# The Influence of User Protection Behaviors on the Control of Internet Worm Propagation

Authors: Yihong Li; Jinxiao Pan; Lipeng Song; Zhen Jin
Journal: Abstract and Applied Analysis
 (2013)

---

## Abstract

Computer users’ reactions to the outbreak of Internet worm directly determine the defense capability of the computer and play an important role in the spread of worm. In this paper, in order to characterize the impacts of adaptive user protection behaviors, an improved SIS model is proposed to describe the Internet worm propagation. The results of theoretical analysis indicate that the protective campaigns of users can indeed reduce the worm’s reproduction number to values less than one. But it may not be sufficient to eradicate the worm. In certain condition, a backward bifurcation leading to bistability can occur. These are new findings in the worm propagation model that bring new challenges to control the spread of the worm and further demonstrate the importance of user behaviors in controlling the worm  propagation. Corresponding to the analysis results, defense and control strategies are provided.


---

## Body

## 1. Introduction

A generalized Internet worm is a kind of computer program that can replicate itself and spread from one host to another through the network [1]. Internet worms are built to propagate without warning or user interaction with the characters of rapid pervasive speed, large invasive scale, and severe destructive power. In the modern information and network security, Internet worms have become one of the most serious security threats to the Internet [2].In order to effectively defense the Internet worm attack and reduce the damage caused by them, the propagation mechanism and control strategies of Internet worms have become active research topics. Mathematical models have been an important tool for investigating and quantifying such effects. Many research efforts have focused on developing effective worm propagation model to understand their propagation mechanisms and examine the effects of defensive measures [3–7]. However, all of these studies are focused on the computer host [8–10] and ignore the user behavior which is closely related to the worm propagation [11].As stated in [12], the most effective way to protect a host from worm is to patch. But it is almost impossible to achieve for some reasons, one of which is the lack of the security awareness of the computer user. It serves to show that user behaviors play an important role in the spread of Internet worm, and understanding the influence of these behaviors on the spread of worm can be a key to improve control efforts. Several studies have been carried out to evaluate the impact and role of the user behavior factors on worm propagation [13–19], but almost all of these studies are focused on the user’s habitual actions. However, in the real world, users can take actions to combat worm prevalence, and under different actions, there will be different worm prevalence processes [20]. Only a few recent attempts have considered the self-induced behavior changes users adopt during an outbreak. Some approaches model user behaviors by modifying infectious rate or removed rate [21, 22]. However, to fully understand the impact of user behaviors on worm dynamics, there still lacks a formulation of a general behavior worm model.In the actual network environment, during the outbreak of the Internet worm, the computer users may filter and block suspicious messages with a firewall, no longer browse websites that are suspicious, update the antivirus software to new version timely, and so forth, which can be called user protection behaviors. Certainly, these protection measures can cause associated costs. For instance, some important information may be filtered out, or the speed of the computer operation can be slowed down. Moreover, these bring some inconvenience to normal activities. So users always compare the risk of worm infection with the associated cost of protection measures and then make a personal decision according to the current situation of worm propagation. As a consequence, the states of the computers switch between vulnerable state and protected state relying on the corresponding protection behaviors of users. From this new perspective, in this paper the computers are categorized according to the user behavioral responses to the spread of worm. The degree of protection is different because of the difference of user’s attitudes, belief systems, opinions, awareness of the worm, and environment. For the sake of simplicity, the computers that have not been infected by the worm are divided into two classes roughly, where one is the vulnerable computers and the other one is the protected computers. Incorporated with the worm dynamics, we study the effect of user protection behaviors on worm propagation and control.The rest of this paper is organized as follows. In Section2, a worm propagation model coupled with user protection behaviors is established. The basic reproduction number is obtained in Section 3, and the equilibria and the corresponding stability are studied. In Section 4, we carry out some sensitivity analysis about the parameters. In the following section are the simulation results and control strategies. Finally, we conclude in Section 6 with a summary of our findings.


## 2. The Worm Propagation Model

We focus on studying the impact of the user behaviors on the worm propagation and control so as to provide theoretical basis for the worm control. Therefore, we shall exclusively consider the random-scanning worm, regardless of the topological structure of the network. That is, all computer hosts in the network are mixing homogeneously and have the vulnerabilities that can be used by the worm.All computers are divided into three classes: vulnerable computers (worm-free computers), protected computers, and infectious computers (computers that have been infected by the worm and can transmit it to the vulnerable computers). LetS1(t), S2(t), and I(t) denote, at time t, the numbers of vulnerable, protected, and infectious computers, respectively. Then S1(t)+S2(t)+I(t)=N(t) is the total number of computers.By carefully considering the features of Internet worm, the following hypotheses are made.(H1)
All newly connected computers are worm-free. These computers are connected to the Internet at positive constant∧, of which a fraction p is protected.(H2)
Computers are disconnected from the Internet at rateμ.(H3)
Infectious computers are cured at positive constant rateγ by running with antivirus software or reinstalling the system, of which a fraction q is protected.(H4)
Compared to the vulnerable computers, the protected ones have the smaller infection rate by worm. We utilize the fraction1-σ to measure the effect of reducing the infection rate due to the protection behaviors. σ=0 means the protection is completely effective in preventing infection, while σ=1 means the protection is utterly ineffective. In fact, we know the protection may not be 100% or completely useless, so we consider the case 0<σ<1, which is more realistic.(H5)
The transformation rate of a computer from vulnerable state to protected state isϕ. In the opposite direction, the transformation rate is θ.Integrating the user protection behaviors into the worm propagation, we have the following graphic of the state transition in Figure1.Figure 1
The flowchart of computer worm spreading.According to the flowchart, the worm propagation process that is coupled with the user protection behaviors can be described as the following model:(1)S˙1=(1-p)∧-β0IS1232-μS1-ϕS1+(1-q)γI+θS2,S˙2=p∧+ϕS1-σβ0IS2232-μS2+qγI-θS2,I˙=β0IS1232+σβ0IS2232-μI-γI,
where β0 denotes the infection rate of vulnerable computers due to the successful scans of an infectious computer per time step and σβ0 is the infection rate of protected computers due to the successful scans of an infectious computer per time step. The probability of successfully finding a vulnerable computer (protected computer) in one scan is S1/232(S2/232), where 232 is the size of IPv4 address space (the scanning space). Then, β0S1/232(σβ0S2/232) is the number of vulnerable computers (protected computers) infected by an infectious computer per time step. So β0IS1/232(σβ0IS2/232) is the number of vulnerable computers (protected computers) infected by infectious computers per time step.Summing up the three equations in system (1), we obtain
(2)dNdt=∧-μN.
When t→+∞, N→∧/μ≜N*. It is easy to see that system (1) can be shown to be mathematically well posed in the positive invariant region 𝔻={(S1,S2,I)∣0≤S1+S2+I≤N*} and solutions in 𝔻 exist for all positive time.Now, we take transformationx=S1/N*, y=S2/N*, z=I/N* to system (1). For convenience, S1, S2, and I are used to represent x, y, and z in the following equations:
(3)S˙1=(1-p)μ-βS1I-μS1-ϕS1+(1-q)γI+θS2,S˙2=pμ+ϕS1-σβS2I-μS2+qγI-θS2,I˙=βS1I+σβS2I-μI-γI,
where β=β0N*/232 and S1+S2+I=1 is satisfied.


## 3. The Analysis of Dynamical Behaviors

The objective of this section is to perform theoretical analysis of system (3). We first give the basic reproduction number. Secondly, we study the equilibria and their stability. Finally, we prove the occurrence of saddle-node bifurcation.


### 3.1. The Basic Reproduction Number

Usually, the basic reproduction number, denoted asR0, is “the expected number of secondary cases produced, in a completely susceptible population, by a typical infective individual” [23, 24]. Similarly, for a worm propagation model the basic reproduction number is defined as the average number of previously worm-free computers that are infected by a single infectious computer during its lifecycle. In our model, infectious computers come from two sources: those vulnerable (S10) that get infected and those protected (S20) that get infected. By the physical meanings of the system parameters in system (3) (or (1)), the following results are obtained:(a)
the average lifetime of an infectious computer isT=1/(μ+γ);(b)
an infectious computer converts a vulnerable computer to an infectious one at rateβ;(c)
an infectious computer converts a protected computer to an infectious one at rateσβ.Thus, the modified basic reproduction number with the protection measures is obtained as(4)Rpro=T(βS10+σβS20)=βμ+γ(S10+σS20)<βμ+γ=R0,
where R0=β/(μ+γ) is the basic reproduction number of the SIS model which does not consider the user protection behaviors. The expressions of S10 and S20 are given in (5). Obviously, the protection behaviors do reduce the basic reproduction number Rpro.


### 3.2. Stability and Bifurcation Analysis

#### 3.2.1. The Worm-Free Equilibrium and Its Stability

Equilibria are obtained by setting the right side of system (3) equal to zero. From the third equation in system (3), we can obtain I=0 or βS1+σβS2=μ+γ. If I=0, the model has a unique worm-free equilibrium:
(5)E0=(S10,S20,0),
where S10=((1-p)μ+θ)/(μ+θ+ϕ), S20=(pμ+ϕ)/(μ+θ+ϕ).To study the local stability of the equilibria, we first give the Jacobian matrix of system (3) at an arbitrary equilibrium:
(6)J=[-βI-μ-ϕθ-βS1+(1-q)γϕ-σβI-μ-θ-σβS2+qγβIσβIβS1+σβS2-(μ+γ)].
Then the corresponding characteristic polynomial at the worm-free equilibrium E0 is derived as
(7)P(λ)=(λ+μ)(λ+μ+θ+ϕ)×(λ+μ+γ-βS10-σβS20),
so we obtained that the eigenvalues at the worm-free equilibrium E0 are λ1=-μ, λ2=-(μ+θ+ϕ) and λ3=βS10+σβS20-(μ+γ)=(μ+γ)(Rpro-1), respectively. Consequentially, the following result is obtained.Theorem 1.
System (3) always has a trivial equilibrium E0, and if Rpro≤1, E0 is locally asymptotically stable.


#### 3.2.2. The Existence and Stability of Endemic Equilibrium

In this section, we study the existence and stability of the endemic equilibria for system (3).IfβS1+σβS2=μ+γ, combined with the second equation of system (3), we can obtain
(8)S1=(μ+γ)(σβI+μ+θ)-σqγβI-σβpμβ(σβI+μ+θ+σϕ),S2=qγβI+βpμ+ϕ(μ+γ)β(σβI+μ+θ+σϕ).
Then, substituting S1 and S2 into the first equation of system (3), a quadratic equation is given as
(9)AI2+BI+C=0
in terms of I, where
(10)A=σβ2,B=β[μ+θ+σϕ+σ(μ+γ)+qγ(1-σ)-σβ],C=(μ+γ)(μ+θ+ϕ)(1-Rpro).
Define Δ=B2-4AC; the number of endemic equilibria is dependent on the sign of B, C, and Δ. After calculation, we can obtain the following results.Theorem 2.
For system (3), consider the following.(1)
IfC<0(Rpro>1), (9) has a positive root I*=(-B+Δ)/2A. Correspondingly, system (3) has one endemic equilibrium E*.(2)
IfC=0(Rpro=1) and B<0, (9) also has a positive root I*=-B/A. Correspondingly, system (3) has one endemic equilibrium E*.(3)
IfC>0(Rpro<1), B<0, there will be three cases.
(i)
IfΔ>0, (9) has two positive roots I*1=(-B+Δ)/2A and I*2=(-B-Δ)/2A. Correspondingly, system (3) has two endemic equilibria E*1=(S1*1,S2*1,I*1) and E*2=(S1*2,S2*2,I*2).(ii)
IfΔ=0, (9) has a positive root I*=-B/2A; then system (3) has one endemic equilibrium E*.(iii)
IfΔ<0, (9) has no positive root, and system (3) has no endemic equilibrium.Now, we study the stability of endemic equilibria seriatim. Similar to Section3.2.1, the corresponding characteristic polynomial of an arbitrary endemic equilibrium is derived as
(11)Q(λ)=(λ+μ)[λ2+(βI+σβI+μ+θ+ϕ)λppppppppp+(2AI+B)Iβλ2].
Obviously, for any endemic equilibrium, there is an eigenvalue λ1=-μ<0. In order to study the other ones, we set
(12)f(λ)=λ2+(βI+σβI+μ+θ+ϕ)λ+(2AI+B)I.
Then the signs of eigenvalues corresponding to the endemic equilibrium are dependent on the distribution of the roots of f(λ)=0.Corresponding to the cases about the existence, we obtain the stability of endemic equilibrium in each case, which are stated as follows.Theorem 3.
For system (3), consider the following. (1)
IfC<0(Rpro>1), then I*=(-B+Δ)/2A, 2AI*+B=Δ>0. In this case, f(λ) has no intersection point with positive real axis; thus E* is locally asymptotically stable.(2)
IfC=0(Rpro=1) and B<0, then I*=-B/A, 2AI*+B=-B>0; same as case (1), E* is locally asymptotically stable.(3)
IfC>0(Rpro<1), B<0, there will be three cases.
(i)
IfΔ>0, for the positive root I*1=(-B+Δ)/2A, 2AI*1+B=Δ>0; same as the above, E*1=(S1*1,S2*2,I*1) is a stable node. For I*2=(-B-Δ)/2A, 2AI*2+B=-Δ<0; in this case, f(λ) has an intersection point with positive real axis, so E*2=(S1*2,S2*2,I*2) is a saddle point.(ii)
IfΔ=0, then I*=-B/2A, 2AI*+B=0; in this case, one of the eigenvalues corresponding to E* is equal to zero, so E* is a nonhyperbolic equilibrium.(iii)
IfΔ<0, system (3) has no endemic equilibrium.


#### 3.2.3. The Saddle Node and Bifurcation

According to Theorems2 and 3, we can see that under the conditions C>0(Rpro<1), B<0, and Δ=0, system (3) has one endemic equilibrium E*, and it is a nonhyperbolic equilibrium. Utilizing the center manifold theorem [25, 26] and the existence theorem [27], we studied the dynamical behavior near the equilibrium E*. Taking β as the bifurcation parameter, we prove that system (3) could experience saddle-node bifurcation. The detailed results are given as follows (the proofs of Theorems 4 and 5 are provided in Appendices A and B).Theorem 4.
IfC>0(Rpro<1), B<0, and Δ=0, system (3) has one positive equilibrium E*, and E* is a saddle node.Theorem 5.
System (3) experiences saddle-node bifurcation at the equilibrium x0=E* as the parameter β passes through the bifurcation value.From the above mathematical analysis, we can see that under certain parameter condition, system (3) would experience backward bifurcation. Combined with the theoretical results, we can rewrite the inequality conditions about C, B, and Δ=B2-4AC in terms of β:
(13)C<0(Rpro>1)⟺β>βC≜(μ+γ)(μ+θ+ϕ)μ(1-p)+θ+σϕ+σμp,B<0⟺β>βB≜μ+θ+σϕ+σ(μ+γ)+qγ(1-σ)σ,Δ>0⟺β>βΔ≜(((σ)-1σ(μ+γ)+(pμ+qγ)(1-σ)+pμ(1-σ)-(μ+θ+σϕ)(σ)-1)×(σ)-1)+(×(σ)-12(σ(1-σ)(μ+γ)(ϕ+pμ)ppppppp+(pμ+qγ)(1-σ)ppppppp×[pμ(1-σ)pppppppppp-(μ+θ+σϕ)])1/2×(σ)-1).βC, βB, and βΔ satisfy the following relationship
(14)βC>βB⟹βC>βΔ>βB.
Then
(15)Rpro′≜Rpro|β=βΔ=βΔμ+γ·(1-p)μ+θ+σ(pμ+ϕ)μ+θ+ϕ
becomes one critical threshold for system (3), and β>βΔ⇔Rpro>Rpro′. In addition, we can obtain Rpro′=1-(B2/4A) if Δ=0. Obviously, Rpro′<1.From Theorems1–5, we can obtain the following properties.Corollary 6.
For system (3),(1)
ifβC>βB and βΔ<β<βC, then two endemic equilibria exist, one of which is locally stable and competes with the locally stable worm-free equilibrium, which is the backward bifurcation (see Figure 2(b));(2)
otherwise, the worm-free equilibrium is the unique attractor whenRpro<1, which is the forward bifurcation (see Figure 2(a)).Bifurcation diagram. (a) Forward bifurcation case; (b) backward bifurcation case.
(a)
(b)These results can also be given in terms ofσ, ϕ, or θ, and in practice, these parameters are easily controlled. However, the expressions are more complicated. Therefore, we only give corresponding regions in numerical simulation.


## 3.1. The Basic Reproduction Number

Usually, the basic reproduction number, denoted asR0, is “the expected number of secondary cases produced, in a completely susceptible population, by a typical infective individual” [23, 24]. Similarly, for a worm propagation model the basic reproduction number is defined as the average number of previously worm-free computers that are infected by a single infectious computer during its lifecycle. In our model, infectious computers come from two sources: those vulnerable (S10) that get infected and those protected (S20) that get infected. By the physical meanings of the system parameters in system (3) (or (1)), the following results are obtained:(a)
the average lifetime of an infectious computer isT=1/(μ+γ);(b)
an infectious computer converts a vulnerable computer to an infectious one at rateβ;(c)
an infectious computer converts a protected computer to an infectious one at rateσβ.Thus, the modified basic reproduction number with the protection measures is obtained as(4)Rpro=T(βS10+σβS20)=βμ+γ(S10+σS20)<βμ+γ=R0,
where R0=β/(μ+γ) is the basic reproduction number of the SIS model which does not consider the user protection behaviors. The expressions of S10 and S20 are given in (5). Obviously, the protection behaviors do reduce the basic reproduction number Rpro.


## 3.2. Stability and Bifurcation Analysis

### 3.2.1. The Worm-Free Equilibrium and Its Stability

Equilibria are obtained by setting the right side of system (3) equal to zero. From the third equation in system (3), we can obtain I=0 or βS1+σβS2=μ+γ. If I=0, the model has a unique worm-free equilibrium:
(5)E0=(S10,S20,0),
where S10=((1-p)μ+θ)/(μ+θ+ϕ), S20=(pμ+ϕ)/(μ+θ+ϕ).To study the local stability of the equilibria, we first give the Jacobian matrix of system (3) at an arbitrary equilibrium:
(6)J=[-βI-μ-ϕθ-βS1+(1-q)γϕ-σβI-μ-θ-σβS2+qγβIσβIβS1+σβS2-(μ+γ)].
Then the corresponding characteristic polynomial at the worm-free equilibrium E0 is derived as
(7)P(λ)=(λ+μ)(λ+μ+θ+ϕ)×(λ+μ+γ-βS10-σβS20),
so we obtained that the eigenvalues at the worm-free equilibrium E0 are λ1=-μ, λ2=-(μ+θ+ϕ) and λ3=βS10+σβS20-(μ+γ)=(μ+γ)(Rpro-1), respectively. Consequentially, the following result is obtained.Theorem 1.
System (3) always has a trivial equilibrium E0, and if Rpro≤1, E0 is locally asymptotically stable.


### 3.2.2. The Existence and Stability of Endemic Equilibrium

In this section, we study the existence and stability of the endemic equilibria for system (3).IfβS1+σβS2=μ+γ, combined with the second equation of system (3), we can obtain
(8)S1=(μ+γ)(σβI+μ+θ)-σqγβI-σβpμβ(σβI+μ+θ+σϕ),S2=qγβI+βpμ+ϕ(μ+γ)β(σβI+μ+θ+σϕ).
Then, substituting S1 and S2 into the first equation of system (3), a quadratic equation is given as
(9)AI2+BI+C=0
in terms of I, where
(10)A=σβ2,B=β[μ+θ+σϕ+σ(μ+γ)+qγ(1-σ)-σβ],C=(μ+γ)(μ+θ+ϕ)(1-Rpro).
Define Δ=B2-4AC; the number of endemic equilibria is dependent on the sign of B, C, and Δ. After calculation, we can obtain the following results.Theorem 2.
For system (3), consider the following.(1)
IfC<0(Rpro>1), (9) has a positive root I*=(-B+Δ)/2A. Correspondingly, system (3) has one endemic equilibrium E*.(2)
IfC=0(Rpro=1) and B<0, (9) also has a positive root I*=-B/A. Correspondingly, system (3) has one endemic equilibrium E*.(3)
IfC>0(Rpro<1), B<0, there will be three cases.
(i)
IfΔ>0, (9) has two positive roots I*1=(-B+Δ)/2A and I*2=(-B-Δ)/2A. Correspondingly, system (3) has two endemic equilibria E*1=(S1*1,S2*1,I*1) and E*2=(S1*2,S2*2,I*2).(ii)
IfΔ=0, (9) has a positive root I*=-B/2A; then system (3) has one endemic equilibrium E*.(iii)
IfΔ<0, (9) has no positive root, and system (3) has no endemic equilibrium.Now, we study the stability of endemic equilibria seriatim. Similar to Section3.2.1, the corresponding characteristic polynomial of an arbitrary endemic equilibrium is derived as
(11)Q(λ)=(λ+μ)[λ2+(βI+σβI+μ+θ+ϕ)λppppppppp+(2AI+B)Iβλ2].
Obviously, for any endemic equilibrium, there is an eigenvalue λ1=-μ<0. In order to study the other ones, we set
(12)f(λ)=λ2+(βI+σβI+μ+θ+ϕ)λ+(2AI+B)I.
Then the signs of eigenvalues corresponding to the endemic equilibrium are dependent on the distribution of the roots of f(λ)=0.Corresponding to the cases about the existence, we obtain the stability of endemic equilibrium in each case, which are stated as follows.Theorem 3.
For system (3), consider the following. (1)
IfC<0(Rpro>1), then I*=(-B+Δ)/2A, 2AI*+B=Δ>0. In this case, f(λ) has no intersection point with positive real axis; thus E* is locally asymptotically stable.(2)
IfC=0(Rpro=1) and B<0, then I*=-B/A, 2AI*+B=-B>0; same as case (1), E* is locally asymptotically stable.(3)
IfC>0(Rpro<1), B<0, there will be three cases.
(i)
IfΔ>0, for the positive root I*1=(-B+Δ)/2A, 2AI*1+B=Δ>0; same as the above, E*1=(S1*1,S2*2,I*1) is a stable node. For I*2=(-B-Δ)/2A, 2AI*2+B=-Δ<0; in this case, f(λ) has an intersection point with positive real axis, so E*2=(S1*2,S2*2,I*2) is a saddle point.(ii)
IfΔ=0, then I*=-B/2A, 2AI*+B=0; in this case, one of the eigenvalues corresponding to E* is equal to zero, so E* is a nonhyperbolic equilibrium.(iii)
IfΔ<0, system (3) has no endemic equilibrium.


### 3.2.3. The Saddle Node and Bifurcation

According to Theorems2 and 3, we can see that under the conditions C>0(Rpro<1), B<0, and Δ=0, system (3) has one endemic equilibrium E*, and it is a nonhyperbolic equilibrium. Utilizing the center manifold theorem [25, 26] and the existence theorem [27], we studied the dynamical behavior near the equilibrium E*. Taking β as the bifurcation parameter, we prove that system (3) could experience saddle-node bifurcation. The detailed results are given as follows (the proofs of Theorems 4 and 5 are provided in Appendices A and B).Theorem 4.
IfC>0(Rpro<1), B<0, and Δ=0, system (3) has one positive equilibrium E*, and E* is a saddle node.Theorem 5.
System (3) experiences saddle-node bifurcation at the equilibrium x0=E* as the parameter β passes through the bifurcation value.From the above mathematical analysis, we can see that under certain parameter condition, system (3) would experience backward bifurcation. Combined with the theoretical results, we can rewrite the inequality conditions about C, B, and Δ=B2-4AC in terms of β:
(13)C<0(Rpro>1)⟺β>βC≜(μ+γ)(μ+θ+ϕ)μ(1-p)+θ+σϕ+σμp,B<0⟺β>βB≜μ+θ+σϕ+σ(μ+γ)+qγ(1-σ)σ,Δ>0⟺β>βΔ≜(((σ)-1σ(μ+γ)+(pμ+qγ)(1-σ)+pμ(1-σ)-(μ+θ+σϕ)(σ)-1)×(σ)-1)+(×(σ)-12(σ(1-σ)(μ+γ)(ϕ+pμ)ppppppp+(pμ+qγ)(1-σ)ppppppp×[pμ(1-σ)pppppppppp-(μ+θ+σϕ)])1/2×(σ)-1).βC, βB, and βΔ satisfy the following relationship
(14)βC>βB⟹βC>βΔ>βB.
Then
(15)Rpro′≜Rpro|β=βΔ=βΔμ+γ·(1-p)μ+θ+σ(pμ+ϕ)μ+θ+ϕ
becomes one critical threshold for system (3), and β>βΔ⇔Rpro>Rpro′. In addition, we can obtain Rpro′=1-(B2/4A) if Δ=0. Obviously, Rpro′<1.From Theorems1–5, we can obtain the following properties.Corollary 6.
For system (3),(1)
ifβC>βB and βΔ<β<βC, then two endemic equilibria exist, one of which is locally stable and competes with the locally stable worm-free equilibrium, which is the backward bifurcation (see Figure 2(b));(2)
otherwise, the worm-free equilibrium is the unique attractor whenRpro<1, which is the forward bifurcation (see Figure 2(a)).Bifurcation diagram. (a) Forward bifurcation case; (b) backward bifurcation case.
(a)
(b)These results can also be given in terms ofσ, ϕ, or θ, and in practice, these parameters are easily controlled. However, the expressions are more complicated. Therefore, we only give corresponding regions in numerical simulation.


## 3.2.1. The Worm-Free Equilibrium and Its Stability

Equilibria are obtained by setting the right side of system (3) equal to zero. From the third equation in system (3), we can obtain I=0 or βS1+σβS2=μ+γ. If I=0, the model has a unique worm-free equilibrium:
(5)E0=(S10,S20,0),
where S10=((1-p)μ+θ)/(μ+θ+ϕ), S20=(pμ+ϕ)/(μ+θ+ϕ).To study the local stability of the equilibria, we first give the Jacobian matrix of system (3) at an arbitrary equilibrium:
(6)J=[-βI-μ-ϕθ-βS1+(1-q)γϕ-σβI-μ-θ-σβS2+qγβIσβIβS1+σβS2-(μ+γ)].
Then the corresponding characteristic polynomial at the worm-free equilibrium E0 is derived as
(7)P(λ)=(λ+μ)(λ+μ+θ+ϕ)×(λ+μ+γ-βS10-σβS20),
so we obtained that the eigenvalues at the worm-free equilibrium E0 are λ1=-μ, λ2=-(μ+θ+ϕ) and λ3=βS10+σβS20-(μ+γ)=(μ+γ)(Rpro-1), respectively. Consequentially, the following result is obtained.Theorem 1.
System (3) always has a trivial equilibrium E0, and if Rpro≤1, E0 is locally asymptotically stable.


## 3.2.2. The Existence and Stability of Endemic Equilibrium

In this section, we study the existence and stability of the endemic equilibria for system (3).IfβS1+σβS2=μ+γ, combined with the second equation of system (3), we can obtain
(8)S1=(μ+γ)(σβI+μ+θ)-σqγβI-σβpμβ(σβI+μ+θ+σϕ),S2=qγβI+βpμ+ϕ(μ+γ)β(σβI+μ+θ+σϕ).
Then, substituting S1 and S2 into the first equation of system (3), a quadratic equation is given as
(9)AI2+BI+C=0
in terms of I, where
(10)A=σβ2,B=β[μ+θ+σϕ+σ(μ+γ)+qγ(1-σ)-σβ],C=(μ+γ)(μ+θ+ϕ)(1-Rpro).
Define Δ=B2-4AC; the number of endemic equilibria is dependent on the sign of B, C, and Δ. After calculation, we can obtain the following results.Theorem 2.
For system (3), consider the following.(1)
IfC<0(Rpro>1), (9) has a positive root I*=(-B+Δ)/2A. Correspondingly, system (3) has one endemic equilibrium E*.(2)
IfC=0(Rpro=1) and B<0, (9) also has a positive root I*=-B/A. Correspondingly, system (3) has one endemic equilibrium E*.(3)
IfC>0(Rpro<1), B<0, there will be three cases.
(i)
IfΔ>0, (9) has two positive roots I*1=(-B+Δ)/2A and I*2=(-B-Δ)/2A. Correspondingly, system (3) has two endemic equilibria E*1=(S1*1,S2*1,I*1) and E*2=(S1*2,S2*2,I*2).(ii)
IfΔ=0, (9) has a positive root I*=-B/2A; then system (3) has one endemic equilibrium E*.(iii)
IfΔ<0, (9) has no positive root, and system (3) has no endemic equilibrium.Now, we study the stability of endemic equilibria seriatim. Similar to Section3.2.1, the corresponding characteristic polynomial of an arbitrary endemic equilibrium is derived as
(11)Q(λ)=(λ+μ)[λ2+(βI+σβI+μ+θ+ϕ)λppppppppp+(2AI+B)Iβλ2].
Obviously, for any endemic equilibrium, there is an eigenvalue λ1=-μ<0. In order to study the other ones, we set
(12)f(λ)=λ2+(βI+σβI+μ+θ+ϕ)λ+(2AI+B)I.
Then the signs of eigenvalues corresponding to the endemic equilibrium are dependent on the distribution of the roots of f(λ)=0.Corresponding to the cases about the existence, we obtain the stability of endemic equilibrium in each case, which are stated as follows.Theorem 3.
For system (3), consider the following. (1)
IfC<0(Rpro>1), then I*=(-B+Δ)/2A, 2AI*+B=Δ>0. In this case, f(λ) has no intersection point with positive real axis; thus E* is locally asymptotically stable.(2)
IfC=0(Rpro=1) and B<0, then I*=-B/A, 2AI*+B=-B>0; same as case (1), E* is locally asymptotically stable.(3)
IfC>0(Rpro<1), B<0, there will be three cases.
(i)
IfΔ>0, for the positive root I*1=(-B+Δ)/2A, 2AI*1+B=Δ>0; same as the above, E*1=(S1*1,S2*2,I*1) is a stable node. For I*2=(-B-Δ)/2A, 2AI*2+B=-Δ<0; in this case, f(λ) has an intersection point with positive real axis, so E*2=(S1*2,S2*2,I*2) is a saddle point.(ii)
IfΔ=0, then I*=-B/2A, 2AI*+B=0; in this case, one of the eigenvalues corresponding to E* is equal to zero, so E* is a nonhyperbolic equilibrium.(iii)
IfΔ<0, system (3) has no endemic equilibrium.


## 3.2.3. The Saddle Node and Bifurcation

According to Theorems2 and 3, we can see that under the conditions C>0(Rpro<1), B<0, and Δ=0, system (3) has one endemic equilibrium E*, and it is a nonhyperbolic equilibrium. Utilizing the center manifold theorem [25, 26] and the existence theorem [27], we studied the dynamical behavior near the equilibrium E*. Taking β as the bifurcation parameter, we prove that system (3) could experience saddle-node bifurcation. The detailed results are given as follows (the proofs of Theorems 4 and 5 are provided in Appendices A and B).Theorem 4.
IfC>0(Rpro<1), B<0, and Δ=0, system (3) has one positive equilibrium E*, and E* is a saddle node.Theorem 5.
System (3) experiences saddle-node bifurcation at the equilibrium x0=E* as the parameter β passes through the bifurcation value.From the above mathematical analysis, we can see that under certain parameter condition, system (3) would experience backward bifurcation. Combined with the theoretical results, we can rewrite the inequality conditions about C, B, and Δ=B2-4AC in terms of β:
(13)C<0(Rpro>1)⟺β>βC≜(μ+γ)(μ+θ+ϕ)μ(1-p)+θ+σϕ+σμp,B<0⟺β>βB≜μ+θ+σϕ+σ(μ+γ)+qγ(1-σ)σ,Δ>0⟺β>βΔ≜(((σ)-1σ(μ+γ)+(pμ+qγ)(1-σ)+pμ(1-σ)-(μ+θ+σϕ)(σ)-1)×(σ)-1)+(×(σ)-12(σ(1-σ)(μ+γ)(ϕ+pμ)ppppppp+(pμ+qγ)(1-σ)ppppppp×[pμ(1-σ)pppppppppp-(μ+θ+σϕ)])1/2×(σ)-1).βC, βB, and βΔ satisfy the following relationship
(14)βC>βB⟹βC>βΔ>βB.
Then
(15)Rpro′≜Rpro|β=βΔ=βΔμ+γ·(1-p)μ+θ+σ(pμ+ϕ)μ+θ+ϕ
becomes one critical threshold for system (3), and β>βΔ⇔Rpro>Rpro′. In addition, we can obtain Rpro′=1-(B2/4A) if Δ=0. Obviously, Rpro′<1.From Theorems1–5, we can obtain the following properties.Corollary 6.
For system (3),(1)
ifβC>βB and βΔ<β<βC, then two endemic equilibria exist, one of which is locally stable and competes with the locally stable worm-free equilibrium, which is the backward bifurcation (see Figure 2(b));(2)
otherwise, the worm-free equilibrium is the unique attractor whenRpro<1, which is the forward bifurcation (see Figure 2(a)).Bifurcation diagram. (a) Forward bifurcation case; (b) backward bifurcation case.
(a)
(b)These results can also be given in terms ofσ, ϕ, or θ, and in practice, these parameters are easily controlled. However, the expressions are more complicated. Therefore, we only give corresponding regions in numerical simulation.


## 4. Sensitivity Analysis

In real world applications, our main objective is to control the percentage of infective computers or eradicate the worm by taking effective measures. In our model, parametersσ, ϕ, θ, p, and q are related to human behavioral responses. For our purpose, following Arriola and Hyman [28], the normalized forward sensitivity indices with respect to σ, ϕ, θ, and p are calculated, respectively, as follows:
(16)(∂Rpro/Rpro)(∂σ/σ)=σ(ϕ+pμ)(1-p)μ+θ+σϕ+σpμ>0,(∂Rpro/Rpro)(∂ϕ/ϕ)=-βμ+γ·(1-σ)[θ+(1-p)μ](μ+θ+ϕ)2<0,(∂Rpro/Rpro)(∂θ/θ)=βμ+γ·(1-σ)(ϕ+pμ)(μ+θ+ϕ)2>0,(∂Rpro/Rpro)(∂p/p)=-βμ+γ·(1-σ)μμ+θ+ϕ<0.
It can be seen that, among these parameters, Rpro is an increasing function of σ and θ. Opposed to this, ϕ and p have an inversely proportional relationship with Rpro.By now, for a general worm propagation model with forward bifurcation (Figure2(a)), we can take measures to increase ϕ and decrease σ, θ at the same time to make Rpro below one. However, for our model, the backward bifurcation (Figure 2(b)) appears under certain parameter values. In this case, reducing Rpro below one would not promise to eradicate the worm eventually. As shown in Figure 2(b), there exists a locally stable endemic equilibrium even if Rpro<1. In order to control the worm propagation, the involved parameter values must be further reduced or increased so far that Rpro<Rpro′, and Rpro enters the region where no endemic equilibria exist (see Figures 2(b) and 9). Therefore, the control of worm propagation is more difficult under the situation in which backward bifurcation appears.


## 5. Simulations and Control Strategies

Theoretical results have been provided in previous section; now we use numerical simulations to verify the above results. We fixN*=0.24×232 [29], μ=1/(5×24), and γ=1/24 throughout this paper.


### 5.1. The Effect of Parameters

In Section4, we have analyzed the effects of σ, ϕ, θ, and p on Rpro. To provide an intuitive impression, when β=250×0.24×0.0026, the influences of σ, ϕ, θ, and p on I(t) are shown in Figure 3.The variations in the number of infectious computersI(t) for different values of σ, ϕ, θ, and p, respectively.
(a)
(b)
(c)
(d)It can be observed that the effects ofσ, ϕ, and θ are stronger and p have little or almost no influence on I(t). Moreover, we find that ϕ can influence not only the number of infectious computers but also the arrival time of the second peak. It is easy to see that the peak of the second outbreak would be postponed if ϕ is increasing. Generally, as the arrival time of the first peak of worm outbreak is very quick, it is too late to make any responses when we are aware of it. Thus, if the arrival time of the second peak of worm outbreak can be postponed, it can give security professionals more time to study the corresponding counter measures.Althoughq does not appear in the expression for Rpro, it is related to the user behavior. So, fixing β=250×0.24×0.0026, p=0.8, ϕ=0.0003, θ=0.0005, σ=0.02 (this is the forward bifurcation case, Rpro=2.3235), we study the influences of q on the changes of I(t). From Figure 4, we can see an increase of q would lead to a decrease of I(t). That is, even if Rpro>1, the final size of infectious computers can be reduced to a low level by increasing q.Figure 4
The variations in the number of infectious computersI(t) for different values of q.In order to display the differences between the forward and backward bifurcation, in the following parts, we carry on numerical simulations for the two cases, respectively.


### 5.2. Forward Bifurcation

Firstly, to find better control strategies for worm infection, we perform some sensitivity analysis ofI(t) and the basic reproduction number Rpro in terms of the model parameters. Choosing p=0.8, q=0.5, ϕ=0.0003, θ=0.0005, σ=0.02, we can obtain βC=0.0671. Assuming the value of β is 250×0.24×0.0011, 250×0.24×0.002, and 250×0.24×0.0026, respectively, then the corresponding value of Rpro is 0.9830, 1.7873, and 2.3235. We show variations of I(t) for different values of Rpro in Figure 5 with I(0)=107. We can see that Rpro is really the threshold for the establishment of the worm in the susceptible pool, and the number of infectious computers increases with the increase of Rpro.Figure 5
The variations in the number of infectious computersI(t) for different values of Rpro.Secondly, in Figure6, we show the influences of initial conditions I(0) on the number of infectious computers I(t) for the same Rpro. We can see I(0) has little or almost no influence on I(t).The influences of initial conditionsI(0) on the number of infectious computers I(t) for different values of I(0) with the same Rpro.
(a)
(b)
(c)From the above analysis, we find that as long as we take measures to control the parameter values to makeRpro<1, we will be able to control the spread of the worm. However, we know that in real world the control measures corresponding to involved parameters may not be easy to carry out. Even if controlling parameter values cannot ensure that Rpro<1, the final size of infectious computers can be reduced by reducing the value of Rpro as far as possible.


### 5.3. Backward Bifurcation

Similarly, keeping other parameter values unchanged, we chooseϕ=0.006, σ=0.2, then βC=0.1589, βB=0.1336, βΔ=0.1505, and βC>βB, Rpro′=0.9470. Assuming the value of β is 250×0.24×0.0025, 250×0.24×0.0026, and 250×0.24×0.00275, respectively, then the corresponding value of Rpro is 0.9439, 0.9817, and 1.0383. The inequality 0.9439<Rpro′<0.9817<1.0383 is satisfied.In Figure7, we show the changes of I with time for different Rpro. The initial values adopted in Figures 7(a) and 7(b) are I(0)=107 and I(0)=3×106, respectively.The variations in the number of infectious computersI(t) for different values of Rpro: (a) I(0)=107, (b) I(0)=3×106.
(a)
(b)Comparing Figure7(a) with Figure 5, we can find if at Rpro<1, I(t) may still tend to a positive endemic level; that is, Rpro<1 is not sufficient to control the spread of Internet worm. Comparing Figure 7(a) with Figure 7(b), it can be observed that when Rpro′<Rpro=0.9817<1, the initial value I(0) can influence the evolutions of I with time. But the initial value I(0) has no influence on the evolutions of I with time when Rpro=1.0383>1 and Rpro=0.9439<Rpro′. Thus Rpro=1 is not the only threshold condition for the worm eradication, and Rpro′ also plays a key role.In order to display the impacts ofI(0) on the evolutions of I(t) more clearly, in Figure 8, we assume the initial value of I(0) is 106 : 106 : 107. From Figures 8(a)–8(c), we can see that when Rpro′<Rpro<1, for different I(0), I(t) will tend to endemic equilibrium or worm-free equilibrium simultaneously, which puts forward new challenges to the worm control. Because the value of I(0) depends mainly on the hackers who write malicious code, it is hard to control. Then in order to eradicate the worm, we must take further measures to reduce Rpro, so that Rpro<Rpro′.The influences of initial conditionsI(0) on the number of infectious computers I(t) for different Rpro.
(a)
(b)
(c)Bifurcation diagram in the(σ,ϕ), (ϕ,θ), and (σ,θ) planes (C<0⇔Rpro>1).
(a)
(b)
(c)For system (3), the parameters are in cooperation with each other. So in Figure 9, we give the region division of the distribution of endemic equilibria in (σ,ϕ), (ϕ,θ), and (σ,θ) planes. Thus the parameter space is divided into several parts. In the yellow area, system (3) has two endemic equilibria, one of which is locally asymptotically stable. In the “no endemic equilibrium” region, the worm-free equilibrium is globally asymptotically stable. In the “one endemic equilibrium” region, the unique endemic equilibrium is globally asymptotically stable. From Figure 9, we can obtain the corresponding value ranges of σ, ϕ, and θ just as β easily. This can be an instruction to control parameter values and provides a good basis for the establishment of control measures in practical terms.Synthesizing the above analysis and simulation results, some control strategies can be implemented: in both cases (forward and backward bifurcation), it is strongly recommended that one should periodically acquire and run antivirus software of the newest version. Filtering and blocking suspicious messages with a firewall is also suggested. Educational efforts should be rolled out to increase the public awareness of worm propagation. Especially in the case of backward bifurcation, in order to control the spread of the worm, one must further strengthen the implementation of these measures.


## 5.1. The Effect of Parameters

In Section4, we have analyzed the effects of σ, ϕ, θ, and p on Rpro. To provide an intuitive impression, when β=250×0.24×0.0026, the influences of σ, ϕ, θ, and p on I(t) are shown in Figure 3.The variations in the number of infectious computersI(t) for different values of σ, ϕ, θ, and p, respectively.
(a)
(b)
(c)
(d)It can be observed that the effects ofσ, ϕ, and θ are stronger and p have little or almost no influence on I(t). Moreover, we find that ϕ can influence not only the number of infectious computers but also the arrival time of the second peak. It is easy to see that the peak of the second outbreak would be postponed if ϕ is increasing. Generally, as the arrival time of the first peak of worm outbreak is very quick, it is too late to make any responses when we are aware of it. Thus, if the arrival time of the second peak of worm outbreak can be postponed, it can give security professionals more time to study the corresponding counter measures.Althoughq does not appear in the expression for Rpro, it is related to the user behavior. So, fixing β=250×0.24×0.0026, p=0.8, ϕ=0.0003, θ=0.0005, σ=0.02 (this is the forward bifurcation case, Rpro=2.3235), we study the influences of q on the changes of I(t). From Figure 4, we can see an increase of q would lead to a decrease of I(t). That is, even if Rpro>1, the final size of infectious computers can be reduced to a low level by increasing q.Figure 4
The variations in the number of infectious computersI(t) for different values of q.In order to display the differences between the forward and backward bifurcation, in the following parts, we carry on numerical simulations for the two cases, respectively.


## 5.2. Forward Bifurcation

Firstly, to find better control strategies for worm infection, we perform some sensitivity analysis ofI(t) and the basic reproduction number Rpro in terms of the model parameters. Choosing p=0.8, q=0.5, ϕ=0.0003, θ=0.0005, σ=0.02, we can obtain βC=0.0671. Assuming the value of β is 250×0.24×0.0011, 250×0.24×0.002, and 250×0.24×0.0026, respectively, then the corresponding value of Rpro is 0.9830, 1.7873, and 2.3235. We show variations of I(t) for different values of Rpro in Figure 5 with I(0)=107. We can see that Rpro is really the threshold for the establishment of the worm in the susceptible pool, and the number of infectious computers increases with the increase of Rpro.Figure 5
The variations in the number of infectious computersI(t) for different values of Rpro.Secondly, in Figure6, we show the influences of initial conditions I(0) on the number of infectious computers I(t) for the same Rpro. We can see I(0) has little or almost no influence on I(t).The influences of initial conditionsI(0) on the number of infectious computers I(t) for different values of I(0) with the same Rpro.
(a)
(b)
(c)From the above analysis, we find that as long as we take measures to control the parameter values to makeRpro<1, we will be able to control the spread of the worm. However, we know that in real world the control measures corresponding to involved parameters may not be easy to carry out. Even if controlling parameter values cannot ensure that Rpro<1, the final size of infectious computers can be reduced by reducing the value of Rpro as far as possible.


## 5.3. Backward Bifurcation

Similarly, keeping other parameter values unchanged, we chooseϕ=0.006, σ=0.2, then βC=0.1589, βB=0.1336, βΔ=0.1505, and βC>βB, Rpro′=0.9470. Assuming the value of β is 250×0.24×0.0025, 250×0.24×0.0026, and 250×0.24×0.00275, respectively, then the corresponding value of Rpro is 0.9439, 0.9817, and 1.0383. The inequality 0.9439<Rpro′<0.9817<1.0383 is satisfied.In Figure7, we show the changes of I with time for different Rpro. The initial values adopted in Figures 7(a) and 7(b) are I(0)=107 and I(0)=3×106, respectively.The variations in the number of infectious computersI(t) for different values of Rpro: (a) I(0)=107, (b) I(0)=3×106.
(a)
(b)Comparing Figure7(a) with Figure 5, we can find if at Rpro<1, I(t) may still tend to a positive endemic level; that is, Rpro<1 is not sufficient to control the spread of Internet worm. Comparing Figure 7(a) with Figure 7(b), it can be observed that when Rpro′<Rpro=0.9817<1, the initial value I(0) can influence the evolutions of I with time. But the initial value I(0) has no influence on the evolutions of I with time when Rpro=1.0383>1 and Rpro=0.9439<Rpro′. Thus Rpro=1 is not the only threshold condition for the worm eradication, and Rpro′ also plays a key role.In order to display the impacts ofI(0) on the evolutions of I(t) more clearly, in Figure 8, we assume the initial value of I(0) is 106 : 106 : 107. From Figures 8(a)–8(c), we can see that when Rpro′<Rpro<1, for different I(0), I(t) will tend to endemic equilibrium or worm-free equilibrium simultaneously, which puts forward new challenges to the worm control. Because the value of I(0) depends mainly on the hackers who write malicious code, it is hard to control. Then in order to eradicate the worm, we must take further measures to reduce Rpro, so that Rpro<Rpro′.The influences of initial conditionsI(0) on the number of infectious computers I(t) for different Rpro.
(a)
(b)
(c)Bifurcation diagram in the(σ,ϕ), (ϕ,θ), and (σ,θ) planes (C<0⇔Rpro>1).
(a)
(b)
(c)For system (3), the parameters are in cooperation with each other. So in Figure 9, we give the region division of the distribution of endemic equilibria in (σ,ϕ), (ϕ,θ), and (σ,θ) planes. Thus the parameter space is divided into several parts. In the yellow area, system (3) has two endemic equilibria, one of which is locally asymptotically stable. In the “no endemic equilibrium” region, the worm-free equilibrium is globally asymptotically stable. In the “one endemic equilibrium” region, the unique endemic equilibrium is globally asymptotically stable. From Figure 9, we can obtain the corresponding value ranges of σ, ϕ, and θ just as β easily. This can be an instruction to control parameter values and provides a good basis for the establishment of control measures in practical terms.Synthesizing the above analysis and simulation results, some control strategies can be implemented: in both cases (forward and backward bifurcation), it is strongly recommended that one should periodically acquire and run antivirus software of the newest version. Filtering and blocking suspicious messages with a firewall is also suggested. Educational efforts should be rolled out to increase the public awareness of worm propagation. Especially in the case of backward bifurcation, in order to control the spread of the worm, one must further strengthen the implementation of these measures.


## 6. Conclusion

In the vast majority of Internet worm models [30–35], the basic reproduction number R0 is the critical threshold condition. Various actions are taken to control the system parameter values so that R0<1, then the solutions of the system will approach worm-free equilibrium finally; that is, the spread of worm can be controlled. In our paper, by characterizing the user protection behaviors, we propose a mathematical model which is coupled with the adaptive user protection behaviors for the Internet worm propagation. The theoretical analysis demonstrates that the protection behavior can reduce the value of the basic reproduction number to below one. Besides, we find that the simple model exhibits a very interesting and rich spectrum of dynamical behaviors, such as backward bifurcation, saddle-node bifurcation. Thus, in this case, the basic reproduction number below one is not the only threshold condition for the computer worm control. In the backward bifurcation case, one must further strengthen the protection to control the spread of worm. These results show that whether the user selects protection has an important effect on worm controlling. Moreover, enhancing the protection consciousness of users or speeding up the antivirus software upgrade can delay the arrival time of second peak of infectious computer, which is essential for the security professionals. To sum up, our results are new discoveries in the field of Internet worm propagation and can bring new perspectives to defense and control worm propagation.



---

*Source: 531781-2013-09-11.xml*