# Propagation Behavior of Virus Codes in the Situation That Infected Computers Are Connected to the Internet with Positive Probability

Authors: Lu-Xing Yang; Xiaofan Yang
Journal: Discrete Dynamics in Nature and Society
 (2012)

---

## Abstract

All the known models describing the propagation of virus codes were based on the assumption that a computer is uninfected at the time it is being connected to the Internet. In reality, however, it is much likely that infected computers are connected to the Internet. This paper is intended to investigate the propagation behavior of virus programs provided infected computers are connected to the Internet with positive probability. For that purpose, a new model characterizing the spread of computer virus is proposed. Theoretical analysis of this model indicates that (1) there is a unique (viral) equilibrium, and (2) this equilibrium is globally asymptotically stable. Further study shows that, by taking active measures, the percentage of infected computers can be made below an acceptable threshold value.


---

## Body

## 1. Introduction

The past few decades have witnessed a rapid progress in computer and communication domains. This progress, however, also provides rich techniques for the development of virus programs. Consequently, antivirus software is indispensable to safeguard data and files stored in computers or transmitted through network [1]. The development of antivirus software, in turn, is preceded by a full understanding of the way that computer viruses spread.To a certain extent, the propagation of virus codes in a collection of interacting computers is analogous to the diffusion of infectious diseases in a population. Inspired by this analogy, some classical epidemic models were modified to characterize the propagation of computer virus, and the obtained results show that the long-term behavior of virus programs could be predicted [2–10]. Very recently, Yang et al. [11] introduced an interesting virus propagation model, known as the SLBS model, by considering the feature of virus codes that a computer possesses infection ability immediately when it is infected.To our knowledge, all the known models describing the propagation of virus codes were established on the assumption that a computer is uninfected at the time it is being connected to the Internet. This assumption, however, is inconsistent with the fact that some computers are already infected at their respective connection times. Indeed, Zuo et al. [12] proved that there is no perfect antivirus software that can detect and clear all kinds of virus codes.This paper is intended to examine the propagation behavior of virus codes in the case that infected computers are connected to the Internet with positive probability. For that purpose, a new computer virus propagation model, which incorporates in the SLBS model the possibility that infected computers are connected to the Internet, is proposed. Stability analysis of this model indicates that there is a unique (viral) equilibrium, which is globally asymptotically stable for any combination of the system parameters. Further investigation shows that, by taking active measures, the percentage of infected computers can be kept below an acceptable threshold value.The remaining materials of this paper are organized in this fashion: Section2 describes the new model. Section 3 proves the global asymptotic stability of the viral equilibrium. A few insights are drawn in Section 4 by conducting a parameter analysis. Finally, Section 5 summarizes this work.


## 2. Model Formulation

At any time, a computer (i.e., node) is classified as eitherinternal or external according as it is connected to the Internet or not at that time, and the nodes all over the world are categorized into the following three classes.  (i)
Susceptible nodes, that is, uninfected nodes.(ii)
Latent  nodes, that is, infected nodes in which all viruses are in their respective latencies.(iii)
Attacked  nodes, that is, infected nodes in which at least one virus is performing its behavior module.For our purpose, the whole set of internal nodes is partitioned into the following three compartments (i.e., subsets).(i)
S compartment: the set of all internal susceptible nodes.(ii)
L compartment: the set of all internal latent nodes.(iii)
A compartment: the set of all internal attacked nodes.At timet, let S(t), L(t), and A(t) denote the respective concentrations of S, L, and A compartments, that is, their respective percentages in all internal nodes. Without ambiguity, S(t), L(t), and A(t) will be abbreviated as S, L, and A, respectively.Our model is based on the following reasonable hypotheses.(H1)
The total amount of internal nodes is conservative.(H2)
An external node is either susceptible or latent at the time it is being connected to the Internet.(H3)
Due to that external susceptible nodes are connected to the Internet, at any time the concentration ofS compartment increases by μ1.(H4)
Due to that external latent nodes are connected to the Internet, at any time the concentration ofL compartment increases by μ2.(H5)
At any time an internal node is disconnected from the Internet with probabilityδ=μ1+μ2. This hypothesis is consistent with hypotheses (H1), (H3), and (H4).(H6)
Due to the contact of susceptible nodes with infected nodes through the Internet, at any time an internal susceptible node is infected with probabilityβ1L+β2A.(H7)
At any time an internal latent node is attacked with probabilityα.(H8)
An internal latent node cannot be cured, which means that its user doesnot start antivirus software actively.(H9)
Due to the effect of antivirus software, at any time an internal attacked node is cured with probabilityγ.Based on this collection of hypotheses, the new model is formulated as(2.1)S˙=μ1-β1SL-β2SA+γA-δS,L˙=μ2+β1SL+β2SA-αL-δL,A˙=αL-γA-δA,
with initial conditions S(0)≥0, L(0)≥0, and A(0)≥0.BecauseS(t)+L(t)+A(t)≡1, this system can be reduced to the following planar system:
(2.2)L˙=μ2+β1(1-L-A)L+β2(1-L-A)A-αL-δL,A˙=αL-γA-δA,
with initial conditions L(0)≥0 and A(0)≥0. It is easily verified that the simply connected compact set
(2.3)Ω={(L,A):L≥0,A≥0,L+A≤1}
is positively invariant for this system.


## 3. Model Analysis

This section is devoted to understanding the dynamical behavior of system (2.2) within Ω.


### 3.1. Equilibrium

Theorem 3.1.
System (2.2) has a unique equilibrium E*=(L*,A*) within Ω, where
(3.1)L*=-a1+a12-4a0a22a0,(3.2)A*=αγ+δL*,(3.3)a0=(α+γ+δ)[β1(γ+δ)+β2α],a1=(γ+δ)[-β1(γ+δ)-β2α+(α+δ)(γ+δ)],a2=-μ2(γ+δ)2.
Moreover, this equilibrium is viral, that is  L*+A*>0.Proof.
All the equilibria of system (2.2) are determined by the following system of equations:
(3.4)μ2+β1(1-L-A)L+β2(1-L-A)A-(α+δ)L=0,αL-(γ+δ)A=0.
Solving this system, we get E*=(L*,A*) as the unique solution within Ω. It is trivial to verify that L*+A*>0.Remark 3.2.
This theorem shows that the proposed system has no virus-free equilibrium and, hence, doesn't undergo any bifurcation, whereas any known computer virus propagation model undergoes fold or backward bifurcation.


### 3.2. Local Analysis

Next, let us examine the local stability of the viral equilibrium.Lemma 3.3.
E
* is locally asymptotically stable.Proof.
Rewrite system (2.2) in the matrix-vector notation as
(3.5)x′=F(x)=(f1(x)f2(x)).
The Jacobian of F evaluated at E* is
(3.6)JF(E*)=(β1(1-2L*-A*)-β2A*-α-δβ2(1-L*-2A*)-β1L*α-γ-δ),
and the corresponding characteristic equation is
(3.7)λ2+b1λ+b2=0,
where
(3.8)b1=β1(2L*+A*)+β2A*+α+γ+2δ-β1,b2=[β1(2L*+A*)+β2A*+α+δ-β1](γ+δ)+α[β2(L*+2A*)+β1L*-β2].
Let S*=1-L*-A*. Since
(3.9)μ2+β1S*L*+β2S*L*αγ+δ-(α+δ)L*=0,
we have
(3.10)β1S*+β2S*αγ+δ<α+δ,
that is, S*<(γ+δ)(α+δ)/(β1(γ+δ)+β2α). Hence,
(3.11)b1=β1L*+β2A*-β1S*+α+γ+2δ>β1L*+β2A*-α+δ1+(β2α/β1(γ+δ))+α+γ+2δ>β1L*+β2A*+γ+δ>0.
On the other hand,
(3.12)b2=[β1(γ+δ)+β2α](L*+A*-1)+β2α(L*+A*-1)+(β1L*+β2A*)(α+γ+δ)+(α+δ)(γ+δ)=-[β1(γ+δ)+β2α]S*+(α+δ)(γ+δ)+(β1L*+β2A*)(α+γ+δ)>(β1L*+β2A*)(α+γ+δ)>0.
By the Hurwitz criterion, the two roots of (3.7) both have negative real parts, and the claimed result follows by the Lyapunov theorem [13].


### 3.3. Global Analysis

Now, it is the turn to examine the global stability of the viral equilibrium.Lemma 3.4.
System (2.2) admits no periodic orbit that lies in the interior of Ω.Proof.
DefineD(L,A)=1/LA. Then,
(3.13)∂(Df1)∂L+∂(Df2)∂A=-μ2AL2-β1A-αA2-β21-AL2<0.
By the Bendixson-Dulac criterion [13], the system has no periodic orbit.Lemma 3.5.
System (2.2) admits no periodic orbit that passes through a point on ∂Ω, the boundary of Ω.Proof.
By the smoothness of all orbits of system (2.2), it can be concluded that:  (1)
there is no periodic orbit that passes through a corner ofΩ, that is, either (0,0) or (0,1) or (1,0),(2)
if there is a periodic orbit that passes through a noncorner point on∂Ω, then this orbit must be tangent to ∂Ω at this point. On the contrary, suppose there is a periodic orbit Γ that passes through a noncorner point (L¯,A¯) on ∂Ω, then there are three possibilities.
Case1: 0<L¯<1, A¯=0. Then we haveA˙|(L¯,A¯)=αL¯>0, implying thatΓis not tangent to∂Ωat this point. A contradiction occurs.
Case2:L¯=0, 0<A¯<1. Then we haveL˙|(L¯,A¯)=μ2+β2(1-A¯)A¯>0, implying thatΓis not tangent to∂Ωat this point, again a contradiction.
Case3: L¯+A¯=1,L¯≠0,A¯≠0. Then we haved(L+A)/dt|(L¯,A¯)=-μ1-γA¯<0, implying thatΓis not tangent to∂Ωat this point, also a contradiction.
Combining the above discussions, we conclude that there is no periodic orbit that passes through a point on∂Ω.We are ready to present the main result of this paper.Theorem 3.6.
E
* is globally asymptotically stable with respect to Ω.Proof.
The claimed result follows by combining the generalized Poincare´-Bendixson theorem [13] with Lemmas 3.3–3.5.Remark 3.7.
This theorem shows that, with the elapse of time, the concentrations of latent nodes and attacked nodes would tend toL* and A*, respectively.Example 3.8.
Consider system (2.2) with β1=0.01, β2=0.02, μ2=0.1, α=0.1, γ=0.1, and δ=0.2. We have (L*,A*)=(0.3437,0.1146), and the phase portrait is presented in Figure 1.Figure 1
Phase portrait for the system given in Example3.8.Example 3.9.
Consider system (2.2) with β1=0.05, β2=0.08, μ2=0.08, α=0.1, γ=0.2, and δ=0.1. We have (L*,A*)=(0.4675,0.1558), and the phase portrait is displayed in Figure 2.Figure 2
Phase portrait for the system given in Example3.9.Example 3.10.
Consider system (2.2) with β1=0.02, β2=0.05, μ2=0.1, α=0.3, γ=0.1, and δ=0.2. We have (L*,A*)=(0.2172,0.2172), and the phase portrait is demonstrated in Figure 3.Figure 3
Phase portrait for the system given in Example3.10.Example 3.11.
Consider system (2.2) with β1=0.1, β2=0.2, μ2=0.1, α=0.4, γ=0.2, and δ=0.1. We have (L*,A*)=(0.2727,0.3648), and the phase portrait is exhibited in Figure 4.Figure 4
Phase portrait for the system given in Example3.11.From Figures1–4 one can see that, for each of these four systems, there exists a globally asymptotically stable viral equilibrium.


## 3.1. Equilibrium

Theorem 3.1.
System (2.2) has a unique equilibrium E*=(L*,A*) within Ω, where
(3.1)L*=-a1+a12-4a0a22a0,(3.2)A*=αγ+δL*,(3.3)a0=(α+γ+δ)[β1(γ+δ)+β2α],a1=(γ+δ)[-β1(γ+δ)-β2α+(α+δ)(γ+δ)],a2=-μ2(γ+δ)2.
Moreover, this equilibrium is viral, that is  L*+A*>0.Proof.
All the equilibria of system (2.2) are determined by the following system of equations:
(3.4)μ2+β1(1-L-A)L+β2(1-L-A)A-(α+δ)L=0,αL-(γ+δ)A=0.
Solving this system, we get E*=(L*,A*) as the unique solution within Ω. It is trivial to verify that L*+A*>0.Remark 3.2.
This theorem shows that the proposed system has no virus-free equilibrium and, hence, doesn't undergo any bifurcation, whereas any known computer virus propagation model undergoes fold or backward bifurcation.


## 3.2. Local Analysis

Next, let us examine the local stability of the viral equilibrium.Lemma 3.3.
E
* is locally asymptotically stable.Proof.
Rewrite system (2.2) in the matrix-vector notation as
(3.5)x′=F(x)=(f1(x)f2(x)).
The Jacobian of F evaluated at E* is
(3.6)JF(E*)=(β1(1-2L*-A*)-β2A*-α-δβ2(1-L*-2A*)-β1L*α-γ-δ),
and the corresponding characteristic equation is
(3.7)λ2+b1λ+b2=0,
where
(3.8)b1=β1(2L*+A*)+β2A*+α+γ+2δ-β1,b2=[β1(2L*+A*)+β2A*+α+δ-β1](γ+δ)+α[β2(L*+2A*)+β1L*-β2].
Let S*=1-L*-A*. Since
(3.9)μ2+β1S*L*+β2S*L*αγ+δ-(α+δ)L*=0,
we have
(3.10)β1S*+β2S*αγ+δ<α+δ,
that is, S*<(γ+δ)(α+δ)/(β1(γ+δ)+β2α). Hence,
(3.11)b1=β1L*+β2A*-β1S*+α+γ+2δ>β1L*+β2A*-α+δ1+(β2α/β1(γ+δ))+α+γ+2δ>β1L*+β2A*+γ+δ>0.
On the other hand,
(3.12)b2=[β1(γ+δ)+β2α](L*+A*-1)+β2α(L*+A*-1)+(β1L*+β2A*)(α+γ+δ)+(α+δ)(γ+δ)=-[β1(γ+δ)+β2α]S*+(α+δ)(γ+δ)+(β1L*+β2A*)(α+γ+δ)>(β1L*+β2A*)(α+γ+δ)>0.
By the Hurwitz criterion, the two roots of (3.7) both have negative real parts, and the claimed result follows by the Lyapunov theorem [13].


## 3.3. Global Analysis

Now, it is the turn to examine the global stability of the viral equilibrium.Lemma 3.4.
System (2.2) admits no periodic orbit that lies in the interior of Ω.Proof.
DefineD(L,A)=1/LA. Then,
(3.13)∂(Df1)∂L+∂(Df2)∂A=-μ2AL2-β1A-αA2-β21-AL2<0.
By the Bendixson-Dulac criterion [13], the system has no periodic orbit.Lemma 3.5.
System (2.2) admits no periodic orbit that passes through a point on ∂Ω, the boundary of Ω.Proof.
By the smoothness of all orbits of system (2.2), it can be concluded that:  (1)
there is no periodic orbit that passes through a corner ofΩ, that is, either (0,0) or (0,1) or (1,0),(2)
if there is a periodic orbit that passes through a noncorner point on∂Ω, then this orbit must be tangent to ∂Ω at this point. On the contrary, suppose there is a periodic orbit Γ that passes through a noncorner point (L¯,A¯) on ∂Ω, then there are three possibilities.
Case1: 0<L¯<1, A¯=0. Then we haveA˙|(L¯,A¯)=αL¯>0, implying thatΓis not tangent to∂Ωat this point. A contradiction occurs.
Case2:L¯=0, 0<A¯<1. Then we haveL˙|(L¯,A¯)=μ2+β2(1-A¯)A¯>0, implying thatΓis not tangent to∂Ωat this point, again a contradiction.
Case3: L¯+A¯=1,L¯≠0,A¯≠0. Then we haved(L+A)/dt|(L¯,A¯)=-μ1-γA¯<0, implying thatΓis not tangent to∂Ωat this point, also a contradiction.
Combining the above discussions, we conclude that there is no periodic orbit that passes through a point on∂Ω.We are ready to present the main result of this paper.Theorem 3.6.
E
* is globally asymptotically stable with respect to Ω.Proof.
The claimed result follows by combining the generalized Poincare´-Bendixson theorem [13] with Lemmas 3.3–3.5.Remark 3.7.
This theorem shows that, with the elapse of time, the concentrations of latent nodes and attacked nodes would tend toL* and A*, respectively.Example 3.8.
Consider system (2.2) with β1=0.01, β2=0.02, μ2=0.1, α=0.1, γ=0.1, and δ=0.2. We have (L*,A*)=(0.3437,0.1146), and the phase portrait is presented in Figure 1.Figure 1
Phase portrait for the system given in Example3.8.Example 3.9.
Consider system (2.2) with β1=0.05, β2=0.08, μ2=0.08, α=0.1, γ=0.2, and δ=0.1. We have (L*,A*)=(0.4675,0.1558), and the phase portrait is displayed in Figure 2.Figure 2
Phase portrait for the system given in Example3.9.Example 3.10.
Consider system (2.2) with β1=0.02, β2=0.05, μ2=0.1, α=0.3, γ=0.1, and δ=0.2. We have (L*,A*)=(0.2172,0.2172), and the phase portrait is demonstrated in Figure 3.Figure 3
Phase portrait for the system given in Example3.10.Example 3.11.
Consider system (2.2) with β1=0.1, β2=0.2, μ2=0.1, α=0.4, γ=0.2, and δ=0.1. We have (L*,A*)=(0.2727,0.3648), and the phase portrait is exhibited in Figure 4.Figure 4
Phase portrait for the system given in Example3.11.From Figures1–4 one can see that, for each of these four systems, there exists a globally asymptotically stable viral equilibrium.


## 4. Discussions

Due to the fact that the proposed model has no virus-free equilibrium, any effort in eradicating virus is doomed to failure. In practical situations, the best achievable goal is to keep the percentage of infected nodes below an acceptable threshold. For that purpose, some valuable suggestions shall be presented in this section.Theorem 4.1.
L
*
+
A
*
≤
T if and only if
(4.1)a0(γ+δ)2T2+a1(γ+δ)(α+γ+δ)T+a2(α+γ+δ)2≥0.Proof.
This result follows by substituting (3.1)-(3.2) into L*+A*≤T and simplifying the resulting inequality.This theorem has the following three valuable corollaries.Corollary 4.2.
L
*
+
A
*
≤
T if and only if μ2≤μ2,max, where
(4.2)μ2,max⁡=Tα+γ+δ{[β1(γ+δ)+β2α](T-1)+(α+δ)(γ+δ)}.Proof.
The claimed result holds by combining Theorem4.1 with (3.10).Example 4.34.3.
Consider a class of systems (2.2) with α=0.1, γ=0.1, δ=0.2, β1=0.1, and β2=0.2. In order that L*+A*≤T, it is sufficient by Corollary 4.2 that μ2≤μ2,max=(7T2+2T)/40 be satisfied. See Figure 5 for how μ2,max varies with T.Figure 5
μ
2
,
max versus T for the class of systems given in Example 4.3.Corollary 4.4.
L
*
+
A
*
≤
T if and only if 0<β1≤β1,max, where
(4.3)β1,max=μ2(α+γ+δ)+[β2α-(α+δ)(γ+δ)]T-β2αT2(γ+δ)T(T-1).Proof.
The claimed result holds by Theorem4.1.Example 4.5.
Consider a class of systems (2.2) with α=0.3, γ=0.1, δ=0.2, μ2=0.01, and β2=0.1. In order that L*+A*≤T, it is sufficient by Corollary 4.4 that 0<β1≤β1,max=(5T2+20T-1)/50T(1-T) be satisfied. See Figure 6 for how β1,max varies with T.Figure 6
β
1
,
max versus T for the class of systems given in Example 4.5.Corollary 4.6.
L
*
+
A
*
≤
T if and only if 0<β2≤β2,max, where
(4.4)β2,max⁡=μ2(α+γ+δ)+[β1(γ+δ)-(α+δ)(γ+δ)]T-β1(γ+δ)T2αT(T-1).Proof.
The claimed result holds by Theorem4.1.Example 4.7.
Consider system (2.2) with α=0.3, γ=0.1, δ=0.2, μ2=0.01, and β1=0.1. In order that L*+A*≤T, it is sufficient by Corollary 4.6 that 0<β2≤β2,max=(5T2+20T-1)/50T(1-T) be satisfied. See Figure 7 for how β2,max varies with T.Figure 7
β
2
,
max versus T for the class of systems given in Example 4.7.Second, check the dependency ofu:=L*+A* on β1, β2, and μ2, respectively. We have
(4.5)c0u2+c1u+c2=0,
where
(4.6)c0=β1(γ+δ)+β2α,c1=(α+δ)(γ+δ)-β2α-β1(γ+δ),c2=-μ2(α+γ+δ).Theorem 4.8.
∂
u
/
∂
β
1
>
0, ∂u/∂β2>0, ∂u/∂μ2>0.Proof.
(4.7)
∂
u
∂
β
1
=
(
γ
+
δ
)
u
(
1
-
u
)
(
2
u
-
1
)
[
β
1
(
γ
+
δ
)
+
β
2
α
]
+
(
α
+
δ
)
(
γ
+
δ
)
=
(
γ
+
δ
)
u
(
1
-
u
)
c
1
2
-
4
c
0
c
2
>
0
,
∂
u
∂
β
2
=
α
u
(
1
-
u
)
(
2
u
-
1
)
[
β
1
(
γ
+
δ
)
+
β
2
α
]
+
(
α
+
δ
)
(
γ
+
δ
)
=
α
u
(
1
-
u
)
c
1
2
-
4
c
0
c
2
>
0
,
∂
u
∂
μ
2
=
α
+
γ
+
δ
(
2
u
-
1
)
[
β
1
(
γ
+
δ
)
+
β
2
α
]
+
(
α
+
δ
)
(
γ
+
δ
)
=
α
+
γ
+
δ
c
1
2
-
4
c
0
c
2
>
0
.
The proof is complete.Remark 4.9.
This theorem states thatu is increasing with β1, β2, and μ2. Hence, another means of suppressing the concentration of infected nodes is to reduce these parameters.Finally, examine the dependency ofu:=L*+A* on γ and δ, respectively.Theorem 4.10.
∂
u
/
∂
γ
<
0 and ∂u/∂δ<0 if β1(γ+δ)+β2α-β2γ>0.Proof.
By means of the implicit differentiation, it is derived that(4.8)∂u∂γ=μ2+(β1-α-δ)u-β1u2(2u-1)[β1(γ+δ)+β2α]+(α+δ)(γ+δ)=[(β1(α+δ)(γ+δ)/(β1(γ+δ)+β2α))-α-δ]u+μ2[1-β1(α+γ+δ)/(β1(γ+δ)+β2α)]c12-4c0c2=(α/β1(γ+δ)+β2α)[-β2(α+δ)u+μ2(β2-β1)]c12-4c0c2.
Since
(4.9)μ2+β1S*L*+β2S*A*-γA*-δ(L*+A*)=0,
then
(4.10)μ2-(γ+δ)u<0.
In view of β2α+β1(γ+δ)>β2γ, one can derive
(4.11)u>μ2γ+δ>μ2(β2-β1)β2(α+δ),
which implies ∂u/∂γ<0. Likewise,
(4.12)∂u∂δ=μ2-(α+γ+2δ)u-β1u2c12-4c0c2<0.
The proof is complete.Remark 4.11.
This theorem states that in some casesu is decreasing with γ and δ. Thus, still another means of inhibiting the concentration of infected nodes is to enhance these parameters.


## 5. Summary

A new model describing the spread of computer virus has been proposed, under which infected computers are assumed to be probably connected to the Internet. To our knowledge, this is the first model with this reasonable assumption. Qualitative analysis of this model has shown that, entirely different from any previously proposed model, the new model admits no virus-free equilibrium. Rather, it possesses a globally asymptotically stable viral equilibrium. Furthermore, it has been indicated that, by adjusting some system parameters, the concentration of infected computers can be reduced.This work provides a new insight into the modeling of propagation of computer virus, which, in our opinion, would arouse considerable interest from the computer virus community.



---

*Source: 693695-2012-07-03.xml*