Stochastic Stabilization of Malware Propagation in Wireless Sensor Network via Aperiodically Intermittent White Noise

In this paper, we propose a novel heterogeneous model to describe the propagation dynamics of malware (viruses, worms, Trojan horses, etc.) in wireless sensor networks. Our model takes into consideration different battery-level sensor nodes contrary to existing models. In order to control the spread of malware, we design an aperiodically intermittent controller driven by white noise, which has striking advantages of lower cost and more flexible control strategy. We give a distinct condition on stability in probability one using graph-theoretical Lyapunov function and stochastic analysis method. Our results show that the nonlinear malware propagation system can be stabilized by intermittent stochastic perturbation under the intermittent time related to stochastic perturbation intensity. Our theoretical results can be applied to understand the observed mechanisms of malware and design interventions to control the spread of malware. Numerical simulations illustrate our analytical results clearly.


Introduction
With the improvement of wireless sensor technology, wireless sensor networks (WSNs) are used in many new scenarios: intelligent transportation network, water quality monitoring, military target detection, etc. Due to wireless feature and special structure of wireless sensor network, it is vulnerable to malware attack which can eavesdrop and paralyze the network [1][2][3]. Consequently, mathematical modeling and control strategies of malware propagation are of vital importance in order to predict its effects and defend it. In recent years, many scientific literatures have appeared, specifically, global model and the related global behaviour of WSNs by the concept of epidemiology. In the epidemic system, all people separate into different compartments such as S (Susceptible), E (Exposed), I (Infectious), R (Recovered), and so on. Toutonji et al. [4] proposed a VEIS-V worm attack propagation model which considers security countermeasures during worm attack. Bimal and Keshri [5] established a compartments based on the classic SIR epidemic model. Li et al. [19] considered a SIR network malware propagation model; Li's SIR model is different from del Rey's heterogeneous model which considers tree-based networks. Inspired by stifler state in the rumor spreading model, Hosseini and Azgomi [20] proposed a SEIRS model. ey assumed that nodes could be vaccinated and immunized to the malware infection. All of the above models did not consider sensor's energy consumption, which affects seriously the information transmission quality. Nodes may not have enough energy to propagate malware by sending information to their neighbors. Proceeding from this angle, infected state should be separated into infected state with high capacity level and infected state with low capacity level. It is worth to mention that most of the results concentrate on dynamic analysis of the deterministic model (global or individual-based model) by the basic reproduction number R 0 , which is calculated by the next generation matrix method. But there are rare results on malware control strategies if malware becomes endemic (R 0 > 1).
As is well known, stochastic noises can stabilize an unstable system [21][22][23][24][25][26][27]. Its application extends to many practical areas, such as sleep improvement, tone discrimination [28], and financial stability [21,23]. From the consideration of reducing control cost and control time, discontinuous controllers have been designed to stabilize a given system such as feedback control [29][30][31][32], pinning control [33], impulsive control [34], adaptive control [35][36][37][38][39][40], and intermittent control [41][42][43][44]. As for intermittent control, control time is divided into periodic and aperiodic type. Periodically intermittent control has been studied by many authors especially in synchronization problems. Zhang et al. [41] designed a periodically intermittent linear controller driven by white noises to stabilize an unstable memristor-based system. As Liu and Chen [45,46] have mentioned before, the requirement of periodicity is unusual in real world application, while aperiodically intermittent control strategy needs a complex management to study the dynamic behaviour of the controlled system. We highlight Liu and Chen [45,46] who investigated aperiodically intermittent deterministic controller for complex coupled deterministic system, and sufficient conditions have been given to guarantee global synchronization.
Stochastic control has been proved to be sufficiently useful in many fields. But for the best of our knowledge, there is no work on aperiodically intermittent stochastic stabilization for malware propagation; the application on malware propagation needs to be explored. is motivates us to investigate this kind of scheme oriented to the security issue for WSNs. In this paper, we will design an aperiodically intermittent control strategy. In this strategy, we will focus on quantitative conditions for network to stabilize. e main contributions can be summarized as follows: (i) Compared with the previous works on malware spreading models on WSNs, our SI L I H A model is a new model which considers both individual behaviours and sensor capacitance. It can be used to solar heterogeneous network system. (ii) Compared with the previous works on spreading control, the control itself is random perturbation and the control time is aperiodically intermittent rather than continuous, and starting time and control length are arbitrary. We can control steady rate autonomously by adjusting the work width. In this angle, our control strategy is more flexible. e paper is organized as follows. In Section 2, we establish a new malware propagation model on WSNs at first, which considers different battery-level sensor nodes. en, we analyze the dynamic behaviour of the model. In Section 3, we design an aperiodically intermittent stochastic noise controller to control malware spreading. e control intensity expression reflects the relationship between system parameters and network topological structure. In Section 4, numerical simulations of the proposed model are given to show the power of aperiodically intermittent noise controller. Finally, we conclude the paper in Section 5.

Model Formulation
According to topological structures of WSNs, all nodes partition into n groups based on different nodal degrees. Each group i is further compartmentalized into four states: (1) Susceptible (S i ): the nodes in this state are prone to being infected by the implantation of malware and will become an infected one if it connects to an infected node. (2) Infectious with high energy level (I H i ): the nodes in this state have already been infected by malware successfully and have stored up enough energy to continue propagating the malware.
(3) Infectious with low energy level (I L i ): the nodes in this state have already been infected by malware successfully but do not have sufficient energy to propagate malware by sending information to their neighbors. (4) Antimalware program activated (A i ): when nodes in state I H and state I L are detected to be infected, the nodes will activate antimalware program to clear up the infection. e node activated by the antimalicious program will no longer be invaded by the same malware.
Based on the sensor features and transition characters, the malware propagation process is described as follows: when a susceptible node connects to an infected node, the susceptible node with high energy level becomes an infected node with probability β 1 and the susceptible with low energy level node becomes an infected node with probability β 2 . Both the contact rates β 1 and β 2 are positive constants. e malware itself will not cause additional cost to infected node. e infected node with low energy level can become infected 2 Complexity node with high level if it is recharged, and the charge rate is a positive constant c. e influence of the malware on the natural mortality rate of infected nodes should be ignored and nodes in four states are assigned equal natural mortality rate η which satisfies η ≥ 0. Figure 1 shows state transition diagram of the model. us, our model can be formulated by the following ordinary differential equations: with initial values where i � 1, . . . , n, represents the nodal degree. Θ(t) represents the probability that an edge connects to an infectious sensor node at time t. Its expression is where 〈j〉 � n j�1 jp(j) represents the average nodal degree. p(j) represents the probability that a randomly chosen sensor node has degree j, n j�1 p(j) � 1. Obviously, for all i and t ≥ 0, en, we can deduce system (1) into About the dynamic behaviour of the above deterministic model (5), we give the following corollary.
which depends on the fluctuations of the degree distribution and system parameters. Since malware will die out when R 0 < 1, malware prevention measures can be designed to decrease R 0 , such as decreasing node connectivity to decrease the contact rates β 1 , β 2 and increasing monitoring efforts on infective nodes to increase the detective rate μ 2 .

Control Strategy
In this section, we mainly concentrate on the control strategy of malware propagation. In the context of aperiodically intermittent stochastic noise stabilization of the complex heterogeneous network system, we propose a design procedure for the noise control input to stabilize system (5). At first, we consider a stochastic noise driven by Brownian motions and a g-type structure of the controller. e controller's mathematical expression is is a 3n-dimensional Brownian motion corresponding to system variables and _ B(t) is the related white noise. To be flexible and to save cost, we design the control time as aperiodically intermittent type, which admits uncertain rest times. We give a sketch of aperiodically intermittent control strategy in Figure 2, under the perturbation of g-type; the time span [t k , t k+1 ) contains the work time [t k , t k + c k ) and the rest time [t k + c k , t k+1 ), and c k denotes the k-th noise width. Naturally, the noise widths satisfy 0 ≤ c k ≤ t k+1 − t k . e stochastic control input system is where Complexity For the aperiodically intermittent perturbation strategy, the start time and the noise width might be different, but the total perturbation time ratio should be fixed in the long term. Mathematically, there exists a positive scalar τ, such that the above time nodes satisfy the following assumption: We call τ as the control time ratio. Moreover, we assume g(t, 0) ≡ 0 for stochastic stability analysis, which guarantees the existence of a trivial solution x(t, t 0 , 0) ≡ 0.

Theorem 1. If the aperiodically perturbed intensity σ satisfies
, then the infected nodes will die out with probability one.
Proof. Define a matrix M: We can calculate that . . , ω n ) be the eigenvector of M corresponding to ρ(M); then, we have where ω i > 0, i � 1, 2, . . . , n. Define a Lyapunov function: and 0 < a < 1/2 is a constant. Using Itô formula, we obtain where Note that f(x) can be regarded as a linear growth function of S i ; as S i ≤ N i � Λ/η for t ≥ t 0 , we can derive that i-th work width i-th rest width Figure 2: e sketch of aperiodically intermittent control strategy. 4 Complexity where E represents an elementary matrix or an identity matrix. By condition (11), the above inequation becomes en, we discuss the time t in different time intervals. Obviously, there exists one positive integer m such that t ∈ [t m , t m+1 ).
In eorem 1, we give the global stability of the malwarefree equilibrium. It is worth to mention that we separate interaction terms in the stochastic model (7) by using the group-theoretic approaching method, and then the infected groups I L i (t) and I H i (t) can be considered separately. Calculating the Lyapunov exponents, we obtain the global stability of the malware-free equilibrium.

□
Proof of Corollary 1. Set σ � 0; then, stochastic model (7) becomes deterministic model (5). e control intensity mathematical expression becomes It implies which means R 0 < 1. Applying eorem 1, the malware-free equilibrium is globally asymptotically stable. To get the endemic equilibrium solution S * i , I L * i , I H * i , A * i , the right side of system (1) should equal to zero. e solution definitely satisfies the restrictive condition on the total quality of nodes: Combining and solving all the above equations, we can obtain an equation containing Θ(t) and S * i , I L * i , I H * i , A * i . To guarantee a nontrivial solution of it, R 0 need to be bigger than one, and thus we obtain that there is an endemic equilibrium when R 0 > 1. en, we prove the malware will be persistent when R 0 > 1. If R 0 > 1, the derivative of function V becomes positive for S i (t)(i � 1, 2, . . . , n) sufficiently close to Λ/η except when 1, 2, . . . , n).
is establishes the malware-free equilibrium's unstable property. Since the necessary and sufficient condition for uniform persistence is equivalent to the malwarefree equilibrium being unstable, system (1) is persistent. □ Remark 2. If t k+1 − t k � T and c k � δ for all k ∈ N, system (7) becomes a periodic intermittent system. e minimum control intensity becomes is agrees with eorem 1 in Zhang et al. [41]. Our results can be regarded as a generalization of Zhang et al. [41].

Remark 3.
According to the expression of σ, the control intensity depends on the network topological structure and system parameters. Apparently, if the degree distribution of WSNs follows a power law (like a scale-free network) and the number of nodes is huge enough, then (〈j 2 〉/〈j〉) ⟶ ∞, so the absence of control intensity, i.e., σ ⟶ ∞, is observed. Moreover, the disappearance of malware is related to perturbation time ratios τ. us, we can enhance or weaken noise intensity to decrease or increase the corresponding control time ratios. Control strategy would be designed based on our theoretical results.

Numerical Simulation
e aperiodically intermittent noise controller can stabilize system (1) under the intensity σ. From the expression, control intensity is directly proportional to the contact rates β 1 , β 2 and inversely proportional to the control time ratio. Using Milstein's higher order method [47], the discretized equations for the system (7) are Complexity where ξ i are independent random variables N (0, 1), i � 1, 2, . . . , n. Generally, we assume WSN is a scale-free network with the power law distribution P(j) � aj 3 , where a satisfies n j�1 aj 3 � 1. We set the initial values to S i (0) � 900, I L i (0) � 50, I h i � 50, A i � 0, i � 1, 2, . . . , n and n � 50. Choosing parameter values in Table 1, the reproduction number is According to Corollary 1, the malware is persistent. e top two pictures in Figure 3 show that the solution of system (1) converges to the endemic equilibrium. e last two pictures in Figure 3 show clearly that the number of infected nodes I H k and I L k converge to a positive constant. To stabilize the above deterministic model, we choose different control intensities σ by adjusting control time to compare the stabilization effects.
(i) Let control time ratio τ � 0.5 and initial value (900, 50, 50, 0, . . ., 900, 50, 50, 0). Generating the  aperiodically intermittent time intervals randomly, we give two examples in the middle two pictures of Figure 4. We can calculate that σ 2 � 0.04 > 0.0254; according to eorem 1, I H k and I L k all tend to zero; Figure 4 shows clearly that the malware disappears. (ii) Increase the control time ratio to τ � 0.8; specific aperiodically intermittent time intervals are shown in the middle two pictures of Figure 5. We can obtain that σ 2 � 0.04 > 0.0211, the condition in eorem 1 is satisfied, and I H k and I L k all tend to zero. e top two and the last two pictures of Figure 5 show clearly that all the infected nodes go to zero. (iii) Adding control time to full time. Figure 6 shows the solution of system (7) converges to the malware-free equilibrium, I H k and I L k all tend to zero, and the malware nodes will disappear. Comparing Figures 4-6, we can conclude that the bigger the perturbation intensity is, the faster the steady speed is.

Conclusion
Based on network topology and malware propagation property, we established a heterogeneous wireless sensor network model which considers the influence of energy consumption to node communication. e basic reproduction number R 0 has been given which determines the extinction or persistence of malware: if R 0 < 1, the malware will die out; if R 0 > 1, the malware will be persistent. To control malware spreading, we design a kind of aperiodically intermittent stochastic noise controller, starting time and control length of which are arbitrary. We can control steady rate autonomously by adjusting the work width. Using the straightening operator and Markov inequality, we calculate the specific stochastic noise intensity σ, which is inversely proportional to intermittent time. When stochastic noise controller's intensity is greater than σ, malware propagation will be controlled with probability 1. Otherwise, the malware program will destroy the wireless sensor networks. is stochastic stabilization method presents a new theoretical strategy for wireless sensor network security: stochastic noise controller. Numerical simulations are given to illustrate the stabilization effect of stochastic noise.

Data Availability
No data were used to support this study.

Conflicts of Interest
e authors declare that they have no conflicts of interest.