# Adaptive Human Behavior in a Two-Worm Interaction Model

Authors: Li-Peng Song; Xie Han; Dong-Ming Liu; Zhen Jin
Journal: Discrete Dynamics in Nature and Society
 (2012)

---

## Abstract

The complex interactions among internet worms have great impact on the dynamics of worms. To contain the propagation of worms, it is necessary to characterize these interactions. Therefore, a two-worm interaction model is presented in this paper. Different from previous researches, we have considered the influence of adaptive human reaction stirred by one cooperative worm on the other worm in the model. The model’s equilibria and their stability conditions are obtained mathematically and verified by simulations. Results indicate that considering adaptive human behavior significantly changes the prospective propagation course of worms and that this consideration has implications for designing counterworm methods.


---

## Body

## 1. Introduction

Nowadays, malware (including worms, viruses, botnets et al.) is prevalent on the internet, which has led to serious problems to the security of internet. For example, more than one hundred million web-based infections are detected by Kaspersky Lab in February 2012 [1]. According to Crandall et al. [2], the fight against malware, which is often viewed as an “arms race," is quickly becoming unsustainable as so many malware samples are collected each day. However, malware has also created a complex environment for itself. Understanding the effects of interactions of malware with other malware and with its environment may suggest new defense methods that give fundamental advantages to the defender.Mathematical models have been proposed to characterize the spreading of malware. Han and Tan [3] analyzed the influence of time delay on computer virus by using a susceptible-infected-recovered-susceptible model. They obtained the critical value of time delay which determined whether the model had periodic solution or not. Song et al. [4] presented a model focusing on the worms spreading via both Web-based scanning and removable devices. They found that the existence of infected removable devices was in favor of the outbreak of worms, and limiting the number of removable devices would prevent the worms’ outbreak. In [5], Mishra and Pandey focused on the vertical transmission of worms in computer network. Ren et al. [6] presented a novel model and analyzed the effect of anti-virus ability. Different from other models, the ability of anti-virus software in their model was dependent on the number of infected computers. Some other models [7–10] have also been given in recent year. However, all of these studies have focused on one type of malware.Tanachaiwiwat and Helmy [11] proposed the first model focusing on the interactions between two types of competitive worms, to our knowledge. In [12], Song et al. presented an interaction model between two different types of botnets and analyzed the influences of the strategies selected by interacting botnet owners on the propagation of both botnets.In this paper, we present a two-worm model to analyze the influence of one cooperative worm on the other worm. Different from previous models [11, 12], the influence of adaptive human behavior stirred by the cooperative worm has been included in the model. Our work is motivated by the phenomenon that many worms (cooperative worms, e.g., Email-Worm.Win32.Bagle.p, Email-Worm.Win32.Roron.12, and so on) can block the anti-virus software and the firewall, which will be beneficial to the spreading of other worms [13] but may lead to people’s reaction to the infection state.The remainder of this paper is organized as follows. In Section2, we present the model and interpret the actual meanings of the model’s parameters. Then, we give the analytical results in Section 3 and validate the analytical results using various simulations in Section 4. After that, we summarize our results in Section 5.


## 2. Model Description

The basic model used in this paper is the susceptible-infected-susceptible (SIS) model [14]. To depict the interactions between one cooperative worm and the other worm, here named as noncooperative worm, we enhance the model by dividing the infected compartment into three parts.Thus, the model, presented here, includes four compartments: susceptible computers (S), computers infected by worm1 (cooperative worm) (I1)—computers that are currently infected by the cooperative worm and are susceptible to the noncooperative worm; computers infected by worm2 (noncooperative worm) (I2)—computers that are currently infected by some noncooperative worm and are susceptible to the cooperative worm, and computers infected by both worms (I12).Here, we assume that the anti-virus software and the firewall will be blocked whenever computers are infected with the cooperative worm. We also assume that a computer’s anti-virus software and firewall are always open unless stopped by the cooperative worm.Letβ1 and β2 denote the susceptible computer’s infection rates due to the successful scanning of a computer infected with the cooperative worm and the successful scanning of a computer infected with the noncooperative worm, respectively. To model the influence of anti-virus software and firewall, an increasing factor in infection rate is given by μ (μ>1) while trying to infect a computer with its anti-virus software and firewall closed.As in [12, 15], when the operating system was reinstalled, infected computers would return to the susceptible state. Here, we denote the random reinstallation rate as δ. We also assume an increasing in the reinstallation rate whenever a computer is infected with the cooperative worm. It is reasonable since the cooperative worm will block the anti-virus software and firewall, and this may stimulate user’s reaction to the invasion of malware. For simplicity, let δ1(δ1>δ) be the rate which combines the random reinstallation rate and the reinstallation rate caused by user’s adaptive behavior.The probability of successfully finding a susceptible computer in one scan isS/N, where N is the total number of computers considered. Then, β1S/N and β2S/N are the susceptible computer’s infection numbers per time step caused by a computer infected with the cooperative worm and the noncooperative worm, respectively.Thus, the model is given below:(2.1)S·=-β1SN(I1+I12)-β2SN(I2+I12)+δ1(I1+I12)+δI2,I·1=β1SN(I1+I12)-μβ2I1N(I2+I12)-δ1I1,I·2=β2SN(I2+I12)-β1I2N(I1+I12)-δI2,I·12=μβ2I1N(I2+I12)+β1I2N(I1+I12)-δ1I12,
where N=S+I1+I2+I12.Note that the model is conservative for total computers(N) since we do not include both new computers and obsolete computers in  (2.1). Then, the model can be rewritten as
(2.2)I·1=β1(N-I1-I2-I12)N(I1+I12)-μβ2I1N(I2+I12)-δ1I1,I·2=β2(N-I1-I2-I12)N(I2+I12)-β1I2N(I1+I12)-δI2,I·12=μβ2I1N(I2+I12)+β1I2N(I1+I12)-δ1I12.The initial state of the system (2.2) is set to I1(0)=I10, I2(0)=I20, and I12(0)=I120, where S0=N-I10-I20-I120. The values of S0, I10, I20, and I120 are given in the simulation section.


## 3. Model Analysis

### 3.1. Equilibria

The equilibria of system (2.2) are given by(3.1a)β1(N-I1-I2-I12)N(I1+I12)-μβ2I1N(I2+I12)-δ1I1=0,(3.1b)β2(N-I1-I2-I12)N(I2+I12)-β1I2N(I1+I12)-δI2=0,(3.1c)μβ2I1N(I2+I12)+β1I2N(I1+I12)-δ1I12=0.LetR01 be the basic reproduction number, the number of secondary infections deriving from a single primary infection, of the cooperative worm, and R02, R012 be the basic reproduction numbers of the noncooperative worm when the cooperative worm dies out or exists, respectively. Then, we have
(3.2)R01=β1δ1,(3.3a)R02=β2δ,(3.3b)R012=β2[δ1N+μI1*(β1-δ1+δ)](β1-δ1+δ)δ1N,where(3.4)I1*=-b2-4ac-b2a,anda=μβ2(β1-μβ1+μδ1-μδ)/β1N,  b=-μ(β1-δ1+δ)(1-2δ1/β1)-μβ2-δ1,  and  c=δ1N(β1-δ1+δ)(β1-δ1)/β1β2.As the derivations ofR01 and R02 are very simple, we only give the derivation of R012 here.Adding  (3.1a) to (3.1c) leads to
(3.5)I1+I12=N-δ1β1
or
(3.6)I1+I12=0.R012 means that the cooperative worm exists. Thus, we only consider the condition when I1+I12=N-δ1/β1. Using this condition in  (3.1b) and (3.1c), we get
(3.7)(β2δ1β1-β2I2N)(I2+I12)-(β1-δ1+δ)I2=0,(μβ2I1N-δ1)(I2+I12)+β1I2=0.
This yields
(3.8)β1β2I2=β2δ1N+μβ2I1(β1-δ1+δ)-(β1-δ1+δ)δ1N.According to the right hand side of  (3.8), we can get the term of R012. Furthermore, (3.4) can be obtained by substituting I2 in (3.8) into (3.1a).For the simplified system (2.2), there always exists a disease-free equilibrium (0,0,0) for (I1,I2,I12). If R01>1 and R012<1, there exists an equilibrium (N-(δ1/β1)N,0,0), corresponding to the cooperative worm endemic equilibrium. If R01<1 and R02>1, the noncooperative worm endemic equilibrium (0,N-(δ/β2)N,0) will exist. The coexistence endemic equilibrium (I1*,I2*,I12*) occurs if R01>1 and R012>1, where I1* is the same as in  (3.4),
(3.9)I2*=β2[δ1N+μI1*(β1-δ1+δ)]-δ1N(β1-δ1+δ)β1β2,I12*=N-δ1β1N-I1*.Thus,  (3.3a) and (3.3b) give the noncooperative worm’s existence thresholds when the cooperative worm dies out or exists, respectively, that is, to ensure the existence of noncooperative worm, β2 must be greater than the threshold value (δ) predicted by R02=1 (cooperative worm dies out) or the threshold value ((β1-δ1+δ)δ1N/(δ1N+μI1*(β1-δ1+δ))) predicted by R012=1 (cooperative worm exists).


### 3.2. Stability

Theorem 3.1.
IfR01<1 and R02<1, then the disease-free equilibrium (0,0,0) is asymptotically stable.Theorem 3.2.
IfR01>1 and R012<1, then the cooperative worm endemic equilibrium (N-(δ1/β1)N,0,0) is asymptotically stable.Theorem 3.3.
IfR01<1 and R02>1, then the noncooperative worm endemic equilibrium (0,N-(δ/β2)N,0) is asymptotically stable.Theorems3.1, 3.2, and 3.3 are easy to be proven. Here, we only give the detailed proof of the stability of coexistence endemic equilibrium (I1*, I2*, I12*).Let(3.10)β1st=-b-Y13-Y233a,
where a=4μ2, b=-12μ2δ1+8μ2δ-δ1, c=4μ2(δ1-δ)(3δ1-δ), d=-4μ2δ1(δ1-δ)2, A=b2-3ac, B=bc-9ad, C=c2-3bd, and Y1,2=Ab+3a(-B±B2-4AC)/2.Theorem 3.4.
IfR01>1, R012>1, and β1>β1st, then the coexistence endemic equilibrium (I1*, I2*, I12*) is asymptotically stable.Proof.
The Jacobian matrix of system (2.2) at the coexistence endemic equilibrium is given by
(3.11)Jac(I1*,I2*,I12*)=(β1(N-2I1*-I2*-2I12*)N-β1(I1*+I12*)+μβ2I1*Nβ1(N-2I1*-I2*-2I12*)N-μβ2(I2*+I12*)N-δ1-μβ2I1*N-β2(I2*+I12*)-β1I2*Nβ2(N-I1*-2I2*-2I12*)Nβ2(N-I1*-2I2*-2I12*)N-β1(I1*+I12*)N-δ-β1I2*Nβ1I2*+μβ2(I2*+I12*)Nβ1(I1*+I12*)+μβ2I1*Nβ1I2*+μβ2I1*N-δ1).
By means of similarity transformation upon the matrix (3.11), we have
(3.12)Jac(I1*,I2*,I12*)=(-β1+δ100-β2(I2*+I12*)-β1I2*Nβ2(N-I1*-2I2*-2I12*)Nβ2(N-I1*-I2*-I12*)N-β1+δ1-δβ1I2*+μβ2(I2*+I12*)Nβ1-δ1+μβ2I1*Nμβ2(I1*-I2*-I12*)N-δ1).
The characteristic equation of (3.12) is given by
(3.13)(λ+β1-δ1)[λ2-(a22+a33)λ+a22a33-a23a32]=0,
where a22=β2(N-I1*-2I2*-2I12*)/N-β1+δ1-δ, a23=β2(N-I1*-I2*-I12*)/N, a32=β1-δ1+μβ2I1*/N, and a33=μβ2(I1*-I2*-I12*)/N-δ1.
In  (3.13), λ1=-β1+δ1, which is less than zero as R01>1. Then, we only need to prove that the eigenvalues in the square brackets of  (3.13) have negative real parts.
According to the Hurwitz criteria [16],
(3.14)H1=-(a22+a33),H2=-(a22+a33)(a22a33-a23a32).
It is easy to see thata33<0 and
(3.15)a22a33-a23a32=[(β2(N-I1*-2I2*-2I12*)N-β1+δ1-δ)(μβ2(I1*-I2*-I12*)N-δ1)-β2(N-I1*-I2*-I12*)N(β1-δ1+μβ2I1*N)]=μβ2(I2*+I12*)N[β2(2I2*+2I12*)N-β2+β1-δ1+δ+δ1μ]+(β1-δ1+δ)(δ1-μβ2I1*N)-(δ1-β1I2*N)β2=μβ2(I2*+I12*)N[β2(2I2*+2I12*)N-β2+β1-δ1+δ+δ1μ]>μβ2(I2*+I12*)N[β2(2I2*+2I12*+I1*-N)N+β1-δ1+δ]=μβ2(I2*+I12*)N(-a22).
Thus, H1>0 and H2>0 provided that a22<0. Consider
(3.16)a22=β2(N-I1*-2I2*-2I12*)N-β1+δ1-δ=β2-2β2(I2*+I12*)N-β2I1*N-β1+δ1-δ=β2-2μ[(δ1-β1I2*/N)(N-Nδ1/β1)I1*-δ1]-β2I1*N-β1+δ1-δ=β2-2μ[-(β1-δ1+δ)(μI1*/N-δ1/β2)(N-Nδ1/β1)I1*-δ1]-β2I1*N-β1+δ1-δ=β2-β2I1*N-2δ1Nμβ2I1*(1-δ1β1)(β1-δ1+δ)+(1-2δ1β1)(β1-δ1+δ)+2δ1μ=-(μβ2/N)I1*2+𝒜I1*-(2δ1N/β2)(β1-δ1+δ)(1-δ1/β1)μI1*=-(μβ2/N)(1-μ(β1-δ1+δ)/β1)I1*2+ℬI1*+(δ1N/β2)(β1-δ1+δ)(1-δ1/β1)μI1*-(μβ2(μβ1-μδ1+μδ)/Nβ1)I1*2-δ1I1*+(δ1N/β2)(β1-δ1+δ)(1-δ1/β1)μI1*,
where 𝒜 denotes [μ(β1-δ1+δ)(1-2δ1/β1)+μβ2+2δ1] and ℬ denotes [μ(β1-δ1+δ)(1-(2δ1/β1))+μβ2+δ1]. As (μβ2/N)(1-μ(β1-δ1+δ)/β1)I1*2+[μ(β1-δ1+δ)(1-2δ1/β1)+μβ2+δ1]I1*+(δ1N/β2)(β1-δ1+δ)(1-δ1/β1)/μI1*=0, we have
(3.17)a22=-(μβ2(μβ1-μδ1+μδ)/Nβ1)I1*2-δ1I1*+(δ1N/β2)(β1-δ1+δ)(1-δ1/β1)μI1*=-(μβ2(μβ1-μδ1+μδ)/Nβ1)𝒞+(δ1N/β2)(β1-δ1+δ)(1-(δ1/β1))-𝒟μI1*<-(δ1N/β2)(β1-δ1+δ)(1-δ1/β1)-𝒟μI1*=-δ1N(β1-δ1+δ)(1-δ1/β1)-δ12β1N/4μ(μβ1-μδ1+μδ)μβ2I1*=-δ1N4μ2β1(β1-δ1+δ)μβ2I1*[aβ13+bβ12+cβ11+d],
where 𝒞 denotes [I1*-δ1β1N/2μβ2(μβ1-μδ1+μδ)]2 and 𝒟 denotes δ12β1N/4μβ2(μβ1-μδ1+μδ) and where a, b, c, and d are the same as in  (3.10).
According to the root extracting formula, the equation,aβ13+bβ12+cβ11+d=0, has one positive real root β1st. Furthermore, for any β1, if β1>β1st, then aβ13+bβ12+cβ11+d>0.
AsR01>1 and β1>β1st can guarantee a22<0, according to the text mentioned above, a22<0 can guarantee that both H1 and H2 are greater than zero, which means that both eigenvalues in the square brackets of  (3.13) have negative real parts. Thus, if R01>1, R012>1 and β1>β1st, there exists a coexistence endemic equilibrium, and it is asymptotically stable. The proof is completed.


## 3.1. Equilibria

The equilibria of system (2.2) are given by(3.1a)β1(N-I1-I2-I12)N(I1+I12)-μβ2I1N(I2+I12)-δ1I1=0,(3.1b)β2(N-I1-I2-I12)N(I2+I12)-β1I2N(I1+I12)-δI2=0,(3.1c)μβ2I1N(I2+I12)+β1I2N(I1+I12)-δ1I12=0.LetR01 be the basic reproduction number, the number of secondary infections deriving from a single primary infection, of the cooperative worm, and R02, R012 be the basic reproduction numbers of the noncooperative worm when the cooperative worm dies out or exists, respectively. Then, we have
(3.2)R01=β1δ1,(3.3a)R02=β2δ,(3.3b)R012=β2[δ1N+μI1*(β1-δ1+δ)](β1-δ1+δ)δ1N,where(3.4)I1*=-b2-4ac-b2a,anda=μβ2(β1-μβ1+μδ1-μδ)/β1N,  b=-μ(β1-δ1+δ)(1-2δ1/β1)-μβ2-δ1,  and  c=δ1N(β1-δ1+δ)(β1-δ1)/β1β2.As the derivations ofR01 and R02 are very simple, we only give the derivation of R012 here.Adding  (3.1a) to (3.1c) leads to
(3.5)I1+I12=N-δ1β1
or
(3.6)I1+I12=0.R012 means that the cooperative worm exists. Thus, we only consider the condition when I1+I12=N-δ1/β1. Using this condition in  (3.1b) and (3.1c), we get
(3.7)(β2δ1β1-β2I2N)(I2+I12)-(β1-δ1+δ)I2=0,(μβ2I1N-δ1)(I2+I12)+β1I2=0.
This yields
(3.8)β1β2I2=β2δ1N+μβ2I1(β1-δ1+δ)-(β1-δ1+δ)δ1N.According to the right hand side of  (3.8), we can get the term of R012. Furthermore, (3.4) can be obtained by substituting I2 in (3.8) into (3.1a).For the simplified system (2.2), there always exists a disease-free equilibrium (0,0,0) for (I1,I2,I12). If R01>1 and R012<1, there exists an equilibrium (N-(δ1/β1)N,0,0), corresponding to the cooperative worm endemic equilibrium. If R01<1 and R02>1, the noncooperative worm endemic equilibrium (0,N-(δ/β2)N,0) will exist. The coexistence endemic equilibrium (I1*,I2*,I12*) occurs if R01>1 and R012>1, where I1* is the same as in  (3.4),
(3.9)I2*=β2[δ1N+μI1*(β1-δ1+δ)]-δ1N(β1-δ1+δ)β1β2,I12*=N-δ1β1N-I1*.Thus,  (3.3a) and (3.3b) give the noncooperative worm’s existence thresholds when the cooperative worm dies out or exists, respectively, that is, to ensure the existence of noncooperative worm, β2 must be greater than the threshold value (δ) predicted by R02=1 (cooperative worm dies out) or the threshold value ((β1-δ1+δ)δ1N/(δ1N+μI1*(β1-δ1+δ))) predicted by R012=1 (cooperative worm exists).


## 3.2. Stability

Theorem 3.1.
IfR01<1 and R02<1, then the disease-free equilibrium (0,0,0) is asymptotically stable.Theorem 3.2.
IfR01>1 and R012<1, then the cooperative worm endemic equilibrium (N-(δ1/β1)N,0,0) is asymptotically stable.Theorem 3.3.
IfR01<1 and R02>1, then the noncooperative worm endemic equilibrium (0,N-(δ/β2)N,0) is asymptotically stable.Theorems3.1, 3.2, and 3.3 are easy to be proven. Here, we only give the detailed proof of the stability of coexistence endemic equilibrium (I1*, I2*, I12*).Let(3.10)β1st=-b-Y13-Y233a,
where a=4μ2, b=-12μ2δ1+8μ2δ-δ1, c=4μ2(δ1-δ)(3δ1-δ), d=-4μ2δ1(δ1-δ)2, A=b2-3ac, B=bc-9ad, C=c2-3bd, and Y1,2=Ab+3a(-B±B2-4AC)/2.Theorem 3.4.
IfR01>1, R012>1, and β1>β1st, then the coexistence endemic equilibrium (I1*, I2*, I12*) is asymptotically stable.Proof.
The Jacobian matrix of system (2.2) at the coexistence endemic equilibrium is given by
(3.11)Jac(I1*,I2*,I12*)=(β1(N-2I1*-I2*-2I12*)N-β1(I1*+I12*)+μβ2I1*Nβ1(N-2I1*-I2*-2I12*)N-μβ2(I2*+I12*)N-δ1-μβ2I1*N-β2(I2*+I12*)-β1I2*Nβ2(N-I1*-2I2*-2I12*)Nβ2(N-I1*-2I2*-2I12*)N-β1(I1*+I12*)N-δ-β1I2*Nβ1I2*+μβ2(I2*+I12*)Nβ1(I1*+I12*)+μβ2I1*Nβ1I2*+μβ2I1*N-δ1).
By means of similarity transformation upon the matrix (3.11), we have
(3.12)Jac(I1*,I2*,I12*)=(-β1+δ100-β2(I2*+I12*)-β1I2*Nβ2(N-I1*-2I2*-2I12*)Nβ2(N-I1*-I2*-I12*)N-β1+δ1-δβ1I2*+μβ2(I2*+I12*)Nβ1-δ1+μβ2I1*Nμβ2(I1*-I2*-I12*)N-δ1).
The characteristic equation of (3.12) is given by
(3.13)(λ+β1-δ1)[λ2-(a22+a33)λ+a22a33-a23a32]=0,
where a22=β2(N-I1*-2I2*-2I12*)/N-β1+δ1-δ, a23=β2(N-I1*-I2*-I12*)/N, a32=β1-δ1+μβ2I1*/N, and a33=μβ2(I1*-I2*-I12*)/N-δ1.
In  (3.13), λ1=-β1+δ1, which is less than zero as R01>1. Then, we only need to prove that the eigenvalues in the square brackets of  (3.13) have negative real parts.
According to the Hurwitz criteria [16],
(3.14)H1=-(a22+a33),H2=-(a22+a33)(a22a33-a23a32).
It is easy to see thata33<0 and
(3.15)a22a33-a23a32=[(β2(N-I1*-2I2*-2I12*)N-β1+δ1-δ)(μβ2(I1*-I2*-I12*)N-δ1)-β2(N-I1*-I2*-I12*)N(β1-δ1+μβ2I1*N)]=μβ2(I2*+I12*)N[β2(2I2*+2I12*)N-β2+β1-δ1+δ+δ1μ]+(β1-δ1+δ)(δ1-μβ2I1*N)-(δ1-β1I2*N)β2=μβ2(I2*+I12*)N[β2(2I2*+2I12*)N-β2+β1-δ1+δ+δ1μ]>μβ2(I2*+I12*)N[β2(2I2*+2I12*+I1*-N)N+β1-δ1+δ]=μβ2(I2*+I12*)N(-a22).
Thus, H1>0 and H2>0 provided that a22<0. Consider
(3.16)a22=β2(N-I1*-2I2*-2I12*)N-β1+δ1-δ=β2-2β2(I2*+I12*)N-β2I1*N-β1+δ1-δ=β2-2μ[(δ1-β1I2*/N)(N-Nδ1/β1)I1*-δ1]-β2I1*N-β1+δ1-δ=β2-2μ[-(β1-δ1+δ)(μI1*/N-δ1/β2)(N-Nδ1/β1)I1*-δ1]-β2I1*N-β1+δ1-δ=β2-β2I1*N-2δ1Nμβ2I1*(1-δ1β1)(β1-δ1+δ)+(1-2δ1β1)(β1-δ1+δ)+2δ1μ=-(μβ2/N)I1*2+𝒜I1*-(2δ1N/β2)(β1-δ1+δ)(1-δ1/β1)μI1*=-(μβ2/N)(1-μ(β1-δ1+δ)/β1)I1*2+ℬI1*+(δ1N/β2)(β1-δ1+δ)(1-δ1/β1)μI1*-(μβ2(μβ1-μδ1+μδ)/Nβ1)I1*2-δ1I1*+(δ1N/β2)(β1-δ1+δ)(1-δ1/β1)μI1*,
where 𝒜 denotes [μ(β1-δ1+δ)(1-2δ1/β1)+μβ2+2δ1] and ℬ denotes [μ(β1-δ1+δ)(1-(2δ1/β1))+μβ2+δ1]. As (μβ2/N)(1-μ(β1-δ1+δ)/β1)I1*2+[μ(β1-δ1+δ)(1-2δ1/β1)+μβ2+δ1]I1*+(δ1N/β2)(β1-δ1+δ)(1-δ1/β1)/μI1*=0, we have
(3.17)a22=-(μβ2(μβ1-μδ1+μδ)/Nβ1)I1*2-δ1I1*+(δ1N/β2)(β1-δ1+δ)(1-δ1/β1)μI1*=-(μβ2(μβ1-μδ1+μδ)/Nβ1)𝒞+(δ1N/β2)(β1-δ1+δ)(1-(δ1/β1))-𝒟μI1*<-(δ1N/β2)(β1-δ1+δ)(1-δ1/β1)-𝒟μI1*=-δ1N(β1-δ1+δ)(1-δ1/β1)-δ12β1N/4μ(μβ1-μδ1+μδ)μβ2I1*=-δ1N4μ2β1(β1-δ1+δ)μβ2I1*[aβ13+bβ12+cβ11+d],
where 𝒞 denotes [I1*-δ1β1N/2μβ2(μβ1-μδ1+μδ)]2 and 𝒟 denotes δ12β1N/4μβ2(μβ1-μδ1+μδ) and where a, b, c, and d are the same as in  (3.10).
According to the root extracting formula, the equation,aβ13+bβ12+cβ11+d=0, has one positive real root β1st. Furthermore, for any β1, if β1>β1st, then aβ13+bβ12+cβ11+d>0.
AsR01>1 and β1>β1st can guarantee a22<0, according to the text mentioned above, a22<0 can guarantee that both H1 and H2 are greater than zero, which means that both eigenvalues in the square brackets of  (3.13) have negative real parts. Thus, if R01>1, R012>1 and β1>β1st, there exists a coexistence endemic equilibrium, and it is asymptotically stable. The proof is completed.


## 4. Simulation

In this paper, we use the improved Euler method to simulate the system (2.2). In the simulation, the total number of computers (N) is set to 1000000. The initially infected computers with cooperative worm (I10), the initially infected computers with noncooperative worm (I20), and the initially infected computers with both worms (I120) are set to 100, 100, and 0, respectively, for all simulations. Thus, the initially susceptible computers (S0) are 999800.Here, we first give the convergence proof of the numerical method used in the simulation. LetI=(I1,I2,I12), a three-dimensional vector. Then, the system (2.2) can be rewritten as I·=f(t,I), where f is a three-dimensional vector function in R4. It is obvious that f is a continuous and differential function in R4. Thus, f satisfies the Lipschitz condition, and we have ∥f(t,I1)-f(t,I2)∥≤L∥I1-I2∥, where L is a constant.The Euler iteration equation isIn+1(k+1)=In+h/2[f(tn,In)+f(tn+1,In+1(k))], where k=0,1,2,…, In+1(0)=In+hf(tn,In), and n=0,1,2,…. h=tn+1-tn, representing the step value in the Euler iteration algorithm. Then,
(4.1)∥In+1(k+1)-In+1(k)∥=h2∥f(tn+1,In+1(k))-f(tn+1,In+1(k-1))∥≤hL2∥In+1(k)-In+1(k-1)∥≤(hL2)2∥In+1(k-1)-In+1(k-2)∥≤⋯≤(hL2)k∥In+1(1)-In+1(0)∥.
Thus, the Euler iteration algorithm used in this paper is convergent as we can ensure that hL/2<1 by selecting the step value (h).To validate the accuracy of the thresholds predicted by (3.3a) and (3.3b), we simulated the model (2.2) using four sets of variables: (i) the cooperative worm exists: β1=0.48, δ1=0.0416, β2=0.0264, and δ=0.025, (ii) no cooperative worm: β1=0.01, δ1=0.0416, β2=0.0264, and δ=0.025, (iii) the cooperative worm exists: β1=0.48, δ1=0.0416, β2=0.0288, and δ=0.03, and (iv) no cooperative worm: β1=0.01, δ1=0.0416, β2=0.0288, and δ=0.03. μ is set to 1.5 for these simulations.Note that in (i)β2(=0.0264) is less than the existence threshold (0.0285) predicted by (3.3b). Thus, the noncooperative worm will die out although β2 is greater than the existence threshold (0.025) predicted by (3.3a). Similar results can also be reached with the other three sets of variables.Figure1 shows the simulation results of the noncooperative worm using the first two sets of variables. Figure 2 shows the simulation results using another two sets of variables.Figure 1
Fraction of computers infected with noncooperative worm: (i) green: the cooperative worm exists andR012<1 and (ii) blue: the cooperative worm dies out and R02>1.Figure 2
Fraction of computers infected with noncooperative worm: (iii) green: the cooperative worm exists andR012>1 and (iv) blue: the cooperative worm dies out and R02<1.As shown in Figure1, when the cooperative worm exists and R012<1, the noncooperative worm dies out; when the cooperative worm terminates and R02>1, the noncooperative worm survives. In Figure 2, when the cooperative worm exists and R012>1, the noncooperative worm survives; when the cooperative worm terminates and R02<1, the noncooperative worm dies out. Thus, both Figures 1 and 2 demonstrate that the simulation results are consistent with the theoretical prediction.Figures1 and 2 also show that the cooperative worm has dual influences on the noncooperative worm, which is different from our intuition. In Figure 1, the existence of cooperative worm (i) contains the propagation of noncooperative worm. However, the existence of cooperative worm (iii) favors the propagation of noncooperative worm in Figure 2.To get the effective noncooperative worm containment strategy, we further explore the influence of adaptive human behavior (δ1) on the noncooperative worm. We simulated with various δ1 and calculated the thresholds of β2 predicted by R02=1 and R012=1. Figures 3(a), 3(b), and 3(c) plot the results with μ=1.2, 1.5 and 2, respectively.Thresholds ofβ2 predicted by (3.3a) and (3.3b) with β1=0.24 and δ=0.00595, and (a) μ=1.2; (b) μ=1.5; (c) μ=2 are given. δ1 is varied in the simulations.
(a)
(b)
(c)According to Figures3(a), 3(b), and 3(c), adaptive human behavior (reflected by δ1) has great influence on the propagation of noncooperative worm. The threshold (dash line) increases rapidly with the increase of δ1 no matter what value μ is. Moreover, when δ1≥0.014, the thresholds (dash line) in all figures are much higher than the corresponding values (solid line) when no human behavior is considered (the cooperative worm dies out), which also means a promising worm-counter-worm method.We also verified the accuracy of coexistence endemic equilibrium’s stability thresholds given by Theorem (3.4). Here, the simulation parameters are set to (i) β1=0.36, δ1=0.0416, β2=0.03, δ=0.025, and μ=2 where β1 is greater than β1st (=0.346), and (ii) β1=0.08, δ1=0.0416, β2=0.03, δ=0.025, and μ=2 where β1 is less than β1st. Figures 4(a) and 4(b) show the simulation results.Fraction of computers infected with noncooperative worm: (a)β1>β1st and (b) β1<β1st are given.
(a)
(b)Note that the cooperative worm (I1+I12=N-(δ1/β1)N) is a constant with any given β1 and δ1. Thus, we only plot the noncooperative worm’s propagation process in Figures 4(a) and 4(b).As shown in Figure4(a), when β1>β1st, the noncooperative worm approaches a stable state. However, in Figure 4(b), when β1<β1st, we can see a clearly oscillatory epidemic phenomenon, which validates the conclusion of Theorem (3.4).


## 5. Conclusion

Recently, the researches concerning network security and malware have focused on the fight between antimalware system and malware [3–10]. In this paper, we have explored the interactions between one cooperative worm and the other noncooperative worm; especially we focus on the influence of adaptive human behavior, to find an inherent advantage in the fight against attackers.Different from our intuition, the results presented in this paper have shown that the cooperative worm has dual effects on the propagation of the noncooperative worm due to the existence of adaptive human behavior, which is a valuable information for defenders in designing counter-worm methods [17, 18]. In the future, we plan to use real trace data to test our model and get the most effective policy to motivate people.



---

*Source: 828246-2012-11-08.xml*