# Impulsive Switching Epidemic Model with Benign Worm Defense and Quarantine Strategy

Authors: Jiying Lai; Shujing Gao; Yujiang Liu; Xinzhu Meng
Journal: Complexity
 (2020)

---

## Abstract

The issue on how to effectively control Internet malicious worms has been drawn significant attention owing to enormous threats to the Internet. Due to the rapid spreading of malicious worms, it is necessary to explore the integrated measures to automatically mitigate the propagation on the Internet. In this paper, a novel worm propagation model is established, which combines both impulsive quarantine and benign worm implementation. Then, sufficient conditions for the global stability of worm-free periodic solution and the permanence of the benign worm are obtained. Finally, the effects of quarantine strategy are assessed and some feasible strategies that can constrain the propagation of malicious worm are provided by numerical simulation.


---

## Body

## 1. Introduction

With the wide use of computer network, network security problem, such as illegal access, malicious worm attacks, and virus spread, has become more remarkable and complicated. Worm is a kind of malicious code, which can run automatically and self-replicate and spread via networks and usually does not require human interaction to propagate [1]. For example, the Code Red worm [2, 3] and Slammer worm [4] caused thousands of computers to be infected and made the finance and government suffering great loss. KoobFace worm [5] targeted mainly the users of networking websites like Facebook and Gmail; the user’s devices if once infected, their personal data, financial services information, and passwords may be revealed. Worm causes more damages than other network security threats owing to their rapid spread and wide influence. Therefore, it is a pressing issue to hamper Internet worm’s prevalence in a large-scale network.The technology of detection, recovery, and interdiction has been improved to some extent, with the development of a strategy that is used in scanning network worm propagation. In order to effectively control the propagation of malicious worm, more defenses should be developed to eliminate the worm and to immunize hosts before the worm attack. Since traditional prevention measures cannot effectively constrain worm propagation, the way of using benign worms to fight against worms has been becoming a new emergency response technology. The idea of benign worm is to transform a malicious worm into an antiworm which spreads itself using the same mechanism as the original worm and immunizes a host [6]. Antivirus softwares, firewalls, IDS (Intrusion Detection Systems), and IPS (Intrusion Prevention System) are generally static in nature and only prevent known attacks; therefore, they must be updated periodically to obtain defence against the worm attacks [6].Worm modeling can help us to better understand how worms spread and propagate and how to effectively prevent and mitigate the effects of worm attacks. According to the propagation mechanism of benign worms, many mathematical models have been proposed to analyze the transmission law and transmission trend of different worms in various real-life networks [1, 7–10]. Benign worm is widely applied to fight worm; Wang et al. [10] focused on the spread of worm in mobile environment and proposed a benign worm strategy. In [11], the authors proposed an e-SEIAR (Susceptible-Exposed-Infective-Antiworm-Recovered) model with benign worm defense and proved that the basic reproduction number determines whether the worm dies out completely. The numerical simulation illustrated that the number of neighbors of benign worms plays an important role in worm propagation.Moreover, in the computer field, worm quarantine is another prominent strategy in defending against worms and reliable for IDS whose performance directly affects the effectiveness of the quarantine [12–15]. Recently, the quarantine strategy has been applied to various worm propagation models [12, 16, 17]. In [16], an Internet worm propagation model with time delay in quarantine was proposed and theoretical analyzed. The results showed that decreasing the window size can guarantee stability of the worm propagation system. In [12], the authors put forward the pulse quarantine strategy and assumed that a host is detected by the anomaly detection system and then put into quarantine in a single pulse and applied every fixed units of time. They used an impulsive differential equation to describe worm propagation with the pulse quarantine strategy and illustrated that the pulse quarantine strategy has a better effect on worm containment and a higher application value in the field of worm prevention.As we all know, many people’s behaviors are varied with different time of a day, for example, people seldom send and receive e-mail in midnight or early in the morning. People’s habits of surfing online are in line with their living habits. This implies that the infection rates vary with time every day. Thus, it is necessary to consider that some coefficients of the model are time-varying and switching in time. In this paper, we mainly formulate a worm propagation model with impulsive quarantine and switching in time, study the dynamic behavior, and evaluate the control strategies.The rest of this paper is organized as follows. In Section2, the impulsive switching model with the interaction between malicious worm and benign worm is formulated. In Section 3, the threshold condition of the eradication of malicious and benign worms is obtained. The sufficient condition of persistence of the benign is examined in Section 4. Numerical simulations are carried out to illustrate the theoretical results and analyze the effects of system parameters on worm spreading in Section 5. Finally, a brief conclusion is given and future research is put forward in the last section.


## 2. Model Formulation

Similar to a biological virus, a computer worm spreads by sending self-replication across the network, exploiting vulnerabilities in programs on other computers. To develop appropriate ways for thwarting rapid spread of worms, many scholars are trying to understand the behavior of the worm propagation with the aid of epidemiological models. Based on the classical Kermack–McKendrick model [18], Chen and Wei [19] developed a worm propagation SIRS model with temporary immunity. Now, we assume R host has permanent immunity, and then the SIRS model yields to the SIR model, which is formed as follows:(1)dSdt=μ−βSI−μS,dIdt=βSI−ηI−μI,dRdt=ηI−μR,where St, It, and Rt represent the proportion of susceptible, infected, and recovered hosts in all hosts at time t, respectively. Susceptible hosts, with security vulnerabilities, can be infected by worms with an infection rate β>0. Some infectious hosts can be found and then manually patched at rate η>0. It is assumed in model (1) that the recruitment rate of new hosts is equal to the obsolescence rate, denoted by μ>0. Global stability of equilibria and control measures were investigated in [19]. Introduction of benign worms may effectively control worm propagation. In [20], the interaction between malicious worm and benign worm is studied. We take benign worm into consideration in model (1) and yield the following improved benign Worm-Antiworm propagation SIBR model.(2)dSdt=μ−β1SI−β2SB−μS,dIdt=β1SI−β1IB−β2IB−ηI−μI,dBdt=β2BS+I+β1IB−μB,dRdt=ηI−μR,where the total hosts are divided into four classes: susceptible, malicious infected, benign infected, and recovered denoted by S,I,B,R, respectively, β1>0 is the infection rate of malicious worm due to the successful scans of an malicious infected host, and β2>0 is the infection rate of benign worm due to the successful scans of benign hosts.Quarantine strategy is an effective worm defensive measure. However, the constant quarantine strategy has its disadvantages which are inevitable, such as the high demand on the patching rate of new hosts and its adoption of the imperfect misuse detection system [12]. Therefore, the pulse quarantine strategy is widely applied to constrain worm propagation. Based on the previous facts, we give the following assumptions:A1 The pulse quarantine strategy is applied at a discrete time t=tk, where impulsive times tk satisfy tk+1>tk>0 and limk⟶∞tk=∞A2 The susceptible and malicious infected hosts detected by the anomaly detection method are quarantined with the rate γk0≤γk≤1 at time tk.According to AssumptionsA1−A2, we establish the following impulsive worm propagation model with benign worm defense and the quarantine strategy (denoted by SIBR−Q worm model):(3)dSdt=μ−β1SI−β2SB−μS,dIdt=β1SI−β1IB−β2IB−ηI−μI,dBdt=β2BS+I+β1IB−μB,dRdt=ηI−μRt∈tk−1,tk,St+=1−γkSt,It+=1−γkIt,Bt+=Bt,Rt+=Rt+γkSt+It,t=tk.Furthermore, based on surfing habits, it is necessary to consider that some coefficients of model (3) are time-varying and switching in time. Suppose that some parameters are modeled as switching parameters and governed by a switching rule σt:tk−1,tk⟶1,2,⋯,m=P,k=1,2,⋯,m, where m is the number of the subsystems and σt is a piecewise continuous switching rule such that σt=ik∈P for all t∈tk−1,tk. Define the set of all switching rules by J. In order to better characterize the propagation of benign worm, this paper adopts an impulsive switching model with benign worm defense and quarantine strategy (denoted by SIBR−QW worm model):(4)dSdt=μσ−β1σSI−β2σSB−μσS,dIdt=β1σSI−β1σIB−β2σIB−ησI−μσI,dBdt=β2σBS+I+β1σIB−μσB,dRdt=ησI−μσR.t∈tk−1,tk,St+=1−γσSt,It+=1−γσIt,Bt+=Bt,Rt+=Rt+γσSt+It,t=tk.In fact, the anomaly detection method is periodically implemented and people’s surfing habit is always fixed. Consequently, for simplicity, we only consider the periodic switching rule. Following the idea of [21], we assume that the switching rule σ satisfies tk−tk−1=ωk with ωk+m=ωk, and then ω=∑k=1mωk is the period of switch σ. Assume that μik=μk, β1ik=β1k, β2ik=β2k, γik=γk, and mik=mk, for t∈tk−1,tk, and tk+m=tk+ω, μk+m=μk, β1,k+m=β1k, β2,k+m=β2k, and γk+m=γk. Define Jp as the set of periodic switching rule.Note that the variableR does not appear in the first three equations of system (4). This allows us to attack (4) by studying the subsystem with periodic switch:(5)dSdt=μk−β1kSI−β2kSB−μkS,dIdt=β1kSI−β1kIB−β2kIB−ηkI−μkI,dBdt=β2kBS+I+β1kIB−μkB.t∈tk−1,tk,St+=1−γkSt,It+=1−γkIt,Bt+=Bt,t=tk,with initial value St0+,It0+,Bt0+=St0,It0,Bt0∈D, where(6)D=S,I,B∈R+3S+I+B≤1.It is easy to obtain the nonnegativity and boundedness of system (5). The property will be used in the following results.Lemma 1.
All solutions of system (5) with nonnegative initial conditions are nonnegative for all t≥t0 and ultimately bounded.


## 3. Global Asymptotical Stability of Worm-free Periodic Solution

Following the idea of Lemma 2.2 in [22], we can obtain the result which is essential for the proof of the main results.Lemma 2.
Consider the following impulsive switching system:(7)dUdt=ak−bkU,t≠tk,k∈Z+,Ut+=1−γkUt,t=tk,k∈Z+,Ut0+=Ut0=U0,where ak>0,bk>0,0≤γk≤1 and tk+ω=tk+m,ak+m=ak,bk+m=bk,γk+m=γk. Then, there exists a unique positive periodic solution U∗t of system (7) which is globally asymptotically stable, where(8)U∗t=akbk+Unω+tk−1+−akbkexp−bkt−tk−1,for t∈nω+tk−1,nω+tk,n∈Z+,k=1,2,⋯,m, here(9)Unω+tk−1+=∑l=1k−1albl∏i=lk−11−γiexp∑j=1lbjtj−tj−1+∏i=1k−11−γiU0−∑l=1k−1albl∏i=lk−11−γiexp∑l−1j=1bjtj−tj−1exp−∑i=1k−1biti−ti−1,U0=∑l=1mal/bl∏i=lm1−γiexp∑j=1lbjtj−tj−1−∑l=1mal/bl∏i=lm1−γiexp∑j=1l−1bjtj−tj−1exp∑i=1mbiti−ti−1−∏i=1m1−γi.LetIt≡0,Bt≡0 for t≥t0. From system (5), we get the growth of susceptible hosts St satisfies(10)dSdt=μk−μkS,t≠tk,St+=1−γkSt,t=tk.According to Lemma2, we have that there is a worm-free periodic solution of system (5) x∗t=S∗t,0,0, where S∗t=U∗t as ak=bk=μk, U∗t is defined in (8).Define(11)R1=∑i=1mβ1i∫ti−1tiS∗τdτ∑i=1mηi+μiti−ti−1−∑i=1mln1−γi,R2=∑i=1mβ2i∫ti−1tiS∗τdτ∑i=1mμiti−ti−1,ℛ0=maxR1,R2.Theorem 1.
Ifℛ0<1, then the worm-free periodic solution x∗t of system (5) is globally attractive.Proof.
Sinceℛ0<1, we can choose ε>0 sufficiently small such that(12)Λ1≜exp∑i=1mβ1i∫ti−1tiS∗τ+εdτ−ηi+μiti−ti−1+ln1−γi<1,(13)Λ2≜exp∑i=1mβ2i∫ti−1tiS∗τ+εdτ+β1iε−μiti−ti−1<1.
It follows from the first equation of system (5) that dSt/dt≤μk−μkSt. Thus, we consider the comparison impulsive differential system:(14)dS˜dt=μk−μkS˜,t≠tk,S˜t+=1−γkS˜t,t=tk.
In view of Lemma2, we can easily obtain that there is a unique positive periodic solution of system (14) S˜∗t=S∗t, and S˜∗t is globally asymptotically stable.
LetSt,It,Bt be the solution of system (5) with initial value St0+,It0+,Bt0+∈D and St0+=S0>0, and S˜t be the solution of system (14) with initial value S˜t0+=S0. In view of the comparison theorem in impulsive differential equations [23, 24], there exists a positive integer n1 such that(15)St≤S∗t+ε,fort>n1ω.
Furthermore, it follows from the second equation of (5) and (15) that, for t∈nω+tk−1,nω+tk and n≥n1,(16)dIdt=β1kSI−β1kIB−β2kIB−ηkI−μkI≤β1kS∗t+ε−ηk−μkI.
Thus, fort∈nω+tk−1,nω+tk and n≥n1,(17)It≤Inω+tk−1+exp∫nω+tk−1tβ1kS∗τ+ε−ηk−μkdτ=1−γk−1Inω+tk−1exp∫nω+tk−1tβ1kS∗τ+ε−ηk−μkdτ.
By simple calculation, we can deduce that fort∈nω+tk−1,nω+tk and n≥n1.(18)It≤∏i=1k−11−γiInω+t0+exp∫nω+t0nω+t1β11S∗τ+ε−η1−μ1dτ+⋯+∫nω+tk−2nω+tk−1β1k−1S∗τ+ε−ηk−1−μk−1dτ+∫nω+tk−1tβ1kS∗τ+ε−ηk−μkdτ.
Especially, whent=n1+1ω+t0, we get(19)In1+1ω+t0+=In1ω+tm+=1−γmIn1ω+tm≤∏i=1m1−γiIn1ω+t0+exp∑i=1mβ1i∫ti−1tiS∗τ+εdτ−ηi+μiti−ti−1=In1ω+t0+exp∑i=1mβ1i∫ti−1tiS∗τ+εdτ−ηi+μiti−ti−1+ln1−γi=Λ1In1ω+t0+.
Thus, for any positive integerp, we have In1+pω+t0+≤Λ1pIn1ω+t0+. It follows from (12) that(20)In1+pω+t0+⟶0,asp⟶∞.
From (18) and (20), we have limt⟶∞It=0. Therefore, for abovementioned ε, there is a positive integer n2>n1, such that(21)It<ε,fort>n2ω.
It follows from the third equation of system (5), (15), and (21) that for t>n2ω(22)dBtdt=β2kBS+I+β1kIB−μkB≤β2kS∗t+2ε+β1kε−μkB.
SinceBt is not effected by impulses, we can get by directly computing(23)Bn2+1ω+t0=Bn2ω+tm≤Bn2ω+t0exp∑i=1mβ2i∫ti−1tiS∗τ+εdτ+β1iε−μiti−ti−1=Λ2Bn2ω+t0.
Thus, for any positive integerl, we have Bn+lω+t0≤Λ2lBnω+t0. (13) implies(24)Bn+lω+t0⟶0,asl⟶∞.
Consequently,limt⟶∞Bt=0. By the theory of asymptotically autonomous semiflows, we have that limt⟶+∞St,It,Bt=S∗t,0,0. Therefore, if ℛ0<1, the worm-free periodic solution x∗t=S∗t,0,0 is globally attractive. This completes the proof.
Consider the following general impulsive switching epidemic model with periodic environment:(25)x˙t=ℱkxt−Vkxt,t∈tk−1,tk,Xt+=hkxt,Yt+=gkxt,t=tk,k∈Z+,xt0+=x0,t0≥0.where x=x1,x2,⋯,xn, X=x1,x2,⋯,xm, Y=xm+1,xm+2,⋯,xn, hk=ψ1k,ψ2k,⋯,ψmk, and gk=ψm+1k,⋯,ψnk. Compartment x is split by two types with the first q compartments x1,x2,⋯,xm, the infected individuals, and xm+1,xm+2,⋯,xn, the uninfected individuals. ℱkx are the newly infected rates, Vk−x are the rates of transfer of individuals out of compartments, then Vkx=Vk−x−Vk+x represent the set transfer rates out of compartments, and ℱk+mxt=ℱkxt, Vk+mxt=Vkxt, hk+mxt=hkxt, and gk+mxt=gkxt for all k∈Z+. Let ρB be the spectral radius of matrix B. The following result can be seen in [25].Lemma 3.
Assume that Assumptions (H1)–(H7) hold. If ρΦFk/λ−VkPkω<1, then the disease-free periodic solution x∗t of system (25) is locally asymptotically stable, where the definition of matrix ΦFk/λ−VkPkω can be seen in Appendix A and Assumptions (H1)–(H7) are given in Appendix B.Theorem 2.
Ifℛ0<1, then the worm-free periodic solution x∗t of system (5) is locally asymptotically stable.Proof.
By Lemma3, we firstly want to verify Assumptions (H1)–(H7). For system (5), it is easy to obtain that(26)ℱk=β1kSIβ2kBS+I+β1kIB0,Vk=β1kIB+β2kIB+ηkI+μkIμkBβ1kSI+β2kSB+μkS−μk.
Obviously, Assumptions (H1)–(H5) hold. Then, we will show that Assumptions (H6) and (H7) hold.
By AppendixB and simple calculation, we can get Mk, Qk, Fk, Vk, and Pk of system (5), which are represented as the following form:(27)Mk=−μk,Qk=1−γk,(28)Fk=β1kS∗t00β2kS∗t,Vk=ηk+μk00μk,(29)Pk=1−γk001.
It follows from (27)–(29) and (A.2) (see Appendix A) that(30)ΦMkQkω=∏k=1mQm−k+1ΨMktm−k+1,tm−k=∏k=1m1−γkexp∑i=1m−μiti−ti−1,Φ−VkPkω=J100J2,here J1=∏k=1m1−γkexp∑i=1m−ηi+μiti−ti−1,J2=exp∑i=1m−μiti−ti−1.
Obviously,ρΦMkQkω<1 and ρΦ−VkPkω<1. Thus, for system (5), Assumptions (H6) and (H7) hold.
Next, we will show(31)ℛ0=ρΦFk−VkPkω.
From (28), (29), and (A.1), we have(32)ΦFk−VkPkω=∏k=1mPm−k+1ΨFk−Vktm−k+1,tm−k=R100R2,where R1 and R2 are defined in (11). Thus, ρΦFk−VkPkω=maxR1,R2=ℛ0.
According to Lemma3, we have that, if ρΦFk−VkPkω<1, that is, ℛ0<1, the worm-free periodic solution x∗t of system (5) is asymptotically stable. This completes the proof.
From Theorem1 and Theorem 2, we can easily obtain the following result.Theorem 3.
Ifℛ0<1, the worm-free periodic solution x∗t of system (5) is globally asymptotically stable.


## 4. Persistence of Benign Worm

In this section, we mainly obtain the sufficient condition for persistence of benign worm.LetS˜t be the positive periodic solution of the following system:(33)dydt=μk−β1k+β2kB∗+μky,t∈tk−1,tk,yt+=1−γkyt,t=tk,where B∗ is a fixed positive number. According to Lemma 2, we know that S˜t=U∗t as ak=μk,bk=β1k+β2kB∗+μk, and here U∗t is defined in (8).Denote(34)ℛ1=∑i=1mβ2i∫ti−1tiS˜τdτ∑i=1mμiti−ti−1.Theorem 4.
If there exists a positive numberB∗ such that ℛ1>1, then the benign worm is uniformly persistent; that is, there is a positive constant q, such that lim inft⟶∞Bt≥q.Proof.
LetSt,Bt,andIt be the solution of system (5) with initial value St0+,Bt0+,It0+∈D. It follows from ℛ1>1 that, for a given B∗, there exists sufficiently small ϵ>0 such that(35)∑i=1mβ2i∫ti−1tiS˜τ−ϵdτ−∑i=1mμiti−ti−1>0.
First, we prove the claim(36)lim supt⟶∞Bt>B∗.
Suppose that (36) does not hold. Thus, there exists a T1>0 such that Bt<B∗ for all t≥T1. From the first equation of (5) that for t>T1,(37)dSdt≥μk−β1k+β2kB∗+μkS,t∈tk−1,tk.
Consider the following comparison impulsive system fort>T1:(38)dydt=μk−β1k+β2kB∗+μky,t∈tk−1,tk,yt+=1−γkyt,t=tk.
By Lemma2, we have that system (38) has a unique positive periodic solution y∗t=S˜t, which is globally asymptotically stable. By comparison theorem for impulsive differential equations, we have that there exists a T2>T1 such that the following inequality holds for t>T2:(39)St>S˜t−ϵ.
Set(40)Bl=mint∈T2,T2+ωBt.
We will show thatBt≥Bl for all t>T2. Suppose the contrary. Then, there is a T∗ such that Bt≥Bl for T2≤t≤T2+ω+T∗ and BT2+ω+T∗=Bl. However, it follows from the third equation of system (5) and (39) that(41)dBdt≥β2kS˜t−ϵ−μkB,fort∈tk−1,tk,tk−1>T2.
From (35), we can yield(42)Bl=BT2+ω+T∗=BT2+T∗exp∑i=1mβ2i∫ti−1tiS˜τ−ϵdτ−∑i=1mμiti−ti−1>Bl.
This is a contradiction. Thus,Bt>Bl for all t>T2. In addition, from (39) and (41), we get(43)dBdt>β2kS˜t−ϵ−μkBl,fort∈tk−1,tk,tk−1>T2,which implies that as t⟶∞, Bt⟶∞ if ℛ1>1. This contradicts the boundedness of Bt. Hence, the claim is true.
By the claim, we are left to discuss two cases: (i)Bt≥B∗ for t large enough; (ii) Bt oscillates about B∗ for t large enough.
Define(44)q=minB∗2,B∗e−μω,whereμ=maxμk,k=1,2,⋯,m.
We hope to show thatBt≥q for t is large enough. For case (i), it is obvious that the conclusion is true. For case (ii), let T0>0 and ξ>0 satisfy(45)BT0=BT0+ξ=B∗,Bt<B∗forT0<t<T0+ξ,where T0 is sufficiently large such that St>S∗t−ϵ for T0<t<T0+ξ.
B
t is uniformly continuous since the positive solution of (5) is ultimately bounded and Bt is not effected by impulses. Hence, there is a τ (0<τ<ω and τ is independent of the choice of Bt) such that Bt>B∗/2 for T0≤t<T0+τ. If ξ≤τ, there is nothing to prove. Let us consider the case where τ<ξ≤ω. Since dB/dt>−μkBt for t∈tk−1,tk and BT0=B∗, it is obvious that Bt≥B∗e−μω>q for T0≤t≤T0+ξ. If ξ>ω, then from dB/dt>−μkBt for t∈tk−1,tk and BT0=B∗, it is easy to see that Bt≥B∗e−μω for T0≤t≤T0+ω. Then, proceeding exactly as the proof for the abovementioned claim, we can get that Bt≥B∗e−μω for T0≤t≤T0+ξ. Since this kind of interval T0,T0+ξ is chosen in an arbitrary way, so we can obtain that Bt≤q for all large t in the second case. In view of the abovementioned discussion, the choices of q is independent of the positive solution, and we have proved that any positive solution of system (5) satisfies Bt≥q for sufficiently large t. This completes the proof.


## 5. Numerical Simulations

We now present a set of simulation results to verify dynamical behavior of the model and evaluate the effect of benign worm and quarantine strategy in defending against malicious worm. The numerical simulations are performed by MATLAB. For convenience, we set the numeric values of the coefficients as follows:ω=3, m=6, t6k=3k, t6k+1=3k+0.66, t6k+2=3k+1, t6k+3=3k+1.66, t6k+4=3k+2, t6k+5=3k+2.66, μk=μ if k is odd, μk=0.5μ if k is even, γk=0.05 if k is an integer multiple of 6 or else γk=0, β1k=β1 if k is odd, β1k=0.3β1 if k is even, β2k=β2 if k is odd, β2k=0.3β2 if k is even, where μ=0.005,η=0.002, γ=0.1, β1=0.6, β2=0.004. For the simulations, we apply the set of parameters unless otherwise stated.


### 5.1. Verification of Theoretical Results

In this section, we will perform numerical simulations for two sets of parameters that show the behavior of the model (5) depending on the value of the basic reproductive number. In both cases, we assume that the initial values are S0=0.7,I0=0.2,B0=0.1. In the first simulation (see Figure 1), by calculating, we have R1=0.9762,R2=0.9480,ℛ0=0.9480<1, and the worm-free periodic solution is globally asymptotically stable, in accordance with the theoretical prediction. On the other hand, in the second simulation, we choose B∗=0.01 and β2=0.06 and get ℛ1=1.6189>1. As a consequence, the benign worms will be permanent (see Figure 2), again in agreement with the theoretical prediction.Figure 1
Evolution ofIt and Bt for system (5). ℛ0=0.9480<1, both worms are extinct.
(a)
(b)Figure 2
Evolution ofBt for system (5). ℛ1=1.6189>1, benign worm is permanent.


### 5.2. Comparison of Four Worm Models:SIR, SIBR, SIBR−Q, and SIBR−QW

To determine the validity of theSIBR−QW model, it is compared with the plain SIR, SIBR, and SIBR−Q models. We first simulate the SIR model as a baseline and then implement the SIBR and SIBR−Q models. Finally, we design our SIBR−QW model. All models share the same parameters which is illustrated as mentioned above except for γ=0.4. Figure 3(a) shows the proportion of malicious worm for each of the four models. The numerical result illustrates a noticeable decrease and a reduced propagation spread for the malicious worms in the SIBR, SIBR−Q, and SIBR−QW models than the SIR model. Figure 3(b), a partially enlarged view of Figure 3(a), shows that the peak value of malicious worm of the SIBR model is larger than that of SIBR−Q and SIBR−QW models. These imply that benign worm countermeasure and quarantine strategy play an important role in constraining malicious worm prevalence. The result supports our expectation that combining mitigation strategies will reduce the propagation speed of malicious worms and decrease the number of malicious worms. Furthermore, we can see that the SIBR−QW model can more accurately reflect people’s online habits than the SIBR−Q model.Figure 3
(a) Comparison between four models, in terms of the number of malicious worms. (b) Comparison betweenSIBR−Q and SIBR−QW models.
(a)
(b)


### 5.3. Quarantine Time and Quarantine Rate

In this section, we mainly discuss the effect of the quarantine strategy. In order to understand the impact of quarantine time and quarantine rate on worm propagation, we firstly run the simulation with quarantine timeω=3,5,7. Figure 4 shows the effect of increasing the quarantine times (which are between 3 and 7 days) on worm propagation. We obtain a conclusion that more frequent quarantine can lower the total number of the malicious worms. Next, we run the simulation with the quarantine rate γ=0.05,0.10,0.15,2.0. Figure 5 illustrates that increasing the quarantine rate yields a decline in the number of malicious worms. It means quarantine strategy is an effective way to constrain the malicious worm’s propagation. We can reduce the losses of our society by increasing the quarantine rate.Figure 4
Evolution ofIt and Bt of system (5) for the different values of quarantine time ω.
(a)
(b)Figure 5
Evolution ofIt and Bt of system (5) for the different values of quarantine rate γ.
(a)
(b)


### 5.4. Attack Performance Sensitivity of Benign Worm

In this section, we mainly study the effect of the attack performance of benign worm on malicious infected host propagation. Figure6 depicts the data on the attack performance under different β21 and β22. This simulation matches our expectation: the number of It declines, and the number of Bt increases with the increase of β21 and β22 for reasons that S host and I host are transmitted to B host due to benign worm attack and the process of transmission of S host and I host are infected more rapidly with larger β21 and β22.Figure 6
Evolution ofIt and Bt of system (5) for the different values of infection rate β21 and β22.
(a)
(b)Remark 1.
R
1 (defined in (11)) depends on the parameter values of μk,β1k,ηk,γk,andωk. The parameters β1k,ωk exhibit directly proportional relationships with R1. By contrast, the parameters ηk,γk are inversely proportional to R1. Then, the eradication of the worms is possible by reducing R1 to below 1 by tuning the model parameters while taking practical actions accordingly.Remark 2.
On the basis of the discussion above, some effectual actions for users are stated as follows:(i)
Reducing the infection rateβ1k by installing antivirus software and firewall timely and increasing the security awareness of user and running it automatically while using computer. These actions can decrease the potential infection of the user’s computer caused by a contact with some other computers.(ii)
Increasing the recovery rate η by a patching system and updating antivirus software in a timely manner.Remark 3.
IDS (Intrusion Detection System) is a tool to detect the network intrusion actions. It divides into two categories according to the detection technique: misuse IDS and anomaly IDS. Moreover, IPS (Intrusion prevention system) is a new information security technology which can supply a gap of the firewall and the IDS in the information security domain. The developer of the antivirus software should improve the performance of IDS and IPS and the attack ability of benign worm. Some effectual actions for the developer are listed as follows:(i)
Increasing the quarantine rateγk by improving the recognition rate and the accuracy rate of misuse IDS, enhancing the anomaly IDS to make it more aggressive and more sensitive to the worms activities, and reducing the false alarms caused by anomaly IDS.(ii)
Reducing the interval time of pulse quarantineωk by increasing the frequency of anomaly detection.(iii)
Reducing the infection rateβ1k by increasing the performance of IPS.(iv)
Increasing the infection rateβ2k by exploring the delivery strategy and improving attack ability of benign worms.


## 5.1. Verification of Theoretical Results

In this section, we will perform numerical simulations for two sets of parameters that show the behavior of the model (5) depending on the value of the basic reproductive number. In both cases, we assume that the initial values are S0=0.7,I0=0.2,B0=0.1. In the first simulation (see Figure 1), by calculating, we have R1=0.9762,R2=0.9480,ℛ0=0.9480<1, and the worm-free periodic solution is globally asymptotically stable, in accordance with the theoretical prediction. On the other hand, in the second simulation, we choose B∗=0.01 and β2=0.06 and get ℛ1=1.6189>1. As a consequence, the benign worms will be permanent (see Figure 2), again in agreement with the theoretical prediction.Figure 1
Evolution ofIt and Bt for system (5). ℛ0=0.9480<1, both worms are extinct.
(a)
(b)Figure 2
Evolution ofBt for system (5). ℛ1=1.6189>1, benign worm is permanent.


## 5.2. Comparison of Four Worm Models:SIR, SIBR, SIBR−Q, and SIBR−QW

To determine the validity of theSIBR−QW model, it is compared with the plain SIR, SIBR, and SIBR−Q models. We first simulate the SIR model as a baseline and then implement the SIBR and SIBR−Q models. Finally, we design our SIBR−QW model. All models share the same parameters which is illustrated as mentioned above except for γ=0.4. Figure 3(a) shows the proportion of malicious worm for each of the four models. The numerical result illustrates a noticeable decrease and a reduced propagation spread for the malicious worms in the SIBR, SIBR−Q, and SIBR−QW models than the SIR model. Figure 3(b), a partially enlarged view of Figure 3(a), shows that the peak value of malicious worm of the SIBR model is larger than that of SIBR−Q and SIBR−QW models. These imply that benign worm countermeasure and quarantine strategy play an important role in constraining malicious worm prevalence. The result supports our expectation that combining mitigation strategies will reduce the propagation speed of malicious worms and decrease the number of malicious worms. Furthermore, we can see that the SIBR−QW model can more accurately reflect people’s online habits than the SIBR−Q model.Figure 3
(a) Comparison between four models, in terms of the number of malicious worms. (b) Comparison betweenSIBR−Q and SIBR−QW models.
(a)
(b)


## 5.3. Quarantine Time and Quarantine Rate

In this section, we mainly discuss the effect of the quarantine strategy. In order to understand the impact of quarantine time and quarantine rate on worm propagation, we firstly run the simulation with quarantine timeω=3,5,7. Figure 4 shows the effect of increasing the quarantine times (which are between 3 and 7 days) on worm propagation. We obtain a conclusion that more frequent quarantine can lower the total number of the malicious worms. Next, we run the simulation with the quarantine rate γ=0.05,0.10,0.15,2.0. Figure 5 illustrates that increasing the quarantine rate yields a decline in the number of malicious worms. It means quarantine strategy is an effective way to constrain the malicious worm’s propagation. We can reduce the losses of our society by increasing the quarantine rate.Figure 4
Evolution ofIt and Bt of system (5) for the different values of quarantine time ω.
(a)
(b)Figure 5
Evolution ofIt and Bt of system (5) for the different values of quarantine rate γ.
(a)
(b)


## 5.4. Attack Performance Sensitivity of Benign Worm

In this section, we mainly study the effect of the attack performance of benign worm on malicious infected host propagation. Figure6 depicts the data on the attack performance under different β21 and β22. This simulation matches our expectation: the number of It declines, and the number of Bt increases with the increase of β21 and β22 for reasons that S host and I host are transmitted to B host due to benign worm attack and the process of transmission of S host and I host are infected more rapidly with larger β21 and β22.Figure 6
Evolution ofIt and Bt of system (5) for the different values of infection rate β21 and β22.
(a)
(b)Remark 1.
R
1 (defined in (11)) depends on the parameter values of μk,β1k,ηk,γk,andωk. The parameters β1k,ωk exhibit directly proportional relationships with R1. By contrast, the parameters ηk,γk are inversely proportional to R1. Then, the eradication of the worms is possible by reducing R1 to below 1 by tuning the model parameters while taking practical actions accordingly.Remark 2.
On the basis of the discussion above, some effectual actions for users are stated as follows:(i)
Reducing the infection rateβ1k by installing antivirus software and firewall timely and increasing the security awareness of user and running it automatically while using computer. These actions can decrease the potential infection of the user’s computer caused by a contact with some other computers.(ii)
Increasing the recovery rate η by a patching system and updating antivirus software in a timely manner.Remark 3.
IDS (Intrusion Detection System) is a tool to detect the network intrusion actions. It divides into two categories according to the detection technique: misuse IDS and anomaly IDS. Moreover, IPS (Intrusion prevention system) is a new information security technology which can supply a gap of the firewall and the IDS in the information security domain. The developer of the antivirus software should improve the performance of IDS and IPS and the attack ability of benign worm. Some effectual actions for the developer are listed as follows:(i)
Increasing the quarantine rateγk by improving the recognition rate and the accuracy rate of misuse IDS, enhancing the anomaly IDS to make it more aggressive and more sensitive to the worms activities, and reducing the false alarms caused by anomaly IDS.(ii)
Reducing the interval time of pulse quarantineωk by increasing the frequency of anomaly detection.(iii)
Reducing the infection rateβ1k by increasing the performance of IPS.(iv)
Increasing the infection rateβ2k by exploring the delivery strategy and improving attack ability of benign worms.


## 6. Conclusion and Discussion

An understanding of the combined impact of implementing benign worm and quarantine defenses is of great importance for effectively containing worm epidemics. Aiming at this, an impulsive switching worm propagation model (SIBR−QW model) has been formulated and analyzed. The basic reproductive number ℛ0 has been calculated. A worm-free periodic solution has been acquired, and its local and global asymptotic stabilities have been proven by applying the next infection operator and by the comparison method if ℛ0<1. The uniform persistence of benign worm has been illustrated. Finally, by numerical simulations, some conclusions have been drawn and the according suggestions for containing the worms spreading have been put forward.However, in this paper, we only obtain the sufficient condition for the permanence of benign worm for the caseℛ0>1. There are many issues that should be considered in our future work of system (5), in particular paying attention to the following points:(i)
The existence and stability of boundary periodic solution.(ii)
The threshold condition for the permanence.(iii)
The existence and stability of a positive periodic solution.



---

*Source: 3578390-2020-01-13.xml*