Propagation Effect of a Virus Outbreak on a Network with Limited Anti-Virus Ability

This paper describes a new computer virus spreading model which takes into account the possibility of a virus outbreak on a network with limited anti-virus ability. Then, the model is investigated for the existence of equilibria and their stabilities are proved and illustrated. Moreover, it is found that these two factors are not only relative to the threshold value determining whether the virus becomes extinct or not, but that they are also relative to the virus epidemic levels. Theoretical and experimental results indicate that, in some ways, it would be practically possible to eradicate the virus or suppress its prevalence below a suitable level. Consequently, some suggestions are proposed that may help eradicate or suppress virus propagation over a real computer network.

To the best of our knowledge, all of the known computer virus models [1][2][3][4][5][6][7][8][9][10][11][12][13][14][15][16][17] that describe virus propagation neglect the fact that viruses possess a paroxysmal nature in common, as demonstrated when a large number of computer viruses have the possibility of an outbreak absence of aura. Furthermore, antivirus techniques always lag behind virus techniques, and thus during that investable lag from the outbreak of a new virus to the widespread application of the anti-virus software aiming to conquer this virus the computer is susceptible to the attack. As a result, the virus would not be entirely eradicated, but instead be temporarily suppressed and therefore still capable of infecting other computers, which may lead to huge losses. Almost all of the existing models assume, first, that during the time [dt, t+dt], once infected, any susceptible computer is in its latency (i.e., all of the S computers become the E ones), and secondly, that by using the anti-virus software on the affected network, the virus can be completely and immediately eliminated. However, these assumptions are inconsistent to the facts that, in general, most viruses break out suddenly. Zuo et al [30] have shown that there is no any perfect anti-virus software that can detect and clear all kinds of viruses. This paper pays attention to the spreading behaviors of a computer virus during a virus outbreak on a network with limited anti-virus ability. Accordingly, a new computer virus propagation model is proposed, which incorporates those two kinds of new state transitions. First, we give the threshold value R 0 , which determines whether the virus disappears completely or not, and find that the dynamic behavior of the proposed model is determined by it. Next, the proposed model admits a virus-free equilibrium which is globally asymptotically stable that results in virus eradication if R 0 1 and admits a virus equilibrium which is globally asymptotically stable whereas R 0 >1. System parameters are considered to analyze the dynamical behaviors of the model. It is found that (1) the outbreak probability and transmission rate due to the limited anti-virus ability are strongly relative to the threshold value R 0 , and (2) the outbreak probability and transmission rate are heavily connected with the virus epidemic levels. These results imply that, to some degree, it would be practically possible to eradicate the virus or inhibit its prevalence below a suitable level. Finally, theoretical and experimental studies reveal the effect of system parameters on virus propagation. Consequently, some suggestions are made that may help suppress virus propagation over a computer network.
In the next section, we establish a mathematical model to be discussed. In Section 3, we study the stability of the virus-free and virus equilibrium of the model, respectively. The given parameters are considered to analyze the dynamic behaviors of the model. In Section 4, we use theoretical and experimental research to reveal the effect of parameters on virus propagation to which corresponding suggestions are made. Finally, some conclusions are given in Section 5.

Mathematical Model
Based on the computer virus propagation models involving the S, E, I and other compartments in Ref. [31][32][33] and ignoring infection details, the total number of computers connected the Internet are divided into four compartments: 1. Susceptible compartments (S):The set of all external uninfected computers that are connected to the network, i.e. susceptible computers.

Exposed compartments (E):
The set of all latent computers, i.e. infected computers where all viruses are latent.

Infected compartments (I):
The set of all infected computers where all of the viruses are currently breaking out.

Recovered compartments (R):
The set of all recovered computers that have run the antivirus software.
Let S(t), E(t), I(t) and R(t) denote their numbers at time t, respectively. The involved parameters b denotes the rate at which external computers are connected to the network, β denotes the rate at which, when having a connection to one latent computer, one susceptible computer can become latent one, γ denotes the rate at which one latent computer breaks out, α denotes the recovery rate of infected computers and depends on the ability of the anti-virus software, μ denotes the rate at which one computer is removed from the network. Furthermore, since most viruses break out suddenly, with the time period [dt, t+dt], due to a possible connection with infected computers, every susceptible computer is either latent with probability (1-p) βI(t)dt, or breaks out with probability pβI(t)dt, where p>0 is a constant. Since the existing anti-virus ability of any given network is limited, the virus is temporarily suppressed with probability ε, where ε > 0 is a constant. At time t, every infected computer is either latent sequentially with probability ε or recovered with probability α.
From the work above, the transmission between the model can be expressed by the following system of differential equations: Because the first three equations in (1) are independent of R, we can consider the following reduced model: With initial conditions S(0) ! 0, E(0) ! 0, I(0) ! 0 and all the parameters are positive constants. It is easily verified that the set is positively invariant for this system.

Model Analysis
This section is devoted to understanding the dynamic behaviors of the model (2). First, we will obtain a threshold value R 0 for the model and it is defined as the number of virus-free computers that are infected by a single infected computer. It is easy to see that the model (2) always admits a virus-free equilibrium E 0 = (S 0 , 0, 0). Then let Then, Hence, next generation matrix for the model is : Again, the spectral radius R 0 of the matrix K is the basic reproduction number of the model, i.e.

The virus-free equilibrium and its stability
Model (2) always has a unique equilibrium E 0 ¼ ð b m ; 0; 0Þ. Then the characteristic equation of the linearization of model (2) Clearly, the eigenvalues are −μ and other roots are decided by the following equations: where a ¼ m þ g À pbS 0 þ ε þ a þ m; If R 0 < 1, then a = μ + γ − pβS 0 + ε + α + μ > 0, and The two roots of Eq (9) both have negative real parts, by the Hurwitz criterion we can obtain the following result: Theorem 3.1. When R 0 < 1, the virus-free equilibrium E 0 is local stability. Now, it is turn to examine the global stability of virus-free equilibrium by use of the Lyapunov direct method. The following Theorem is obtained: Theorem 3.2. When R 0 1, the virus-free equilibrium E 0 is global stability.

The virus equilibrium and its stability
Now, let us investigate the existence and stability of virus equilibrium of model (2). By calculations, the unique equilibrium E Ã is given by And the corresponding characteristic equation of the linearization of model (2) is which equals the following equation: where a 1 ¼ ðbI Ã þ mÞðg þ mÞ À ðpbS Ã À ε À a À mÞ > 0; ð16Þ It is easy to verify that a 1 a 2 -a 3 > 0 holds, then according to the Routh-Hurwitz criterion, the following theorem is given: Virus equilibrium E Ã is locally asymptotically stable when R 0 > 1. Remark 1. This Theorem expresses that, under the assumption of virus outbreak on a network with limited anti-virus ability, virus epidemic would attain a certain level, and the model admits no the periodic and chaotic dynamic behaviors.
Theorem 3.4. Virus equilibrium E Ã is globally asymptotically stable. Proof. We consider the following Lyapunov function constructed as Meanwhile, for simplicity, denote then time derivative of V(t) along the solution of Eq (2) is By using the following equations b À bS Ã I Ã À mS Ã ¼ 0; ð1 À pÞbS Ã I Ã À gE Ã þ εI Ã À mE Ã ¼ 0; pbS Ã I Ã þ gE Ã À εI Ã À aI Ã À mI Ã ¼ 0; Eq (20) can be written as Since the arithmetical mean is great than or equal to the geometrical mean, thus, 2 À x À .60), and hence the virus equilibrium is asymptotically stable (see Fig 2), i.e., the virus can maintain its infection to some extent.

Further Discussions and Suggestions
Theorem 3.2 and 3.3 tell us, to some degree, it would be possible to eradicate the virus or inhibit its epidemics below a proper level in practice. In order to do this, it is critical to have an overall knowledge of the effects of parameters on the virus propagation. By the proof of Theorem 3.1, we have Since breakout probability p and transmission rateε play a key role, then differentiating R 0 with respect to them, we can obtain: Example 5. Consider the effect ofε, p on R 0 in model (2) with parameters b = 5, β = 0.075, μ = 0.6, γ = 0.5, Fig 9 shows that R 0 is increasing with p and decreasing withε.
Next, we are ready to study the effect of parameters on virus epidemic level I Ã . A direct calculation yields: Based on analyses above, the following suggestions may help eliminate or suppress the spread of computer viruses in a real network: 1. When R 0 is well below one, Theorem 4.2 demonstrates that R 0 is more sensitive to change in p than inε. This sensitivity informs us that outbreak is more important than passive detection for computer viruses, which leads us to eliminate the virus by dissecting its logical structure [34], analysis of function of every module and their interrelation so as to uncover the source of the virus burst.
2. When R 0 is significantly greater than one, it leads us to suppress virus propagation to an acceptable level (i.e. decreasing the number of infected computers I Ã by either updating the anti-virus timely or reinstalling the system to dispel the bias of anti-virus software).