# Modeling and Analysis of Bifurcation in a Delayed Worm Propagation Model

Authors: Yu Yao; Nan Zhang; Wenlong Xiang; Ge Yu; Fuxiang Gao
Journal: Journal of Applied Mathematics
 (2013)

---

## Abstract

A delayed worm propagation model with birth and death rates is formulated. The stability of the positive equilibrium is studied. Through theoretical analysis, a critical valueτ0 of Hopf bifurcation is derived. The worm propagation system is locally asymptotically stable when time delay is less than τ0. However, Hopf bifurcation appears when time delay τ passes the threshold τ0, which means that the worm propagation system is unstable and out of control. Consequently, time delay should be adjusted to be less than τ0 to ensure the stability of the system stable and better prediction of the scale and speed of Internet worm spreading. Finally, numerical and simulation experiments are presented to simulate the system, which fully support our analysis.


---

## Body

## 1. Introduction

In recent years, Internet is undoubtedly one of the fastest increasing scientific technologies, which brings about convenience in people’s daily work and changes people’s life in variety of aspects. With rapid development of network applications and the increase of network complexity, security problems emerge progressively. Among them, the problem of Internet worms has become the focus with its wide infection range, fast spread speed, and tremendous destruction. Enlightened by the researches in epidemiology, plenty of models have been constructed to predict the spread of worms and some containment strategies have been taken into consideration. In addition, birth and death rates are widely applied in epidemiology because individuals in the ecological system may die during the spread of diseases. Meanwhile baby individuals are born everyday and join the ecological system [1–3]. In the computer science field, computers are like individuals in an ecological system. As a result of being infected by Internet worms or quarantined by intrusion detection systems (IDS), hosts will get unstable and unreliable which will result in system reinstallation by their owners. Besides, when many new computers are brought, most of them are preinstalled with operating systems without newest safety patches. Furthermore, old computers are discarded and recycled at the same time. These phenomena are quite similar to the death and birth in epidemiology. Thus, in order to imitate the real world, birth and death rates should be introduced to worm propagation model.Quarantine strategies have been exploited and applied in the control of disease. The implementation of quarantine strategy in computer field relies on the IDS [4]. The IDS include two major categories: misuse intrusion detection and anomaly intrusion detection system. The anomaly detection system is commonly used to detect malicious code such as computer virus and worms for its relatively better performance [5, 6]. Once a deviation from the normal behavior is detected, such behavior is recognized as an attack and appropriate response actions, such as quarantine or vaccination, are triggered.Mechanism of time window was brought in IDS in order to balance the false negative rate and false positive rate [7]. The introduction of time window is used to decide whether an alarm is a true or false positive based on the number of abnormal behaviors detected in a time window. It implies that the size of time window affects both the number of true positive and false positive rates. However, the import of the time window leads to time delay. Therefore, in order to accord with actual condition, time delay should be considered. In this paper, time delay is introduced in the worm propagation model along with birth and death rates, and its stability is analyzed. Moreover, it is indicated that overlarge time delay may result in the bifurcation which would do little help to eliminate the worms. Consequently, in order to guarantee the simplification and stability of the worm propagation system, time delay should be decreased appropriately by a decrease in the window size.The rest of the paper is organized as follows. In the next section, related work on time delay and birth is death rates and introduced. Section3 gives a brief introduction of the simple worm propagation model and quarantine strategy. Afterwards we present the delayed worm propagation model with birth and death rates and analyze the stability of the positive equilibrium. In Section 4, numerical and simulation experiments are presented to support our theoretical analysis. Finally, Section 5 draws the conclusions.


## 2. Related Work

Due to the high similarity between the spread of infectious biological viruses and computer worms, some scholars have used epidemic model to simulate and analyze the worm propagation [8–14]. For instance, Staniford first constructs the propagation of Internet worms by imitating epidemic propagation models, called simple epidemic model (SEM) model [9]. susceptible-infected-removed (SIR) model plays a significant role in the research of worm propagation model [10]. On the basis of SIR model, Zou et al. propose a worm propagation model with two factors on Code Red [11]. Ren et al. give a novel computer virus propagation model and study its dynamic behaviors [12]. Mishra and Pandey formulate an e-epidemic SIRS model for the fuzzy transmission of worms in computer network [13]. L.-X. Yang and X. Yang investigate the propagation behavior of virus programs and propose that infected computers are connected to the Internet with positive probability [14]. Mathematical analysis and simulation experiment of these models are conducted, which are helpful to predict the speed and scale of Internet worm propagation. In addition, to our knowledge, the use of quarantine strategies has produced a great effect on controlling disease. Enlightened by this, quarantine strategies are also widely used in worm containment [15–18]. Yao et al. construct a worm propagation model with time delay under quarantine, and its stability of the positive equilibrium is analyzed [15, 16]. Yao also proposes a pulse quarantine strategy to eliminate worms and obtains its stability condition [17]. Wang et al. propose a novel epidemic model which combines both vaccinations and dynamic quarantine methods, referred to as SEIQV model [18].Furthermore, some scholars have done some researches on time delay [19–21]. Dong et al. propose a computer virus model with time delay based on SEIR model [19]. By proposing an SIRS model with stage structure and time delays, Zhang et al. perform some bifurcation analysis of this model [20]. Zhang et al. also consider a delayed predator-prey epidemiological system with disease spreading in predator population [21]. In addition, the direction of Hopf bifurcations and the stability of bifurcated periodic solutions are studied, which are our extension direction in the future research.


## 3. Worm Propagation Model

### 3.1. The Simple Worm Propagation Model

Realizing the similarities between Internet worms and biological viruses in propagation characteristics, classical epidemic models have been applied to the research of worm propagation models. Initially, we introduce a simple propagation model, the Kermack Mckendrick model (KM model) [22], as the basis of our research.The KM model assumes that all Internet hosts are in one of three states: susceptible state (S), infectious state (I), and removed state (R). And hosts can only maintain one state at any given moment. Infectious hosts are converted from susceptible hosts by a worm infection and can shift to removed state through killing worms by antivirus softwares and installing safety patches. Once patches are installed, the hosts can no longer be infected by worms. The state transition diagram of the KM model is given in Figure 1.Figure 1
State transition diagram of the KM model.S
(
t
) denotes the number of susceptible hosts at time t, I(t) denotes the number of infectious hosts at time t, and R(t) denotes the number of removed hosts at time t. The total number of hosts in the network is N and remains constant. β is infection rate at which susceptible hosts are infected by infectious hosts, and γ is recovery rate at which infectious hosts get recovered. The KM model can be formulated by a set of differential equations from the state transition diagram as follows:
(1)dS(t)dt=-βS(t)I(t),dI(t)dt=βS(t)I(t)-γI(t),dR(t)dt=γI(t).Although KM model adopts recovery feature and does generate some braking containment effect on the worm propagation, it only describes the initial stage of worm propagation and does not control the outbreaks of worms. More suppression strategies should be taken to further control the worm propagation.


### 3.2. The Worm Propagation Model with Quarantine Strategy

Quarantine strategy, which relies on the intrusion detection system, is an effective way to diminish the speed of worm propagation. On the basis of the KM model, quarantine strategy should be taken into consideration. Firstly, infectious hosts are detected by the systems and then get quarantined and patched. Moreover, considering that hosts could get patched whatever state the hosts stay, we add a new path from hosts in susceptible state to vaccinated state to accord with actual situation. The state transition diagram of the worm propagation model with quarantine strategy is given in Figure2.Figure 2
State transition diagram of the quarantine model.In this model, vaccinated state equals to removed state in KM model, andV(t) denotes the number of vaccinated hosts at time t. Susceptible hosts can be infected by worms with an infection rate β due to their vulnerabilities. After infection, the hosts become infectious hosts, which means the hosts can infect other susceptible hosts. The hosts can be directly patched into the vaccinated state before getting infected at rate ω. By applying misuse intrusion detection system for its relatively high accuracy, we add a new state called quarantine state, but only infectious hosts will be quarantined. Q(t) denotes the number of quarantine hosts at time t. Infectious hosts will be quarantined at rate α which depends on the performance of intrusion detection systems and network devices. When infectious hosts are quarantined, the hosts will get rid of worms and get patched at rate φ. Meanwhile, infectious hosts can be manually patched into vaccinated state at recovery rate γ. It can be perceived that if a host is patched, it has gained immunity permanently.The differetial equations of this model are given as(2)dS(t)dt=-βI(t)S(t)-ωS(t),dI(t)dt=βI(t)S(t)-γI(t)-αI(t),dQ(t)dt=αI(t)-φQ(t),dV(t)dt=ωS(t)+γI(t)+φQ(t).The total number of this model is set toN=1, which means the sum of hosts in all four states is equal to one; that is S(t)+I(t)+Q(t)+V(t)=1. Then, the infection-free equilibrium of this model and its stability condition will be studied.The first, second, and third equations in system (2) have no dependence on the last one; therefore, the last one can be omitted. System (2) can be rewritten as a three-demensional system
(3)dS(t)dt=-βI(t)S(t)-ωS(t),dI(t)dt=βI(t)S(t)-γI(t)-αI(t),dQ(t)dt=αI(t)-φQ(t).Due to the infection-free state which the system holds in the end, the number of infectious hosts is equal to 0. Obviously, the number of susceptible hosts and number of quarantined hosts are both equal to 0, because all of the hosts in the network will get patched at last, no matter which way the hosts take. Thus the infection-free equilibrium pointE*(0,0,0) of system (3) can be obtained. Since V(t)=N-S(t)-I(t)-Q(t), the infection-free equilibrium of the model with quarantine strategy is E*(0,0,0,N).Although all infectious hosts in quarantine model convert to vaccinated hosts, in other words, worms have been eliminated, it is hardly appropriate for real world situation. Actually, not all the hosts will convert to vaccinated hosts, and no-patch hosts are still existing in the network and suffering high risk of worm attack. In addition, considering that hosts are consumer electronic products, the recycling of old hosts happens frequently every day. In order to imitate the facts in the real world, birth and death rates must be taken into consideration.Additionally, due to the time windows of intrusion detection system, which decreases the number of false positives, time delay should be considered to accord with actual situation. Therefore, in the next section, the new model is proposed.


### 3.3. The Delayed Worm Propagation Model with Birth and Death Rates

By adding time delay, along with birth and death rates, the delayed worm propagation model with birth and death rates is presented. Figure3 shows the state transition diagram of the delayed worm propagation model with birth and death rates.Figure 3
State transition diagram of the delayed model.In this model, the total number of hosts denoted byN is divided into five parts. Compared with quarantine model, a new state, delayed state, is added. The hosts do not have the ability to infect other susceptible hosts but are not quarantined yet. Therefore, a new state is needed to represent these hosts. D(t) denotes the hosts in delayed state at time t. Furthermore, the hosts in susceptible, infected, quarantined, and removed states have the same rate μ to leave the network. If the hosts are quarantined by IDS, some of applications may not access to network because their ports are occupied by worms. At this moment, the users would like to reinstall OS and leave the network system. Thus, the birth and death rates are correlative to the number of infectious hosts and quarantined hosts in the network system. And the rate μ is
(4)μ=μ0(I(t)+Q(t)N).The hosts in delayed state are not likely to leave the network, accounting for the activeness of these hosts. The newborn hosts enter the system with the same rateμ, of which a portion 1-p is recovered by installing patches instantly at birth. This differs from the transition denoted by ω, because the hosts are vaccinated at the time of entering the network by installing patched operating system. The transition ω represents the rate by which those susceptible in the network get vaccinated by installing patches later. The delayed differential equations are written as
(5)dS(t)dt=pμ(N(t)-D(t))-βI(t)S(t)-ωS(t)-μS(t),dI(t)dt=βI(t)S(t)-γI(t)-αI(t)-μI(t),dD(t)dt=αI(t)-αI(t-τ),dQ(t)dt=αI(t-τ)-φQ(t)-μQ(t),dV(t)dt=(1-p)μ(N(t)-D(t))+ωS(t)+γI(t)+φQ(t)-μV(t).Other notations are identical to those in the previous model. To understand them more clearly, the notations in this model are shown in Table1.Table 1
Notations in this paper.
Notation
Definition
N
Total number of hosts in the network
S
(
t
)
Number of susceptible hosts at timet
I
(
t
)
Number of infectious hosts at timet
D
(
t
)
Number of delayed hosts at timet
Q
(
t
)
Number of quarantined hosts at timet
V
(
t
)
Number of vaccinated hosts at timet
β
Infection rate
ω
Vaccine rate of susceptible hosts
α
Quarantine rate
φ
Removal rate of quaratined hosts
γ
Removal rate of infectious hosts
μ
Birth and death rates
p
Birth ratio of susceptible hosts
τ
Length of the time window in IDSAs mentioned in Table1, the population size is set to N, which is set to unity:
(6)S(t)+I(t)+D(t)+Q(t)+V(t)=N.


### 3.4. Stability of the Positive Equilibrium and Bifurcation Analysis

Theorem 1.
The system has a unique positive equilibriumE*(S*,I*,D*,Q*,V*), when the condition (H1)
(pμβN/(μ+α+γ)(μ+ω))>1is satisfied, where
(7)S*=μ+α+γβ,D*=ατI*,Q*=αI*φ+μ,V*=γI*+ωS*+φQ*+μ(1-p)(N-D*)μ.Proof.
From system (5), according to [23], if all the derivatives on the left of equal sign of the system are set to 0, which implies that the system becomes stationary, we can get
(8)S=μ+α+γβ,D=ατI*,Q=αI*φ+μ,V=γI*+ωS*+φQ*+μ(1-p)(N-D*)μ.
Substituting the value of each variable in (8) for each of (6), then we can get:
(9)μ+α+γβ+I+ατI+αIφ+μ+V=N.
After solving this equation with respect to I*, a solution of I* is obtained
(10)I=pNμβ-(μ+ω)(μ+α+γ)β(α+μpατ+μ+γ).
Thus, if (H1) is satisfied, (10) has one unique positive root I*, and there is one unique positive equilibrium E*(S*,I*,D*,Q*,V*) of system (5). The proof is completed.According to (6), V=N-S-I-D-Q, and thus system (5) can be simplified to
(11)dS(t)dt=pμ(N(t)-D(t))-βI(t)S(t)-wS(t)-μS(t),dI(t)dt=βI(t)S(t)-γI(t)-αI(t)-μI(t),dD(t)dt=αI(t)-αI(t-τ),dQ(t)dt=αI(t-τ)-φQ(t)-μQ(t).
The Jacobi matrix of (11) about E*(S*,I*,D*,Q*,V*) is given by
(12)J(E*)=(a1a2a3a4βI*a50a60α-αe-λτ000αe-λτ-a70a8),
where
(13)a1=-μ0(I*+Q*)N-ω-βI*,a2=pμ0(N-D*)N-μ0S*N-βS*,a3=-pμ0(I*+Q*)N,a4=pμ0(N-D*)-μ0S*N,a5=βS*-α-γ-2μ0I*+μ0Q*N,a6=-μ0I*N,a7=μ0Q*N,a8=-φ-μ0I*+2μ0Q*N.
The characteristic equation of that matrix can be obtained by
(14)P(λ)+Q(λ)e-λτ=0,
where
(15)P(λ)=λ4-(a1+a5+a8)λ311111+(a1a5+a1a8+a5a8+a6a7-a2βI*)λ211111+(-a1a5a8-a1a6a7+a2a8βI*1111111+a4a7βI*-a3αβI*)λ11111+a3a8αβI*,Q(λ)=-a6αλ2+(a1a6α-a4αβI*+a3αβI*)λ111111-a3a8αβI*.
Let
(16)b3=-(a1+a5+a8),b2=a1a5+a1a8+a5a8+a6a7-a2βI*b1=-a1a5a8-a1a6a7+a2a8βI*1111+a4a7βI*-a3αβI*,b0=a3a8αβI*,c2=-a6αc1=a1a6α-a4αβI*+a3αβI*,c0=-a3a8αβI*.
Then
(17)P(λ)=λ4+b3λ3+b2λ2+b1λ+b0,Q(λ)=c2λ2+c1λ+c0.Theorem 2.
The positive equilibriumE* is locally asymptotically stable without time delay, if the following holds:(H2)
b3>0,d1>0,b1+c1>0,where
(18)d1=b3(b2+c2)-(b1+c1)
is satisfied.Proof.
Ifτ=0, then (14) reduces to
(19)λ4+b3λ3+(b2+c2)λ2+(b1+c1)λ+(b0+c0)=0.
Because b0+c0=0, equation (19) can be further reduced to
(20)λ3+b3λ2+(b2+c2)λ+(b1+c1)=0.
According to Routh-Hurwitz criterion, all the roots of (20) have negative real parts. Therefore, it can be deduced that the positive equilibrium E* is locally asymptotically stable without time delay. The proof is completed.Obviously,λ=iω (ω>0) is a root of (14). After separating the real and imaginary parts, it can be written as
(21)ω4-b2ω2+b0+(c0-c2ω2)cos(ωτ)+c1ωsin(ωτ)=0,-b3ω3+b1ω+(c2ω2-c0)sin(ωτ)+c1ωcos(ωτ)=0.From the two equations of (21), the following equation can be obtained:
(22)c12ω2+(c22ω2-c0)21=(ω4-b2ω2+b0)2+(b1ω-b3ω3)2,
which implies that
(23)ω8+m3ω6+m2ω4+m1ω2+m0=0,
where
(24)m3=b32-2b2,m2=b22+2b0-2b1b3-c22,m1=b12-c12-2b2b0+2c0c2,m0=b02-c02.
Then (23) reduces to
(25)ω6+m3ω4+m2ω2+m1=0.
Let z=ω2. Then (25) can be written as
(26)h(z)=z3+m3z2+m2z+m1,Δ is defined as Δ=m32-3m2. And we can get a solution z*=(Δ-m3)/3 of h(z).Lemma 3.
Suppose that(H2)   b3>0,d1>0,   b1+c1>0 is satisfied.(i)
If one of followings holds: (a)Δ>0, z*<0; (b) Δ>0, z*>0, and h(z*)>0, then all roots of (14) have negative real parts when τ∈[0,τ0), and τ0 is a certain positive constant.(ii)
If the conditions (a) and (b) are not satisfied, then all roots of (14) have negative real parts for all τ≥0.Proof.
Whenτ=0, equation (14) can be reduced to
(27)λ3+b3λ2+(b2+c2)λ+(b1+c1)=0.
By the Routh-Hurwitz criterion, all roots of (20) have negative real parts if and only if b3>0, d1>0, and b1+c1>0.
Considering (26), it is easy to see from the characters of cubic algebra equation that h(z) is a strictly monotonically increasing function if Δ≤0. If Δ>0 and z*<0 or Δ>0, z*>0 but h(z*)>0, then h(z) has no positive root. Thus, under these conditions, equation (14) has no purely imaginary roots for any τ>0. In addition, this also implies that the positive equilibrium E*(S*,I*,D*,Q*,V*) of system (5) is absolutely stable. Therefore, the following theorem on the stability of positive equilibrium E*(S*,I*,D*,Q*,V*) can be easily obtained.Theorem 4.
Assume that(H1) and (H2) are satisfied and Δ>0 and z*<0 or Δ>0, z*>0, and h(z*)>0. Then the positive equilibrium E*(S*,I*,D*,Q*,V*) of system (5) is absolutely stable; that is to say E*(S*,I*,D*,Q*,V*) is asymptotically stable for any time delay τ≥0.
It is assumed that the coefficients inh(z) satisfy the condition as follows:(H3)
Δ>0,z*>0,h(z*)<0.
Then, according to lemma in [15], it is known that (26) has at least a positive root ω0; namely, the characteristic equation (14) has a pair of purely imaginary roots ±iω0.
In view of the fact that (14) has a pair of purely imaginary roots ±iω0, the corresponding τk>0 is given by eliminating sin(ωτ) in (21):
(28)τk=1ω0arccos[(b2ω02-ω04-b0)(c0-c2ω02)(c0-c2ω02)2+ω(b3ω2-b1-c1)]+2kπω0(k=0,1,2,…).
Letλ(τ)=v(τ)+iω(τ) be the root of (14) so that v(τk)=0 and ω(τk)=ω0 are satisfied when τ=τk.Lemma 5.
Suppose thath′(z0)≠0. If τ=τ0, then ±iω0 is a pair of simple purely imaginary roots of (14). In addition, if the conditions in Lemma 3 are satisfied, then
(29)d(Reλ)dτ|τ=τk>0.
This signifies that there exists at least one eigenvalue with positive real part forτ>τk. Differentiating both sides of (14) with respect to τ, it can be written as
(30)(dλdτ)-1=((4λ3+3b3λ2+2b2λ+b1)+c1e-λτ-(c1λ+c0)τe-λτ)×((c1λ+c0)λe-λτ)-1.
Therefore
(31)sgn{dReλdτ}τ=τk=sgn{Re(dλdτ)-1}λ=iω0=sgnω02Λ(4ω06+3m3ω04111111111+2m2ω02+m1)=sgnω02Λ{h′(ω02)}=sgn{h′(ω02)},
where Λ=c12ω04+c0ω02. Then it can be derived that
(32)d(Reλ)dτ|τ=τk>0.It follows the hypothesis(H3) that h′(ω02)≠0. Therefore, transversality condition holds and the conditions for Hopf bifurcation are satisfied when τ=τk, according to Hopf bifurcation theorem [24] for functional differential equations. Then the following results can be obtained.Theorem 6.
Suppose that the conditions(H1) and (H2) are satisfied.(i)
For system (5), the equilibrium E*(S*,I*,D*,Q*,V*) is locally asymptotically stable when τ∈[0,τ0) but unstable when τ>τ0.(ii)
When condition(H3) is satisfied, system (5) will undergo a Hopf bifurcation at the positive equilibrium E*(S*,I*,D*,Q*,V*) when τ=τk (k=0,1,2,…), where τk is defined by (28).Theorem2 implies to us that when birth and death rates and the mechanism of time window in intrusion detection system are considered, the length of time window is crucial for the stability of the propagation process. When time delay is less than the threshold τ0, the system will stabilize at its infection equilibrium point, which is beneficial to further implement containment strategies to eliminate worms. However, when time delay is greater than the threshold, the system will be unstable and undergo a bifurcation. Although the propagation of worm presents a periodical phenomenon, in real world, complicated environment may make the propagation pass the critical state and reach to an unpredictable chaos.


## 3.1. The Simple Worm Propagation Model

Realizing the similarities between Internet worms and biological viruses in propagation characteristics, classical epidemic models have been applied to the research of worm propagation models. Initially, we introduce a simple propagation model, the Kermack Mckendrick model (KM model) [22], as the basis of our research.The KM model assumes that all Internet hosts are in one of three states: susceptible state (S), infectious state (I), and removed state (R). And hosts can only maintain one state at any given moment. Infectious hosts are converted from susceptible hosts by a worm infection and can shift to removed state through killing worms by antivirus softwares and installing safety patches. Once patches are installed, the hosts can no longer be infected by worms. The state transition diagram of the KM model is given in Figure 1.Figure 1
State transition diagram of the KM model.S
(
t
) denotes the number of susceptible hosts at time t, I(t) denotes the number of infectious hosts at time t, and R(t) denotes the number of removed hosts at time t. The total number of hosts in the network is N and remains constant. β is infection rate at which susceptible hosts are infected by infectious hosts, and γ is recovery rate at which infectious hosts get recovered. The KM model can be formulated by a set of differential equations from the state transition diagram as follows:
(1)dS(t)dt=-βS(t)I(t),dI(t)dt=βS(t)I(t)-γI(t),dR(t)dt=γI(t).Although KM model adopts recovery feature and does generate some braking containment effect on the worm propagation, it only describes the initial stage of worm propagation and does not control the outbreaks of worms. More suppression strategies should be taken to further control the worm propagation.


## 3.2. The Worm Propagation Model with Quarantine Strategy

Quarantine strategy, which relies on the intrusion detection system, is an effective way to diminish the speed of worm propagation. On the basis of the KM model, quarantine strategy should be taken into consideration. Firstly, infectious hosts are detected by the systems and then get quarantined and patched. Moreover, considering that hosts could get patched whatever state the hosts stay, we add a new path from hosts in susceptible state to vaccinated state to accord with actual situation. The state transition diagram of the worm propagation model with quarantine strategy is given in Figure2.Figure 2
State transition diagram of the quarantine model.In this model, vaccinated state equals to removed state in KM model, andV(t) denotes the number of vaccinated hosts at time t. Susceptible hosts can be infected by worms with an infection rate β due to their vulnerabilities. After infection, the hosts become infectious hosts, which means the hosts can infect other susceptible hosts. The hosts can be directly patched into the vaccinated state before getting infected at rate ω. By applying misuse intrusion detection system for its relatively high accuracy, we add a new state called quarantine state, but only infectious hosts will be quarantined. Q(t) denotes the number of quarantine hosts at time t. Infectious hosts will be quarantined at rate α which depends on the performance of intrusion detection systems and network devices. When infectious hosts are quarantined, the hosts will get rid of worms and get patched at rate φ. Meanwhile, infectious hosts can be manually patched into vaccinated state at recovery rate γ. It can be perceived that if a host is patched, it has gained immunity permanently.The differetial equations of this model are given as(2)dS(t)dt=-βI(t)S(t)-ωS(t),dI(t)dt=βI(t)S(t)-γI(t)-αI(t),dQ(t)dt=αI(t)-φQ(t),dV(t)dt=ωS(t)+γI(t)+φQ(t).The total number of this model is set toN=1, which means the sum of hosts in all four states is equal to one; that is S(t)+I(t)+Q(t)+V(t)=1. Then, the infection-free equilibrium of this model and its stability condition will be studied.The first, second, and third equations in system (2) have no dependence on the last one; therefore, the last one can be omitted. System (2) can be rewritten as a three-demensional system
(3)dS(t)dt=-βI(t)S(t)-ωS(t),dI(t)dt=βI(t)S(t)-γI(t)-αI(t),dQ(t)dt=αI(t)-φQ(t).Due to the infection-free state which the system holds in the end, the number of infectious hosts is equal to 0. Obviously, the number of susceptible hosts and number of quarantined hosts are both equal to 0, because all of the hosts in the network will get patched at last, no matter which way the hosts take. Thus the infection-free equilibrium pointE*(0,0,0) of system (3) can be obtained. Since V(t)=N-S(t)-I(t)-Q(t), the infection-free equilibrium of the model with quarantine strategy is E*(0,0,0,N).Although all infectious hosts in quarantine model convert to vaccinated hosts, in other words, worms have been eliminated, it is hardly appropriate for real world situation. Actually, not all the hosts will convert to vaccinated hosts, and no-patch hosts are still existing in the network and suffering high risk of worm attack. In addition, considering that hosts are consumer electronic products, the recycling of old hosts happens frequently every day. In order to imitate the facts in the real world, birth and death rates must be taken into consideration.Additionally, due to the time windows of intrusion detection system, which decreases the number of false positives, time delay should be considered to accord with actual situation. Therefore, in the next section, the new model is proposed.


## 3.3. The Delayed Worm Propagation Model with Birth and Death Rates

By adding time delay, along with birth and death rates, the delayed worm propagation model with birth and death rates is presented. Figure3 shows the state transition diagram of the delayed worm propagation model with birth and death rates.Figure 3
State transition diagram of the delayed model.In this model, the total number of hosts denoted byN is divided into five parts. Compared with quarantine model, a new state, delayed state, is added. The hosts do not have the ability to infect other susceptible hosts but are not quarantined yet. Therefore, a new state is needed to represent these hosts. D(t) denotes the hosts in delayed state at time t. Furthermore, the hosts in susceptible, infected, quarantined, and removed states have the same rate μ to leave the network. If the hosts are quarantined by IDS, some of applications may not access to network because their ports are occupied by worms. At this moment, the users would like to reinstall OS and leave the network system. Thus, the birth and death rates are correlative to the number of infectious hosts and quarantined hosts in the network system. And the rate μ is
(4)μ=μ0(I(t)+Q(t)N).The hosts in delayed state are not likely to leave the network, accounting for the activeness of these hosts. The newborn hosts enter the system with the same rateμ, of which a portion 1-p is recovered by installing patches instantly at birth. This differs from the transition denoted by ω, because the hosts are vaccinated at the time of entering the network by installing patched operating system. The transition ω represents the rate by which those susceptible in the network get vaccinated by installing patches later. The delayed differential equations are written as
(5)dS(t)dt=pμ(N(t)-D(t))-βI(t)S(t)-ωS(t)-μS(t),dI(t)dt=βI(t)S(t)-γI(t)-αI(t)-μI(t),dD(t)dt=αI(t)-αI(t-τ),dQ(t)dt=αI(t-τ)-φQ(t)-μQ(t),dV(t)dt=(1-p)μ(N(t)-D(t))+ωS(t)+γI(t)+φQ(t)-μV(t).Other notations are identical to those in the previous model. To understand them more clearly, the notations in this model are shown in Table1.Table 1
Notations in this paper.
Notation
Definition
N
Total number of hosts in the network
S
(
t
)
Number of susceptible hosts at timet
I
(
t
)
Number of infectious hosts at timet
D
(
t
)
Number of delayed hosts at timet
Q
(
t
)
Number of quarantined hosts at timet
V
(
t
)
Number of vaccinated hosts at timet
β
Infection rate
ω
Vaccine rate of susceptible hosts
α
Quarantine rate
φ
Removal rate of quaratined hosts
γ
Removal rate of infectious hosts
μ
Birth and death rates
p
Birth ratio of susceptible hosts
τ
Length of the time window in IDSAs mentioned in Table1, the population size is set to N, which is set to unity:
(6)S(t)+I(t)+D(t)+Q(t)+V(t)=N.


## 3.4. Stability of the Positive Equilibrium and Bifurcation Analysis

Theorem 1.
The system has a unique positive equilibriumE*(S*,I*,D*,Q*,V*), when the condition (H1)
(pμβN/(μ+α+γ)(μ+ω))>1is satisfied, where
(7)S*=μ+α+γβ,D*=ατI*,Q*=αI*φ+μ,V*=γI*+ωS*+φQ*+μ(1-p)(N-D*)μ.Proof.
From system (5), according to [23], if all the derivatives on the left of equal sign of the system are set to 0, which implies that the system becomes stationary, we can get
(8)S=μ+α+γβ,D=ατI*,Q=αI*φ+μ,V=γI*+ωS*+φQ*+μ(1-p)(N-D*)μ.
Substituting the value of each variable in (8) for each of (6), then we can get:
(9)μ+α+γβ+I+ατI+αIφ+μ+V=N.
After solving this equation with respect to I*, a solution of I* is obtained
(10)I=pNμβ-(μ+ω)(μ+α+γ)β(α+μpατ+μ+γ).
Thus, if (H1) is satisfied, (10) has one unique positive root I*, and there is one unique positive equilibrium E*(S*,I*,D*,Q*,V*) of system (5). The proof is completed.According to (6), V=N-S-I-D-Q, and thus system (5) can be simplified to
(11)dS(t)dt=pμ(N(t)-D(t))-βI(t)S(t)-wS(t)-μS(t),dI(t)dt=βI(t)S(t)-γI(t)-αI(t)-μI(t),dD(t)dt=αI(t)-αI(t-τ),dQ(t)dt=αI(t-τ)-φQ(t)-μQ(t).
The Jacobi matrix of (11) about E*(S*,I*,D*,Q*,V*) is given by
(12)J(E*)=(a1a2a3a4βI*a50a60α-αe-λτ000αe-λτ-a70a8),
where
(13)a1=-μ0(I*+Q*)N-ω-βI*,a2=pμ0(N-D*)N-μ0S*N-βS*,a3=-pμ0(I*+Q*)N,a4=pμ0(N-D*)-μ0S*N,a5=βS*-α-γ-2μ0I*+μ0Q*N,a6=-μ0I*N,a7=μ0Q*N,a8=-φ-μ0I*+2μ0Q*N.
The characteristic equation of that matrix can be obtained by
(14)P(λ)+Q(λ)e-λτ=0,
where
(15)P(λ)=λ4-(a1+a5+a8)λ311111+(a1a5+a1a8+a5a8+a6a7-a2βI*)λ211111+(-a1a5a8-a1a6a7+a2a8βI*1111111+a4a7βI*-a3αβI*)λ11111+a3a8αβI*,Q(λ)=-a6αλ2+(a1a6α-a4αβI*+a3αβI*)λ111111-a3a8αβI*.
Let
(16)b3=-(a1+a5+a8),b2=a1a5+a1a8+a5a8+a6a7-a2βI*b1=-a1a5a8-a1a6a7+a2a8βI*1111+a4a7βI*-a3αβI*,b0=a3a8αβI*,c2=-a6αc1=a1a6α-a4αβI*+a3αβI*,c0=-a3a8αβI*.
Then
(17)P(λ)=λ4+b3λ3+b2λ2+b1λ+b0,Q(λ)=c2λ2+c1λ+c0.Theorem 2.
The positive equilibriumE* is locally asymptotically stable without time delay, if the following holds:(H2)
b3>0,d1>0,b1+c1>0,where
(18)d1=b3(b2+c2)-(b1+c1)
is satisfied.Proof.
Ifτ=0, then (14) reduces to
(19)λ4+b3λ3+(b2+c2)λ2+(b1+c1)λ+(b0+c0)=0.
Because b0+c0=0, equation (19) can be further reduced to
(20)λ3+b3λ2+(b2+c2)λ+(b1+c1)=0.
According to Routh-Hurwitz criterion, all the roots of (20) have negative real parts. Therefore, it can be deduced that the positive equilibrium E* is locally asymptotically stable without time delay. The proof is completed.Obviously,λ=iω (ω>0) is a root of (14). After separating the real and imaginary parts, it can be written as
(21)ω4-b2ω2+b0+(c0-c2ω2)cos(ωτ)+c1ωsin(ωτ)=0,-b3ω3+b1ω+(c2ω2-c0)sin(ωτ)+c1ωcos(ωτ)=0.From the two equations of (21), the following equation can be obtained:
(22)c12ω2+(c22ω2-c0)21=(ω4-b2ω2+b0)2+(b1ω-b3ω3)2,
which implies that
(23)ω8+m3ω6+m2ω4+m1ω2+m0=0,
where
(24)m3=b32-2b2,m2=b22+2b0-2b1b3-c22,m1=b12-c12-2b2b0+2c0c2,m0=b02-c02.
Then (23) reduces to
(25)ω6+m3ω4+m2ω2+m1=0.
Let z=ω2. Then (25) can be written as
(26)h(z)=z3+m3z2+m2z+m1,Δ is defined as Δ=m32-3m2. And we can get a solution z*=(Δ-m3)/3 of h(z).Lemma 3.
Suppose that(H2)   b3>0,d1>0,   b1+c1>0 is satisfied.(i)
If one of followings holds: (a)Δ>0, z*<0; (b) Δ>0, z*>0, and h(z*)>0, then all roots of (14) have negative real parts when τ∈[0,τ0), and τ0 is a certain positive constant.(ii)
If the conditions (a) and (b) are not satisfied, then all roots of (14) have negative real parts for all τ≥0.Proof.
Whenτ=0, equation (14) can be reduced to
(27)λ3+b3λ2+(b2+c2)λ+(b1+c1)=0.
By the Routh-Hurwitz criterion, all roots of (20) have negative real parts if and only if b3>0, d1>0, and b1+c1>0.
Considering (26), it is easy to see from the characters of cubic algebra equation that h(z) is a strictly monotonically increasing function if Δ≤0. If Δ>0 and z*<0 or Δ>0, z*>0 but h(z*)>0, then h(z) has no positive root. Thus, under these conditions, equation (14) has no purely imaginary roots for any τ>0. In addition, this also implies that the positive equilibrium E*(S*,I*,D*,Q*,V*) of system (5) is absolutely stable. Therefore, the following theorem on the stability of positive equilibrium E*(S*,I*,D*,Q*,V*) can be easily obtained.Theorem 4.
Assume that(H1) and (H2) are satisfied and Δ>0 and z*<0 or Δ>0, z*>0, and h(z*)>0. Then the positive equilibrium E*(S*,I*,D*,Q*,V*) of system (5) is absolutely stable; that is to say E*(S*,I*,D*,Q*,V*) is asymptotically stable for any time delay τ≥0.
It is assumed that the coefficients inh(z) satisfy the condition as follows:(H3)
Δ>0,z*>0,h(z*)<0.
Then, according to lemma in [15], it is known that (26) has at least a positive root ω0; namely, the characteristic equation (14) has a pair of purely imaginary roots ±iω0.
In view of the fact that (14) has a pair of purely imaginary roots ±iω0, the corresponding τk>0 is given by eliminating sin(ωτ) in (21):
(28)τk=1ω0arccos[(b2ω02-ω04-b0)(c0-c2ω02)(c0-c2ω02)2+ω(b3ω2-b1-c1)]+2kπω0(k=0,1,2,…).
Letλ(τ)=v(τ)+iω(τ) be the root of (14) so that v(τk)=0 and ω(τk)=ω0 are satisfied when τ=τk.Lemma 5.
Suppose thath′(z0)≠0. If τ=τ0, then ±iω0 is a pair of simple purely imaginary roots of (14). In addition, if the conditions in Lemma 3 are satisfied, then
(29)d(Reλ)dτ|τ=τk>0.
This signifies that there exists at least one eigenvalue with positive real part forτ>τk. Differentiating both sides of (14) with respect to τ, it can be written as
(30)(dλdτ)-1=((4λ3+3b3λ2+2b2λ+b1)+c1e-λτ-(c1λ+c0)τe-λτ)×((c1λ+c0)λe-λτ)-1.
Therefore
(31)sgn{dReλdτ}τ=τk=sgn{Re(dλdτ)-1}λ=iω0=sgnω02Λ(4ω06+3m3ω04111111111+2m2ω02+m1)=sgnω02Λ{h′(ω02)}=sgn{h′(ω02)},
where Λ=c12ω04+c0ω02. Then it can be derived that
(32)d(Reλ)dτ|τ=τk>0.It follows the hypothesis(H3) that h′(ω02)≠0. Therefore, transversality condition holds and the conditions for Hopf bifurcation are satisfied when τ=τk, according to Hopf bifurcation theorem [24] for functional differential equations. Then the following results can be obtained.Theorem 6.
Suppose that the conditions(H1) and (H2) are satisfied.(i)
For system (5), the equilibrium E*(S*,I*,D*,Q*,V*) is locally asymptotically stable when τ∈[0,τ0) but unstable when τ>τ0.(ii)
When condition(H3) is satisfied, system (5) will undergo a Hopf bifurcation at the positive equilibrium E*(S*,I*,D*,Q*,V*) when τ=τk (k=0,1,2,…), where τk is defined by (28).Theorem2 implies to us that when birth and death rates and the mechanism of time window in intrusion detection system are considered, the length of time window is crucial for the stability of the propagation process. When time delay is less than the threshold τ0, the system will stabilize at its infection equilibrium point, which is beneficial to further implement containment strategies to eliminate worms. However, when time delay is greater than the threshold, the system will be unstable and undergo a bifurcation. Although the propagation of worm presents a periodical phenomenon, in real world, complicated environment may make the propagation pass the critical state and reach to an unpredictable chaos.


## 4. Numerical and Simulation Experiments

### 4.1. Numerical Experiments

The parameters of the delayed model will be chosen properly, according to the stability of the positive equilibrium, bifurcation analysis, and the practical environment. 500,000 hosts are picked as the population size, and the worm’s average scan rate isη=4000 per second. The worm infection rate can be calculated as ε=ηN/232=0.4657 [11], which means that average 0.4657 hosts of all the hosts can be scanned by one host. The infection ratio is β=η/232=0.0000053. The rest of the parameters are γ=0.03, μ0=0.026, ω=0.00001, α=0.56, φ=0.0009, and p=0.99. Initially, I(0)=50, which means that there are 50 infectious hosts while the rest of the hosts are susceptible at the beginning.Figure4 shows the curves of five kinds of hosts when τ=5<τ0. All of the five kinds of hosts get stable within 4 minutes, which illustrates that E* is asymptotically stable. It implies that the number of infectious hosts maintain a constant level and thus can be predicted. Further strategies can be developed and utilized to eliminate worms. But when time delay τ gets increased and then reach the threshold τ0, E* will lose its stability and a bifurcation will occur. Figure 5 shows the susceptible, infected, and recovered hosts when τ>τ0. In this firgure, we can clearly see that the number of infectious hosts will outburst after a short period of peace and repeat again and again but not in the same period.Figure 4
Worm propagation trend of the model whenτ<τ0.Figure 5
Worm propagation trend of the model whenτ>τ0.In order to see the influence of time delay,τ is set to a different value each time with other parameters remaining the same. Figure 6 shows the number of infected hosts in the same coordinate with time delays τ=5, τ=15, τ=45, and τ=90, respectively.Figure 6
The number ofI(t) when τ is changed.Figure7 gives the four curves in four coordinates. In these two figures, the impact of time delay on infected hosts is evident. Initially, the four curves are overlapped which means that time delay has little effect in the initial stage of worm propagation. With the increase of time delay, the curve begins to oscillate. When time delay passes through the threshold τ0, the infecting process gets unstable. Then simultaneously, it can be discovered that the amplitude and period of the number of infected hosts get increased.The number ofI(t) when τ is changed.
(a)
(b)
(c)
(d)Figure8(a) shows the projection of the phase portrait of system (5) when τ=15<τ0 in (S,I,V)-space. The curve converges to a fixed point which suggests that the system is stable. Figure 8(b) shows the projection of the phase portrait of system (5) when τ=25>τ0 in (S,I,V)-space. The curve converges to a limit circle which implies that the system is unstable. Figures 8(c) and 8(d) show the phase portraits of susceptible S(t) and infected I(t) as τ=15<τ0 and τ=25>τ0, respectively.The phase portrait whenτ<τ0 and τ>τ0.
(a)
The projection of the phase portrait in(S,I,R)-space when τ<τ0
(b)
The projection of the phase portrait in(S,I,R)-space when τ>τ0
(c)
The phase portrait of susceptibleS(t) and infected I(t) when τ<τ0
(d)
The phase portrait of susceptibleS(t) and infected I(t) when τ>τ0


### 4.2. Simulation Experiments

The discrete-time simulation is an expanded version of Zou’s program simulating Code Red worm propagation and has been modified to run on a Linux server. The system in our simulation experiment consists of 500,000 hosts that can reach each other directly, which is consistent with the numerical experiments, and there is no topology issue in our simulation. At the beginning of simulation, 50 hosts are randomly chosen to be infectious and the others are all susceptible.Identical with the results of numerical experiments, Figure9 shows all five kinds of hosts when τ=5<τ0. We find that the model will reach a stable state after a short period of time, which suggests that the number of infetious hosts can be predicted and we can develop further strategy to eliminate worms.Figure 9
Simulation result of the five kinds of hosts whenτ<τ0.When time delay increases but is less than the threshold derived from theoretical analysis, the number of infectious hosts and other hosts present a damped oscillation and finally reach an approximately stable state. Figure10 shows the number of five kinds of hosts when τ=15<τ0. An interesting result is that the number of each host maintain a slight random vibration. However, the overall amplitude is only 0.273% to the population size, and the maximum amplitude is only 0.953% to the population size. The reason why this phenomenon occurs is due to the random events in simulation experiments. The implement of transition rates of the model is based on probability. That is to say, when the removal rate of infectious hosts is set to 0.03, it means that the probability of transition from infectious hosts to vaccinated state is 3%; it also means that infectious hosts get patched with probability of 3%. To investigate this phenomenon, phase portrait of susceptible S(t) and infected I(t) is depicted when τ=15<τ0 as shown Figure 11. It shows that the curve is converged to a fixed point, which means that the system gets stable.Figure 10
Simulation result of the five kinds of hosts whenτ=15.Figure 11
The phase portrait of susceptibleS(t) and infected I(t) when τ=15.When time delay passes the threshold, a bifurcation appears. Figure12 shows the number of susceptible, infectious and vaccinated hosts when τ>τ0. Figure 13 shows the difference between simulation and numerical results of susceptible and infectious hosts, respectively. In this figure, the periods of these two curves are well matched, which suggests that the results of numerical and simulation experiments are identical. But there is a difference of 9.6% of total population size in amplitudes. This mainly results from the precision of experiments. The number of hosts in numerical experiments can be either integers or decimals because it is the solution of differential equations. However, in simulation experiments, the number of hosts must be integers. Furthermore, when the number of infectious hosts are very little, this tiny difference will result in a big gap afterwards.Figure 12
Simulation result of the three kinds of hosts whenτ>τ0.The comparison of numerical and simulation experiments.
(a)
The comparison of the number of susceptible hosts
(b)
The comparison of the number of infectious hosts


## 4.1. Numerical Experiments

The parameters of the delayed model will be chosen properly, according to the stability of the positive equilibrium, bifurcation analysis, and the practical environment. 500,000 hosts are picked as the population size, and the worm’s average scan rate isη=4000 per second. The worm infection rate can be calculated as ε=ηN/232=0.4657 [11], which means that average 0.4657 hosts of all the hosts can be scanned by one host. The infection ratio is β=η/232=0.0000053. The rest of the parameters are γ=0.03, μ0=0.026, ω=0.00001, α=0.56, φ=0.0009, and p=0.99. Initially, I(0)=50, which means that there are 50 infectious hosts while the rest of the hosts are susceptible at the beginning.Figure4 shows the curves of five kinds of hosts when τ=5<τ0. All of the five kinds of hosts get stable within 4 minutes, which illustrates that E* is asymptotically stable. It implies that the number of infectious hosts maintain a constant level and thus can be predicted. Further strategies can be developed and utilized to eliminate worms. But when time delay τ gets increased and then reach the threshold τ0, E* will lose its stability and a bifurcation will occur. Figure 5 shows the susceptible, infected, and recovered hosts when τ>τ0. In this firgure, we can clearly see that the number of infectious hosts will outburst after a short period of peace and repeat again and again but not in the same period.Figure 4
Worm propagation trend of the model whenτ<τ0.Figure 5
Worm propagation trend of the model whenτ>τ0.In order to see the influence of time delay,τ is set to a different value each time with other parameters remaining the same. Figure 6 shows the number of infected hosts in the same coordinate with time delays τ=5, τ=15, τ=45, and τ=90, respectively.Figure 6
The number ofI(t) when τ is changed.Figure7 gives the four curves in four coordinates. In these two figures, the impact of time delay on infected hosts is evident. Initially, the four curves are overlapped which means that time delay has little effect in the initial stage of worm propagation. With the increase of time delay, the curve begins to oscillate. When time delay passes through the threshold τ0, the infecting process gets unstable. Then simultaneously, it can be discovered that the amplitude and period of the number of infected hosts get increased.The number ofI(t) when τ is changed.
(a)
(b)
(c)
(d)Figure8(a) shows the projection of the phase portrait of system (5) when τ=15<τ0 in (S,I,V)-space. The curve converges to a fixed point which suggests that the system is stable. Figure 8(b) shows the projection of the phase portrait of system (5) when τ=25>τ0 in (S,I,V)-space. The curve converges to a limit circle which implies that the system is unstable. Figures 8(c) and 8(d) show the phase portraits of susceptible S(t) and infected I(t) as τ=15<τ0 and τ=25>τ0, respectively.The phase portrait whenτ<τ0 and τ>τ0.
(a)
The projection of the phase portrait in(S,I,R)-space when τ<τ0
(b)
The projection of the phase portrait in(S,I,R)-space when τ>τ0
(c)
The phase portrait of susceptibleS(t) and infected I(t) when τ<τ0
(d)
The phase portrait of susceptibleS(t) and infected I(t) when τ>τ0


## 4.2. Simulation Experiments

The discrete-time simulation is an expanded version of Zou’s program simulating Code Red worm propagation and has been modified to run on a Linux server. The system in our simulation experiment consists of 500,000 hosts that can reach each other directly, which is consistent with the numerical experiments, and there is no topology issue in our simulation. At the beginning of simulation, 50 hosts are randomly chosen to be infectious and the others are all susceptible.Identical with the results of numerical experiments, Figure9 shows all five kinds of hosts when τ=5<τ0. We find that the model will reach a stable state after a short period of time, which suggests that the number of infetious hosts can be predicted and we can develop further strategy to eliminate worms.Figure 9
Simulation result of the five kinds of hosts whenτ<τ0.When time delay increases but is less than the threshold derived from theoretical analysis, the number of infectious hosts and other hosts present a damped oscillation and finally reach an approximately stable state. Figure10 shows the number of five kinds of hosts when τ=15<τ0. An interesting result is that the number of each host maintain a slight random vibration. However, the overall amplitude is only 0.273% to the population size, and the maximum amplitude is only 0.953% to the population size. The reason why this phenomenon occurs is due to the random events in simulation experiments. The implement of transition rates of the model is based on probability. That is to say, when the removal rate of infectious hosts is set to 0.03, it means that the probability of transition from infectious hosts to vaccinated state is 3%; it also means that infectious hosts get patched with probability of 3%. To investigate this phenomenon, phase portrait of susceptible S(t) and infected I(t) is depicted when τ=15<τ0 as shown Figure 11. It shows that the curve is converged to a fixed point, which means that the system gets stable.Figure 10
Simulation result of the five kinds of hosts whenτ=15.Figure 11
The phase portrait of susceptibleS(t) and infected I(t) when τ=15.When time delay passes the threshold, a bifurcation appears. Figure12 shows the number of susceptible, infectious and vaccinated hosts when τ>τ0. Figure 13 shows the difference between simulation and numerical results of susceptible and infectious hosts, respectively. In this figure, the periods of these two curves are well matched, which suggests that the results of numerical and simulation experiments are identical. But there is a difference of 9.6% of total population size in amplitudes. This mainly results from the precision of experiments. The number of hosts in numerical experiments can be either integers or decimals because it is the solution of differential equations. However, in simulation experiments, the number of hosts must be integers. Furthermore, when the number of infectious hosts are very little, this tiny difference will result in a big gap afterwards.Figure 12
Simulation result of the three kinds of hosts whenτ>τ0.The comparison of numerical and simulation experiments.
(a)
The comparison of the number of susceptible hosts
(b)
The comparison of the number of infectious hosts


## 5. Conclusions

In order to accord with actual facts in the real world, time delay generated by time window in IDS is introduced to construct the worm propagation model. Dynamic birth and death rates are considered in this paper, accounting for the reinstallation of OS which users are more likely to do after when the hosts suffer worm’s destruction or quarantined to the Internet. In addition, combined with birth and death rates, time delay may lead to bifurcation and make the worm propagation system unstable.In this paper, a delayed worm propagation model with birth and death rates is studied. Next, the stability of the positive equilibrium is analyzed. Through theoretical analysis and numerical and simulation experiments, the following conclusions can be derived.(i)
The introduction of time window in IDS may lead to time delay in worm propagation model, which results in bifurcation. The critical time delayτ0 where the bifurcation appears is obtained.(ii)
The worm propagation system is stable when time delayτ<τ0. In this situation, the worm propagation can be easily predicted and eliminated.(iii)
A bifurcation emerges when time delayτ≥τ0, which means the worm propagation is unstable and may be out of control.Consequently, time delayτ should remain less than τ0 by decreasing the time window in IDS, which is helpful to predict the worm propagation and even eliminate the worm.In this paper, we have only discussed the cases which satisfy conditions(H1), (H2), and (H3). But for cases that satisfy (H1), (H2), and (H3), the dynamical behavior of this model has not been studied. These issues will be studied and discussed in our future work.



---

*Source: 927369-2013-10-10.xml*