Propagation Behavior of Virus Codes in the Situation That Infected Computers Are Connected to the Internet with Positive Probability

All the known models describing the propagation of virus codes were based on the assumption that a computer is uninfected at the time it is being connected to the Internet. In reality, however, it is much likely that infected computers are connected to the Internet. This paper is intended to investigate the propagation behavior of virus programs provided infected computers are connected to the Internet with positive probability. For that purpose, a new model characterizing the spread of computer virus is proposed. Theoretical analysis of this model indicates that 1 there is a unique viral equilibrium, and 2 this equilibrium is globally asymptotically stable. Further study shows that, by taking active measures, the percentage of infected computers can be made below an acceptable threshold value.


Introduction
The past few decades have witnessed a rapid progress in computer and communication domains. This progress, however, also provides rich techniques for the development of virus programs. Consequently, antivirus software is indispensable to safeguard data and files stored in computers or transmitted through network 1 . The development of antivirus software, in turn, is preceded by a full understanding of the way that computer viruses spread.
To a certain extent, the propagation of virus codes in a collection of interacting computers is analogous to the diffusion of infectious diseases in a population. Inspired by this analogy, some classical epidemic models were modified to characterize the propagation of computer virus, and the obtained results show that the long-term behavior of virus programs 2 Discrete Dynamics in Nature and Society could be predicted 2-10 . Very recently, Yang et al. 11 introduced an interesting virus propagation model, known as the SLBS model, by considering the feature of virus codes that a computer possesses infection ability immediately when it is infected.
To our knowledge, all the known models describing the propagation of virus codes were established on the assumption that a computer is uninfected at the time it is being connected to the Internet. This assumption, however, is inconsistent with the fact that some computers are already infected at their respective connection times. Indeed, Zuo et al. 12 proved that there is no perfect antivirus software that can detect and clear all kinds of virus codes.
This paper is intended to examine the propagation behavior of virus codes in the case that infected computers are connected to the Internet with positive probability. For that purpose, a new computer virus propagation model, which incorporates in the SLBS model the possibility that infected computers are connected to the Internet, is proposed. Stability analysis of this model indicates that there is a unique viral equilibrium, which is globally asymptotically stable for any combination of the system parameters. Further investigation shows that, by taking active measures, the percentage of infected computers can be kept below an acceptable threshold value.
The remaining materials of this paper are organized in this fashion: Section 2 describes the new model. Section 3 proves the global asymptotic stability of the viral equilibrium. A few insights are drawn in Section 4 by conducting a parameter analysis. Finally, Section 5 summarizes this work.

Model Formulation
At any time, a computer i.e., node is classified as either internal or external according as it is connected to the Internet or not at that time, and the nodes all over the world are categorized into the following three classes.
i Susceptible nodes, that is, uninfected nodes.
ii Latent nodes, that is, infected nodes in which all viruses are in their respective latencies.
iii Attacked nodes, that is, infected nodes in which at least one virus is performing its behavior module.
For our purpose, the whole set of internal nodes is partitioned into the following three compartments i.e., subsets .
i S compartment: the set of all internal susceptible nodes.
ii L compartment: the set of all internal latent nodes.
iii A compartment: the set of all internal attacked nodes.
At time t, let S t , L t , and A t denote the respective concentrations of S, L, and A compartments, that is, their respective percentages in all internal nodes. Without ambiguity, S t , L t , and A t will be abbreviated as S, L, and A, respectively.
Our model is based on the following reasonable hypotheses.
H1 The total amount of internal nodes is conservative.
H2 An external node is either susceptible or latent at the time it is being connected to the Internet.
Discrete Dynamics in Nature and Society 3 H3 Due to that external susceptible nodes are connected to the Internet, at any time the concentration of S compartment increases by μ 1 .
H4 Due to that external latent nodes are connected to the Internet, at any time the concentration of L compartment increases by μ 2 .
H5 At any time an internal node is disconnected from the Internet with probability δ μ 1 μ 2 . This hypothesis is consistent with hypotheses H1 , H3 , and H4 .
H6 Due to the contact of susceptible nodes with infected nodes through the Internet, at any time an internal susceptible node is infected with probability β 1 L β 2 A.
H7 At any time an internal latent node is attacked with probability α.
H8 An internal latent node cannot be cured, which means that its user doesnot start antivirus software actively.
H9 Due to the effect of antivirus software, at any time an internal attacked node is cured with probability γ.
Based on this collection of hypotheses, the new model is formulated aṡ Because S t L t A t ≡ 1, this system can be reduced to the following planar system:L with initial conditions L 0 ≥ 0 and A 0 ≥ 0. It is easily verified that the simply connected compact set is positively invariant for this system.

Model Analysis
This section is devoted to understanding the dynamical behavior of system 2.2 within Ω.

4
Discrete Dynamics in Nature and Society

3.3
Moreover, this equilibrium is viral, that is L * A * > 0.
Proof. All the equilibria of system 2.2 are determined by the following system of equations: 3.4 Solving this system, we get E * L * , A * as the unique solution within Ω. It is trivial to verify that L * A * > 0.

Remark 3.2.
This theorem shows that the proposed system has no virus-free equilibrium and, hence, doesn't undergo any bifurcation, whereas any known computer virus propagation model undergoes fold or backward bifurcation.

Local Analysis
Next, let us examine the local stability of the viral equilibrium.

Lemma 3.3. E * is locally asymptotically stable.
Proof. Rewrite system 2.2 in the matrix-vector notation as The Jacobian of F evaluated at E * is Discrete Dynamics in Nature and Society 5 and the corresponding characteristic equation is we have

3.11
On the other hand,

3.12
By the Hurwitz criterion, the two roots of 3.7 both have negative real parts, and the claimed result follows by the Lyapunov theorem 13 .

Global Analysis
Now, it is the turn to examine the global stability of the viral equilibrium. Proof. Define D L, A 1/LA. Then, By the Bendixson-Dulac criterion 13 , the system has no periodic orbit. Proof. By the smoothness of all orbits of system 2.2 , it can be concluded that: 1 there is no periodic orbit that passes through a corner of Ω, that is, either 0,0 or 0,1 or 1,0 , 2 if there is a periodic orbit that passes through a noncorner point on ∂Ω, then this orbit must be tangent to ∂Ω at this point.
On the contrary, suppose there is a periodic orbit Γ that passes through a noncorner point L, A on ∂Ω, then there are three possibilities. Case 1: 0 < L < 1, A 0. Then we haveȦ| L,A αL > 0, implying that Γ is not tangent to ∂Ω at this point. A contradiction occurs.
Case 3: L A 1, L / 0, A / 0. Then we have d L A /dt| L,A −μ 1 − γA < 0, implying that Γ is not tangent to ∂Ω at this point, also a contradiction.
Combining the above discussions, we conclude that there is no periodic orbit that passes through a point on ∂Ω.
We are ready to present the main result of this paper. Theorem 3.6. E * is globally asymptotically stable with respect to Ω.

Remark 3.7.
This theorem shows that, with the elapse of time, the concentrations of latent nodes and attacked nodes would tend to L * and A * , respectively.     Figure 4.
From Figures 1-4 one can see that, for each of these four systems, there exists a globally asymptotically stable viral equilibrium.

Discussions
Due to the fact that the proposed model has no virus-free equilibrium, any effort in eradicating virus is doomed to failure. In practical situations, the best achievable goal is to keep the percentage of infected nodes below an acceptable threshold. For that purpose, some valuable suggestions shall be presented in this section.
Proof. The claimed result holds by combining Theorem 4.1 with 3.10 .
Proof. The claimed result holds by Theorem 4.1.
Proof. The claimed result holds by Theorem 4.1.
The proof is complete.
Remark 4.9. This theorem states that u is increasing with β 1 , β 2 , and μ 2 . Hence, another means of suppressing the concentration of infected nodes is to reduce these parameters.
Finally, examine the dependency of u : L * A * on γ and δ, respectively. Proof. By means of the implicit differentiation, it is derived that ∂u ∂γ
Remark 4.11. This theorem states that in some cases u is decreasing with γ and δ. Thus, still another means of inhibiting the concentration of infected nodes is to enhance these parameters.

Summary
A new model describing the spread of computer virus has been proposed, under which infected computers are assumed to be probably connected to the Internet. To our knowledge, this is the first model with this reasonable assumption. Qualitative analysis of this model has shown that, entirely different from any previously proposed model, the new model admits no virus-free equilibrium. Rather, it possesses a globally asymptotically stable viral equilibrium. Furthermore, it has been indicated that, by adjusting some system parameters, the concentration of infected computers can be reduced . This work provides a new insight into the modeling of propagation of computer virus, which, in our opinion, would arouse considerable interest from the computer virus community.