# Global Bifurcation of a Novel Computer Virus Propagation Model

Authors: Jianguo Ren; Yonghong Xu; Jiming Liu
Journal: Abstract and Applied Analysis
 (2014)

---

## Abstract

In a recent paper by J. Ren et al. (2012), a novel computer virus propagation model under the effect of the antivirus ability in a real network is established. The analysis there only partially uncovers the dynamics behaviors of virus spread over the network in the case where around bifurcation is local. In the present paper, by mathematical analysis, it is further shown that, under appropriate parameter values, the model may undergo a global B-T bifurcation, and the curves of saddle-node bifurcation, Hopf bifurcation, and homoclinic bifurcation are obtained to illustrate the qualitative behaviors of virus propagation. On this basis, a collection of policies is recommended to prohibit the virus prevalence. To our knowledge, this is the first time the global bifurcation has been explored for the computer virus propagation. Theoretical results and corresponding suggestions may help us suppress or eliminate virus propagation in the network.


---

## Body

## 1. Introduction

More and more applications based on computer networks go into our daily life. While bringing convenience to us, computer networks are exposed to various threats. Computer viruses, which are programs developed to attempt to attach themselves to a host and spread to other computers mainly through Internet, can damage network resources. Consequently, understanding the law governing the spread of computer virus is of considerable interest.Due to the high similarity between computer viruses and biological viruses [1], the classical SIR (Susceptible-Infected-Recovered) computer virus propagation model borrowed from its epidemic counterpart was proposed [2–4], which is formulated as the following system of differential equations:
(1)
d
S
d
t
=
b
-
λ
S
(
t
)
I
(
t
)
-
d
S
(
t
)
,
d
I
d
t
=
λ
S
(
t
)
I
(
t
)
-
ε
I
(
t
)
-
d
I
(
t
)
,
d
R
d
t
=
ε
I
(
t
)
-
d
R
(
t
)
.
Here it is assumed that all the computers connected to the network in concern are classified into three categories: susceptible, infected, and recovered computers. Let S
(
t
), I
(
t
), and R
(
t
) denote their corresponding numbers at time t, respectively. This model involves four positive parameters: b denotes the rate at which external computers are connected to the network, ε denotes the recovery rate of infected computers due to the antivirus ability of the network, d denotes the rate at which one computer is removed from the network, and λ denotes the rate at which, when having connection to one infected computer, one susceptible computer can become infected. For some variants of this model or its extensions, see [5–19].The use of antivirus software is regarded as one of the most effective approaches to recovering infected computers [20]. In reality, the ability of an antivirus software is usually proportional to its cost. Due to the limited software cost, the antivirus ability of a network is limited. So, it is natural to consider the following recovery function:
(2)
T
(
I
)
=
{
ε
I
if
0
≤
I
≤
I
0
,
m
if
I
>
I
0
,
where ε is the recovery rate when the antivirus ability is not fully utilized; m
=
ε
I
0. The susceptible individuals are assumed to have the logistic growth with carrying capacity k
>
0 as well as intrinsic growth rate r
>
0.Based on the above mentioned work, we establish a novel computer virus propagation model in [19]:
(3)
d
S
d
t
=
r
S
(
1
-
S
k
)
-
λ
S
I
-
d
S
,
d
I
d
t
=
λ
S
I
-
T
(
I
)
-
d
I
,
d
R
d
t
=
T
(
I
)
-
d
R
.
Because the first two equations in (3) are independent of R, we can consider the following reduced model:
(4)
d
S
d
t
=
r
S
(
1
-
S
k
)
-
λ
S
I
-
d
S
,
d
I
d
t
=
λ
S
I
-
T
(
I
)
-
d
I
.In [19], we carry out the global qualitative analysis of the model and obtain rich dynamical properties. First, we give the threshold value determining whether the virus dies out completely. Second, we study the existence of equilibria and investigate their local and global asymptotic stability. Next, we find that, depending on the antivirus ability, the system may undergo a local backward bifurcation or a Hopf bifurcation. Finally, we prove that, under appropriate conditions, the system may admit bistable states: a stable virus-free equilibrium and a stable virus equilibrium, or two stable virus equilibria. In this case, the initial condition is critical for the eventual steady state of the system.In consideration of the fact that our former work on the dynamics behaviors of virus spread in model (4) is incomplete. In this paper, we continue the previous work and give detailed theoretical analysis of the presented model so as to supplement its rich dynamics. In fact, by our mathematical analysis, we have not only theoretically proved the existence of global Bogdanov-Takens bifurcation in the model, but also obtained the curves of saddle-node bifurcation, Hopf bifurcation, and homoclinic bifurcation, even for unstable limit cycle and stable virus equilibrium cases and especially found stability switches for the virus equilibria near the Bogdanov-Takens bifurcation point so that the qualitative behaviors of virus spread have been illustrated, all of which are instructive for us to choose appropriate virus-controlling strategy. On this basis, a set of policies is recommended for eradicating viruses spreading across the Internet effectively.The remaining materials of this paper are organized this way: Section2 studies the existence of equilibria of model (4); Section 3 examines the global Bogdanov-Takens bifurcation; Section 4 illustrates the qualitative behaviors of the bifurcation. We end the paper with a brief concluding remark in Section 5.


## 2. Equilibria

To obtain equilibria, model (4) can be written as
(5)
r
S
(
1
-
S
k
)
-
d
S
-
λ
S
I
=
0
,
λ
S
I
-
I
(
d
+
ε
)
=
0
,
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
if
0
≤
I
≤
I
0
,
(6)
r
S
(
1
-
S
k
)
-
λ
S
I
-
d
S
=
0
,
λ
S
I
-
m
-
d
I
=
0
,
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
a
i
i
if
I
0
<
I
.
Equation (5) has a trivial equilibrium E
0
=
(
0,0
) and a virus-free equilibrium E
0
*
=
(
k
(
r
-
d
)
/
r
,
0
). Let R
0
=
k
λ
(
r
-
d
)
/
r
(
d
+
ε
) and if R
0
>
1, then (5) admits a unique positive solution E
*
(
S
*
,
I
*
), where
(7)
S
*
=
k
(
r
-
d
)
r
R
0
,
I
*
=
(
R
0
-
1
)
(
r
-
d
)
λ
R
0
.
Obviously, E
* is a virus equilibrium of (5) if and only if
(8)
1
<
R
0
≤
1
+
λ
I
0
(
r
-
d
-
λ
I
0
)
.
From (6) we get a quadratic equation in I:
(9)
k
λ
2
I
2
-
b
I
+
m
r
=
0
,
where b
=
k
λ
(
r
-
d
)
-
r
d. When b
>
0 and Δ
=
b
2
-
4
k
m
r
λ
2
≥
0 (which is equivalent to R
0
≥
1
+
(
2
λ
k
m
r
-
r
ε
)
/
r
(
d
+
ε
)), (6) has the following positive solutions:
(10)
I
1
=
b
-
Δ
2
k
λ
2
,
I
2
=
b
+
Δ
2
k
λ
2
.
Accordingly,
(11)
E
1
=
(
S
1
,
I
1
)
=
(
2
k
λ
-
(
b
-
Δ
)
2
λ
r
,
b
-
Δ
2
k
λ
2
)
,
E
2
=
(
S
2
,
I
2
)
=
(
2
k
λ
-
(
b
+
Δ
)
2
λ
r
,
b
+
Δ
2
k
λ
2
)
.
E
1, E
2 are virus equilibria if I
1, I
2
>
I
0.Let us consider the inequalityI
1
>
I
0, which is equivalent to 2
k
λ
2
I
0
-
b
≤
-
Δ. By solving it, we get
(12)
1
+
2
k
λ
2
I
0
-
r
ε
r
(
d
+
ε
)
<
R
0
<
1
+
k
λ
2
I
0
r
(
d
+
ε
)
.
Likewise, we can derive I
2
>
I
0 if
(13)
R
0
>
1
+
2
k
λ
2
I
0
-
r
ε
r
(
d
+
ε
)
,
or
(14)
1
+
k
λ
2
I
0
r
(
d
+
ε
)
<
R
0
<
1
+
2
k
λ
2
I
0
-
r
ε
r
(
d
+
ε
)
.
Notice that R
0
<
1
+
k
λ
2
I
0
/
r
(
d
+
ε
) is equivalent to R
0
<
1
+
λ
I
0
/
(
r
-
d
-
λ
I
0
). To summarize, we get the following.Theorem 11 (see [19]).
Consider model (4). Let
(15)
R
0
=
k
λ
(
r
-
d
)
r
(
d
+
ε
)
,
p
0
=
1
+
2
λ
k
m
r
-
r
ε
r
(
d
+
ε
)
,
p
1
=
1
+
2
k
λ
2
I
0
-
r
ε
r
(
d
+
ε
)
,
p
2
=
1
+
k
λ
2
I
0
r
(
d
+
ε
)
.
If R
0
>
p
0, then E
1 and E
2 are the only possible equilibria. Moreover, (i)
if2
k
λ
2
I
0
<
r
ε
+
k
λ
2
I
0 and p
1
<
R
0
<
p
2, then both E
1 and E
2 are equilibria;
(ii)
if2
k
λ
2
I
0
<
r
ε
+
k
λ
2
I
0 and R
0
≥
p
2, then E
1 is an equilibrium but E
2 is not;
(iii)
if2
k
λ
2
I
0
>
r
ε
+
k
λ
2
I
0, then E
1 does not exist. Furthermore, E
2 exists if and only if R
0
>
p
2.


## 3. Global Bifurcation

In this section, we will study the global bifurcation of the above model. In fact, if the conditionΔ
=
b
2
-
4
k
m
r
λ
2
=
0 (which is equivalent to R
0
=
1  +  (
2
λ
k
m
r
-
r
ε
)
/
r
(
d
+
ε
)), (6) has the following unique positive solution:
(16)
I
*
=
b
2
k
λ
2
.
Accordingly, the virus equilibrium is
(17)
E
*
=
(
S
*
,
I
*
)
=
(
2
k
λ
-
b
2
λ
r
,
b
2
k
λ
2
)
.
Solving the inequality I
*
>
I
0, we can obtain
(18)
R
0
>
2
k
λ
2
I
0
+
r
d
r
(
d
+
ε
)
.
To summarize, we get the following.Theorem 2.
Consider model (4). Let
(19)
R
0
=
k
λ
(
r
-
d
)
r
(
d
+
ε
)
,
R
0
*
=
1
+
2
λ
k
m
r
-
r
ε
r
(
d
+
ε
)
,
p
3
=
2
k
λ
2
I
0
+
r
d
r
(
d
+
ε
)
.
If R
0
*
=
R
0
>
p
3 holds, then E
* is a unique virus equilibrium.Theorem 3.
If the virus equilibriumE
* exists, then E
* is a cusp of codimension 2; that is, it is a Bogdanov-Takens singularity.Proof.
To translateE
* to the origin, let x
=
S
-
S
*, y
=
I
-
I
*; then (4) becomes
(20)
d
x
d
t
=
(
r
-
2
r
S
*
k
-
λ
I
*
-
d
)
x
-
λ
S
*
y
-
r
x
2
k
-
λ
x
y
,
d
y
d
t
=
λ
I
*
x
+
(
λ
S
*
-
d
)
y
+
λ
x
y
.
That the Jacobin matrices at the virus equilibrium E
* have the double-zero eigenvalue implies that
(21)
λ
S
*
(
r
-
d
)
+
2
r
S
*
(
d
-
λ
S
*
)
k
=
d
(
r
-
d
)
-
λ
d
I
*
,
-
(
r
-
2
r
S
*
k
-
λ
I
*
-
d
)
=
(
λ
S
*
-
d
)
.
Let X
=
x
,
Y
=
-
(
λ
S
*
-
d
)
-
y
(
λ
S
*
-
d
)
2
/
λ
I
*; then (21) can become the following:
(22)
d
X
d
t
=
Y
+
a
1
X
2
+
a
2
X
Y
,
d
Y
d
t
=
b
1
X
2
+
b
2
X
Y
,
where a
1
=
(
(
λ
S
*
-
d
)
/
S
*
-
r
/
k
), a
2
=
1
/
S
*, b
1
=
(
λ
S
*
-
d
)
(
λ
-
a
1
), and b
2
=
λ
-
a
2
(
λ
S
*
-
d
).
Again by lettingx
=
X
-
(
1
/
2
)
a
2
X
2
,
y
=
Y
+
a
1
X
2, we can obtain the following:
(23)
d
x
d
t
=
y
+
R
1
(
x
,
y
)
,
d
y
d
t
=
b
1
x
2
+
(
b
2
+
2
a
1
)
x
y
+
R
2
(
x
,
y
)
,
where R
1
,
R
2 are smooth functions in (
x
,
y
) at least of third order and b
1
=
(
λ
S
*
-
d
)
(
λ
-
a
1
)
=
(
b
/
2
r
)
(
d
/
S
*
+
r
/
k
)
>
0
,
b
2
=
λ
-
a
2
(
λ
S
*
-
d
)
=
d
/
S
*
>
0. It follows from [21, 22] that model (4) admits a Bogdanov-Takens bifurcation.Next, we will explore the approximating BT bifurcation curves by choosingm and r as bifurcation parameters. First we fix the parameters k
=
k
0
,
λ
=
λ
0, and d
=
d
0 and let r
=
r
0
+
λ
1
,
m
=
m
0
+
λ
2, where λ
1 and λ
2 are parameters which vary in a small neighborhood of the origin. Let x
=
S
-
S
*
,
y
=
I
-
I
*; then E
* is translated to (
0,0
) and model (4) becomes
(24)
d
x
d
t
=
a
1
λ
1
+
a
2
x
-
a
3
y
-
a
4
x
2
-
λ
x
y
,
d
y
d
t
=
-
λ
2
+
λ
I
*
x
+
(
λ
S
*
-
d
)
y
+
λ
x
y
,
where a
1
=
λ
1
S
*
(
1
-
S
*
/
k
), a
2
=
r
0
+
λ
1
+
2
S
*
(
r
0
-
λ
1
)
/
k
-
λ
I
*
-
d, a
3
=
λ
S
*, and a
4
=
(
r
0
+
λ
1
)
/
k.LetX
=
x
,
Y
=
a
1
λ
1
+
a
2
x
-
a
3
y
-
a
4
x
2
-
λ
x
y; then (24) becomes
(25)
d
X
d
t
=
Y
,
d
y
d
t
=
b
1
+
b
2
X
+
b
3
Y
+
b
4
X
2
+
b
5
X
Y
+
b
6
Y
2
+
R
3
(
X
,
Y
)
,
where
(26)
b
1
=
-
λ
2
a
3
-
a
1
(
λ
0
S
*
-
d
)
,
b
2
=
-
λ
2
λ
0
-
a
3
λ
0
I
*
-
a
2
(
λ
0
S
*
-
d
)
-
a
1
λ
0
,
b
3
=
a
2
-
λ
0
(
a
1
+
1
)
a
3
+
(
λ
0
S
*
-
d
)
,
b
4
=
-
λ
0
2
I
*
+
a
4
(
λ
0
S
*
-
d
)
-
a
2
λ
0
,
b
5
=
λ
0
-
2
a
4
-
λ
0
a
2
a
3
+
λ
0
2
a
1
a
3
2
,
b
6
=
λ
0
a
3
,
and R
3
(
X
,
Y
) is a smooth function of X
,
Y at least of third order.Letx
=
X
+
b
3
/
b
5
,
y
=
Y; then (26) becomes
(27)
d
x
d
t
=
y
,
d
y
d
t
=
h
1
+
h
2
x
+
b
4
x
2
+
b
5
x
y
+
b
6
y
2
+
R
4
(
x
,
y
)
,
where h
1
=
b
1
+
b
4
b
3
2
/
b
5
2
-
b
2
b
3
/
b
5
,
h
2
=
b
2
-
2
b
3
b
4
/
b
5, and R
4
(
x
,
y
) is a smooth function of x
,
y at least of third order.A new time variableτ is introduced which satisfies d
t
=
(
1
-
b
6
x
)
d
τ. Still write τ as t; then (27) can be written as follows:
(28)
d
x
d
t
=
(
1
-
b
6
x
)
y
,
d
y
d
t
=
(
1
-
b
6
x
)
(
h
1
+
h
2
x
+
b
4
x
2
+
b
5
x
y
+
b
6
y
2
)
+
R
5
(
x
,
y
)
,
where R
5
(
x
,
y
) is a smooth function of x
,
y at least of third order.LetX
=
x, Y
=
(
1
-
b
6
x
)
y, rewrite X
,
Yas x
,
y, and then (28) becomes
(29)
d
x
d
t
=
y
,
d
y
d
t
=
c
1
+
c
2
x
+
c
3
x
2
+
c
4
x
y
+
R
6
(
x
,
y
)
,
where c
1
=
h
1, c
2
=
h
2
-
2
h
1
b
6, c
3
=
b
4
+
h
1
b
6
2, and c
4
=
b
5
,
R
6
(
x
,
y
) is a smooth function of x
,
y at least of third order.LetX
=
(
c
4
2
/
c
3
)
x, Y
=
(
c
4
3
/
c
3
2
)
y, and τ
=
(
c
3
/
c
4
)
t, rewrite X
,
Y
,
τ as x
,
y
,
t, and then (29) can become the following:
(30)
d
x
d
t
=
y
,
d
y
d
t
=
β
1
+
β
2
x
+
x
2
+
x
y
+
R
7
(
x
,
y
)
,
where β
1
=
c
1
c
4
4
/
c
3
3, β
2
=
c
2
c
4
2
/
c
3
2, and R
7
(
x
,
y
) is a smooth function of x
,
y at least of third order.According to the theorems of [23], we can obtain the following theorem:Theorem 4.
If the virus equilibriumE
* exists, then model (4) admits the following bifurcation behavior:(1)
there is a saddle-node bifurcation curveS
N
=
{
(
λ
1
,
λ
2
)
:
4
β
1
=
β
2
2
+
o
(
∥
λ
∥
2
)
};
(2)
there is a Hopf bifurcation curveH
=
{
(
λ
1
,
λ
2
)
:
β
1
+
o
(
∥
λ
1
,
λ
2
∥
2
)
=
0
,
β
2
<
0
};
(3)
there is a homoclinic curveH
L
=
{
(
λ
1
,
λ
2
)
:
25
β
1
+
6
β
2
2
=
0
+
o
(
∥
λ
1
∥
2
)
}.


## 4. Further Discussions and Suggestions

From the above theorem, we have found that, depending on the parameters(
λ
1
,
λ
2
) that vary in a small neighborhood of the original, model (4) undergoes a B-T bifurcation consisting of the curves of saddle-node bifurcation, Hopf bifurcation, and homoclinic bifurcation where the virus exhibits the different spread behaviors. In the following, we will illustrate the qualitative behaviors and the bifurcation diagram as sketched in Figure 1.Figure 1
The bifurcation diagram of our model.Now, Let us make a roundtrip near the Bogdanov-Takens pointλ
=
0. When the point lies in region 1 where there are no virus equilibria (and thus no limit cycles are possible) and the corresponding flow is parallelizable. When the point lies on the curve SN
+, model (4) has exactly one virus equilibrium E, which is saddle-node, and E has three separatrices: one of them tends to E as t to -
∞ (unstable separatrix) and two are stable separatrices (tend to E as t to +
∞). Entering from region 2 into region 3 through the component SN
+ of the fold curve yields two virus equilibria: a saddle and a stable node and has no periodic solution. It is worth noting that when the points pass from one side of the cure SN
+ to the other side, the number of equilibria of model (4) changes from zero to two. This hints that model (4) undergoes a saddle-node bifurcation of codimension 1, and the surface SN is called asaddle-node bifurcation surface. Then, the node turns into a focus and loses stability when crossing the Hopf bifurcation boundary H. While entering into region 3, there exist exactly two virus equilibria: one saddle point and another stable focus surrounded by one limit cycle, which is unstable. As we move clockwise, it “grows” and approaches the saddle, turning into a homoclinic orbit at HL. For our remainder journey clockwise, no limit cycles must remain. Therefore, there must be global bifurcations “destroying” the cycle somewhere between H and SN
-. When reaching curve HL, two virus equilibria appear, one saddle point and one stable focus. Two separatrices of the saddle point form a closed separatrix loop surrounding the stable focus. There is no periodic solution and if we trace the homoclinic orbit along the curve HL toward the Bogdanov-Takens point, the loop-like orbit shrinks and disappears. To complete our roundtrip, note that there are no cycles in region 4 located below the curve HL, and a stable node and a saddle, existing for the parameter values in these regions, collide and disappear, consequently, resulting in only one virus equilibrium which has three separatrices, one unstable and two stable at the fold curve SN
-. Let us also point out that at λ
=
0 the critical equilibrium with a double-zero eigen value has exactly two asymptotic orbits (one tending to the equilibrium for t
→
+
∞ and one approaching it as t
→
-
∞).We know that the virus propagation behaviors mainly depend on the dynamics, specifically, the existence and stability of virus-free equilibrium or virus equilibrium and the limit cycles of model. Based on the above analysis, we can see that the dynamics of B-T bifurcation can broadly fall into three types between different regions and curves: unstable virus equilibrium, no virus equilibrium, and no limit cycle; stable virus equilibrium; stable virus equilibrium and unstable limit cycle. Next, we provide some suggestions aiming at each type to suppress or eliminate the virus spread in the real network.Case 1.
Existence of an unstable virus equilibrium, no equilibrium, and no limit cycle: this implies that any positive orbit of model (4) meets the positive S-axis in finite time; that is, there is no infected computer in the network, and therefore, the virus will become extinct. Thus, the virus should be left alone in a network.Case 2.
Existence of a stable virus equilibrium: this implies that the virus cannot be eradicated, but can be suppressed. Thus, virus prevalence, which is defined as the infected computers, independent of any initial state, would attain a certain level. So, it is necessary for us to carry out certain steps to inhibit the virus prevalence to an acceptable level. A proper suggestion is to increaseλ
2, which corresponds to the increase of the antivirus ability m. Say, it is sufficient to increase m to the extent where a virus equilibrium becomes unstable so as to eliminate the virus in a real network. This leads us to perceive that, on the one hand, we should understand the structure of currently prevalent viruses, because the new antivirus software developed based on this understanding would possess a powerful capability to detect and clear existing viruses; toward this direction, we give the structure of the virus in Figure 2. On the other hand, we should invest more on developing antivirus software or updating it timely so as to enhance its antivirus ability.Figure 2
The logic structure of virus.Case 3.
Coexistence of a stable virus equilibrium and an unstable limit cycle, that is, a unique unstable limit cycle inside which the positive orbits of model (4) tend to a virus equilibrium as t tends to infinity: this implies that virus is persistent inside the cycle, whereas the virus becomes disappeared outside this cycle, which leads us to perceive that, on the one hand, we should enhance the antivirus ability of the network; on the other hand, we should take proper measures to make the initial position lie outside the cycle so as to eliminate the virus.


## 5. Concluding Remarks

In our previous work, we presented a novel computer virus model describing the virus spread behaviors under the effect of the antivirus ability in a real network and analyzed its dynamics for the case where around bifurcation is local. In order to supplement these partial dynamical behaviors, in the present paper, it is further shown that, under appropriate parameter values, the model may undergo a global B-T bifurcation, and the curves of saddle-node bifurcation, Hopf bifurcation, and homoclinic bifurcation are obtained at the virus equilibrium. To our knowledge, this is the first time the global bifurcation has been explored for the computer virus propagation. Based on the theoretical results, corresponding suggestions may help us take practical measures to suppress or eliminate virus in the network.Towards this direction, there are some further issues that are yet to be studied. First, the inherent structure of a computer virus represents the resource of its breakout. Therefore, it is crucial to dissect the logical structure of virus and analyze the function of each of the modules and their interrelations so as to uncover the resource of virus burst. Second, it is well known that a computer virus may spread through the Internet, which can be reflected in two-layer structure: router layer and autonomous systems layer. The former processes different extents of the antivirus ability due to the limit cost of antivirus and the latter emerges power-law distribution topology features [24], both of which will be combined to model and analyze the virus propagation behaviors on the Internet in our next work.



---

*Source: 731856-2014-04-16.xml*