Dynamic model of worm propagation in computer network

Bimal Kumar Mishra

a,
, Samir Kumar Pandey
b
a
Department of Applied Mathematics, Birla Institute of Technology, Mesra, Ranchi 835 215, India
b
Department of Mathematics, Jharkhand Rai University, Ranchi 834 002, India
a r t i c l e i n f o
Article history:
Received 21 September 2012
Received in revised form 11 June 2013
Accepted 8 October 2013
Available online 30 October 2013
Keywords:
Vertical transmission
Modied reproductive number
Stability
Compartmental model
Equilibrium
a b s t r a c t
In this paper, an attempt has been made to mathematically formulate a compartmental
susceptible exposed infectious susceptible with vaccination (that is, anti-virus treat-
ment) (SEIS-V) epidemic transmission model of worms in a computer network with natural
death rate (which depends on the total number of nodes). The stability of the result is sta-
ted in terms of modied reproductive number R
v
. We have derived an explicit formula for
the modied reproductive number R
v
, and have shown that the worm-free equilibrium,
whose component of infective is zero, is globally asymptotically stable if R
v
< 1, and unsta-
ble if R
v
> 1. The contribution of vertical transmission to the modied reproductive number
is also analyzed. Numerical methods are employed to solve and simulate the system of
equations developed and interpretation of the model yields interesting revelations. Analy-
sis of efcient antivirus software is also performed.
2013 Elsevier Inc. All rights reserved.
1. Introduction
These are days of networked computers. Lot of effort has been devoted to the development of virtual vaccines but each
time a new worm appears. All systems connected to the internet are potential targets to the attack of worms because the
openness of internet makes them accessible to attack. It is well known that software can only offer a temporary immunity
to the nodes. Thus once a software wanes from the node of the computer network, the node becomes susceptible to the at-
tack again. Therefore, it is of vital importance to determine the optimal software needed to eradicate a computer worm from
the network. Also the mathematical models give the clear view to identify and solve the many complex problems. Thus, we
develop e-epidemic models for different classes of computer nodes and analyze the effect of antivirus software in the com-
puter network.
In past several decades, many authors have studied different mathematical models which illustrate the dynamical behav-
ior of the transmission of biological disease and/or computer viruses. Based on SIR classical epidemic models [13] and due
to the lots of similarities between biological viruses and computer viruses, several extended research articles are proposed to
study the spreading and attacking behavior of computer viruses in different phenomenon, e.g. virus propagation [413],
quarantine [1417], virus immunization [1824], time delay [25], fuzziness [26], effect of antivirus software [27,28], vacci-
nation [29,30], etc. May et al. [31] studied the dynamical behavior of viruses on scale free networks. Transmission of viruses
in computer network in P2P network and its time relevance is well studied [32]. Wang et al. studied the robustness of l-
tering on nonlinearities in packet losses, sensors, etc. [3338]. In the computer network, worms may transmit from main
server to any of the end nodes using vertical transmission. In this condition, the anti-virus software is taken only to the
new infected nodes. It can be easily observed that, the network cannot be recovered permanently from the worms till a sin-
gle computer node is attached to the network, still we run the anti-virus software. Then, we propose an SEIS-V epidemic
0307-904X/$ - see front matter 2013 Elsevier Inc. All rights reserved.
http://dx.doi.org/10.1016/j.apm.2013.10.046

Corresponding author. Tel.: +91 9430764860; fax: +91 651 2275401.

E-mail addresses: drbimalmishra@gmail.com (B.K. Mishra), samir.phd2009@gmail.com (S.K. Pandey).
Applied Mathematical Modelling 38 (2014) 21732179
Contents lists available at ScienceDirect
Applied Mathematical Modelling
j our nal homepage: www. el sevi er . com/ l ocat e/ apm
model with vertical transmission using vaccination (that is, run of anti-virus software time and again with full efcacy) such
that we can get temporary recovery from the infection of worms.
The rest parts of this paper is structured as follows: In Section 2, we formulate the e-epidemic SEIS-V worm model and
develop the system of differential equations, in Section 3, we introduce modied reproductive number and discuss the local
stability conditions for worm free equilibrium, in Section 4, we establish that the worm free equilibrium is globally asymp-
totically stable if modied reproductive number is less than one, in Section 5, we discuss the stability of the system devel-
oped using numerical methods and MATLAB and nally, in Section 6, we conclude this paper.
2. The e-epidemic SEIS-V worm model
In any computer network, to derive the model equation, the total number of nodes (N) is divided into four classes: fully
Susceptible nodes (S), Exposed nodes (E), Susceptible nodes with anti-virus software (V), Infected nodes (I), that is,
S E I V N: 1
In this model, the ow of worms is from class S to class E, class S to class V, class E to class I, class V to class I and class V to
class S (due to lack of latest version of anti-virus software) which can be seen in Fig. 1. The transmission between model
classes can be expressed by the following system of differential equations:
dS
dt
bN
bSI
N
f NS pS cI eV;
dE
dt

bSI
N
f NE gE;
dI
dt
gE f NI aI cI
rbVI
N
hb;
dV
dt
pS
rbVI
N
eV f NV:
2
In this model, we assume that the anti-virus software have full efcacy, but in reality, the efcacy of such software is usually
not 100%. Hence, we need to take this into account when we formulate epidemic models with anti-virus software (shown by
ow chart in Fig. 1) where we suppose that the birth rate coefcient is b, the natural death rate coefcient depends on the
population size N, denoted by f(N), the anti-virus software is given to both attached nodes and susceptible nodes, standard
incidence is chosen. The software is not completely efcacious and r (0 6 r 6 1) describes the inefcaciousness of the soft-
ware such that the infection incidence from the inefcaciously vaccinated nodes is rbVI/N; p is the anti-virus software rate
coefcient, b is the rate of contact, g is the rate coefcient of exposed class, a is the death rate coefcient due to the attack of
worms, c is the rate coefcient from class I to class S, e is rate coefcient from class V to class S. The model also assumes that
the ow of worms between the model classes can be spread through vertical transmission. In this case, the attack of worms
through vertical transmission increases at the rate h and introduced at the class I.
3. Worm free equilibrium & modied reproductive number
The modied reproductive number or simply the reproductive number (R
v
) is the average number of secondary infections
produced by one infected computer nodes. This can be obtained through the local analysis of the stability of the trivial equi-
librium point. If R
v
< 1, which implies that the worms fade out from the network eventually. If R
v
> 1, which means the
worms persists at a constant endemic level in the computer network.
We now get the modied reproductive number for the worm control or eradication and analyze the worm-free equilib-
rium. Our analysis will be restricted to the dynamics of the three equations of the system (2). By the Eq. (1) and the system
(2), we get,
dN
dt
b f NN aI hb which is also called as equation for the total population (i.e. total nodes) [30,19]. Thus,
b ! f N as t ! 1.
This shows that, the feasible region,
U fS; E; I; V : S; E; I; V P0; S E I V Ng
V
I
bN S E I b V
f(N)S pS f(N)E f(N)I I f(N)V
Fig. 1. Schematic diagram for the ow of worms in computer network.
2174 B.K. Mishra, S.K. Pandey / Applied Mathematical Modelling 38 (2014) 21732179
is a positive invariant set for the model [30,19].
In the absence of infection, the model has a unique worm-free equilibrium x
0
S
0
; E
0
; 0; V
0
, which can be derived by
taking
dS
dt
0,
dE
dt
0,
dV
dt
0, I = 0 and put f(N) = b, we get, S
0

bbeN
bpbepe
, V
0

pbN
bpbepe
, E = 0 = I.
Further, to study the stability of worm-free equilibrium, the system (2) is linearized around x
0
by taking,
St S
0
st; Vt V
0
vt and It it: 3
Then using Eq. (1) (i.e. E = N S I V), we have,
ds
dt
b ps ev ci
bb e
b p e
i;
dv
dt
ps b ev
rbp
b p e
i;
di
dt
gs gv
rbp
b p e
b a c g

i:
4
The fundamental matrix of the system (4) consists of the solutions x
j
s
j
t; v
j
t; i
j
t; j = 1, 2, 3 which satisfy the
conditions:
x
1
0 1; 0; 0; x
2
0 0; 1; 0; x
3
0 0; 0; 1:
We have the set of solutions given by,
x
1

expb pt
0
0
0
B
@
1
C
A; x
2

0
expb et
0
0
B
@
1
C
A and x
3

0
0
exp
brp
bpe
b a c g

t
h i
0
B
@
1
C
A:
Now, the local stability of x
0
is determined by the modulus of the eigenvalues of the matrix M(t) = [x
1
(t), x
2
(t), x
3
(t)]. These
eigenvalues are k
1
expb pt, k
2
expb et and k
3
exp
brp
bpe
b a c gt. Since 0 < k
1
, k
2
< 1, the equilib-
rium is locally asymptotically stable, if, k
3
< 1, that is,
brp
bpebacg
< 1, that is R
v
< 1, where, R
v

brp
bpebacg
is the mod-
ied reproductive number and worm-free equilibrium is locally asymptotically stable, if R
v
< 1 and unstable, if R
v
> 1.
4. Global stability of the worm-free equilibrium
Here, we will prove a theorem which shows that the local and global stability of worm-free equilibrium are equivalent.
Theorem. If R
v
< 1, then the worm-free equilibrium is globally asymptotically stable.
Proof. Since U is the positively invariant region, it is sufcient to establish the global stability of x
0
in U. Since for all t 2 R,
S = N E I V, then from the system (2),
0 10 20 30 40 50 60 70 80 90 100
0
2
4
6
8
10
12
14
16
18
SUSCEPTIBLE S
V
A
C
C
I
N
A
T
E
D


V
b = 0.01, p = 0.01, Epsilon = 0.02
b = 0.02, p = 0.02, Epsilon = 0.03
b = 0.03, p = 0.03, Epsilon = 0.04
Fig. 2. Dynamical behavior of SV-plane with b = 0.01, p = 0.01, 0.02, 0.03, b = 0.01, 0.02, 0.03, a = 0.09, g = 0.03, h = 0.05, e = 0.02, 0.03, 0.04, r = 0.03, c = 0.03.
B.K. Mishra, S.K. Pandey / Applied Mathematical Modelling 38 (2014) 21732179 2175
dV
dt
pN pE pI
rbVI
N
eV b p eV;
dV
dt
6 b p eV:
Using Eq. (3),
dv
dt
6 b p eV
0
V
dv
dt
6 b p e
pN
b p e
V

:
Using Comparison theorem [39], we get,
lim
t!1
sup
lPt
Vl 6
pN
b p e
: 5
Then for a given e
0
> 0, there exists a t
0
> 0, such that, Vt 6
pN
bpe

e
0
e
It follows from the system (2), using similar approach,
for t > t
0
,
ds
dt
6 e
0
b p
beN
bpe
S

.
Consequently,
lim
t!1
sup
lPt
Sl 6
b eN
b p e
: 6
0 10 20 30 40 50 60 70 80 90 100
0
10
20
30
40
50
60
70
80
90
100
TIME IN MINUTES
C
L
A
S
S
E
S

O
F

N
O
D
E
S

I
N

H
U
N
D
R
E
D
S
Susceptible
Exposed
Infectious
Vaccinated
Fig. 3. Dynamical behavior of the system (2) with b = 0.01, p = 0.01, b = 0.01, a = 0.09, g = 0.03, h = 0.05, e = 0.02, r = 0.03, c = 0.03.
0 2 4 6 8 10 12 14
0
1
2
3
4
5
6
7
8
9
Infectious
V
a
c
c
i
n
a
t
e
d
Fig. 4. Dynamical behavior of IV-plane with b = 0.01, p = 0.01, b = 0.01, a = 0.09, g = 0.03, h = 0.05, e = 0.02, r = 0.03, c = 0.03.
2176 B.K. Mishra, S.K. Pandey / Applied Mathematical Modelling 38 (2014) 21732179
Using Eqs. (5), (6) and system (2), for e
0
> 0 (however small), we get,
dI
dt
6 b a c
R
v
b

2 re
0
b a c

b 1

; for t Pt
1
> t
0
: 7
That is, It 6 exp b a c R
v
1
2re
0
b
bac

t
h i
.
Since, R
v
< 1, for e
0
> 0 (sufciently small), we can see that, R
v
1
2re
0
b
bac
< 0 and hence by Eq. (7), 0 6 lim
t!1
It 6 0,
that is, lim
t!1
It 0.
We now show that each solution with an initial condition in U approaches x
0.
For this, we consider the system (when
I = 0),
dS
dt
bN b pS eV X;
dV
dt
pS b eV Y: 8
0
20
40
60
80
100
0
5
10
15
0
2
4
6
8
10
Susceptible
Infectious
V
a
c
c
i
n
a
t
e
d
Fig. 5. Dynamical behavior of SIV-plane with b = 0.01, p = 0.01, b = 0.01, a = 0.09, g = 0.03, h = 0.05, e = 0.02, r = 0.03, c = 0.03.
0
20
40
60
80
0
5
10
15
0
2
4
6
8
10
Exposed
Infectious
V
a
c
c
i
n
a
t
e
d
Fig. 6. Dynamical behavior of EIV-plane with b = 0.01, p = 0.01, b = 0.01, a = 0.09, g = 0.03, h = 0.05, e = 0.02, r = 0.03, c = 0.03.
B.K. Mishra, S.K. Pandey / Applied Mathematical Modelling 38 (2014) 21732179 2177
Now, we have the Dulac functison D = 1/V for V > 0, then, we get,
@
@S
DX
@
@V
DY
b p
V

pS
V
2
< 0:
Thus, the system (8) has no limit cycle and hence the model (2) has no limit cycle in the SV-plane for the different values
of the parameters (depicted in Fig. 2). Since lim
t!1
It 0, it follows that x
0
is the set of every solution in U [30,19]. Then, x
0
is the globally asymptotically stable. This shows that, R
v
< 1 guarantees the worm eradication. h
5. Numerical methods and discussion
Numerical methods (RungeKutta Fehlberg fourth-fth order methods) are employed to solve and simulate the system
(1) of equations developed under different parameters and the behavior of susceptible, exposed, infected and vaccinated
(anti-virus software with latest version) nodes with respect to time are observed which is depicted in Fig. 3. The analysis
of Fig. 3 says that the system is asymptotically stable. The effect of anti-virus (with latest version) treatment on infected
nodes is also observed and depicted in Fig. 4. Here, anti-virus software plays a vital role for the recovery of the nodes from
attack of worms. The more we use this software, the more is the recovery (depicted in Figs. 5 and 6), that is, the computer
network will be safe from the attack of worms. The vertical transmission parameter h plays an important role for the direct
spread of worms, so its parametric value (h = 0.01, 0.07, 0.15) is well considered in simulations. We have also observed that
as the value of h increases, attack of worms increases but nally infection vanishes due to antivirus software (Fig. 7). By anal-
ysis of the model and simulation studies, it investigates that the time of anti-virus technique and user observation are essen-
tial factors to control the worm transmission.
6. Conclusion
A dynamic e-epidemic SEIS-V model has been developed for the transmission of worms using vertical transmission in the
computer network. The transmission of worms in network can be through horizontal and vertical transmission. We assume
that the worms possess a non-negligible latent period & infected nodes will stay in the latent period before they become
infectious. We have discussed the characteristic of the modied reproductive number and established that if R
v
6 1, the
worm free equilibrium is globally stable in the feasible region and the worms fade out from the network, whereas if
R
v
> 1, the worm free equilibrium is unstable. This model will be highly useful to analyze the efciency of antivirus software.
The antivirus software will be highly efcient if the rate of recovery of nodes from infectious nodes is very high and crashing
of the nodes due to the attack of worms in the presence of the antivirus software is very less. Thus these types of mathemat-
ical models will be very helpful in developing good antivirus software, keeping into mind the attacking behavior of worms,
which may reduce the attack.
References
[1] W.O. Kermack, A.G. McKendrick, Contributions of mathematical theory to epidemics, Proc. R. Soc. Lond. Ser. A 115 (1927) 700721.
[2] W.O. Kermack, A.G. McKendrick, Contributions of mathematical theory to epidemics, Proc. R. Soc. Lond. Ser. A 138 (1932) 5583.
[3] W.O. Kermack, A.G. McKendrick, Contributions of mathematical theory to epidemics, Proc. R. Soc. Lond. Ser. A 141 (1933) 94122.
0
50
100
0
5
10
15
0
2
4
6
8
10
TIME (IN MINUTES)
INFECTIOUS I
V
A
C
C
I
N
A
T
E
D


V
Theta = 0.15
Theta = 0.07
Theta = 0.01
Fig. 7. Dynamical behavior of the system (2) with b = 0.01, p = 0.01, b = 0.01, a = 0.09, g = 0.03, h = 0.01, 0.07, 0.15, e = 0.02, r = 0.03, c = 0.03.
2178 B.K. Mishra, S.K. Pandey / Applied Mathematical Modelling 38 (2014) 21732179
[4] E. Gelenbe, Dealing with software viruses: A biological paradigm, Inform. Sec. Tech. Rep. 12 (4) (2007) 242250.
[5] Erol Gelenbe, Keeping viruses under control, in: 20th International Symposium Computer and Information Sciences ISCIS 2005, Lecture Notes in
Computer Science, vol. 3733, Springer, 2005, pp. 304311.
[6] Erol Gelenbe, Varol Kaptan, Yu Wang, Biological metaphors for agent behavior, in: 19th International SymposiumComputer and Information Sciences
ISCIS 2004, Lecture Notes in Computer Science, vol. 3280, Springer-Verlag, 2004, pp. 667675.
[7] J.R.C. Piqueira, F.B. Cesar, Dynamic models for computer virus propagation, Math. Prob. Eng., http://dx.doi.org/10.1155/2008/940526.
[8] J.R.C. Piqueira, B.F. Navarro, L.H.A. Monteiro, Epidemiological models applied to virus in computer network, J. Comput. Sci. 1 (1) (2005) 3134.
[9] C.C. Zou, W.B. Gong, D. Towsley, L.X. Gao, The monitoring and early detection of internet malicious codes, IEEE/ACM Trans. Network 13 (5) (2005) 961
974.
[10] J.O. Kephart, S.R. White, D.M. Chess, Computers and epidemiology, IEEE Spectr. (1993) 2026.
[11] M.J. Keeling, K.T.D. Eames, Network and epidemic models, J. R. Soc. Interface 2 (4) (2005) 295307.
[12] M.E.J. Newman, S. Forrest, J. Balthrop, Email networks and the spread of computer virus, Phys. Rev. E 66 (2002) 232369.
[13] S. Forest, S. Hofmeyr, A. Somayaji, T. Longstaff, Self-nonself discrimination in a computer, in: Proceeding of IEEE Symposium on Computer Security and
Privacy, 1994, pp. 202212.
[14] C.C. Zou, W. Gong, D. Towsley, Malicious codes propagation modeling and analysis under dynamic quarantine defense, in: Proceeding of the ACM CCS
Workshop on Rapid Malcode, ACM, 2003, pp. 5160.
[15] D. Moore, C. Shannon, G.M. Voelker, S. Savage, Internet quarantine: requirements for containing self-propagating code, in: Proceeding of IEEE
INFOCOM2003, IEEE, 2003, pp. 8591.
[16] B.K. Mishra, N. Jha, SEIQRS model for the transmission of malicious objects in computer network, Appl. Math. Model. 34 (2010) 710715.
[17] T. Chen, N. Jamil, Effectiveness of quarantine in malicious codes epidemic, in: IEEE International Conference on Communications 2006, IEEE, 2006, pp.
21422147.
[18] B.K. Mishra, D.K. Saini, Mathematical models on computer viruses, Appl. Math. Comput. 187 (2) (2007) 929936.
[19] B.K. Mishra, S.K. Pandey, Dynamic Model of worms with vertical transmission in computer network, Appl. Math. Comput. 217 (21) (2011) 84388446.
[20] Ma.M. Williamson, J. Leill, An Epidemiological Model of Virus Spread and cleanup, 2003, http://www.hpl.hp.com/techreports/.
[21] J.O. Kephart, A biologically inspired immune system for computers, in: R.A. Brooks, P. Maes (Eds.), Articial life IV: Proceedings of the Fourth
International Workshop on Synthesis and Simulation of Living Systems, MIT Press, Cambridge, MA, 1994, pp. 130139.
[22] M. Draief, A. Ganesh, L. Massouili, Thresholds for virus spread on network, Ann. Appl. Probab. 18 (2) (2008) 359369.
[23] N. Madar, T. Kalisky, R. Cohen, D. Ben Avraham, S. Havlin, Immunization and epidemic dynamics in complex networks, Eur. Phys. J. B 38 (2004) 269
276.
[24] R. Pastor-Satorras, A. Vespignani, Epidemics and Immunization in Scale-Free Networks, Handbook of Graphs and Network: From the Genome to the
Internet, Willey-VCH, Berlin, 2002.
[25] B.K. Mishra, D.K. Saini, SEIRS epidemic model with delay for transmission of malicious objects in computer network, Appl. Math. Comput. 188 (2)
(2007) 14761482.
[26] B.K. Mishra, S.K. Pandey, Fuzzy epidemic model for the transmission of worms in computer network, Nonlinear Anal.: Real world Appl. 11 (2010)
43354341.
[27] B.K. Mishra, N. Jha, Fixed period of temporary immunity after run of anti-malicious software on computer nodes, Appl. Math. Comput. 190 (2) (2007)
12071212.
[28] B.K. Mishra, S.K. Pandey, Effect of antivirus software on infectious nodes in computer network: a mathematical model, Phys. Lett. A 376 (2012) 2389
2393.
[29] S. Datta, H. Wang, The effectiveness of vaccinations on the spread of email-borne computer virus, in: IEEE CCECE/CCGEL, IEEE, 2005, pp. 219223.
[30] M.E. Alexander, S.M. Moghadas, P. Rohani, A.R. Summers, Modeling the effect of a booster vaccination on disease epidemiology, J. Math. Biol 52 (2006)
290306.
[31] R.M. May, A.L. Lloyd, Infection dynamics on scale-free networks, Phys. Rev. E 64 (066112) (2001) 13.
[32] W.T. Richard, J.C. Mark, Modeling virus propagation in peer-to-peer networks, in: IEEE International Conference on Information, Communication and
Signal Processing (ICICS 2005), pp. 981985.
[33] H. Dong, Z. Wang, H. Gao, Observer-based H-innity control for systems with repeated scalar nonlinearities and multiple packet losses, Int. J. Robust
Nonlinear Control, 1049-8923 20 (12) (2010) 13631378.
[34] Z. Wang, D.W.C. Ho, H. Dong, H. Gao, Robust H-innity nite-horizon control for a class of stochastic nonlinear time-varying systems subject to sensor
and actuator saturations, IEEE Trans. Automat. Control, 0018-9286 55 (7) (2010) 17161722.
[35] B. Shen, Z. Wang, Y.S. Hung, Distributed consensus H-innity ltering in sensor networks with multiple missing measurements: the nite-horizon
case, Automatica, 0005-1098 46 (10) (2010) 16821688.
[36] B. Shen, Z. Wang, H. Shu, G. Wei, Robust H-innity nite-horizon ltering with randomly occurred nonlinearities and quantization effects, Automatica,
0005-1098 46 (11) (2010) 17431751.
[37] B. Shen, Z. Wang, X. Liu, Bounded H-innity synchronization and state estimation for discrete time-varying stochastic complex networks over a nite-
horizon, IEEE Trans. Neural Networks, 1045-9227 22 (1) (2011) 145157.
[38] H. Dong, Z. Wang, D.W.C. Ho, H. Gao, Variance-constrained H-innity ltering for nonlinear time-varying stochastic systems with multiple missing
measurements: the nite-horizon case, IEEE Transactions on Signal Processing, 1053-587X 58 (5) (2010) 25342543.
[39] V. Lakshmikantham, S. Leela, Differential and Integral Inequalities: Theory and Applications, Academic Press, NewYork, 1969.
B.K. Mishra, S.K. Pandey / Applied Mathematical Modelling 38 (2014) 21732179 2179