple epidemics and derive the critical threshold for networks to have herd immunity [26]. Fan presents a study on modeling the propagation of P2P worms under quarantine using logic matrix [27]. Yao et al. model and analyse the quarantine strategy with time delay and variable infection rate [28]. Martín del Rey et al. propose a malware propagation model based on random complex networks, it is based on individuals and described by cellular automata [29]. Sheng et al. study the spread of industrial viruses with intelligent honeynet model [30]. Liu et al. study the characteristics of key nodes in complex networks [31]. Sardar et al. propose and analyse a conceptual mathematical model for the tumor-immune interaction [32]. Masood et al. develop an autonomous epidemic virus model to depict the transmission of malicious computer code in active networks with preexisting immunity and quarantine as effective control strategies [33]. However, the topology and the node equipment of the ICS network are quite different with that in the P2P botnets. The topology of the ICS network is approximately regarded as a power law distribution, and it is mainly composed of PLCs and honeypots. Therefore, the epidemic dynamic is quite different in the two networks. However, the effectiveness of P2P botnet quarantine has not yet been studied in detail.In this paper, according to the life cycle of P2P botnet, a P2P botnet model called Susceptible-Infected-Infected-Recovered (SIIR) model is proposed to reflect the formation of P2P botnets. On this basis, two mathematical models (SIIQR, SIIQPR) are proposed and analysed with quarantine strategy and virtual patching, respectively. The bot-free equilibrium point is analysed and the basic reproduction number is derived to quantify the guideline for effective defence of P2P botnets. The simulation and numerical experiments are conducted to verify the correctness and effectiveness of our models. Through the comparative experiments, the model with both quarantine strategy and virtual patching can restrain the propagation of the P2P botnets the best, and for the SIIQPR model, larger infected rate that the bot-masters recruit new hosts and larger deploying rate of virtual patching can control the number of infected hosts more effectively. The paper can give effective strategy into predicting and restraining of the P2P botnet.The rest of the paper is organized as follows. In Section2, the propagation models of P2P botnet are presented combining the P2P botnet formation process and the dynamic quarantine and virtual patching strategy. Section 3 analyses the stability of equilibrium and obtained the basic reproduction number. In Section 4, the numerical analysis and simulation experiments of our models are carried out. Section 5 summarized the paper with some future directions.


## 2. Model Formulation

The life cycle of the P2P botnet consists of four primary phases, namely, initial infection, peer propagation, secondary injection, and attack [34, 35]. Initial infection phase: bot code is created through different technologies such as web downloads, vulnerability exploitation, e-mail attachments, automatic scanning, and traditional file-based viruses inserted into users’ computers [36]. Bot code is a program that performs user-centric tasks automatically without any interaction with a user. The vulnerable end-user computer that running bot code is called bot-master. Peer propagation phase: the bot-master tries to connect with other vulnerable hosts based on its own hard-coded peer list to select P2P bot candidates. Secondary injection phase: the new bots download the latest update of the bot code through the C&C channel, which will update it for future tasks. All the updated bots form a network called P2P botnet. Attack phase: finally, the bot initiates malicious activities such as spam or phishing emails, distributed denial-of-service (DDoS) attacks, stealing information, and scanning activities.In the peer propagation phase, there are three ways for a bot-master to recruits new hosts. Therefore, P2P botnet can be classified into three category: parasite P2P botnet, leaching P2P botnet, and bot-only P2P botnet. In addition, the P2P botnet (such as Sinit) uses a random scan method to find other interactive bots, this leads to a very weak connection of the constructed P2P botnet. So the topology of the P2P botnets is approximately regarded as a random distribution. To enhance readability and facilitate understanding, some definitions are given as follows which explain the meaning of some concepts involved in this paper.Definition 1.
Parasite P2P botnet is a botnet in which bots are chosen from an existing P2P network.Definition 2.
Leaching P2P botnet is a botnet in which bot-masters recruit new bots from vulnerable hosts throughout the whole Internet, but they will join in and depend on an existing P2P network.Definition 3.
Bot-only P2P botnet is a botnet that occurs in an unattached network, and there are no nonmalignant peers except bots.
In this paper, we focus on talking about the leaching P2P botnet, which is a typical kind of P2P botnet and can best reflect the characteristics of P2P network.


### 2.1. SIIR Model

According to the life cycle of the P2P Botnet, we can consider the propagation process of the leaching P2P botnet as a two-step process. Step one, an infected host (bot-master) try to infect the new susceptible hosts (bots) throughout the whole Internet. Step two, the new compromised hosts join into the P2P network and connect with other bots. So a two-phase SIR model is employed to describe the dynamic behaviour of leaching P2P botnet, which is called SIIR model. The proposed model can describe the spreading behaviour of leaching P2P botnet more realistically in this paper.In the model, there are four kinds of hosts: susceptible hosts (S), stage-1-infected hosts (I1), stage-2-infected hosts (I2), and recovered hosts (R). Stage-1-infected hosts (I1) are compromised hosts but not connected with other bots. In Stage-1-infected hosts (I1), no abnormal traffic is generated because there are no interaction with other bots and the stage-1-infected hosts are hard to be detected. Stage-2-infected hosts (I2) are indeed bots that joins the P2P network and do attack activities. If the stage-2-infected hosts carry on the attack activities, they can be detected and recovered.Considering that the hosts on the Internet will dynamically join and leave the P2P network, the birth rate and the death rateμ are added to model this process, but not all the newly joined hosts will become bots in P2P botnet. If the hosts are patched, even if they just joined the network, they will directly be immune to the attack. The probability of a newly added node being patched is 1−p, the rest of newly joined hosts will become susceptible hosts.β is the infected rate that represented the probability in the process of susceptible hosts and are selected as bot-masters. ρ is the infected rate that the bot-masters recruit new hosts on the Internet. γ is the recovered rate of the infected hosts. The state transition diagram of the SIIR model is shown in Figure 1.Figure 1
The state transition diagram of the SIIR model.The total number of hosts on the Internet is assumed relatively stable. We have the following equation:(1)N=St+I1t+I2t+Rt.LetSt, I1t, I2t, and Rt be the number of hosts in leaching P2P botnets at time t in state S, I1, I2, and R, respectively. And the propagation model of leaching P2P botnets can be represented with the following equation:(2)dSdt=pμN−μSt−βStI1t+I2t,dI1dt=βStI1t+I2t−ρ+μI1t,dI2dt=ρI1t−μ+γI2t,dRdt=1−pμN+γI2t−μRt.


### 2.2. SIIQR Model

In order to study the effectiveness of quarantine in P2P botnet, SIIQR model is established to model the dynamic quarantine process and analyse the dynamic quarantine effect. Only when hosts in the stage-2-infected hosts (I2) state, they will carry out the attack and show suspicious behaviour. A host is quarantined by blocking traffic on its anomaly port whenever its behaviour looks suspicious. The dynamic quarantine will be released after a short time, even if the host has not been inspected by security staff yet.The dynamic quarantine is a compensation method that can tolerate higher false alarm rate of P2P botnet detection. A falsely quarantined healthy host will only be quarantined for a short time, thus its normal activities will not be interfered too much. The state transition diagram of the SIIQR model is shown in Figure2.Figure 2
The state transition diagram of the SIIQR model.σ is the quarantine rate that depends on the performance parameter of the misuse intrusion detection system. δ is the transition rate from state Q to state R. Let Qt be the number of the state Q hosts at time t. The propagation model of leaching P2P botnets combining dynamic quarantine methods is shown as follows:(3)dSdt=pμN−μSt−βStI1t+I2t,dI1dt=βStI1t+I2t−ρ+μI1t,dI2dt=ρI1t−σ+γ+μI2t,dQdt=σI2t−μ+δQt,dRdt=γI2t+δQt+1−pμN−μRt.


### 2.3. SIIQPR Model

The dynamic quarantine strategy is used for unknown cyber attacks and is carried out when the hosts exhibit a suspicious behaviour. Virtual patching is a policy for an intermediary device (i.e., firewall) that is able to identify and block attempts to exploit a specific vulnerability. Virtual patching strategy is used for known attack behaviour and it gives a temporary protection for the vulnerable hosts to survive the spanning time of updating the software or releasing the new patching of application.The workflow of virtual patching consists of the following phases: preparation phase, identification phase, analysis phase, virtual patch creation phase, implementation/testing phase. The preparation phase need to setup the virtual patching processes and framework prior to actually having to deal with an identified vulnerability. The identification phase occurs when a vulnerability of Internet host is aware. Then, we need to expedite the implementation of virtual patches through the analysis, creation, implementation, and testing.The virtual patching is often deployed on the firewall. Once the virtual patching is ready, the firewall will analyse transactions and intercepts attacks in transit, the malicious traffic will never reach the hosts. The effect of virtual patching is that the specific attacks will not be implemented even if the hosts are still susceptible. So a new state calledP state (virtual patched state) is added to reflect the process of configuring virtual patches on firewall. The P state is completely different from the R state. The hosts in P state are still susceptible, but the vulnerability exploited attempt does not succeed. The hosts in R state are patched up and cannot be infected.The virtual patching strategy will mainly affect the propagation of P2P botnet if it is in initial infection phase and peer propagation phase. In initial infection phase, the bot code cannot be inserted into the susceptible hosts for virtual patching. However, the susceptible hosts and the stage-1-infected hosts can be virtual patched. It is assumed that the deploying rate of virtual patching on the Internet isα1 and α2, respectively.In peer propagation phase, the bot-masters cannot connect with other bots by using the specified vulnerability. Some of the bot-masters lost the ability to recruit new bots, therefore the state transition of the stage-1-infected hosts is from stateI1 to state P. The state transition diagram of the SIIQPR model is shown in Figure 3.Figure 3
The state transition diagram of the SIIQPR model.Pt is the number of virtual patched hosts at time t, and the propagation model of leaching P2P botnets combining dynamic quarantine and virtual patching methods is shown as follows:(4)dSdt=pμN−μ+α1St−βStI1t+I2t,dPdt=α1St+α2I1t−ω+μPt,dI1dt=βStI1t+I2t−α2+ρ+μI1t,dI2dt=ρI1t−σ+γ+μI2t,dQdt=σI2t−μ+δQt,dRdt=1−pμN+γI2t+δQt+ωPt−μRt.


## 2.1. SIIR Model

According to the life cycle of the P2P Botnet, we can consider the propagation process of the leaching P2P botnet as a two-step process. Step one, an infected host (bot-master) try to infect the new susceptible hosts (bots) throughout the whole Internet. Step two, the new compromised hosts join into the P2P network and connect with other bots. So a two-phase SIR model is employed to describe the dynamic behaviour of leaching P2P botnet, which is called SIIR model. The proposed model can describe the spreading behaviour of leaching P2P botnet more realistically in this paper.In the model, there are four kinds of hosts: susceptible hosts (S), stage-1-infected hosts (I1), stage-2-infected hosts (I2), and recovered hosts (R). Stage-1-infected hosts (I1) are compromised hosts but not connected with other bots. In Stage-1-infected hosts (I1), no abnormal traffic is generated because there are no interaction with other bots and the stage-1-infected hosts are hard to be detected. Stage-2-infected hosts (I2) are indeed bots that joins the P2P network and do attack activities. If the stage-2-infected hosts carry on the attack activities, they can be detected and recovered.Considering that the hosts on the Internet will dynamically join and leave the P2P network, the birth rate and the death rateμ are added to model this process, but not all the newly joined hosts will become bots in P2P botnet. If the hosts are patched, even if they just joined the network, they will directly be immune to the attack. The probability of a newly added node being patched is 1−p, the rest of newly joined hosts will become susceptible hosts.β is the infected rate that represented the probability in the process of susceptible hosts and are selected as bot-masters. ρ is the infected rate that the bot-masters recruit new hosts on the Internet. γ is the recovered rate of the infected hosts. The state transition diagram of the SIIR model is shown in Figure 1.Figure 1
The state transition diagram of the SIIR model.The total number of hosts on the Internet is assumed relatively stable. We have the following equation:(1)N=St+I1t+I2t+Rt.LetSt, I1t, I2t, and Rt be the number of hosts in leaching P2P botnets at time t in state S, I1, I2, and R, respectively. And the propagation model of leaching P2P botnets can be represented with the following equation:(2)dSdt=pμN−μSt−βStI1t+I2t,dI1dt=βStI1t+I2t−ρ+μI1t,dI2dt=ρI1t−μ+γI2t,dRdt=1−pμN+γI2t−μRt.


## 2.2. SIIQR Model

In order to study the effectiveness of quarantine in P2P botnet, SIIQR model is established to model the dynamic quarantine process and analyse the dynamic quarantine effect. Only when hosts in the stage-2-infected hosts (I2) state, they will carry out the attack and show suspicious behaviour. A host is quarantined by blocking traffic on its anomaly port whenever its behaviour looks suspicious. The dynamic quarantine will be released after a short time, even if the host has not been inspected by security staff yet.The dynamic quarantine is a compensation method that can tolerate higher false alarm rate of P2P botnet detection. A falsely quarantined healthy host will only be quarantined for a short time, thus its normal activities will not be interfered too much. The state transition diagram of the SIIQR model is shown in Figure2.Figure 2
The state transition diagram of the SIIQR model.σ is the quarantine rate that depends on the performance parameter of the misuse intrusion detection system. δ is the transition rate from state Q to state R. Let Qt be the number of the state Q hosts at time t. The propagation model of leaching P2P botnets combining dynamic quarantine methods is shown as follows:(3)dSdt=pμN−μSt−βStI1t+I2t,dI1dt=βStI1t+I2t−ρ+μI1t,dI2dt=ρI1t−σ+γ+μI2t,dQdt=σI2t−μ+δQt,dRdt=γI2t+δQt+1−pμN−μRt.


## 2.3. SIIQPR Model

The dynamic quarantine strategy is used for unknown cyber attacks and is carried out when the hosts exhibit a suspicious behaviour. Virtual patching is a policy for an intermediary device (i.e., firewall) that is able to identify and block attempts to exploit a specific vulnerability. Virtual patching strategy is used for known attack behaviour and it gives a temporary protection for the vulnerable hosts to survive the spanning time of updating the software or releasing the new patching of application.The workflow of virtual patching consists of the following phases: preparation phase, identification phase, analysis phase, virtual patch creation phase, implementation/testing phase. The preparation phase need to setup the virtual patching processes and framework prior to actually having to deal with an identified vulnerability. The identification phase occurs when a vulnerability of Internet host is aware. Then, we need to expedite the implementation of virtual patches through the analysis, creation, implementation, and testing.The virtual patching is often deployed on the firewall. Once the virtual patching is ready, the firewall will analyse transactions and intercepts attacks in transit, the malicious traffic will never reach the hosts. The effect of virtual patching is that the specific attacks will not be implemented even if the hosts are still susceptible. So a new state calledP state (virtual patched state) is added to reflect the process of configuring virtual patches on firewall. The P state is completely different from the R state. The hosts in P state are still susceptible, but the vulnerability exploited attempt does not succeed. The hosts in R state are patched up and cannot be infected.The virtual patching strategy will mainly affect the propagation of P2P botnet if it is in initial infection phase and peer propagation phase. In initial infection phase, the bot code cannot be inserted into the susceptible hosts for virtual patching. However, the susceptible hosts and the stage-1-infected hosts can be virtual patched. It is assumed that the deploying rate of virtual patching on the Internet isα1 and α2, respectively.In peer propagation phase, the bot-masters cannot connect with other bots by using the specified vulnerability. Some of the bot-masters lost the ability to recruit new bots, therefore the state transition of the stage-1-infected hosts is from stateI1 to state P. The state transition diagram of the SIIQPR model is shown in Figure 3.Figure 3
The state transition diagram of the SIIQPR model.Pt is the number of virtual patched hosts at time t, and the propagation model of leaching P2P botnets combining dynamic quarantine and virtual patching methods is shown as follows:(4)dSdt=pμN−μ+α1St−βStI1t+I2t,dPdt=α1St+α2I1t−ω+μPt,dI1dt=βStI1t+I2t−α2+ρ+μI1t,dI2dt=ρI1t−σ+γ+μI2t,dQdt=σI2t−μ+δQt,dRdt=1−pμN+γI2t+δQt+ωPt−μRt.


## 3. Equilibrium and Stability

In this section, the dynamical behaviour of systems (2)–(4) proposed in Section 2 is studied here. A general formal study to obtain the reproduction number and stability properties of equilibrium points is proposed and formally discussed [37]. In addition, epidemic dynamics on complex networks has been studied with the methods of the mathematical models and computational methods [38, 39, 40]. Based on these studies, the equilibrium and the basic reproduction number of system (2)–(4) are analysed.


### 3.1. Bot-Free Equilibrium of SIIR Model

Bot-free equilibrium means that the malware becomes extinct, system (2) can be rewritten as follows:(5)dSdt=pμN−μSt−βStI1t+I2t,dI1dt=βStI1t+I2t−ρ+μI1t,dI2dt=ρI1t−μ+γI2t.LetI1t=I2t=0, the bot-free equilibrium (BFE) E∗S∗,I1∗,I2∗ can be obtained, that is, S∗=pN, I1∗=I2∗=0. Therefore, we can obtain the following theorem.Theorem 1.
BFEE∗ of system (2) is locally asymptotically stable when R0<1 and unstable when R0>1, where(6)R0=pβNμ+γ+ρρ+μμ+γ=βS∗μ+γ+ρρ+μμ+γ.Proof.
The characteristic equation of system (5) can be written as follows:(7)detλ+μβS∗βS∗0λ−βS∗+ρ+μ−βS∗0ρλ+μ+γ=0.
Equation (5) has one negative real part characteristic root λ=−μ and roots of λ+μλ2+cλ+d=0, where(8)c=ρ+2μ+γ−βS∗,d=ρ+μμ+γ−βS∗μ+γ+ρ.
Obviously, whenR0<1, d is positive and μ+γ>βS∗μ+γ+ρ/ρ+μ.
Thus,c=ρ+2μ+γ−βS∗>u+r−βS∗>0 and d>0. According to the Routh-Hurwitz criteria, the bot-free equilibrium point E∗S∗,I1∗,I2∗ is stable if and only if all of the characteristic values are negative. Hence the BFE E∗ of system (5) is locally asymptotically stable when R0<1 and unstable when R0>1.


### 3.2. Bot-Free Equilibrium of SIIQR Model

LetN=St+I1t+I2t+Qt+Rt in system (3), therefore system (3) can be rewritten as follows:(9)dSdt=pμN−μSt−βStI1t+I2t,dI1dt=βStI1t+I2t−ρ+μI1t,dI2dt=ρI1t−σ+γ+μI2t,dQdt=σI2t−μ+δQt.IfI1t=I2t=0, the bot-free equilibrium (BFE) E∗S∗,I1∗,I2∗,Q∗ can be obtained, that is S∗=pN, I1∗=I2∗==Q∗=0.Theorem 2.
BFEE∗ of system (9) is locally asymptotically stable when R0<1 and unstable when R0>1.(10)R0=pβNμ+γ+σ+ρρ+μμ+γ+σ=βS∗μ+γ+σ+ρρ+μμ+γ+σ.Proof.
The characteristic equation of system (9) can be written as follows:(11)detλ+μβS∗βS∗00λ−βS∗+ρ+μ−βS∗00−ρλ+μ+γ+σ000σλ+μ+δ=0.
Equation (11) has two negative real part characteristic roots λ1=−μ,λ2=−μ+δ and roots of λ+μλ2+cλ+dλ+μ+δ=0, where(12)c=ρ+2μ+γ+σ−βS∗,d=ρ+μμ+γ+σ−βS∗μ+γ+σ+ρ.
Obviously, whenR0<1, μ+ρ>βS∗μ+γ+ρ+σ/μ+γ+σ>βS∗ and the polynomial d is positive. Thus, d>0 and c=ρ+2μ+γ−βS∗>u+ρ−βS∗>0. According to the Routh-Hurwitz criteria, the bot-free equilibrium point E∗ (S∗,I1∗,I2∗,Q∗) is stable if and only if all the characteristic values are negative. Then, the BFE E∗ of system (9) is locally asymptotically stable when R0<1 and unstable when R0>1.


### 3.3. Bot-Free Equilibrium of SIIQPR Model

Similar with the two models above, SIIQPR model has a bot-free equilibrium. LetN=St+I1t+I2t+Qt+Pt+Rt in system (9), then system (9) can be rewritten as follows:(13)dSdt=pμN−μ+α1St−βStI1t+I2t,dPdt=α1St+α2I1t−ω+μt,dI1dt=βStI1t+I2t−α2+ρ+μI1t,dI2dt=ρI1t−σ+γ+μI2t,dQdt=σI2t−μ+δQt.Similarly, letI1t=I2t=0 the bot-free equilibrium (BFE) E∗S∗,I1∗,I2∗,Q∗,P∗ can be obtained, that is S∗=pμN/μ+α1, I1∗=0, I2∗=0, Q∗=0, P∗=pμNα1/μ+ωα1+ω.Theorem 3.
BFEE∗ of system (13) is locally asymptotically stable when R0<1 and unstable when R0>1.(14)R0=βS∗μ+γ+σ+ρρ+μ+α2μ+γ+σ=pNμβμ+γ+σ+ρρ+μ+α2μ+γ+σμ+α1.Proof.
The characteristic equation of system (13) can be written as follows:(15)detλ+μ+α10βS∗βS∗0−α1λ+μ+ωα20000λ+α2+ρ+μ−βS∗βS∗000−ρλ+μ+γ+σ0000σλ+μ+δ=0.
Equation (15) has two negative real part characteristic roots λ1=−μ+α1, λ2=−μ+w, λ3=−μ+δ and roots of λ+μ+α1λ+μ+ωλ+μ+δλ2+cλ+d=0, where(16)c=ρ+2μ+γ+σ+α2−βS∗,d=ρ+α2+μμ+γ+σ−βS∗μ+γ+σ+ρ,
WhenR0<1, ρ+α2+μ>βS∗μ+γ+ρ+σ/μ+γ+σ>βS∗ and the polynomial d is positive. Thus, d>0 and c=ρ+α2+2μ+γ+σ−βS∗>ρ+α2+μ−βS∗>0. According to the Routh-Hurwitz criteria, the bot-free equilibrium point E∗S∗,I1∗,I2∗,Q∗,P∗ is stable if and only if all the characteristic values are negative, the BFE E∗ of system (13) is locally asymptotically stable when R0<1 and unstable when R0>1. Then, we analyse the global behaviours of the bot-free equilibrium. For system (13), the set(17)Ω≡y=y1,y2,…,yn∈R+n:0≤yi≤1,i=1,…,n,is positive invariant.
For allt > 0, yit≥0, where i=1,…,n, and the initial value y0∈Ω. Besides, there would exist k0∈1,…,n and t0 > 0, such that yk0t0=0. To ensure the generality, let yi=ii and t∗=inft>0,iit=0. It follows from system (13).(18)diit∗dt=βi0I1t∗>0.
However, the definition oft∗ yields dit∗/dt≤0, which leads to a contradiction. Then, based on Theorem 3.2 in the work of Zhao et al. [41], we derive the global stability of the disease-free equilibrium of system (13).Lemma 1.
For a constant differential autonomous system(19)dytdt=fy,wherey∈Rn and f:R+n⟶Rn is a continuous differential map. The following conditions are assumed.(1)
f is cooperative in R, that is, for ∀y∈R+n and i,j=1,2,…,n, if i≠j, then ∂fi/∂xj≥0. Meanwhile, Dfy=∂fi/∂xj1≤i,j≤n is irreducible for ∀y∈R+n;(2)
f(0) = 0 and for all y∈R+n, if yi = 0, then fiy≥0,i=1,2,…,n;Then, the following result is obtained:IfsDf0=maxReλ;detλ−Df0≤0, y = 0 is globally asymptotically stable in R+n.Theorem 4.
IfR0≤1, the disease-free equilibrium is globally asymptotically stable in Ω;Proof.
Obviously, the functionf:Ω⟶Rn is continuously differential and f(0) = 0, fiy≥0 for all y∈Ω with yi=0,i=1,2,…,n. In addition, ∂fi/∂yj≥0 for y∈Ω,i≠j. Thus, the function f is a cooperative system. Particularly, for all y∈Ω, Df=∂fi/∂yj1≤i,j≤n is irreducible; and for any ε∈0,1 and y∈Ω, fiεy≥εfiy with i=1,2,…,n. It implies that f is strictly sublinear in Ω. So the proof is completed by applying Lemma 1.


## 3.1. Bot-Free Equilibrium of SIIR Model

Bot-free equilibrium means that the malware becomes extinct, system (2) can be rewritten as follows:(5)dSdt=pμN−μSt−βStI1t+I2t,dI1dt=βStI1t+I2t−ρ+μI1t,dI2dt=ρI1t−μ+γI2t.LetI1t=I2t=0, the bot-free equilibrium (BFE) E∗S∗,I1∗,I2∗ can be obtained, that is, S∗=pN, I1∗=I2∗=0. Therefore, we can obtain the following theorem.Theorem 1.
BFEE∗ of system (2) is locally asymptotically stable when R0<1 and unstable when R0>1, where(6)R0=pβNμ+γ+ρρ+μμ+γ=βS∗μ+γ+ρρ+μμ+γ.Proof.
The characteristic equation of system (5) can be written as follows:(7)detλ+μβS∗βS∗0λ−βS∗+ρ+μ−βS∗0ρλ+μ+γ=0.
Equation (5) has one negative real part characteristic root λ=−μ and roots of λ+μλ2+cλ+d=0, where(8)c=ρ+2μ+γ−βS∗,d=ρ+μμ+γ−βS∗μ+γ+ρ.
Obviously, whenR0<1, d is positive and μ+γ>βS∗μ+γ+ρ/ρ+μ.
Thus,c=ρ+2μ+γ−βS∗>u+r−βS∗>0 and d>0. According to the Routh-Hurwitz criteria, the bot-free equilibrium point E∗S∗,I1∗,I2∗ is stable if and only if all of the characteristic values are negative. Hence the BFE E∗ of system (5) is locally asymptotically stable when R0<1 and unstable when R0>1.


## 3.2. Bot-Free Equilibrium of SIIQR Model

LetN=St+I1t+I2t+Qt+Rt in system (3), therefore system (3) can be rewritten as follows:(9)dSdt=pμN−μSt−βStI1t+I2t,dI1dt=βStI1t+I2t−ρ+μI1t,dI2dt=ρI1t−σ+γ+μI2t,dQdt=σI2t−μ+δQt.IfI1t=I2t=0, the bot-free equilibrium (BFE) E∗S∗,I1∗,I2∗,Q∗ can be obtained, that is S∗=pN, I1∗=I2∗==Q∗=0.Theorem 2.
BFEE∗ of system (9) is locally asymptotically stable when R0<1 and unstable when R0>1.(10)R0=pβNμ+γ+σ+ρρ+μμ+γ+σ=βS∗μ+γ+σ+ρρ+μμ+γ+σ.Proof.
The characteristic equation of system (9) can be written as follows:(11)detλ+μβS∗βS∗00λ−βS∗+ρ+μ−βS∗00−ρλ+μ+γ+σ000σλ+μ+δ=0.
Equation (11) has two negative real part characteristic roots λ1=−μ,λ2=−μ+δ and roots of λ+μλ2+cλ+dλ+μ+δ=0, where(12)c=ρ+2μ+γ+σ−βS∗,d=ρ+μμ+γ+σ−βS∗μ+γ+σ+ρ.
Obviously, whenR0<1, μ+ρ>βS∗μ+γ+ρ+σ/μ+γ+σ>βS∗ and the polynomial d is positive. Thus, d>0 and c=ρ+2μ+γ−βS∗>u+ρ−βS∗>0. According to the Routh-Hurwitz criteria, the bot-free equilibrium point E∗ (S∗,I1∗,I2∗,Q∗) is stable if and only if all the characteristic values are negative. Then, the BFE E∗ of system (9) is locally asymptotically stable when R0<1 and unstable when R0>1.


## 3.3. Bot-Free Equilibrium of SIIQPR Model

Similar with the two models above, SIIQPR model has a bot-free equilibrium. LetN=St+I1t+I2t+Qt+Pt+Rt in system (9), then system (9) can be rewritten as follows:(13)dSdt=pμN−μ+α1St−βStI1t+I2t,dPdt=α1St+α2I1t−ω+μt,dI1dt=βStI1t+I2t−α2+ρ+μI1t,dI2dt=ρI1t−σ+γ+μI2t,dQdt=σI2t−μ+δQt.Similarly, letI1t=I2t=0 the bot-free equilibrium (BFE) E∗S∗,I1∗,I2∗,Q∗,P∗ can be obtained, that is S∗=pμN/μ+α1, I1∗=0, I2∗=0, Q∗=0, P∗=pμNα1/μ+ωα1+ω.Theorem 3.
BFEE∗ of system (13) is locally asymptotically stable when R0<1 and unstable when R0>1.(14)R0=βS∗μ+γ+σ+ρρ+μ+α2μ+γ+σ=pNμβμ+γ+σ+ρρ+μ+α2μ+γ+σμ+α1.Proof.
The characteristic equation of system (13) can be written as follows:(15)detλ+μ+α10βS∗βS∗0−α1λ+μ+ωα20000λ+α2+ρ+μ−βS∗βS∗000−ρλ+μ+γ+σ0000σλ+μ+δ=0.
Equation (15) has two negative real part characteristic roots λ1=−μ+α1, λ2=−μ+w, λ3=−μ+δ and roots of λ+μ+α1λ+μ+ωλ+μ+δλ2+cλ+d=0, where(16)c=ρ+2μ+γ+σ+α2−βS∗,d=ρ+α2+μμ+γ+σ−βS∗μ+γ+σ+ρ,
WhenR0<1, ρ+α2+μ>βS∗μ+γ+ρ+σ/μ+γ+σ>βS∗ and the polynomial d is positive. Thus, d>0 and c=ρ+α2+2μ+γ+σ−βS∗>ρ+α2+μ−βS∗>0. According to the Routh-Hurwitz criteria, the bot-free equilibrium point E∗S∗,I1∗,I2∗,Q∗,P∗ is stable if and only if all the characteristic values are negative, the BFE E∗ of system (13) is locally asymptotically stable when R0<1 and unstable when R0>1. Then, we analyse the global behaviours of the bot-free equilibrium. For system (13), the set(17)Ω≡y=y1,y2,…,yn∈R+n:0≤yi≤1,i=1,…,n,is positive invariant.
For allt > 0, yit≥0, where i=1,…,n, and the initial value y0∈Ω. Besides, there would exist k0∈1,…,n and t0 > 0, such that yk0t0=0. To ensure the generality, let yi=ii and t∗=inft>0,iit=0. It follows from system (13).(18)diit∗dt=βi0I1t∗>0.
However, the definition oft∗ yields dit∗/dt≤0, which leads to a contradiction. Then, based on Theorem 3.2 in the work of Zhao et al. [41], we derive the global stability of the disease-free equilibrium of system (13).Lemma 1.
For a constant differential autonomous system(19)dytdt=fy,wherey∈Rn and f:R+n⟶Rn is a continuous differential map. The following conditions are assumed.(1)
f is cooperative in R, that is, for ∀y∈R+n and i,j=1,2,…,n, if i≠j, then ∂fi/∂xj≥0. Meanwhile, Dfy=∂fi/∂xj1≤i,j≤n is irreducible for ∀y∈R+n;(2)
f(0) = 0 and for all y∈R+n, if yi = 0, then fiy≥0,i=1,2,…,n;Then, the following result is obtained:IfsDf0=maxReλ;detλ−Df0≤0, y = 0 is globally asymptotically stable in R+n.Theorem 4.
IfR0≤1, the disease-free equilibrium is globally asymptotically stable in Ω;Proof.
Obviously, the functionf:Ω⟶Rn is continuously differential and f(0) = 0, fiy≥0 for all y∈Ω with yi=0,i=1,2,…,n. In addition, ∂fi/∂yj≥0 for y∈Ω,i≠j. Thus, the function f is a cooperative system. Particularly, for all y∈Ω, Df=∂fi/∂yj1≤i,j≤n is irreducible; and for any ε∈0,1 and y∈Ω, fiεy≥εfiy with i=1,2,…,n. It implies that f is strictly sublinear in Ω. So the proof is completed by applying Lemma 1.


## 4. Applications

In this section, numerical experiments of the models we proposed are conducted to verify our derivation, and some dynamical properties of our model are showed. In our experiments, the performance metrics is the equilibrium with differentR0, and simulation experiments can prove this from the dynamics of the system, the fit of the two curves (numerical curves and simulation curves) can confirm the reliability of the experiments. In addition, simulation results are presented to verify the actual behaviour in P2P botnet. It is worth noting that the birth rate and the death rate are considered in our experiments. To obtain the spread of worm in a large-scale network, the vulnerable population is assumed N = 1,000,000 in our experiments. In Table 1, the values of several parameters are listed, and these values are invariable in this paper.Table 1
Parameters for disease-free equilibrium.
ParameterValueN1000000β0.00000008μ0.0005p0.2γ0.06δ0.0000001σ0.008ω0.00000008


### 4.1. Performance of the SIIR Model

To validate the accuracy of obtained from SIIR model, the parameters for disease-free equilibrium are listed in Table1, and the following parameters are set: (a) ρ=0.003, where R0=4.79>1, and (b) ρ=0.023, where R0=0.93<1. The numerical and simulation results are shown in Figures 4 and 5, respectively.Figure 4
The numerical results of SIIR model. (a):R0>1. (b): R0<1.
(a)(b)Figure 5
The simulation results of SIIR model. (a):R0>1. (b): R0<1.
(a)(b)In Figure4(a), the number of the infected hosts is not zero when the system becomes stable, whereas the number of the infected hosts Figure 4(b) is zero. Thus, the correctness of the bot-free equilibrium of SIIR model is verified. When we take the actual situation into consideration, the basic reproduction number is usually larger than 1, which means the P2P botnets should be controlled by the corresponding containment strategies. In Figure 5, simulation results are presented to verify the actual behaviour of malware propagation in P2P botnet. The solid curves are numerical results and the imaginary curves are simulation results. It is obviously to find that the simulation curves match the numerical curves well. The small difference does not affect the validity of our results.


### 4.2. Performance of the SIIQR Model

For the SIIQR model,δ=0.0000001 is the transition rate from state Q to state R. σ=0.008 is the quarantine ratio that the stage-2-infected hosts are quarantined by the misuse detection system, and other parameters for disease-free equilibrium are listed in Table 1. To validate the accuracy of R0 obtained from SIIQR model, the following parameters are set: (a) ρ=0.003, where R0=4.73>1, (b) ρ=0.023, where R0=0.86<1, and other parameters are not changed. The numerical and simulation results are shown in Figures 6 and 7, respectively.Figure 6
The numerical results of SIIQR model. (a):R0>1. (b): R0<1.
(a)(b)Figure 7
The simulation results of SIIQR model. (a):R0>1. (b): R0<1.
(a)(b)In Figure6, the bot-free and endemic equilibrium is showed, and Theorem 2 is verified as well, namely BFE E∗ of the system is locally asymptotically stable when R0<1 and unstable when R0>1. In Figure 7, simulation results are presented to verify the actual behaviour of malware propagation. The same as Figure 4, the solid curves are numerical results and the imaginary curves are simulation results. Similarly, the simulation curves match the numerical curves well.


### 4.3. Performance of the SIIQPR Model

In this subsection, (a):α1=0.0006, α2=0.00001, ρ=0.003, the basic reproduction number R0>1, (b): α1=0.0015, α2=0.0035, ρ=0.023 the basic reproduction number R0>1. α1 and α2 are the temporarily patching rates by virtual patching strategy, respectively. And ω=0.00000005 is the rate that the P hosts turn into state R patched by the real patching, other parameters for disease-free equilibrium are listed in Table 1. Under the above parameters, numerical and simulation experiments on the SIIPQR model is conducted and the results are shown in Figures 8 and 9.Figure 8
The numerical results of SIIQPR model. (a):R0>1. (b): R0<1.
(a)(b)Figure 9
The simulation results of SIIQPR model. (a):R0>1. (b): R0<1.
(a)(b)Figure8 shows the results of the numerical curves including bot-free and endemic equilibrium. Figure 9 shows a tiny distinction between the simulation and numerical experiments. The effect of the virtual patching strategy is verified. The good matches between the simulation and numerical experiments verify that the SIIQPR model can describe the P2P botnets well. And the result shows that the virtual patching strategy can effectively control the P2P botnets.In order to appraise the effectiveness of the virtual patching strategy, comparisons have been made among the three models, SIIR model, SIIQR model, and SIIQPR model. The tendencies of worm propagation from three models are shown in Figure10.Figure 10
Comparison of infected hosts of three models.All the infected hosts in the three models will die out for the reason that their basic reproduction numbers areR0<1. In Figure 10, solid curves are the number of I1 hosts, and the dashed curves are the number of I2 hosts. Blue, red, and green curves represent SIIR, SIIQR, and SIIQPR models, respectively. The number of infected hosts can show the effect of the models. As Figure 10 shows, the number of infected hosts in SIIQPR model (green lines) is the minimum. So the SIIQPR is the best one. Comparing SIIR model with SIIQR model, Figure 9 shows that the number of I2 hosts only drop a little while the number of I1 hosts almost changes just a little. It demonstrates that one and only quarantine strategy is not effective to inhibit worms propagation. After adopting both the virtual patching and quarantine strategy, the number of I1 hosts and I2 hosts is effectively controlled. The excellent effect SIIQPR model is demonstrated. In addition, the parameters ρ and α1 is analysed based on the SIIQPR model.WhenR0>1, the parameter ρ is set ρ=0.002, ρ=0.003, and ρ=0.004. Figure 11 shows the comparison of the infected hosts with different parameter ρ in the SIIQPR model. Similar with Figure 9, the number of I1 and I2 hosts are compared. It is obviously to find that the number of I1 hosts is fewer with larger parameter ρ. And the I2 hosts is opposite of this. Because of the range of hosts’ number, the difference is not showed very clearly.Figure 11
Comparison of infected hosts with different parameterρ in SIIQPR model.WhenR0<1, the parameter α1 is set α1=0.0015, α1=0.0025, and α1=0.0035. Figure 12 shows the comparison of the infected hosts with different parameter α1 in the SIIQPR model. It is obviously that the number of I1 and I2 hosts is lower with larger parameter α1. It demonstrates that larger parameters ρ and α1 can control the number of infected hosts more effectively. In addition, the influence of deploying rate of virtual patching α2 and quarantine rate σ are discussed in Figures 13 and 14, respectively. As we see, the difference of the curves with different α2 and σ is not very prominent. This illustrates that controlling the deploying rate of virtual patching α1 and infected rate ρ is more efficient to suppress the P2P botnet.Figure 12
Comparison of infected hosts with different parameterα1 in SIIQPR model.Figure 13
Comparison with different deploying rate of virtual patchingα2 in SIIQPR model.Figure 14
Comparison of infected hosts with different quarantine rateσ in SIIQPR model.It is easy to confirm that SIIQPR model works better in Figure15. When the system reach bot-free equilibrium, the number of infected hosts in SIR model is much larger than that in SIIQPR model. Based on the experiment results and analysis above, the virtual patching strategy is effective on protecting the susceptible hosts and the constant quarantine strategy is not sufficient in controlling the worm propagation. Our models can describe the dynamic behaviour of P2P botnets accurately.Figure 15
Comparison of infected hosts between SIIQPR model and SIR model.


## 4.1. Performance of the SIIR Model

To validate the accuracy of obtained from SIIR model, the parameters for disease-free equilibrium are listed in Table1, and the following parameters are set: (a) ρ=0.003, where R0=4.79>1, and (b) ρ=0.023, where R0=0.93<1. The numerical and simulation results are shown in Figures 4 and 5, respectively.Figure 4
The numerical results of SIIR model. (a):R0>1. (b): R0<1.
(a)(b)Figure 5
The simulation results of SIIR model. (a):R0>1. (b): R0<1.
(a)(b)In Figure4(a), the number of the infected hosts is not zero when the system becomes stable, whereas the number of the infected hosts Figure 4(b) is zero. Thus, the correctness of the bot-free equilibrium of SIIR model is verified. When we take the actual situation into consideration, the basic reproduction number is usually larger than 1, which means the P2P botnets should be controlled by the corresponding containment strategies. In Figure 5, simulation results are presented to verify the actual behaviour of malware propagation in P2P botnet. The solid curves are numerical results and the imaginary curves are simulation results. It is obviously to find that the simulation curves match the numerical curves well. The small difference does not affect the validity of our results.


## 4.2. Performance of the SIIQR Model

For the SIIQR model,δ=0.0000001 is the transition rate from state Q to state R. σ=0.008 is the quarantine ratio that the stage-2-infected hosts are quarantined by the misuse detection system, and other parameters for disease-free equilibrium are listed in Table 1. To validate the accuracy of R0 obtained from SIIQR model, the following parameters are set: (a) ρ=0.003, where R0=4.73>1, (b) ρ=0.023, where R0=0.86<1, and other parameters are not changed. The numerical and simulation results are shown in Figures 6 and 7, respectively.Figure 6
The numerical results of SIIQR model. (a):R0>1. (b): R0<1.
(a)(b)Figure 7
The simulation results of SIIQR model. (a):R0>1. (b): R0<1.
(a)(b)In Figure6, the bot-free and endemic equilibrium is showed, and Theorem 2 is verified as well, namely BFE E∗ of the system is locally asymptotically stable when R0<1 and unstable when R0>1. In Figure 7, simulation results are presented to verify the actual behaviour of malware propagation. The same as Figure 4, the solid curves are numerical results and the imaginary curves are simulation results. Similarly, the simulation curves match the numerical curves well.


## 4.3. Performance of the SIIQPR Model

In this subsection, (a):α1=0.0006, α2=0.00001, ρ=0.003, the basic reproduction number R0>1, (b): α1=0.0015, α2=0.0035, ρ=0.023 the basic reproduction number R0>1. α1 and α2 are the temporarily patching rates by virtual patching strategy, respectively. And ω=0.00000005 is the rate that the P hosts turn into state R patched by the real patching, other parameters for disease-free equilibrium are listed in Table 1. Under the above parameters, numerical and simulation experiments on the SIIPQR model is conducted and the results are shown in Figures 8 and 9.Figure 8
The numerical results of SIIQPR model. (a):R0>1. (b): R0<1.
(a)(b)Figure 9
The simulation results of SIIQPR model. (a):R0>1. (b): R0<1.
(a)(b)Figure8 shows the results of the numerical curves including bot-free and endemic equilibrium. Figure 9 shows a tiny distinction between the simulation and numerical experiments. The effect of the virtual patching strategy is verified. The good matches between the simulation and numerical experiments verify that the SIIQPR model can describe the P2P botnets well. And the result shows that the virtual patching strategy can effectively control the P2P botnets.In order to appraise the effectiveness of the virtual patching strategy, comparisons have been made among the three models, SIIR model, SIIQR model, and SIIQPR model. The tendencies of worm propagation from three models are shown in Figure10.Figure 10
Comparison of infected hosts of three models.All the infected hosts in the three models will die out for the reason that their basic reproduction numbers areR0<1. In Figure 10, solid curves are the number of I1 hosts, and the dashed curves are the number of I2 hosts. Blue, red, and green curves represent SIIR, SIIQR, and SIIQPR models, respectively. The number of infected hosts can show the effect of the models. As Figure 10 shows, the number of infected hosts in SIIQPR model (green lines) is the minimum. So the SIIQPR is the best one. Comparing SIIR model with SIIQR model, Figure 9 shows that the number of I2 hosts only drop a little while the number of I1 hosts almost changes just a little. It demonstrates that one and only quarantine strategy is not effective to inhibit worms propagation. After adopting both the virtual patching and quarantine strategy, the number of I1 hosts and I2 hosts is effectively controlled. The excellent effect SIIQPR model is demonstrated. In addition, the parameters ρ and α1 is analysed based on the SIIQPR model.WhenR0>1, the parameter ρ is set ρ=0.002, ρ=0.003, and ρ=0.004. Figure 11 shows the comparison of the infected hosts with different parameter ρ in the SIIQPR model. Similar with Figure 9, the number of I1 and I2 hosts are compared. It is obviously to find that the number of I1 hosts is fewer with larger parameter ρ. And the I2 hosts is opposite of this. Because of the range of hosts’ number, the difference is not showed very clearly.Figure 11
Comparison of infected hosts with different parameterρ in SIIQPR model.WhenR0<1, the parameter α1 is set α1=0.0015, α1=0.0025, and α1=0.0035. Figure 12 shows the comparison of the infected hosts with different parameter α1 in the SIIQPR model. It is obviously that the number of I1 and I2 hosts is lower with larger parameter α1. It demonstrates that larger parameters ρ and α1 can control the number of infected hosts more effectively. In addition, the influence of deploying rate of virtual patching α2 and quarantine rate σ are discussed in Figures 13 and 14, respectively. As we see, the difference of the curves with different α2 and σ is not very prominent. This illustrates that controlling the deploying rate of virtual patching α1 and infected rate ρ is more efficient to suppress the P2P botnet.Figure 12
Comparison of infected hosts with different parameterα1 in SIIQPR model.Figure 13
Comparison with different deploying rate of virtual patchingα2 in SIIQPR model.Figure 14
Comparison of infected hosts with different quarantine rateσ in SIIQPR model.It is easy to confirm that SIIQPR model works better in Figure15. When the system reach bot-free equilibrium, the number of infected hosts in SIR model is much larger than that in SIIQPR model. Based on the experiment results and analysis above, the virtual patching strategy is effective on protecting the susceptible hosts and the constant quarantine strategy is not sufficient in controlling the worm propagation. Our models can describe the dynamic behaviour of P2P botnets accurately.Figure 15
Comparison of infected hosts between SIIQPR model and SIR model.


## 5. Conclusion

P2P botnets have attracted considerable attention. The containment strategy of the propagation of P2P botnets is an important topic. The virtual patching strategy and quarantine strategy are effective measures to ensure network security. This paper explores two novel dynamical models to examine the different containment strategies impacting on the propagation of the P2P botnets. The first is SIIQR model which describes the dynamical behaviour of P2P botnets under quarantine strategy. The second is the SIIQPR model which describes the dynamical behaviour of P2P botnets under quarantine strategy and virtual patching. Through the detailed mathematical analysis, the stability of equilibrium is investigated and the basic reproduction number is obtained, which governs whether or not P2P botnets are extinct. Numerical and simulation experiments show the dynamics of the models, and the birth rate and the death rate are considered in the experiments. Furthermore, the effect of virtual patching is showed and the influence of parametersρ, σ, α1, and α2 is analysed as well in SIIQPR model, and we find that controlling the deploying rate of virtual patching α1 and infected rate ρ is more efficient to suppress the P2P botnet. In a word, the analysis and experiment results verify that the virtual patching strategy and quarantine strategy can effectively contain the propagation of the P2P botnets. This paper provides a new insight to the containment strategy of P2P botnets.



---

*Source: 2851677-2022-10-29.xml*