# Stability Analysis of an Advanced Persistent Distributed Denial-of-Service Attack Dynamical Model

Authors: Chunming Zhang; Jingwei Xiao
Journal: Security and Communication Networks
 (2018)

---

## Abstract

The advanced persistent distributed denial-of-service (APDDoS) attack is a fairly significant threat to cybersecurity. Formulating a mathematical model for accurate prediction of APDDoS attack is important. However, the dynamical model of APDDoS attack has barely been reported. This paper first proposes a novel dynamical model of APDDoS attack to understand the mechanisms of APDDoS attack. Then, the attacked threshold of this model is calculated. The global stability of attack-free and attacked equilibrium are both proved. The influences of the model’s parameters on attacked equilibrium are discussed. Eventually, the main conclusions of the theoretical analysis are examined through computer simulations.


---

## Body

## 1. Introduction

Cyberattack has already become one of the greatest threats to cybersecurity [1–4]. With the rapid development of information technologies, a considerable number of cyberattack methods have been emerging in the past few decades, such as SQL injection (SQLi) attack, distributed denial-of-service (DDos) attack, targeted attack, and account hijackings [5]. In particular, DDoS attack has become one of the most popular methods of hackers due to its strong covertness and low cost. Recently, several cases have been widely reported; for instance, in November, 2016, five Russian banks have suffered a persistent DDoS attack for almost 12 hours, which caused unnumbered economic losses and social turbulence [6]. What is more, in August, 2017, Ukraine’s national postal service has been hit by a two-day-long cyberattack [7].Denial-of-service attack (DoS attack) is a cyberattack, where the attackers attempt to disrupt the servers which are going to respond to the requests. When these attacks of DoS attack originate from many different computers and networks, this attack mode can be referred to as distributed denial-of-service attack (DDoS attack). On the other hand, the dynamical models of advanced persistent threats (APTs) have already attracted the attention of researchers [8–12]. An advanced persistent threat is a set of stealthy and continuous computer hacking processes, often orchestrated by a person or persons targeting a specific entity [13]. The computers with defensive ability in network cannot be successfully attacked easily by a standard DDoS attack (only DDoS attack once), which means that a standard DDoS attack does little harm to the network. But nowadays, there are numerous hackers with clear aim, well resource, and exceptional skills. Therefore, they are able to launch continuous and long-term attack, which is also called APDDoS attack in this paper. In this way, attackers of APDDoS attack would cause a bigger threat to cybersecurity [14].Although the APDDoS attack has been mentioned in numerous papers [15–18], the dynamical models of APDDoS attack have rarely been reported yet. In this context, this paper proposes a dynamical model of APDDoS attack, which can help to figure out the mechanism of APDDoS attack.In reality, different computer has different defensive ability. For example, the computer with low level of defensive ability is more likely to be attacked, while the high level of defensive ability makes the computer not be totally affected easily, so that the flooding attack is the only one way to attack the high-defensive computer. Hence, this paper divides the computers into two parts which are weak-defensive computers and strong-defensive computers. Meanwhile, the procedures of APDDoS attack can be typically classified into two phases, including spreading computer worms and launching flooding attacks (see Figure1).Figure 1
Schematic diagram of APDDoS attack.(  1) Spreading Computer Worms. As to infect more computers with low level of defensive ability, hackers are attempting to spread more computer worms on networks (such as Internet and WWW) by sending fake and malicious emails or links, which are going to lure people to click on them and thus lead them to visit virus websites and then download malware unconsciously. So, zombie in here is used to denote the infected computer or an infectious local network. Then, worms can also be diffused through the zombie to its neighbors under the control of the hackers.(  2) Launching Flooding Attacks. After successfully intruding the computer and gaining the control of zombies, the hackers will send instructions to the zombies so as to launch APDDoS attacks to computers with extraordinary high-defensive levels. Owing to the strong disruptive power of APDDoS attacks, some high-defensive computers will still be intruded and broken down. So, compromised computer is utilizing to represent the high-defensive computer, which has been broken down.The rest of this paper is organized as follows. In Section2, a dynamical model of APDDoS attack is proposed; then the model is analyzed in Section 3; some further discussions are provided in Section 4; finally, the summary of this paper is given in Section 5.


## 2. Model Description

This paper makes the hypothesis that computers can be classified into two parts: weak-defensive computers and strong-defensive computers.The weak-defensive computers consist of two groups, weak-defensive nodes (not infected yet) and attacked nodes.(i) Weak-defensive node, which has not been infected by worms or malwares yet, lacks in defending the malicious attacks, for existing some system vulnerabilities and device defects or being without the defense of antivirus software. It is also calledW node for short.(ii) Attack node, the zombie that can infect otherW nodes and launch attacks controlled by hackers, can be also represented by A node briefly.The strong-defensive computers also can be divided into two groups, strong-defensive nodes (not compromised yet) and compromised nodes.(i) Strong-defensive node, which provides considerable power of filtering and self-defensive ability, represents the computer with firewall equipped. In general, strong-defensive node acts as server in the network, and it is also calledS node in this paper.(ii) Compromised node, which denotes the state thatS node becomes compromised and cannot respond to the requests after the attacks, is called C node in this paper.Based on the above facts, the following assumptions can be obtained.(H1) The system is closed; the total number of systems is constant. Hence, W(t)+A(t)+S(t)+C(t)≡1.(H2) Due to opening the phishing emails or text or performing some operations which would damage system security, W node is infected with the probability of β.(H3) Due to executing some positive measures, like reinstalling operation system, A node recovers with the probability of γ.(H4) Due to the APDDoS attacks, S node is compromised with the probability of α.(H5) With the assistance of firewall, p, used to describe the self-protection ability of S node, represents the ability of resisting attack of APDDoS. And 1/p should be proportional to the rate that S node compromised. Besides, p must be greater than 1.(H6) Due to some positive measures, like restarting the computer, C node turns to an S node with the probability of η.(H7) As the system is divided into two separated parts, the parameters ϕ and 1-ϕ are used to, respectively, denote the rate of the weak part and the strong part. So the following equations hold, ϕ=W(t)+A(t) and 1-ϕ=S(t)+C(t).According to (H1)–(H7), the following dynamical system is got (see Figure 2).(1)dWtdt=-βWtAt+γAt,dAtdt=βWAt-γAt,dStdt=-αStAtp+ηCt,dCtdt=αStAtp-ηCt,where 0≤W(t), A(t)≤ϕ, 0≤S(t), C(t)≤1-ϕ, and 0≤α, β, γ, η, ϕ≤1.Figure 2
Status transition graph of the basic model (the dashed line on the graph means the attack fromA node to S node).


## 3. Theoretical Analysis of the Dynamical Model

This section focuses on the mathematical properties of the dynamical model, such as equilibriums, threshold, and the local and global stability of system (1).AsW(t)+A(t)=ϕ and S(t)+C(t)=1-ϕ, the equations of system (1) can be deduced into a two-dimensional system as follows:(2)dAtdt=βϕ-AtAt-γAt,dCtdt=α1-ϕ-CtAtp-ηCt,where 0≤A(t)≤ϕ≤1 and 0≤C(t)≤1-ϕ≤1. The simply connected compact set can be obtained that Ω=A(t),C(t)∈R+2:A(t)∈0,ϕ,C(t)∈0,1-ϕ.Since system (1) and system (2) are equivalent, we are going to examine the properties of system (2).


### 3.1. Equilibriums

Theorem 1.
System (2) has a unique attack-free equilibrium E0.Proof.
LettingA(t)=A0=0 and C(t)=C0=0, then the unique attack-free equilibrium E0 is shown as follows:(3)E0=A0,C0T=0,0T.Theorem 2.
System (2) has a unique attack-free equilibrium:(4)E∗=A∗,C∗=ϕ-γβ,α1-ϕβϕ-γpβη+αβϕ-γ.It is easy to prove, so the proof has been omitted here.


### 3.2. Attacked Threshold

In this paper, propagation threshold is a vital indicator that determines whether system will suffer APDDoS attack.According to method described in Appendix, there are four statuses in system (1), so let (5)x=x1,x2,x3,x4T=At,Ct,Wt,StT,and the following vectors can be obtained that(6)Fx=βx1x3αpx1x400,V-=γx1ηx2βx1x3αpx1x4,V+=00γx1ηx2,which satisfies E0 where x1∗=0, x2∗=0, x3∗=ϕ, x4∗=1-ϕ. So(7)F=βx30αpx40,V=γ00η.ThenR0=ρ(FV-1)=ϕβ/γ, where R0 is strictly increasing with respect to the parameters ϕ and β and strictly decreasing with respect to γ.Example 3.
Fixingγ=0.3 and changing the parameters β and ϕ, the value of R0 is shown in Figure 3.Figure 3
Example3.Example 4.
Fixing theβ=0.3 and varying the parameters γ and ϕ, the value of R0 is shown in Figure 4.Figure 4
Example4.


### 3.3. The Global Stability of Attack-Free Equilibrium

Theorem 5.
E 0 is globally asymptotically stable when R0<1.Proof.
Consider the following Lyapunov function with an undermined coefficient(8)VAt,Ct=At+12κCt2,where κ is a positive constant to be determined. Besides, A(t)≥0 and C(t)≥0, so V is nonnegative.
The time derivative ofV along an orbit of system (2) is(9)dVdt=A′+κCC′=βϕ-AA-γA+κCα1-ϕ-CpA-ηC=βϕ-γA-βA2-κα1-ϕpβCA+κηβC2-ακpAC2.
AsR0=ϕβ/γ<1, then βϕ-γ<0 and (βϕ-γ)A(t)≤0 are obtained. And another part, βA2-κ(α1-ϕ/pβ)CA+(κη/β)C2, can be deduced into (10)βA-κα1-ϕ2pβC2-βκα1-ϕ2pβ2-κηβC2.
Obviously,βA-(κα1-ϕ/2pβ)C2≥0. When (11)κα1-ϕ2pβ2-κηβ≤0,then the inequality βA2-κ(α1-ϕ/pβ)CA+(κη/β)C2≥0 holds.
Considering inequality (11), let κ=4ηp2/α21-ϕ2>0, so κα1-ϕ/2pβ2-κη/β=0. Finally, the remaining part, (ακ/p)AC2, is nonnegative, for κ>0. Hence, only if A(t)=C(t)=0, that A(t),C(t)T∈E0, dV/dt=0. dV/dt<0, when A(t),C(t)T∈Ω-E0. The result confirms the stability principle in [19].
The proof is completed.Example 6.
In system (2) with α=0.1, γ=0.37, η=0.05, β=0.65, ϕ=0.5, p=1.2, where R0=0.8784<1, computers will not suffer from APDDoS attacks and the attack-free equilibrium is globally asymptotically stable (see Figure 5).Figure 5
(a) and (b) represent the variety of the proportion ofC(t) and A(t) in different initial conditions by time-varying diagram and phase diagram, respectively.
(a) (b)


### 3.4. The Global Stability of Attacked Equilibrium

Firstly, the local stability of attacked equilibrium of system (2) will be demonstrated.Lemma 7.
E ∗ is locally asymptotically stable when R0>1.Proof.
The Jacobian of the linearized system (2) evaluated at E∗ is as follows:(12)J=βϕ-2βA∗-γ0-α1-ϕ-C∗p-αA∗p+η,and the corresponding characteristic equation is(13)λ-βϕ-2βA∗-γλ+αA∗p+η=0.
Clearly, two roots of (13) are λ1=-αA∗/p-η and λ2=βϕ-2βA∗-γ, so the possibility of these two roots will be discussed next. As A∗=ϕ-γ/β>0, it is easy to get that λ1<0. Besides, the equation of λ2 can be rewritten into λ2=-βϕ+γ and λ2<-1<0, for R0=βϕ-γ>1. Hence, the two roots of (13) both have negative real parts. Further, the conclusion of this result follows by the Lyapunov theorem, conforming to the Hurwitz criterion [19].
The proof is completed.Second, the global behaviors of the equilibrium ofE∗ will be examined.Lemma 8.
The simplified system admits no periodic orbit in the interior ofΩ [20].Proof.
Let(14)f1x=βϕ-AtAt-γAt,f2x=α1-ϕ-CtpAt-ηCt.
DefineDA,C=1/A; then(15)∂Df1∂L+∂Df2∂A=-β-αp-ηA<0.
The result follows the Bendixson–Dulac criterion [20].Lemma 9.
System (2) admits no periodic orbit that passes through a point on ∂Ω, that is the boundary of Ω.Proof.
As for the smoothness of all orbits of system (2), all conditions can be enumerated as follows.
(a) There is no periodic orbit that passes through a corner ofΩ, i.e., either (0,0) or (ϕ,0) or (0,1-ϕ), or (ϕ,1-ϕ).
(b) If there is a periodic orbit passes through a noncorner point on∂Ω, then this orbit must be tangent to ∂Ω at this point.On the contrary, suppose that there is a periodic orbitΓ that passes through a noncorner point A-,C- on ∂Ω; then there are four possibilities.Case 1.
0 < A - < ϕ, C-=0. Then dC/dtA-,C-=(α1-ϕ/p)A->0, implying that Γ is not tangent to ∂Ω at this point, which leads to a contradiction.Case 2.
0 < C - < 1 - ϕ, A-=0. Then dA/dtA-,C-=0, implying that Γ is not tangent to ∂Ω at this point, which is self-contradictory.Case 3.
0 < A - < ϕ, C-=1-ϕ. Then dC/dtA-,C-=-η1-ϕ<0, implying that Γ is not tangent to ∂Ω at this point, which leads to a contradiction.Case 4.
0 < C - < 1 - ϕ, A-=ϕ. Then dA/dtA-,C-=-ϕγ<0, implying that Γ is not tangent to ∂Ω at this point, which is also a contradiction.Theorem 10.
E ∗ is globally asymptotically stable when R0>1.Proof.
The claimed result follows by combining Lemmas7–9 with the generalized Poincaré–Bendixson theorem [20].Example 11.
Under system (2) with α=0.1, γ=0.2, η=0.05, β=0.8, ϕ=0.5, p=1.2, where R0=2.0, computers in this situation will under the attack of APDDoS, and thus the attacked equilibrium E∗ is globally asymptotically stable (see Figure 6).Figure 6
(a) and (b) represent the variety of proportion ofC(t) and A(t) in different initial conditions by time-varying diagram and phase diagram, respectively.
(a) (b)Example 12.
Under system (2) with α=0.1, γ=0.3, η=0.05, β=0.7, ϕ=0.5, p=1.2 that R0=1.1667, computers will suffer APDDoS attack, also the attacked equilibrium E∗ is globally asymptotically stable (see Figure 7).Figure 7
(a) and (b) represent the variety of proportion ofC(t) and A(t) in different initial conditions by time-varying diagram and phase diagram, respectively.
(a) (b)


## 3.1. Equilibriums

Theorem 1.
System (2) has a unique attack-free equilibrium E0.Proof.
LettingA(t)=A0=0 and C(t)=C0=0, then the unique attack-free equilibrium E0 is shown as follows:(3)E0=A0,C0T=0,0T.Theorem 2.
System (2) has a unique attack-free equilibrium:(4)E∗=A∗,C∗=ϕ-γβ,α1-ϕβϕ-γpβη+αβϕ-γ.It is easy to prove, so the proof has been omitted here.


## 3.2. Attacked Threshold

In this paper, propagation threshold is a vital indicator that determines whether system will suffer APDDoS attack.According to method described in Appendix, there are four statuses in system (1), so let (5)x=x1,x2,x3,x4T=At,Ct,Wt,StT,and the following vectors can be obtained that(6)Fx=βx1x3αpx1x400,V-=γx1ηx2βx1x3αpx1x4,V+=00γx1ηx2,which satisfies E0 where x1∗=0, x2∗=0, x3∗=ϕ, x4∗=1-ϕ. So(7)F=βx30αpx40,V=γ00η.ThenR0=ρ(FV-1)=ϕβ/γ, where R0 is strictly increasing with respect to the parameters ϕ and β and strictly decreasing with respect to γ.Example 3.
Fixingγ=0.3 and changing the parameters β and ϕ, the value of R0 is shown in Figure 3.Figure 3
Example3.Example 4.
Fixing theβ=0.3 and varying the parameters γ and ϕ, the value of R0 is shown in Figure 4.Figure 4
Example4.


## 3.3. The Global Stability of Attack-Free Equilibrium

Theorem 5.
E 0 is globally asymptotically stable when R0<1.Proof.
Consider the following Lyapunov function with an undermined coefficient(8)VAt,Ct=At+12κCt2,where κ is a positive constant to be determined. Besides, A(t)≥0 and C(t)≥0, so V is nonnegative.
The time derivative ofV along an orbit of system (2) is(9)dVdt=A′+κCC′=βϕ-AA-γA+κCα1-ϕ-CpA-ηC=βϕ-γA-βA2-κα1-ϕpβCA+κηβC2-ακpAC2.
AsR0=ϕβ/γ<1, then βϕ-γ<0 and (βϕ-γ)A(t)≤0 are obtained. And another part, βA2-κ(α1-ϕ/pβ)CA+(κη/β)C2, can be deduced into (10)βA-κα1-ϕ2pβC2-βκα1-ϕ2pβ2-κηβC2.
Obviously,βA-(κα1-ϕ/2pβ)C2≥0. When (11)κα1-ϕ2pβ2-κηβ≤0,then the inequality βA2-κ(α1-ϕ/pβ)CA+(κη/β)C2≥0 holds.
Considering inequality (11), let κ=4ηp2/α21-ϕ2>0, so κα1-ϕ/2pβ2-κη/β=0. Finally, the remaining part, (ακ/p)AC2, is nonnegative, for κ>0. Hence, only if A(t)=C(t)=0, that A(t),C(t)T∈E0, dV/dt=0. dV/dt<0, when A(t),C(t)T∈Ω-E0. The result confirms the stability principle in [19].
The proof is completed.Example 6.
In system (2) with α=0.1, γ=0.37, η=0.05, β=0.65, ϕ=0.5, p=1.2, where R0=0.8784<1, computers will not suffer from APDDoS attacks and the attack-free equilibrium is globally asymptotically stable (see Figure 5).Figure 5
(a) and (b) represent the variety of the proportion ofC(t) and A(t) in different initial conditions by time-varying diagram and phase diagram, respectively.
(a) (b)


## 3.4. The Global Stability of Attacked Equilibrium

Firstly, the local stability of attacked equilibrium of system (2) will be demonstrated.Lemma 7.
E ∗ is locally asymptotically stable when R0>1.Proof.
The Jacobian of the linearized system (2) evaluated at E∗ is as follows:(12)J=βϕ-2βA∗-γ0-α1-ϕ-C∗p-αA∗p+η,and the corresponding characteristic equation is(13)λ-βϕ-2βA∗-γλ+αA∗p+η=0.
Clearly, two roots of (13) are λ1=-αA∗/p-η and λ2=βϕ-2βA∗-γ, so the possibility of these two roots will be discussed next. As A∗=ϕ-γ/β>0, it is easy to get that λ1<0. Besides, the equation of λ2 can be rewritten into λ2=-βϕ+γ and λ2<-1<0, for R0=βϕ-γ>1. Hence, the two roots of (13) both have negative real parts. Further, the conclusion of this result follows by the Lyapunov theorem, conforming to the Hurwitz criterion [19].
The proof is completed.Second, the global behaviors of the equilibrium ofE∗ will be examined.Lemma 8.
The simplified system admits no periodic orbit in the interior ofΩ [20].Proof.
Let(14)f1x=βϕ-AtAt-γAt,f2x=α1-ϕ-CtpAt-ηCt.
DefineDA,C=1/A; then(15)∂Df1∂L+∂Df2∂A=-β-αp-ηA<0.
The result follows the Bendixson–Dulac criterion [20].Lemma 9.
System (2) admits no periodic orbit that passes through a point on ∂Ω, that is the boundary of Ω.Proof.
As for the smoothness of all orbits of system (2), all conditions can be enumerated as follows.
(a) There is no periodic orbit that passes through a corner ofΩ, i.e., either (0,0) or (ϕ,0) or (0,1-ϕ), or (ϕ,1-ϕ).
(b) If there is a periodic orbit passes through a noncorner point on∂Ω, then this orbit must be tangent to ∂Ω at this point.On the contrary, suppose that there is a periodic orbitΓ that passes through a noncorner point A-,C- on ∂Ω; then there are four possibilities.Case 1.
0 < A - < ϕ, C-=0. Then dC/dtA-,C-=(α1-ϕ/p)A->0, implying that Γ is not tangent to ∂Ω at this point, which leads to a contradiction.Case 2.
0 < C - < 1 - ϕ, A-=0. Then dA/dtA-,C-=0, implying that Γ is not tangent to ∂Ω at this point, which is self-contradictory.Case 3.
0 < A - < ϕ, C-=1-ϕ. Then dC/dtA-,C-=-η1-ϕ<0, implying that Γ is not tangent to ∂Ω at this point, which leads to a contradiction.Case 4.
0 < C - < 1 - ϕ, A-=ϕ. Then dA/dtA-,C-=-ϕγ<0, implying that Γ is not tangent to ∂Ω at this point, which is also a contradiction.Theorem 10.
E ∗ is globally asymptotically stable when R0>1.Proof.
The claimed result follows by combining Lemmas7–9 with the generalized Poincaré–Bendixson theorem [20].Example 11.
Under system (2) with α=0.1, γ=0.2, η=0.05, β=0.8, ϕ=0.5, p=1.2, where R0=2.0, computers in this situation will under the attack of APDDoS, and thus the attacked equilibrium E∗ is globally asymptotically stable (see Figure 6).Figure 6
(a) and (b) represent the variety of proportion ofC(t) and A(t) in different initial conditions by time-varying diagram and phase diagram, respectively.
(a) (b)Example 12.
Under system (2) with α=0.1, γ=0.3, η=0.05, β=0.7, ϕ=0.5, p=1.2 that R0=1.1667, computers will suffer APDDoS attack, also the attacked equilibrium E∗ is globally asymptotically stable (see Figure 7).Figure 7
(a) and (b) represent the variety of proportion ofC(t) and A(t) in different initial conditions by time-varying diagram and phase diagram, respectively.
(a) (b)


## 4. Further Discussion

In this section, the impact of parameters on the attacked equilibriumE∗ of system (2) will be discussed.In Section3, the attacked equilibrium E∗ can be rewritten into(16)E∗=A∗,C∗=γβR0-1,αγ1-ϕR0-1pβη+αγR0-1=ϕ-γβ,α1-ϕβϕ-γpβη+αβϕ-γ.By calculation,(17)C∗=αγ1-ϕR0-1pβη+αγR0-1=α1-ϕβϕ-γpβη+αβϕ-γ=1-ϕpβη/αβϕ-γ+1.So, it is easy to get the following conclusions:(1)
A∗ is strictly increasing with respect to parameters ϕ and β.(2)
C∗ is strictly increasing with respect to parameter α, and C∗ is strictly decreasing with respect to parameters p and η.(3)
Both ofA∗ and C∗ are strictly decreasing with respect to parameter γ.Now, let us consider the influence ofϕ and β on the proportion of C∗. The following relations can be gained:(18)∂C∗∂β=ααβϕ-γ+pβηϕ1-ϕ-αϕ+pη1-ϕβϕ-γαβϕ-γ+pβη2=αpηγαβϕ-γ+pβη2>0.Hence, C∗ is strictly increasing with respect to the parameters β.Then, focusing on the influence ofϕ, the relation between C∗ and ϕ is shown as follows:(19)∂C∗∂ϕ=αβϕ-γ+pβηαβ1-ϕ-βϕ-γ-α2β1-ϕβϕ-γαβϕ-γ+pβη2.So the following function has been constructed:(20)fϕ=-αβ2ϕ2+2αβγ-pβ2ηϕ+pβηβ+γ-αγ2,when ϕ is the positive root of function (20) and C∗ will get its maximum or minimum.Finally the discussion of the value ofϕ will be shown as follows.LetΔ represent the discriminant which determines whether the function f(ϕ) has real root and how many it has. By definition, it is easy to get Δ=4pβ3ηΛ, where Λ=pβη+αβ-αγ. f(ϕ) exists in two real roots if Λ>0. Let ϕ1 and ϕ2(ϕ1≤x2) denote the two real roots of f(ϕ) if Δ≥0. Also the axis of symmetry of the function f(ϕ), γ/β-pη/α, can be obtained easily.Case 1.
Λ ≤ 0, which also means pβη+αβ-αγ<0, the inequality can be derived as (21)pβη+αβ-αγ>βη+αβ-αγ=βη+α1-γβ.ϕ∈(0,1) and ϕ>γ/β(R0>1) infer that γ/β<1, which means βη+α1-γ/β>0; thus, that contradicts pβη+αβ-αγ<0. Therefore, the attacked equilibrium does not exist, and this condition is not satisfied when R0>1.Case 2.
Λ > 0, and ϕ1<0, ϕ2∈(0,1). Considering the positive value ϕ2, C∗ increases with respect to ϕ when ϕ∈(0,ϕ2], and C∗ decreases with respect to ϕ when ϕ∈(ϕ2,1). So C∗ϕ=ϕ2 is the local maximum of C∗ (see Figure 8).Figure 8
Example13.Case 3.
Λ > 0, and ϕ1, ϕ2∈(0,1). When ϕ≤ϕ1, the attacked equilibrium does not exist because ϕ1<γ/β-pη/α<γ/β and R0<1. Hence, C∗ increases with respect to ϕ when ϕ∈(ϕ1,ϕ2], and C∗ decreases with respect to ϕ when ϕ∈ϕ2,1. Here the only concern about the condition is that ϕ=ϕ2, where C∗ϕ=ϕ2 is the local maximum of C∗, respectively (see Figure 9).Figure 9
Example14.Case 4.
Λ > 0, and ϕ1<0, ϕ2>1. If ϕ1<0, ϕ2>1, then(22)ϕ1=-2αβγ-pβ2η-Δ-2αβ2<0,ϕ2=-2αβγ-pβ2η+Δ-2αβ2>1;these two inequalities can be further derived as(23)pβη-αγ>Δ>0,-αβ-pβη-αγ>Δ;however, these two formulas are contradictory. Hence, this condition does not hold.Case 5.
Λ > 0, and ϕ1, ϕ2>1. Then γ/β-pη/α>1; the axis of symmetry of the function f(ϕ) is on the right side of ϕ=1, which means γ/β>1>ϕ. So this condition does not hold.According to the above discussion, only Cases2 and 3 may have attacked equilibrium.(4) When the attacked equilibrium exists,C∗ will increase at first, and then C∗ will decrease.Example 13.
Fixingα=0.8, γ=0.2, η=0.1, β=0.8, p=1.0, and varying ϕ, the change of C(t) in system (2) is shown in Figure 8. By calculation, ϕ1=-0.2057 (has been ignored because of ϕ⁡=ϕ1<0), ϕ2=0.4557 (see Figure 8).Example 14.
Fixingα=0.8, γ=0.3, η=0.1, β=0.6, p=1.0, and varying ϕ, the proportion of C(t) in system (2) is shown in Figure 9. By calculation, ϕ1=0.0955, ϕ2=0.6545, so C∗ exists as a maximum (see Figure 9).According to above conclusion, there are some suggestions as follows.(1) Regular antivirus and strengthening the precaution of malwares will help to reduceβ and enlarge γ and can decrease A node.(2) Also strengthening the precaution of malwares, which will enlargeγ, can help to decrease C nodes.(3) Enhancing the firewall’s abilities, like filter and information processing, helps to increasep and prevent S nodes from becoming C nodes.(4) Reinstalling operation system or changing the hardware of computer, which also means to enlargeη or γ, will be useful to turn C nodes to S nodes or make A nodes become W nodes.(5) Practically, it is hard to reduceα by controlling or decreasing the destructive power of malware, but it is available to inhibit the propagation of malware by enhancing the firewall’s abilities of spying and controlling.(6) By taking some special strategies, it is feasible to change the structure of the network, which also means to changeϕ, like installing firewall. Besides, according to the discussion of the parameter of ϕ, it must be regarded that the proportion of C nodes will get its maximum in special ϕ, which will cause enormous damage.


## 5. Conclusion

This paper aims at modelling a dynamical APDDoS attack model. And some properties of this novel model have been deeply researched, like threshold, equilibriums, and stability. The numerical simulations have been got at the same time. Finally, by analyzing the respective influences of system parameters, some suggestions are proposed to reduce the harm of DDoS attacks



---

*Source: 5353060-2018-05-24.xml*