research article modeling and analyzing the spread of ... · 0.2 0.1 0 1 f : e change gure of...

Research ArticleModeling and Analyzing the Spread of Flash DiskWorms via Multiple Subnets

Guihua Li,1,2 Zhenzhen Peng,2 and Lipeng Song3

1School of Mathematics, Nanjing Normal University, Nanjing, Jiangsu 210046, China2Department of Mathematics, North University of China, Taiyuan, Shan’xi 030051, China3Department of Computer Science and Technology, North University of China, Taiyuan, Shan’xi 030051, China

Correspondence should be addressed to Guihua Li; [email protected]

Received 18 June 2014; Accepted 15 July 2014

Academic Editor: Kaifa Wang

Copyright © 2015 Guihua Li et al. This is an open access article distributed under the Creative Commons Attribution License,which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

The Flash Disk worms, spreading via both Web-based scanning and removable devices between multiple subnets, have become aserious threat to the Internet, especially those physically isolated subnets. We present a model which incorporates specific featuresof these worms in this paper.Then, we analyze the dynamic behaviors of themodel when one subnet is considered. Analytical resultshows that the Flash Disk worm can self-perpetuate when𝑅0

𝑖> 1 and will die out otherwise.Whenmultiple subnets are considered,

we get that once a computer is infected by the Flash Disk worms, other computers in that subnet will be infected in a short time.Thus, for any subnet, to contain the Flash Disk worms, themost effective way is to prevent the first infected individual by improvingthe users’ security awareness of using removed devices. Our results are illustrated by numerical simulation.

1. Introduction

The Flash Disk worms, which spread via both Web-basedscanning on the Internet and removable devices, mainlyattack SIMATIC and WinCC software. Those worms appearto be aimed directly at controlling physical machinery andattempt to take control of critical physical infrastructure.Stuxnet which is a kind of the Flash Disk worms has infectedabout 500,000–1000,000 computers, mainly in Iran, India,Indonesia, and Pakistan [1]. Nowadays, it becomes a majorquestion to research the Flash Disk worms.

For a great many similarities between computer wormsand biological virus [2], some biological epidemic modelshave been modified to describe the spreading of the Internetworms. For example, the susceptible-infected-susceptible(SIS) model was modified including a reintroduction param-eter by Wierman and Marchette [3]. In [4], the susceptible-infected-recovered (SIR)model and a discreteMarkovmodelwere presented to capture the short term and long termdynamics of viral propagation. The susceptible-antidotal-infected-contaminated (SAIC) model whose two new com-partments were introduced was proposed [5]. Besides,

there were the susceptible-infected-recovered-susceptible(SIRS), the susceptible-infected-detected-recovered (SIDR),and the susceptible-asymptomatic-symptomatic-recovered(SAIR) models which were adopted [6–9]. However, thesemodels cannot be applied to thewormswhich spread via bothWeb-based scanning on the Internet and removable devices.

Jin andWang describe the FD-SEIRmodel to analyze andcontrol the FlashDisk worms [10]. Besides, Song et al. presentthe worms model about the cross infection of computersand removable devices [11]. However, the two models wereanalyzed under the condition of computers and removabledevices mixed evenly. It is not suitable for the spread ofStuxnet because of the different speed of Stuxnet’s spreadingin different subnets. Inspired by these models, we will builda model focusing on Stuxnet which spreads via Web-basedscanning on the Internet and removable devices in multiplesubnets.

The organization of this paper is as follows. In Section 2,we present a model in multiple subnets. In Section 3, weanalyze its dynamical behavior in one and more subnetsand give some results by numerical simulation in multiple

Hindawi Publishing CorporationDiscrete Dynamics in Nature and SocietyVolume 2015, Article ID 941862, 7 pageshttp://dx.doi.org/10.1155/2015/941862

2 Discrete Dynamics in Nature and Society

subnets. The paper concludes with a brief discussion inSection 4.

2. The Model Formulation in Multiple Subnets

The Flash Disk worms spread by Web-based scanning on theInternet and using removable devices between subnets. Inthe different subnets, the Flash Disk worms may have thedifferent spreading speed. Thus, the propagation of wormscan be considered to be a fast system. If they spread slowly,these subnets will be seen as a slow system. For simplicity,we suppose that the removable devices represent all mobiledevices related to computer, including flash disk, mobile harddisk, and memory card. Assume that computer hosts areclassified in three compartments: susceptible (𝑆𝑐

𝑖), infected

(𝐼𝑐𝑖), and recovered (𝑅𝑐

𝑖) and the removable devices are two

compartments: susceptible 𝑆𝑢𝑖and infected 𝐼𝑢

𝑖. To consider

the spread relationship between computers and removabledevices, the model is as follows:

𝑑𝑆𝑐

𝑖

𝑑𝑡= 𝜇1𝑁𝑖−𝛽in𝑆𝑐

𝑖𝐼𝑐

𝑖

𝑁𝑖

−𝑏𝛾𝛽𝑢𝑐𝑆𝑐

𝑖𝐼𝑢

𝑖

𝑁𝑖

− 𝜇1𝑆𝑐

𝑖

+ 𝜀(−

𝑘

∑

𝑗=1

𝛽𝑐𝑆𝑐

𝑖𝐼𝑐

𝑗

𝑁𝑖

−

𝑘

∑

𝑗=1

𝑏𝑖𝛾𝛽𝑢𝑐𝑆𝑐

𝑖𝐼𝑢

𝑗

𝑁𝑖

) ,

𝑑𝐼𝑐

𝑖

𝑑𝑡=𝛽in𝑆𝑐

𝑖𝐼𝑐

𝑖

𝑁𝑖

+𝑏𝛾𝛽𝑢𝑐𝑆𝑐

𝑖𝐼𝑢

𝑖

𝑁𝑖

− 𝛿1𝐼𝑐

𝑖− 𝜇1𝐼𝑐

𝑖

+ 𝜀(

𝑘

∑

𝑗=1

𝛽𝑐𝑆𝑐

𝑖𝐼𝑐

𝑗

𝑁𝑖

+

𝑘

∑

𝑗=1


𝑖𝐼𝑢

𝑗

𝑁𝑖

) ,

𝑑𝑅𝑐

𝑖

𝑑𝑡= 𝛿1𝐼𝑐

𝑖− 𝜇1𝑅𝑐

𝑖,

𝑑𝑆𝑢

𝑖

𝑑𝑡= 𝜇2𝑛𝑖−𝑏𝛽𝑐𝑢𝑆𝑢

𝑖𝐼𝑐

𝑖

𝑁𝑖

+ 𝛿2𝐼𝑢

𝑖− 𝜇2𝑆𝑢

𝑖

+ 𝜀(−

𝑘

∑

𝑗=1

𝑏𝑖𝛽out𝑆𝑢

𝑖𝐼𝑐

𝑗

𝑁𝑗

) ,

𝑑𝐼𝑢

𝑖

𝑑𝑡=𝑏𝛽𝑐𝑢𝑆𝑢

𝑖𝐼𝑐

𝑖

𝑁𝑖

− 𝛿2𝐼𝑢

𝑖− 𝜇2𝐼𝑢

𝑖+ 𝜀(

𝑘

∑

𝑗=1


𝑖𝐼𝑐

𝑗

𝑁𝑗

) ,

(1)

where 𝑆𝑐𝑖+ 𝐼𝑐

𝑖+ 𝑅𝑐

𝑖= 𝑁𝑖, 𝑆𝑢𝑖+ 𝐼𝑢

𝑖= 𝑛𝑖, and meaning of

the parameters and state variables is shown in Notations andDefinitions section.

3. Model Analysis

In the section, two parts will be analyzed. In the first part,we will not consider the worms spreading among differentsubnets. In the secondpart, wewill considerworms spreadingamong different subnets.

3.1. Model Analysis in the 𝑖th Subnet. If we let 𝜀 = 0, then theworms will be only propagated in subnet. Model (1) becomes

𝑑𝑆𝑐

𝑖

𝑑𝑡= 𝜇1𝑁𝑖−𝛽in𝑆𝑐

𝑖𝐼𝑐

𝑖

𝑁𝑖

−𝑏𝛾𝛽𝑢𝑐𝑆𝑐

𝑖𝐼𝑢

𝑖

𝑁𝑖

− 𝜇1𝑆𝑐

𝑖,

𝑑𝐼𝑐

𝑖

𝑑𝑡=𝛽in𝑆𝑐

𝑖𝐼𝑐

𝑖

𝑁𝑖


𝑖𝐼𝑢

𝑖

𝑁𝑖

− 𝛿1𝐼𝑐


𝑖,

𝑑𝑅𝑐

𝑖

𝑑𝑡= 𝛿1𝐼𝑐

𝑖− 𝜇1𝑅𝑐

𝑖,

𝑑𝑆𝑢

𝑖

𝑑𝑡= 𝜇2𝑛𝑖−𝑏𝛽𝑐𝑢𝑆𝑢

𝑖𝐼𝑐

𝑖

𝑁𝑖

+ 𝛿2𝐼𝑢

𝑖− 𝜇2𝑆𝑢

𝑖,

𝑑𝐼𝑢

𝑖

𝑑𝑡=𝑏𝛽𝑐𝑢𝑆𝑢

𝑖𝐼𝑐

𝑖

𝑁𝑖

− 𝛿2𝐼𝑢


𝑖.

(2)

Then we will consider the existence and stability of equilibriafor system (2). It is obvious that there is a disease-freeequilibrium𝑄0

𝑖= (𝑁𝑖, 0, 0, 𝑛

𝑖, 0) in system (2). To analyze the

existence of the positive equilibria, we firstly give the basicreproduction number:

𝑅0

𝑖=𝛽in𝛿1+ 𝜇1

+𝑛𝑖𝑏2𝛾𝛽𝑢𝑐𝛽𝑐𝑢

𝑁𝑖(𝛿1+ 𝜇1) (𝛿2+ 𝜇2). (3)

Here 𝑅0𝑖is the number of newly infected individuals at

the disease-free equilibrium in the 𝑖th subnet in infectiousperiod.

By calculating, we obtain that 𝐼𝑐𝑖satisfied the following

equation:

𝑏𝛽in𝛽𝑐𝑢𝑁𝑖

𝐼𝑐

𝑖

2

+ [(𝛿1+ 𝜇1) (𝛿2+ 𝜇2) 𝑅0

𝑖+𝑏𝜇1𝛽𝑐𝑢𝛿1+ 𝜇1− 𝛽in

𝛿1+ 𝜇1

] 𝐼𝑐

𝑖

+ 𝜇1𝑁𝑖(𝛿2+ 𝜇2) (1 − 𝑅

0

𝑖) = 0.

(4)

According to Descartes sign rule, if 𝑅0𝑖> 1, there exists a

unique positive equilibrium 𝑄∗𝑖= (𝑆𝑐

𝑖

∗, 𝐼𝑐

𝑖

∗, 𝑅𝑐

𝑖

∗, 𝑆𝑢

𝑖

∗, 𝐼𝑢

𝑖

∗) in

system (2), where

𝑆𝑐

𝑖

∗=𝜇1𝑁𝑖− 𝛿1𝐼𝑐

𝑖

∗− 𝜇1𝐼𝑐

𝑖

∗

𝜇1

,

𝐼𝑐

𝑖

∗=

√𝜔2

2− 4𝜔1𝜔3− 𝜔2

2𝜔1

,

𝑅𝑐

𝑖

∗=𝛿1

𝜇1

𝐼𝑐

𝑖

∗,

𝑆𝑢

𝑖

∗=(𝛿1+ 𝜇1) 𝑛𝑖𝑁𝑖

𝑏𝛽𝑐𝑢𝐼𝑐

𝑖

∗+ (𝛿2+ 𝜇2)𝑁𝑖

,

𝐼𝑢

𝑖

∗=

𝑏𝛽𝑐𝑢𝑛𝑖𝐼𝑐

𝑖

∗


𝑖

∗+ (𝛿2+ 𝜇2)𝑁𝑖

,

Discrete Dynamics in Nature and Society 3

𝜔1=𝑏𝛽in𝛽𝑐𝑢𝑁𝑖

,

𝜔2= (𝛿1+ 𝜇1) (𝛿2+ 𝜇2) 𝑅0

𝑖+𝑏𝜇1𝛽𝑐𝑢(𝛿1+ 𝜇1− 𝛽in)

𝛿1+ 𝜇1

,

𝜔3= 𝜇1𝑁𝑖(𝛿2+ 𝜇2) (1 − 𝑅

0

𝑖) .

(5)

Furthermore, we consider the stability of equilibria. Wehave the following theorems.

Theorem 1. If 𝑅0𝑖< 1, the disease-free equilibrium 𝑄0

𝑖of (2) is

locally asymptotically stable.

Proof. The Jacobian matrix of (2) at 𝑄0𝑖is

𝐽0

𝑄0

𝑖

=(

(

−𝜇1−𝛽in 0 −𝑏𝛾𝛽

𝑢𝑐

0 𝛽in − 𝛿1 − 𝜇1 0 𝑏𝛾𝛽𝑢𝑐

0 −𝑏𝑛𝛽𝑐𝑢

𝑁𝑖

−𝜇2𝛿2

0𝑏𝑛𝛽𝑐𝑢

𝑁𝑖

0 − (𝛿2+ 𝜇2)

)

)

. (6)

Then the characteristic equation is

(𝜆 + 𝜇1) (𝜆 + 𝜇

2)

⋅ [𝜆2+ (𝛿1+ 𝛿2+ 𝜇1+ 𝜇2− 𝛽in) 𝜆

+ (𝛿1+ 𝜇1) (𝛿2+ 𝜇2) (1 − 𝑅

0

𝑖)] = 0.

(7)

It is easily seen that all eigenvalues of 𝜆 have negative realparts if 𝑅0

𝑖< 1. Thus, the theorem is proven by Routh-

Hurwitz criterion.

Theorem 2. When 𝑅0𝑖< 1, the disease-free equilibrium 𝑄0

𝑖of

system (2) is globally asymptotically stable.

Proof. Take Lyapunov function,

𝑉 (𝐼𝑐

𝑖, 𝐼𝑢

𝑖) =1

𝛿1+ 𝜇1

𝐼𝑐

𝑖+

𝑏𝛾𝛽𝑢𝑐

(𝛿1+ 𝛽1) (𝛿2+ 𝛽2)𝐼𝑢

𝑖, (8)

which is always positive in 𝑅2+where

𝑅2

+= {(𝐼𝑐

𝑖, 𝐼𝑢

𝑖) ∈ 𝑅2: 𝐼𝑐

𝑖> 0, 𝐼

𝑢

𝑖> 0} . (9)

Then,

�̇� (𝐼𝑐

𝑖, 𝐼𝑢

𝑖) =1

𝛿1+ 𝜇1

(𝛽in𝑆𝑐

𝑖𝐼𝑐

𝑖

𝑁𝑖


𝑖𝐼𝑢

𝑖

𝑁𝑖

− 𝛿1𝐼𝑐


𝑖)

+𝑏𝛾𝛽𝑢𝑐

𝛿1+ 𝛽1𝛿2+ 𝛽2

⋅ (𝑏𝛽𝑐𝑢𝑆𝑢

𝑖𝐼𝑐

𝑖

𝑁𝑖

− 𝛿2𝐼𝑢


𝑖)

=𝛽in𝛿1+ 𝜇1

𝑆𝑐

𝑖𝐼𝑐

𝑖

𝑁𝑖

+𝑏2𝛾𝛽𝑢𝑐𝛽𝑐𝑢

𝛿1+ 𝛽1𝛿2+ 𝛽2

𝑆𝑢

𝑖𝐼𝑐

𝑖

𝑁𝑖

− 𝐼𝑐

𝑖+𝑏𝛾𝛽𝑐𝑢

𝛿1+ 𝜇1

𝑆𝑐

𝑖𝐼𝑢

𝑖

𝑁𝑖

+𝑏𝛾𝛽𝑐𝑢

𝛿1+ 𝜇1

𝐼𝑢

𝑖

≤𝛽in𝛿1+ 𝜇1

𝐼𝑐

𝑖+𝑏2𝛾𝛽𝑢𝑐𝛽𝑐𝑢

𝛿1+ 𝛽1𝑛𝛿2+ 𝛽2𝑁𝑖

𝐼𝑐

𝑖− 𝐼𝑐

𝑖

+𝑏𝛾𝛽𝑐𝑢

𝛿1+ 𝜇1

𝐼𝑢

𝑖−𝑏𝛾𝛽𝑐𝑢

𝛿1+ 𝜇1

𝐼𝑢

𝑖

= (𝑅0

𝑖− 1) 𝐼

𝑐

𝑖

≤ 0.

(10)

Then, when𝑅0𝑖< 1, the disease-free equilibrium𝑄0

𝑖of system

(2) is globally asymptotically stable. The theorem is proven.

Theorem 3. If 𝑅0𝑖> 1, the positive equilibrium 𝑄∗

𝑖of (2) is

locally asymptotically stable.

Proof. The matrix of the linearization of system (2) at theunique positive equilibrium 𝑄∗

𝑖is

𝐽∗

𝑄∗

𝑖

=

((((((((

(

−𝛽in𝐼𝑐

𝑖

∗

𝑁𝑖

−𝑏𝛾𝛽𝑢𝑐𝐼𝑢

𝑖

∗

𝑁𝑖

− 𝜇1−𝛽in𝑆𝑐

𝑖

∗

𝑁𝑖

0 −𝑏𝛾𝛽𝑢𝑐𝑆𝑐

𝑖

∗

𝑁𝑖

𝛽in𝐼𝑐

𝑖

∗

𝑁𝑖

+𝑏𝛾𝛽𝑢𝑐𝐼𝑢

𝑖

∗

𝑁𝑖

𝛽in𝑆𝑐

𝑖

∗

𝑁𝑖

− 𝛿1− 𝜇1

0𝑏𝛾𝛽𝑢𝑐𝑆𝑐

𝑖

∗

𝑁𝑖

0 −𝑏𝛽𝑐𝑢𝑆𝑢

𝑖

∗

𝑁𝑖

−𝑏𝛽𝑐𝑢𝐼𝑐

𝑖

∗

𝑁𝑖

− 𝜇2𝛿2

0𝑏𝛽𝑐𝑢𝑆𝑢

𝑖

∗

𝑁𝑖


𝑖

∗

𝑁𝑖

− (𝛿2+ 𝜇2)

))))))))

)

. (11)


Then the characteristic equation is (𝜆 + 𝜇2)(𝜆3+ 𝑎1𝜆2+ 𝑎2𝜆 +

𝑎3) = 0, where

𝑎1= 2𝜇1+ 𝛿1+ 𝜇2+ 𝛿2+𝑏𝛽𝑐𝑢𝐼𝑐

𝑖

∗

𝑁𝑖

+𝛽in𝐼𝑐

𝑖

∗

𝑁𝑖


𝑖

∗

𝑁𝑖

−𝛽in𝐼𝑐

𝑖

∗

𝑁𝑖

= 𝜇1+ 𝜇2+ 𝛿2+𝛽in𝐼𝑐

𝑖

∗+ 𝑏𝛽𝑐𝑢𝐼𝑐

𝑖

∗+ 𝑏𝛾𝛽

𝑢𝑐𝐼𝑢

𝑖

∗

𝑁𝑖


𝑖

∗𝐼𝑢

𝑖

∗

𝑁𝑖𝐼𝑐

𝑖

∗> 0,

𝑎2= (𝜇2+ 𝛿2+𝑏𝛾𝑐𝑢𝐼𝑐

𝑖

∗

𝑁𝑖

)(𝜇1+ 𝛿2−𝛽in𝑆𝑐

𝑖

∗

𝑁𝑖

)

+ 𝜇1(𝜇1+ 𝛿1+ 𝜇2+ 𝛿2+𝑏𝛽𝑐𝑢𝐼𝑐

𝑖

∗

𝑁𝑖

−𝛽in𝐼𝑐

𝑖

∗

𝑁𝑖

)

+ (𝛽in𝐼𝑐

𝑖

∗

𝑁𝑖


𝑖

∗

𝑁𝑖

)

⋅ (𝜇1+ 𝛿1+ 𝜇2+ 𝛿2+𝑏𝛽𝑐𝑢𝐼𝑐

𝑖

∗

𝑁𝑖

)

−𝑏2𝛾𝛽𝑢𝑐𝛽𝑐𝑢𝑆𝑐

𝑖

∗𝑆𝑢

𝑖

∗

𝑁2

𝑖

= (𝜇2+ 𝛿2)𝑏𝛾𝛽𝑢𝑐𝑆𝑐

𝑖

∗𝐼𝑢

𝑖

∗

𝑁𝑖𝐼𝑐

𝑖

∗

+ 𝜇1(𝜇2+ 𝛿2+𝑏𝛽𝑐𝑢𝐼𝑐

𝑖

∗

𝑁𝑖


𝑖

∗𝐼𝑢

𝑖

∗

𝑁𝑖𝐼𝑐

𝑖

∗)

+ (𝛽in𝐼𝑐

𝑖

∗

𝑁𝑖


𝑖

∗

𝑁𝑖

)

⋅ (𝜇1+ 𝛿1+ 𝜇2+ 𝛿2+𝑏𝛽𝑐𝑢𝐼𝑐

𝑖

∗

𝑁𝑖

) > 0,

𝑎3= 𝜇1(𝜇2+ 𝛿2+𝑏𝛽𝑐𝑢𝐼𝑐

𝑖

∗

𝑁𝑖

) + (𝜇1+ 𝛿1)

⋅ (𝛽in𝐼𝑐

𝑖

∗

𝑁𝑖


𝑖

∗

𝑁𝑖

)(𝜇2+ 𝛿2+𝑏𝛽𝑐𝑢𝐼𝑐

𝑖

∗

𝑁𝑖

)

−𝑏2𝛾𝛽𝑢𝑐𝛽𝑐𝑢𝑆𝑐

𝑖

∗𝑆𝑢

𝑖

∗

𝑁2

𝑖

= 𝜇1(𝜇2+ 𝛿2)𝑏𝛾𝛽𝑢𝑐𝑆𝑐

𝑖

∗𝐼𝑢

𝑖

∗

𝑁𝑖𝐼𝑐

𝑖

∗

+ (𝜇1+ 𝛿1) (𝛽in𝐼𝑐

𝑖

∗

𝑁𝑖


𝑖

∗

𝑁𝑖

)

⋅ (𝜇2+ 𝛿2+𝑏𝛽𝑐𝑢𝐼𝑐

𝑖

∗

𝑁𝑖

) > 0.

(12)

Then

𝑎1𝑎1− 𝑎3= (𝛽in𝐼𝑐

𝑖

∗

𝑁𝑖


𝑖

∗

𝑁𝑖

)(𝜇2+ 𝛿2+𝑏𝛽𝑐𝑢𝐼𝑐

𝑖

∗

𝑁𝑖

)𝑎1


𝑖

∗𝐼𝑢

𝑖

∗

𝑁𝑖𝐼𝑐

𝑖

∗(𝜇2+ 𝛿2)

⋅ (𝜇2+ 𝛿2+𝑏𝛽𝑐𝑢𝐼𝑐

𝑖

∗

𝑁𝑖

+𝛽in𝐼𝑐

𝑖

∗

𝑁𝑖


𝑖

∗

𝑁𝑖


𝑖

∗𝐼𝑢

𝑖

∗

𝑁𝑖𝐼𝑐

𝑖

∗)

+ (𝜇1+ 𝛿1) (𝛽in𝐼𝑐

𝑖

∗

𝑁𝑖


𝑖

∗

𝑁𝑖

)

⋅ (𝜇1+𝛽in𝐼𝑐

𝑖

∗

𝑁𝑖


𝑖

∗𝐼𝑢

𝑖

∗

𝑁𝑖𝐼𝑐

𝑖

∗) > 0.

(13)

Hence the Routh-Hurwitz criterion is satisfied. Thus itfollows that the endemic equilibrium 𝑄∗

𝑖of (2), which exists

if 𝑅0𝑖> 1, is always locally asymptotically stable. The theorem

is proven.

To prove the global stability, we have a dimensionlesstransformation where 𝑠𝑐

𝑖= 𝑆𝑐

𝑖/𝑁𝑖, 𝑖𝑐𝑖= 𝐼𝑐

𝑖/𝑁𝑖, 𝑟𝑐𝑖= 𝑅𝑐

𝑖/𝑁𝑖,

𝑠𝑢

𝑖= 𝑆𝑢

𝑖/𝑛𝑖, 𝑖𝑢𝑖= 𝐼𝑢

𝑖/𝑁𝑖, and 𝑚

𝑖= 𝑛𝑖/𝑁𝑖, for system (2). It

becomes

𝑑𝑠𝑐

𝑖

𝑑𝑡= 𝜇1− 𝛽in𝑠

𝑐

𝑖𝑖𝑐

𝑖− 𝑏𝛾𝛽

𝑢𝑐𝑚𝑖𝑠𝑐

𝑖𝑖𝑢

𝑖− 𝜇1𝑠𝑐

𝑖,

𝑑𝑖𝑐

𝑖

𝑑𝑡= 𝛽in𝑠

𝑐

𝑖𝑖𝑐

𝑖+ 𝑏𝛾𝛽

𝑢𝑐𝑚𝑖𝑠𝑐

𝑖𝑖𝑢

𝑖− 𝛿1𝑖𝑐

𝑖− 𝜇1𝑖𝑐

𝑖,

𝑑𝑟𝑐

𝑖

𝑑𝑡= 𝛿1𝑖𝑐− 𝜇1𝑟𝑐

𝑖,

𝑑𝑠𝑢

𝑖

𝑑𝑡= 𝜇2− 𝑏𝛽𝑐𝑢𝑠𝑢

𝑖𝑖𝑐

𝑖+ 𝛿2𝑖𝑢

𝑖− 𝜇2𝑠𝑢

𝑖,

𝑑𝑖𝑢

𝑖

𝑑𝑡= 𝑏𝛽𝑐𝑢𝑠𝑢

𝑖𝑖𝑐

𝑖− 𝛿2𝑖𝑢

𝑖− 𝜇2𝑖𝑢

𝑖.

(14)

Then,

𝑅0

𝑖=𝛽in𝛿1+ 𝜇1

+𝑏2𝛾𝛽𝑢𝑐𝛽𝑐𝑢𝑚𝑖

(𝛿1+ 𝜇1) (𝛿2+ 𝜇2). (15)

The positive equilibrium is

𝑞∗

𝑖= (𝑠𝑐

𝑖

∗, 𝑖𝑐

𝑖

∗, 𝑟𝑐

𝑖

∗, 𝑠𝑢

𝑖

∗, 𝑖𝑢

𝑖

∗) = (𝑆𝑐

𝑖

∗

𝑁𝑖

,𝐼𝑐

𝑖

∗

𝑁𝑖

,𝑅𝑐

𝑖

∗

𝑁𝑖

,𝑆𝑢

𝑖

∗

𝑛𝑖

,𝐼𝑢

𝑖

∗

𝑛𝑖

) .

(16)

Theorem 4. When 𝑅0𝑖> 1, the positive equilibrium 𝑞∗

𝑖of

system (14), as well as the positive equilibrium 𝑄∗𝑖of system

(2), is globally asymptotically stable.


Proof. Take Lyapunov function,

𝑉 (𝑠𝑐

𝑖, 𝑖𝑐

𝑖, 𝑠𝑢

𝑖, 𝑖𝑢

𝑖) = 𝛽𝑐𝑢(𝑠𝑐

𝑖− 𝑠𝑐

𝑖

∗ ln 𝑠𝑐𝑖) + 𝛽𝑐𝑢(𝑖𝑐

𝑖− 𝑖𝑐

𝑖

∗ ln 𝑖𝑐𝑖)

+ 𝛾𝑚𝑖𝛽𝑢𝑐(𝑠𝑢

𝑖− 𝑠𝑢

𝑖

∗ ln 𝑠𝑢𝑖)

+ 𝛾𝑚𝑖𝛽𝑢𝑐(𝑖𝑢

𝑖− 𝑖𝑢

𝑖

∗ ln 𝑖𝑢𝑖) ,

(17)

which is always positive in 𝑅4+where

𝑅4

+= {(𝑠𝑐

𝑖, 𝑖𝑐

𝑖, 𝑠𝑢

𝑖, 𝑖𝑢

𝑖) ∈ 𝑅4: 𝑠𝑐

𝑖> 0, 𝑖

𝑐

𝑖> 0, 𝑠

𝑢

𝑖> 0, 𝑖

𝑢

𝑖> 0} .

(18)

Then,

�̇� (𝑠𝑐

𝑖, 𝑖𝑐

𝑖, 𝑠𝑢

𝑖, 𝑖𝑢

𝑖) = 𝛽𝑐𝑢(1 −𝑠𝑐

𝑖

∗

𝑠𝑐

𝑖

) ̇𝑠𝑐

𝑖+ 𝛽𝑐𝑢(1 −𝑖𝑐

𝑖

∗

𝑖𝑐

𝑖

) ̇𝑖𝑐

𝑖

+ 𝛾𝑚𝑖𝛽𝑢𝑐(1 −𝑠∗

𝑢

𝑠𝑢

𝑖

∗) ̇𝑠𝑢

𝑖

+ 𝛾𝑚𝑖𝛽𝑢𝑐(1 −𝑖𝑐

𝑢

∗

𝑖𝑢

𝑖

) ̇𝑖𝑢

𝑖

= 𝛽in𝛽𝑐𝑢 (1 −𝑠𝑐

𝑖

∗

𝑠𝑐

𝑖

)(𝑠𝑐

𝑖

∗𝑖𝑐

𝑖

∗− 𝑠𝑐

𝑖𝑖𝑐

𝑖)

+ 𝑏𝛾𝛽𝑐𝑢𝛽𝑢𝑐𝑚𝑖(1 −𝑠𝑢

𝑖

∗

𝑠𝑢

𝑖

)(𝑠𝑢

𝑖

∗𝑖𝑢

𝑖

∗− 𝑠𝑢

𝑖𝑖𝑢

𝑖)

+ 𝜇1𝛽𝑐𝑢(1 −𝑠𝑐

𝑖

∗

𝑠𝑐

𝑖

)(𝑠𝑐

𝑖

∗− 𝑠𝑐

𝑖)

+ 𝛽in𝛽𝑐𝑢 (1 −𝑖𝑐

𝑖

∗

𝑖𝑐

𝑖

)(𝑠𝑐

𝑖𝑖𝑐

𝑖− 𝑠𝑐

𝑖

∗𝑖𝑐

𝑖)

+ 𝑏𝛾𝛽𝑐𝑢𝛽𝑢𝑐𝑚𝑖(1 −𝑖𝑐

𝑖

∗

𝑖𝑐

𝑖

)

⋅ (𝑖𝑢

𝑖𝑠𝑐

𝑖−𝑠𝑐

𝑖

∗𝑖𝑢

𝑖

∗

𝑖𝑐

𝑖

∗) 𝑖𝑐

𝑖

+ 𝑏𝛾𝛽𝑐𝑢𝛽𝑢𝑐𝑚𝑖

𝑠𝑐

𝑖

∗𝑖𝑖

𝑖

∗

𝑖𝑐

𝑖

∗𝑠𝑢

𝑖

∗(1 −𝑠𝑢

𝑖

∗

𝑠𝑢

𝑖

)

⋅ (𝑖𝑐

𝑖

∗𝑠𝑢

𝑖

∗− 𝑖𝑐

𝑖𝑠𝑢

𝑖)

+ 𝑏𝛿2𝛾𝛽𝑐𝑢𝛽𝑢𝑐𝑚𝑖

𝑠𝑐

𝑖

∗𝑖𝑢

𝑖

∗

𝑖𝑐

𝑖

∗𝑠𝑢

𝑖

∗(1 −𝑠𝑢

𝑖

∗

𝑠𝑢

𝑖

)

⋅ (𝑖𝑢

𝑖− 𝑖𝑢

𝑖

∗)

+ 𝑏𝜇2𝛾𝛽𝑐𝑢𝛽𝑢𝑐𝑚𝑖

𝑠𝑐

𝑖

∗𝑖𝑢

𝑖

∗

𝑖𝑐

𝑖

∗𝑠𝑢

𝑖

∗(1 −𝑖𝑢

𝑖

∗

𝑖𝑢

𝑖

)

⋅ (𝑖𝑐

𝑖𝑖𝑢

𝑖−𝑖𝑐

𝑖

∗𝑠𝑢

𝑖

∗

𝑖𝑢

𝑖

∗⋅ 𝑖𝑢

𝑖)

≤ 𝛽in𝛽𝑐𝑢(2𝑠𝑐

𝑖

∗𝑖𝑐

𝑖

∗−𝑠𝑐

𝑖

∗2

𝑖𝑐

𝑖

∗

𝑠𝑐

𝑖

− 𝑖𝑐

𝑖

∗𝑠𝑐

𝑖)

+ 𝑏𝛾𝛽𝑐𝑢𝛽𝑢𝑐𝑚𝑖

⋅ (4𝑠𝑐

𝑖

∗𝑖𝑢

𝑖

∗−𝑠𝑐

𝑖

∗2

𝑖𝑢

𝑖

∗

𝑠𝑐

−𝑖𝑐

𝑖

∗𝑖𝑢

𝑖𝑠𝑐

𝑖

𝑖𝑐

𝑖

−𝑠𝑐

𝑖

∗𝑖𝑢

𝑖

∗𝑠𝑢

𝑖

∗

𝑠𝑢

𝑖

−𝑠𝑐

𝑖

∗𝑖𝑐

𝑖𝑠𝑢

𝑖𝑖𝑢

𝑖

∗2

𝑠𝑐

𝑖

∗𝑠𝑢

𝑖

∗𝑖𝑢

𝑖

) ≤ 0.

(19)

The positive equilibrium 𝑞∗𝑖of system (14), as well as the pos-

itive equilibrium 𝑄∗𝑖of system (2), is globally asymptotically

stable when 𝑅0𝑖> 1. The theorem is proven.

3.2. Model Analysis between Subnets. In the subsection, wewill analyze the existence of positive equilibrium for system(1). For convenience, assume that the fast system is stable inone subnet. Then the slow system is

𝑑𝑆𝑐

𝑖

𝑑𝑡= −

𝑘

∑

𝑗=1

𝛽𝑐𝑆𝑐

𝑖𝐼𝑐

𝑗

𝑁𝑖

−

𝑘

∑

𝑗=1


𝑖𝐼𝑢

𝑗

𝑁𝑖

,

𝑑𝐼𝑐

𝑖

𝑑𝑡=

𝑘

∑

𝑗=1

𝛽𝑐𝑆𝑐

𝑖𝐼𝑐

𝑗

𝑁𝑖

+

𝑘

∑

𝑗=1


𝑖𝐼𝑢

𝑗

𝑁𝑖

,

𝑑𝑆𝑢

𝑖

𝑑𝑡= −

𝑘

∑

𝑗=1


𝑖𝐼𝑐

𝑗

𝑁𝑗

,

𝑑𝐼𝑢

𝑖

𝑑𝑡=

𝑘

∑

𝑗=1


𝑖𝐼𝑐

𝑗

𝑁𝑗

,

(20)

where 𝑆𝑐𝑖+ 𝐼𝑐

𝑖= 𝑁𝑖and 𝑆𝑢

𝑖+ 𝐼𝑢

𝑖= 𝑛𝑖. From system (20), we

can obtain 𝐼𝑐𝑖(𝑡) and 𝐼𝑢

𝑖(𝑡). If 𝑡 → 0,

𝑆𝑐

𝑖(0) = 𝑁

𝑖,

𝑆𝑢

𝑖(0) = 𝑛

𝑖,

𝐼𝑐

𝑖(𝑡) = 𝑁

𝑖− 𝑁𝑖𝑒−(𝑐1(𝛽𝑐/𝑁𝑖)+𝑐2(𝑏𝑖𝛾𝛽𝑢𝑐/𝑁𝑖))𝑡,

𝐼𝑢

𝑖(𝑡) = 𝑛

𝑖− 𝑛𝑖𝑒−𝑐3𝑏𝑖𝛽out𝑡,

(21)

where

𝑐1=

𝑘

∑

𝑗=1

𝐼𝑐

𝑗

∗, 𝑐

2=

𝑘

∑

𝑗=1

𝐼𝑢

𝑗

∗, 𝑐

3=

𝑘

∑

𝑗=1

𝐼𝑐

𝑗

∗

𝑁∗

𝑗

. (22)

From (21), we know that one can prevent the worm spreadingby controlling parameters. If infected computers and remov-able devices by the worms is less than one, that is, 𝐼𝑐

𝑖(𝑡) < 1

and 𝐼𝑢𝑖(𝑡) < 1, the worms will die out. Otherwise, they will be

epidemic.We should improve the security awareness of usingremovable devices. Formodel (20), it is difficult to analyze thedynamic behaviors. In the following part, we will simulate thedynamic behaviors of system (1).


200 400 600 800 1000 1200 1400 1600 1800 20000

0.0020.0040.0060.008

0.010.0120.0140.0160.018

0.02

Time (hour)

Frac

tion

of in

fect

ed co

mpu

ter

0 50 1000

0.05

0.1

0.15

R0 > 1R0 > 1

R0 < 1R0 < 1

Figure 1: The change figure of proportion of infected computerswith time 𝑡 when 𝑅0

𝑖< 1 and 𝑅0

𝑖> 1, respectively.

Take the determined parameters and the average value ofabout 100 experimental results. Firstly, let𝑁 = 1000, 𝑛 = 500,𝛽in = 0.5, 𝛽out = 0.8, 𝑏 = 0.006, 𝛾 = 0.75, 𝛿1 = 0.0059,𝛿2= 0.002, 𝜇

1= 0.00057, 𝜇

2= 0.00057, and time step

Δ𝑡 = 1. Then we plot figures of dynamical behaviors if wetake the different initial value. (i) 𝐼𝑐

𝑖0= 100 if 𝑅0

𝑖< 1 and

𝐼𝑐

𝑖0= 1 if 𝑅0

𝑖> 1 when 𝑡 = 0. From Figure 1, we can see that

if 𝑅0𝑖< 1, the number of infected computers will gradually

reduce and finally disappear. On the contrary, if 𝑅0𝑖> 1, the

number of infected computers will increase and then tend toa stable status. (ii) Let the initial value 𝐼𝑐

𝑖0= 0 when 𝑡 = 0

and the other values do not change. We draw change figuresfor the proportion of infected computers 𝐼𝑐

𝑖(𝑡) with time 𝑡

in the 𝑖th subnet (see Figure 2) and multiple subnets (seeFigure 3). From Figure 2, we can obtain that if a computeris infected by Stuxnet, other computers will be infected in ashort time. From Figure 3, it is found that once a computeris infected by the Flash Disk worms, other computers willbe infected among the different subnets after a longer time.Furthermore, comparing Figure 2 with Figure 3, we can findthat if a computer is infected by the Flash Disk worms, othercomputers will be infected in a short time in one subnet.To prevent computer from being infected by the worms, weshould take some effective measures. We can improve thesafety awareness of using removable devices to prevent thefirst computer from being infected by the worms.

4. Conclusion

In this paper, we proposed a new model focusing on theFlash Disk worms spreading via both Web-based scanningand removable devices in multiple subnets. In the 𝑖th subnet,we deduced the basic reproduction number 𝑅0

𝑖, a disease-

free equilibrium, and a unique equilibrium. If 𝑅0𝑖< 1,

the disease-free equilibrium is globally asymptotically stable;

0 100 200 300 400 500 600 700 800 900

0.90.80.70.60.50.40.30.20.1

0

Time (hour)

Frac

tion

of in

fect

ed co

mpu

ter

Theoretical valueDetermined simulationStochastic simulation

−0.1

Figure 2: The change figure of proportion of infected computers 𝐼𝑐𝑖

with time 𝑡 in the 𝑖th subnet.

0 200 400 600 800 1000 1200 1400 1600 1800 2000Time (day)

Frac

tion

of in

fect

ed co

mpu

ter

Stochastic simulationDetermined simulationTheoretical value

0.9

0.8

0.7

0.6

0.5

0.4

0.3

0.2

0.1

0

1

Figure 3: The change figure of proportion of infected computers𝐼𝑐

𝑖(𝑡) with time 𝑡 between subnets.

otherwise the Flash Disk worms can self-perpetuate. Inthe different subnets, we analyzed controlling the numberof infected computers by the determined simulation andstochastic simulation. If a computer is infected by the FlashDisk worms, other computers will be infected in a short timein one subnet. We should improve the safety awareness ofusing removable devices to prevent the first computer frombeing infected by the worms. The future work will focus onusing real trace data to test the model and these strategies.We will also study some countermeasures against the FlashDisk worms.


Notations and Definitions

𝑁𝑖and 𝑛

𝑖: Number of total computer hosts and removabledevices in the 𝑖th subnet, respectively

𝑆𝑐

𝑖and 𝑆𝑢

𝑖: Number of susceptible computer hosts andremovable devices in the 𝑖th subnet,respectively

𝐼𝑐

𝑖and 𝐼𝑢𝑖: Number of infected computer hosts andremovable devices in the 𝑖th subnet,respectively

𝑅𝑐

𝑖: Number of recovered computer hosts in the 𝑖th

subnet𝜇1and 𝜇

2: Quarantine or replacement rate of computerhosts and removable devices, respectively

𝛿1and 𝛿

2: Recovery rate of infected computer hosts andinfected removable devices, respectively

𝛽in: Infection rate of susceptible computer hosts inthe 𝑖th subnet caused by infected computersinside the 𝑖th subnet

𝛽𝑢𝑐: Infection rate from removable devices to

susceptible computer hosts𝛽𝑐𝑢: Infection rate of susceptible computer hosts in

the 𝑖th subnet caused by removable devicesinside the 𝑖th subnet

𝛽𝑐: Infection rate of susceptible computer hosts in

the 𝑖th subnet caused by infected computerhosts in the 𝑗th subnet

𝛽out: Infection rate of susceptible computer hosts inthe 𝑖th subnet caused by removable devices inthe 𝑗th subnet

𝑏: The removable devices using probability perunit time in the 𝑖th subnet

𝑏𝑗: The removable devices of the 𝑖th patch using

probability per unit time in the 𝑗th subnet𝛾: Probability of direct opening when using

removable devices𝜀: A small dimensionless parameter.

Conflict of Interests

The authors declare that there is no conflict of interestsregarding the publication of this paper.

Acknowledgments

Thiswork is supported by theNational Science Foundation ofChina (11201434, 11331009, and 61379125), Fund Program forthe ScientificActivities of SelectedReturnedOverseas Profes-sionals in Shanxi Province, and Research Project Supportedby Shanxi Scholarship Council of China (2013-087).

References

[1] T. M. Chen, “Stuxnet, the real start of cyber warfare?” IEEENetwork, vol. 24, no. 6, pp. 2–3, 2010.

[2] F. Cohen, “Computer viruses: theory and experiments,” Com-puters and Security, vol. 6, no. 1, pp. 22–35, 1987.

[3] J. C. Wierman and D. J. Marchette, “Modeling computer virusprevalence with a susceptible-infected-susceptible model with

reintroduction,”Computational Statistics andDataAnalysis, vol.45, no. 1, pp. 3–23, 2004.

[4] L. Billings, W. M. Spears, and I. B. Schwartz, “A unifiedprediction of computer virus spread in connected networks,”Physics Letters A, vol. 297, no. 3-4, pp. 261–266, 2002.

[5] J. R. C. Piqueira, A. A. de Vasconcelos, C. E. C. J. Gabriel, and V.O. Araujo, “Dynamic models for computer viruses,” Computersand Security, vol. 27, no. 7-8, pp. 355–359, 2008.

[6] R. Xu, Z. Ma, and Z. Wang, “Golbal stability of a delayedSIRS epidemic model with saturation incidence and temporaryimmunity,”Computers&Mathematics with Applications, vol. 59,no. 9, pp. 3211–3221, 2010.

[7] Z. D. Teng, Y. P. Liu, and L. Zhang, “Persistence and extinctionof disease in non-autonomous SIRS epidemic models withdisease-inducedmortality,”NonlinearAnalysis:Theory,Methods& Applications, vol. 69, no. 8, pp. 2599–2614, 2008.

[8] M. Ma and J. L. Williamson, An Epidemiological Model of VirusSpread and Cleanup, 2003, http://www.hpl.hp.com/techreports.

[9] J. R. C. Piqueira, B. F. Navarro, and L.H. A.Monteiro, “Epidemi-ological models applied to virus in computer networks,” Journalof Computer Science, vol. 1, no. 1, pp. 31–34, 2005.

[10] C. Jin and X.-Y. Wang, “Analysis and control stratagems offlash disk virus dynamic propagation model,” Security andCommunication Networks, vol. 5, no. 2, pp. 226–235, 2012.

[11] L. P. Song, Z. Jin, G. Q. Sun, J. Zhang, and X. Han, “Influence ofremovable devices on computer worms: dynamic analysis andcontrol strategies,”Computers &Mathematics with Applications,vol. 61, no. 7, pp. 1823–1829, 2011.

Submit your manuscripts athttp://www.hindawi.com

Hindawi Publishing Corporationhttp://www.hindawi.com Volume 2014

MathematicsJournal of


Mathematical Problems in Engineering

Hindawi Publishing Corporationhttp://www.hindawi.com

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of


Probability and StatisticsHindawi Publishing Corporationhttp://www.hindawi.com Volume 2014

Journal of


Mathematical PhysicsAdvances in

Complex AnalysisJournal of


OptimizationJournal of


CombinatoricsHindawi Publishing Corporationhttp://www.hindawi.com Volume 2014

International Journal of


Operations ResearchAdvances in

Journal of


Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttp://www.hindawi.com Volume 2014

International Journal of Mathematics and Mathematical Sciences


The Scientific World JournalHindawi Publishing Corporation http://www.hindawi.com Volume 2014


Algebra

Discrete Dynamics in Nature and Society



Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttp://www.hindawi.com

Volume 2014 Hindawi Publishing Corporationhttp://www.hindawi.com Volume 2014

Stochastic AnalysisInternational Journal of

research article modeling and analyzing the spread of ... · 0.2 0.1 0 1 f : e change gure of...

Documents