# Analysis of a Delayed Internet Worm Propagation Model with Impulsive Quarantine Strategy

Authors: Yu Yao; Xiaodong Feng; Wei Yang; Wenlong Xiang; Fuxiang Gao
Journal: Mathematical Problems in Engineering
 (2014)

---

## Abstract

Internet worms exploiting zero-day vulnerabilities have drawn significant attention owing to their enormous threats to Internet in the real world. To begin with, a worm propagation model with time delay in vaccination is formulated. Through theoretical analysis, it is proved that the worm propagation system is stable when the time delay is less than the thresholdτ
0 and Hopf bifurcation appears when time delay is equal to or greater than τ
0. Then, a worm propagation model with constant quarantine strategy is proposed. Through quantitative analysis, it is found that constant quarantine strategy has some inhibition effect but does not eliminate bifurcation. Considering all the above, we put forward impulsive quarantine strategy to eliminate worms. Theoretical results imply that the novel proposed strategy can eliminate bifurcation and control the stability of worm propagation. Finally, simulation results match numerical experiments well, which fully supports our analysis.


---

## Body

## 1. Introduction

With the rapid growth of information technologies and network applications, severe challenges, in form of requirement of a suitable defense system, have been posed to make sure of the safety of the valuable information stored on system and in transit. For example, worms that exploit zero-day vulnerabilities have brought severe threats to Internet security in the real world. To date, none of the patches could effectively and reliably immunize the hosts thoroughly against being attacked by those worms. It may take a period of time for users to immunize their computers if they are in infected state. In addition, the failure of some vaccination measures or worm-variants may also lead to high risks that the hosts being immunized would be infected again. On the other hand, the propagation of worms in a system of interacting computers could be compared to contagious diseases in human population. In computer science field, computers are like individuals in an ecological system and thus the same mechanism of birth and death should be considered. Being infected by network worms or quarantined by IDS (intrusion detection systems), hosts will become dangerous and their owners will have to reinstall the system. Another factor to consider is that when new computers are brought, most of them have preinstalled operating systems but without newest safety patches while old computers are discarded and recycled. Consequently, in order to imitate the real world, birth and death rates should be introduced to worm propagations model.Considering all the above, we firstly construct a worm propagation model with time delay in vaccination based on the classical epidemic Kermack-Mckendrick model [1] to describe the current situation. Through theoretical analysis, it is proved that Hopf bifurcation appears when time delay is equal to or greater than the threshold τ
0, which leads the number of infected hosts to be unpredictable and the propagation of worms to be out of control. In order to make up the deficiency of vaccination strategy and eliminate the negative impact of time delay, quarantine strategies are proposed to improve vaccination effect and eliminate bifurcation. The current quarantine strategy generally depends on the intrusion detection system, which can be classified into two categories: misuse and anomaly intrusion detection. Misuse intrusion detection system can accurately detect known worms. Based on misuse intrusion detection system, we propose constant quarantine strategy. Although it does improve vaccination effect, the system is still out of control and Hopf bifurcation is not eliminated either. Furthermore, the system fails to detect unknown worms and worm-variants. Anomaly intrusion detection system is of help in detecting these kinds of worm. However, it is always accompanied by high false-positive rate.Consequently, this paper proposes a worm propagation model with impulsive quarantine strategy based on a hybrid intrusion detection system that combines both misuse and anomaly intrusion detection to make up for the gaps existing in the two systems. After adoption impulsive quarantine strategy, it is clearly proved that Hopf bifurcation is eliminated thoroughly so that the system is stable.The rest of the paper is organized as follows. In the next section, related work on time delay and quarantine strategy is introduced. Section3 provides a worm propagation model with time delay in vaccination. In Section 4, we construct a delayed worm propagation model with constant quarantine and analyze it in detail. Then, in Section 5, a delayed worm propagation model using impulsive quarantine strategy is proposed, and its analysis is performed. Section 6 presents numerical analyses and simulation experiments based on Slammer worm. Simulation results match well with numerical ones. Finally, Section 7 gives the conclusions.


## 2. Related Work

With the similarity between Internet worms and biological diseases, epidemiological models have been widely used in modeling the propagation of worms [2–6]. To make the worm transmission in computer network work as in the real word, the research within the data-driven framework has been done [7–9]. Although some human factors are included, these models cannot restrain worms effectively. Thus, a variety of containment strategies have been applied to worm propagation models. As far as we know, the use of quarantine strategies has produced a great effect on controlling disease. People use quarantine strategies widely in worm containment enlightened by this [10–16]. In addition, some scholars have done research on time delay [17–19].However, previous studies have failed to consider the appropriate quarantine strategy to eliminate the negative effect of time delay. For instance, the pulse quarantine strategy that Yao has proposed [12] does lead to worm elimination with a relatively low value, but time delay is not considered, which leads to Hopf bifurcation so that the worm propagation system will be unstable and out of control. In this paper, constant quarantine and impulsive quarantine strategies are proposed to constrain the worms spreading and even eliminate Hopf bifurcation.


## 3. Worm Propagation Model with Time Delay in Vaccination

With regard to worms exploiting zero-day vulnerabilities, none of the patches could effectively and reliably immunize the hosts. After the hosts are being infected, some measures, such as cutting off the network connection, running manual antivirus, or setting firewall, are taken to remove the worms. With these measures being carried out, the hosts cannot further infect other susceptible hosts, but they are in fact not vaccinated completely. Namely, detecting and cleaning worms take a period of time. Therefore, time delay should be considered in actual conditions. Since time delay exists, infected hosts go through a temporary state (delayed) after vaccination. Consequently, on the basis of KM model, we give a worm propagation model with time delay in vaccination. We assume all hosts are in one of four states: susceptible state (S), infected state (I), delayed state (D), and vaccinated state (V). The state transition diagram of the delayed model is given in Figure 1.Figure 1
State transition diagram of delayed model.LetS
(
t
) denote the number of susceptible hosts at time t, I
(
t
) denote the number of infected hosts at time t, D
(
t
) denote the number of delayed hosts at time t, and V
(
t
) denote the number of vaccinated hosts at time t. β is the infection rate at which susceptible hosts are infected by infected hosts and γ is the rate of removal of infected from circulation. As worms and worm-variants exist, μ is the rate that vaccinated hosts back to susceptible hosts. The newborn hosts enter the system with the same rate ν, of which a portion 1
-
p is recovered by installing patches at birth. Time delay is denoted by τ.In order to show it clearly, we list in Notations section some frequently used notations in this paper.


### 3.1. Description of Delayed Model

From the above definitions in the paper, we write down the complete differential equations of the delayed model:(1)
d
S
(
t
)
d
t
=
p
ν
N
-
β
S
(
t
)
I
(
t
)
-
ν
S
(
t
)
+
μ
V
(
t
)
,
d
I
(
t
)
d
t
=
β
S
(
t
)
I
(
t
)
-
γ
I
(
t
)
-
ν
I
(
t
)
,
d
D
(
t
)
d
t
=
γ
I
(
t
)
-
γ
I
(
t
-
τ
)
-
ν
D
(
t
)
,
d
V
(
t
)
d
t
=
(
1
-
p
)
ν
N
+
γ
I
(
t
-
τ
)
-
μ
V
(
t
)
-
ν
V
(
t
)
.
As mentioned above, the population size is set N, which is set to unity:
(2)
S
(
t
)
+
I
(
t
)
+
D
(
t
)
+
V
(
t
)
=
N
.


### 3.2. Stability of the Positive Equilibrium and Bifurcation Analysis

Theorem 1.
The system has a unique positive equilibriumE
*
(
S
*
,
I
*
,
D
*
,
V
*
) when it satisfies the following condition: (
H
1
)
(
β
N
-
γ
-
ν
)
(
μ
+
ν
)
/
β
(
1
-
p
)
ν
N
>
1, where S
*
=
(
γ
+
ν
)
/
β, D
*
=
0, V
*
=
(
γ
I
*
+
(
1
-
p
)
ν
N
)
/
(
μ
+
v
).Proof.
For system (1), if all the derivatives on the left of equal sign of the system are set to 0, which implies that the system becomes stable, we can derive
(3)
S
=
γ
+
ν
β
,
D
=
0
,
V
=
γ
I
*
+
(
1
-
p
)
ν
N
μ
+
v
.
Substituting the value of each variable in (3) for each of (2), then we can derive
(4)
S
*
+
I
*
+
γ
I
*
+
(
1
-
p
)
ν
N
μ
+
v
=
N
.
Obviously, if(
H
1
) is satisfied, (4) has one unique positive root I
* and there is one unique positive equilibrium E
*
(
S
*
,
I
*
,
D
*
,
V
*
) of system (1). The proof is completed.According to (2), V
(
t
)
=
N
-
S
(
t
)
-
I
(
t
)
-
D
(
t
); thus, system (1) can be simplified to
(5)
d
S
(
t
)
d
t
=
p
ν
N
+
μ
(
N
-
S
(
t
)
-
I
(
t
)
-
D
(
t
)
)
d
D
(
t
)
d
t
-
β
S
(
t
)
I
(
t
)
-
ν
S
(
t
)
,
d
I
(
t
)
d
t
=
β
S
(
t
)
I
(
t
)
-
γ
I
(
t
)
-
ν
I
(
t
)
,
d
D
(
t
)
d
t
=
γ
I
(
t
)
-
γ
I
(
t
-
τ
)
-
ν
D
(
t
)
.
The Jacobi matrix of (5) about E
*
(
S
*
,
I
*
,
D
*
) is given by
(6)
J
(
E
*
)
=
(
-
μ
-
β
I
*
-
ν
-
μ
-
β
S
*
-
μ
β
I
*
β
S
*
-
γ
-
ν
0
0
γ
-
γ
e
-
λ
τ
-
ν
)
.
The characteristic equation of that matrix can be obtained by
(7)
P
(
λ
)
+
Q
(
λ
)
e
-
λ
τ
=
0
.
Let
(8)
p
2
=
μ
+
β
I
*
+
3
ν
-
β
S
*
+
γ
,
p
1
=
β
(
2
ν
-
μ
+
γ
)
I
*
-
β
S
*
(
μ
+
2
ν
)
-
2
β
2
I
*
S
*
+
μ
(
2
ν
+
γ
)
+
ν
(
3
ν
2
+
2
γ
)
,
p
0
=
β
I
*
(
ν
γ
+
ν
2
+
μ
γ
-
μ
ν
)
-
ν
β
S
*
(
μ
+
ν
)
-
2
ν
β
2
S
*
I
*
+
ν
μ
γ
+
ν
2
(
μ
+
γ
+
ν
)
,
q
0
=
-
β
μ
γ
I
*
.
Then P
(
λ
)
=
λ
3
+
p
2
λ
2
+
p
1
λ
+
p
0, Q
(
λ
)
=
q
0.Theorem 2.
The positive equilibriumE
* is locally asymptotically stable without time delay, if the following holds:(
H
2
)
p
2
>
0
,
p
1
p
2
-
(
p
0
+
q
0
)
>
0
,
p
0
+
q
0
>
0.Proof.
Ifτ
=
0, (7) reduces to
(9)
λ
3
+
p
2
λ
2
+
p
1
λ
+
(
p
0
+
q
0
)
=
0
.
According to Routh-Hurwitz criterion, all the roots of (9) have negative real parts. Therefore, it can be deduced that the positive equilibrium E
* is locally asymptotically stable without time delay. The proof is completed.Obviously,λ
=
i
ω
(
ω
>
0
) is a root of (7). After separating the real and imaginary parts, it can be written as
(10)
-
p
2
ω
2
+
p
0
+
q
0
cos
⁡
(
ω
τ
)
=
0
,
(11)
-
ω
3
+
p
1
ω
-
q
0
sin
(
ω
τ
)
=
0
,
which implies
(12)
ω
6
+
D
3
ω
4
+
D
2
ω
2
+
D
1
=
0
,
where
(13)
D
3
=
p
2
2
-
2
p
1
,
D
2
=
p
1
-
2
p
2
p
0
,
D
1
=
p
0
2
-
q
0
2
.Letz
=
ω
2; (12) can be written as
(14)
h
(
z
)
=
z
3
+
D
3
z
2
+
D
2
z
+
D
1
.
Δ is defined as Δ
=
D
3
2
-
3
D
2. Hence, we can get a solution z
*
=
(
Δ
-
D
3
)
/
3 of h
(
z
).Lemma 3.
Suppose that(
H
2
)
p
2
>
0, p
1
p
2
-
(
p
0
+
q
0
)
>
0; p
0
+
q
0
>
0 is satisfied.(1)
If one of the following holds: (a)Δ
>
0, z
*
<
0; (b) Δ
>
0, z
*
>
0; and h
(
z
*
)
>
0, then all roots of (7) have negative real parts when τ
∈
[
0
,
τ
0
) and τ
0 is a certain positive constant.
(2)
If the conditions (a) and (b) are not satisfied, then all roots of (7) have negative real parts for all τ
≥
0.Proof.
Whenτ
=
0, (7) can be reduced to
(15)
λ
3
+
p
2
λ
2
+
p
1
λ
+
(
p
0
+
q
0
)
=
0
.
By the Routh-Hurwitz criterion, all roots of (9) have negative real parts and only if
(16)
p
2
>
0
,
p
1
p
2
-
(
p
0
+
q
0
)
>
0
,
p
0
+
q
0
>
0
.
Considering (14), it is easy to see from the characters of cubic algebraic equation that h
(
z
) is a strictly monotonically increasing function if Δ
≤
0. If Δ
>
0, z
*
<
0 or Δ
>
0, z
*
>
0 and h
(
z
*
)
>
0, then h
(
z
) has no positive root. Hence, (7) has no purely imaginary roots for any τ
>
0, which implies that the positive equilibrium E
*
(
S
*
,
I
*
,
D
*
,
V
*
) of system (1) is absolutely stable. Therefore, the following theorem on the stability of positive equilibrium E
*
(
S
*
,
I
*
,
D
*
,
V
*
) can be easily obtained.Theorem 4.
Assume that(
H
1
) and (
H
2
) are satisfied, and Δ
>
0, z
*
<
0 or Δ
>
0, z
*
>
0. and h
(
z
*
)
>
0, then the positive equilibrium E
*
(
S
*
,
I
*
,
D
*
,
V
*
) of system (1) is absolutely stable. Namely, E
*
(
S
*
,
I
*
,
D
*
,
V
*
) is asymptotically stable for any time delay τ
>
0.Assume that the coefficients inh
(
z
) satisfy the condition as follows:(
H
3
)
Δ
>
0
,
z
*
>
0, h
(
z
*
)
<
0.According to lemma, it is proved that (14) has at least a positive root ω
0, namely, the characteristic equation (7) has a pair of purely imaginary roots ±
i
ω
0.In view of the fact that (7) has a pair of purely imaginary roots ±
i
ω
0, the corresponding τ
k
>
0 is given by eliminating sin
(
ω
τ
) in (10) and (11):
(17)
τ
k
=
1
ω
0
arccos
[
p
2
ω
0
2
-
p
0
q
0
]
+
2
k
π
ω
0
(
k
=
0,1
,
2
,
…
)
.
Let λ
(
τ
)
=
v
(
τ
)
+
i
ω
(
τ
) be the root of (7), so that v
(
τ
k
)
=
0 and ω
(
τ
k
)
=
ω
0 are satisfied when τ
=
τ
k.Lemma 5.
Supposeh
′
(
z
0
)
≠
0. If τ
=
τ
0, then ±
i
ω
0 is a pair of purely imaginary roots of (7). In addition, if the conditions in Lemma 3 are satisfied, then
(18)
d
(
Re
λ
)
d
τ
|
τ
=
τ
k
>
0
.
This signifies that there exists at least one eigenvalue with positive real part forτ
>
τ
k. Differentiating both sides of (7) with respect to τ, it can be written as
(19)
(
d
λ
d
τ
)
-
1
=
(
3
λ
2
+
2
p
2
λ
+
p
1
)
-
q
0
τ
e
-
λ
τ
q
0
λ
e
-
λ
τ
.
Therefore,
(20)
sgn
⁡
[
d
Re
λ
d
τ
]
τ
=
τ
k
=
sgn
⁡
[
Re
(
d
λ
d
τ
)
-
1
]
λ
=
i
ω
0
=
sgn
⁡
ω
0
2
Λ
(
3
ω
0
4
+
2
D
2
ω
0
2
+
D
1
)
=
sgn
⁡
ω
0
2
Λ
{
h
′
(
ω
0
2
)
}
=
sgn
⁡
{
h
′
(
ω
0
2
)
}
,
where Λ
=
q
0
ω
0
2; then it follows the hypothesis (
H
3
) that h
′
(
ω
0
2
)
≠
0.
Hence,(21)
d
(
Re
λ
)
d
τ
|
τ
=
τ
k
>
0
.
The root of characteristic equation (7) crosses from left to right on the imaginary axis as τ continuously varies from a value less than τ
k to one greater than τ
k according to Routh’s theorem. Therefore, according to the Hopf bifurcation theorem [20] for functional differential equations, the transverse condition holds and the conditions for Hopf bifurcation are satisfied at τ
=
τ
k. Then the following result can be obtained.Theorem 6.
Suppose that the conditions(
H
1
) and (
H
2
) are satisfied.(1)
The equilibriumE
*
(
S
*
,
I
*
,
D
*
,
V
*
) is locally asymptotically stable when τ
∈
[
0
,
τ
0
), but unstable when τ
>
τ
0.
(2)
If condition(
H
3
) is satisfied, the system will undergo Hopf bifurcation at the positive equilibrium E
*
(
S
*
,
I
*
,
D
*
,
V
*
) when τ
=
τ
k
(
k
=
0,1
,
2
,
…
), where τ
k is defined by (17).
This implies that when time delayτ
<
τ
0, the system will stabilize at its infection equilibrium point, which is beneficial to implement a containment strategy; when τ
≥
τ
0, the system will be unstable and worms cannot be effectively controlled.


## 3.1. Description of Delayed Model

From the above definitions in the paper, we write down the complete differential equations of the delayed model:(1)
d
S
(
t
)
d
t
=
p
ν
N
-
β
S
(
t
)
I
(
t
)
-
ν
S
(
t
)
+
μ
V
(
t
)
,
d
I
(
t
)
d
t
=
β
S
(
t
)
I
(
t
)
-
γ
I
(
t
)
-
ν
I
(
t
)
,
d
D
(
t
)
d
t
=
γ
I
(
t
)
-
γ
I
(
t
-
τ
)
-
ν
D
(
t
)
,
d
V
(
t
)
d
t
=
(
1
-
p
)
ν
N
+
γ
I
(
t
-
τ
)
-
μ
V
(
t
)
-
ν
V
(
t
)
.
As mentioned above, the population size is set N, which is set to unity:
(2)
S
(
t
)
+
I
(
t
)
+
D
(
t
)
+
V
(
t
)
=
N
.


## 3.2. Stability of the Positive Equilibrium and Bifurcation Analysis

Theorem 1.
The system has a unique positive equilibriumE
*
(
S
*
,
I
*
,
D
*
,
V
*
) when it satisfies the following condition: (
H
1
)
(
β
N
-
γ
-
ν
)
(
μ
+
ν
)
/
β
(
1
-
p
)
ν
N
>
1, where S
*
=
(
γ
+
ν
)
/
β, D
*
=
0, V
*
=
(
γ
I
*
+
(
1
-
p
)
ν
N
)
/
(
μ
+
v
).Proof.
For system (1), if all the derivatives on the left of equal sign of the system are set to 0, which implies that the system becomes stable, we can derive
(3)
S
=
γ
+
ν
β
,
D
=
0
,
V
=
γ
I
*
+
(
1
-
p
)
ν
N
μ
+
v
.
Substituting the value of each variable in (3) for each of (2), then we can derive
(4)
S
*
+
I
*
+
γ
I
*
+
(
1
-
p
)
ν
N
μ
+
v
=
N
.
Obviously, if(
H
1
) is satisfied, (4) has one unique positive root I
* and there is one unique positive equilibrium E
*
(
S
*
,
I
*
,
D
*
,
V
*
) of system (1). The proof is completed.According to (2), V
(
t
)
=
N
-
S
(
t
)
-
I
(
t
)
-
D
(
t
); thus, system (1) can be simplified to
(5)
d
S
(
t
)
d
t
=
p
ν
N
+
μ
(
N
-
S
(
t
)
-
I
(
t
)
-
D
(
t
)
)
d
D
(
t
)
d
t
-
β
S
(
t
)
I
(
t
)
-
ν
S
(
t
)
,
d
I
(
t
)
d
t
=
β
S
(
t
)
I
(
t
)
-
γ
I
(
t
)
-
ν
I
(
t
)
,
d
D
(
t
)
d
t
=
γ
I
(
t
)
-
γ
I
(
t
-
τ
)
-
ν
D
(
t
)
.
The Jacobi matrix of (5) about E
*
(
S
*
,
I
*
,
D
*
) is given by
(6)
J
(
E
*
)
=
(
-
μ
-
β
I
*
-
ν
-
μ
-
β
S
*
-
μ
β
I
*
β
S
*
-
γ
-
ν
0
0
γ
-
γ
e
-
λ
τ
-
ν
)
.
The characteristic equation of that matrix can be obtained by
(7)
P
(
λ
)
+
Q
(
λ
)
e
-
λ
τ
=
0
.
Let
(8)
p
2
=
μ
+
β
I
*
+
3
ν
-
β
S
*
+
γ
,
p
1
=
β
(
2
ν
-
μ
+
γ
)
I
*
-
β
S
*
(
μ
+
2
ν
)
-
2
β
2
I
*
S
*
+
μ
(
2
ν
+
γ
)
+
ν
(
3
ν
2
+
2
γ
)
,
p
0
=
β
I
*
(
ν
γ
+
ν
2
+
μ
γ
-
μ
ν
)
-
ν
β
S
*
(
μ
+
ν
)
-
2
ν
β
2
S
*
I
*
+
ν
μ
γ
+
ν
2
(
μ
+
γ
+
ν
)
,
q
0
=
-
β
μ
γ
I
*
.
Then P
(
λ
)
=
λ
3
+
p
2
λ
2
+
p
1
λ
+
p
0, Q
(
λ
)
=
q
0.Theorem 2.
The positive equilibriumE
* is locally asymptotically stable without time delay, if the following holds:(
H
2
)
p
2
>
0
,
p
1
p
2
-
(
p
0
+
q
0
)
>
0
,
p
0
+
q
0
>
0.Proof.
Ifτ
=
0, (7) reduces to
(9)
λ
3
+
p
2
λ
2
+
p
1
λ
+
(
p
0
+
q
0
)
=
0
.
According to Routh-Hurwitz criterion, all the roots of (9) have negative real parts. Therefore, it can be deduced that the positive equilibrium E
* is locally asymptotically stable without time delay. The proof is completed.Obviously,λ
=
i
ω
(
ω
>
0
) is a root of (7). After separating the real and imaginary parts, it can be written as
(10)
-
p
2
ω
2
+
p
0
+
q
0
cos
⁡
(
ω
τ
)
=
0
,
(11)
-
ω
3
+
p
1
ω
-
q
0
sin
(
ω
τ
)
=
0
,
which implies
(12)
ω
6
+
D
3
ω
4
+
D
2
ω
2
+
D
1
=
0
,
where
(13)
D
3
=
p
2
2
-
2
p
1
,
D
2
=
p
1
-
2
p
2
p
0
,
D
1
=
p
0
2
-
q
0
2
.Letz
=
ω
2; (12) can be written as
(14)
h
(
z
)
=
z
3
+
D
3
z
2
+
D
2
z
+
D
1
.
Δ is defined as Δ
=
D
3
2
-
3
D
2. Hence, we can get a solution z
*
=
(
Δ
-
D
3
)
/
3 of h
(
z
).Lemma 3.
Suppose that(
H
2
)
p
2
>
0, p
1
p
2
-
(
p
0
+
q
0
)
>
0; p
0
+
q
0
>
0 is satisfied.(1)
If one of the following holds: (a)Δ
>
0, z
*
<
0; (b) Δ
>
0, z
*
>
0; and h
(
z
*
)
>
0, then all roots of (7) have negative real parts when τ
∈
[
0
,
τ
0
) and τ
0 is a certain positive constant.
(2)
If the conditions (a) and (b) are not satisfied, then all roots of (7) have negative real parts for all τ
≥
0.Proof.
Whenτ
=
0, (7) can be reduced to
(15)
λ
3
+
p
2
λ
2
+
p
1
λ
+
(
p
0
+
q
0
)
=
0
.
By the Routh-Hurwitz criterion, all roots of (9) have negative real parts and only if
(16)
p
2
>
0
,
p
1
p
2
-
(
p
0
+
q
0
)
>
0
,
p
0
+
q
0
>
0
.
Considering (14), it is easy to see from the characters of cubic algebraic equation that h
(
z
) is a strictly monotonically increasing function if Δ
≤
0. If Δ
>
0, z
*
<
0 or Δ
>
0, z
*
>
0 and h
(
z
*
)
>
0, then h
(
z
) has no positive root. Hence, (7) has no purely imaginary roots for any τ
>
0, which implies that the positive equilibrium E
*
(
S
*
,
I
*
,
D
*
,
V
*
) of system (1) is absolutely stable. Therefore, the following theorem on the stability of positive equilibrium E
*
(
S
*
,
I
*
,
D
*
,
V
*
) can be easily obtained.Theorem 4.
Assume that(
H
1
) and (
H
2
) are satisfied, and Δ
>
0, z
*
<
0 or Δ
>
0, z
*
>
0. and h
(
z
*
)
>
0, then the positive equilibrium E
*
(
S
*
,
I
*
,
D
*
,
V
*
) of system (1) is absolutely stable. Namely, E
*
(
S
*
,
I
*
,
D
*
,
V
*
) is asymptotically stable for any time delay τ
>
0.Assume that the coefficients inh
(
z
) satisfy the condition as follows:(
H
3
)
Δ
>
0
,
z
*
>
0, h
(
z
*
)
<
0.According to lemma, it is proved that (14) has at least a positive root ω
0, namely, the characteristic equation (7) has a pair of purely imaginary roots ±
i
ω
0.In view of the fact that (7) has a pair of purely imaginary roots ±
i
ω
0, the corresponding τ
k
>
0 is given by eliminating sin
(
ω
τ
) in (10) and (11):
(17)
τ
k
=
1
ω
0
arccos
[
p
2
ω
0
2
-
p
0
q
0
]
+
2
k
π
ω
0
(
k
=
0,1
,
2
,
…
)
.
Let λ
(
τ
)
=
v
(
τ
)
+
i
ω
(
τ
) be the root of (7), so that v
(
τ
k
)
=
0 and ω
(
τ
k
)
=
ω
0 are satisfied when τ
=
τ
k.Lemma 5.
Supposeh
′
(
z
0
)
≠
0. If τ
=
τ
0, then ±
i
ω
0 is a pair of purely imaginary roots of (7). In addition, if the conditions in Lemma 3 are satisfied, then
(18)
d
(
Re
λ
)
d
τ
|
τ
=
τ
k
>
0
.
This signifies that there exists at least one eigenvalue with positive real part forτ
>
τ
k. Differentiating both sides of (7) with respect to τ, it can be written as
(19)
(
d
λ
d
τ
)
-
1
=
(
3
λ
2
+
2
p
2
λ
+
p
1
)
-
q
0
τ
e
-
λ
τ
q
0
λ
e
-
λ
τ
.
Therefore,
(20)
sgn
⁡
[
d
Re
λ
d
τ
]
τ
=
τ
k
=
sgn
⁡
[
Re
(
d
λ
d
τ
)
-
1
]
λ
=
i
ω
0
=
sgn
⁡
ω
0
2
Λ
(
3
ω
0
4
+
2
D
2
ω
0
2
+
D
1
)
=
sgn
⁡
ω
0
2
Λ
{
h
′
(
ω
0
2
)
}
=
sgn
⁡
{
h
′
(
ω
0
2
)
}
,
where Λ
=
q
0
ω
0
2; then it follows the hypothesis (
H
3
) that h
′
(
ω
0
2
)
≠
0.
Hence,(21)
d
(
Re
λ
)
d
τ
|
τ
=
τ
k
>
0
.
The root of characteristic equation (7) crosses from left to right on the imaginary axis as τ continuously varies from a value less than τ
k to one greater than τ
k according to Routh’s theorem. Therefore, according to the Hopf bifurcation theorem [20] for functional differential equations, the transverse condition holds and the conditions for Hopf bifurcation are satisfied at τ
=
τ
k. Then the following result can be obtained.Theorem 6.
Suppose that the conditions(
H
1
) and (
H
2
) are satisfied.(1)
The equilibriumE
*
(
S
*
,
I
*
,
D
*
,
V
*
) is locally asymptotically stable when τ
∈
[
0
,
τ
0
), but unstable when τ
>
τ
0.
(2)
If condition(
H
3
) is satisfied, the system will undergo Hopf bifurcation at the positive equilibrium E
*
(
S
*
,
I
*
,
D
*
,
V
*
) when τ
=
τ
k
(
k
=
0,1
,
2
,
…
), where τ
k is defined by (17).
This implies that when time delayτ
<
τ
0, the system will stabilize at its infection equilibrium point, which is beneficial to implement a containment strategy; when τ
≥
τ
0, the system will be unstable and worms cannot be effectively controlled.


## 4. A Delayed Worm Propagation Model with Constant Quarantine

Enlightened by the methods in disease control, quarantine is selected as an effective way to diminish the speed of worm propagation. The current quarantine strategy generally depends on the intrusion detection system, which can be classified into two categories: misuse and anomaly intrusion detection [12]. As the delayed model cannot make sure of the system stable and controlled, quarantine strategies should be taken into consideration to further control the worm propagation.


### 4.1. Using Constant Quarantine Strategy to Model a Delayed Worm Propagation

Misuse intrusion detection system builds a database with the feature of known attack behaviors. The system can recognize the invaders once their behaviors agree with one of the databases and accurately detect known worms [12]. By applying misuse intrusion detection system for its relatively high accuracy, we add a new state called quarantine state (Q) [9], but only infected hosts will be quarantined. Q
(
t
) denote the number of quarantined hosts at time t. Unlike the quarantine strategy against epidemics, the implementation of constant quarantine strategy depends on the misuse intrusion detection system. Infected hosts will be quarantined at rate α which depends on the performance of intrusion detection system and network devices. When infected hosts are quarantined, they will get rid of worms and get patched at rate δ. The state transition diagram of constant quarantine model is given in Figure 2.Figure 2
State transition diagram of constant quarantine model.


### 4.2. Description of Constant Quarantine Model

According to the definitions above in the paper, the differential equations of constant quarantine model are given as follows:(22)
d
S
(
t
)
d
t
=
p
ν
N
-
β
S
(
t
)
I
(
t
)
+
μ
V
(
t
)
-
ν
S
(
t
)
,
d
I
(
t
)
d
t
=
β
S
(
t
)
I
(
t
)
-
I
(
t
)
-
α
I
(
t
)
-
ν
I
(
t
)
,
d
D
(
t
)
d
t
=
γ
I
(
t
)
-
γ
I
(
t
-
τ
)
-
ν
D
(
t
)
,
d
Q
(
t
)
d
t
=
α
I
(
t
)
-
δ
Q
(
t
)
-
ν
Q
(
t
)
,
d
V
(
t
)
d
t
=
γ
I
(
t
-
τ
)
+
δ
Q
(
t
)
-
μ
V
(
t
)
+
(
1
-
p
)
ν
N
-
ν
V
(
t
)
.
Similarly,
(23)
S
(
t
)
+
I
(
t
)
+
D
(
t
)
+
Q
(
t
)
+
V
(
t
)
=
N
.


### 4.3. Stability of the Positive Equilibrium and Bifurcation Analysis

Theorem 7.
The system has a unique positive equilibriumE
*
(
S
*
,
I
*
,
D
*
,
Q
*
,
V
*
) when it satisfies the following condition:(
H
1
)
β
N
(
μ
+
p
ν
)
/
μ
(
μ
+
ν
)
(
γ
+
α
+
ν
)
>
1, where S
*
=
(
γ
+
α
+
ν
)
/
β, D
*
=
0, Q
*
=
(
α
/
(
δ
+
ν
)
)
I
*, V
*
=
(
(
γ
+
α
+
ν
)
/
μ
)
(
ν
/
β
+
I
*
)
-
p
ν
N
/
μ.Proof.
For system (22), if all the derivatives on the left of equal sign of the system are set to 0, which implies that the system becomes stable, we can get
(24)
S
=
γ
+
α
+
ν
β
,
D
=
0
,
Q
=
α
δ
+
ν
I
*
,
V
=
γ
+
α
+
ν
μ
(
ν
β
+
I
*
)
-
p
ν
N
μ
.
Substituting the value of each variable in (24) for each of (23), then we can get
(25)
S
*
+
α
δ
+
ν
I
*
+
I
*
+
γ
+
α
+
ν
μ
(
ν
β
+
I
*
)
-
p
ν
N
μ
=
N
.
Obviously, if(
H
1
) is satisfied, (25) has one unique positive root I
*, and there is one unique positive equilibrium E
*
(
S
*
,
I
*
,
D
*
,
Q
*
,
V
*
) of system (22). The proof is completed.According to (23), V
(
t
)
=
N
-
S
(
t
)
-
I
(
t
)
-
D
(
t
)
-
Q
(
t
); thus, system (22) can be simplified to
(26)
d
S
(
t
)
d
t
=
p
ν
N
+
μ
(
N
-
S
(
t
)
-
I
(
t
)
-
D
(
t
)
-
Q
(
t
)
)
m
m
m
m
l
-
β
S
(
t
)
I
(
t
)
-
ν
S
(
t
)
,
d
I
(
t
)
d
t
=
β
S
(
t
)
I
(
t
)
-
γ
I
(
t
)
-
α
I
(
t
)
-
ν
I
(
t
)
,
d
D
(
t
)
d
t
=
γ
I
(
t
)
-
γ
I
(
t
-
τ
)
-
ν
D
(
t
)
,
d
Q
(
t
)
d
t
=
α
I
(
t
)
-
δ
Q
(
t
)
-
ν
Q
(
t
)
.
The Jacobi matrix of (26) about E
*
(
S
*
,
I
*
,
D
*
,
Q
*
) is given by
(27)
J
(
E
*
)
=
(
-
β
I
*
-
ν
-
μ
-
β
S
*
-
μ
-
μ
-
μ
β
I
*
β
S
*
-
γ
-
α
-
ν
0
0
0
γ
-
γ
e
-
λ
τ
-
ν
0
0
α
0
-
δ
-
μ
)
.
The characteristic equation of that matrix can be obtained by
(28)
P
(
λ
)
+
Q
(
λ
)
e
-
λ
τ
=
0
.
Let
(29)
p
3
=
a
+
b
+
c
+
ν
,
p
2
=
a
b
+
c
ν
+
(
a
+
b
)
(
ν
+
c
)
+
β
I
*
d
,
p
1
=
a
b
(
ν
+
c
)
+
ν
c
(
a
+
b
)
+
β
I
*
(
d
(
ν
+
c
)
+
μ
(
α
+
γ
)
)
,
p
0
=
a
b
c
ν
+
β
I
*
(
c
d
ν
+
α
μ
ν
+
c
μ
γ
)
,
q
1
=
-
μ
γ
β
I
*
,
q
0
=
-
β
μ
c
γ
I
*
,
where
(30)
a
=
β
I
*
+
ν
+
μ
,
b
=
γ
+
α
+
μ
-
β
S
*
,
c
=
δ
+
ν
,
d
=
β
S
*
+
μ
then
(31)
P
(
λ
)
=
λ
4
+
p
3
λ
3
+
p
2
λ
2
+
p
1
λ
+
p
0
,
Q
(
λ
)
=
q
1
λ
+
q
0
.Theorem 8.
The positive equilibriumE
* is locally asymptotically stable without time delay, if the following holds:(
H
2
)
p
3
>
0, d
1
>
0
,
d
2
>
0, (
p
1
+
q
1
)
d
1
-
p
3
2
d
2
>
0,where
(32)
d
1
=
p
3
p
2
-
(
p
1
+
q
1
)
,
d
2
=
p
0
+
q
0
.Proof.
Ifτ
=
0, (28) reduces to
(33)
λ
4
+
p
3
λ
3
+
p
2
λ
2
+
(
p
1
+
q
1
)
λ
+
(
p
0
+
q
0
)
=
0
.
According to Routh-Hurwitz criterion, all the roots of (33) have negative real parts. Therefore, it can be deduced that the positive equilibrium E
* is locally asymptotically stable without time delay. The proof is completed.Obviously,λ
=
i
ω
(
ω
>
0
) is a root of (28). After separating the real and imaginary parts, it can be written as
(34)
ω
4
-
p
2
ω
2
+
p
0
+
q
1
ω
sin
(
ω
τ
)
+
q
0
cos
⁡
(
ω
τ
)
=
0
,
-
p
3
ω
3
+
p
1
ω
+
q
1
ω
cos
⁡
(
ω
τ
)
-
q
0
sin
(
ω
τ
)
=
0
,
which implies
(35)
ω
6
+
D
3
ω
4
+
D
2
ω
2
+
D
1
=
0
,
where
(36)
D
3
=
p
3
2
-
2
p
2
,
D
2
=
p
2
2
+
2
p
0
-
2
p
1
p
3
,
D
1
=
p
1
2
-
q
1
2
-
2
p
2
p
0
.Letz
=
ω
2, and (35) can be written as
(37)
h
(
z
)
=
z
3
+
D
3
z
2
+
D
2
z
+
D
1
.
Δ is defined as Δ
=
D
3
2
-
3
D
2. Hence, we can get a solution z
*
=
(
Δ
-
D
3
)
/
3 of h
(
z
).Lemma 9.
Suppose that(
H
2
)
p
3
>
0, d
1
>
0, and d
2
>
0; (
p
1
+
q
1
)
d
1
-
p
3
2
d
2
>
0 is satisfied.(1)
If one of the following holds: (a)Δ
>
0, z
*
<
0; (b) Δ
>
0, z
*
>
0 and h
(
z
*
)
>
0. Then all roots of (28) have negative real parts when τ
∈
[
0
,
τ
0
), τ
0 is a certain positive constant.
(2)
If the conditions (a) and (b) are not satisfied, then all roots of (28) have negative real parts for all τ
≥
0.Proof.
whenτ
=
0, (28) can be reduced to
(38)
λ
4
+
p
3
λ
3
+
p
2
λ
2
+
(
p
1
+
q
1
)
λ
+
(
p
0
+
q
0
)
=
0
.
By the Routh-Hurwitz criterion, all roots of (33) have negative real parts and only if
(39)
p
3
>
0
,
d
1
>
0
,
d
2
>
0
,
(
p
1
+
q
1
)
d
1
-
p
3
2
d
2
>
0
.
Considering (37), it is easy to see from the characters of cubic algebraic equation that h
(
z
) is a strictly monotonically increasing function if Δ
≤
0. If Δ
>
0, z
*
<
0 or Δ
>
0, z
*
>
0 and h
(
z
*
)
>
0, then h
(
z
) has no positive root. Hence, (28) has no purely imaginary roots for any τ
>
0, which implies that the positive equilibrium E
*
(
S
*
,
I
*
,
D
*
,
Q
*
,
V
*
) of system (22) is absolutely stable. Therefore, the following theorem on the stability of positive equilibrium E
*
(
S
*
,
I
*
,
D
*
,
Q
*
,
V
*
) can be easily obtained.Theorem 10.
Assume that(
H
1
) and (
H
2
) are satisfied, and Δ
>
0, z
*
<
0 or Δ
>
0, z
*
>
0, and h
(
z
*
)
>
0, then the positive equilibrium E
*
(
S
*
,
I
*
,
D
*
,
Q
*
,
V
*
) of system (22) is absolutely stable. Namely, E
*
(
S
*
,
I
*
,
D
*
,
Q
*
,
V
*
) is asymptotically stable for any time delay τ
>
0.
Assume that the coefficients inh
(
z
) satisfy the condition as follows:(
H
3
)
Δ
>
0
,
z
*
>
0
,
h
(
z
*
)
<
0.
According to lemma, it is proved that (37) has at least a positive root ω
0, namely, the characteristic equation (28) has a pair of purely imaginary roots ±
i
ω
0.
In view of the fact that (28) has a pair of purely imaginary roots ±
i
ω
0, the corresponding τ
k
>
0 is given by eliminating sin
(
ω
τ
) in (34):
(40)
τ
k
=

1
ω
0
arccos
[

q
0
(

p
2
ω
0
2
-
ω
0
4
-
p
0

)
+
q
1
ω
0
(

p
3
ω
0
3
-
p
1
ω
0

)
q
1
2
ω
0
2
+
q
0
2

]
+
2
k
π
ω
0
(
k
=
0,1
,
2
,
…
)
.
Let λ
(
τ
)
=
v
(
τ
)
+
i
ω
(
τ
) be the root of (28), so that v
(
τ
k
)
=
0 and ω
(
τ
k
)
=
ω
0 are satisfied when τ
=
τ
k.Lemma 11.
Supposeh
′
(
z
0
)
≠
0. If τ
=
τ
0, then ±
i
ω
0 is a pair of purely imaginary roots of (28). In addition, if the conditions in Lemma 9 are satisfied, then
(41)
d
(
Re
λ
)
d
τ
|
τ
=
τ
k
>
0
.
This signifies that there exists at least one eigenvalue with positive real part forτ
>
τ
k. Differentiating both sides of (28) with respect to τ, it can be written as
(42)
(
d
λ
d
τ
)
-
1
=
(

4
λ
3
+
3
p
3
λ
2
+
2
p
2
λ
+
p
1

)
+
q
1
e
-
λ
τ
-
(

q
1
λ
+
q
0

)
τ
e
-
λ
τ
(
q
1
λ
+
q
0
)
λ
e
-
λ
τ
.
Therefore
(43)
sgn
⁡
[
d
Re
λ
d
τ
]
τ
=
τ
k
=
sgn
⁡
[
Re
(
d
λ
d
τ
)
-
1
]
λ
=
i
ω
0
=
sgn
⁡
ω
0
2
Γ
(
4
ω
0
6
+
3
D
3
ω
0
4
+
2
D
2
ω
0
2
+
D
1
)
=
sgn
⁡
ω
0
2
Γ
{
h
′
(
ω
0
2
)
}
=
sgn
⁡
{
h
′
(
ω
0
2
)
}
,
where Γ
=
q
1
2
ω
0
4
+
q
0
ω
0
2; then it follows the hypothesis (
H
3
) that h
′
(
ω
0
2
)
≠
0.
Hence,(44)
d
(
Re
λ
)
d
τ
|
τ
=
τ
k
>
0
.
The root of characteristic equation (28) crosses from left to right on the imaginary axis as τ continuously varies from a value less than τ
k to one greater than τ
k according to Routh’s theorem. Therefore, according to the Hopf bifurcation theorem for functional differential equations, the transverse condition holds and the conditions for Hopf bifurcation are satisfied at τ
=
τ
k. Then the following result can be obtained.Theorem 12.
Suppose that the conditions(
H
1
) and (
H
2
) are satisfied.(1)
EquilibriumE
*
(
S
*
,
I
*
,
D
*
,
Q
*
,
V
*
) is locally asymptotically stable when τ
∈
[
0
,
τ
0
), but unstable when τ
>
τ
0.
(2)
If condition(
H
3
) is satisfied, the system will undergo Hopf bifurcation at the positive equilibrium E
*
(
S
*
,
I
*
,
D
*
,
Q
*
,
V
*
) when τ
=
τ
k
(
k
=
0,1
,
2
,
…
), where τ
k is defined by (40).
This implies that when time delayτ
<
τ
0, the system will be stable at its infection equilibrium point so that it is easy to control and eliminate worms; when τ
≥
τ
0, the system will be unstable but the threshold τ
0 is greater than delayed model’s, which illustrates the model with constant quarantine strategy gets stable easier and the users have more time to remove worms.


## 4.1. Using Constant Quarantine Strategy to Model a Delayed Worm Propagation

Misuse intrusion detection system builds a database with the feature of known attack behaviors. The system can recognize the invaders once their behaviors agree with one of the databases and accurately detect known worms [12]. By applying misuse intrusion detection system for its relatively high accuracy, we add a new state called quarantine state (Q) [9], but only infected hosts will be quarantined. Q
(
t
) denote the number of quarantined hosts at time t. Unlike the quarantine strategy against epidemics, the implementation of constant quarantine strategy depends on the misuse intrusion detection system. Infected hosts will be quarantined at rate α which depends on the performance of intrusion detection system and network devices. When infected hosts are quarantined, they will get rid of worms and get patched at rate δ. The state transition diagram of constant quarantine model is given in Figure 2.Figure 2
State transition diagram of constant quarantine model.


## 4.2. Description of Constant Quarantine Model

According to the definitions above in the paper, the differential equations of constant quarantine model are given as follows:(22)
d
S
(
t
)
d
t
=
p
ν
N
-
β
S
(
t
)
I
(
t
)
+
μ
V
(
t
)
-
ν
S
(
t
)
,
d
I
(
t
)
d
t
=
β
S
(
t
)
I
(
t
)
-
I
(
t
)
-
α
I
(
t
)
-
ν
I
(
t
)
,
d
D
(
t
)
d
t
=
γ
I
(
t
)
-
γ
I
(
t
-
τ
)
-
ν
D
(
t
)
,
d
Q
(
t
)
d
t
=
α
I
(
t
)
-
δ
Q
(
t
)
-
ν
Q
(
t
)
,
d
V
(
t
)
d
t
=
γ
I
(
t
-
τ
)
+
δ
Q
(
t
)
-
μ
V
(
t
)
+
(
1
-
p
)
ν
N
-
ν
V
(
t
)
.
Similarly,
(23)
S
(
t
)
+
I
(
t
)
+
D
(
t
)
+
Q
(
t
)
+
V
(
t
)
=
N
.


## 4.3. Stability of the Positive Equilibrium and Bifurcation Analysis

Theorem 7.
The system has a unique positive equilibriumE
*
(
S
*
,
I
*
,
D
*
,
Q
*
,
V
*
) when it satisfies the following condition:(
H
1
)
β
N
(
μ
+
p
ν
)
/
μ
(
μ
+
ν
)
(
γ
+
α
+
ν
)
>
1, where S
*
=
(
γ
+
α
+
ν
)
/
β, D
*
=
0, Q
*
=
(
α
/
(
δ
+
ν
)
)
I
*, V
*
=
(
(
γ
+
α
+
ν
)
/
μ
)
(
ν
/
β
+
I
*
)
-
p
ν
N
/
μ.Proof.
For system (22), if all the derivatives on the left of equal sign of the system are set to 0, which implies that the system becomes stable, we can get
(24)
S
=
γ
+
α
+
ν
β
,
D
=
0
,
Q
=
α
δ
+
ν
I
*
,
V
=
γ
+
α
+
ν
μ
(
ν
β
+
I
*
)
-
p
ν
N
μ
.
Substituting the value of each variable in (24) for each of (23), then we can get
(25)
S
*
+
α
δ
+
ν
I
*
+
I
*
+
γ
+
α
+
ν
μ
(
ν
β
+
I
*
)
-
p
ν
N
μ
=
N
.
Obviously, if(
H
1
) is satisfied, (25) has one unique positive root I
*, and there is one unique positive equilibrium E
*
(
S
*
,
I
*
,
D
*
,
Q
*
,
V
*
) of system (22). The proof is completed.According to (23), V
(
t
)
=
N
-
S
(
t
)
-
I
(
t
)
-
D
(
t
)
-
Q
(
t
); thus, system (22) can be simplified to
(26)
d
S
(
t
)
d
t
=
p
ν
N
+
μ
(
N
-
S
(
t
)
-
I
(
t
)
-
D
(
t
)
-
Q
(
t
)
)
m
m
m
m
l
-
β
S
(
t
)
I
(
t
)
-
ν
S
(
t
)
,
d
I
(
t
)
d
t
=
β
S
(
t
)
I
(
t
)
-
γ
I
(
t
)
-
α
I
(
t
)
-
ν
I
(
t
)
,
d
D
(
t
)
d
t
=
γ
I
(
t
)
-
γ
I
(
t
-
τ
)
-
ν
D
(
t
)
,
d
Q
(
t
)
d
t
=
α
I
(
t
)
-
δ
Q
(
t
)
-
ν
Q
(
t
)
.
The Jacobi matrix of (26) about E
*
(
S
*
,
I
*
,
D
*
,
Q
*
) is given by
(27)
J
(
E
*
)
=
(
-
β
I
*
-
ν
-
μ
-
β
S
*
-
μ
-
μ
-
μ
β
I
*
β
S
*
-
γ
-
α
-
ν
0
0
0
γ
-
γ
e
-
λ
τ
-
ν
0
0
α
0
-
δ
-
μ
)
.
The characteristic equation of that matrix can be obtained by
(28)
P
(
λ
)
+
Q
(
λ
)
e
-
λ
τ
=
0
.
Let
(29)
p
3
=
a
+
b
+
c
+
ν
,
p
2
=
a
b
+
c
ν
+
(
a
+
b
)
(
ν
+
c
)
+
β
I
*
d
,
p
1
=
a
b
(
ν
+
c
)
+
ν
c
(
a
+
b
)
+
β
I
*
(
d
(
ν
+
c
)
+
μ
(
α
+
γ
)
)
,
p
0
=
a
b
c
ν
+
β
I
*
(
c
d
ν
+
α
μ
ν
+
c
μ
γ
)
,
q
1
=
-
μ
γ
β
I
*
,
q
0
=
-
β
μ
c
γ
I
*
,
where
(30)
a
=
β
I
*
+
ν
+
μ
,
b
=
γ
+
α
+
μ
-
β
S
*
,
c
=
δ
+
ν
,
d
=
β
S
*
+
μ
then
(31)
P
(
λ
)
=
λ
4
+
p
3
λ
3
+
p
2
λ
2
+
p
1
λ
+
p
0
,
Q
(
λ
)
=
q
1
λ
+
q
0
.Theorem 8.
The positive equilibriumE
* is locally asymptotically stable without time delay, if the following holds:(
H
2
)
p
3
>
0, d
1
>
0
,
d
2
>
0, (
p
1
+
q
1
)
d
1
-
p
3
2
d
2
>
0,where
(32)
d
1
=
p
3
p
2
-
(
p
1
+
q
1
)
,
d
2
=
p
0
+
q
0
.Proof.
Ifτ
=
0, (28) reduces to
(33)
λ
4
+
p
3
λ
3
+
p
2
λ
2
+
(
p
1
+
q
1
)
λ
+
(
p
0
+
q
0
)
=
0
.
According to Routh-Hurwitz criterion, all the roots of (33) have negative real parts. Therefore, it can be deduced that the positive equilibrium E
* is locally asymptotically stable without time delay. The proof is completed.Obviously,λ
=
i
ω
(
ω
>
0
) is a root of (28). After separating the real and imaginary parts, it can be written as
(34)
ω
4
-
p
2
ω
2
+
p
0
+
q
1
ω
sin
(
ω
τ
)
+
q
0
cos
⁡
(
ω
τ
)
=
0
,
-
p
3
ω
3
+
p
1
ω
+
q
1
ω
cos
⁡
(
ω
τ
)
-
q
0
sin
(
ω
τ
)
=
0
,
which implies
(35)
ω
6
+
D
3
ω
4
+
D
2
ω
2
+
D
1
=
0
,
where
(36)
D
3
=
p
3
2
-
2
p
2
,
D
2
=
p
2
2
+
2
p
0
-
2
p
1
p
3
,
D
1
=
p
1
2
-
q
1
2
-
2
p
2
p
0
.Letz
=
ω
2, and (35) can be written as
(37)
h
(
z
)
=
z
3
+
D
3
z
2
+
D
2
z
+
D
1
.
Δ is defined as Δ
=
D
3
2
-
3
D
2. Hence, we can get a solution z
*
=
(
Δ
-
D
3
)
/
3 of h
(
z
).Lemma 9.
Suppose that(
H
2
)
p
3
>
0, d
1
>
0, and d
2
>
0; (
p
1
+
q
1
)
d
1
-
p
3
2
d
2
>
0 is satisfied.(1)
If one of the following holds: (a)Δ
>
0, z
*
<
0; (b) Δ
>
0, z
*
>
0 and h
(
z
*
)
>
0. Then all roots of (28) have negative real parts when τ
∈
[
0
,
τ
0
), τ
0 is a certain positive constant.
(2)
If the conditions (a) and (b) are not satisfied, then all roots of (28) have negative real parts for all τ
≥
0.Proof.
whenτ
=
0, (28) can be reduced to
(38)
λ
4
+
p
3
λ
3
+
p
2
λ
2
+
(
p
1
+
q
1
)
λ
+
(
p
0
+
q
0
)
=
0
.
By the Routh-Hurwitz criterion, all roots of (33) have negative real parts and only if
(39)
p
3
>
0
,
d
1
>
0
,
d
2
>
0
,
(
p
1
+
q
1
)
d
1
-
p
3
2
d
2
>
0
.
Considering (37), it is easy to see from the characters of cubic algebraic equation that h
(
z
) is a strictly monotonically increasing function if Δ
≤
0. If Δ
>
0, z
*
<
0 or Δ
>
0, z
*
>
0 and h
(
z
*
)
>
0, then h
(
z
) has no positive root. Hence, (28) has no purely imaginary roots for any τ
>
0, which implies that the positive equilibrium E
*
(
S
*
,
I
*
,
D
*
,
Q
*
,
V
*
) of system (22) is absolutely stable. Therefore, the following theorem on the stability of positive equilibrium E
*
(
S
*
,
I
*
,
D
*
,
Q
*
,
V
*
) can be easily obtained.Theorem 10.
Assume that(
H
1
) and (
H
2
) are satisfied, and Δ
>
0, z
*
<
0 or Δ
>
0, z
*
>
0, and h
(
z
*
)
>
0, then the positive equilibrium E
*
(
S
*
,
I
*
,
D
*
,
Q
*
,
V
*
) of system (22) is absolutely stable. Namely, E
*
(
S
*
,
I
*
,
D
*
,
Q
*
,
V
*
) is asymptotically stable for any time delay τ
>
0.
Assume that the coefficients inh
(
z
) satisfy the condition as follows:(
H
3
)
Δ
>
0
,
z
*
>
0
,
h
(
z
*
)
<
0.
According to lemma, it is proved that (37) has at least a positive root ω
0, namely, the characteristic equation (28) has a pair of purely imaginary roots ±
i
ω
0.
In view of the fact that (28) has a pair of purely imaginary roots ±
i
ω
0, the corresponding τ
k
>
0 is given by eliminating sin
(
ω
τ
) in (34):
(40)
τ
k
=

1
ω
0
arccos
[

q
0
(

p
2
ω
0
2
-
ω
0
4
-
p
0

)
+
q
1
ω
0
(

p
3
ω
0
3
-
p
1
ω
0

)
q
1
2
ω
0
2
+
q
0
2

]
+
2
k
π
ω
0
(
k
=
0,1
,
2
,
…
)
.
Let λ
(
τ
)
=
v
(
τ
)
+
i
ω
(
τ
) be the root of (28), so that v
(
τ
k
)
=
0 and ω
(
τ
k
)
=
ω
0 are satisfied when τ
=
τ
k.Lemma 11.
Supposeh
′
(
z
0
)
≠
0. If τ
=
τ
0, then ±
i
ω
0 is a pair of purely imaginary roots of (28). In addition, if the conditions in Lemma 9 are satisfied, then
(41)
d
(
Re
λ
)
d
τ
|
τ
=
τ
k
>
0
.
This signifies that there exists at least one eigenvalue with positive real part forτ
>
τ
k. Differentiating both sides of (28) with respect to τ, it can be written as
(42)
(
d
λ
d
τ
)
-
1
=
(

4
λ
3
+
3
p
3
λ
2
+
2
p
2
λ
+
p
1

)
+
q
1
e
-
λ
τ
-
(

q
1
λ
+
q
0

)
τ
e
-
λ
τ
(
q
1
λ
+
q
0
)
λ
e
-
λ
τ
.
Therefore
(43)
sgn
⁡
[
d
Re
λ
d
τ
]
τ
=
τ
k
=
sgn
⁡
[
Re
(
d
λ
d
τ
)
-
1
]
λ
=
i
ω
0
=
sgn
⁡
ω
0
2
Γ
(
4
ω
0
6
+
3
D
3
ω
0
4
+
2
D
2
ω
0
2
+
D
1
)
=
sgn
⁡
ω
0
2
Γ
{
h
′
(
ω
0
2
)
}
=
sgn
⁡
{
h
′
(
ω
0
2
)
}
,
where Γ
=
q
1
2
ω
0
4
+
q
0
ω
0
2; then it follows the hypothesis (
H
3
) that h
′
(
ω
0
2
)
≠
0.
Hence,(44)
d
(
Re
λ
)
d
τ
|
τ
=
τ
k
>
0
.
The root of characteristic equation (28) crosses from left to right on the imaginary axis as τ continuously varies from a value less than τ
k to one greater than τ
k according to Routh’s theorem. Therefore, according to the Hopf bifurcation theorem for functional differential equations, the transverse condition holds and the conditions for Hopf bifurcation are satisfied at τ
=
τ
k. Then the following result can be obtained.Theorem 12.
Suppose that the conditions(
H
1
) and (
H
2
) are satisfied.(1)
EquilibriumE
*
(
S
*
,
I
*
,
D
*
,
Q
*
,
V
*
) is locally asymptotically stable when τ
∈
[
0
,
τ
0
), but unstable when τ
>
τ
0.
(2)
If condition(
H
3
) is satisfied, the system will undergo Hopf bifurcation at the positive equilibrium E
*
(
S
*
,
I
*
,
D
*
,
Q
*
,
V
*
) when τ
=
τ
k
(
k
=
0,1
,
2
,
…
), where τ
k is defined by (40).
This implies that when time delayτ
<
τ
0, the system will be stable at its infection equilibrium point so that it is easy to control and eliminate worms; when τ
≥
τ
0, the system will be unstable but the threshold τ
0 is greater than delayed model’s, which illustrates the model with constant quarantine strategy gets stable easier and the users have more time to remove worms.


## 5. A Delayed Worm Propagation Model with Impulsive Quarantine

### 5.1. Using Impulsive Quarantine Strategy to Model a Delayed Worm Propagation

Although constant quarantine strategy based on misuse intrusion detection does improve vaccination effect, the system is out of control and bifurcation is still not eliminated. In addition, the system fails to detect unknown worms and worm-variants. Anomaly intrusion detection system is of help in detecting these kinds of worm. However, the system is accompanied by high false-positive rate. To solve the problem of constant quarantine strategy and anomaly intrusion detection system, we proposed a novel quarantine strategy called impulsive quarantine based on a hybrid intrusion detection system, which can make up for the gaps existing in the two systems. Impulsive quarantine is implemented as follows: constant quarantine of infected hosts found by the misuse detection is performed, while susceptible and infected hosts detected by anomaly detection are quarantined in an impulsive way everyT units of time. The advantages of this strategy lie in both avoiding a high false-positive rate caused by anomaly detection and making up for the insufficiency of the misuse detection in detecting unknown worms [12]. Impulsive quarantine strategy adds two transitions as a result of the influence of the anomaly detection method. The susceptible and infected hosts detected by anomaly detection method are quarantined at rate θ
1 and θ
2, respectively. Other settings are identical to those of constant quarantine model.The state transition diagram of impulsive quarantine model is given in Figure3.Figure 3
State transition diagram of impulsive quarantine model.


### 5.2. Description of Impulsive Quarantine Model

The complete differential equations of the impulsive quarantine model are showed as follows:(45)
d
S
(
t
)
d
t
=
p
ν
N
-
β
S
(
t
)
I
(
t
)
-
ν
S
(
t
)
+
μ
V
(
t
)
,
d
I
(
t
)
d
t
=
β
S
(
t
)
I
(
t
)
-
ν
I
(
t
)
-
γ
I
(
t
)
-
α
I
(
t
)
,
d
D
(
t
)
d
t
=
γ
I
(
t
)
-
γ
I
(
t
-
τ
)
-
ν
D
(
t
)
,
d
V
(
t
)
d
t
=
γ
I
(
t
-
τ
)
+
δ
Q
(
t
)
-
ν
V
(
t
)
-
ω
V
(
t
)
+
(
1
-
p
)
ν
N
,
d
Q
(
t
)
d
t
=
α
I
(
t
)
-
δ
Q
(
t
)
-
ν
Q
(
t
)
,
d
Q
(
t
)
d
t
=
γ
I
(
t
-
τ
)
+
δ
Q
(
t
)
-
ν
V
(
t
)
-
ω
V
(
t
)
0000
+
t
≠
n
T
,
S
(
n
T
+
)
=
S
(
n
T
-
)
-
θ
1
S
(
n
T
-
)
,
I
(
n
T
+
)
=
I
(
n
T
-
)
-
θ
2
I
(
n
T
-
)
,
D
(
n
T
+
)
=
D
(
n
T
-
)
,
Q
(
n
T
+
)
=
Q
(
n
T
-
)
+
θ
1
S
(
n
T
-
)
+
θ
2
I
(
n
T
-
)
,
V
(
n
T
+
)
=
V
(
n
T
-
)
,
0000000000000000000000000000000
t
=
n
T
,
where n
=
0,1
,
2
,
…, the impulsive strategy is applied at a discrete time t
=
n
T, and T is the interval time of impulsive quarantine. n
T
+ is the moment at which we apply the nth impulsive quarantine measure, whereas n
T
- is the time just before the nth impulsive quarantine measure is applied.


### 5.3. Global Attractivity of Infection-Free Periodic Solution

We have(46)
S
(
t
)
+
I
(
t
)
+
D
(
t
)
+
Q
(
t
)
+
V
(
t
)
=
N
.
Since Q
(
t
)
=
N
-
S
(
t
)
-
I
(
t
)
-
D
(
t
)
-
V
(
t
), then system (45) can be rewritten as
(47)
d
S
(
t
)
d
t
=
p
ν
N
-
β
S
(
t
)
I
(
t
)
-
ν
S
(
t
)
+
μ
V
(
t
)
,
d
I
(
t
)
d
t
=
β
S
(
t
)
I
(
t
)
-
ν
I
(
t
)
-
γ
I
(
t
)
-
α
I
(
t
)
,
d
D
(
t
)
d
t
=
γ
I
(
t
)
-
γ
I
(
t
-
τ
)
-
ν
D
(
t
)
,
d
V
(
t
)
d
t
=
γ
I
(
t
-
τ
)
+
δ
(
N
-
S
(
t
)
-
I
(
t
)
-
D
(
t
)
-
V
(
t
)
)
d
V
(
t
)
d
t
-
μ
V
(
t
)
-
ν
V
(
t
)
+
(
1
-
p
)
ν
N
,
d
Q
(
t
)
d
t
=
α
I
(
t
)
-
δ
Q
(
t
)
-
ν
Q
(
t
)
,
00000000000000000000000000000000000000000
t
≠
n
T
,
S
(
n
T
+
)
=
S
(
n
T
-
)
-
θ
1
S
(
n
T
-
)
,
I
(
n
T
+
)
=
I
(
n
T
-
)
-
θ
2
I
(
n
T
-
)
,
D
(
n
T
+
)
=
D
(
n
T
-
)
,
Q
(
n
T
+
)
=
Q
(
n
T
-
)
+
θ
1
S
(
n
T
-
)
+
θ
2
I
(
n
T
-
)
,
V
(
n
T
+
)
=
V
(
n
T
-
)
,
00000000000000000000000000000000
t
=
n
T
.We may see that the first four equations in (47) are independent of the fourth equation. Therefore, the fourth equation can be omitted without loss of generality [21]. Hence, model (47) can be rewritten as
(48)
d
S
(
t
)
d
t
=
p
ν
N
-
β
S
(
t
)
I
(
t
)
-
ν
S
(
t
)
+
μ
V
(
t
)
,
d
I
(
t
)
d
t
=
β
S
(
t
)
I
(
t
)
-
ν
I
(
t
)
-
γ
I
(
t
)
-
α
I
(
t
)
,
d
D
(
t
)
d
t
=
γ
I
(
t
)
-
γ
I
(
t
-
τ
)
-
ν
D
(
t
)
,
d
V
(
t
)
d
t
=
γ
I
(
t
-
τ
)
+
δ
(
N
-
S
(
t
)
-
I
(
t
)
-
D
(
t
)
-
V
(
t
)
)
d
V
(
t
)
d
t
-
μ
V
(
t
)
-
ν
V
(
t
)
+
(
1
-
p
)
ν
N
,
00000000000000000000000000000000000000000
t
≠
n
T
,
S
(
n
T
+
)
=
S
(
n
T
-
)
-
θ
1
S
(
n
T
-
)
,
I
(
n
T
+
)
=
I
(
n
T
-
)
-
θ
2
I
(
n
T
-
)
,
D
(
n
T
+
)
=
D
(
n
T
-
)
,
V
(
n
T
+
)
=
V
(
n
T
-
)
,
000000000000000000000
t
=
n
T
.
In the following, we introduce some notations and definitions in subsequent sections.Let(49)
R
+
=
[
0
,
∞
)
,
R
+
4
=
{
Z
∈
R
4
:
Z
≥
0
}
.
Denote f
=
(
f
1
,
f
2
,
f
3
,
f
4
)
T, the map defined by the right hand of the four equations of system (48).LetC be the space of continuous functions on [
-
ω
,
0
] with uniform norm. The initial conditions for (48) are
(50)
(
ϕ
1
(
ζ
)
,
ϕ
2
(
ζ
)
,
ϕ
3
(
ζ
)
,
ϕ
4
(
ζ
)
)
∈
C
+
=
C
(
[
-
ω
,
0
]
,
R
+
4
)
,
ϕ
i
(
0
)
>
0
,
i
=
1,2
,
3,4
.Definition 13.
System (48) is said to be permanent if there exists a compact region Ω
0
∈
int
⁡
Ω such that every solution of system (48) with initial conditions (50) will eventually enter and remain in region Ω
0.The solution of system (48) is a piecewise continuous function Z
:
R
+
→
R
+
4, Z
(
t
) is continuous on [
n
T
,
(
n
+
1
)
T
], k
∈
Z
+, and Z
(
n
T
+
)
=
lim
⁡
t
→
n
T
+
Z
(
t
) exists. Obviously the smooth properties of f guarantee the global existence and uniqueness of solutions of system (48) for detail on fundamental properties of impulsive systems [22, 23]. The following lemma is obtained.Lemma 14.
SupposeZ
(
t
) is a solution of system (48) with initial conditions (50), then Z
(
t
)
≥
0 for all t
≥
0.
Denote(51)
Ω
=
{
(
S
,
I
,
D
,
V
)
∈
R
4
∣
S
≥
0
,
I
≥
0
,
D
≥
0
,
V
≥
0
}
.
It is easy to show that Ω is positively invariant with respect to (48) with initial conditions (48).Lemma 15 (see [21, 22]).
Consider the following equation:(52)
x
˙
(
t
)
=
a
1
x
(
t
-
ω
)
-
a
2
x
(
t
)
,
where a
1
,
a
2
,
ω
>
0; x
(
t
)
>
0 for -
ω
≤
t
≤
0.
We have(i)
ifa
1
<
a
2, then lim
⁡
t
→
∞
x
(
t
)
=
0,
(ii)
ifa
1
>
a
2, then lim
⁡
t
→
∞
x
(
t
)
=
+
∞.The proofs of case (i) and case (ii) are given in Theorems 2
.
1 [24] and 2
.
2 [25], respectively.
We first demonstrate the existence of the infection-free periodic solution, in which infected individuals are entirely absent from the population permanently, that is,I
(
t
)
=
0 for all t
≥
0. Under this condition, the S, D, and V must satisfy
(53)
d
S
(
t
)
d
t
=
p
ν
N
-
β
S
(
t
)
I
(
t
)
-
ν
S
(
t
)
+
μ
V
(
t
)
,
d
D
(
t
)
d
t
=
γ
I
(
t
)
-
γ
I
(
t
-
τ
)
-
ν
D
(
t
)
,
d
V
(
t
)
d
t
=
γ
I
(
t
-
τ
)
+
δ
(
N
-
S
(
t
)
-
I
(
t
)
-
D
(
t
)
-
V
(
t
)
)
d
V
(
t
)
d
t
-
μ
V
(
t
)
-
ν
V
(
t
)
+
(
1
-
p
)
ν
N
,
00000000000000000000000000000000000000000
t
≠
n
T
,
S
(
n
T
+
)
=
S
(
n
T
-
)
-
θ
1
S
(
n
T
-
)
,
D
(
n
T
+
)
=
D
(
n
T
-
)
,
V
(
n
T
+
)
=
V
(
n
T
-
)
,
000000000000000000000
t
=
n
T
.
First we show below that the susceptible populationS oscillates with period T, in synchronization with the periodic pulse vaccination. From the first and fourth equations of system (53), we have that
(54)
S
~
(
t
)
=
p
N
+
(
S
*
-
p
N
)
e
-
ν
(
t
-
n
T
)
,
n
T
<
t
≤
(
n
+
1
)
T
is globally asymptotically stable, where
(55)
S
*
=
p
N
(
1
-
θ
1
)
(
1
-
e
-
ν
T
)
(
1
-
(
1
-
θ
1
)
e
-
ν
T
)
.
From the second and fifth equations of system (53), we have lim
⁡
t
→
∞
D
(
t
)
=
0. Further, it follows from the third and sixth equations of system (53) that lim
⁡
t
→
∞
V
(
t
)
=
(
[
(
1
-
p
)
ν
+
δ
]
N
-
δ
S
~
(
t
)
)
/
(
δ
+
ν
+
μ
).Therefore(
S
~
(
t
)
,
0,0
,
(
[
(
1
-
p
)
ν
+
δ
]
N
-
δ
S
~
(
t
)
)
/
(
δ
+
ν
+
μ
)
) is the infection-free periodic solution of system (48). In the rest of this section, we establish the global attractivity condition for the infection-free periodic solution.Theorem 16.
The infection-free periodic solution(
S
~
(
t
)
,
0,0
,
(
[
(
1
-
p
)
ν
+
δ
]
N
-
δ
S
~
(
t
)
)
/
(
δ
+
ν
+
μ
)
) of system (48) is globally attractive provided that R
*
<
1, where
(56)
R
*
=
β
p
N
(
1
-
θ
1
)
(
1
-
e
-
ν
T
)
(
ν
+
γ
+
α
)
(
1
-
(
1
-
θ
1
)
e
-
μ
T
)
.Proof.
SinceR
*
<
1, we can choose ε
0
>
0 sufficiently small such that
(57)
β
(
p
N
(
1
-
θ
1
)
(
1
-
e
-
ν
T
)
(
1
-
(
1
-
θ
1
)
e
-
ν
T
)
+
ε
0
)
<
ν
+
γ
+
α
.
It follows from the first equation of (48) that
(58)
S
˙
(
t
)
≤
p
ν
N
-
ν
S
(
t
)
+
μ
V
(
t
)
.
Thus we consider the comparison impulsive differential system
(59)
x
˙
(
t
)
=
p
ν
N
-
ν
x
(
t
)
,
t
≠
n
T
x
(
n
T
+
)
=
(
1
-
θ
1
)
x
(
n
T
-
)
,
t
=
n
T
.
According to [26], we obtain that the periodic solution of system (59)
(60)
x
~
(
t
)
=
S
~
(
t
)
=
p
N
+
(
S
*
-
p
N
)
e
-
ν
(
t
-
n
T
)
,
m
m
m
m
m
n
T
<
t
≤
(
n
+
1
)
T
is globally asymptotically stable, where
(61)
x
*
=
S
*
=
p
N
(
1
-
θ
1
)
(
1
-
e
-
ν
T
)
1
-
(
1
-
θ
1
)
e
-
ν
T
.
Let(
S
(
t
)
,
I
(
t
)
,
D
(
t
)
,
V
(
t
)
) be the solution of system (48) with initial values (50) and let S
(
0
+
)
=
S
0
>
0
,
x
(
t
) be the solution of system (59) with initial value x
(
0
+
)
=
S
0. In view of the comparison theorem in impulsive differential equations [18, 19], there exists an integer n
1
>
0 such that
(62)
S
(
t
)
<
x
(
t
)
<
x
~
(
t
)
+
ε
0
,
n
T
<
t
≤
(
n
+
1
)
T
,
that is,
(63)
S
(
t
)
<
S
~
(
t
)
+
ε
0
≤
p
N
(
1
-
θ
1
)
(
1
-
e
-
ν
T
)
(
1
-
(
1
-
θ
1
)
e
-
ν
T
)
+
ε
0
≜
S
M
,
n
T
<
t
≤
(
n
+
1
)
T
,
n
>
n
1
,
where S
~
(
t
) is defined (55). Further, from the second equation of system (48), we know that (63) implies
(64)
I
˙
(
t
)
≤
β
S
M
I
(
t
)
-
(
ν
+
γ
+
α
)
I
(
t
)
,
t
>
n
T
,
n
>
n
1
.
Consider the following comparison differential system:
(65)
y
(
t
)
=
β
S
M
y
(
t
)
-
(
ν
+
γ
+
α
)
y
(
t
)
,
t
>
n
T
,
n
>
n
1
.
From (57), we have β
S
M
<
ν
+
γ
+
α. According to Lemma 15 we have lim
⁡
t
→
∞
⁡
y
(
t
)
=
0.
Let(
S
(
t
)
,
I
(
t
)
,
D
(
t
)
,
V
(
t
)
) be the solution of system (48) with initial values (50) and I
(
0
+
)
=
I
0
>
0; let y
(
t
) be the solution of system (65) with initial value y
(
0
+
)
=
I
0. Consider the second and the sixth equations of system (48); according to Lemma 15, we have limsup
⁡
t
→
∞
I
(
t
)
≤
limsup
⁡
t
→
∞
y
(
t
)
=
0. Incorporating into the positivity of I
(
t
), we know that
(66)
lim
⁡
t
→
∞
⁡
I
(
t
)
=
0
.
Therefore, for any ε
1
>
0 (sufficiently small), there exists an integer n
2
>
n
1 such that I
(
t
)
<
ε
1 for all t
>
n
2
T.
For the third equation of system (48), we have
(67)
D
˙
(
t
)
<
γ
ε
1
-
ν
D
(
t
)
for
t
>
n
2
T
.
Consider comparison differential equation, for t
>
n
2
T,
(68)
z
˙
(
t
)
=
γ
ε
1
-
ν
z
(
t
)
.
It is easy to see that z
(
t
)
=
γ
ε
1
/
ν. According to the comparison theorem, there is a n
3
>
n
2 such that, for all t
>
n
3
T,
(69)
D
(
t
)
≤
γ
ε
1
ν
+
ε
1
.
Therefore, in view of the positivity of D
(
t
) and sufficiently small ε
1, it follows from (69) that
(70)
lim
⁡
t
→
∞
⁡
D
(
t
)
=
0
.
Moreover, for the first equation of system (48), we have
(71)
S
˙
(
t
)
≥
p
ν
N
-
(
ν
+
β
ε
1
)
S
(
t
)
for
n
>
n
3
T
.
Consider the following equations, for t
>
n
T and n
>
n
3:
(72)
u
˙
(
t
)
=
p
ν
N
-
(
ν
+
β
ε
1
)
u
(
t
)
,
t
≠
n
T
,
u
(
n
T
+
)
=
(
1
-
θ
1
)
u
(
n
T
-
)
,
t
=
n
T
.
According to [27], we know that the periodic solution of system (72)
(73)
u
~
(
t
)
=
p
ν
N
ν
+
β
ε
1
+
(
u
*
-
p
ν
N
ν
+
β
ε
1
)
e
-
(
ν
+
β
ε
1
)
(
t
-
n
T
)
,
n
T
<
t
≤
(
n
+
1
)
T
is globally asymptotically stable, where
(74)
u
*
=
p
ν
N
ν
+
β
ε
1
(
1
-
θ
1
)
(
1
-
e
-
(
ν
+
β
ε
1
)
T
)
(
1
-
(
1
-
θ
1
)
e
-
(
ν
+
β
ε
1
)
T
)
.
According to the comparison theorem in impulsive differential equations, there exists an integer n
4
>
n
3 such that
(75)
S
(
t
)
>
u
~
(
t
)
-
ε
1
,
n
T
<
t
≤
(
n
+
1
)
,
n
>
n
4
.
Since that ε
1 is arbitrarily small, consider (63) and (75); we have that
(76)
S
~
(
t
)
=
p
N
(
1
-
θ
1
(
1
-
e
-
ν
T
)
1
-
(
1
-
θ
1
)
e
-
ν
T
e
-
ν
(
t
-
n
T
)
)
,
n
T
<
t
≤
(
n
+
1
)
T
is globally attractive, that is,
(77)
lim
⁡
t
→
∞
⁡
S
(
t
)
=
S
~
(
t
)
.
For the fourth equation of system (48), we have
(78)
V
˙
(
t
)
≤
[
δ
+
(
1
-
p
)
ν
]
N
-
δ
S
(
t
)
-
δ
V
(
t
)
-
μ
V
(
t
)
-
ν
V
(
t
)
for t
>
n
4
T.
It is easy to obtain that there is an
5
>
n
4 such that
(79)
V
(
t
)
<
[
δ
+
(
1
-
p
)
ν
]
N
-
δ
S
(
t
)
δ
+
ν
+
μ
+
ε
1
for
t
>
n
5
T
.
In a similar way, there is a n
6
>
n
5
:
(80)
V
(
t
)
>
[
δ
+
(
1
-
p
)
ν
]
N
-
δ
S
(
t
)
δ
+
ν
+
μ
-
ε
1
for
t
>
n
6
T
.
Since that ε
1 is arbitrarily small, consider (79) and (80); we have
(81)
lim
⁡
t
→
∞
⁡
V
(
t
)
=
(
(
(
θ
1
(
1
-
e
-
ν
T
)
)
(
1
-
(
1
-
θ
)
e
-
ν
T
)
)
[
δ
+
(
1
-
p
)
ν
]
N
m
m
m
m
l
-
δ
p
N
(
1
-
(
θ
1
(
1
-
e
-
ν
T
)
)
(
1
-
(
1
-
θ
)
e
-
ν
T
)
e
-
ν
(
t
-
n
T
)
)
(
(
θ
1
(
1
-
e
-
ν
T
)
)
(
1
-
(
1
-
θ
)
e
-
ν
T
)
)
)
×
(
δ
+
ν
+
μ
)
-
1
.
It follows from (66), (70), (77), and (81) that the infection-free periodic solution (
S
~
(
t
)
,
0,0
,
(
[
(
1
-
p
)
ν
+
δ
]
N
-
δ
S
~
(
t
)
)
/
(
δ
+
ν
+
μ
)
) is globally attractive. The proof of Theorem 16 is complete.


## 5.1. Using Impulsive Quarantine Strategy to Model a Delayed Worm Propagation

Although constant quarantine strategy based on misuse intrusion detection does improve vaccination effect, the system is out of control and bifurcation is still not eliminated. In addition, the system fails to detect unknown worms and worm-variants. Anomaly intrusion detection system is of help in detecting these kinds of worm. However, the system is accompanied by high false-positive rate. To solve the problem of constant quarantine strategy and anomaly intrusion detection system, we proposed a novel quarantine strategy called impulsive quarantine based on a hybrid intrusion detection system, which can make up for the gaps existing in the two systems. Impulsive quarantine is implemented as follows: constant quarantine of infected hosts found by the misuse detection is performed, while susceptible and infected hosts detected by anomaly detection are quarantined in an impulsive way everyT units of time. The advantages of this strategy lie in both avoiding a high false-positive rate caused by anomaly detection and making up for the insufficiency of the misuse detection in detecting unknown worms [12]. Impulsive quarantine strategy adds two transitions as a result of the influence of the anomaly detection method. The susceptible and infected hosts detected by anomaly detection method are quarantined at rate θ
1 and θ
2, respectively. Other settings are identical to those of constant quarantine model.The state transition diagram of impulsive quarantine model is given in Figure3.Figure 3
State transition diagram of impulsive quarantine model.


## 5.2. Description of Impulsive Quarantine Model

The complete differential equations of the impulsive quarantine model are showed as follows:(45)
d
S
(
t
)
d
t
=
p
ν
N
-
β
S
(
t
)
I
(
t
)
-
ν
S
(
t
)
+
μ
V
(
t
)
,
d
I
(
t
)
d
t
=
β
S
(
t
)
I
(
t
)
-
ν
I
(
t
)
-
γ
I
(
t
)
-
α
I
(
t
)
,
d
D
(
t
)
d
t
=
γ
I
(
t
)
-
γ
I
(
t
-
τ
)
-
ν
D
(
t
)
,
d
V
(
t
)
d
t
=
γ
I
(
t
-
τ
)
+
δ
Q
(
t
)
-
ν
V
(
t
)
-
ω
V
(
t
)
+
(
1
-
p
)
ν
N
,
d
Q
(
t
)
d
t
=
α
I
(
t
)
-
δ
Q
(
t
)
-
ν
Q
(
t
)
,
d
Q
(
t
)
d
t
=
γ
I
(
t
-
τ
)
+
δ
Q
(
t
)
-
ν
V
(
t
)
-
ω
V
(
t
)
0000
+
t
≠
n
T
,
S
(
n
T
+
)
=
S
(
n
T
-
)
-
θ
1
S
(
n
T
-
)
,
I
(
n
T
+
)
=
I
(
n
T
-
)
-
θ
2
I
(
n
T
-
)
,
D
(
n
T
+
)
=
D
(
n
T
-
)
,
Q
(
n
T
+
)
=
Q
(
n
T
-
)
+
θ
1
S
(
n
T
-
)
+
θ
2
I
(
n
T
-
)
,
V
(
n
T
+
)
=
V
(
n
T
-
)
,
0000000000000000000000000000000
t
=
n
T
,
where n
=
0,1
,
2
,
…, the impulsive strategy is applied at a discrete time t
=
n
T, and T is the interval time of impulsive quarantine. n
T
+ is the moment at which we apply the nth impulsive quarantine measure, whereas n
T
- is the time just before the nth impulsive quarantine measure is applied.


## 5.3. Global Attractivity of Infection-Free Periodic Solution

We have(46)
S
(
t
)
+
I
(
t
)
+
D
(
t
)
+
Q
(
t
)
+
V
(
t
)
=
N
.
Since Q
(
t
)
=
N
-
S
(
t
)
-
I
(
t
)
-
D
(
t
)
-
V
(
t
), then system (45) can be rewritten as
(47)
d
S
(
t
)
d
t
=
p
ν
N
-
β
S
(
t
)
I
(
t
)
-
ν
S
(
t
)
+
μ
V
(
t
)
,
d
I
(
t
)
d
t
=
β
S
(
t
)
I
(
t
)
-
ν
I
(
t
)
-
γ
I
(
t
)
-
α
I
(
t
)
,
d
D
(
t
)
d
t
=
γ
I
(
t
)
-
γ
I
(
t
-
τ
)
-
ν
D
(
t
)
,
d
V
(
t
)
d
t
=
γ
I
(
t
-
τ
)
+
δ
(
N
-
S
(
t
)
-
I
(
t
)
-
D
(
t
)
-
V
(
t
)
)
d
V
(
t
)
d
t
-
μ
V
(
t
)
-
ν
V
(
t
)
+
(
1
-
p
)
ν
N
,
d
Q
(
t
)
d
t
=
α
I
(
t
)
-
δ
Q
(
t
)
-
ν
Q
(
t
)
,
00000000000000000000000000000000000000000
t
≠
n
T
,
S
(
n
T
+
)
=
S
(
n
T
-
)
-
θ
1
S
(
n
T
-
)
,
I
(
n
T
+
)
=
I
(
n
T
-
)
-
θ
2
I
(
n
T
-
)
,
D
(
n
T
+
)
=
D
(
n
T
-
)
,
Q
(
n
T
+
)
=
Q
(
n
T
-
)
+
θ
1
S
(
n
T
-
)
+
θ
2
I
(
n
T
-
)
,
V
(
n
T
+
)
=
V
(
n
T
-
)
,
00000000000000000000000000000000
t
=
n
T
.We may see that the first four equations in (47) are independent of the fourth equation. Therefore, the fourth equation can be omitted without loss of generality [21]. Hence, model (47) can be rewritten as
(48)
d
S
(
t
)
d
t
=
p
ν
N
-
β
S
(
t
)
I
(
t
)
-
ν
S
(
t
)
+
μ
V
(
t
)
,
d
I
(
t
)
d
t
=
β
S
(
t
)
I
(
t
)
-
ν
I
(
t
)
-
γ
I
(
t
)
-
α
I
(
t
)
,
d
D
(
t
)
d
t
=
γ
I
(
t
)
-
γ
I
(
t
-
τ
)
-
ν
D
(
t
)
,
d
V
(
t
)
d
t
=
γ
I
(
t
-
τ
)
+
δ
(
N
-
S
(
t
)
-
I
(
t
)
-
D
(
t
)
-
V
(
t
)
)
d
V
(
t
)
d
t
-
μ
V
(
t
)
-
ν
V
(
t
)
+
(
1
-
p
)
ν
N
,
00000000000000000000000000000000000000000
t
≠
n
T
,
S
(
n
T
+
)
=
S
(
n
T
-
)
-
θ
1
S
(
n
T
-
)
,
I
(
n
T
+
)
=
I
(
n
T
-
)
-
θ
2
I
(
n
T
-
)
,
D
(
n
T
+
)
=
D
(
n
T
-
)
,
V
(
n
T
+
)
=
V
(
n
T
-
)
,
000000000000000000000
t
=
n
T
.
In the following, we introduce some notations and definitions in subsequent sections.Let(49)
R
+
=
[
0
,
∞
)
,
R
+
4
=
{
Z
∈
R
4
:
Z
≥
0
}
.
Denote f
=
(
f
1
,
f
2
,
f
3
,
f
4
)
T, the map defined by the right hand of the four equations of system (48).LetC be the space of continuous functions on [
-
ω
,
0
] with uniform norm. The initial conditions for (48) are
(50)
(
ϕ
1
(
ζ
)
,
ϕ
2
(
ζ
)
,
ϕ
3
(
ζ
)
,
ϕ
4
(
ζ
)
)
∈
C
+
=
C
(
[
-
ω
,
0
]
,
R
+
4
)
,
ϕ
i
(
0
)
>
0
,
i
=
1,2
,
3,4
.Definition 13.
System (48) is said to be permanent if there exists a compact region Ω
0
∈
int
⁡
Ω such that every solution of system (48) with initial conditions (50) will eventually enter and remain in region Ω
0.The solution of system (48) is a piecewise continuous function Z
:
R
+
→
R
+
4, Z
(
t
) is continuous on [
n
T
,
(
n
+
1
)
T
], k
∈
Z
+, and Z
(
n
T
+
)
=
lim
⁡
t
→
n
T
+
Z
(
t
) exists. Obviously the smooth properties of f guarantee the global existence and uniqueness of solutions of system (48) for detail on fundamental properties of impulsive systems [22, 23]. The following lemma is obtained.Lemma 14.
SupposeZ
(
t
) is a solution of system (48) with initial conditions (50), then Z
(
t
)
≥
0 for all t
≥
0.
Denote(51)
Ω
=
{
(
S
,
I
,
D
,
V
)
∈
R
4
∣
S
≥
0
,
I
≥
0
,
D
≥
0
,
V
≥
0
}
.
It is easy to show that Ω is positively invariant with respect to (48) with initial conditions (48).Lemma 15 (see [21, 22]).
Consider the following equation:(52)
x
˙
(
t
)
=
a
1
x
(
t
-
ω
)
-
a
2
x
(
t
)
,
where a
1
,
a
2
,
ω
>
0; x
(
t
)
>
0 for -
ω
≤
t
≤
0.
We have(i)
ifa
1
<
a
2, then lim
⁡
t
→
∞
x
(
t
)
=
0,
(ii)
ifa
1
>
a
2, then lim
⁡
t
→
∞
x
(
t
)
=
+
∞.The proofs of case (i) and case (ii) are given in Theorems 2
.
1 [24] and 2
.
2 [25], respectively.
We first demonstrate the existence of the infection-free periodic solution, in which infected individuals are entirely absent from the population permanently, that is,I
(
t
)
=
0 for all t
≥
0. Under this condition, the S, D, and V must satisfy
(53)
d
S
(
t
)
d
t
=
p
ν
N
-
β
S
(
t
)
I
(
t
)
-
ν
S
(
t
)
+
μ
V
(
t
)
,
d
D
(
t
)
d
t
=
γ
I
(
t
)
-
γ
I
(
t
-
τ
)
-
ν
D
(
t
)
,
d
V
(
t
)
d
t
=
γ
I
(
t
-
τ
)
+
δ
(
N
-
S
(
t
)
-
I
(
t
)
-
D
(
t
)
-
V
(
t
)
)
d
V
(
t
)
d
t
-
μ
V
(
t
)
-
ν
V
(
t
)
+
(
1
-
p
)
ν
N
,
00000000000000000000000000000000000000000
t
≠
n
T
,
S
(
n
T
+
)
=
S
(
n
T
-
)
-
θ
1
S
(
n
T
-
)
,
D
(
n
T
+
)
=
D
(
n
T
-
)
,
V
(
n
T
+
)
=
V
(
n
T
-
)
,
000000000000000000000
t
=
n
T
.
First we show below that the susceptible populationS oscillates with period T, in synchronization with the periodic pulse vaccination. From the first and fourth equations of system (53), we have that
(54)
S
~
(
t
)
=
p
N
+
(
S
*
-
p
N
)
e
-
ν
(
t
-
n
T
)
,
n
T
<
t
≤
(
n
+
1
)
T
is globally asymptotically stable, where
(55)
S
*
=
p
N
(
1
-
θ
1
)
(
1
-
e
-
ν
T
)
(
1
-
(
1
-
θ
1
)
e
-
ν
T
)
.
From the second and fifth equations of system (53), we have lim
⁡
t
→
∞
D
(
t
)
=
0. Further, it follows from the third and sixth equations of system (53) that lim
⁡
t
→
∞
V
(
t
)
=
(
[
(
1
-
p
)
ν
+
δ
]
N
-
δ
S
~
(
t
)
)
/
(
δ
+
ν
+
μ
).Therefore(
S
~
(
t
)
,
0,0
,
(
[
(
1
-
p
)
ν
+
δ
]
N
-
δ
S
~
(
t
)
)
/
(
δ
+
ν
+
μ
)
) is the infection-free periodic solution of system (48). In the rest of this section, we establish the global attractivity condition for the infection-free periodic solution.Theorem 16.
The infection-free periodic solution(
S
~
(
t
)
,
0,0
,
(
[
(
1
-
p
)
ν
+
δ
]
N
-
δ
S
~
(
t
)
)
/
(
δ
+
ν
+
μ
)
) of system (48) is globally attractive provided that R
*
<
1, where
(56)
R
*
=
β
p
N
(
1
-
θ
1
)
(
1
-
e
-
ν
T
)
(
ν
+
γ
+
α
)
(
1
-
(
1
-
θ
1
)
e
-
μ
T
)
.Proof.
SinceR
*
<
1, we can choose ε
0
>
0 sufficiently small such that
(57)
β
(
p
N
(
1
-
θ
1
)
(
1
-
e
-
ν
T
)
(
1
-
(
1
-
θ
1
)
e
-
ν
T
)
+
ε
0
)
<
ν
+
γ
+
α
.
It follows from the first equation of (48) that
(58)
S
˙
(
t
)
≤
p
ν
N
-
ν
S
(
t
)
+
μ
V
(
t
)
.
Thus we consider the comparison impulsive differential system
(59)
x
˙
(
t
)
=
p
ν
N
-
ν
x
(
t
)
,
t
≠
n
T
x
(
n
T
+
)
=
(
1
-
θ
1
)
x
(
n
T
-
)
,
t
=
n
T
.
According to [26], we obtain that the periodic solution of system (59)
(60)
x
~
(
t
)
=
S
~
(
t
)
=
p
N
+
(
S
*
-
p
N
)
e
-
ν
(
t
-
n
T
)
,
m
m
m
m
m
n
T
<
t
≤
(
n
+
1
)
T
is globally asymptotically stable, where
(61)
x
*
=
S
*
=
p
N
(
1
-
θ
1
)
(
1
-
e
-
ν
T
)
1
-
(
1
-
θ
1
)
e
-
ν
T
.
Let(
S
(
t
)
,
I
(
t
)
,
D
(
t
)
,
V
(
t
)
) be the solution of system (48) with initial values (50) and let S
(
0
+
)
=
S
0
>
0
,
x
(
t
) be the solution of system (59) with initial value x
(
0
+
)
=
S
0. In view of the comparison theorem in impulsive differential equations [18, 19], there exists an integer n
1
>
0 such that
(62)
S
(
t
)
<
x
(
t
)
<
x
~
(
t
)
+
ε
0
,
n
T
<
t
≤
(
n
+
1
)
T
,
that is,
(63)
S
(
t
)
<
S
~
(
t
)
+
ε
0
≤
p
N
(
1
-
θ
1
)
(
1
-
e
-
ν
T
)
(
1
-
(
1
-
θ
1
)
e
-
ν
T
)
+
ε
0
≜
S
M
,
n
T
<
t
≤
(
n
+
1
)
T
,
n
>
n
1
,
where S
~
(
t
) is defined (55). Further, from the second equation of system (48), we know that (63) implies
(64)
I
˙
(
t
)
≤
β
S
M
I
(
t
)
-
(
ν
+
γ
+
α
)
I
(
t
)
,
t
>
n
T
,
n
>
n
1
.
Consider the following comparison differential system:
(65)
y
(
t
)
=
β
S
M
y
(
t
)
-
(
ν
+
γ
+
α
)
y
(
t
)
,
t
>
n
T
,
n
>
n
1
.
From (57), we have β
S
M
<
ν
+
γ
+
α. According to Lemma 15 we have lim
⁡
t
→
∞
⁡
y
(
t
)
=
0.
Let(
S
(
t
)
,
I
(
t
)
,
D
(
t
)
,
V
(
t
)
) be the solution of system (48) with initial values (50) and I
(
0
+
)
=
I
0
>
0; let y
(
t
) be the solution of system (65) with initial value y
(
0
+
)
=
I
0. Consider the second and the sixth equations of system (48); according to Lemma 15, we have limsup
⁡
t
→
∞
I
(
t
)
≤
limsup
⁡
t
→
∞
y
(
t
)
=
0. Incorporating into the positivity of I
(
t
), we know that
(66)
lim
⁡
t
→
∞
⁡
I
(
t
)
=
0
.
Therefore, for any ε
1
>
0 (sufficiently small), there exists an integer n
2
>
n
1 such that I
(
t
)
<
ε
1 for all t
>
n
2
T.
For the third equation of system (48), we have
(67)
D
˙
(
t
)
<
γ
ε
1
-
ν
D
(
t
)
for
t
>
n
2
T
.
Consider comparison differential equation, for t
>
n
2
T,
(68)
z
˙
(
t
)
=
γ
ε
1
-
ν
z
(
t
)
.
It is easy to see that z
(
t
)
=
γ
ε
1
/
ν. According to the comparison theorem, there is a n
3
>
n
2 such that, for all t
>
n
3
T,
(69)
D
(
t
)
≤
γ
ε
1
ν
+
ε
1
.
Therefore, in view of the positivity of D
(
t
) and sufficiently small ε
1, it follows from (69) that
(70)
lim
⁡
t
→
∞
⁡
D
(
t
)
=
0
.
Moreover, for the first equation of system (48), we have
(71)
S
˙
(
t
)
≥
p
ν
N
-
(
ν
+
β
ε
1
)
S
(
t
)
for
n
>
n
3
T
.
Consider the following equations, for t
>
n
T and n
>
n
3:
(72)
u
˙
(
t
)
=
p
ν
N
-
(
ν
+
β
ε
1
)
u
(
t
)
,
t
≠
n
T
,
u
(
n
T
+
)
=
(
1
-
θ
1
)
u
(
n
T
-
)
,
t
=
n
T
.
According to [27], we know that the periodic solution of system (72)
(73)
u
~
(
t
)
=
p
ν
N
ν
+
β
ε
1
+
(
u
*
-
p
ν
N
ν
+
β
ε
1
)
e
-
(
ν
+
β
ε
1
)
(
t
-
n
T
)
,
n
T
<
t
≤
(
n
+
1
)
T
is globally asymptotically stable, where
(74)
u
*
=
p
ν
N
ν
+
β
ε
1
(
1
-
θ
1
)
(
1
-
e
-
(
ν
+
β
ε
1
)
T
)
(
1
-
(
1
-
θ
1
)
e
-
(
ν
+
β
ε
1
)
T
)
.
According to the comparison theorem in impulsive differential equations, there exists an integer n
4
>
n
3 such that
(75)
S
(
t
)
>
u
~
(
t
)
-
ε
1
,
n
T
<
t
≤
(
n
+
1
)
,
n
>
n
4
.
Since that ε
1 is arbitrarily small, consider (63) and (75); we have that
(76)
S
~
(
t
)
=
p
N
(
1
-
θ
1
(
1
-
e
-
ν
T
)
1
-
(
1
-
θ
1
)
e
-
ν
T
e
-
ν
(
t
-
n
T
)
)
,
n
T
<
t
≤
(
n
+
1
)
T
is globally attractive, that is,
(77)
lim
⁡
t
→
∞
⁡
S
(
t
)
=
S
~
(
t
)
.
For the fourth equation of system (48), we have
(78)
V
˙
(
t
)
≤
[
δ
+
(
1
-
p
)
ν
]
N
-
δ
S
(
t
)
-
δ
V
(
t
)
-
μ
V
(
t
)
-
ν
V
(
t
)
for t
>
n
4
T.
It is easy to obtain that there is an
5
>
n
4 such that
(79)
V
(
t
)
<
[
δ
+
(
1
-
p
)
ν
]
N
-
δ
S
(
t
)
δ
+
ν
+
μ
+
ε
1
for
t
>
n
5
T
.
In a similar way, there is a n
6
>
n
5
:
(80)
V
(
t
)
>
[
δ
+
(
1
-
p
)
ν
]
N
-
δ
S
(
t
)
δ
+
ν
+
μ
-
ε
1
for
t
>
n
6
T
.
Since that ε
1 is arbitrarily small, consider (79) and (80); we have
(81)
lim
⁡
t
→
∞
⁡
V
(
t
)
=
(
(
(
θ
1
(
1
-
e
-
ν
T
)
)
(
1
-
(
1
-
θ
)
e
-
ν
T
)
)
[
δ
+
(
1
-
p
)
ν
]
N
m
m
m
m
l
-
δ
p
N
(
1
-
(
θ
1
(
1
-
e
-
ν
T
)
)
(
1
-
(
1
-
θ
)
e
-
ν
T
)
e
-
ν
(
t
-
n
T
)
)
(
(
θ
1
(
1
-
e
-
ν
T
)
)
(
1
-
(
1
-
θ
)
e
-
ν
T
)
)
)
×
(
δ
+
ν
+
μ
)
-
1
.
It follows from (66), (70), (77), and (81) that the infection-free periodic solution (
S
~
(
t
)
,
0,0
,
(
[
(
1
-
p
)
ν
+
δ
]
N
-
δ
S
~
(
t
)
)
/
(
δ
+
ν
+
μ
)
) is globally attractive. The proof of Theorem 16 is complete.


## 6. Numerical and Simulation Experiments

In order to simulate the worm propagation in the real world, the parameters in the experiments are practical values. The Slammer worm is selected for experiments [10]. 750,000 hosts are picked as the population size, and the worm’s average scan rate is 3300 per second. The worm infection rate can be calculated as α
=
η
N
/
2
32
=
0.5763, which means that average 0.5763 hosts of all the hosts can be scanned by one host. The infection rate is β
=
3300
/
2
32
=
0.00000077, the recovery rate of infectious hosts is γ
=
0.19, the quarantine rate is α
=
0.15, and the removal rate of quarantined hosts is δ
=
0.04. The rest of the parameters are p
=
0.9, μ
=
0.031, and ν
=
0.026. At the beginning, there are 50 infected hosts, while others are susceptible. The following numerical analyses are supplement for the above results.


### 6.1. Numerical Experiments of Worm Propagation Model with Time Delay in Vaccination

According to the above parameters, as shown in Figure4, the curves of three kinds of host in system (1) are presented when τ
=
5
<
τ
0. All of the three kinds of host get stable quickly, which illustrates that E
* is asymptotically stable. It implies that the number of infected hosts stays very low and can be predicted. Further strategies can be developed and utilized to eliminate worms.Figure 4
Worm propagation trend of model with time delay whenτ
<
τ
0.However, when time delayτ gets increased and then reach the threshold τ
0, E
* will lose its stability and a bifurcation will occur. Figure 5 shows the susceptible, infected, and vaccinated hosts in system (1) when τ
=
100
>
τ
0. In this figure, we can clearly see that the number of infected hosts will outburst after a short period of peace and repeat again and again but not in the same period, which means that it is hard to predict the number of infected hosts and to develop further strategies to eliminate worms.Figure 5
Worm propagation trend of model with time delay whenτ
>
τ
0.In order to see the influence of time delay,τ is set to a different value each time with other parameters remaining the same. Figure 6 shows the number of infected hosts in the same coordinate with time delays τ
=
5, τ
=
15, τ
=
45, and τ
=
90. Initially, the four curves are overlapped, which means that time delay has little effect in the initial stage of worm propagation. With time delay increasing, the curve begins to oscillate. When time delay passes through the threshold τ
0, the infecting process gets unstable. Meanwhile, it can be discovered that the amplitude and period of the number of infected hosts get increased.Figure 6
Number of infected hosts whenτ is changed.In Figure7, the projection of the phase portrait of system (1) in (
S
,
I
,
V
)-space is presented when τ
=
35 and τ
=
45. In Figure 8, when τ
=
35, it is clear that the curve converges to a fixed point which suggests that the system is stable. When τ
=
45, the curve converges to a limit circle which implies that the system is unstable. Figure 9 shows bifurcation diagram with τ from 1 to 100; Hopf bifurcation will occur when τ
=
τ
0
=
38.The projection of the phase portrait of system (1) in (
S
,
I
,
V
)-space.
(a)
τ
=
35
(b)
τ
=
45The phase portrait of susceptible hostss
(
t
) and infected hosts I
(
t
).
(a)
τ
=
35
(b)
τ
=
45Figure 9
Bifurcation diagram of system (1) with τ from 1 to 100.


### 6.2. Numerical Experiments of Worm Propagation Model with Constant Quarantine Strategy

In order to show the impact of constant quarantine strategy, we analyze the numerical results after adopting the constant quarantine strategy. Further, we compare them with the worm propagation model with time delay.Figure10 shows the curves of three kinds of host in system (22) when τ
=
5
<
τ
0. All of the three kinds of host get stable quickly, which illustrates that E
* is asymptotically stable.Figure 10
Worm propagation trend of model with constant quarantine strategy whenτ
<
τ
0.When time delayτ gets increased and then reach the threshold τ
0, E
* will lose its stability and a bifurcation will occur. Figure 11 shows the susceptible, infected, and vaccinated hosts in system (22) when τ
=
100
>
τ
0. In this figure, we can clearly see that the number of infected hosts will outburst after a short period of peace and repeat again and again but the range is much less than delayed model’s. It implies that the constant quarantine strategy cannot eliminate the Hopf bifurcation, but it can reduce the max number of infected hosts.Figure 11
Worm propagation trend of model with constant quarantine strategy whenτ
>
τ
0.In Figure12, when τ
=
100
>
τ
0, it is clear that the maximum of infected hosts is diminished sharply from 220,000 to 38,000, which illustrates that constant quarantine strategy has much better inhibition impact than single vaccination. However, constant quarantine strategy cannot eliminate the Hopf bifurcation; the system is still unstable and out of control.Figure 12
Comparison of infected hosts before and after adopting constant quarantine strategy ifτ
>
τ
0.Figure13 shows the projection of the phase portrait of system (22) in (
S
,
I
,
V
)-space when τ
=
40 and τ
=
55. In Figure 14, when τ
=
40, it is clear that the curve converges to a fixed point which suggests that the system is stable. When τ
=
55, the curve converges to a limit circle which implies that the system is unstable. Figure 15 shows bifurcation diagram with τ from 1 to 90; we find that Hopf bifurcation will occur when τ
=
τ
0
=
46. The threshold is greater than delayed model’s, which illustrates the model gets stable easier and the users have more time to remove worms.The projection of the phase portrait of system (22) in (
S
,
I
,
V
)-space.
(a)
τ
=
40
(b)
τ
=
55The phase portrait of susceptible hostsS
(
t
) and infected hosts I
(
t
).
(a)
τ
=
40
(b)
τ
=
55Figure 15
Bifurcation diagram of system (22) with τ from 1 to 90.


### 6.3. Numerical Experiments of Worm Propagation Model with Impulsive Quarantine Strategy

The paper performs the numerical experiments and compares the results with constant quarantine model after using impulsive quarantine strategy. The interval time of impulsive quarantine is setT
=
10. The susceptible and infected hosts detected by the anomaly intrusion detection method are quarantined at rate θ
1
=
0.00002315 and θ
2
=
0.6, respectively. Other parameters are the same as constant quarantine model.Figure16 shows the curves of four kinds of host when τ
=
5
<
τ
0. All of the four kinds of host get stable more quickly, which illustrates that E
*is asymptotically stable. After using impulsive quarantine strategy, Figure 17 shows the curves of three kinds of hosts when τ
=
100
>
τ
0. All kinds of hosts get stable within 4 hours, which implies that Hopf bifurcation has been eliminated thoroughly. In Figure 18, the number of infected hosts has been shown without quarantine, adopting quarantine strategy, and impulsive quarantine strategy, respectively. It is clear that the number of infected hosts is almost 0 after using the impulsive quarantine strategy, which is even much less than model using constant quarantine strategy. The result means that the impulsive quarantine strategy works well. Thus, the system will be stable and controlled so that the worm will not break out again.Figure 16
Worm propagation trend of model with impulsive quarantine strategy whenτ
<
τ
0.Figure 17
Worm propagation trend of model with impulsive quarantine strategy whenτ
>
τ
0.Figure 18
Comparison of infected hosts without quarantine, adopting constant quarantine strategy and impulsive quarantine strategy, respectively, whenτ
>
τ
0.


### 6.4. Simulation Experiments

The discrete-time simulation is an expanded version of Zou’s program [8] simulating Code Red worm propagation. The system in our simulation experiment consists of 750,000 hosts that can reach each other directly, which is consistent with the numerical experiments, and there is no topology issue in our simulation. At the beginning of simulation, 50 hosts are randomly chosen to be infected and the others are all susceptible. In the simulation experiments, the implement of transition rates of the model is based on probability. Under the propagation parameters of the Slammer worm, some simulation experiments are performed. Figure 19 shows that numerical and simulation curve of infected hosts match well when using the constant quarantine strategy and Figure 20 shows that numerical and simulation curve of infected hosts match well after using the impulsive quarantine strategy, whatever the value of τ is.Comparison of numerical and simulation curve of the infected hosts of constant quarantine model.
(a)
τ
<
τ
0
(b)
τ
>
τ
0Comparison of numerical and simulation curve of the infected hosts of impulsive quarantine model.
(a)
(b)


## 6.1. Numerical Experiments of Worm Propagation Model with Time Delay in Vaccination

According to the above parameters, as shown in Figure4, the curves of three kinds of host in system (1) are presented when τ
=
5
<
τ
0. All of the three kinds of host get stable quickly, which illustrates that E
* is asymptotically stable. It implies that the number of infected hosts stays very low and can be predicted. Further strategies can be developed and utilized to eliminate worms.Figure 4
Worm propagation trend of model with time delay whenτ
<
τ
0.However, when time delayτ gets increased and then reach the threshold τ
0, E
* will lose its stability and a bifurcation will occur. Figure 5 shows the susceptible, infected, and vaccinated hosts in system (1) when τ
=
100
>
τ
0. In this figure, we can clearly see that the number of infected hosts will outburst after a short period of peace and repeat again and again but not in the same period, which means that it is hard to predict the number of infected hosts and to develop further strategies to eliminate worms.Figure 5
Worm propagation trend of model with time delay whenτ
>
τ
0.In order to see the influence of time delay,τ is set to a different value each time with other parameters remaining the same. Figure 6 shows the number of infected hosts in the same coordinate with time delays τ
=
5, τ
=
15, τ
=
45, and τ
=
90. Initially, the four curves are overlapped, which means that time delay has little effect in the initial stage of worm propagation. With time delay increasing, the curve begins to oscillate. When time delay passes through the threshold τ
0, the infecting process gets unstable. Meanwhile, it can be discovered that the amplitude and period of the number of infected hosts get increased.Figure 6
Number of infected hosts whenτ is changed.In Figure7, the projection of the phase portrait of system (1) in (
S
,
I
,
V
)-space is presented when τ
=
35 and τ
=
45. In Figure 8, when τ
=
35, it is clear that the curve converges to a fixed point which suggests that the system is stable. When τ
=
45, the curve converges to a limit circle which implies that the system is unstable. Figure 9 shows bifurcation diagram with τ from 1 to 100; Hopf bifurcation will occur when τ
=
τ
0
=
38.The projection of the phase portrait of system (1) in (
S
,
I
,
V
)-space.
(a)
τ
=
35
(b)
τ
=
45The phase portrait of susceptible hostss
(
t
) and infected hosts I
(
t
).
(a)
τ
=
35
(b)
τ
=
45Figure 9
Bifurcation diagram of system (1) with τ from 1 to 100.


## 6.2. Numerical Experiments of Worm Propagation Model with Constant Quarantine Strategy

In order to show the impact of constant quarantine strategy, we analyze the numerical results after adopting the constant quarantine strategy. Further, we compare them with the worm propagation model with time delay.Figure10 shows the curves of three kinds of host in system (22) when τ
=
5
<
τ
0. All of the three kinds of host get stable quickly, which illustrates that E
* is asymptotically stable.Figure 10
Worm propagation trend of model with constant quarantine strategy whenτ
<
τ
0.When time delayτ gets increased and then reach the threshold τ
0, E
* will lose its stability and a bifurcation will occur. Figure 11 shows the susceptible, infected, and vaccinated hosts in system (22) when τ
=
100
>
τ
0. In this figure, we can clearly see that the number of infected hosts will outburst after a short period of peace and repeat again and again but the range is much less than delayed model’s. It implies that the constant quarantine strategy cannot eliminate the Hopf bifurcation, but it can reduce the max number of infected hosts.Figure 11
Worm propagation trend of model with constant quarantine strategy whenτ
>
τ
0.In Figure12, when τ
=
100
>
τ
0, it is clear that the maximum of infected hosts is diminished sharply from 220,000 to 38,000, which illustrates that constant quarantine strategy has much better inhibition impact than single vaccination. However, constant quarantine strategy cannot eliminate the Hopf bifurcation; the system is still unstable and out of control.Figure 12
Comparison of infected hosts before and after adopting constant quarantine strategy ifτ
>
τ
0.Figure13 shows the projection of the phase portrait of system (22) in (
S
,
I
,
V
)-space when τ
=
40 and τ
=
55. In Figure 14, when τ
=
40, it is clear that the curve converges to a fixed point which suggests that the system is stable. When τ
=
55, the curve converges to a limit circle which implies that the system is unstable. Figure 15 shows bifurcation diagram with τ from 1 to 90; we find that Hopf bifurcation will occur when τ
=
τ
0
=
46. The threshold is greater than delayed model’s, which illustrates the model gets stable easier and the users have more time to remove worms.The projection of the phase portrait of system (22) in (
S
,
I
,
V
)-space.
(a)
τ
=
40
(b)
τ
=
55The phase portrait of susceptible hostsS
(
t
) and infected hosts I
(
t
).
(a)
τ
=
40
(b)
τ
=
55Figure 15
Bifurcation diagram of system (22) with τ from 1 to 90.


## 6.3. Numerical Experiments of Worm Propagation Model with Impulsive Quarantine Strategy

The paper performs the numerical experiments and compares the results with constant quarantine model after using impulsive quarantine strategy. The interval time of impulsive quarantine is setT
=
10. The susceptible and infected hosts detected by the anomaly intrusion detection method are quarantined at rate θ
1
=
0.00002315 and θ
2
=
0.6, respectively. Other parameters are the same as constant quarantine model.Figure16 shows the curves of four kinds of host when τ
=
5
<
τ
0. All of the four kinds of host get stable more quickly, which illustrates that E
*is asymptotically stable. After using impulsive quarantine strategy, Figure 17 shows the curves of three kinds of hosts when τ
=
100
>
τ
0. All kinds of hosts get stable within 4 hours, which implies that Hopf bifurcation has been eliminated thoroughly. In Figure 18, the number of infected hosts has been shown without quarantine, adopting quarantine strategy, and impulsive quarantine strategy, respectively. It is clear that the number of infected hosts is almost 0 after using the impulsive quarantine strategy, which is even much less than model using constant quarantine strategy. The result means that the impulsive quarantine strategy works well. Thus, the system will be stable and controlled so that the worm will not break out again.Figure 16
Worm propagation trend of model with impulsive quarantine strategy whenτ
<
τ
0.Figure 17
Worm propagation trend of model with impulsive quarantine strategy whenτ
>
τ
0.Figure 18
Comparison of infected hosts without quarantine, adopting constant quarantine strategy and impulsive quarantine strategy, respectively, whenτ
>
τ
0.


## 6.4. Simulation Experiments

The discrete-time simulation is an expanded version of Zou’s program [8] simulating Code Red worm propagation. The system in our simulation experiment consists of 750,000 hosts that can reach each other directly, which is consistent with the numerical experiments, and there is no topology issue in our simulation. At the beginning of simulation, 50 hosts are randomly chosen to be infected and the others are all susceptible. In the simulation experiments, the implement of transition rates of the model is based on probability. Under the propagation parameters of the Slammer worm, some simulation experiments are performed. Figure 19 shows that numerical and simulation curve of infected hosts match well when using the constant quarantine strategy and Figure 20 shows that numerical and simulation curve of infected hosts match well after using the impulsive quarantine strategy, whatever the value of τ is.Comparison of numerical and simulation curve of the infected hosts of constant quarantine model.
(a)
τ
<
τ
0
(b)
τ
>
τ
0Comparison of numerical and simulation curve of the infected hosts of impulsive quarantine model.
(a)
(b)


## 7. Conclusions

By considering that time delay leads to Hopf bifurcation so that the worm propagation system will be out of control, this paper proposes two quarantine strategies: constant quarantine and impulsive quarantine strategy to control the stability of worm propagation. Through theoretical analysis and simulation experiments, the following conclusions can be derived.(1)
In order to accord with actual facts in the real world, a worm propagation model with time delay in vaccination is constructed. The critical time delayτ
0 where Hopf bifurcation appears is obtained. When time delay τ
<
τ
0, the worm propagation system will stabilize at its infection equilibrium point, which is beneficial to implement a containment strategy to eliminate the worm completely. When time delay τ
≥
τ
0, Hopf bifurcation appears, implying that the system will be unstable and the worm cannot be effectively controlled.
(2)
Constant quarantine strategy based on misuse IDS has only some inhibition impact. Through theoretical analysis, the thresholdτ
0 is greater than delayed model’s so that the users have more time to clean worms. Nevertheless, constant quarantine strategy cannot eliminate bifurcation.
(3)
Impulsive quarantine strategy is proposed, which can both make up for the gaps existing in the misuse and anomaly IDS and eliminate bifurcation. Through theoretical analysis and numerical experiments, the numerical results match theoretical ones well, which fully support our analysis.Furthermore, various factors can affect worm propagation. The paper focuses on analyzing the influence of time delay. Other impact factors to worm propagation will be a major emphasis of our future research.



---

*Source: 369360-2014-04-28.xml*