# Modeling and Analysis of the Spread of Malware with the Influence of User Awareness

Authors: Qingyi Zhu; Xuhang Luo; Yuhang Liu
Journal: Complexity
 (2021)

---

## Abstract

By incorporating the security awareness of computer users into the susceptible-infected-susceptible (SIS) model, this study proposes a new malware propagation model, named the SID model, where D compartment denotes the group of nodes with user awareness. Through qualitative analysis, the basic reproductive numberR0 is given. Furthermore, it is proved that the virus-free equilibrium is globally asymptotically stable if R0 is less than one, whereas the viral equilibrium is globally asymptotically stable if R0 is greater than one. Then, some numerical examples are given to demonstrate the analytical results. Finally, we put forward some efficient control measures according to the theoretical and experimental analysis.


---

## Body

## 1. Introduction

Malware is the generic term used to designate any informatics program created deliberately to carry out an unauthorized activity that, in many cases, is harmful to the system in which it has been lodged [1]. There is an increasing trend in both the number and types of malware. According to the report in [2], there is an exponential growth in the number of viruses, and in 2017, there are 15,107,232 different malware files that we had never seen before, mainly because of the improvement of technology and the increasing Internet population. Hence, there are lots of researchers trying to develop effective methods and tools to detect malware from a microperspective [3–5].Although the scientific approach to combating malware is mainly focused on the design of efficient methods to detect and remove malware [6], it is also worth modeling the propagation behaviors of malware and developing effective control strategies, furthermore, to prevent its outbreak. Most of these models are dynamical systems of ordinary differential equations [7]. They are compartmental, that is, the nodes are divided into different types, such as susceptible, exposed, infectious, recovered, and quarantined. Thus, a great number of models (SIS models [8, 9], SIR models [10, 11], SEIR models [12], and SIRQ models [13]) have been proposed.In recent years, most malware propagation models are proposed by incorporating some new compartments into the existing models. In [14], by considering the protected nodes in cloud, Gan et al. proposed an SIP model for computer virus propagation. More specifically, the protected nodes in cloud can be not infected but might be converted into an S compartment in a certain probability. Similarly, considering the devices that can be infected by the malware but cannot be damaged, an SIRC model is built in [15], where C denotes the carrier device.On the other hand, user’s awareness also has gained a lot of attention from researchers. In [16], the authors pointed out that the missing of user awareness might cause some security issues. In [17], Furnell also claimed that phishing is a significant security threat, and the problem cannot be completely solved by technology alone; in this context, user awareness is highly required. It is no doubt that user awareness is essential for cybersecurity. Considering that user awareness also plays an important role in slowing down the propagation of malware, an improved model based on the SLIR model with user awareness has been put forward in [18]. In [18], the user whose computer is not infected or exposed is probable to install antivirus programs, and the probability here is called user awareness.In [1], the author raised the issue that the infection rate of computers may vary from computer to computer. For example, if users are worried about security issues, the infection rate should be reduced. In contrast, if users have dangerous behaviors, the infection rate should be higher. Inspired by this, this study aims to address the issue of different infection rates of computers with/without user awareness. Different from the work in [18], a new compartment (D compartment) is incorporated into the classical SIS model. Here, D compartment denotes the group of nodes with security awareness, whereas S represents the node with dangerous behaviors. Obviously, the infection rate of D nodes is less than S nodes. Besides, in [19, 20], the author proposed S and W compartments similar to S and D compartments in this article, where the conversion rate of the two is a constant. However, we noticed that the change in user awareness is related to the number of infections. The higher the number of infections, the higher the awareness of users. So, we consider that the rate of consciousness conversion is related to the number of infections.The main contributions of this work are as follows:(1)
A new model describing computer virus propagation is built from the perspective of user awareness(2)
Two equilibrium of the model is obtained: the virus-free equilibrium point and the viral equilibrium, and furthermore, their local and global stabilities are proved, respectively.(3)
Through qualitative analysis and simulation experiments, effective control measures are proposed to prevent the outbreak and spread of malwareThe remaining materials of this study are organized as follows: Section2 formulates the proposed propagation model of malware. In Section 3, local stabilities of both the infection-free and viral equilibria are analyzed, respectively, while Section 4 deals with the global stabilities of the two equilibria. In Section 5, some numerical simulations are performed to illustrate the obtained theoretical results and efficient control measures. Finally, Section 6 summarizes this work and gives some shortcomings.


## 2. Mathematical Framework

The model proposed in this work is a compartmental model where the computers are divided into 3 classes: susceptible nodes (S) which can be infected by malware easily, nodes with user awareness (D) which can be infected by malware more difficult than S nodes, and infected nodes (I) which can infect other nodes. The transfer diagram is shown in Figure 1. The following notations and assumptions will be adopted in the sequel.Figure 1
The transfer diagram of the model.


### 2.1. Notations

St: the number of S nodes at time tDt: the number of D nodes at time tIt: the number of I nodes at time tNt: the total number of nodes at time tα: the rate at which the node connects to the networkμ: the rate at which the node disconnects to the networkβ1: the infection rate of S nodes caused by an I nodeβ2: the infection rate of D nodes caused by an I node. Obviously, β2<β1.ϵ: the conversion rate from S nodes to D nodes caused by an I nodeη: the recovery rates of I nodes due to the effect of antivirus software


### 2.2. Model Assumptions

(i)
All newly accessed nodes areS nodes(ii)
At timet, the infection force from S to I is given by β1StIt, and the infection force from D to I is given by β2DtIt.(iii)
Due to the spread of malware, users gradually become conscious. At timet, the conversion force from S to D is given by εStIt.(iv)
At timet, the users of the recovered nodes all have improved, and the recovered force of I nodes is ηIt.


### 2.3. Model Formulation

Considering the above assumptions, the dynamics of the model is governed by the following system of ordinary differential equations:(1)dSdt=α−μS−β1SI−ϵIS,dDdt=ϵIS+ηI−β2DI−μD,dIdt=β1SI+β2DI−ηI−μI.According toNt=St+Dt+It, we have dN/dt=α−μN. Obviously, when t⟶∞, N⟶α/μ. Thus, system (1) can be reduced to the following limit system:(2)dSdt=α−μS−β1SI−ϵIS,dIdt=β1SI+β2αμ−S−II−ηI−μI.It is easy to verify that all feasible solutions of equation (2) are bounded and finally fall inside the region Ψ defined as(3)Ψ=S,I:S≥0,I≥0,D+I≤αμ.Obviously, system (2) has infection-free equilibrium E0=α/μ,0.The basic reproduction numberR0 is defined as the average number of computers infected by an infected device during the period from infection. R0 often serves as a threshold parameter that predicts whether an infection will spread. For system (2), we have(4)R0=β1αμμ+η.IfR0>1, system (2) has a viral equilibrium E∗=S∗,I∗:(5)I∗=b2−4ac−b2a,S∗=αμ+β1I∗+εI∗,where(6)a=μβ2β1+ε,b=μ2β1+β2+ε+β1+εμη−β2α,c=μμ2+μη−β1α.


## 2.1. Notations

St: the number of S nodes at time tDt: the number of D nodes at time tIt: the number of I nodes at time tNt: the total number of nodes at time tα: the rate at which the node connects to the networkμ: the rate at which the node disconnects to the networkβ1: the infection rate of S nodes caused by an I nodeβ2: the infection rate of D nodes caused by an I node. Obviously, β2<β1.ϵ: the conversion rate from S nodes to D nodes caused by an I nodeη: the recovery rates of I nodes due to the effect of antivirus software


## 2.2. Model Assumptions

(i)
All newly accessed nodes areS nodes(ii)
At timet, the infection force from S to I is given by β1StIt, and the infection force from D to I is given by β2DtIt.(iii)
Due to the spread of malware, users gradually become conscious. At timet, the conversion force from S to D is given by εStIt.(iv)
At timet, the users of the recovered nodes all have improved, and the recovered force of I nodes is ηIt.


## 2.3. Model Formulation

Considering the above assumptions, the dynamics of the model is governed by the following system of ordinary differential equations:(1)dSdt=α−μS−β1SI−ϵIS,dDdt=ϵIS+ηI−β2DI−μD,dIdt=β1SI+β2DI−ηI−μI.According toNt=St+Dt+It, we have dN/dt=α−μN. Obviously, when t⟶∞, N⟶α/μ. Thus, system (1) can be reduced to the following limit system:(2)dSdt=α−μS−β1SI−ϵIS,dIdt=β1SI+β2αμ−S−II−ηI−μI.It is easy to verify that all feasible solutions of equation (2) are bounded and finally fall inside the region Ψ defined as(3)Ψ=S,I:S≥0,I≥0,D+I≤αμ.Obviously, system (2) has infection-free equilibrium E0=α/μ,0.The basic reproduction numberR0 is defined as the average number of computers infected by an infected device during the period from infection. R0 often serves as a threshold parameter that predicts whether an infection will spread. For system (2), we have(4)R0=β1αμμ+η.IfR0>1, system (2) has a viral equilibrium E∗=S∗,I∗:(5)I∗=b2−4ac−b2a,S∗=αμ+β1I∗+εI∗,where(6)a=μβ2β1+ε,b=μ2β1+β2+ε+β1+εμη−β2α,c=μμ2+μη−β1α.


## 3. Local Stability

In this section, we will analyze the two local stabilities of the equilibria of the system.Theorem 1.
E0 is locally asymptotically stable if R0<1. Whereas, E0 is unstable if R0>1.Proof.
By linearizing system (2) at E0, we get the characteristic equation:(7)λ+μβ1αμ+ε0λ+η+μ−β1Nαμ=0.
Thus,(8)λ+αλ+η+μ−β1Nαμ=0,(9)λ1=−μ<0,λ2=−η−μ+β1Nαμ.
On the one hand, all roots of equation (8) have negative real parts, and hence, E0 is locally asymptotically stable if R0<1. On the other hand, equation (8) has at least one root with positive real, and hence, E0 is unstable if R0>1.Theorem 2.
E∗ is locally asymptotically stable if R0>1.Proof.
By linearizing system (2) at E∗, we get the characteristic equation:(10)λ+μ+β1I∗+εI∗β1S∗+εS∗β2I∗−β1I∗λ+β2S∗+2β1I∗+η+μ−β1S∗−β2αμ=0.
Thus,(11)λ2+k1λ+k2=0,where(12)k1=β2S∗+3β1I∗+η+2μ+εI∗−β1S∗−β2αμ,k2=μ+β1I∗+εI∗β2S∗+2β1I∗+η+μ−β1S∗−β2αμ+I∗S∗β1+εβ1−β2.
The following inequality can be obtained from Section2: β1>β2. We can also obtain an equation from the second equation of system (2): β1S∗+β2α/μ=β2S∗+β2I∗+η+μ.
We havek1=2β1I∗+μ+εI∗+β1−β2I∗>0 and β2S∗+2β1I∗+η+μ−β1S∗−β2α/μ=β1I∗>0, so k2>0.
It follows from the Hurwitz [21] criterion that the two roots of (11) have negative real parts. Thus, the claimed result follows.


## 4. Global Stability

Theorem2 has revealed that the equilibrium E∗ and E0 in the system (2) are locally asymptotically stable, respectively. Then, we intend to analyze the global stability of the SID epidemic model in this section. A famous method is for determining a system whether having periodic orbits is the Bendixson–Dulac [22] criterion. The following lemma will be useful in the sequel before proving the global stability of equilibrium points.Lemma 1.
The system has no periodic orbits inΨ for system (2).Proof.
Define(13)h1S,I=α−μS−β1SI−εIS,h2S,I=β1SI+β2αμI−β2SI−β2I2−ηI−μI.
Constructing Dulac function [22],(14)FD,I=1SI.
In the interior ofΨ, one can get(15)∂Fh1∂S+∂Fh2∂I=−αS2I−β2S<0.
Therefore, it follows from the Bendixson–Dulac criterion [22] that the interior of Ψ for system (2) does not contain periodic orbit.
We should take into account the boundary ofΨ after considering the interior area. Assume that an arbitrary point (S˜,I˜) is on the edge of the Ψ. After that, the following three possibilities will be discussed, respectively:(1)
Case 1: when0<S˜≤α/μ and I˜=0, then(16)dIdtS˜,I˜=0.(2)
Case 2: when0<I˜≤α/μ and S˜=0, then(17)dSdtS˜,I˜=α>0.(3)
Case 3: whenS˜+I˜=α/μ, S˜≠0, and I˜≠0, then(18)dS+IdtS˜,I˜=α+β2Iαμ−I−S−μS+I−ϵIS−ηI=−ϵIS−ηI<0.
Thus, it complies with the above three cases that there is no periodic orbit getting past (S˜,I˜) for system (2). In brief, there is no periodic orbit within Ω˜ for system (2). Now, the proof has been completed.
Then, we can set out to prove the equilibriaE∗ and E0 of system (2) are global asymptotically stable in corresponding conditions, respectively.Theorem 3.
E0 is globally asymptotically stable with respect to Ψ if R0<1, whereas E∗ is globally asymptotically stable with respect to Ψ if R0>1.Proof.
With the basis of Theorems1 and 2 and Lemma 1, according to the Poincare–Bendixson theorem [22], one can get that the equilibrium E∗ is globally asymptotically stable for system (2) with respect to Ψ if R0>1, and E0 is globally asymptotically stable with respect to Ψ if R0<1. Now, we accomplish the proof.Remark 1.
Theorems1–3 have presented a phenomenon that the malware cannot be completely suppressed if R0>1. But according to Theorem 1, some factors can also suppress the spread of malware. In another aspect, with these related parameters, the proportion of infected can be reduced. This also provides an effective direction to curb the spread of malware in computers.


## 5. Numerical Simulations

This section is to give some numerical simulations to verify our theoretical results.Example 1.
Consider system (1) with parameters α=1,μ=0.1,ϵ=0.02, β1=0.05, β2=0.02, and η=0.45; then, R0=0.91<1, and some initial values are given in Table 1.
In Figure2, E0 is globally stable if R0<1. What is more, we can get a conclusion that the initial value has nothing to do with the global stability if R0<1.Table 1
Simulation initial values.
Initial valueS0D0I0Case 1208Case 2406Case 3604Case 4235Case 5442Figure 2
The time plot for the system given inExample 1.Example 2.
Consider system (1) with parameters α=1,μ=0.1,ϵ=0.02, β1=0.1, β2=0.05, and η=0.45; then, R0=1.82>1, and the initial values of the system are kept the same as given in Table 1.
In Figure3, E∗ is globally stable if R0>1. We can also find that the initial value has no effect on the spread of malware if R0>1. By comparing Figure 2 with Figure 3, keeping the basic reproduction number R0<1 is an effective way to prevent the breakout of malware.Figure 3
The time plots for the system given in Example2.Example 3.
We will illustrate the influence of different the awareness conversion rateϵ = {0.02, 0.08, 0.14, 0.20, 0.26} on system (1). Consider system (1) with parameters α=1,μ=0.1,β1=0.1, β2=0.02, and η=0.1 and with initial conditions S0=9, D0=0, and I0=1.
Since user awareness plays an important role in malware propagation, Figure4 shows time plots of the number of infected users with varied awareness conversion rates. We can find that the higher the awareness conversion rate, the smaller the number of infected users. So, raising user awareness can effectively control the number of infected users.Figure 4
The time plots of number of infected nodes of the system with conditions given in Example3.Example 4.
Due to the importance ofR0, we will discuss how parameters affect the evolution of malware propagation over time. The parameters are given in Table 2.
We can find thatR0 and β1 have a positive linear relationship as shown in Figure 5. Therefore, we can keep the contact rate β1 at a low level to prevent the spread of malware in computers effectively. R0 and α have a positive linear relationship in Figure 6. Figure 7 shows that R0 decreases as μ increases. Thus, it is reasonable to reduce the online rate of the computer and increase the disconnect rate of computer when the malware spreads and breaks out. Figure 8 shows that R0 will drop sharply if the recovery rate increased. So, installing the latest antimalware software on computers is another effective countermeasure to control the propagation of malware.Table 2
Simulation parameters.
Figuresβ1αμηFigure5∗10.10.6Figure60.05∗0.10.6Figure70.051∗0.6Figure80.0510.1∗Figure 5
The effect ofβ1 on R0.Figure 6
The effect ofα on R0.Figure 7
The effect ofμ on R0.Figure 8
The effect ofη on R0.Example 5.
Finally, we compare the SIS model with our proposed model through several sets of simulation experiments. The SIS model with the infection rateβ and the recovery rate η1 have been proposed in [23]. Here, β=β1 and η1=η. The initial conditions are S0=6, D0=0, and I0=4. The parameters are given in Table 3.
In Figure9, we can clearly see that the final number of infected nodes in the SID model is always smaller than the corresponding number in the SIS model. So, it makes sense to improve the security awareness of users.Table 3
Simulation parameters.
Parametersαμβ1β2ηϵβη1Case 110.10.10.050.20.040.10.2Case 210.10.30.10.20.020.30.2Case 310.10.50.20.20.040.50.2Figure 9
The time plots for the system given in Example5.


## 6. Conclusion

Inspired that user awareness plays an important role in the spread of malware, a new model based on the SIS model is proposed. Through mathematical analysis and simulation experiments, the rationality of the model is verified, and it is proposed that if we improve user awareness before malware propagation, then preventing the spread of malware will be achieved. Moreover, biological and malware models have many similar behaviors. Hence, it makes sense to compare biological and malware models. The novel coronavirus infectious disease is commonly known as COVID-19 and has become the greatest challenge in this world [24]. To study the spread of the coronavirus, there are plenty of mathematical models about COVID-19 [25–27]. The model proposed in this article can also be used to describe the propagation of COVID-19. In this context, S node represents people who have not taken any measures against COVID-19, D node represents people who have taken measures against COVID-19, such as wearing a mask or staying at home, and I node represents people who have been infected and can infect others.



---

*Source: 6639632-2021-11-01.xml*