Abstract
The issue on how to effectively control Internet malicious worms has been drawn significant attention owing to enormous threats to the Internet. Due to the rapid spreading of malicious worms, it is necessary to explore the integrated measures to automatically mitigate the propagation on the Internet. In this paper, a novel worm propagation model is established, which combines both impulsive quarantine and benign worm implementation. Then, sufficient conditions for the global stability of worm-free periodic solution and the permanence of the benign worm are obtained. Finally, the effects of quarantine strategy are assessed and some feasible strategies that can constrain the propagation of malicious worm are provided by numerical simulation.
1. Introduction
With the wide use of computer network, network security problem, such as illegal access, malicious worm attacks, and virus spread, has become more remarkable and complicated. Worm is a kind of malicious code, which can run automatically and self-replicate and spread via networks and usually does not require human interaction to propagate [1]. For example, the Code Red worm [2, 3] and Slammer worm [4] caused thousands of computers to be infected and made the finance and government suffering great loss. KoobFace worm [5] targeted mainly the users of networking websites like Facebook and Gmail; the user’s devices if once infected, their personal data, financial services information, and passwords may be revealed. Worm causes more damages than other network security threats owing to their rapid spread and wide influence. Therefore, it is a pressing issue to hamper Internet worm’s prevalence in a large-scale network.
The technology of detection, recovery, and interdiction has been improved to some extent, with the development of a strategy that is used in scanning network worm propagation. In order to effectively control the propagation of malicious worm, more defenses should be developed to eliminate the worm and to immunize hosts before the worm attack. Since traditional prevention measures cannot effectively constrain worm propagation, the way of using benign worms to fight against worms has been becoming a new emergency response technology. The idea of benign worm is to transform a malicious worm into an antiworm which spreads itself using the same mechanism as the original worm and immunizes a host [6]. Antivirus softwares, firewalls, IDS (Intrusion Detection Systems), and IPS (Intrusion Prevention System) are generally static in nature and only prevent known attacks; therefore, they must be updated periodically to obtain defence against the worm attacks [6].
Worm modeling can help us to better understand how worms spread and propagate and how to effectively prevent and mitigate the effects of worm attacks. According to the propagation mechanism of benign worms, many mathematical models have been proposed to analyze the transmission law and transmission trend of different worms in various real-life networks [1, 7–10]. Benign worm is widely applied to fight worm; Wang et al. [10] focused on the spread of worm in mobile environment and proposed a benign worm strategy. In [11], the authors proposed an e-SEIAR (Susceptible-Exposed-Infective-Antiworm-Recovered) model with benign worm defense and proved that the basic reproduction number determines whether the worm dies out completely. The numerical simulation illustrated that the number of neighbors of benign worms plays an important role in worm propagation.
Moreover, in the computer field, worm quarantine is another prominent strategy in defending against worms and reliable for IDS whose performance directly affects the effectiveness of the quarantine [12–15]. Recently, the quarantine strategy has been applied to various worm propagation models [12, 16, 17]. In [16], an Internet worm propagation model with time delay in quarantine was proposed and theoretical analyzed. The results showed that decreasing the window size can guarantee stability of the worm propagation system. In [12], the authors put forward the pulse quarantine strategy and assumed that a host is detected by the anomaly detection system and then put into quarantine in a single pulse and applied every fixed units of time. They used an impulsive differential equation to describe worm propagation with the pulse quarantine strategy and illustrated that the pulse quarantine strategy has a better effect on worm containment and a higher application value in the field of worm prevention.
As we all know, many people’s behaviors are varied with different time of a day, for example, people seldom send and receive e-mail in midnight or early in the morning. People’s habits of surfing online are in line with their living habits. This implies that the infection rates vary with time every day. Thus, it is necessary to consider that some coefficients of the model are time-varying and switching in time. In this paper, we mainly formulate a worm propagation model with impulsive quarantine and switching in time, study the dynamic behavior, and evaluate the control strategies.
The rest of this paper is organized as follows. In Section 2, the impulsive switching model with the interaction between malicious worm and benign worm is formulated. In Section 3, the threshold condition of the eradication of malicious and benign worms is obtained. The sufficient condition of persistence of the benign is examined in Section 4. Numerical simulations are carried out to illustrate the theoretical results and analyze the effects of system parameters on worm spreading in Section 5. Finally, a brief conclusion is given and future research is put forward in the last section.
2. Model Formulation
Similar to a biological virus, a computer worm spreads by sending self-replication across the network, exploiting vulnerabilities in programs on other computers. To develop appropriate ways for thwarting rapid spread of worms, many scholars are trying to understand the behavior of the worm propagation with the aid of epidemiological models. Based on the classical Kermack–McKendrick model [18], Chen and Wei [19] developed a worm propagation model with temporary immunity. Now, we assume R host has permanent immunity, and then the model yields to the model, which is formed as follows:where , , and represent the proportion of susceptible, infected, and recovered hosts in all hosts at time t, respectively. Susceptible hosts, with security vulnerabilities, can be infected by worms with an infection rate . Some infectious hosts can be found and then manually patched at rate . It is assumed in model (1) that the recruitment rate of new hosts is equal to the obsolescence rate, denoted by . Global stability of equilibria and control measures were investigated in [19]. Introduction of benign worms may effectively control worm propagation. In [20], the interaction between malicious worm and benign worm is studied. We take benign worm into consideration in model (1) and yield the following improved benign Worm-Antiworm propagation model.where the total hosts are divided into four classes: susceptible, malicious infected, benign infected, and recovered denoted by , respectively, is the infection rate of malicious worm due to the successful scans of an malicious infected host, and is the infection rate of benign worm due to the successful scans of benign hosts.
Quarantine strategy is an effective worm defensive measure. However, the constant quarantine strategy has its disadvantages which are inevitable, such as the high demand on the patching rate of new hosts and its adoption of the imperfect misuse detection system [12]. Therefore, the pulse quarantine strategy is widely applied to constrain worm propagation. Based on the previous facts, we give the following assumptions: The pulse quarantine strategy is applied at a discrete time , where impulsive times satisfy and The susceptible and malicious infected hosts detected by the anomaly detection method are quarantined with the rate at time .
According to Assumptions , we establish the following impulsive worm propagation model with benign worm defense and the quarantine strategy (denoted by worm model):
Furthermore, based on surfing habits, it is necessary to consider that some coefficients of model (3) are time-varying and switching in time. Suppose that some parameters are modeled as switching parameters and governed by a switching rule , where m is the number of the subsystems and is a piecewise continuous switching rule such that for all . Define the set of all switching rules by . In order to better characterize the propagation of benign worm, this paper adopts an impulsive switching model with benign worm defense and quarantine strategy (denoted by worm model):
In fact, the anomaly detection method is periodically implemented and people’s surfing habit is always fixed. Consequently, for simplicity, we only consider the periodic switching rule. Following the idea of [21], we assume that the switching rule σ satisfies with , and then is the period of switch σ. Assume that , , , , and , for , and , , , , and . Define as the set of periodic switching rule.
Note that the variable R does not appear in the first three equations of system (4). This allows us to attack (4) by studying the subsystem with periodic switch:with initial value , where
It is easy to obtain the nonnegativity and boundedness of system (5). The property will be used in the following results.
Lemma 1. All solutions of system (5) with nonnegative initial conditions are nonnegative for all and ultimately bounded.
3. Global Asymptotical Stability of Worm-free Periodic Solution
Following the idea of Lemma 2.2 in [22], we can obtain the result which is essential for the proof of the main results.
Lemma 2. Consider the following impulsive switching system:where and . Then, there exists a unique positive periodic solution of system (7) which is globally asymptotically stable, wherefor , here
Let for . From system (5), we get the growth of susceptible hosts satisfies
According to Lemma 2, we have that there is a worm-free periodic solution of system (5) , where as , is defined in (8).
Define
Theorem 1. If , then the worm-free periodic solution of system (5) is globally attractive.
Proof. Since , we can choose sufficiently small such thatIt follows from the first equation of system (5) that . Thus, we consider the comparison impulsive differential system:In view of Lemma 2, we can easily obtain that there is a unique positive periodic solution of system (14) , and is globally asymptotically stable.
Let be the solution of system (5) with initial value and , and be the solution of system (14) with initial value . In view of the comparison theorem in impulsive differential equations [23, 24], there exists a positive integer such thatFurthermore, it follows from the second equation of (5) and (15) that, for and ,Thus, for and ,By simple calculation, we can deduce that for and .Especially, when , we getThus, for any positive integer p, we have . It follows from (12) thatFrom (18) and (20), we have Therefore, for abovementioned ε, there is a positive integer , such thatIt follows from the third equation of system (5), (15), and (21) that for Since is not effected by impulses, we can get by directly computingThus, for any positive integer l, we have . (13) impliesConsequently, . By the theory of asymptotically autonomous semiflows, we have that . Therefore, if , the worm-free periodic solution is globally attractive. This completes the proof.
Consider the following general impulsive switching epidemic model with periodic environment:where , , , , and . Compartment x is split by two types with the first q compartments , the infected individuals, and , the uninfected individuals. are the newly infected rates, are the rates of transfer of individuals out of compartments, then represent the set transfer rates out of compartments, and , , , and for all . Let be the spectral radius of matrix B. The following result can be seen in [25].
Lemma 3. Assume that Assumptions ()–() hold. If , then the disease-free periodic solution of system (25) is locally asymptotically stable, where the definition of matrix can be seen in Appendix A and Assumptions ()–() are given in Appendix B.
Theorem 2. If , then the worm-free periodic solution of system (5) is locally asymptotically stable.
Proof. By Lemma 3, we firstly want to verify Assumptions ()–(). For system (5), it is easy to obtain thatObviously, Assumptions ()–() hold. Then, we will show that Assumptions () and () hold.
By Appendix B and simple calculation, we can get , , , , and of system (5), which are represented as the following form:It follows from (27)–(29) and (A.2) (see Appendix A) thathere .
Obviously, and . Thus, for system (5), Assumptions () and () hold.
Next, we will showFrom (28), (29), and (A.1), we havewhere and are defined in (11). Thus, .
According to Lemma 3, we have that, if , that is, , the worm-free periodic solution of system (5) is asymptotically stable. This completes the proof.
From Theorem 1 and Theorem 2, we can easily obtain the following result.
Theorem 3. If , the worm-free periodic solution of system (5) is globally asymptotically stable.
4. Persistence of Benign Worm
In this section, we mainly obtain the sufficient condition for persistence of benign worm.
Let be the positive periodic solution of the following system:where is a fixed positive number. According to Lemma 2, we know that as , and here is defined in (8).
Denote
Theorem 4. If there exists a positive number such that , then the benign worm is uniformly persistent; that is, there is a positive constant q, such that .
Proof. Let be the solution of system (5) with initial value . It follows from that, for a given , there exists sufficiently small such thatFirst, we prove the claimSuppose that (36) does not hold. Thus, there exists a such that for all . From the first equation of (5) that for ,Consider the following comparison impulsive system for :By Lemma 2, we have that system (38) has a unique positive periodic solution , which is globally asymptotically stable. By comparison theorem for impulsive differential equations, we have that there exists a such that the following inequality holds for :SetWe will show that for all . Suppose the contrary. Then, there is a such that for and . However, it follows from the third equation of system (5) and (39) thatFrom (35), we can yieldThis is a contradiction. Thus, for all . In addition, from (39) and (41), we getwhich implies that as , if . This contradicts the boundedness of . Hence, the claim is true.
By the claim, we are left to discuss two cases: (i) for t large enough; (ii) oscillates about for t large enough.
DefineWe hope to show that for t is large enough. For case (i), it is obvious that the conclusion is true. For case (ii), let and satisfywhere is sufficiently large such that for .
is uniformly continuous since the positive solution of (5) is ultimately bounded and is not effected by impulses. Hence, there is a τ ( and τ is independent of the choice of ) such that for . If , there is nothing to prove. Let us consider the case where . Since for and , it is obvious that for . If , then from for and , it is easy to see that for . Then, proceeding exactly as the proof for the abovementioned claim, we can get that for . Since this kind of interval is chosen in an arbitrary way, so we can obtain that for all large t in the second case. In view of the abovementioned discussion, the choices of q is independent of the positive solution, and we have proved that any positive solution of system (5) satisfies for sufficiently large t. This completes the proof.
5. Numerical Simulations
We now present a set of simulation results to verify dynamical behavior of the model and evaluate the effect of benign worm and quarantine strategy in defending against malicious worm. The numerical simulations are performed by MATLAB. For convenience, we set the numeric values of the coefficients as follows: , , , , , , , , if k is odd, if k is even, if k is an integer multiple of 6 or else , if k is odd, if k is even, if k is odd, if k is even, where , , , . For the simulations, we apply the set of parameters unless otherwise stated.
5.1. Verification of Theoretical Results
In this section, we will perform numerical simulations for two sets of parameters that show the behavior of the model (5) depending on the value of the basic reproductive number. In both cases, we assume that the initial values are . In the first simulation (see Figure 1), by calculating, we have , and the worm-free periodic solution is globally asymptotically stable, in accordance with the theoretical prediction. On the other hand, in the second simulation, we choose and and get . As a consequence, the benign worms will be permanent (see Figure 2), again in agreement with the theoretical prediction.
(a)
(b)
5.2. Comparison of Four Worm Models: , , , and
To determine the validity of the model, it is compared with the plain , , and models. We first simulate the model as a baseline and then implement the and models. Finally, we design our model. All models share the same parameters which is illustrated as mentioned above except for . Figure 3(a) shows the proportion of malicious worm for each of the four models. The numerical result illustrates a noticeable decrease and a reduced propagation spread for the malicious worms in the , , and models than the model. Figure 3(b), a partially enlarged view of Figure 3(a), shows that the peak value of malicious worm of the model is larger than that of and models. These imply that benign worm countermeasure and quarantine strategy play an important role in constraining malicious worm prevalence. The result supports our expectation that combining mitigation strategies will reduce the propagation speed of malicious worms and decrease the number of malicious worms. Furthermore, we can see that the model can more accurately reflect people’s online habits than the model.
(a)
(b)
5.3. Quarantine Time and Quarantine Rate
In this section, we mainly discuss the effect of the quarantine strategy. In order to understand the impact of quarantine time and quarantine rate on worm propagation, we firstly run the simulation with quarantine time . Figure 4 shows the effect of increasing the quarantine times (which are between 3 and 7 days) on worm propagation. We obtain a conclusion that more frequent quarantine can lower the total number of the malicious worms. Next, we run the simulation with the quarantine rate . Figure 5 illustrates that increasing the quarantine rate yields a decline in the number of malicious worms. It means quarantine strategy is an effective way to constrain the malicious worm’s propagation. We can reduce the losses of our society by increasing the quarantine rate.
(a)
(b)
(a)
(b)
5.4. Attack Performance Sensitivity of Benign Worm
In this section, we mainly study the effect of the attack performance of benign worm on malicious infected host propagation. Figure 6 depicts the data on the attack performance under different and . This simulation matches our expectation: the number of declines, and the number of increases with the increase of and for reasons that S host and I host are transmitted to B host due to benign worm attack and the process of transmission of S host and I host are infected more rapidly with larger and .
(a)
(b)
Remark 1. (defined in (11)) depends on the parameter values of . The parameters exhibit directly proportional relationships with . By contrast, the parameters are inversely proportional to . Then, the eradication of the worms is possible by reducing to below 1 by tuning the model parameters while taking practical actions accordingly.
Remark 2. On the basis of the discussion above, some effectual actions for users are stated as follows:(i)Reducing the infection rate by installing antivirus software and firewall timely and increasing the security awareness of user and running it automatically while using computer. These actions can decrease the potential infection of the user’s computer caused by a contact with some other computers.(ii)Increasing the recovery rate η by a patching system and updating antivirus software in a timely manner.
Remark 3. IDS (Intrusion Detection System) is a tool to detect the network intrusion actions. It divides into two categories according to the detection technique: misuse IDS and anomaly IDS. Moreover, IPS (Intrusion prevention system) is a new information security technology which can supply a gap of the firewall and the IDS in the information security domain. The developer of the antivirus software should improve the performance of IDS and IPS and the attack ability of benign worm. Some effectual actions for the developer are listed as follows:(i)Increasing the quarantine rate by improving the recognition rate and the accuracy rate of misuse IDS, enhancing the anomaly IDS to make it more aggressive and more sensitive to the worms activities, and reducing the false alarms caused by anomaly IDS.(ii)Reducing the interval time of pulse quarantine by increasing the frequency of anomaly detection.(iii)Reducing the infection rate by increasing the performance of IPS.(iv)Increasing the infection rate by exploring the delivery strategy and improving attack ability of benign worms.
6. Conclusion and Discussion
An understanding of the combined impact of implementing benign worm and quarantine defenses is of great importance for effectively containing worm epidemics. Aiming at this, an impulsive switching worm propagation model ( model) has been formulated and analyzed. The basic reproductive number has been calculated. A worm-free periodic solution has been acquired, and its local and global asymptotic stabilities have been proven by applying the next infection operator and by the comparison method if . The uniform persistence of benign worm has been illustrated. Finally, by numerical simulations, some conclusions have been drawn and the according suggestions for containing the worms spreading have been put forward.
However, in this paper, we only obtain the sufficient condition for the permanence of benign worm for the case . There are many issues that should be considered in our future work of system (5), in particular paying attention to the following points:(i)The existence and stability of boundary periodic solution.(ii)The threshold condition for the permanence.(iii)The existence and stability of a positive periodic solution.
Appendix
A. The Definition of
Let be the evolution operator of the linear ω-periodic system:
Denote
B. The Introduction of Assumptions ()–() for System (25)
() If , then the function , and are nonnegative and continuous on and continuously differential with respect to x for () If , then . Particularly, if , then for () for () If , then for () The pulse on the infected compartments must be uncoupled with the uninfected compartments, that is, is essentially , and () , where () , where , and
Data Availability
All data generated or analyzed during this study are included in this article.
Conflicts of Interest
The authors declare that there are no conflicts of interest regarding the publication of this paper.
Acknowledgments
The research has been supported by the Natural Science Foundation of China (11961003, 11561004, and 11901110) and Natural Science Foundation of Jiangxi Province (no. 20192BCBL20004).