# A Novel Computer Virus Propagation Model under Security Classification

Authors: Qingyi Zhu; Chen Cen
Journal: Discrete Dynamics in Nature and Society
 (2017)

---

## Abstract

In reality, some computers have specific security classification. For the sake of safety and cost, the security level of computers will be upgraded with increasing of threats in networks. Here we assume that there exists a threshold value which determines when countermeasures should be taken to level up the security of a fraction of computers with low security level. And in some specific realistic environments the propagation network can be regarded as fully interconnected. Inspired by these facts, this paper presents a novel computer virus dynamics model considering the impact brought by security classification in full interconnection network. By using the theory of dynamic stability, the existence of equilibria and stability conditions is analysed and proved. And the above optimal threshold value is given analytically. Then, some numerical experiments are made to justify the model. Besides, some discussions and antivirus measures are given.


---

## Body

## 1. Introduction

With the rapid development of the Internet, the spread of computer virus has brought a lot of potential safety problems, which not only caused huge waste to the network resources but also harmed the interests of individuals and the masses. The traditional way of antivirus is constantly updating the virus library of antivirus software. But it is a passive mechanism to prevent viruses. In this context, the macroscopical study of computer virus propagation is regarded as a very important approach to antivirus and has received more and more attention from scholars.In 1991, Kephart and White firstly used the model of biological infectious virus to study the spread of computer viruses [1]. Since then, a lot of dynamical models of computer virus have been presented. These models can be simply divided into two broad categories: homogeneous models and heterogeneous models according to according to whether the network is fully connected or not.In recent years, more and more scholars have begun to study heterogeneous models. Kjaergaard and his partners followed the time evolution of information propagation through communication networks by using the susceptible-infected (SI) model with empirical data on contact sequences [2]. Castellano and Pastor-Satorras studied the threshold of epidemic models in quenched networks with degree distribution given by a power-law for the susceptible-infected-susceptible (SIS) model [3]. Zhu et al. investigated a new epidemic SIS model with nonlinear infectivity, as well as birth and death of nodes and edges [4]. Taking into account the power-law degree distribution of the Internet, Yang et al. proposed a novel epidemic model of computer viruses and presented the spreading threshold for the model [5]. L.-X. Yang and X. Yang proposed an epidemic model of computer viruses over a reduced scale-free network [6]. Yang and his partners proposed a node-based susceptible-latent-breaking-susceptible (SLBS) model which addresses the impact of the structure of the viral propagation network on the viral prevalence [7]. To understand the impact of available information in the control of malicious network epidemics, Mishra and three others proposed a 1-n-n-1 type differential epidemic model, where the differentiability allows a symptom based classification [8]. All these models assume that the spread of viruses can only be through the topological neighbors.In fact, a lot of viruses can propagate without dependence on the topology, such as Code Red (2001), Slammer (2003), Blaster (2003), Witty (2004), and Conficker (2009). By probing the entire IPv4 space or localized IP addresses, these viruses can infect an arbitrary vulnerable computer. In this condition, the propagation network can be regarded as fully connected. Besides, there are still some fully interconnected networks, such as virtual cluster in cloud [9–12]. So the study of homogeneous models is also an important branch of computer virus dynamical models. A portion of infected external computers could enter the Internet and removable storage media could carry viruses, based on the two facts. Gan et al. established a series of dynamical models [13–16]. Amador and Artalejo investigated the dynamics of computer virus spreading by considering a stochastic SIRS model where immune computers send warning signals to reduce the propagation of the virus among the rest of computers in the network [17]. Liu and Zhong presented and analyzed an SDIRS model describing the propagation of web malware based on the assumption of homogeneity [18]. Yuan and three others presented a nonlinear force of infection function for e-SEIR model to study the crowding and psychological effects in network virus prevalence [19].In order to protect the security and stability of information systems, the concept of information security classified protection is proposed and has been a basic strategy of construction of national information. But to our knowledge, nearly all previous models describing the spread of computer viruses ignore the impacts of security classifications. In order to study how these factors affect the spread of computer viruses on the Internet, this paper proposes a novel computer virus propagation model. A thorough analysis of this model shows that some equilibria existed and are globally asymptotically stable in a specific situation. Besides, some simulation experiments are performed to examine the conclusion got from this model. In the end, some effective strategies for controlling virus spreading are recommended.The subsequent materials are organized in this fashion: The idea of modeling is introduced in Section2. The new model is established in Section 3. The analysis of four equilibria is addressed in Section 4. The local and global stabilities of these equilibria are investigated in Sections 5 and 6, respectively. Simulation experiments and some discussions are presented in Section 7. Finally, this work is outlined in Section 8.


## 2. Idea of Modeling

In a security classification network, blindly increasing the security level of computer will result in both waste of resource and increase of cost. Therefore, reinforcing the security level of computer must be targeted. About security classification of computer, the influential criteria are “Trusted Computer System Evaluation Criteria (TcsEC)” issued by United States Department of Defense [20]. By using these criteria, computers in the network can be divided into four divisions. From high to low, they are Levels A, B, C, and D, respectively.Low Security Level: Divisions D and C. In this level, it is reserved for those systems that have been evaluated but that fail to meet the requirements for a higher evaluation class. Classes in this level provide for discretionary (need-to-know) protection and it can only provide a review of protection.High Security Level: Divisions B and A. The security-relevant sections of a system are mentioned throughout this document as the Trusted Computing Base (TCB) [21]. Computers in this level must carry the sensitivity labels with most data structures in the system and the system developer should provide the security policy model based on TCB. By using formal security verification methods, this level requires that each operation in the system must have a formal documentation and can only be made by the administrator.Obviously, computers with low security level are more likely to be infected by virus. This is the first breakthrough point for modeling.In the network with security classification, administrators usually do not take any measures to upgrade the computers with low security level if there are only few threats for the sake of cost. With the increase of the infected computers number in the network, the administrators will upgrade the security level of computers ultimately. Here we assume that there exists a threshold value. If the number of infected computers is above the threshold value, some countermeasures will be taken to level up the security of a fraction of computers with low security level. Further, assume that the probability of taking upgrading measures for one uninfected computer is proportional to the number of infected computers. The flow diagram in Figure1 can briefly express these operations. How the threshold value and the fraction of upgraded computers affect the propagation of computer virus is the concern in this paper.Figure 1
Flow diagram of upgrading.


## 3. Model Formulation

According to the situation of computer virus infection and the level of computer security, all computers in the network are divided into three compartments.(a)
Sl-compartment: the set of uninfected or susceptible computers in low security level(b)
Sh-compartment: the set of uninfected or susceptible computers in high security level(c)
I-compartment: the set of infected computersFor the modeling purpose, a series of parameters are introduced and some assumptions are made.(1)
One can assume that the average probabilities per unit time ofSl and Sh computers connecting to the network are bl and bh, respectively.(2)
Every computer in the system is got out for some reasons with the average probability per unit timeμ, where μ is positive constant.(3)
Due to possible contact with infected computers in the network, everySl and Sh computer is infected with the average probabilities βl and βh per unit time, respectively, where βl and βh are positive constant and βl>βh.(4)
Assume that oneI computer becomes an Sl computer (or an Sh computer) with the average probability per unit time γl (or γh), where γl,γh are positive constants.(5)
As mentioned in Section2, the upgrading probability of an Sl computer is denoted by a piecewise function f(I). The expression of f(I) is as follows: (1)fI=0,if0⩽I<Imax,αI,ifI⩾Imax.Imax denotes the threshold value and α denotes the a fraction of upgrading computers.Let Sl(t), Sh(t), and I(t) denote, at time t, the average numbers of Sl-, Sh-, and I-compartment computers, respectively. Let N(t) denote the total number of all computers in the system at time t. Unless otherwise stated in the following content, they will be abbreviated as N, Sl, Sh, and I, respectively. Then, Sl+Sh+I=N. The collection of the above parameters and assumptions can be schematically depicted in Figure 2, from which the dynamical model is formulated as the following differential system:(2)S˙l=bl+γlI-fISl-βlSlI-μSl,S˙h=bh+γhI+fISl-βhShI-μSh,I˙=βlSlI+βhShI-γlI-γhI-μI. Considering that Sl+Sh+I=N, system (2) can be reduced to the following system:(3)N˙=bl+bh-μN,S˙h=bh+γhI+fIN-Sh-I-βhShI-μSh,I˙=βlN-Sh-II+βhShI-γlI-γhI-μI.Figure 2
Transition diagram of the new model.Solving the first equations of system (3), it is easy to obtain limt→∞N=N∗=bl+bh/μ. Therefore, system (3) can be reduced to the following limiting system [22, 23]:(4)S˙h=bh+γhI+fIN∗-Sh-I-βhShI-μSh,I˙=βlN∗-Sh-II+βhShI-γlI-γhI-μI. The feasible region for system (4) is(5)Ω=Sh,I∣Sh⩾0,I⩾0,0⩽Sh+I⩽N∗,which is positively invariant.


## 4. Equilibria

In this section, all equilibria of system (4) are calculated. To obtain all potential equilibria, system (4) can be written as(6)bh+γhI-βhShI-μSh=0,βlN∗-Sh-II+βhShI-γlI-γhI-μI=0,if0⩽I<Imax,(7)bh+γhI+αIN∗-Sh-I-βhShI-μSh=0,βlN∗-Sh-II+βhShI-γlI-γhI-μI=0,ifI⩾Imax.From (6) the fact that there always exists a virus-free equilibrium can be got: (8)E0∗=Sh0∗=bhμ,I0∗=0, and the basic reproduction number is(9)R0=βlbl+βhbhμγl+γh+μ. Let(10)C=μγl+γh+μ-βlbl-βhbh=μγl+γh+μ1-R0,(11)A1=βlβh,B1=βlβhN∗-βlγh-βlμ-βhγl-βhμ,Δ1=B12-4A1C,(12)A2=βlβh+αβh,B2=βlβh+αβhN∗-βlγh-βlμ-βhγl-βhμ-αγl+γh+μ,Δ2=B22-4A2C.The quadratic equation of I can be got from system (6) and (7) as follows:(13)A1I2-B1I+C=0if0⩽I<Imax,(14)A2I2-B2I+C=0,ifI⩾Imax.Considering that I1∗=B1+Δ1/2A1, I2∗=B1-Δ1/2A1 are the roots of (13) and I3∗=B2+Δ2/2A2, I4∗=B2-Δ2/2A2 are the roots of (14) (I1∗≠I3∗), the solution of (6) and (7) can be got as follows:(15)I1∗=B1+Δ12A1,Sh1∗=bh+γhI1∗μ+βhI1∗,I2∗=B1-Δ12A1,Sh2∗=bh+γhI2∗μ+βhI2∗,I3∗=B2+Δ22A2,Sh3∗=bh+γhI3∗+αI3∗N-I3∗μ+βhI3∗,I4∗=B2-Δ22A2,Sh4∗=bh+γhI4∗+αI4∗N-I4∗μ+βhI4∗. (13) and (14) can be deduced as follows: (16)A1I1∗2-I3∗2-B1I1∗-I3∗-αβhI3∗2+B2-B1I3∗=0,I1∗-I3∗A1I1∗+I3∗-B1=I3∗αβhI3∗-B2-B1,I1∗-I3∗A1I1∗+I3∗-B1=I3∗αβhI3∗-αβhN∗+αγl+γh+μ,I1∗-I3∗A1I1∗+I3∗-B1=αI3∗βhI3∗-βhN∗+βlN∗-I3∗-Sh3∗,I1∗-I3∗A1I1∗+I3∗-B1=αI3∗βl-βhN∗-I3∗-Sh3∗, because of βl>βh and I3∗+Sh3∗⩽N∗,αI3∗(βl-βh)(N∗-I3∗-Sh3∗)⩾0. Then (17)I1∗-I3∗A1I1∗+I3∗-B1⩾0. Assuming I1∗<I3∗, then A1(I1∗+I3∗)-B1>2A1I1∗-B1=Δ1>0 and (I1∗-I3∗)[A1(I1∗+I3∗)-B1]<0, which contradicts with (17). So I1∗>I3∗. In the same way, one can get(18)I2∗<I4∗<I3∗<I1∗.Theorem 1.
There are only two viral equilibriaE1∗=(Sh1∗,I1∗)(orE3∗=(Sh3∗,I3∗)) and E2∗=(Sh2∗,I2∗)(orE4∗=(Sh4∗,I4∗)) in this model if (1)
R0<1;(2)
B1>0,Δ1>0(orB2>0,Δ2>0);(3)
I1∗>Imax(orI2∗>Imax).Proof.
System (13) has two real roots if Δ1>0. From (10) one can get that C>0 if R0<1; then C/A1>0. So the fact that I1∗>0,I2∗>0 if B1>0 can be got (in the same way, the fact that I1∗>0,I2∗>0 can be got if B2>0, Δ2>0) and there are only two viral equilibria E1∗,E2∗(orE3∗,E4∗) if I1∗>Imax(orI2∗>Imax) from (18).Theorem 2.
System (4) has only three viral equilibria E2∗=(Sh2∗,I2∗), E3∗=(Sh3∗,I3∗), and E4∗=(Sh4∗,I4∗) if (1)
R0<1;(2)
B1>0,Δ1>0;(3)
B2>0,Δ2>0;(4)
I2∗<Imax⩽I4∗.Proof.
Like the proof of Theorem1, it does not need to be stated.Theorem 3.
System (4) has only one viral equilibrium E1∗=(Sh1∗,I1∗)(orE3∗=(Sh3∗,I3∗)) if (1)
R0>1;(2)
I1∗<Imax(orI3∗⩾Imax).Proof.
One can getC<0 if R0>1 and Δ1>0,Δ2>0,C/A1<0,C/A2<0. So I1∗>0,I2∗<0 and I3∗>0,I4∗<0. Then the fact that only E1∗(orE3∗) existed if I1∗<Imax(orI3∗⩾Imax) from (18) can be got.


## 5. The Local Stability Analysis

To examine the local stability of the equilibria of system (4), its Jacobian matrices should be got as follows: (19)J1=-βhI-μγh-βhSh-βlI+βhIβlN∗-βlSh-2βlI+βhSh-γl-γh-μ,if0⩽I<Imax,J2=-βhI-μ-αIγh-βhSh+αN∗-Sh-2I-βlI+βhIβlN∗-βlSh-2βlI+βhSh-γl-γh-μ,ifI⩾Imax.Theorem 4.
E
0
∗ is locally asymptotically stable if R0<1.Proof.
The associated characteristic equation ofE0∗ can be got from J1 as follows:(20)λ+μλ+γl+γh+μ-βlblμ-βhbhμ.Then(21)λ1=-μ<0,λ2=-γl-γh-μ+βlblμ+βhbhμ=γl+γh+μR0-1. Based on the Lyapunov theorem [24], only if R0<1 are all eigenvalues of (17) negative. At this situation, E0∗ is locally asymptotically stable.Theorem 5.
E
1
∗
(
o
r
E
3
∗
) is locally asymptotically stable if system (4) follows Theorem 1 or 2 or 3.Proof.
The associated characteristic equations ofE1∗ can be got from J1 as follows:(22)λ2+k1λ+k2=0,
where(23)k1=βlI1∗+βhI1∗+μ>0,k2=I1∗βlβhI1∗+μ-βl-βhβhSh1∗-γh=I1∗2βlβhI1∗+βlμ-βlβhSh1∗+βlγh+β22Sh1∗-βhγh-βlβhI1∗+βlβhN∗-βlβhN∗=I1∗2βlβhI1∗+βlμ+βlγh-βhγh+βhβlN∗-βlSh1∗-βlI1∗+βhSh1∗-βlβhN∗=I1∗2βlβhI1∗+βlμ+βlγh-βhγh+βhγl+γh+μ-βlβhN∗=I1∗2βlβhI1∗+βlμ+βlγh+βhγl+βhμ-βlβhN∗=I1∗2A1B1+Δ12A1-B1=I1∗Δ1>0.The associated characteristic equations of E3∗ can be got from J2 as follows:(24)λ2+k3λ+k4=0, where (25)k3=αI3∗+βlI3∗+βhI3∗+μ>0,k4=I3∗βlαI3∗+βhI3∗+μ-βl-βhαSh3∗+2αI3∗-αN∗+βhSh3∗-γh=I3∗2βlβh+βhαI3∗+αβlN∗-βlI3∗-βlSh3∗+βhSh3∗+βhβlN∗-βlI3∗-βlSh3∗+βhSh3∗+βlμ+βlγh-βhγh-N∗βlβh+βhα=I3∗2A2I3∗+αγl+γh+μ+βhγl+γh+μ+βlμ+βlγh-βhγh-N∗βlβh+βhα=I3∗2A2I3∗-B2=I3∗2A2B2+Δ22A2-B2=I3∗Δ2>0.k1>0,k2>0(ork3>0,k4>0); the Hurwitz criterion follows [24], so E1∗(orE3∗) is locally asymptotically stable.


## 6. The Global Stability Analysis

This section will discuss the global stability of the equilibrium of system (4). To get global stability, let us investigate the following lemmas.Lemma 6.
For system (4), there is no periodic solution in the interior of Ω.Proof.
Let(26)GSh,I=bh+γhI+fIN∗-Sh-I-βhShI-μSh,HSh,I=βlN∗-Sh-II+βhShI-γlI-γhI-μI,BSh,I=1I, and then(27)∂GB∂Sh+∂HB∂I=-βh-μI-βl<0,if0⩽I<Imax,∂GB∂Sh+∂HB∂I=-βh-μI-βl-α<0,ifI⩾Imax.Thus, the claimed result follows from the Bendixson-Dulac criterion [24].Lemma 7.
For system (4), there is no periodic solution that passes through a point on ∂Ω, the boundary of Ω.Proof.
Consider an arbitrary point (S¯h,I¯), on the boundary of Ω. From (5), ∂Ω consists of the following three possibilities: (a)
S¯h=0. Then S˙h(S¯h,I¯)=bh+γhI¯>0, if0⩽I<Imax, and S˙h(S¯h,I¯)=bh+γhI¯+αI¯(N∗-I¯)>0, ifImax⩽I⩽N∗.(b)
I¯=0, 0⩽S¯h⩽N∗. Then I˙(S¯h,I¯)=0.(c)
S¯h+I¯=N∗. Then d(S¯h+I¯)/dt(S¯h,I¯)=-bl-γlI¯<0. In view of the orbit smoothness, combining the above discussions can get the claimed result.In view of Lemmas6 and 7 and Theorems 3–5, the main result of this section can be got as follows.


## 7. Numerical Examples and Discussions

In this section, some numerical examples are used to verify the results obtained in the previous section.Example 1.
Supposeβl=0.24, βh=0.08, γl=0.146, γh=0.003, bl=0.0012, bh=0.0018, μ=0.003, α=0.005, and Imax=0.38. In this situation, R0<1, I1∗<Imax. Some trajectories of initial points are displayed in Figure 3(a) and the time plots about two of them are shown in Figures 3(b) and 3(c). In Figure 3(a), the blue dashed line divides Ω into Ω1 (above the blue dashed line) and Ω2 (under the blue dashed line). The initial points in Ω1 are finally stable at E1∗ and in Ω2 are finally stable at E0∗, which complies with the third rows of Table 2. And the abbreviation notations of Table 2 are shown in Table 1.Table 1
Related instructions.
N
Not existing
E
Only existing
EL
Existing and locally asymptotically stable
EG
Existing and globally asymptotically stableTable 2
Main result of Section6.
Conditions
E
0
∗
E
1
∗
E
2
∗
E
3
∗
E
4
∗
R
0
<
1
EG
N
N
N
N
R
0
<
1
B
1
>
1
,
B
2
>
1
,
Δ
1
>
0
,
Δ
2
>
0
I
1
∗
<
I
m
a
x
EL
EL
E
N
N
I
3
∗
⩾
I
m
a
x
>
I
2
∗
EL
N
E
EL
E
I
2
∗
>
I
m
a
x
EL
N
N
EL
E
R
0
>
1
I
1
∗
<
I
m
a
x
E
EG
E
N
N
I
3
∗
⩾
I
m
a
x
E
N
N
EG
EFigure 3
Trajectory figure and time plots of Example1.
(a)
(b)
(c)Example 2.
Supposeβl=0.24, βh=0.08, γl=0.146, γh=0.003, bl=0.0012, bh=0.0018, μ=0.003, α=0.005, and Imax=0.21. In this situation, R0<1,I3∗>Imax. Some trajectories of initial points are displayed in Figure 4(a) and the time plots about two of them are shown in Figures 4(b) and 4(c). In Figure 4(a), the blue dashed line divides Ω into Ω1 (above the blue dashed line) and Ω2 (under the blue dashed line). The initial points in Ω1 are finally stable at E3∗ and in Ω2 are finally stable at E0∗, which complies with lines 4-5 of Table 2.Figure 4
Trajectory figure and time plots of Example2.
(a)
(b)
(c)Example 3.
Supposeβl=0.24, βh=0.08, γl=0.146, γh=0.043, bl=0.0012, bh=0.0018, μ=0.003, α=0.005, and Imax=0.21. In this situation, R0<1 and there is only E0∗ in the system. Some trajectories of initial points are displayed in Figure 5(a) and the time plots about two of them are shown in Figures 5(b) and 5(c). The initial points in are finally stable at E0∗, which complies with line 2 of Table 2.Figure 5
Trajectory figure and time plots of Example3.
(a)
(b)
(c)Example 4.
Supposeβl=0.3, βh=0.09, γl=0.056, γh=0.043, bl=0.0012, bh=0.0018, μ=0.003, α=0.06, and Imax=0.38. In this situation, R0>1,I1∗<Imax. Some trajectories of initial points are displayed in Figure 6(a) and the time plots about two of them are shown in Figures 6(b) and 6(c). The initial points in are finally stable at E1∗, which complies with line 6 of Table 2.Figure 6
Trajectory figure and time plots of Example4.
(a)
(b)
(c)Example 5.
Supposeβl=0.3, βh=0.09, γl=0.056, γh=0.043, bl=0.0012, bh=0.0018, μ=0.003, α=0.06, and Imax=0.2. In this situation, R0>1,I3∗>Imax. Some trajectories of initial points are displayed in Figure 7(a) and the time plots about two of them are shown in Figures 7(b) and 7(c). The initial points in are finally stable at E3∗, which complies with the last row of Table 2.Figure 7
Trajectory figure and time plots of Example5.
(a)
(b)
(c)By introducing random factors and model adaptive behavior, a series of simulations run are used to approximate closer to actual worm propagation due to the unavailability of real-world data. Hosts (used IP addresses) here appear as abstractions in the simulations. Instead of modeling various operating systems and services, each host is simply considered to be one of the following: susceptible nodes with high security level, susceptible nodes with low security level, and infected nodes. Here a complete network with initial 10000 nodes is applied for numerical evaluation. And we focus on how the mechanisms of security classification and intervention affect the propagation of network viruses. So we simulate three scenarios for the spread of viruses:(1) non-SC non-INTVIN scenario, (2) with SC non-INTVIN scenario, and (3) with SC and INTVIN scenario (see Figure 8), where SC and INTVIN are short for security classification and intervention, respectively. And the parameters Imax and α determine when to intervene and the strength of interventions, respectively. For evaluation purpose, the values of the model parameters are set as follows: βl=0.3, βh=0.09, γl=0.056, γh=0.043, bl=0.0012, bh=0.0018, μ=0.003, and other parameters are shown in Figure 8. In general, simulation results show that the intervention mechanism proposed in this paper can be applied to curbing the spread of virus effectively. Moreover, a large number of simulations are conducted to study how the combination of Imax and α affects the propagation scale (see Figure 9). Obviously, the earlier (the lower Imax) and stronger (the higher α) the intervention is introduced, the fewer the nodes finally get infected. We divide the parameter subspace α,Imax:α>0,Imax>0 into two parts, numbered as A and B (as shown in Figure 9). Simulation results lead the following conclusion.(1)
If(α,Imax)∈A, the value of Ifinal (defined in Figure 9) only depends on the value of α. So in Figure 8 the number of infected nodes in scenarios with Imax=500 is the same as the one with Imax=1000, where α=0.2, and it is higher than the one with Imax=500 and α=0.6. More precisely, the value of Ifinal decreases as α increasing.(2)
If(α,Imax)∈B, the value of Ifinal only depends on the value of Imax (4). So in Figure 8 the number of infected nodes in scenarios with α=0.2 is the same as the one with α=0.6, where Imax=2000, and it is higher than the one with Imax=1000 and α=0.6. Note that Ifinal does not always decrease with the increase of Imax, because the intervention is never involved for large Imax (see the dark black part for Imax>0.3 in Figure 9).Figure 8
Time evolution of the infected nodes in different scenarios.Figure 9
Influence ofImax and α on Ifinal. Imax and Ifinal are the proportions of infected nodes in all nodes. Moreover, Ifinal is the average of 100 values for t>10000. Here all other parameters are the same as Figure 8.Remark 6.
The simulations here do not take into account latency issues, hop-count, bandwidth limitations, and transfer times or connectivity issues. Since the scale of simulated network is quite small compared with the real Internet, all parameters are assumed on that scale. But the scale factor can also make the real-world more complex.
Table2 suggests that, to eradicate viruses from the Internet, one should take necessary actions to control the system parameters so that R0∗ is well below 1 and not let system meet the lines 3–5 of Table 2. After simple calculations, the following can be got: (28)∂R0∂βl=blμγl+γh+μ>0,∂R0∂βh=bhμγl+γh+μ>0,∂R0∂b1=β1μγl+γh+μ>0,∂R0∂bh=βhμγl+γh+μ>0,∂R0∂μ=-γl+γh+2μμ2γl+γh+μ2<0,∂R0∂γl=-1μγl+γh+μ2<0,∂R0∂γh=-1μγl+γh+μ2<0.Thus, R0 is increasing with βl,βh,bl,bh and is decreasing with μ,γl,γh.Based on the above discussions, an incomplete list of effective measures for users to contain the virus prevalence is presented below:(1)
Timely acquire the updated versions of the antivirus software, so that the two infecting probabilities,βl and βh, are both reduced and the curing probabilities, γl and γh, are enhanced.(2)
Do not connect computers to the Internet when unnecessary, so that the recruitment rate,μ, is lowered.(3)
For both cost and security, let the threshold value of computer virus lead administrator to take measures to upgrade the security level approaching the value of stable infections in the stage of taking measures.


## 8. Conclusions

In this paper, we presented a novel intervention mechanism to restrain the virus spreading under the framework of security classification. The model reflects a realistic scenario how the intervention is applied when the number of infected nodes reaches the intervention threshold. Theoretical analysis and numerical evaluation are used to study howImax, α affect the propagation behaviors. The main results are listed as follows: (1) The dynamic behaviors of computer virus under security classification are different with common circumstance. Obviously, much higher security computers will lead to fewer infections. (2) The earlier and the stronger the intervention is introduced, the fewer the nodes finally get infected. (3) According to the brief parameter analysis, some other effective measures in reality are presented. Viewed from a real-world perspective, in order to make better use of this intervention mechanism, one of the most important things is how to detect the exact number of infected nodes. Although an in-depth discussion of this is outside this paper’s scope, we are forced to point out that the measured value is below the actual one. In this case, the actual value of intervention threshold must be set below the theoretical one.Our future work will be focused on studying such intervention mechanism in heterogeneous networks, such as small-world network and scale-free network.



---

*Source: 8609082-2017-05-25.xml*