# Hopf Bifurcation in an SEIDQV Worm Propagation Model with Quarantine Strategy

Authors: Yu Yao; Wenlong Xiang; Andong Qu; Ge Yu; Fuxiang Gao
Journal: Discrete Dynamics in Nature and Society
 (2012)

---

## Abstract

Worms exploiting zero-day vulnerabilities have drawn significant attention owing to their enormous threats to the Internet. In general, users may immunize their computers with countermeasures in exposed and infectious state, which may take a period of time. Through theoretical analysis, time delay may lead to Hopf bifurcation phenomenon so that the worm propagation system will be unstable and uncontrollable. In view of the above factors, a quarantine strategy is thus proposed in the study. In real network, unknown worms and worm variants may lead to great risks, which misuse detection system fails to detect. However, anomaly detection is of help in detecting these kinds of worm. Consequently, our proposed quarantine strategy is built on the basis of anomaly intrusion detection system. Numerical experiments show that the quarantine strategy can diminish the infectious hosts sharply. In addition, the thresholdτ0 is much larger after using our quarantine strategy, which implies that people have more time to remove worms so that the system is easier to be stable and controllable without Hopf bifurcation. Finally, simulation results match numerical ones well, which fully supports our analysis.


---

## Body

## 1. Introduction

In recent years, with the rapid development of computer technologies and network applications, Internet has become a powerful mechanism for propagating malicious software programs.Systems running on network computers become more vulnerable to digital threats. In particular,worms that exploit zero-day vulnerabilities have brought severe threats to Internet security. To a certain extent, the propagation of worms in a system of interacting computers could be compared with infectious diseases in a population. Anderson and May discussed the spreading nature of biological viruses, parasites and so forth.leading to infectious diseases in human population through several epidemic models [1, 2]. The action of worms throughout a network can be studied by using epidemiological models for disease propagation [3–8]. Mishra and Saini [4] present a SEIRS model with latent and temporary immune periods, which can reveal common worm propagation. Dong et al. propose a computer virus model with time delay based on an SEIR model and regard time delay as bifurcating parameter to study the dynamical behaviors which include local asymptotical stability and local Hopf bifurcation [9]. Ren et al. give a novel computer virus propagation model and study its dynamic behaviors [10]. L.-X. Yang and X. Yang also investigates the propagation behavior of virus programs provided infected computers are connected to the Internet with positive probability [11]. Gan et al. examine the propagation behavior of computer virus under human intervention [12]. The use of a quarantine strategy has produced a tremendous effect on controlling disease. Inspired by this, quarantine strategy is also widely used in worm containment [13–18]. Based on the two-factor model, Zou et al. proposes a worm propagation model under dynamic quarantine defense [15]. Wang et al. proposes a novel epidemic model, which combines both vaccinations and dynamic quarantine methods, referred to as SEIQV model [18].However, previous studies have failed to consider the appropriate quarantine strategy to eliminate the negative effect of time delay, which may lead to Hopf bifurcation phenomenon so that the worm propagation system will be unstable and uncontrollable. In this paper, time delay is introduced in a worm propagation model. Users may immunize their computers with countermeasures in exposed and infectious state, which may take a period of time. Through theoretical analysis, it is proved that the system is stable when time delay is less than the thresholdτ0 and Hopf bifurcation appears when time delay is equal to or greater than the threshold. Moreover, unknown worms and worm-variants may lead to great risks. In order to make up the deficiency of vaccination strategy and eliminate the negative effect of time delay, a quarantine strategy is thus proposed in our study. The current quarantine strategy generally depends on the intrusion detection system, which can be classified into two categories: misuse and anomaly intrusion detection. While misuse detection system fails to detect unknown worms and worm-variants, anomaly detection is of help in detecting these kinds of worm. Consequently, our proposed quarantine strategy is on the basis of anomaly intrusion detection system. According to the above descriptions, we present an SEIDQV worm propagation model to study the behaviors of worm propagation in the real world. Then, the stability of the positive equilibrium and the critical value of Hopf bifurcation are studied. By analysis, the quarantine strategy can diminish the infectious hosts sharply. Moreover, the threshold τ0 is much larger after using our quarantine strategy, which implies that people have more time to remove worms so that the system is easier to be stable and controllable without Hopf bifurcation.The rest of the paper is organized as follows. Section2 provides an SEIDQV worm propagation model. In Section 3, we analyze the stability of the positive equilibrium and the threshold of Hopf bifurcation. Section 4 describes the numerical analysis of our model. In Section 5, we present simulation experiments based on slammer worm. The simulation results match well with numerical ones. Finally, Section 6 gives the conclusions.


## 2. Model Formulation

Considering worms exploiting zero-day vulnerabilities, none of effective and reliable safety patches could immunize the hosts.Susceptible hosts first go through a latent period (exposed) after infection before becoming infectious [9]. People may immunize their computers with countermeasures in exposed and infectious hosts, which may take a period of time. Since time delay exists, infectious hosts go through a temporary state (delayed) after vaccination before becoming vaccinated. What is more, unknown worms and worm-variants may lead to great risks. To our knowledge, quarantine strategies have produced a tremendous effect on controlling disease. Enlightened by this, quarantine strategies are also widely used in worm containment. In order to make up the deficiency of vaccination strategy and eliminate the negative effect of time delay, a quarantine strategy is thus proposed in the study. The current quarantine strategy generally depends on the intrusion detection system, which can be classified into two categories: misuse and anomaly intrusion detection. On one hand, misuse intrusion detection system, which constructs a database with the feather of known attack behaviors, can recognize invaders once their behaviors agree with one of the databases. Although the system can accurately detect known worms, it fails to detect unknown worms and worm variants. On the other hand, an attack can be detected by the anomaly detection system as long as its behavior differs from any database consisting of normal behaviors, which is of help in detecting unknown worms and worm variants. Consequently, our proposed quarantine strategy is on the basis of anomaly intrusion detection system. Meanwhile, anomaly detection system is accompanied by false-positive rates. The quarantine is implemented as follows: the infectious, exposed and susceptible hosts are detected by the anomaly intrusion detection system. The advantage of this strategy lies in detecting unknown worms and worm variants effectively. As anomaly detection system is accompanied by false-positive rates, the quarantine strategy adds two transitions as a result of the influence of the anomaly detection method. The false-positive rates of exposed and susceptible hosts detected by the anomaly detection method are set θ2 and θ3, respectively.According to the descriptions above, we give an SEIDQV worm propagation model with quarantine strategy. Assume all hosts are in one of six states: Susceptible state (S), Exposed state (E), Infectious state (I), Delayed state (D), Quarantined state (Q), and Vaccinated state (V). Let S(t) denote the number of susceptible hosts at time t, E(t) denote the number of exposed hosts at time t,I(t) denote the number of infectious hosts at time t, D(t) denote the number of delayed hosts at time t, Q(t) denote the number of quarantined hosts at time t, and V(t) denote the number of vaccinated hosts at time t. β is the infection rate at which susceptible hosts are infected by infectious hosts, and γ is the rate of removal of infectious for circulation. μ is the rate that vaccinated hosts become susceptible. Time delay is denoted by τ. More parameters are listed in Table 1. The states and state transition diagram of the SEIDQV model are given in Figure 1.Table 1
Notations in this paper.
Notation
Explanation
N
Total number of hosts in the network
S
(
t
)
Number of susceptible hosts at timet
E
(
t
)
Number of exposed hosts at timet
I
(
t
)
Number of infectious hosts at timet
D
(
t
)
Number of delayed hosts at timet
Q
(
t
)
Number of quarantined hosts at timet
V
(
t
)
Number of vaccinated hosts at timet
β
Infection rate
α
The rate at which exposed hosts become infectious
γ
Removal rate of infectious hosts
μ
The rate at which vaccinated hosts become susceptible
ν
The rate at which exposed hosts are vaccinated or treated
δ
Removal rate of quarantined hosts
θ
1
θ
2
θ
3
Quarantine rate of infectious, exposed, and susceptible hosts
τ
Time delay of detecting and removing wormsFigure 1
The states and state transitions in SEIDQV model.In order to understand clearly, we list in Table1 some frequently used notations in this paper.From the above definitions in the paper, we write down the complete differential equations of the SEIDQV model:(2.1)dS(t)dt=-βS(t)I(t)-θ3S(t)+μV(t),dE(t)dt=βS(t)I(t)-αE(t)-θ2E(t)-νE(t-τ),dI(t)dt=αE(t)-γI(t)-θ1I(t),dD(t)dt=γI(t)-γI(t-τ),dQ(t)dt=θ1I(t)+θ2E(t)+θ3S(t)-δQ(t),dV(t)dt=νE(t-τ)+γI(t-τ)+δQ(t)-μV(t).As mentioned above, the population size is setN, which is set to unity
(2.2)S(t)+E(t)+I(t)+D(t)+Q(t)+V(t)=N.


## 3. Stability of the Positive Equilibrium and Bifurcation Analysis

Theorem 3.1.
The system has a unique positive equilibriumE*(S*,E*,I*,D*,Q*,V*) when it satisfies the following condition:
(3.1)(H1)αβμδN(μδ+μθ3+δθ3)(γ+θ1)(α+θ2+ν)>1,whereS*=(γ+θ1)(α+θ2+ν)αβ,E*=(γ+θ1)αI*,D*=0,Q*=αθ1+θ2(γ+θ1)αδI*+θ3δS*,V*=νμE*+γμI*+δμQ*.Proof.
For system (2.1), if all the derivatives on the left of equal sign of the system are set to 0, which implies that the system becomes stable, we can derive
(3.2)S=(γ+θ1)(α+θ2+ν)αβ,E=(γ+θ1)αI*,D=0,Q=αθ1+θ2(γ+θ1)αδI*+θ3δS*,V=νμE*+γμI*+δμQ*.
Substituting the value of each variable in (3.2) for each of (2.2), then we can derive
(3.3)S*+(γ+θ1)αI*+I*+αθ1+θ2(γ+θ1)αδI*+θ3δS*+νμ(γ+θ1)αI*+γμI*+δμQ*=N.
Obviously, if(H1) is satisfied, (3.3) has one unique positive root I*, and there is one unique positive equilibrium E*(S*,E*,I*,D*,Q*,V*) of system (2.1). The proof is completed.According to (2.2), Q(t)=N-S(t)-E(t)-I(t)-D(t)-V(t), thus system (2.1) can be simplified to
(3.4)dS(t)dt=-βS(t)I(t)-θ3S(t)+μV(t),dE(t)dt=βS(t)I(t)-αE(t)-θ2E(t)-νE(t-τ),dI(t)dt=αE(t)-γI(t)-θ1I(t),dD(t)dt=γI(t)-γI(t-τ),dV(t)dt=νE(t-τ)+γI(t-τ)+δ(N-S(t)-E(t)-I(t)-D(t)-V(t))-μV(t).The Jacobi matrix of  (3.4) about E*(S*,E*,I*,D*,V*) is given by
(3.5)J(E*)=(-βI*-θ30-βS*0μβI*-α-θ2-νe-λτβS*000α-γ-θ10000γ-γe-λτ00-δνe-λτ-δγe-λτ-δ-δ-δ-μ).
The characteristic equation of that matrix can be obtained by
(3.6)P(λ)+Q(λ)e-λτ=0,P(λ)=λ5+p4λ4+p3λ3+p2λ2+p1λ+p0,Q(λ)=q4λ4+q3λ3+q2λ2+q1λ+q0,
where
(3.7)p4=βI*+α+δ+μ+γ+θ1+θ2+θ3,p3=(α+γ+θ1+θ2)(δ+μ+βI*+θ3)+(βI*+θ3)(δ+μ)-(γ+θ1)ν,p2=(βI*+θ3)(α+γ+θ1+θ2)(μ+δ)+(γ+θ1)(αβI*+θ2βI*-δν-μν-θ3ν)+δμβI*,p1=(γ+θ1)(δ+μ)((α+θ2)βI*-θ3ν)+(α+γ+θ1)δμβI*,p0=δαμγβI*,q4=ν,q3=ν(δ+μ+βI*+γ+θ1+θ3),q2=ν[(βI*+θ3)(δ+μ)+(γ+θ1)(βI*+θ3+δ+μ)-μβI*],q1=(γ+θ1)(βI*+θ3)(δ+μ)ν-(αγ+γν+θ1ν)δμβI*,q0=-δαμγβI*.Theorem 3.2.
The positive equilibriumE* is locally asymptotically stable without time delay, if the following holds:
(3.8)(H2)p4+q4>0,d1>0,(p2+q2)d1-(p1+q1)(p4+q4)2>0,p1+q1>0.Proof.
Ifτ=0, (3.6) reduces to
(3.9)λ4+(p4+q4)λ3+(p3+q3)λ2+(p2+q2)λ+(p1+q1)=0.
According to Routh-Hurwitz criterion, all the roots of (3.9) have negative real parts. Therefore, it can be deduced that the positive equilibrium E* is locally asymptotically stable without time delay. The proof is completed.Obviously,λ=iω(ω>0) is a root of (3.6). After separating the real and imaginary parts, it can be written as
(3.10)p4ω4-p2ω2+p0+(q4ω4-q2ω2+q0)cos(ωτ)+(q1ω-q3ω3)sin(ωτ)=0,ω5-p3ω3+p1ω-(q4ω4-q2ω2+q0)sin(ωτ)+(q1ω-q3ω3)cos(ωτ)=0,
which implies
(3.11)ω8+D3ω6+D2ω4+D1ω2+D0=0,
where
(3.12)D3=p42-q42-2p3,D2=p32-q32-2p2p4+2q2q4+2p1,D1=p22-q22+2p0p4-2q0q4-2p1p3+2q1q3,D0=p12-q12-2p0p2+2q0q2.Letz=ω2, (3.11) can be written as
(3.13)h(z)=z4+D3z3+D2z2+D1z+D0
Yang et al. [19] obtained the following results on the distribution of roots of (3.13). Denote
(3.14)m=12D2-316D32,n=132D33-18D3D2+D1,Δ=(n2)2+(m3)3,σ=-1+3i2,y1=-n2+Δ3+-n2-Δ3,y2=-n2+Δ3σ+-n2-Δ3σ2,y3=-n2+Δ3σ2+-n2-Δ3σ,zi=yi-3D34(i=1,2,3).Lemma 3.3.
For the polynomial equation (3.13)(1)
ifD0<0, then (3.13) has at least one positive root.(2)
ifD0≥0 and Δ≥0, then (3.13) has positive roots if and only if z1>0 and h(z1)<0,(3)
ifD0≥0 and Δ<0, then (3.13) has positive roots if and only if there exists at least one z*∈(z1,z2,z3), such z*>0 and h(z*)≤0.Lemma 3.4.
Suppose that(H2)p4+q4>0,d1>0,(p2+q2)d1-(p1+q1)(p4+q4)2>0,p1+q1>0 is satisfied.(1)
If one of following holds: (a)D0<0; (b) D0≥0,Δ≥0,z1>0 and h(z1)<0; (c) D0≥0,Δ<0, and there exists at least z*∈(z1,z2,z3) such that z*>0 and h(z*)≤0, then all roots of (3.6) have negative real parts when τ∈[0,τ0), τ0 is a certain positive constant.(2)
If the conditions (a)–(c) are not satisfied, then all roots of (3.6) have negative real parts for all τ≥0.Proof.
Whenτ=0, (3.6) can be reduced to
(3.15)λ4+(p4+q4)λ3+(p3+q3)λ2+(p2+q2)λ+(p1+q1)=0.
By the Routh-Hurwitz criterion,all roots of (3.9) have negative real parts and only if  p4+q4>0,d1>0,(p2+q2)d1-(p1+q1)(p4+q4)2>0,p1+q1>0.
From Lemma3.3, it can be known that if (a)–(c) are not satisfied, then (3.6) has no roots with zero real part for all τ≥0; if one of (a)–(c) holds, when τ≥τk(j)(k=1,2,3,4,j≥1), (3.6) has no roots with zero real part and τ0 is the minimum value of τ, so (3.6) has purely imaginary roots. According to [20], one obtains the conclusion of the lemma.
When conditions (a)–(c) of Lemma3.4 are not satisfied, h(z) always has no positive root. Therefore, under these conditions, (3.6) has no purely imaginary roots for any τ>0, which implies that the positive equilibrium E*(S*,E*,I*,D*,Q*,V*) of system (2.1) is absolutely stable. Therefore, the following theorem on the stability of positive equilibrium E*(S*,E*,I*,D*,Q*,V*) can be easily obtained.Theorem 3.5.
Assume that(H1) and (H2) are satisfied, (a) D0≥0,Δ≥0,z1<0 or h(z1)>0; (b) D0≥0,Δ<0, and there is no z*∈(z1,z2,z3), such that  z*>0 and h(z*)≤0. Then the positive equilibrium E*(S*,E*,I*,D*,Q*,V*) of system (2.1) is absolutely stable. Namely, E*(S*,E*,I*,D*,Q*,V*) is asymptotically stable for any time delay τ≥0.Assume that the coefficients inh(z) satisfy the condition as follows:(
H
3
) (a) D0≥0,Δ≥0,z1<0or h(z1)>0; (b) D0≥0,Δ<0, and there is no z*∈(z1,z2,z3), such that z*>0 and h(z*)≤0.According to the previous lemma,it is proved that (3.13) has at least a positive root ω0, namely, the characteristic equation (3.6) has a pair of purely imaginary roots ±iω0.In view of the fact that (3.6) has a pair of purely imaginary roots ±iω0, the corresponding τk>0 is given by eliminating sin(ωτ) in (3.10):
(3.16)τk=1ω0arccos[(p2ω02-p4ω04-p0)(q4ω04-q2ω02+q0)+(ω05-p3ω03+p1ω0)(q3ω03-q1ω0)(q4ω04-q2ω02+q0)2+(q3ω03-q1ω0)2]+2kπω0(k=0,1,2,…).
Let λ(τ)=v(τ)+iω(τ) be the root of (3.6), so that v(τk)=0 and ω(τk)=ω0 are satisfied when τ=τk.Lemma 3.6.
Supposeh′(z0)≠0. If τ=τ0, then ±iω0 is a pair of purely imaginary roots of (3.6). In addition, if the conditions in Lemma 3.4(1) are satisfied, then
(3.17)d(Reλ)dτ|τ=τk>0.This signifies that it exists at least one eigenvalue with positive real part forτ>τk. Differentiating both sides of (3.6) with respect to τ, it can be written as:
(3.18)(dλdτ)-1=(5λ4+4p4λ3+3p3λ2+2p2λ+p1)(q4λ4+q3λ3+q2λ2+q1λ+q0)λe-λτ+(4q4λ3+3q3λ2+2q2λ+q1)e-λτ(q4λ4+q3λ3+q2λ2+q1λ+q0)λe-λτ-(q4λ4+q3λ3+q2λ2+q1λ+q0)τe-λτ(q4λ4+q3λ3+q2λ2+q1λ+q0)λe-λτ=(5λ4+4p4λ3+3p3λ2+2p2λ+p1)eλτ(q4λ4+q3λ3+q2λ2+q1λ+q0)λ+(4q4λ3+3q3λ2+2q2λ+q1)(q4λ4+q3λ3+q2λ2+q1λ+q0)λ-τλ.
Therefore,
(3.19)sgn[dReλdτ]τ=τk=sgn[Re(dλdτ)-1]λ=iω0=sgn[Re((5λ4+4p4λ3+3p3λ2+2p2λ+p1)eλτ(q4λ4+q3λ3+q2λ2+q1λ+q0)λ+(4q4λ3+3q3λ2+2q2λ+q1)(q4λ4+q3λ3+q2λ2+q1λ+q0)λ-τλ)]λ=iω0=sgnω02K{4ω06+3D3ω04+2D2ω02+D1}=sgn{h′(ω02)},
where K=(q3ω04-q1ω02)2+(q4ω05-q2ω03+q0ω0)2, then it follows the hypothesis (H3) that h′(ω02)≠0.Hence,(3.20)d(Reλ)dτ|τ=τk>0.
The root of characteristic equation (3.6) crosses from left to right on the imaginary axis as τ continuously varies from a value less than τk to one greater than τk according to Routh’s theorem. Therefore, according to Hopf bifurcation theorem for functional differential equations, the transverse condition holds and the conditions for Hopf bifurcation are satisfied at τ=τk. Then the following result can be obtained.Theorem 3.7.
Suppose that the conditions(H1) and (H2) are satisfied.(1)
The equilibriumE*(S*,E*,I*,D*,Q*,V*) is locally asymptotically stable when τ∈[0,τ0), but unstable when τ>τ0.(2)
If condition(H3) is satisfied, the system will undergo a Hopf bifurcation at the positive equilibrium E*(S*,E*,I*,D*,Q*,V*) when τ=τk(k=0,1,2,…) where τk is defined by (3.16).This implies that when time delayτ<τ0, the system will stabilize at its infection equilibrium point, which is beneficial for us to implement a containment strategy; when time delay τ>τ0, the system will be unstable and worms cannot be effectively controlled.


## 4. Numerical Analysis

In order to simulate the real behavior of the spread of a worm, the parameters in the experiments are practical values. The slammer worm is selected for experiments. 750,000 hosts are picked as the population size, and the worm’s average scan rate is 3300 per second. The worm infection rate can be calculated asα=ηN/232=0.5763. It means that average 0.5763 hosts of all the hosts can be scanned by one host. The infection rate is β=3300/232=0.00000077, the recovery rate of infectious hosts is set γ=0.19, the quarantine rates of infectious, exposed and susceptible hosts are set θ1=0.15, θ2=0.0002, θ3=0.00002315. Other parameters are set μ=0.031, α=0.45, ν=0.0001, and δ=0.04. At the beginning, there are 50 infectious hosts, while others are susceptible. Figures 2–5 show that the propagation trend of the five kinds of host and comparison of infectious hosts before and after adopting quarantine strategy when τ<τ0 and τ>τ0.Figure 2
Propagation trend of the five kinds of host whenτ<τ0.Figure 3
Comparison of infectious hosts before and after adopting quarantine strategy ifτ<τ0.Figure 4
Propagation trend of the five kinds of host whenτ>τ0.Figure 5
Comparison of infectious hosts before and after adopting quarantine strategy ifτ>τ0.According to the above parameters, Figure2 shows the curves of five kinds of hosts when τ=5<τ0. All of the five kinds of hosts get stable quickly, which illustrates that E* is asymptotically stable. It implies that the number of infectious hosts maintain a relatively low value and can be predicted. Further strategies can be developed and utilized to eliminate worms. In Figure 3, when τ=5<τ0, the maximum of infectious hosts is diminished sharply. Finally, the number of infectious hosts is almost 18,000. It is much less than ones without using quarantine strategy. However, when time delay τ gets increased and then reached the threshold τ0, E* will lose its stability and a bifurcation will occur. Figure 4 shows the susceptible, exposed, infectious, quarantined, and vaccinated hosts when τ=100>τ0. In this figure, we can clearly see that the number of infectious hosts will outburst after a short period of peace and repeat again and again but not in the same period, which is hard for us to predict the worm spread or eliminate worms. In Figure 5, when τ=100>τ0, it is clearly that the maximum of infectious hosts is diminished sharply from 170,000 to 40,000, which illustrates that quarantine strategy has much better inhibition impact than single vaccination.In order to see the influence of time delay,τ is set to a different value each time with other parameters remaining the same. Figure 6 shows the number of infectious hosts in the same coordinate with time delay τ=5,τ=25,τ=75,andτ=100.Figure 6
The number of infectious hosts whenτ is changed in one coordinate.Initially, the four curves are overlapped which means that time delay has little effect in the initial stage of worm propagation. With the increase of time delay, the curve begins to oscillate. When time delay passes through the thresholdτ0, the infecting process gets unstable. Meanwhile, it can be discovered that the amplitude and period of the number infectious hosts increase.Figure7 shows the projection of the phase portrait of system (2.1) in (S,I,V)-space when τ=65,τ=80, respectively. In Figure 8, when τ=65, it is clear that the curve converges to a fixed point, which suggests that the system is stable. When τ=80, the curve converges to a limit circle, which implies that the system is unstable.The projection of the phase portrait of system (2.1) in (S,I,V)-space.
(a)
(b)The phase portrait of susceptible hostsS(t) and infectious hosts I(t).
(a)
(b)Figure9 shows bifurcation diagram with τ from 1 to 60; Hopf bifurcation will occur when τ=τ0=42. In Figure 10, it shows bifurcation diagram with τ from 1 to 120; Hopf bifurcation will occur when τ=τ0=74. The threshold is greater than model without quarantine strategy, which illustrates that the model gets stable easier and the users have more time to remove worms.Figure 9
Bifurcation diagram of system (2.1) with τ from 1 to 60 without quarantine strategy.Figure 10
Bifurcation diagram of system (2.1) with τ from 1 to 120 with quarantine strategy.


## 5. Simulation Experiments

The discrete-time simulation is an expanded version of Zou’s program simulating Code Red worm propagation. The system in our simulation experiment consists of 750,000 hosts that can reach each other directly, which is consistent with the numerical experiments. At the beginning of simulation, 50 hosts are randomly chosen to be infectious and the others are all susceptible. In the simulation experiments, the implement of transition rates of the model is based on probability. Under the propagation parameters of the slammer worm, several simulation experiments are carried out. Figure11 shows the comparisons between numerical and simulation curves of susceptible, infectious, quarantined and vaccinated hosts respectively, when τ=5<τ0, which indicate that the simulation curves match the numerical ones very well. When time delay passes the threshold, a bifurcation appears. Figure 12 shows the difference between simulation and numerical results of the four kinds of host when τ=100>τ0. In this figure, the periods of these two curves are well matched. But there is a difference in amplitudes. This mainly results from the precision of experiments. The number of hosts in numerical experiments can be either integers or decimals. However, in simulation experiments, the number of hosts must be integer. In addition, when the number of infectious hosts is very little, the tiny difference may result in a big gap.Comparisons between numerical and simulation curves of SEIDQV model whenτ<τ0.
(a)
(b)
(c)
(d)Comparisons between numerical and simulation curves of SEIDQV model whenτ>τ0.
(a)
(b)
(c)
(d)


## 6. Conclusions

By considering that time delay may lead to Hopf bifurcation phenomenon so that the worm propagation system will be unstable and uncontrollable, this paper proposes a quarantine strategy to control worm propagation. An SEIDQV worm propagation model is constructed for practical application. Then, the stability of the positive equilibrium and the critical value of Hopf bifurcation are studied. Through careful theoretical analysis, the following conclusions can be derived.(i)
The critical time delayτ0 where Hopf bifurcation appears is obtained
(6.1)τk=1ω0arccos[(p2ω02-p4ω04-p0)(q4ω04-q2ω02+q0)+(ω05-p3ω03+p1ω0)(q3ω03-q1ω0)(q4ω04-q2ω02+q0)2+(q3ω03-q1ω0)2]+2kπω0.(ii)
When time delayτ<τ0, the worm propagation system will stabilize at its infection equilibrium point, which is beneficial for us to implement a containment strategy to eliminate the worm completely.(iii)
When time delayτ≥τ0, Hopf bifurcation appears, which implies the system will be unstable and the worm cannot be effectively controlled.(iv)
The quarantine strategy can diminish the infectious hosts sharply. The thresholdτ0 is much larger after using the proposed quarantine strategy, which implies that people have more time to remove worms so that the system is easier to be stable and controllable without Hopf bifurcation.In order to control and predict the worm propagation, time delayτ should remain less than the threshold τ0 by decreasing the time of detecting and removing worm. In real world, various factors can affect worm propagation. The paper focuses on analyzing the influence of time delay. Other impact factors to worm propagation will be a major emphasis of our future research.



---

*Source: 304868-2012-11-28.xml*