# An Impulse Dynamic Model for Computer Worms

Authors: Chunming Zhang; Yun Zhao; Yingjiang Wu
Journal: Abstract and Applied Analysis
 (2013)

---

## Abstract

A worm spread model concerning impulsive control strategy is proposed and analyzed. We prove that there exists a globally attractive virus-free periodic solution when the vaccination rate is larger thanθ1. Moreover, we show that the system is uniformly persistent if the vaccination rate is less than θ1. Some numerical simulations are also given to illustrate our main results.


---

## Body

## 1. Introduction

Computer virus is a kind of computer program that can replicate itself and spread from one computer to others including viruses, worms, and trojan horses. Worms use system vulnerability to search and attack computers. As hardware and software technologies develop and computer networks become an essential tool for daily life, worms start to be a major threat. In June 2010, the Belarusian security firm Virus Block Ada discovered deadly Stuxnet worm. The Stuxnet worm is the first known example of a cyber-weapon that is designed not just to steal and manipulate data but to attack a processing system and cause physical damage. The Stuxnet worm is the first cyber-attack of its kind and has infected thousands of computer systems worldwide.Consequently, the trial on better understanding the worm propagation dynamics is an important matter for improving the safety and reliability in computer systems and networks. Similar to the biological viruses, there are two ways to study this problem: microscopic and macroscopic. Following a macroscopic approach, since [1, 2] took the first step towards modeling the spread behavior of worms, much effort has been done in the area of developing a mathematical model for the worms propagation [3–13]. These models provide a reasonable qualitative understanding of the conditions under which viruses spread much faster than others and why.In [7], the authors investigated a differential SEIR model by making the following assumptions (Figure 1).Figure 1
Original model.A population sizeN(t), that is, the total nodes at any time t in the computer network, is partitioned into subclasses of nodes which are susceptible, exposed (infected but not yet infectious), infectious, and recovered with sizes denoted by S(t), E(t), I(t), and R(t), respectively.One has(1)N(t)=S(t)+E(t)+I(t)+R(t),S′(t)=b-λIS-pbE-qbI-dS+ζR,E′(t)=λIS+pbE+qbI-εE-dE,I′(t)=εE-γI-dI-ηI,R′(t)=γI-ζR-dR,
where b, d, and λ are positive constants and ε, η, γ, ζ are nonnegative constants. The constant b is the recruitment rate of susceptible nodes to the computer network, d is the per capita natural mortality rate (i.e., the crashing of nodes due to the reason other than the attack of worms), ε is the rate constant for nodes leaving the exposed class E for infective class I, γ is the rate constant for nodes leaving the infective class I for recovered class R, η is the disease related death rate (i.e., crashing of nodes due to the attack of worms) in the class I, and ζ is the rate constant for nodes becoming susceptible again after recovering.In theSEIRS model, the flow is from class S to class E, class E to class I, class I to class R, and again class R to class S. For the vertical transformation, we assume that a fraction p and a fraction q of the new nodes from the exposed and the infectious classes, respectively, are introduced into the exposed class E. Consequently, the birth flux into the exposed class is given by pbE+qbI, and the birth flux into the susceptible class is given by b-pbE-qbI.As we know, antivirus software is a kind of computer program which can detect and eliminate known worm. There are two common methods to detect worms: using a list of worm signature definition and using a heuristic algorithm to find worm based on common behaviors. It has been observed that it does not always work in detecting a novel worm by using the heuristic algorithm. On the other hand, obviously, it is impossible for antivirus software to find a new worm signature definition on the dated list. So, to keep the antivirus software in high efficiency, it is important to ensure that it is updated. Based on the previous facts, we propose an impulsive system to model the process of periodic installing or updating antivirus software on susceptible computers at fixed time for controlling the spread of worm.Based on the previous facts, we propose the following assumptions:(H1)
the antivirus software is installed or updated at timet=kτ(k∈N), where τ is the period of the impulsive effect;
(H2)
S computers are successfully vaccinated from S class to R class with rate  (0<θ<1).According to the previous assumptions (H1)-(H2) and for the reason of simplicity, we propose the following model (Figure 2):
(2)S′(t)=b-λIS-pbE-qbI-dS+ζR,E′(t)=λIS+pbE+qbI-εE-dE,I′(t)=εE-γI-dI-ηI,R′(t)=γI-ζR-dR,t≠kτ,k∈Z+,S(t+)=(1-θ)S(t),E(t+)=E(t),I(t+)=I(t),R(t+)=R(t)+θS(t),t=kτ,k∈Z+.
The total population size N(t) can be determined by N(t)=S(t)+E(t)+I(t)+R(t) to form the differential equation
(3)N′(t)=b-dN(t)-ηI(t),
which is derived by adding the equations in system (1). Thus the total population size N may vary in time. From (2), we have
(4)b-(d+η)N(t)≤N′(t)≤b-dN(t).
It follows that
(5)b(d+η)≤limx→∞infN(t)≤limx→∞supN(t)≤bd.Figure 2
Impulse model.The system (2) can be reduced to the equivalent system
(6)S′(t)=b-λIS-pbE-qbI-dS+ζ(N-S-E-I),E′(t)=λIS+pbE+qbI-εE-dE,I′(t)=εE-γI-dI-ηI,N′(t)=b-dN(t)-ηI(t),t≠kτ,k∈Z+,S(t+)=(1-θ)S(t),E(t+)=E(t),I(t+)=I(t),N(t+)=N(t).t=kτ,k∈Z+,The initial conditions for (6) are
(7)S(0+)>0,E(0+)>0,I(0+)>0,N(0+)>0.
From physical considerations, we discuss system (6) in the closed set
(8)Ω={(S,E,I,N)∈R+4∣0≤S+E+I≤bd,0≤N≤bd}.The organization of this paper is as follows. In Section2, we establish sufficient condition for the local and global attractivity of virus-free periodic solution. The sufficient condition for the permanence of the model is obtained in Section 3. Some numerical simulations are performed in Section 4. In the final section, a brief conclusion is given, and some future research directions are also pointed out.


## 2. Global Attractivity of Virus-Free Periodic Solution

To prove our main results, we state three lemmas which will be essential to our proofs.Lemma 1 (see [14]).
Consider the following impulsive differential equations:(9)u˙(t)=a-bu(t),t≠kτ,u(t+)=(1-θ)u(t),t=kτ,
where a>0, b>0, and 0<θ<1. Then system (9) has a unique positive periodic solution
(10)u-e(t)=ab+(u*-ab)e-b(t-kτ),kτ<t≤(k+1)τ,
which is globally asymptotically stable; there u*=a(1-θ)(1-e-bτ)/b(1-(1-θ)e-bτ).IfI(t)≡0, we have the following limit systems:
(11)S′(t)=b-λIS-pbE-qbI-dS+ζ(N-S-E),E′(t)=pbE-εE-dE,N′(t)=b-dN,t≠kτ,k∈Z+,S(t+)=(1-θ)S(t),E(t+)=E(t),N(t+)=N(t).t=kτ,k∈Z+,
When pb-d-ε<0, there exists t1 when t>t1, limt→∞E(t)=0. From the third and sixth equations of system (11), we have limt→∞N(t)=b/d. We have the following limit systems:
(12)dSdt=(1-p)b+vbμ-(μ+v)S,t≠kT,k∈Z+,S(t+)=(1-θ)S(t),t=kT.
According to Lemma 1, we know that periodic solution of system (12) is of the form
(13)S-e(t)=(μ(1-p)+v)bμ(μ+v)+(S*-(μ(1-p)+v)bμ(μ+v))e-(μ+v)(t-kτ),kτ<t≤(k+1)τ,
and it is globally asymptotically stable, where S*=((1-p)b+(vb/μ))(1-θ)(e(μ+v)τ-1)/(μ+v)(e(μ+v)τ-1+θ).Theorem 2.
Let(S(t),E(t),I(t),N(t)) be any solution of system (6) with initial values S(0+)>0, E(0+)>0, I(0+)>0, and N(0+)>0; then (S-e(t),0,0,b/d) is locally asymptotically stable, provided that pb-d-ε<0 and R0<1, where
(14)R0=1(d+ε-pb)(γ+d+η)τ-εqbτ×ελbd[τ+θ(1-e(ζ+d)τ)(ζ+d)(e(ζ+d)τ-1+θ)].Proof.
The local stability of virus-free periodic solution may be determined by considering the behaviors of a small amplitude perturbation of the solution. Definew(t)=S(t)-S-e(t), x(t)=E(t), y(t)=I(t), and z(t)=N(t)-b/d, and then the linearized system of system (6) reads as
(15)w′(t)=-(d+ζ)w(t)-(pb+ζ)x(t)-(λS-e(t)+ζ+qb)y(t)+ζz(t),x′(t)=(pb-d-ε)x(t)+(qb+λS-e(t))y(t),y′(t)=εx(t)-(r+d+η)y(t),z′(t)=-ηy(t)-dz(t),t≠kτ,k∈Z+,w(t+)=w(t),x(t+)=x(t),y(t+)=y(t),z(t+)=z(t).t=kτ,k∈Z+,Let Φ(t) be the fundamental solution matrix of system (15), and then Φ(t) must satisfy
(16)dΦ(t)dt=(-d-ζ-pb-ζ-λS-e(t)-ζ-qbζ0pb-d-εqb+λS-e(t)00ε-r-d-η000-η-d)Φ(t)=˙AΦ(t),
and Φ(0)=I, the identity matrix. We can easily see that two eigenvalues of the matrix A are -d-ζ and -d, and the other two eigenvalues are determined by the 2 × 2 matrix B=(pb-d-εqb+λS-e(t)ε-r-d-η). Denote the eigenvalues of B as λ1, λ2, and then as pb-d-ε<0, we have λ1+λ2=pb-d-ε-r-d-η<0,
(17)λ1λ2=(pb-d-ε)(-r-d-η)-ε(qb+λS-e(t)).
Therefore, by the Floquet theorem [15], (S-e(t),0,0,b/d) is locally asymptotically stable, provided that
(18)G=∫0τ[(pb-d-ε)(-γ-d-η)-ε(qb+λS-e(t))]dt=(pb-d-ε)(-γ-d-η)τ-εqbτ-ελbd[τ+θ(1-e(ζ+d)τ)(ζ+d)(e(ζ+d)τ-1+θ)]>0.
When R0=(1/((d+ε-pb)(γ+d+η)τ-εqbτ))ελ(b/d)[τ+θ(1-e(ζ+d)τ)/(ζ+d)(e(ζ+d)τ-1+θ)]≤1, the previous inequality is satisfied for pb-d-ε<0.
The proof is complete.Theorem 3.
IfR1≤1, and pb-d-ε<0 then (S-e(t),0,0,b/d) is globally asymptotically stable for system (11), where
(19)R1=1(d+ε-pb)(γ+d+η)τ-εqbτελbτd×[1-θ(e(ζ+d)τ-1+θ)].Proof.
Becauseex-1>x, for x>0, we have
(20)R0<R1.
By Theorem 2, we know that (S-e(t),0,0,b/d) is locally asymptotically stable. In the following, we will prove the global attraction of (S-e(t),0,0,b/d).
Let(21)L=εE-(pb-ε-d)I.
Then
(22)L′=εE′-(pb-ε-d)I′,L′=[ελS+εqb+(pb+ε-d)(r+d+η)]I.
Therefore, (S-e(t),0,0,b/d) is globally asymptotically stable, provided that
(23)L′=∫0τ[ελS+εqb+(pb+ε-d)(r+d+η)]Idt<0,L′=∫0τ[ελS+εqb+(pb+ε-d)(r+d+η)]dt<[εqb+(pb+ε-d)(r+d+η)]τ+ελbd(1-θe(d+ζ)τ-1+θ)τ<0.
When R1=(1/((d+ε-pb)(γ+d+η)τ-εqbτ))ελ(bτ/d)[1-θ/(e(ζ+d)τ-1+θ)]≤1, the previous inequality is satisfied.
The proof is complete.Corollary 4.
The virus-free periodic solution(S-e(t),0,0,b/d) of system (6) is globally attractive, if θ>θ1, where θ1=1-e(ζ+d)τ+εbλ(e(ζ+d)τ-1)/d[(d+ε-pb)(r+d+η)-εqb].Theorem2 determines the global attractivity of (6) in Ω for the case R0<1. Its realistic implication is that the infected computers vanish, so the worms are removed from the network. Corollary 4 implies that the computer virus will disappear if the vaccination rate is less than θ1.


## 3. Permanence

In this section, we say that the worm is local if the infected population persists above a certain positive level for sufficiently large time. The local of worm can be well captured and studied through the notion of permanence.Definition 5.
System (6) is said to be uniformly persistent if there is an φ>0 (independent of the initial data) such that every solution (S(t),I(t),R(t),N(t)) with initial conditions (8) of system (6) satisfies
(24)limt→∞infS(t)≥φ,limt→∞infI(t)≥φ,limt→∞infR(t)≥φ,limt→∞infN(t)≥φ.Theorem 6.
Suppose thatR1>1 and pb-d-ε<0. Then there is a positive constant mI such that each positive solution (S(t),E(t),I(t),R(t)) of system (6) satisfies I(t)≥mI, for t large enough.Proof.
Now, we will prove that there existmI>0 and a sufficiently large tp such that I(t)≥mI holds for all t>tp. Suppose that I(t)<I* for all t>t0. From the forth equation of (6), we have
(25)b-dN(t)>N′(t)>b-dN(t)-ηI*,bd>N(t)>b-ηI*d.
From the second equation of (6), we have
(26)E′(t)=λIS+pbE+qbI-εE-dE<λI*S+qbI*+(pb-ε-d)E<λI*bd+qbI*+(pb-ε-d)E.
As pb-d-ε<0,
(27)E(t)<(qb+λ)bI*d(ε+d-pb).
From the first equation of (6), we have
(28)S′(t)=b-λIS-pbE-qbI-dS+ζ(N-S-E-I)>b+ζb-ηI*d-qbI*-ζI*-(pb+ζ)(qb+λ)bI*d(ε+d-pb)-(λI*+d+ζ)S(t).
Consider the following comparison system:
(29)v′(t)=b+ζb-ηI*d-qbI*-ζI*-(pb+ζ)(qb+λ)bI*d(ε+d-pb)-(λI*+d+ζ)v(t),t≠kτ,v(t+)=(1-θ)v(t),t=kτ,v(0+)=S(0+).
let A=˙b+ζ((b-ηI*)/d)-qbI*-ζI*-(pb+ζ)((qb+λ)bI*/d(ε+d-pb)), B=˙λI*+d+ζ.
By Lemma1, we know that there exists t1>t0 such that
(30)v-(t)=AB+(v*-AB)e-B(t-kτ),kτ<t≤(k+1)τ,v*=A(1-θ)(1-e-Bτ)B(1-(1-θ)e-Bτ),S(t)>v-(t)=˙S*>0,fort>t1.
From the second equation of (6), we have
(31)E′(t)=λIS+pbE+qbI-εE-dE>λI*S*+qbI*-(ε+d-pb)E,E(t)>λI*S*+qbI*ε+d-pb.
From the third equation of (6); we have
(32)I′(t)=εE-γI-dI-ηI>ελI*S*+qbI*ε+d-pb-(γ+d+η)I.
Note that R1>1, we have
(33)I(t)>εγ+d+ηλI*S*+qbI*ε+d-pb>I*.
This contradicts I(t)≤I*. Hence, we can claim that for any t0>0, it is impossible that
(34)I(t)<I*∀t≥t0.
By the claim, we are left to consider two cases. First, I(t)≥I* for t large enough. Second, I(t) oscillates about I* for t large enough. Obviously, there is nothing to prove for the first case. For the second case, we can choose t2>t1, and ξ>0 satisfy
(35)I(t2)=I(t2+ξ)=I*,fort2<t<t2+ξ.I(t) is uniformly continuous since the positive solutions of (6) are ultimately bounded, and I(t) is not affected by impulses.
Therefore, it is certain that there exists aη (0<η<τ, and η is independent of the choice of t2) such that
(36)I(t)≥I*2,fort2≤t≤t2+η.
In this case, we consider the following three possible cases in term of the sizes of η, ξ, and τ.
Case 1. If ξ≤η<τ, then it is obvious that I(t)≥I*/2, for t∈[t2,t2+ξ].
Case 2. If η<ξ≤τ, then from the second equation of system (6), we obtain I˙(t)>-(d+γ+η)I(t).
SinceI(t2)=I*, it is obvious that I(t)>I*e-(d+γ+η)τ=˙I**, for t∈[t2,t2+ξ].
Case 3. If η<τ≤ξ, it is easy to obtain that I(t)>I** for t∈[t2,t2+τ]. Then, proceeding exactly as the proof for the previous claim, we have that I(t)>I** for t∈[t2+τ,t2+ξ].
Owing to the randomicity oft2, we can obtain that there exists mI=˙min{I*/2,I**} such I(t)>mI holds for all t>tp.
The proof of Theorem6 is completed.Theorem 7.
SupposeR1>1. Then system (6) is permanent.Proof.
Let(S(t),E(t),I(t),N(t)) be any solution of system (6). First, from the first equation of system (6), we have
(37)S′(t)>b-pb2-qb2-(d+λb)S.
Consider the following comparison system:
(38)z˙1(t)=b-pb2-qb2-(d+λb)z1(t),t≠kτ,z1(t+)=(1-θ)z1(t),t=kτ.
By Lemma 1, we know that for any sufficiently small ε>0, there exists a t1 (t1 is sufficiently large) such that
(39)S(t)≥z1(t)>z1*(t)-ε≥(1-pb-qb)b(e(d+λb)τ-1)(d+λb)(e(d+λb)τ-1+θ)-ε=˙mS>0,kτ<t≤(k+1)τ.
From (31), we have
(40)E(t)>λmImS+qbmIε+d-pb-ε=˙mE.
From the third equation of (6), we have
(41)N˙(t)>b-μN(t)-αN(t).
It is easy to see that
(42)N(t)>bμ+α-ε=˙mN.
We let Ω0={(S,I,N)∈R+3∣mS≤S, mI≤I, mN≤N≤b/μ, S+I≤b/μ}. By Theorem 6 and the previous discussions, we know that the set Ω0 is a global attractor in Ω, and of course, every solution of system (6) with initial conditions (8) will eventually enter and remain in region Ω0. Therefore, system (6) is permanent.
The proof of Theorem7 is completed.Corollary 8.
It follows from Theorem6 that the system (6) is uniformly persistent, provided that θ<θ1, where θ1=1-e(ζ+d)τ+εbλ(e(ζ+d)τ-1)/d[(d+ε-pb)(r+d+η)-εqb].


## 4. Numerical Simulations

In this section we have performed some numerical simulations to show the geometric impression of our results.To demonstrate the global attractivity of virus-free periodic solution of system (6), we take following set parameter values: b=2.1, λ=0.2, p=0.1, q=0.15, d=0.3, ζ=0.6, ε=0.4, γ=0.6, τ=0.5, η=0.3, and θ=0.4. In this case, we have R0=0.6886<1. In Figures 3(a), 3(b), 3(c), and 3(d), we have displayed, respectively, the susceptible, exposed, infected and recovered population of system (6) with initial conditions: S(0)=6, E(0)=1, I(0)=1, and R(0)=8.Global attractivity of virus-free periodic solution of system.
(a)
(b)
(c)
(d)To demonstrate the permanence of system (6), we take the following set parameter values: b=2.7, λ=0.2, p=0.1, q=0.15, d=0.3, ζ=0.6, ε=0.4, γ=0.6, τ=0.5, η=0.3 and θ=0.1. In this case, we have R1=1.6496>1. In Figures 4(a), 4(b), 4(c), and 4(d), we have displayed, respectively, the susceptible, exposed, infected, and recovered populations of system (6) with initial conditions: S(0)=6, E(0)=1, I(0)=1 and R(0)=8.Permanence of system.
(a)
(b)
(c)
(d)


## 5. Conclusion

We have analyzed theSEIRS model with pulse vaccination and varying total population size. We have shown that R1>1 or θ<θ1 implies that the worm will be local, whereas R1<1 or θ>θ1 implies that the worm will fade out. We have also established sufficient condition for the permanence of the model. Our results indicate that a large pulse vaccination rate will lead to eradication of the worm.



---

*Source: 286209-2013-06-25.xml*