# Stability Analysis of a Dynamical Model for Malware Propagation with Generic Nonlinear Countermeasure and Infection Probabilities

Authors: Xulong Zhang; Xiaoxia Song
Journal: Security and Communication Networks
 (2020)

---

## Abstract

The dissemination of countermeasures is widely recognized as one of the most effective strategies of inhibiting malware propagation, and the study of general countermeasure and infection has an important and practical significance. On this point, a dynamical model incorporating generic nonlinear countermeasure and infection probabilities is proposed. Theoretical analysis shows that the model has a unique equilibrium which is globally asymptotically stable. Accordingly, a real network based on the model assumptions is constructed, and some numerical simulations are conducted on it. Simulations not only illustrate theoretical results but also demonstrate the reasonability of general countermeasure and infection.


---

## Body

## 1. Introduction and Model Formulation

Human society has been subjected to great financial losses since malware constantly emerged (e.g., [1, 2]). The study of modeling and understanding malware spreading has attracted a lot of attention in the past three decades or so, and a multitude of propagation models capturing the behaviors of malware have been proposed. Specifically, SIS (susceptible-infected-susceptible) models (e.g., [3, 4]), SIRS (susceptible-infected-recovered-susceptible) models (e.g., [5, 6]), SLBS (susceptible-latent-breaking-susceptible) models (e.g., [7, 8]), SICS (susceptible-infected-countermeasured-susceptible) models (e.g., [9–11]), and SDIRS (susceptible-delitescent-infected-recovered-susceptible) model (e.g., [12]).In the field of malware, countermeasures such as software patches or warnings can supply a valid approach to helping individuals and organizations avert malware infection problems (e.g., [13, 14]). In 2004, the CMC (Countermeasure Competing) strategy is proposed by Chen and Carley [15]. Their results reveal that the CMC strategy is more effective than previous strategies by the empirical malware data.Inspired by this work and in order to macroscopically describe the mixing transmission of malware and countermeasures, Zhu et al. [9] presented a compartment model. The dynamics of the model was performed. Later, Yang and Yang [10] simply extended this model by incorporating the impacts of infected removable storage media and external nodes (e.g., computers). However, these two models both neglect two important facts. On the one hand, they ignore the fact that the linear infection probability is a well fit for the real-world situations only when the infected nodes are few. On the other hand, they overlook the fact that countermeasures may propagate through networks at different rates. Thus, the assumptions of linear infection and countermeasure probabilities are unreasonable.To remedy these flaws and considering the impacts of general countermeasure and infection on the spread of malware, this paper studies a new dynamical model (see Figure1), which incorporates generic countermeasure and infection probabilities. Here, St, It, and Ct (S, I, and C, for short) denote the average numbers of susceptible, infected, and countermeasured internal nodes (i.e., nodes on the network) at time t, respectively. Their entering rates are μ1>0, μ2>0, and μ3>0, respectively. Besides, the following basic hypotheses of the model are made:(H1) Each internal node leaves the network with probabilityδ>0.(H2) At timet, each susceptible internal node gets infected by infected internal nodes with probability βIt, where β is twice continuously differentiable, β′>0,β″<0, and β0=0. The concavity hypothesis fits well with the saturation property of the infection probability.(H3) At timet, each infected or susceptible internal node obtains the newest countermeasure with probability γ1Ct, where γ1 is twice continuously differentiable, γ1′>0,γ1″<0, and γ10=0.(H4) By reinstalling the operating system, each infected (or countermeasured) internal node becomes susceptible with probabilityγ2>0 (or α>0).Figure 1
Transfer diagram of the new proposed model.Combining the above hypotheses, the new proposed model can be represented by the following system:(1)dSdt=μ1−βIS−γ1CS+γ2I+αC−δS,dIdt=μ2+βIS−γ1CI−γ2I−δI,dCdt=μ3+γ1CS+γ1CI−αC−δC,with initial condition S0,I0,C0∈ℝ+3.The globally asymptotic stability of the unique (viral) equilibrium of model (1) is proved and illustrated completely. Additionally, a new network is constructed based on the above assumptions, on which some numerical simulations are examined.The paper is organized in this fashion. Section2 determines the (viral) equilibrium and investigates its local and global stabilities. Experimental analysis is presented in Section 3. Finally, some conclusions and outlooks are given in Section 4.


## 2. Model Analysis

LetN=S+I+C, and μ=μ1+μ2+μ3. Adding up the three equations of system (1), one can easily obtain that limt⟶∞N=μ/δ. It follows by the asymptotically autonomous system theory [16] that system (1) is equivalent to the following reduced limiting system:(2)dIdt=μ2+βIμδ−I−C−γ1CI−γ2I−δI,dCdt=μ3+γ1Cμδ−C−α+δC,with initial condition I0,C0∈Ω, where(3)Ω=I,C∈ℝ+2:I+C≤μδ,and Ω is positively invariant for system (2).In the following sections, we just need to investigate the dynamical behavior of system (2).


### 2.1. Equilibrium

Theorem 1.
System (2) has a unique (viral) equilibrium E∗=I∗,C∗, where E∗ is the unique positive solution to the following system:(4)μ2+βxμδ−x−y−γ1yx−γ2x−δx=0,μ3+γ1yμδ−y−α+δy=0,with the initial condition x0,y0∈Ω.Proof.
Let us assume thatE∗=I∗,C∗ is an equilibrium of system (2). Clearly, E∗ satisfies system (4).
Firstly, let us prove that the second equation of system (4) has a unique positive root. Let(5)fy=μ3+γ1yμδ−y−α+δy,y∈0,μδ.As f0=μ3>0 and fμ/δ=−αμ/δ−μ1+μ2<0, it follows that f has a zero located in the interval 0,μ/δ. Furthermore, note that(6)f′μδ=−γ1μδ−α+δ<0,f″y=γ1″yμδ−y−2γ1′y<0.
We shall proceed by distinguishing two possibilities depending on whetherf′0 is positive or negative.Case 1:f′0>0. Let(7)y¯=maxy∈0,μδ:f′y>0.
Thus,f is strictly increasing and decreasing in 0,y¯ and y¯,μ/δ, respectively, which implies that f has a single zero in y¯,μ/δ.Case 2:f′0≤0. Hence, f is strictly decreasing and has a single zero.
Collecting the above discussions, it can be concluded thatf does have a unique zero. Then, y=C∗, and f′C∗<0.
Next, let us prove that the first equation of system (4) has a unique positive root. Let(8)gx=μ2+βxμδ−C∗−x−γ2+δ+γ1C∗x,x∈0,μδ−C∗.
Asg0=μ2>0 and gμ/δ−C∗=−μ1−αC∗−γ2μ/δ−C∗<0, g does have a (positive) zero located in the interval 0,μ/δ−C∗. Besides, notice that(9)g′μδ−C∗=−βμδ−C∗−γ2+δ+γ1C∗<0,g″x=β″xμδ−C∗−x−2β′x<0.
We shall also proceed by distinguishing two possibilities depending on whetherg′0 is positive or negative.Case 1:g′0>0. Let(10)x¯=maxx∈0,μδ−C∗:g′x>0.
Thus,g is strictly increasing and decreasing in 0,x¯ and x¯,μ/δ−C∗, respectively, implying that g has a single zero in x¯,μ/δ−C∗.Case 2:g′0≤0. Thus, g is strictly decreasing and has a single zero. Then, g always has a unique zero x=I∗. Besides, g′I∗<0.
In conclusion, the claimed result is proved.


### 2.2. Local Stability

Theorem 2.
E∗ is locally asymptotically stable with respect to Ω.Proof.
LetS∗=μ/δ−I∗−C∗. The corresponding Jacobian matrix of system (2) at E∗ is given as follows:(11)β′I∗S∗−βI∗−γ1C∗−γ2−δ−βI∗−γ1′C∗I∗0γ1′C∗μδ−C∗−γ1C∗−α+δ,and its two eigenvalues are(12)λ1=β′I∗S∗−βI∗−γ1C∗−γ2−δ=g′I∗<0,λ2=γ1′C∗μδ−C∗−γ1C∗−α+δ=f′C∗<0.
Thus, the claimed result follows from the Lyapunov stability theorem [17].


### 2.3. Global Stability

Lemma 1.
System (2) admits no periodic orbit.Proof.
Let(13)h1I,C=μ2+βIμδ−I−C−γ1CI−γ2+δI,h2I,C=μ3+γ1Cμδ−C−α+δC,DI,C=1IC.
In the interior ofΩ, it is easily obtained that(14)∂Dh1∂I+∂Dh2∂C=−β′IC−γ1CI+1I2Cμδ−Cβ′II−βI+μδIC2γ1′CC−γ1C−μ2I2C−μ3IC2.
Let(15)k1x=β′xx−βx.
Ask10=0 and k1′x=β″xx<0 for all x>0, k1I<0.
Let(16)k2x=γ1′xx−γ1x.
Ask20=0 and k2′x=γ1″xx<0 for all x>0, k2C<0. Thus, we have ∂Dh1/∂I+∂Dh2/∂C<0.
Hence, it follows from the Bendixson–Dulac criterion [17] that system (2) admits no periodic orbit in the interior of Ω.
On the boundary ofΩ, let I˜,C˜ denote an arbitrary point. Thus, three possibilities can be considered.Case 1:0<C˜<μ/δ, I˜=0. Then, dI/dtI˜,C˜=μ2>0.Case 2:0<I˜<μ/δ, C˜=0. Then, dC/dtI˜,C˜=μ3>0.Case 3:I˜+C˜=μ/δ, C˜≠0, I˜≠0. Thus,(17)dI+CdtI˜,C˜=−μ1−γ2I˜−αC˜<0.
Hence, system (2) has no periodic orbit across I˜,C˜. In conclusion, the claimed result is proved.
By Theorems1 and 2, Lemma 1, and the generalized Poincare–Bendixson theorem [17], we can easily obtain the main result of this paper as follows.Theorem 3.
E∗ is globally asymptotically stable with respect to Ω.In Figures2 and 3, six orbits of system (1) are examined with different system parameters and different initial conditions, respectively. The illustrated results are in accordance with the main theoretical result (i.e., Theorem 3).Figure 2
Six orbits of system (1) for different system parameters.Figure 3
Six orbits of system (1) with different initial conditions.


## 2.1. Equilibrium

Theorem 1.
System (2) has a unique (viral) equilibrium E∗=I∗,C∗, where E∗ is the unique positive solution to the following system:(4)μ2+βxμδ−x−y−γ1yx−γ2x−δx=0,μ3+γ1yμδ−y−α+δy=0,with the initial condition x0,y0∈Ω.Proof.
Let us assume thatE∗=I∗,C∗ is an equilibrium of system (2). Clearly, E∗ satisfies system (4).
Firstly, let us prove that the second equation of system (4) has a unique positive root. Let(5)fy=μ3+γ1yμδ−y−α+δy,y∈0,μδ.As f0=μ3>0 and fμ/δ=−αμ/δ−μ1+μ2<0, it follows that f has a zero located in the interval 0,μ/δ. Furthermore, note that(6)f′μδ=−γ1μδ−α+δ<0,f″y=γ1″yμδ−y−2γ1′y<0.
We shall proceed by distinguishing two possibilities depending on whetherf′0 is positive or negative.Case 1:f′0>0. Let(7)y¯=maxy∈0,μδ:f′y>0.
Thus,f is strictly increasing and decreasing in 0,y¯ and y¯,μ/δ, respectively, which implies that f has a single zero in y¯,μ/δ.Case 2:f′0≤0. Hence, f is strictly decreasing and has a single zero.
Collecting the above discussions, it can be concluded thatf does have a unique zero. Then, y=C∗, and f′C∗<0.
Next, let us prove that the first equation of system (4) has a unique positive root. Let(8)gx=μ2+βxμδ−C∗−x−γ2+δ+γ1C∗x,x∈0,μδ−C∗.
Asg0=μ2>0 and gμ/δ−C∗=−μ1−αC∗−γ2μ/δ−C∗<0, g does have a (positive) zero located in the interval 0,μ/δ−C∗. Besides, notice that(9)g′μδ−C∗=−βμδ−C∗−γ2+δ+γ1C∗<0,g″x=β″xμδ−C∗−x−2β′x<0.
We shall also proceed by distinguishing two possibilities depending on whetherg′0 is positive or negative.Case 1:g′0>0. Let(10)x¯=maxx∈0,μδ−C∗:g′x>0.
Thus,g is strictly increasing and decreasing in 0,x¯ and x¯,μ/δ−C∗, respectively, implying that g has a single zero in x¯,μ/δ−C∗.Case 2:g′0≤0. Thus, g is strictly decreasing and has a single zero. Then, g always has a unique zero x=I∗. Besides, g′I∗<0.
In conclusion, the claimed result is proved.


## 2.2. Local Stability

Theorem 2.
E∗ is locally asymptotically stable with respect to Ω.Proof.
LetS∗=μ/δ−I∗−C∗. The corresponding Jacobian matrix of system (2) at E∗ is given as follows:(11)β′I∗S∗−βI∗−γ1C∗−γ2−δ−βI∗−γ1′C∗I∗0γ1′C∗μδ−C∗−γ1C∗−α+δ,and its two eigenvalues are(12)λ1=β′I∗S∗−βI∗−γ1C∗−γ2−δ=g′I∗<0,λ2=γ1′C∗μδ−C∗−γ1C∗−α+δ=f′C∗<0.
Thus, the claimed result follows from the Lyapunov stability theorem [17].


## 2.3. Global Stability

Lemma 1.
System (2) admits no periodic orbit.Proof.
Let(13)h1I,C=μ2+βIμδ−I−C−γ1CI−γ2+δI,h2I,C=μ3+γ1Cμδ−C−α+δC,DI,C=1IC.
In the interior ofΩ, it is easily obtained that(14)∂Dh1∂I+∂Dh2∂C=−β′IC−γ1CI+1I2Cμδ−Cβ′II−βI+μδIC2γ1′CC−γ1C−μ2I2C−μ3IC2.
Let(15)k1x=β′xx−βx.
Ask10=0 and k1′x=β″xx<0 for all x>0, k1I<0.
Let(16)k2x=γ1′xx−γ1x.
Ask20=0 and k2′x=γ1″xx<0 for all x>0, k2C<0. Thus, we have ∂Dh1/∂I+∂Dh2/∂C<0.
Hence, it follows from the Bendixson–Dulac criterion [17] that system (2) admits no periodic orbit in the interior of Ω.
On the boundary ofΩ, let I˜,C˜ denote an arbitrary point. Thus, three possibilities can be considered.Case 1:0<C˜<μ/δ, I˜=0. Then, dI/dtI˜,C˜=μ2>0.Case 2:0<I˜<μ/δ, C˜=0. Then, dC/dtI˜,C˜=μ3>0.Case 3:I˜+C˜=μ/δ, C˜≠0, I˜≠0. Thus,(17)dI+CdtI˜,C˜=−μ1−γ2I˜−αC˜<0.
Hence, system (2) has no periodic orbit across I˜,C˜. In conclusion, the claimed result is proved.
By Theorems1 and 2, Lemma 1, and the generalized Poincare–Bendixson theorem [17], we can easily obtain the main result of this paper as follows.Theorem 3.
E∗ is globally asymptotically stable with respect to Ω.In Figures2 and 3, six orbits of system (1) are examined with different system parameters and different initial conditions, respectively. The illustrated results are in accordance with the main theoretical result (i.e., Theorem 3).Figure 2
Six orbits of system (1) for different system parameters.Figure 3
Six orbits of system (1) with different initial conditions.


## 3. Model Simulation

In Section2, some orbits for system (1) have been examined in Figures 2 and 3. In order to further show the main result and the impacts of nonlinear countermeasure and infection probabilities, some simulations will be made on a constructed network, which is based on the model assumptions. For brevity, a computer is called as a node.As was treated in the work [18], let sik denote the state of node i at time k, where k is a nonnegative integer. Let Sek, Iek, and Cek denote, at time k, the numbers of susceptible, infected, and countermeasured nodes, respectively. Now, let us introduce the network iterative rules.Rule 1.
Each internal node at timek would be disconnected from the network with probability δ at time k+1.Rule 2.
μ external nodes, including μ1 susceptible nodes, μ2 infected nodes, and μ3 countermeasured nodes, would be connected to the network at the next time.Rule 3.
The state of each susceptible internal nodei at time k+1 is determined by the following rule:(18)sik+1=susceptiblewith probability1−βIek−γ1Cek,infectedwith probabilityβIek,countermeasuredwith probabilityγ1Cek.Rule 4.
The state of each infected internal nodei at time k+1 is determined by the following rule:(19)sik+1=susceptiblewith probabilityγ2,infectedwith probability1−γ2−γ1Cek,countermeasuredwith probabilityγ1Cek.Rule 5.
The state of each countermeasured internal nodei at time k+1 is determined by the following rule:(20)sik+1=susceptiblewith probabilityα,countermeasuredwith probability1−α.Example 1.
Consider system (1) with μ1=11.01, μ2=7.02, μ3=5.11, γ2=0.021, α=0.012, δ=0.048, βI=0.115I0.552, and γ1C=0.015C0.498. Three initial conditions are S0,I0,C0=325,55,10, S0,I0,C0=225,200,50, and S0,I0,C0=80,135,15, respectively. Figure 4 shows that the results of theoretical prediction quite agree with the experimental ones.Figure 4
Comparisons between simulated time plot and predicted time plot with different initial conditions.Example 2.
Consider three sets of parameters for system (1): (a) μ1=3.51, μ2=1.52, μ3=1.03, γ2=0.0201, α=0.112, δ=0.012, βI=0.0423I0.252, and γ1C=0.029C0.153; (b) μ1=11.01, μ2=7.02, μ3=5.11, γ2=0.021, α=0.012, δ=0.048, βI=0.115I0.552, and γ1C=0.015C0.498; (c) μ1=9.2, μ2=4.5, μ3=2.9, γ2=0.0263, α=0.0153, δ=0.0171, βI=0.0981I0.472, and γ1C=0.0456C0.398. The common initial condition is S0,I0,C0=325,55,10. Figure 5 reveals that the results of experiment and theoretical predictions are almost identical.Figure 5
Comparisons between simulated time plot and predicted time plot for different system parameters.Example 3.
Consider two systems induced by system (1) with μ1=11.01, μ2=7.02, μ3=5.11, γ2=0.021, α=0.012, and δ=0.048, where one system is with βI=0.115I and γ1C=0.015C and the other with βI=0.115I0.552 and γ1C=0.015C0.498. The common initial condition is S0,I0,C0=325,55,10. Figure 6 demonstrates that the new model with nonlinear infection and countermeasured probabilities is more reasonable than the original model [9] because malware would be always there and would not go extinct.Figure 6
A comparison between nonlinear and linear infection and countermeasure probabilities.


## 4. Summary and Outlook

In order to investigate the impacts of general countermeasure and infection on the diffusion of malware, a new propagation model, which incorporates nonlinear generic infection and countermeasure probabilities, has been presented and analyzed. The global stability of the unique (viral) equilibrium has been proved. Additionally, some simulations have been examined on a constructed network, whose iterative rules are consistent with the model assumptions. The simulation results show the main result and the effects of general countermeasure and infection.Additionally, the follow-up work arrangement is as follows. Firstly, time delays (e.g., [19, 20]), pulses (e.g., [21, 22]), random fluctuations (e.g., [23, 24]), and optimal control strategies (e.g., [25–27]) can be considered in the new model. Secondly, the new model may be extended on wireless sensor networks (e.g., [28–30]) and social networks (e.g., [31]). Finally, the new proposed model can be formulated for cloud computing security (e.g., [32]).



---

*Source: 8859883-2020-09-22.xml*