# Modelling and Analysis of Propagation Behavior of Computer Viruses with Nonlinear Countermeasure Probability and Infected Removable Storage Media

Authors: Xulong Zhang; Yong Li
Journal: Discrete Dynamics in Nature and Society
 (2020)

---

## Abstract

The dissemination of countermeasures is diffusely recognized as one of the most valid strategies of containing computer virus diffusion. In order to better understand the impacts of countermeasure and removable storage media on viral spread, this paper addresses a dynamical model, which incorporates nonlinear countermeasure probability and infected removable storage media. Theoretical analysis reveals that the unique (viral) equilibrium of the model is globally asymptotically stable. This main result is also illustrated by some numerical experiments. Additionally, the numerical experiments of different countermeasure probabilities are conducted.


---

## Body

## 1. Introduction

The continual emergence of computer viruses, especially with the growing popularity of the Internet, has brought great troubles and threats to our daily work and life (e.g., [1]). Besides, removable storage media, such as compact disk, removable hard disk, USB flash disk, flash memory card, and so on, which are often used in our daily work provide another spreading route for computer viruses except the Internet. Antivirus software, patches, and firewall are the main technical means of defending against computer viruses, which can weed out all viruses they can recognize that stay in individual electronic devices such as personal computer (PC) and removable storage media. Unfortunately, these techniques seem powerless to the outbreak of a new virus. In order to effectively contain virus spread, one needs to understand the propagation laws of computer viruses, which may provide a theoretical basis for decision making, as well as to use technical measures.A multitude of propagation models of computer viruses have been presented since 1991, specifically, SIS (susceptible-infected-susceptible) models (e.g., [2, 3]), SIRS (susceptible-infected-recovered-susceptible) models (e.g., [4, 5]), SLBS (susceptible-latent-breaking-susceptible) model (e.g., [6]), SICS (susceptible-infected-countermeasured-susceptible) models (e.g., [7–9]), and SDIRS (susceptible-delitescent-infected-recovered- susceptible) model (e.g., [10]).In the field of computer viruses, countermeasures such as warnings, firewall, and software patches can provide a practical approach to avoid virus infection problems. In 2004, Chen and Carley [11] addressed the countermeasure competing (CMC) strategy, which shows that the CMC strategy is more available compared to previous strategies.Inspired by this work and in order to macroscopically describe the mixed transmission of computer viruses and countermeasures, Zhu et al. [7] presented the first compartment model in this aspect, named as the SICS model, and its global dynamics was fully examined. Afterwards, Yang and Yang [8] extended this model by incorporating the effect of infected external computers (i.e., computers outside the Internet) and removable storage media. However, these two models ignore two important facts. On the one hand, they overlook the fact that the linear infection probability is fit well for the real-world situations only when the countermeasured (or immune) nodes are few. On the other hand, they neglect the fact that countermeasures may be disseminated through networks at different rates, which has been mentioned in Reference [11]. Thus, the assumption of linear countermeasure probability is unreasonable.To remedy these defects and considering the influences of general countermeasure and infected removable storage media on viral diffusion, this paper studies a new propagation model incorporating generic countermeasure probability and infected removable storage media. The main result, the global stability of the unique (viral) equilibrium, is proved, which is also examined by some numerical experiments. Furthermore, the numerical experiments of different countermeasure probabilities are conducted.The paper is organized as follows. The model formulation is made in Section2. Section 3 determines the (viral) equilibrium and investigates its global stability. Numerical experiments are presented in Section 4. This work is summarized in Section 5.


## 2. Model Description

In this paper, a computer is called external or internal computer determined by whether it is disconnected from or connected to the Internet. All internal computers may have three states:susceptible, infected, and immune (with countermeasures). For brevity, let St, It, and Ct (S, I, and C, for short) denote the average numbers of susceptible, infected, and countermeasured computers at time t, respectively. Their entering rates are μ1>0, μ2>0, and μ3>0, respectively. Besides, the following basic assumptions of the model are made.(1)
Each internal computer leaves the Internet with probabilityδ>0.(2)
Each susceptible internal computer becomes infected by connecting with infected internal computer (or infected removable storage media) with probabilityβ1>0 (or β2>0).(3)
Each infected or susceptible internal computer gains the latest countermeasure with probabilityγ1Ct at time t, where γ1 is twice continuously differentiable, γ1′>0,γ1″<0, and γ10=0. The concavity assumption seizes well the saturability of the countermeasure probability.(4)
By reinstalling the operating system, each countermeasured (or infected) internal computer becomes susceptible with probabilityα>0 (or γ2>0).Now, one can derive the mathematical representation of the model as follows (also see Figure1):(1)dSdt=μ1−β1SI−β2S−γ1CS+γ2I+αC−δS,dIdt=μ2+β1SI+β2S−γ1CI−γ2I−δI,dCdt=μ3+γ1CS+γ1CI−αC−δC,with initial condition S0,I0,C0∈ℝ+3.Figure 1
Transfer diagram of the new proposed model.


## 3. Theoretical Analysis

LetN=S+I+C, and μ=μ1+μ2+μ3. Adding up the three equations of system (1), it is easy to get that limt⟶∞N=μ/δ. It follows by the asymptotically autonomous system theory [12] that system (1) is equivalent to the following reduced limiting system:(2)dIdt=μ2+β2μδ+β1μδ−β2−γ2−δI−β2C−β1I2−β1IC−γ1CI,dCdt=μ3+γ1Cμδ−C−α+δC,with initial condition I0,C0∈Ω, where(3)Ω=I,C∈ℝ+2:I+C≤μδ,and Ω is positively invariant for system (2).In the following sections, we just need to investigate the dynamical behavior of system (2).


### 3.1. Equilibrium

Theorem 1.
There exists a unique (viral) equilibriumE∗=I∗,C∗ for system (2), where E∗ is the single positive solution to the following system:(4)μ2+β2μδ+β1μδ−β2−γ2−δx−β2y−β1x2−β1xy−γ1yx=0,μ3+γ1yμδ−y−α+δy=0,with the initial condition x0,y0∈Ω.Proof.
Let us suppose thatE∗=I∗,C∗ is an equilibrium of system (2). Clearly, E∗ satisfies system (4). Thus, it suffices to prove that system (4) has a unique positive solution.
Firstly, let us prove that the second equation of system (4) has a unique positive root. Let(5)fy=μ3+γ1yμδ−y−α+δy.
Asf0=μ3>0 and fμ/δ=−αμ/δ−μ1+μ2<0, so f does have a zero located in 0,μ/δ. Besides, notice that(6)f′μδ=−γ1μδ−α+δ<0,f″y=γ1″yμδ−y−2γ1′y<0.
We shall consider two possibilities depending upon whetherf′0 is positive or negative.Case 1:f′0>0. Let(7)y¯=maxy∈0,μδ:f′y>0.Thus,f is strictly increasing in 0,y¯ and strictly decreasing in y¯,μ/δ, which implies that f has a unique zero in y¯,μ/δ.Case 2:f′0≤0. So, f is decreasing and has a unique zero.
It is easily obtained from the above discussions thatf does has a single zero. Then, y=C∗. Besides, f′C∗<0.
Next, let us prove that the first equation of system (4) has a single positive root. Let(8)gx=μ2+β2μδ−C∗+β1μδ−β2−γ2−δ−β1C∗−γ1C∗x−β1x2.
Asg0=μ2+β2μ/δ−C∗>0 and gμ/δ−C∗=−μ1−αC∗−γ2μ/δ−C∗<0, g does have a (positive) zero located in 0,μ/δ−C∗. Besides, note that(9)g′μδ−C∗=−β1μδ−C∗−β2+γ2+δ+γ1C∗<0,g″x=−2β1<0.
We shall also proceed by distinguishing two possibilities depending upon whetherg′0 is positive or negative.Case 1:g′0>0. Let(10)x¯=maxx∈0,μδ−C∗:g′x>0.Then,g is strictly increasing in 0,x¯ and decreasing in x¯,μ/δ−C∗, meaning that g has a single zero in x¯,μ/δ−C∗.Case 2:g′0≤0. Hence, g is decreasing and has a unique zero. Then, g always has a single zero x=I∗. Besides, g′I∗<0.
Thus, the claimed result follows.


### 3.2. Local Stability

Theorem 2.
E∗ is locally asymptotically stable.Proof.
The corresponding Jacobian matrix of system (2) at E∗ is as follows: (11)β1μδ−β2−γ2−δ−β1C∗−2β1I∗−γ1C∗−β2−β1I∗−γ1′C∗I∗0γ1′C∗μδ−C∗−γ1C∗−α+δ,and its two eigenvalues are(12)λ1=β1μδ−β2−γ2−δ−β1C∗−2β1I∗−γ1C∗=g′I∗<0,λ2=γ1′C∗μδ−C∗−γ1C∗−α+δ=f′C∗<0.
Thus, the claimed result follows from the Lyapunov stability theorem [13].


### 3.3. Global Stability

Lemma 1.
System (2) has no periodic orbit.Proof.
Let(13)h1I,C=μ2+β2μδ+β1μδ−β2−γ2−δI−β2C−β1I2−β1IC−γ1CI,h2I,C=μ3+γ1Cμδ−C−α+δC,DI,C=1IC.
It can be obtained in the interior ofΩ that(14)∂Dh1∂I+∂Dh2∂C=−β1C−γ1′CI−μ2I2C−μ3IC2−β2I2Cμδ−C+μδIC2γ1′CC−γ1C.
Let(15)kx=γ1′xx−γ1x.
Ask0=0 and k′x=γ1″xx<0 for all x>0, kC<0. Thus, we have ∂Dh1/∂I+∂Dh2/∂C<0.
Hence, in the interior ofΩ, system (2) has no periodic orbit according to the Bendixson–Dulac criterion [13].
On the boundary ofΩ, let I˜,C˜ denote an arbitrary point. Thus, three possibilities may occur.Case 1:0<C˜<μ/δ, I˜=0. Then, dI/dt|I˜,C˜=μ2+β2μ/δ−C˜>0.Case 2:0<I˜<μ/δ, C˜=0. Then, dC/dt|I˜,C˜=μ3>0.Case 3:I˜+C˜=μ/δ, C˜≠0, I˜≠0. Hence,(16)dI+Cdt|I˜,C˜=−μ1−γ2I˜−αC˜<0.
Thus, system (2) has no periodic orbit across the arbitrary point I˜,C˜. The proof is completed.
In what follows, the main result of this paper will be given as follows.Theorem 3.
E∗ is globally asymptotically stable.Proof.
Based on Theorem1, Lemma 1, and Theorem 2, the claimed result follows from the generalized Poincare–Bendixson theorem [13].


## 3.1. Equilibrium

Theorem 1.
There exists a unique (viral) equilibriumE∗=I∗,C∗ for system (2), where E∗ is the single positive solution to the following system:(4)μ2+β2μδ+β1μδ−β2−γ2−δx−β2y−β1x2−β1xy−γ1yx=0,μ3+γ1yμδ−y−α+δy=0,with the initial condition x0,y0∈Ω.Proof.
Let us suppose thatE∗=I∗,C∗ is an equilibrium of system (2). Clearly, E∗ satisfies system (4). Thus, it suffices to prove that system (4) has a unique positive solution.
Firstly, let us prove that the second equation of system (4) has a unique positive root. Let(5)fy=μ3+γ1yμδ−y−α+δy.
Asf0=μ3>0 and fμ/δ=−αμ/δ−μ1+μ2<0, so f does have a zero located in 0,μ/δ. Besides, notice that(6)f′μδ=−γ1μδ−α+δ<0,f″y=γ1″yμδ−y−2γ1′y<0.
We shall consider two possibilities depending upon whetherf′0 is positive or negative.Case 1:f′0>0. Let(7)y¯=maxy∈0,μδ:f′y>0.Thus,f is strictly increasing in 0,y¯ and strictly decreasing in y¯,μ/δ, which implies that f has a unique zero in y¯,μ/δ.Case 2:f′0≤0. So, f is decreasing and has a unique zero.
It is easily obtained from the above discussions thatf does has a single zero. Then, y=C∗. Besides, f′C∗<0.
Next, let us prove that the first equation of system (4) has a single positive root. Let(8)gx=μ2+β2μδ−C∗+β1μδ−β2−γ2−δ−β1C∗−γ1C∗x−β1x2.
Asg0=μ2+β2μ/δ−C∗>0 and gμ/δ−C∗=−μ1−αC∗−γ2μ/δ−C∗<0, g does have a (positive) zero located in 0,μ/δ−C∗. Besides, note that(9)g′μδ−C∗=−β1μδ−C∗−β2+γ2+δ+γ1C∗<0,g″x=−2β1<0.
We shall also proceed by distinguishing two possibilities depending upon whetherg′0 is positive or negative.Case 1:g′0>0. Let(10)x¯=maxx∈0,μδ−C∗:g′x>0.Then,g is strictly increasing in 0,x¯ and decreasing in x¯,μ/δ−C∗, meaning that g has a single zero in x¯,μ/δ−C∗.Case 2:g′0≤0. Hence, g is decreasing and has a unique zero. Then, g always has a single zero x=I∗. Besides, g′I∗<0.
Thus, the claimed result follows.


## 3.2. Local Stability

Theorem 2.
E∗ is locally asymptotically stable.Proof.
The corresponding Jacobian matrix of system (2) at E∗ is as follows: (11)β1μδ−β2−γ2−δ−β1C∗−2β1I∗−γ1C∗−β2−β1I∗−γ1′C∗I∗0γ1′C∗μδ−C∗−γ1C∗−α+δ,and its two eigenvalues are(12)λ1=β1μδ−β2−γ2−δ−β1C∗−2β1I∗−γ1C∗=g′I∗<0,λ2=γ1′C∗μδ−C∗−γ1C∗−α+δ=f′C∗<0.
Thus, the claimed result follows from the Lyapunov stability theorem [13].


## 3.3. Global Stability

Lemma 1.
System (2) has no periodic orbit.Proof.
Let(13)h1I,C=μ2+β2μδ+β1μδ−β2−γ2−δI−β2C−β1I2−β1IC−γ1CI,h2I,C=μ3+γ1Cμδ−C−α+δC,DI,C=1IC.
It can be obtained in the interior ofΩ that(14)∂Dh1∂I+∂Dh2∂C=−β1C−γ1′CI−μ2I2C−μ3IC2−β2I2Cμδ−C+μδIC2γ1′CC−γ1C.
Let(15)kx=γ1′xx−γ1x.
Ask0=0 and k′x=γ1″xx<0 for all x>0, kC<0. Thus, we have ∂Dh1/∂I+∂Dh2/∂C<0.
Hence, in the interior ofΩ, system (2) has no periodic orbit according to the Bendixson–Dulac criterion [13].
On the boundary ofΩ, let I˜,C˜ denote an arbitrary point. Thus, three possibilities may occur.Case 1:0<C˜<μ/δ, I˜=0. Then, dI/dt|I˜,C˜=μ2+β2μ/δ−C˜>0.Case 2:0<I˜<μ/δ, C˜=0. Then, dC/dt|I˜,C˜=μ3>0.Case 3:I˜+C˜=μ/δ, C˜≠0, I˜≠0. Hence,(16)dI+Cdt|I˜,C˜=−μ1−γ2I˜−αC˜<0.
Thus, system (2) has no periodic orbit across the arbitrary point I˜,C˜. The proof is completed.
In what follows, the main result of this paper will be given as follows.Theorem 3.
E∗ is globally asymptotically stable.Proof.
Based on Theorem1, Lemma 1, and Theorem 2, the claimed result follows from the generalized Poincare–Bendixson theorem [13].


## 4. Numerical Experiments

To illustrate the main result of this paper and the impacts of different countermeasure probabilities on viral spread, some numerical experiments are presented in this section.Example 1.
Consider system (1) with μ1=0.55, μ2=0.25, μ3=0.2,α=0.02, β1=0.05, β2=0.03, γ2=0.02, δ=0.1, and γ1C=0.05C/1+C. The initial condition is S0,I0,C0=3,1,5. In Figure 2, a comparison between the new proposed SICS model and the original SICS model is shown, from which it can be seen that the new proposed model is more reasonable in predicting virus prevalence because computer viruses would not go extinct (i.e., I≥1), which demonstrates that the linear countermeasure probability overestimates the suppression of countermeasures on virus diffusion when compared to the nonlinear one.Figure 2
A comparison between the new proposed SICS model and the original SICS model.Example 2.
Consider system (1) with μ1=55, μ2=38, μ3=7, α=0.01, β1=0.52, β2=0.015, γ2=0.01, δ=0.02, and γ1C=0.006C0.15. Six different initial conditions are listed below.
(1)
S0,I0,C0=325,25,10.(2)
S0,I0,C0=925,125,90.(3)
S0,I0,C0=1525,225,170.(4)
S0,I0,C0=2125,325,250.(5)
S0,I0,C0=2725,425,330.(6)
S0,I0,C0=3325,525,410.
Figure3 shows six orbits of system (1) with different initial conditions for a common system. It can be seen from this figure that no matter where the initial state starts, computer viruses would always exist and tend to a steady state, which coincides with the main result. This also reveals that the global stability is independent of the initial state.Figure 3
Six orbits of system (1) with different initial conditions.Example 3.
Consider system (1) with the common initial condition S0,I0,C0=1050,450,105, and six sets of parameters are given in Table 1. Six orbits of system (1) with different system parameters for a common initial condition are shown in Figure 4, from which it can be seen that computer viruses would remain present and tend to a steady state, which accords with the main result. Additionally, this figure reveals that even starting from the same initial state the system would approach to different states for different parameters, which is distinct from the phenomenon in Example 2.Table 1
The parameters of system (1) for Example 3.
ParameterSet 1Set 2Set 3Set 4Set 5Set 6μ1553525151018μ2381525252019μ37105202513α0.010.030.030.020.020.02β10.520.520.220.720.620.12β20.0150.130.010.080.180.02γ20.010.050.030.020.040.02δ0.020.020.020.030.020.02γ1C0.06C0.150.01C0.30.1C0.10.01C0.50.03C0.250.05C0.05Figure 4
Six orbits of system (1) with different system parameters.Example 4.
Consider system (1) with μ1=5.5, μ2=3.8, μ3=0.7,α=0.01, β1=0.52, β2=0.015, γ2=0.01, and δ=0.02. The initial condition is S0,I0,C0=325,25,10. Figure 5 shows the influences of the varied countermeasure probabilities on the number of infected computers, where γ1C=0.08C0.2, γ2C=0.08C/1+0.416C, and γ3C=0.08C/1+C. This figure also demonstrates that the nonlinear countermeasure probabilities which are continuously differentiable up to the second order may have many forms and pose different impacts on viral spread.Figure 5
The impacts of the varied countermeasure probabilities onI.


## 5. Summary and Outlook

A new SICS model has been proposed and analyzed in this paper. The global stability of the unique (viral) equilibrium has been proved and illustrated completely. Besides, a comparison between the new proposed model and the original SICS model has been shown, and the effects of varied countermeasure probabilities have also been revealed. The numerical experiments demonstrate that the nonlinear countermeasure probability is more reasonable than the linear one.Additionally, the follow-up work arrangement is as follows. Firstly, time delays (e.g., [14, 15]), pulses (e.g., [16]), random fluctuations (e.g., [17, 18]), and optimal control strategies (e.g., [19]) can be considered in the new model. Secondly, the new model may be extended on wireless sensor networks (e.g., [20–22]). With the popularity of social networks, individuals’ participation has a particularly important effect on information diffusion including propagation of computer viruses. For example, Alduaiji et al. [23] developed an influence propagation model for clique-based community detection in social networks. Li et al. [24] proposed a metric to measure the community-diversified influence in social networks. Therefore, the new model may also be extended in social networks. Finally, the new proposed model can be formulated for cloud computing security (e.g., [25]).



---

*Source: 8814319-2020-10-26.xml*