# Modeling and Analyzing the Spread of Flash Disk Worms via Multiple Subnets

Authors: Guihua Li; Zhenzhen Peng; Lipeng Song
Journal: Discrete Dynamics in Nature and Society
 (2015)

---

## Abstract

The Flash Disk worms, spreading via both Web-based scanning and removable devices between multiple subnets, have become a serious threat to the Internet, especially those physically isolated subnets. We present a model which incorporates specific features of these worms in this paper. Then, we analyze the dynamic behaviors of the model when one
subnet is considered. Analytical result shows that the Flash Disk worm can self-perpetuate whenRi0>1 and will die out otherwise. When multiple subnets are considered, we get that once a computer is infected by the Flash Disk worms, other computers in that subnet will be infected in a short time. Thus, for any subnet, to contain the Flash Disk worms, the most effective way is to prevent the first infected individual by improving the users’ security awareness of using removed devices. Our results are illustrated by numerical simulation.


---

## Body

## 1. Introduction

The Flash Disk worms, which spread via both Web-based scanning on the Internet and removable devices, mainly attack SIMATIC and WinCC software. Those worms appear to be aimed directly at controlling physical machinery and attempt to take control of critical physical infrastructure. Stuxnet which is a kind of the Flash Disk worms has infected about 500,000–1000,000 computers, mainly in Iran, India, Indonesia, and Pakistan [1]. Nowadays, it becomes a major question to research the Flash Disk worms.For a great many similarities between computer worms and biological virus [2], some biological epidemic models have been modified to describe the spreading of the Internet worms. For example, the susceptible-infected-susceptible (SIS) model was modified including a reintroduction parameter by Wierman and Marchette [3]. In [4], the susceptible-infected-recovered (SIR) model and a discrete Markov model were presented to capture the short term and long term dynamics of viral propagation. The susceptible-antidotal-infected-contaminated (SAIC) model whose two new compartments were introduced was proposed [5]. Besides, there were the susceptible-infected-recovered-susceptible (SIRS), the susceptible-infected-detected-recovered (SIDR), and the susceptible-asymptomatic-symptomatic-recovered (SAIR) models which were adopted [6–9]. However, these models cannot be applied to the worms which spread via both Web-based scanning on the Internet and removable devices.Jin and Wang describe the FD-SEIR model to analyze and control the Flash Disk worms [10]. Besides, Song et al. present the worms model about the cross infection of computers and removable devices [11]. However, the two models were analyzed under the condition of computers and removable devices mixed evenly. It is not suitable for the spread of Stuxnet because of the different speed of Stuxnet’s spreading in different subnets. Inspired by these models, we will build a model focusing on Stuxnet which spreads via Web-based scanning on the Internet and removable devices in multiple subnets.The organization of this paper is as follows. In Section2, we present a model in multiple subnets. In Section 3, we analyze its dynamical behavior in one and more subnets and give some results by numerical simulation in multiple subnets. The paper concludes with a brief discussion in Section 4.


## 2. The Model Formulation in Multiple Subnets

The Flash Disk worms spread by Web-based scanning on the Internet and using removable devices between subnets. In the different subnets, the Flash Disk worms may have the different spreading speed. Thus, the propagation of worms can be considered to be a fast system. If they spread slowly, these subnets will be seen as a slow system. For simplicity, we suppose that the removable devices represent all mobile devices related to computer, including flash disk, mobile hard disk, and memory card. Assume that computer hosts are classified in three compartments: susceptible (Sic), infected (Iic), and recovered (Ric) and the removable devices are two compartments: susceptible Siu and infected Iiu. To consider the spread relationship between computers and removable devices, the model is as follows:(1)dSicdt=μ1Ni-βinSicIicNi-bγβucSicIiuNi-μ1Sic+ɛ-∑j=1k‍βcSicIjcNi-∑j=1k‍biγβucSicIjuNi,dIicdt=βinSicIicNi+bγβucSicIiuNi-δ1Iic-μ1Iic+ɛ∑j=1k‍βcSicIjcNi+∑j=1k‍biγβucSicIjuNi,dRicdt=δ1Iic-μ1Ric,dSiudt=μ2ni-bβcuSiuIicNi+δ2Iiu-μ2Siu+ɛ-∑j=1k‍biβoutSiuIjcNj,dIiudt=bβcuSiuIicNi-δ2Iiu-μ2Iiu+ɛ∑j=1k‍biβoutSiuIjcNj,where Sic+Iic+Ric=Ni, Siu+Iiu=ni, and meaning of the parameters and state variables is shown in Notations and Definitions section.


## 3. Model Analysis

In the section, two parts will be analyzed. In the first part, we will not consider the worms spreading among different subnets. In the second part, we will consider worms spreading among different subnets.


### 3.1. Model Analysis in theith Subnet

If we letɛ=0, then the worms will be only propagated in subnet. Model (1) becomes (2)dSicdt=μ1Ni-βinSicIicNi-bγβucSicIiuNi-μ1Sic,dIicdt=βinSicIicNi+bγβucSicIiuNi-δ1Iic-μ1Iic,dRicdt=δ1Iic-μ1Ric,dSiudt=μ2ni-bβcuSiuIicNi+δ2Iiu-μ2Siu,dIiudt=bβcuSiuIicNi-δ2Iiu-μ2Iiu.Then we will consider the existence and stability of equilibria for system (2). It is obvious that there is a disease-free equilibrium Qi0=(Ni,0,0,ni,0) in system (2). To analyze the existence of the positive equilibria, we firstly give the basic reproduction number:(3)Ri0=βinδ1+μ1+nib2γβucβcuNiδ1+μ1δ2+μ2.Here Ri0 is the number of newly infected individuals at the disease-free equilibrium in the ith subnet in infectious period.By calculating, we obtain thatIic satisfied the following equation: (4)bβinβcuNiIic2+δ1+μ1δ2+μ2Ri0+bμ1βcuδ1+μ1-βinδ1+μ1Iic+μ1Niδ2+μ21-Ri0=0.According to Descartes sign rule, if Ri0>1, there exists a unique positive equilibrium Qi∗=(Sic∗,Iic∗,Ric∗,Siu∗,Iiu∗) in system (2), where(5)Sic∗=μ1Ni-δ1Iic∗-μ1Iic∗μ1,Iic∗=ω22-4ω1ω3-ω22ω1,Ric∗=δ1μ1Iic∗,Siu∗=δ1+μ1niNibβcuIic∗+δ2+μ2Ni,Iiu∗=bβcuniIic∗bβcuIic∗+δ2+μ2Ni,ω1=bβinβcuNi,ω2=δ1+μ1δ2+μ2Ri0+bμ1βcuδ1+μ1-βinδ1+μ1,ω3=μ1Niδ2+μ21-Ri0.Furthermore, we consider the stability of equilibria. We have the following theorems.Theorem 1.
IfRi0<1, the disease-free equilibrium Qi0 of (2) is locally asymptotically stable.Proof.
The Jacobian matrix of (2) at Qi0 is (6)JQi00=-μ1-βin0-bγβuc0βin-δ1-μ10bγβuc0-bnβcuNi-μ2δ20bnβcuNi0-δ2+μ2.
Then the characteristic equation is(7)λ+μ1λ+μ2·λ2+δ1+δ2+μ1+μ2-βinλ1-Ri0+δ1+μ1δ2+μ21-Ri0=0.It is easily seen that all eigenvalues of λ have negative real parts if Ri0<1. Thus, the theorem is proven by Routh-Hurwitz criterion.Theorem 2.
WhenRi0<1, the disease-free equilibrium Qi0 of system (2) is globally asymptotically stable.Proof.
Take Lyapunov function,(8)VIic,Iiu=1δ1+μ1Iic+bγβucδ1+β1δ2+β2Iiu,which is always positive in R+2 where(9)R+2=Iic,Iiu∈R2:Iic>0,Iiu>0.Then, (10)V˙Iic,Iiu=1δ1+μ1βinSicIicNi+bγβucSicIiuNi-δ1Iic-μ1Iic+bγβucδ1+β1δ2+β2·bβcuSiuIicNi-δ2Iiu-μ2Iiu=βinδ1+μ1SicIicNi+b2γβucβcuδ1+β1δ2+β2SiuIicNi-Iic+bγβcuδ1+μ1SicIiuNi+bγβcuδ1+μ1Iiu≤βinδ1+μ1Iic+b2γβucβcuδ1+β1nδ2+β2NiIic-Iic+bγβcuδ1+μ1Iiu-bγβcuδ1+μ1Iiu=Ri0-1Iic≤0.Then, when Ri0<1, the disease-free equilibrium Qi0 of system (2) is globally asymptotically stable. The theorem is proven.Theorem 3.
IfRi0>1, the positive equilibrium Qi∗ of (2) is locally asymptotically stable.Proof.
The matrix of the linearization of system (2) at the unique positive equilibrium Qi∗ is (11)JQi∗∗=-βinIic∗Ni-bγβucIiu∗Ni-μ1-βinSic∗Ni0-bγβucSic∗NiβinIic∗Ni+bγβucIiu∗NiβinSic∗Ni-δ1-μ10bγβucSic∗Ni0-bβcuSiu∗Ni-bβcuIic∗Ni-μ2δ20bβcuSiu∗NibβcuIic∗Ni-δ2+μ2.Then the characteristic equation is (λ+μ2)(λ3+a1λ2+a2λ+a3)=0, where (12)a1=2μ1+δ1+μ2+δ2+bβcuIic∗Ni+βinIic∗Ni+bγβucIiu∗Ni-βinIic∗Ni=μ1+μ2+δ2+βinIic∗+bβcuIic∗+bγβucIiu∗Ni+bγβucSic∗Iiu∗NiIic∗>0,a2=μ2+δ2+bγcuIic∗Niμ1+δ2-βinSic∗Ni+μ1μ1+δ1+μ2+δ2+bβcuIic∗Ni-βinIic∗Ni+βinIic∗Ni+bγβucIiu∗Ni·μ1+δ1+μ2+δ2+bβcuIic∗Ni-b2γβucβcuSic∗Siu∗Ni2=μ2+δ2bγβucSic∗Iiu∗NiIic∗+μ1μ2+δ2+bβcuIic∗Ni+bγβucSic∗Iiu∗NiIic∗+βinIic∗Ni+bγβucIiu∗Ni·μ1+δ1+μ2+δ2+bβcuIic∗Ni>0,a3=μ1μ2+δ2+bβcuIic∗Ni+μ1+δ1·βinIic∗Ni+bγβucIiu∗Niμ2+δ2+bβcuIic∗Ni-b2γβucβcuSic∗Siu∗Ni2=μ1μ2+δ2bγβucSic∗Iiu∗NiIic∗+μ1+δ1βinIic∗Ni+bγβucIiu∗Ni·μ2+δ2+bβcuIic∗Ni>0.Then(13)a1a1-a3=βinIic∗Ni+bγβucIiu∗Niμ2+δ2+bβcuIic∗Nia1+bγβucSic∗Iiu∗NiIic∗μ2+δ2·μ2+δ2+bβcuIic∗Ni+βinIic∗Ni+bγβucIiu∗Ni+bγβucSic∗Iiu∗NiIic∗+μ1+δ1βinIic∗Ni+bγβucIiu∗Ni·μ1+βinIic∗Ni+bγβucSic∗Iiu∗NiIic∗>0.Hence the Routh-Hurwitz criterion is satisfied. Thus it follows that the endemic equilibrium Qi∗ of (2), which exists if Ri0>1, is always locally asymptotically stable. The theorem is proven.To prove the global stability, we have a dimensionless transformation wheresic=Sic/Ni, iic=Iic/Ni, ric=Ric/Ni, siu=Siu/ni, iiu=Iiu/Ni, and mi=ni/Ni, for system (2). It becomes(14)dsicdt=μ1-βinsiciic-bγβucmisiciiu-μ1sic,diicdt=βinsiciic+bγβucmisiciiu-δ1iic-μ1iic,dricdt=δ1ic-μ1ric,dsiudt=μ2-bβcusiuiic+δ2iiu-μ2siu,diiudt=bβcusiuiic-δ2iiu-μ2iiu.Then,(15)Ri0=βinδ1+μ1+b2γβucβcumiδ1+μ1δ2+μ2.The positive equilibrium is(16)qi∗=sic∗,iic∗,ric∗,siu∗,iiu∗=Sic∗Ni,Iic∗Ni,Ric∗Ni,Siu∗ni,Iiu∗ni.Theorem 4.
WhenRi0>1, the positive equilibrium qi∗ of system (14), as well as the positive equilibrium Qi∗ of system (2), is globally asymptotically stable.Proof.
Take Lyapunov function,(17)Vsic,iic,siu,iiu=βcusic-sic∗ln⁡sic+βcuiic-iic∗ln⁡iic+γmiβucsiu-siu∗ln⁡siu+γmiβuciiu-iiu∗ln⁡iiu,which is always positive in R+4 where(18)R+4=sic,iic,siu,iiu∈R4:sic>0,iic>0,siu>0,iiu>0.Then,(19)V˙sic,iic,siu,iiu=βcu1-sic∗sicsic˙+βcu1-iic∗iiciic˙+γmiβuc1-su∗siu∗siu˙+γmiβuc1-iuc∗iiuiiu˙=βinβcu1-sic∗sicsic∗iic∗-siciic+bγβcuβucmi1-siu∗siusiu∗iiu∗-siuiiu+μ1βcu1-sic∗sicsic∗-sic+βinβcu1-iic∗iicsiciic-sic∗iic+bγβcuβucmi1-iic∗iic·iiusic-sic∗iiu∗iic∗iic+bγβcuβucmisic∗iii∗iic∗siu∗1-siu∗siu·iic∗siu∗-iicsiu+bδ2γβcuβucmisic∗iiu∗iic∗siu∗1-siu∗siu·iiu-iiu∗+bμ2γβcuβucmisic∗iiu∗iic∗siu∗1-iiu∗iiu·iiciiu-iic∗siu∗iiu∗·iiu≤βinβcu2sic∗iic∗-sic∗2iic∗sic-iic∗sic+bγβcuβucmi·4sic∗iiu∗-sic∗2iiu∗sc-iic∗iiusiciic-sic∗iiu∗siu∗siu-sic∗iicsiuiiu∗2sic∗siu∗iiu≤0.The positive equilibrium qi∗ of system (14), as well as the positive equilibrium Qi∗ of system (2), is globally asymptotically stable when Ri0>1. The theorem is proven.


### 3.2. Model Analysis between Subnets

In the subsection, we will analyze the existence of positive equilibrium for system (1). For convenience, assume that the fast system is stable in one subnet. Then the slow system is(20)dSicdt=-∑j=1k‍βcSicIjcNi-∑j=1k‍biγβucSicIjuNi,dIicdt=∑j=1k‍βcSicIjcNi+∑j=1k‍biγβucSicIjuNi,dSiudt=-∑j=1k‍biβoutSiuIjcNj,dIiudt=∑j=1k‍biβoutSiuIjcNj,where Sic+Iic=Ni and Siu+Iiu=ni. From system (20), we can obtain Iic(t) and Iiu(t). If t→0,(21)Sic0=Ni,Siu0=ni,Iict=Ni-Nie-c1βc/Ni+c2biγβuc/Nit,Iiut=ni-nie-c3biβoutt,where(22)c1=∑j=1k‍Ijc∗,c2=∑j=1k‍Iju∗,c3=∑j=1k‍Ijc∗Nj∗.From (21), we know that one can prevent the worm spreading by controlling parameters. If infected computers and removable devices by the worms is less than one, that is, Iic(t)<1 and Iiu(t)<1, the worms will die out. Otherwise, they will be epidemic. We should improve the security awareness of using removable devices. For model (20), it is difficult to analyze the dynamic behaviors. In the following part, we will simulate the dynamic behaviors of system (1).Take the determined parameters and the average value of about 100 experimental results. Firstly, letN=1000, n=500, βin=0.5, βout=0.8, b=0.006, γ=0.75, δ1=0.0059, δ2=0.002, μ1=0.00057, μ2=0.00057, and time step Δt=1. Then we plot figures of dynamical behaviors if we take the different initial value. (i) Ii0c=100 if Ri0<1 and Ii0c=1 if Ri0>1 when t=0. From Figure 1, we can see that if Ri0<1, the number of infected computers will gradually reduce and finally disappear. On the contrary, if Ri0>1, the number of infected computers will increase and then tend to a stable status. (ii) Let the initial value Ii0c=0 when t=0 and the other values do not change. We draw change figures for the proportion of infected computers Iic(t) with time t in the ith subnet (see Figure 2) and multiple subnets (see Figure 3). From Figure 2, we can obtain that if a computer is infected by Stuxnet, other computers will be infected in a short time. From Figure 3, it is found that once a computer is infected by the Flash Disk worms, other computers will be infected among the different subnets after a longer time. Furthermore, comparing Figure 2 with Figure 3, we can find that if a computer is infected by the Flash Disk worms, other computers will be infected in a short time in one subnet. To prevent computer from being infected by the worms, we should take some effective measures. We can improve the safety awareness of using removable devices to prevent the first computer from being infected by the worms.Figure 1
The change figure of proportion of infected computers with timet when Ri0<1 and Ri0>1, respectively.Figure 2
The change figure of proportion of infected computersIic with time t in the ith subnet.Figure 3
The change figure of proportion of infected computersIic(t) with time t between subnets.


## 3.1. Model Analysis in theith Subnet

If we letɛ=0, then the worms will be only propagated in subnet. Model (1) becomes (2)dSicdt=μ1Ni-βinSicIicNi-bγβucSicIiuNi-μ1Sic,dIicdt=βinSicIicNi+bγβucSicIiuNi-δ1Iic-μ1Iic,dRicdt=δ1Iic-μ1Ric,dSiudt=μ2ni-bβcuSiuIicNi+δ2Iiu-μ2Siu,dIiudt=bβcuSiuIicNi-δ2Iiu-μ2Iiu.Then we will consider the existence and stability of equilibria for system (2). It is obvious that there is a disease-free equilibrium Qi0=(Ni,0,0,ni,0) in system (2). To analyze the existence of the positive equilibria, we firstly give the basic reproduction number:(3)Ri0=βinδ1+μ1+nib2γβucβcuNiδ1+μ1δ2+μ2.Here Ri0 is the number of newly infected individuals at the disease-free equilibrium in the ith subnet in infectious period.By calculating, we obtain thatIic satisfied the following equation: (4)bβinβcuNiIic2+δ1+μ1δ2+μ2Ri0+bμ1βcuδ1+μ1-βinδ1+μ1Iic+μ1Niδ2+μ21-Ri0=0.According to Descartes sign rule, if Ri0>1, there exists a unique positive equilibrium Qi∗=(Sic∗,Iic∗,Ric∗,Siu∗,Iiu∗) in system (2), where(5)Sic∗=μ1Ni-δ1Iic∗-μ1Iic∗μ1,Iic∗=ω22-4ω1ω3-ω22ω1,Ric∗=δ1μ1Iic∗,Siu∗=δ1+μ1niNibβcuIic∗+δ2+μ2Ni,Iiu∗=bβcuniIic∗bβcuIic∗+δ2+μ2Ni,ω1=bβinβcuNi,ω2=δ1+μ1δ2+μ2Ri0+bμ1βcuδ1+μ1-βinδ1+μ1,ω3=μ1Niδ2+μ21-Ri0.Furthermore, we consider the stability of equilibria. We have the following theorems.Theorem 1.
IfRi0<1, the disease-free equilibrium Qi0 of (2) is locally asymptotically stable.Proof.
The Jacobian matrix of (2) at Qi0 is (6)JQi00=-μ1-βin0-bγβuc0βin-δ1-μ10bγβuc0-bnβcuNi-μ2δ20bnβcuNi0-δ2+μ2.
Then the characteristic equation is(7)λ+μ1λ+μ2·λ2+δ1+δ2+μ1+μ2-βinλ1-Ri0+δ1+μ1δ2+μ21-Ri0=0.It is easily seen that all eigenvalues of λ have negative real parts if Ri0<1. Thus, the theorem is proven by Routh-Hurwitz criterion.Theorem 2.
WhenRi0<1, the disease-free equilibrium Qi0 of system (2) is globally asymptotically stable.Proof.
Take Lyapunov function,(8)VIic,Iiu=1δ1+μ1Iic+bγβucδ1+β1δ2+β2Iiu,which is always positive in R+2 where(9)R+2=Iic,Iiu∈R2:Iic>0,Iiu>0.Then, (10)V˙Iic,Iiu=1δ1+μ1βinSicIicNi+bγβucSicIiuNi-δ1Iic-μ1Iic+bγβucδ1+β1δ2+β2·bβcuSiuIicNi-δ2Iiu-μ2Iiu=βinδ1+μ1SicIicNi+b2γβucβcuδ1+β1δ2+β2SiuIicNi-Iic+bγβcuδ1+μ1SicIiuNi+bγβcuδ1+μ1Iiu≤βinδ1+μ1Iic+b2γβucβcuδ1+β1nδ2+β2NiIic-Iic+bγβcuδ1+μ1Iiu-bγβcuδ1+μ1Iiu=Ri0-1Iic≤0.Then, when Ri0<1, the disease-free equilibrium Qi0 of system (2) is globally asymptotically stable. The theorem is proven.Theorem 3.
IfRi0>1, the positive equilibrium Qi∗ of (2) is locally asymptotically stable.Proof.
The matrix of the linearization of system (2) at the unique positive equilibrium Qi∗ is (11)JQi∗∗=-βinIic∗Ni-bγβucIiu∗Ni-μ1-βinSic∗Ni0-bγβucSic∗NiβinIic∗Ni+bγβucIiu∗NiβinSic∗Ni-δ1-μ10bγβucSic∗Ni0-bβcuSiu∗Ni-bβcuIic∗Ni-μ2δ20bβcuSiu∗NibβcuIic∗Ni-δ2+μ2.Then the characteristic equation is (λ+μ2)(λ3+a1λ2+a2λ+a3)=0, where (12)a1=2μ1+δ1+μ2+δ2+bβcuIic∗Ni+βinIic∗Ni+bγβucIiu∗Ni-βinIic∗Ni=μ1+μ2+δ2+βinIic∗+bβcuIic∗+bγβucIiu∗Ni+bγβucSic∗Iiu∗NiIic∗>0,a2=μ2+δ2+bγcuIic∗Niμ1+δ2-βinSic∗Ni+μ1μ1+δ1+μ2+δ2+bβcuIic∗Ni-βinIic∗Ni+βinIic∗Ni+bγβucIiu∗Ni·μ1+δ1+μ2+δ2+bβcuIic∗Ni-b2γβucβcuSic∗Siu∗Ni2=μ2+δ2bγβucSic∗Iiu∗NiIic∗+μ1μ2+δ2+bβcuIic∗Ni+bγβucSic∗Iiu∗NiIic∗+βinIic∗Ni+bγβucIiu∗Ni·μ1+δ1+μ2+δ2+bβcuIic∗Ni>0,a3=μ1μ2+δ2+bβcuIic∗Ni+μ1+δ1·βinIic∗Ni+bγβucIiu∗Niμ2+δ2+bβcuIic∗Ni-b2γβucβcuSic∗Siu∗Ni2=μ1μ2+δ2bγβucSic∗Iiu∗NiIic∗+μ1+δ1βinIic∗Ni+bγβucIiu∗Ni·μ2+δ2+bβcuIic∗Ni>0.Then(13)a1a1-a3=βinIic∗Ni+bγβucIiu∗Niμ2+δ2+bβcuIic∗Nia1+bγβucSic∗Iiu∗NiIic∗μ2+δ2·μ2+δ2+bβcuIic∗Ni+βinIic∗Ni+bγβucIiu∗Ni+bγβucSic∗Iiu∗NiIic∗+μ1+δ1βinIic∗Ni+bγβucIiu∗Ni·μ1+βinIic∗Ni+bγβucSic∗Iiu∗NiIic∗>0.Hence the Routh-Hurwitz criterion is satisfied. Thus it follows that the endemic equilibrium Qi∗ of (2), which exists if Ri0>1, is always locally asymptotically stable. The theorem is proven.To prove the global stability, we have a dimensionless transformation wheresic=Sic/Ni, iic=Iic/Ni, ric=Ric/Ni, siu=Siu/ni, iiu=Iiu/Ni, and mi=ni/Ni, for system (2). It becomes(14)dsicdt=μ1-βinsiciic-bγβucmisiciiu-μ1sic,diicdt=βinsiciic+bγβucmisiciiu-δ1iic-μ1iic,dricdt=δ1ic-μ1ric,dsiudt=μ2-bβcusiuiic+δ2iiu-μ2siu,diiudt=bβcusiuiic-δ2iiu-μ2iiu.Then,(15)Ri0=βinδ1+μ1+b2γβucβcumiδ1+μ1δ2+μ2.The positive equilibrium is(16)qi∗=sic∗,iic∗,ric∗,siu∗,iiu∗=Sic∗Ni,Iic∗Ni,Ric∗Ni,Siu∗ni,Iiu∗ni.Theorem 4.
WhenRi0>1, the positive equilibrium qi∗ of system (14), as well as the positive equilibrium Qi∗ of system (2), is globally asymptotically stable.Proof.
Take Lyapunov function,(17)Vsic,iic,siu,iiu=βcusic-sic∗ln⁡sic+βcuiic-iic∗ln⁡iic+γmiβucsiu-siu∗ln⁡siu+γmiβuciiu-iiu∗ln⁡iiu,which is always positive in R+4 where(18)R+4=sic,iic,siu,iiu∈R4:sic>0,iic>0,siu>0,iiu>0.Then,(19)V˙sic,iic,siu,iiu=βcu1-sic∗sicsic˙+βcu1-iic∗iiciic˙+γmiβuc1-su∗siu∗siu˙+γmiβuc1-iuc∗iiuiiu˙=βinβcu1-sic∗sicsic∗iic∗-siciic+bγβcuβucmi1-siu∗siusiu∗iiu∗-siuiiu+μ1βcu1-sic∗sicsic∗-sic+βinβcu1-iic∗iicsiciic-sic∗iic+bγβcuβucmi1-iic∗iic·iiusic-sic∗iiu∗iic∗iic+bγβcuβucmisic∗iii∗iic∗siu∗1-siu∗siu·iic∗siu∗-iicsiu+bδ2γβcuβucmisic∗iiu∗iic∗siu∗1-siu∗siu·iiu-iiu∗+bμ2γβcuβucmisic∗iiu∗iic∗siu∗1-iiu∗iiu·iiciiu-iic∗siu∗iiu∗·iiu≤βinβcu2sic∗iic∗-sic∗2iic∗sic-iic∗sic+bγβcuβucmi·4sic∗iiu∗-sic∗2iiu∗sc-iic∗iiusiciic-sic∗iiu∗siu∗siu-sic∗iicsiuiiu∗2sic∗siu∗iiu≤0.The positive equilibrium qi∗ of system (14), as well as the positive equilibrium Qi∗ of system (2), is globally asymptotically stable when Ri0>1. The theorem is proven.


## 3.2. Model Analysis between Subnets

In the subsection, we will analyze the existence of positive equilibrium for system (1). For convenience, assume that the fast system is stable in one subnet. Then the slow system is(20)dSicdt=-∑j=1k‍βcSicIjcNi-∑j=1k‍biγβucSicIjuNi,dIicdt=∑j=1k‍βcSicIjcNi+∑j=1k‍biγβucSicIjuNi,dSiudt=-∑j=1k‍biβoutSiuIjcNj,dIiudt=∑j=1k‍biβoutSiuIjcNj,where Sic+Iic=Ni and Siu+Iiu=ni. From system (20), we can obtain Iic(t) and Iiu(t). If t→0,(21)Sic0=Ni,Siu0=ni,Iict=Ni-Nie-c1βc/Ni+c2biγβuc/Nit,Iiut=ni-nie-c3biβoutt,where(22)c1=∑j=1k‍Ijc∗,c2=∑j=1k‍Iju∗,c3=∑j=1k‍Ijc∗Nj∗.From (21), we know that one can prevent the worm spreading by controlling parameters. If infected computers and removable devices by the worms is less than one, that is, Iic(t)<1 and Iiu(t)<1, the worms will die out. Otherwise, they will be epidemic. We should improve the security awareness of using removable devices. For model (20), it is difficult to analyze the dynamic behaviors. In the following part, we will simulate the dynamic behaviors of system (1).Take the determined parameters and the average value of about 100 experimental results. Firstly, letN=1000, n=500, βin=0.5, βout=0.8, b=0.006, γ=0.75, δ1=0.0059, δ2=0.002, μ1=0.00057, μ2=0.00057, and time step Δt=1. Then we plot figures of dynamical behaviors if we take the different initial value. (i) Ii0c=100 if Ri0<1 and Ii0c=1 if Ri0>1 when t=0. From Figure 1, we can see that if Ri0<1, the number of infected computers will gradually reduce and finally disappear. On the contrary, if Ri0>1, the number of infected computers will increase and then tend to a stable status. (ii) Let the initial value Ii0c=0 when t=0 and the other values do not change. We draw change figures for the proportion of infected computers Iic(t) with time t in the ith subnet (see Figure 2) and multiple subnets (see Figure 3). From Figure 2, we can obtain that if a computer is infected by Stuxnet, other computers will be infected in a short time. From Figure 3, it is found that once a computer is infected by the Flash Disk worms, other computers will be infected among the different subnets after a longer time. Furthermore, comparing Figure 2 with Figure 3, we can find that if a computer is infected by the Flash Disk worms, other computers will be infected in a short time in one subnet. To prevent computer from being infected by the worms, we should take some effective measures. We can improve the safety awareness of using removable devices to prevent the first computer from being infected by the worms.Figure 1
The change figure of proportion of infected computers with timet when Ri0<1 and Ri0>1, respectively.Figure 2
The change figure of proportion of infected computersIic with time t in the ith subnet.Figure 3
The change figure of proportion of infected computersIic(t) with time t between subnets.


## 4. Conclusion

In this paper, we proposed a new model focusing on the Flash Disk worms spreading via both Web-based scanning and removable devices in multiple subnets. In theith subnet, we deduced the basic reproduction number Ri0, a disease-free equilibrium, and a unique equilibrium. If Ri0<1, the disease-free equilibrium is globally asymptotically stable; otherwise the Flash Disk worms can self-perpetuate. In the different subnets, we analyzed controlling the number of infected computers by the determined simulation and stochastic simulation. If a computer is infected by the Flash Disk worms, other computers will be infected in a short time in one subnet. We should improve the safety awareness of using removable devices to prevent the first computer from being infected by the worms. The future work will focus on using real trace data to test the model and these strategies. We will also study some countermeasures against the Flash Disk worms.



---

*Source: 941862-2015-05-14.xml*