Research Article Modeling and Analysis of...
12
Hindawi Publishing Corporation Journal of Applied Mathematics Volume 2013, Article ID 927369, 11 pages http://dx.doi.org/10.1155/2013/927369 Research Article Modeling and Analysis of Bifurcation in a Delayed Worm Propagation Model Yu Yao, 1,2 Nan Zhang, 1 Wenlong Xiang, 1 Ge Yu, 1,2 and Fuxiang Gao 1 1 College of Information Science and Engineering, Northeastern University, Shenyang 110819, China 2 Key Laboratory of Medical Image Computing, Northeastern University, Ministry of Education, Shenyang 110819, China Correspondence should be addressed to Yu Yao; [email protected] Received 18 January 2013; Revised 4 August 2013; Accepted 26 August 2013 Academic Editor: Yannick De Decker Copyright © 2013 Yu Yao et al. is is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited. A delayed worm propagation model with birth and death rates is formulated. e stability of the positive equilibrium is studied. rough theoretical analysis, a critical value 0 of Hopf bifurcation is derived. e worm propagation system is locally asymptotically stable when time delay is less than 0 . However, Hopf bifurcation appears when time delay passes the threshold 0 , which means that the worm propagation system is unstable and out of control. Consequently, time delay should be adjusted to be less than 0 to ensure the stability of the system stable and better prediction of the scale and speed of Internet worm spreading. Finally, numerical and simulation experiments are presented to simulate the system, which fully support our analysis. 1. Introduction In recent years, Internet is undoubtedly one of the fastest increasing scientific technologies, which brings about con- venience in people’s daily work and changes people’s life in variety of aspects. With rapid development of network applications and the increase of network complexity, security problems emerge progressively. Among them, the problem of Internet worms has become the focus with its wide infec- tion range, fast spread speed, and tremendous destruction. Enlightened by the researches in epidemiology, plenty of models have been constructed to predict the spread of worms and some containment strategies have been taken into con- sideration. In addition, birth and death rates are widely applied in epidemiology because individuals in the ecological system may die during the spread of diseases. Meanwhile baby individuals are born everyday and join the ecological system [1–3]. In the computer science field, computers are like individuals in an ecological system. As a result of being infected by Internet worms or quarantined by intrusion detection systems (IDS), hosts will get unstable and unreliable which will result in system reinstallation by their owners. Besides, when many new computers are brought, most of them are preinstalled with operating systems without newest safety patches. Furthermore, old computers are discarded and recycled at the same time. ese phenomena are quite simi- lar to the death and birth in epidemiology. us, in order to imitate the real world, birth and death rates should be intro- duced to worm propagation model. Quarantine strategies have been exploited and applied in the control of disease. e implementation of quarantine strategy in computer field relies on the IDS [4]. e IDS include two major categories: misuse intrusion detection and anomaly intrusion detection system. e anomaly detection system is commonly used to detect malicious code such as computer virus and worms for its relatively better perfor- mance [5, 6]. Once a deviation from the normal behavior is detected, such behavior is recognized as an attack and appro- priate response actions, such as quarantine or vaccination, are triggered. Mechanism of time window was brought in IDS in order to balance the false negative rate and false positive rate [7]. e introduction of time window is used to decide whether an alarm is a true or false positive based on the number of abnormal behaviors detected in a time window. It implies that the size of time window affects both the number of true positive and false positive rates. However, the import of the time window leads to time delay. erefore, in order to accord
Transcript of Research Article Modeling and Analysis of...
Hindawi Publishing CorporationJournal of Applied MathematicsVolume 2013 Article ID 927369 11 pageshttpdxdoiorg1011552013927369
Research ArticleModeling and Analysis of Bifurcation ina Delayed Worm Propagation Model
Yu Yao12 Nan Zhang1 Wenlong Xiang1 Ge Yu12 and Fuxiang Gao1
1 College of Information Science and Engineering Northeastern University Shenyang 110819 China2 Key Laboratory of Medical Image Computing Northeastern University Ministry of Education Shenyang 110819 China
Correspondence should be addressed to Yu Yao yaoyumailneueducn
Received 18 January 2013 Revised 4 August 2013 Accepted 26 August 2013
Academic Editor Yannick De Decker
Copyright copy 2013 Yu Yao et al This is an open access article distributed under the Creative Commons Attribution License whichpermits unrestricted use distribution and reproduction in any medium provided the original work is properly cited
A delayed worm propagation model with birth and death rates is formulated The stability of the positive equilibrium is studiedThrough theoretical analysis a critical value 120591
0ofHopf bifurcation is derivedThewormpropagation system is locally asymptotically
stable when time delay is less than 1205910 However Hopf bifurcation appears when time delay 120591 passes the threshold 120591
0 which means
that the worm propagation system is unstable and out of control Consequently time delay should be adjusted to be less than 1205910to
ensure the stability of the system stable and better prediction of the scale and speed of Internet worm spreading Finally numericaland simulation experiments are presented to simulate the system which fully support our analysis
1 Introduction
In recent years Internet is undoubtedly one of the fastestincreasing scientific technologies which brings about con-venience in peoplersquos daily work and changes peoplersquos lifein variety of aspects With rapid development of networkapplications and the increase of network complexity securityproblems emerge progressively Among them the problemof Internet worms has become the focus with its wide infec-tion range fast spread speed and tremendous destructionEnlightened by the researches in epidemiology plenty ofmodels have been constructed to predict the spread of wormsand some containment strategies have been taken into con-sideration In addition birth and death rates are widelyapplied in epidemiology because individuals in the ecologicalsystem may die during the spread of diseases Meanwhilebaby individuals are born everyday and join the ecologicalsystem [1ndash3] In the computer science field computers arelike individuals in an ecological system As a result of beinginfected by Internet worms or quarantined by intrusiondetection systems (IDS) hostswill get unstable andunreliablewhich will result in system reinstallation by their ownersBesides when many new computers are brought most ofthem are preinstalled with operating systems without newest
safety patches Furthermore old computers are discarded andrecycled at the same time These phenomena are quite simi-lar to the death and birth in epidemiology Thus in order toimitate the real world birth and death rates should be intro-duced to worm propagation model
Quarantine strategies have been exploited and appliedin the control of disease The implementation of quarantinestrategy in computer field relies on the IDS [4] The IDSinclude twomajor categories misuse intrusion detection andanomaly intrusion detection system The anomaly detectionsystem is commonly used to detect malicious code such ascomputer virus and worms for its relatively better perfor-mance [5 6] Once a deviation from the normal behavior isdetected such behavior is recognized as an attack and appro-priate response actions such as quarantine or vaccination aretriggered
Mechanism of time window was brought in IDS in orderto balance the false negative rate and false positive rate [7]The introduction of time window is used to decide whetheran alarm is a true or false positive based on the number ofabnormal behaviors detected in a time window It impliesthat the size of time window affects both the number of truepositive and false positive rates However the import of thetimewindow leads to time delayTherefore in order to accord
2 Journal of Applied Mathematics
with actual condition time delay should be considered Inthis paper time delay is introduced in the worm propagationmodel along with birth and death rates and its stability isanalyzed Moreover it is indicated that overlarge time delaymay result in the bifurcation which would do little help toeliminate the worms Consequently in order to guarantee thesimplification and stability of the worm propagation systemtime delay should be decreased appropriately by a decrease inthe window size
The rest of the paper is organized as follows In the nextsection related work on time delay and birth is death ratesand introduced Section 3 gives a brief introduction of thesimple worm propagation model and quarantine strategyAfterwards we present the delayed worm propagation modelwith birth and death rates and analyze the stability of thepositive equilibrium In Section 4 numerical and simulationexperiments are presented to support our theoretical analysisFinally Section 5 draws the conclusions
2 Related Work
Due to the high similarity between the spread of infectiousbiological viruses and computer worms some scholars haveused epidemic model to simulate and analyze the wormpropagation [8ndash14] For instance Staniford first constructsthe propagation of Internet worms by imitating epidemicpropagation models called simple epidemic model (SEM)model [9] susceptible-infected-removed (SIR) model playsa significant role in the research of worm propagation model[10] On the basis of SIR model Zou et al propose a wormpropagation model with two factors on Code Red [11] Ren etal give a novel computer virus propagation model and studyits dynamic behaviors [12] Mishra and Pandey formulatean e-epidemic SIRS model for the fuzzy transmission ofworms in computer network [13] L-X Yang and X Yanginvestigate the propagation behavior of virus programs andpropose that infected computers are connected to the Internetwith positive probability [14] Mathematical analysis andsimulation experiment of these models are conducted whichare helpful to predict the speed and scale of Internet wormpropagation In addition to our knowledge the use of quar-antine strategies has produced a great effect on controllingdisease Enlightened by this quarantine strategies are alsowidely used inworm containment [15ndash18] Yao et al constructawormpropagationmodelwith time delay under quarantineand its stability of the positive equilibrium is analyzed [15 16]Yao also proposes a pulse quarantine strategy to eliminateworms and obtains its stability condition [17] Wang et alpropose a novel epidemic model which combines both vacci-nations and dynamic quarantine methods referred to asSEIQV model [18]
Furthermore some scholars have done some researcheson time delay [19ndash21] Dong et al propose a computer virusmodel with time delay based on SEIR model [19] By pro-posing an SIRS model with stage structure and time delaysZhang et al perform some bifurcation analysis of this model[20] Zhang et al also consider a delayed predator-preyepidemiological system with disease spreading in predator
S I R120574120573I
Figure 1 State transition diagram of the KMmodel
population [21] In addition the direction of Hopf bifurca-tions and the stability of bifurcated periodic solutions arestudied which are our extension direction in the futureresearch
3 Worm Propagation Model
31 The Simple Worm Propagation Model Realizing thesimilarities between Internet worms and biological viruses inpropagation characteristics classical epidemic models havebeen applied to the research of worm propagation modelsInitially we introduce a simple propagation model theKermack Mckendrick model (KM model) [22] as the basisof our research
The KM model assumes that all Internet hosts are inone of three states susceptible state (119878) infectious state (119868)and removed state (119877) And hosts can only maintain onestate at any given moment Infectious hosts are convertedfrom susceptible hosts by a worm infection and can shift toremoved state through killing worms by antivirus softwaresand installing safety patches Once patches are installed thehosts can no longer be infected by wormsThe state transitiondiagram of the KMmodel is given in Figure 1
119878(119905) denotes the number of susceptible hosts at time 119905119868(119905) denotes the number of infectious hosts at time 119905 and119877(119905) denotes the number of removed hosts at time 119905The totalnumber of hosts in the network is 119873 and remains constant120573 is infection rate at which susceptible hosts are infected byinfectious hosts and 120574 is recovery rate at which infectioushosts get recovered The KM model can be formulated by aset of differential equations from the state transition diagramas follows
119889119878 (119905)
119889119905
= minus 120573119878 (119905) 119868 (119905)
119889119868 (119905)
119889119905
= 120573119878 (119905) 119868 (119905) minus 120574119868 (119905)
119889119877 (119905)
119889119905
= 120574119868 (119905)
(1)
Although KM model adopts recovery feature and doesgenerate some braking containment effect on the wormpropagation it only describes the initial stage of worm prop-agation and does not control the outbreaks of worms Moresuppression strategies should be taken to further control theworm propagation
32 The Worm Propagation Model with Quarantine StrategyQuarantine strategy which relies on the intrusion detectionsystem is an effective way to diminish the speed of wormpropagation On the basis of the KM model quarantine
Journal of Applied Mathematics 3
S I120574
Q
V
120593
120596
120573I
120572
Figure 2 State transition diagram of the quarantine model
strategy should be taken into consideration Firstly infectioushosts are detected by the systems and then get quarantinedand patched Moreover considering that hosts could getpatched whatever state the hosts stay we add a new pathfrom hosts in susceptible state to vaccinated state to accordwith actual situation The state transition diagram of theworm propagation model with quarantine strategy is givenin Figure 2
In this model vaccinated state equals to removed statein KM model and 119881(119905) denotes the number of vaccinatedhosts at time 119905 Susceptible hosts can be infected by wormswith an infection rate 120573 due to their vulnerabilities Afterinfection the hosts become infectious hosts which meansthe hosts can infect other susceptible hosts The hosts canbe directly patched into the vaccinated state before gettinginfected at rate 120596 By applying misuse intrusion detectionsystem for its relatively high accuracy we add a new statecalled quarantine state but only infectious hosts will bequarantined 119876(119905) denotes the number of quarantine hosts attime 119905 Infectious hosts will be quarantined at rate 120572 whichdepends on the performance of intrusion detection systemsand network devices When infectious hosts are quarantinedthe hosts will get rid of worms and get patched at rate 120593Meanwhile infectious hosts can be manually patched intovaccinated state at recovery rate 120574 It can be perceived thatif a host is patched it has gained immunity permanently
The differetial equations of this model are given as
119889119878 (119905)
119889119905
= minus 120573119868 (119905) 119878 (119905) minus 120596119878 (119905)
119889119868 (119905)
119889119905
= 120573119868 (119905) 119878 (119905) minus 120574119868 (119905) minus 120572119868 (119905)
119889119876 (119905)
119889119905
= 120572119868 (119905) minus 120593119876 (119905)
119889119881 (119905)
119889119905
= 120596119878 (119905) + 120574119868 (119905) + 120593119876 (119905)
(2)
The total number of this model is set to 119873 = 1 whichmeans the sum of hosts in all four states is equal to one thatis 119878(119905) + 119868(119905) + 119876(119905) + 119881(119905) = 1 Then the infection-free
equilibrium of this model and its stability condition will bestudied
The first second and third equations in system (2) haveno dependence on the last one therefore the last one can beomitted System (2) can be rewritten as a three-demensionalsystem
119889119878 (119905)
119889119905
= minus 120573119868 (119905) 119878 (119905) minus 120596119878 (119905)
119889119868 (119905)
119889119905
= 120573119868 (119905) 119878 (119905) minus 120574119868 (119905) minus 120572119868 (119905)
119889119876 (119905)
119889119905
= 120572119868 (119905) minus 120593119876 (119905)
(3)
Due to the infection-free state which the system holdsin the end the number of infectious hosts is equal to 0Obviously the number of susceptible hosts and number ofquarantined hosts are both equal to 0 because all of thehosts in the network will get patched at last no matter whichway the hosts take Thus the infection-free equilibrium point119864lowast(0 0 0) of system (3) can be obtained Since 119881(119905) = 119873 minus
119878(119905) minus 119868(119905) minus119876(119905) the infection-free equilibrium of the modelwith quarantine strategy is 119864lowast(0 0 0119873)
Although all infectious hosts in quarantine model con-vert to vaccinated hosts in other words worms have beeneliminated it is hardly appropriate for real world situationActually not all the hosts will convert to vaccinated hosts andno-patch hosts are still existing in the network and sufferinghigh risk of worm attack In addition considering that hostsare consumer electronic products the recycling of old hostshappens frequently every day In order to imitate the factsin the real world birth and death rates must be taken intoconsideration
Additionally due to the time windows of intrusion detec-tion system which decreases the number of false positivestime delay should be considered to accord with actualsituation Therefore in the next section the new model isproposed
33 The Delayed Worm Propagation Model with Birth andDeath Rates By adding time delay along with birth anddeath rates the delayed worm propagation model with birthand death rates is presented Figure 3 shows the state transi-tion diagram of the delayed worm propagation model withbirth and death rates
In this model the total number of hosts denoted by119873 isdivided into five parts Compared with quarantine model anew state delayed state is added The hosts do not have theability to infect other susceptible hosts but are not quaran-tined yet Therefore a new state is needed to represent thesehosts 119863(119905) denotes the hosts in delayed state at time 119905 Fur-thermore the hosts in susceptible infected quarantined andremoved states have the same rate 120583 to leave the networkIf the hosts are quarantined by IDS some of applicationsmay not access to network because their ports are occupiedby worms At this moment the users would like to reinstallOS and leave the network system Thus the birth and death
4 Journal of Applied Mathematics
S I120574
Q
V
120593
120583
120583120583120583
120572I
120596
p120583
D
120573I
120572I(t minus 120591)
(1 minus p)120583
Figure 3 State transition diagram of the delayed model
rates are correlative to the number of infectious hosts andquarantined hosts in the network system And the rate 120583 is
120583 = 1205830(
119868 (119905) + 119876 (119905)
119873
) (4)
The hosts in delayed state are not likely to leave thenetwork accounting for the activeness of these hosts Thenewborn hosts enter the system with the same rate 120583 ofwhich a portion 1 minus 119901 is recovered by installing patchesinstantly at birth This differs from the transition denoted by120596 because the hosts are vaccinated at the time of entering thenetwork by installing patched operating system The transi-tion 120596 represents the rate by which those susceptible in thenetwork get vaccinated by installing patches laterThedelayeddifferential equations are written as
119889119878 (119905)
119889119905
= 119901120583 (119873 (119905) minus 119863 (119905)) minus 120573119868 (119905) 119878 (119905) minus 120596119878 (119905) minus 120583119878 (119905)
119889119868 (119905)
119889119905
= 120573119868 (119905) 119878 (119905) minus 120574119868 (119905) minus 120572119868 (119905) minus 120583119868 (119905)
119889119863 (119905)
119889119905
= 120572119868 (119905) minus 120572119868 (119905 minus 120591)
119889119876 (119905)
119889119905
= 120572119868 (119905 minus 120591) minus 120593119876 (119905) minus 120583119876 (119905)
119889119881 (119905)
119889119905
= (1 minus 119901) 120583 (119873 (119905) minus 119863 (119905))
+ 120596119878 (119905) + 120574119868 (119905) + 120593119876 (119905) minus 120583119881 (119905)
(5)
Other notations are identical to those in the previousmodel To understand themmore clearly the notations in thismodel are shown in Table 1
Table 1 Notations in this paper
Notation Definition119873 Total number of hosts in the network119878(119905) Number of susceptible hosts at time 119905119868(119905) Number of infectious hosts at time 119905119863(119905) Number of delayed hosts at time 119905119876(119905) Number of quarantined hosts at time 119905119881(119905) Number of vaccinated hosts at time 119905120573 Infection rate120596 Vaccine rate of susceptible hosts120572 Quarantine rate120593 Removal rate of quaratined hosts120574 Removal rate of infectious hosts120583 Birth and death rates119901 Birth ratio of susceptible hosts120591 Length of the time window in IDS
As mentioned in Table 1 the population size is set to 119873which is set to unity
119878 (119905) + 119868 (119905) + 119863 (119905) + 119876 (119905) + 119881 (119905) = 119873 (6)
34 Stability of the Positive Equilibrium andBifurcation Analysis
Theorem 1 The system has a unique positive equilibrium119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) when the condition
(1198671) (119901120583120573119873(120583 + 120572 + 120574)(120583 + 120596)) gt 1
is satisfied where
119878lowast=
120583 + 120572 + 120574
120573
119863lowast= 120572120591119868
lowast 119876
lowast=
120572119868lowast
120593 + 120583
119881lowast=
120574119868lowast+ 120596119878lowast+ 120593119876lowast+ 120583 (1 minus 119901) (119873 minus 119863
lowast)
120583
(7)
Proof From system (5) according to [23] if all the derivativeson the left of equal sign of the system are set to 0 whichimplies that the system becomes stationary we can get
119878 =
120583 + 120572 + 120574
120573
119863 = 120572120591119868lowast 119876 =
120572119868lowast
120593 + 120583
119881 =
120574119868lowast+ 120596119878lowast+ 120593119876lowast+ 120583 (1 minus 119901) (119873 minus 119863
lowast)
120583
(8)
Substituting the value of each variable in (8) for each of (6)then we can get
120583 + 120572 + 120574
120573
+ 119868 + 120572120591119868 +
120572119868
120593 + 120583
+ 119881 = 119873 (9)
After solving this equation with respect to 119868lowast a solution of 119868lowastis obtained
119868 =
119901119873120583120573 minus (120583 + 120596) (120583 + 120572 + 120574)
120573 (120572 + 120583119901120572120591 + 120583 + 120574)
(10)
Journal of Applied Mathematics 5
Thus if (1198671) is satisfied (10) has one unique positive
root 119868lowast and there is one unique positive equilibrium
119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) of system (5) The proof is com-
pleted
According to (6)119881 = 119873minus119878minus 119868 minus119863minus119876 and thus system(5) can be simplified to
119889119878 (119905)
119889119905
= 119901120583 (119873 (119905) minus 119863 (119905)) minus 120573119868 (119905) 119878 (119905) minus 119908119878 (119905) minus 120583119878 (119905)
119889119868 (119905)
119889119905
= 120573119868 (119905) 119878 (119905) minus 120574119868 (119905) minus 120572119868 (119905) minus 120583119868 (119905)
119889119863 (119905)
119889119905
= 120572119868 (119905) minus 120572119868 (119905 minus 120591)
119889119876 (119905)
119889119905
= 120572119868 (119905 minus 120591) minus 120593119876 (119905) minus 120583119876 (119905)
(11)
The Jacobimatrix of (11) about119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) is givenby
119869 (119864lowast) = (
1198861
1198862
11988631198864
120573119868lowast
1198865
0 1198866
0 120572 minus 120572119890minus120582120591
0 0
0 120572119890minus120582120591
minus 1198867
0 1198868
) (12)
where
1198861= minus
1205830(119868lowast+ 119876lowast)
119873
minus 120596 minus 120573119868lowast
1198862=
1199011205830(119873 minus 119863
lowast)
119873
minus
1205830119878lowast
119873
minus 120573119878lowast
1198863= minus
1199011205830(119868lowast+ 119876lowast)
119873
1198864=
1199011205830(119873 minus 119863
lowast) minus 1205830119878lowast
119873
1198865= 120573119878lowastminus 120572 minus 120574 minus
21205830119868lowast+ 1205830119876lowast
119873
1198866= minus
1205830119868lowast
119873
1198867=
1205830119876lowast
119873
1198868= minus120593 minus
1205830119868lowast+ 21205830119876lowast
119873
(13)
The characteristic equation of that matrix can be obtained by
119875 (120582) + 119876 (120582) 119890minus120582120591
= 0 (14)
where
119875 (120582) = 1205824minus (1198861+ 1198865+ 1198868) 1205823
+ (11988611198865+ 11988611198868+ 11988651198868+ 11988661198867minus 1198862120573119868lowast) 1205822
+ (minus119886111988651198868minus 119886111988661198867+ 11988621198868120573119868lowast
+ 11988641198867120573119868lowastminus 1198863120572120573119868lowast) 120582
+ 11988631198868120572120573119868lowast
119876 (120582) = minus11988661205721205822+ (11988611198866120572 minus 1198864120572120573119868lowast+ 1198863120572120573119868lowast) 120582
minus 11988631198868120572120573119868lowast
(15)
Let1198873= minus (119886
1+ 1198865+ 1198868)
1198872= 11988611198865+ 11988611198868+ 11988651198868+ 11988661198867minus 1198862120573119868lowast
1198871= minus119886111988651198868minus 119886111988661198867+ 11988621198868120573119868lowast
+ 11988641198867120573119868lowastminus 1198863120572120573119868lowast
1198870= 11988631198868120572120573119868lowast
1198882= minus1198866120572
1198881= 11988611198866120572 minus 1198864120572120573119868lowast+ 1198863120572120573119868lowast
1198880= minus11988631198868120572120573119868lowast
(16)
Then119875 (120582) = 120582
4+ 11988731205823+ 11988721205822+ 1198871120582 + 1198870
119876 (120582) = 11988821205822+ 1198881120582 + 1198880
(17)
Theorem 2 The positive equilibrium 119864lowast is locally asymptoti-
cally stable without time delay if the following holds
(1198672) 1198873gt 0 119889
1gt 0 119887
1+ 1198881gt 0
where
1198891= 1198873(1198872+ 1198882) minus (1198871+ 1198881) (18)
is satisfied
Proof If 120591 = 0 then (14) reduces to
1205824+ 11988731205823+ (1198872+ 1198882) 1205822
+ (1198871+ 1198881) 120582 + (119887
0+ 1198880) = 0
(19)
Because 1198870+ 1198880= 0 equation (19) can be further reduced to
1205823+ 11988731205822+ (1198872+ 1198882) 120582 + (119887
1+ 1198881) = 0 (20)
According to Routh-Hurwitz criterion all the roots of(20) have negative real partsTherefore it can be deduced thatthe positive equilibrium 119864
lowast is locally asymptotically stablewithout time delay The proof is completed
Obviously 120582 = 119894120596 (120596 gt 0) is a root of (14) After separat-ing the real and imaginary parts it can be written as
1205964minus 11988721205962+ 1198870+ (1198880minus 11988821205962) cos (120596120591) + 119888
1120596 sin (120596120591) = 0
minus11988731205963+ 1198871120596 + (119888
21205962minus 1198880) sin (120596120591) + 119888
1120596 cos (120596120591) = 0
(21)
6 Journal of Applied Mathematics
From the two equations of (21) the following equationcan be obtained
1198882
11205962+ (1198882
21205962minus 1198880)
2
= (1205964minus 11988721205962+ 1198870)
2
+ (1198871120596 minus 11988731205963)
2
(22)
which implies that
1205968+ 11989831205966+ 11989821205964+ 11989811205962+ 1198980= 0 (23)
where
1198983= 1198872
3minus 21198872
1198982= 1198872
2+ 21198870minus 211988711198873minus 1198882
2
1198981= 1198872
1minus 1198882
1minus 211988721198870+ 211988801198882
1198980= 1198872
0minus 1198882
0
(24)
Then (23) reduces to
1205966+ 11989831205964+ 11989821205962+ 1198981= 0 (25)
Let 119911 = 1205962Then (25) can be written as
ℎ (119911) = 1199113+ 11989831199112+ 1198982119911 + 119898
1 (26)
Δ is defined as Δ = 1198982
3minus 31198982 And we can get a solution
119911lowast= (radicΔ minus 119898
3)3 of h(z)
Lemma 3 Suppose that (1198672) 1198873gt 0 119889
1gt 0 119887
1+ 1198881gt 0 is
satisfied
(i) If one of followings holds (a) Δ gt 0 119911lowast lt 0 (b) Δ gt
0 119911lowast gt 0 and ℎ(119911lowast) gt 0 then all roots of (14) havenegative real parts when 120591 isin [0 120591
0) and 120591
0is a certain
positive constant(ii) If the conditions (a) and (b) are not satisfied then all
roots of (14) have negative real parts for all 120591 ge 0
Proof When 120591 = 0 equation (14) can be reduced to
1205823+ 11988731205822+ (1198872+ 1198882) 120582 + (119887
1+ 1198881) = 0 (27)
By the Routh-Hurwitz criterion all roots of (20) havenegative real parts if and only if 119887
3gt 0 119889
1gt 0 and 119887
1+1198881gt 0
Considering (26) it is easy to see from the characters ofcubic algebra equation that ℎ(119911) is a strictly monotonicallyincreasing function if Δ le 0 If Δ gt 0 and 119911lowast lt 0 or Δ gt 0119911lowastgt 0 but ℎ(119911lowast) gt 0 then ℎ(119911) has no positive root Thus
under these conditions equation (14) has no purely imag-inary roots for any 120591 gt 0 In addition this also implies thatthe positive equilibrium 119864
lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) of system (5)
is absolutely stable Therefore the following theorem on thestability of positive equilibrium 119864
lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) can
be easily obtained
Theorem 4 Assume that (1198671) and (119867
2) are satisfied and Δ gt
0 and 119911lowast lt 0 orΔ gt 0 119911lowast gt 0 and ℎ(119911lowast) gt 0Then the positive
equilibrium 119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) of system (5) is absolutely
stable that is to say 119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) is asymptoticallystable for any time delay 120591 ge 0
It is assumed that the coefficients in ℎ(119911) satisfy thecondition as follows
(1198673) Δ gt 0 119911
lowastgt 0 ℎ(119911
lowast) lt 0
Then according to lemma in [15] it is known that (26) hasat least a positive root 120596
0 namely the characteristic equation
(14) has a pair of purely imaginary roots plusmn1198941205960
In view of the fact that (14) has a pair of purely imaginaryroots plusmn119894120596
0 the corresponding 120591
119896gt 0 is given by eliminating
sin(120596120591) in (21)
120591119896=
1
1205960
arccos[(11988721205962
0minus 1205964
0minus 1198870) (1198880minus 11988821205962
0)
(1198880minus 11988821205962
0)2+ 120596 (119887
31205962minus 1198871minus 1198881)
]
+
2119896120587
1205960
(119896 = 0 1 2 )
(28)
Let 120582(120591) = V(120591) + 119894120596(120591) be the root of (14) so that V(120591119896) = 0
and 120596(120591119896) = 1205960are satisfied when 120591 = 120591
119896
Lemma 5 Suppose that ℎ1015840(1199110) = 0 If 120591 = 120591
0 then plusmn119894120596
0is a
pair of simple purely imaginary roots of (14) In addition if theconditions in Lemma 3 are satisfied then
119889 (Re 120582)119889120591
10038161003816100381610038161003816100381610038161003816120591=120591119896
gt 0 (29)
This signifies that there exists at least one eigenvalue withpositive real part for 120591 gt 120591
119896 Differentiating both sides of (14)
with respect to 120591 it can be written as
(
119889120582
119889120591
)
minus1
= ((41205823+ 311988731205822+ 21198872120582 + 1198871)
+1198881119890minus120582120591
minus (1198881120582 + 1198880) 120591119890minus120582120591
)
times ((1198881120582 + 1198880) 120582119890minus120582120591
)
minus1
(30)
Therefore
sgn119889Re 120582119889120591
120591=120591119896
= sgnRe(119889120582119889120591
)
minus1
120582=1198941205960
= sgn1205962
0
Λ
(41205966
0+ 311989831205964
0
+211989821205962
0+ 1198981)
= sgn1205962
0
Λ
ℎ1015840(1205962
0) = sgn ℎ1015840 (1205962
0)
(31)
where Λ = 1198882
11205964
0+ 11988801205962
0 Then it can be derived that
119889 (Re 120582)119889120591
10038161003816100381610038161003816100381610038161003816120591=120591119896
gt 0 (32)
Journal of Applied Mathematics 7
times105
5
45
4
35
3
25
2
15
1
05
028024020016012080400
Tota
l num
ber o
f hos
ts
S(t)
I(t)
D(t)
Q(t)
R(t)
t (s)
Figure 4 Worm propagation trend of the model when 120591 lt 1205910
It follows the hypothesis (1198673) that ℎ1015840(1205962
0) = 0 Therefore
transversality condition holds and the conditions for Hopfbifurcation are satisfied when 120591 = 120591
119896 according to Hopf
bifurcation theorem [24] for functional differential equationsThen the following results can be obtained
Theorem 6 Suppose that the conditions (1198671) and (119867
2) are
satisfied
(i) For system (5) the equilibrium 119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast)
is locally asymptotically stable when 120591 isin [0 1205910) but
unstable when 120591 gt 1205910
(ii) When condition (1198673) is satisfied system (5) will
undergo a Hopf bifurcation at the positive equilibrium119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) when 120591 = 120591
119896(119896 = 0 1 2 )
where 120591119896is defined by (28)
Theorem 2 implies to us that when birth and death ratesand the mechanism of time window in intrusion detectionsystem are considered the length of time window is crucialfor the stability of the propagation process When time delayis less than the threshold 120591
0 the system will stabilize at
its infection equilibrium point which is beneficial to fur-ther implement containment strategies to eliminate wormsHowever when time delay is greater than the threshold thesystem will be unstable and undergo a bifurcation Althoughthe propagation of worm presents a periodical phenome-non in real world complicated environment may make thepropagation pass the critical state and reach to an unpre-dictable chaos
4 Numerical and Simulation Experiments
41 Numerical Experiments The parameters of the delayedmodelwill be chosen properly according to the stability of thepositive equilibrium bifurcation analysis and the practicalenvironment 500000 hosts are picked as the population sizeand the wormrsquos average scan rate is 120578 = 4000 per secondThe worm infection rate can be calculated as 120576 = 1205781198732
32=
04657 [11] which means that average 04657 hosts of all the
times105
Tota
l num
ber o
f hos
ts
S(t)
I(t)
R(t)
5
4
3
2
1
00 500 1000 1500 2000 2500 3000
t (s)
Figure 5 Worm propagation trend of the model when 120591 gt 1205910
25
2
15
1
05
00 100 200 300 400 500 600 700 800
times105
I(t)
t(s)
Figure 6 The number of 119868(119905) when 120591 is changed
hosts can be scanned by one host The infection ratio is 120573 =
120578232
= 00000053 The rest of the parameters are 120574 = 0031205830= 0026 120596 = 000001 120572 = 056 120593 = 00009 and
119901 = 099 Initially 119868(0) = 50 which means that there are50 infectious hosts while the rest of the hosts are susceptibleat the beginning
Figure 4 shows the curves of five kinds of hosts when120591 = 5 lt 120591
0 All of the five kinds of hosts get stable within
4 minutes which illustrates that 119864lowast is asymptotically stableIt implies that the number of infectious hosts maintain aconstant level and thus can be predicted Further strategiescan be developed and utilized to eliminate worms But whentime delay 120591 gets increased and then reach the threshold 120591
0
119864lowast will lose its stability and a bifurcation will occur Figure 5
shows the susceptible infected and recovered hosts when120591 gt 1205910 In this firgure we can clearly see that the number of
infectious hosts will outburst after a short period of peaceand repeat again and again but not in the same period
In order to see the influence of time delay 120591 is set to adifferent value each time with other parameters remainingthe same Figure 6 shows the number of infected hosts in the
8 Journal of Applied Mathematics
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 5
t (s)
(a)
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 15
t (s)
(b)
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 45
t (s)
(c)
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 90
t (s)
(d)
Figure 7 The number of 119868(119905) when 120591 is changed
same coordinate with time delays 120591 = 5 120591 = 15 120591 = 45 and120591 = 90 respectively
Figure 7 gives the four curves in four coordinates In thesetwo figures the impact of time delay on infected hosts isevident Initially the four curves are overlapped whichmeansthat time delay has little effect in the initial stage of wormpropagationWith the increase of time delay the curve beginsto oscillate When time delay passes through the threshold1205910 the infecting process gets unstable Then simultaneously
it can be discovered that the amplitude and period of thenumber of infected hosts get increased
Figure 8(a) shows the projection of the phase portrait ofsystem (5) when 120591 = 15 lt 120591
0in (119878 119868 119881)-space The curve
converges to a fixed point which suggests that the system isstable Figure 8(b) shows the projection of the phase portraitof system (5) when 120591 = 25 gt 120591
0in (119878 119868 119881)-space The curve
converges to a limit circle which implies that the system isunstable Figures 8(c) and 8(d) show the phase portraits ofsusceptible 119878(119905) and infected 119868(119905) as 120591 = 15 lt 120591
0and 120591 = 25 gt
1205910 respectively
42 Simulation Experiments The discrete-time simulation isan expanded version of Zoursquos program simulating Code Redworm propagation and has been modified to run on a Linuxserver The system in our simulation experiment consistsof 500000 hosts that can reach each other directly which
is consistent with the numerical experiments and there isno topology issue in our simulation At the beginning ofsimulation 50 hosts are randomly chosen to be infectious andthe others are all susceptible
Identical with the results of numerical experimentsFigure 9 shows all five kinds of hosts when 120591 = 5 lt 120591
0 We
find that themodel will reach a stable state after a short periodof time which suggests that the number of infetious hosts canbe predicted and we can develop further strategy to eliminateworms
When time delay increases but is less than the thresholdderived from theoretical analysis the number of infectioushosts and other hosts present a damped oscillation and finallyreach an approximately stable state Figure 10 shows the num-ber of five kinds of hosts when 120591 = 15 lt 120591
0 An interesting
result is that the number of each host maintain a slightrandom vibration However the overall amplitude is only0273 to the population size and themaximumamplitude isonly 0953 to the population size The reason why this phe-nomenon occurs is due to the random events in simulationexperiments The implement of transition rates of the modelis based on probability That is to say when the removal rateof infectious hosts is set to 003 it means that the probabilityof transition from infectious hosts to vaccinated state is 3 italso means that infectious hosts get patched with probabilityof 3 To investigate this phenomenon phase portrait of
Journal of Applied Mathematics 9
0
1
2
3
4
5
0
005
115
2
I(t)
times104
times10 5
times105
S(t)
2
4V(t)
120591 = 15
(a) The projection of the phase portrait in (119878 119868 119877)-space when 120591 lt 1205910
0
1
2
3
4
5
0
005
115
2
I(t)
times104
times10 5
times105
S(t)
2
4V(t)
120591 = 25
(b) The projection of the phase portrait in (119878 119868 119877)-space when 120591 gt 1205910
5
4
3
2
1
00 02 04 06 08 1 12 14 16 18 2
I(t)
S(t)
times105
times105
120591 = 15
(c) The phase portrait of susceptible 119878(119905) and infected 119868(119905) when 120591 lt 1205910
5
4
3
2
1
00 02 04 06 08 1 12 14 16 18 2
I(t)
S(t)
times105
times105
120591 = 25
(d) The phase portrait of susceptible 119878(119905) and infected 119868(119905) when 120591 gt 1205910
Figure 8 The phase portrait when 120591 lt 1205910and 120591 gt 120591
0
S(t)
I(t)
D(t)
Q(t)
V(t)
5
45
4
35
3
25
2
15
1
05
00 50 100 150 200 250 300 350 400 450 500
times105
Num
ber o
f hos
ts
t (s)
Figure 9 Simulation result of the five kinds of hosts when 120591 lt 1205910
susceptible 119878(119905) and infected 119868(119905) is depictedwhen 120591 = 15 lt 1205910
as shown Figure 11 It shows that the curve is converged to afixed point which means that the system gets stable
When time delay passes the threshold a bifurcationappears Figure 12 shows the number of susceptible infectiousand vaccinated hosts when 120591 gt 120591
0 Figure 13 shows the differ-
ence between simulation and numerical results of susceptibleand infectious hosts respectively In this figure the periods
S(t)
I(t)
D(t)
Q(t)
V(t)
5
45
4
35
3
25
2
15
1
05
00 500
times105
Num
ber o
f hos
ts
1000 1500 2000 2500 3000 3500
t (s)
Figure 10 Simulation result of the five kinds of hosts when 120591 = 15
of these two curves are well matched which suggests thatthe results of numerical and simulation experiments areidentical But there is a difference of 96 of total populationsize in amplitudes This mainly results from the precision ofexperiments The number of hosts in numerical experimentscan be either integers or decimals because it is the solution ofdifferential equations However in simulation experimentsthe number of hosts must be integers Furthermore when the
10 Journal of Applied Mathematics
5
45
4
35
3
25
2
15
1
05
0
times105
I(t)
S(t)
times1040 2 4 6 8 10 12 14 16 18
120591 = 15
Figure 11 The phase portrait of susceptible 119878(119905) and infected 119868(119905)
when 120591 = 15
S(t)
I(t)
V(t)
5
45
4
35
3
25
2
15
1
05
00 500
times105
Num
ber o
f hos
ts
1000 1500 2000 2500 3000
t (s)
Figure 12 Simulation result of the three kinds of hosts when 120591 gt 1205910
number of infectious hosts are very little this tiny differencewill result in a big gap afterwards
5 Conclusions
In order to accord with actual facts in the real world timedelay generated by time window in IDS is introduced toconstruct the worm propagation model Dynamic birth anddeath rates are considered in this paper accounting for thereinstallation of OS which users are more likely to do afterwhen the hosts suffer wormrsquos destruction or quarantined tothe Internet In addition combined with birth and deathrates time delay may lead to bifurcation and make the wormpropagation system unstable
In this paper a delayed worm propagation model withbirth and death rates is studied Next the stability of thepositive equilibrium is analyzedThrough theoretical analysisand numerical and simulation experiments the followingconclusions can be derived
(i) The introduction of time window in IDS may lead totime delay in worm propagationmodel which resultsin bifurcation The critical time delay 120591
0where the
bifurcation appears is obtained
S(t)
5
45
4
35
3
25
2
15
1
05
00 500
times105
1000 1500 2000 2500 3000
S(t) in numerical experimentS(t) in simulation experiment
t (s)
(a) The comparison of the number of susceptible hosts
I(t)
25
2
15
1
05
00 500
times105
1000 1500 2000 2500 30000 500 1000 1500 2000 2500 300
I(t) in numerical experimentI(t) in simulation experiment
t (s)
(b) The comparison of the number of infectious hosts
Figure 13 The comparison of numerical and simulation experi-ments
(ii) The worm propagation system is stable when timedelay 120591 lt 120591
0 In this situation the worm propagation
can be easily predicted and eliminated(iii) A bifurcation emerges when time delay 120591 ge 120591
0 which
means the worm propagation is unstable and may beout of control
Consequently time delay 120591 should remain less than 1205910
by decreasing the time window in IDS which is helpful topredict the worm propagation and even eliminate the worm
In this paper we have only discussed the cases whichsatisfy conditions (119867
1) (1198672) and (119867
3) But for cases that
satisfy (1198671) (1198672) and (119867
3) the dynamical behavior of this
model has not been studied These issues will be studied anddiscussed in our future work
Acknowledgments
The authors are very grateful to the anonymous referee formany valuable comments and suggestions which led to asignificant improvement of the original paper This paper
Journal of Applied Mathematics 11
is supported by the National Natural Science Foundationof China under Grant no 60803132 the Natural ScienceFoundation of Liaoning Province of China under Grant no201202059 Program for Liaoning Excellent Talents in Uni-versity under LR2013011 the Fundamental Research Funds ofthe Central Universities under Grant nos N120504006 andN100704001 and MOE-Intel Special Fund of InformationTechnology (MOE-INTEL-2012-06)
References
[1] N Yoshida and T Hara ldquoGlobal stability of a delayed SIR epide-mic model with density dependent birth and death ratesrdquo Jour-nal of Computational and Applied Mathematics vol 201 no 2pp 339ndash347 2007
[2] M Song W Ma and Y Takeuchi ldquoPermanence of a delayedSIR epidemic model with density dependent birth raterdquo Journalof Computational and Applied Mathematics vol 201 no 2 pp389ndash394 2007
[3] J Liu and T Zhang ldquoBifurcation analysis of an SIS epidemicmodel with nonlinear birth raterdquo Chaos Solitons and Fractalsvol 40 no 3 pp 1091ndash1099 2009
[4] V Yegneswaran P Barford and D Plonka ldquoOn the design anduse of internet sinks for network abuse monitoringrdquo ComputerScience vol 3224 pp 146ndash165 2004
[5] D Yeung and Y Ding ldquoHost-based intrusion detection usingdynamic and static behavioralmodelsrdquo Pattern Recognition vol36 no 1 pp 229ndash243 2003
[6] N Stakhanova S Basu and JWong ldquoOn the symbiosis of speci-fication-based and anomaly-based detectionrdquo Computers andSecurity vol 29 no 2 pp 253ndash268 2010
[7] G P Spathoulas and S K Katsikas ldquoReducing false positives inintrusion detection systemsrdquo Computers and Security vol 29no 1 pp 35ndash44 2010
[8] C Lin B Liu H Hu F Xiao and J Zhang ldquoDetecting hid-den Malware method based on ldquoIn-VMrdquo modelrdquo China Com-munications vol 8 no 4 pp 99ndash108 2011
[9] S Staniford V Paxson and N Weaver ldquoHow to own theinternet in your spare timerdquo in Proceedings of the 11th USENIXSecurity Symposium pp 149ndash167 San Francisco Calif USA2002
[10] S Qing and W Wen ldquoA survey and trends on Internet wormsrdquoComputers and Security vol 24 no 4 pp 334ndash346 2005
[11] C C ZouW Gong and D Towsley ldquoWorm propagation mod-eling and analysis under dynamic quarantine defenserdquo in Pro-ceedings of the 2003 ACMWorkshop on Rapid Malcode (WORMrsquo03) pp 51ndash60 Washington DC USA October 2003
[12] J Ren X Yang Q Zhu L Yang and C Zhang ldquoA novel com-puter virus model and its dynamicsrdquo Nonlinear Analysis RealWorld Applications vol 13 no 1 pp 376ndash384 2012
[13] B K Mishra and S K Pandey ldquoFuzzy epidemic model for thetransmission of worms in computer networkrdquo Nonlinear Ana-lysis Real World Applications vol 11 no 5 pp 4335ndash4341 2010
[14] L-X Yang and X Yang ldquoPropagation behavior of virus codesin the situation that infected computers are connected to theinternet with positive probabilityrdquo Discrete Dynamics in Natureand Society vol 2012 Article ID 693695 13 pages 2012
[15] Y Yao X Xie H Guo G Yu F Gao and X Tong ldquoHopf bifur-cation in an Internet worm propagation model with time delayin quarantinerdquoMathematical and Computer Modelling 2011
[16] Y Yao W Xiang A Qu G Yu and F Gao ldquoHopf bifurcationin an SEIDQV worm propagation model with quarantine stra-tegyrdquoDiscrete Dynamics in Nature and Society vol 2012 ArticleID 304868 18 pages 2012
[17] Y Yao L Guo H Guo G Yu F Gao and X Tong ldquoPulsequarantine strategy of internet worm propagation modelingand analysisrdquo Computers and Electrical Engineering 2011
[18] F Wang Y Zhang C Wang J Ma and S Moon ldquoStability ana-lysis of a SEIQV epidemic model for rapid spreading wormsrdquoComputers and Security vol 29 no 4 pp 410ndash418 2010
[19] T Dong X Liao and H Li ldquoStability and Hopf bifurcation ina computer virus model with multistate antivirusrdquo Abstract andApplied Analysis vol 2012 Article ID 841987 16 pages 2012
[20] T Zhang J Liu and Z Teng ldquoStability of Hopf bifurcation of adelayed SIRS epidemic model with stage structurerdquo NonlinearAnalysis Real World Applications vol 11 no 1 pp 293ndash3062010
[21] J Zhang W Li and X Yan ldquoHopf bifurcation and stabilityof periodic solutions in a delayed eco-epidemiological systemrdquoApplied Mathematics and Computation vol 198 no 2 pp 865ndash876 2008
[22] W Kermack and A McKendrick ldquoA contribution to the mathe-matical theory of epidemicsrdquo Proceedings of the Royal Society ofLondon A vol 115 no 772 pp 700ndash721 1927
[23] S Wang Q Liu X Yu and Y Ma ldquoBifurcation analysis of amodel for network worm propagation with time delayrdquoMathe-matical and Computer Modelling vol 52 no 3-4 pp 435ndash4472010
[24] B Hassard D Kazarino and Y WanTheory and Application ofHopf Bifurcation Cambridge University Press Cambridge UK1981
Submit your manuscripts athttpwwwhindawicom
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Mathematical Problems in Engineering
Hindawi Publishing Corporationhttpwwwhindawicom
Differential EquationsInternational Journal of
Volume 2014
Applied MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Mathematical PhysicsAdvances in
Complex AnalysisJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
OptimizationJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
International Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Operations ResearchAdvances in
Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Function Spaces
Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
International Journal of Mathematics and Mathematical Sciences
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Algebra
Discrete Dynamics in Nature and Society
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Decision SciencesAdvances in
Discrete MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom
Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Stochastic AnalysisInternational Journal of
2 Journal of Applied Mathematics
with actual condition time delay should be considered Inthis paper time delay is introduced in the worm propagationmodel along with birth and death rates and its stability isanalyzed Moreover it is indicated that overlarge time delaymay result in the bifurcation which would do little help toeliminate the worms Consequently in order to guarantee thesimplification and stability of the worm propagation systemtime delay should be decreased appropriately by a decrease inthe window size
The rest of the paper is organized as follows In the nextsection related work on time delay and birth is death ratesand introduced Section 3 gives a brief introduction of thesimple worm propagation model and quarantine strategyAfterwards we present the delayed worm propagation modelwith birth and death rates and analyze the stability of thepositive equilibrium In Section 4 numerical and simulationexperiments are presented to support our theoretical analysisFinally Section 5 draws the conclusions
2 Related Work
Due to the high similarity between the spread of infectiousbiological viruses and computer worms some scholars haveused epidemic model to simulate and analyze the wormpropagation [8ndash14] For instance Staniford first constructsthe propagation of Internet worms by imitating epidemicpropagation models called simple epidemic model (SEM)model [9] susceptible-infected-removed (SIR) model playsa significant role in the research of worm propagation model[10] On the basis of SIR model Zou et al propose a wormpropagation model with two factors on Code Red [11] Ren etal give a novel computer virus propagation model and studyits dynamic behaviors [12] Mishra and Pandey formulatean e-epidemic SIRS model for the fuzzy transmission ofworms in computer network [13] L-X Yang and X Yanginvestigate the propagation behavior of virus programs andpropose that infected computers are connected to the Internetwith positive probability [14] Mathematical analysis andsimulation experiment of these models are conducted whichare helpful to predict the speed and scale of Internet wormpropagation In addition to our knowledge the use of quar-antine strategies has produced a great effect on controllingdisease Enlightened by this quarantine strategies are alsowidely used inworm containment [15ndash18] Yao et al constructawormpropagationmodelwith time delay under quarantineand its stability of the positive equilibrium is analyzed [15 16]Yao also proposes a pulse quarantine strategy to eliminateworms and obtains its stability condition [17] Wang et alpropose a novel epidemic model which combines both vacci-nations and dynamic quarantine methods referred to asSEIQV model [18]
Furthermore some scholars have done some researcheson time delay [19ndash21] Dong et al propose a computer virusmodel with time delay based on SEIR model [19] By pro-posing an SIRS model with stage structure and time delaysZhang et al perform some bifurcation analysis of this model[20] Zhang et al also consider a delayed predator-preyepidemiological system with disease spreading in predator
S I R120574120573I
Figure 1 State transition diagram of the KMmodel
population [21] In addition the direction of Hopf bifurca-tions and the stability of bifurcated periodic solutions arestudied which are our extension direction in the futureresearch
3 Worm Propagation Model
31 The Simple Worm Propagation Model Realizing thesimilarities between Internet worms and biological viruses inpropagation characteristics classical epidemic models havebeen applied to the research of worm propagation modelsInitially we introduce a simple propagation model theKermack Mckendrick model (KM model) [22] as the basisof our research
The KM model assumes that all Internet hosts are inone of three states susceptible state (119878) infectious state (119868)and removed state (119877) And hosts can only maintain onestate at any given moment Infectious hosts are convertedfrom susceptible hosts by a worm infection and can shift toremoved state through killing worms by antivirus softwaresand installing safety patches Once patches are installed thehosts can no longer be infected by wormsThe state transitiondiagram of the KMmodel is given in Figure 1
119878(119905) denotes the number of susceptible hosts at time 119905119868(119905) denotes the number of infectious hosts at time 119905 and119877(119905) denotes the number of removed hosts at time 119905The totalnumber of hosts in the network is 119873 and remains constant120573 is infection rate at which susceptible hosts are infected byinfectious hosts and 120574 is recovery rate at which infectioushosts get recovered The KM model can be formulated by aset of differential equations from the state transition diagramas follows
119889119878 (119905)
119889119905
= minus 120573119878 (119905) 119868 (119905)
119889119868 (119905)
119889119905
= 120573119878 (119905) 119868 (119905) minus 120574119868 (119905)
119889119877 (119905)
119889119905
= 120574119868 (119905)
(1)
Although KM model adopts recovery feature and doesgenerate some braking containment effect on the wormpropagation it only describes the initial stage of worm prop-agation and does not control the outbreaks of worms Moresuppression strategies should be taken to further control theworm propagation
32 The Worm Propagation Model with Quarantine StrategyQuarantine strategy which relies on the intrusion detectionsystem is an effective way to diminish the speed of wormpropagation On the basis of the KM model quarantine
Journal of Applied Mathematics 3
S I120574
Q
V
120593
120596
120573I
120572
Figure 2 State transition diagram of the quarantine model
strategy should be taken into consideration Firstly infectioushosts are detected by the systems and then get quarantinedand patched Moreover considering that hosts could getpatched whatever state the hosts stay we add a new pathfrom hosts in susceptible state to vaccinated state to accordwith actual situation The state transition diagram of theworm propagation model with quarantine strategy is givenin Figure 2
In this model vaccinated state equals to removed statein KM model and 119881(119905) denotes the number of vaccinatedhosts at time 119905 Susceptible hosts can be infected by wormswith an infection rate 120573 due to their vulnerabilities Afterinfection the hosts become infectious hosts which meansthe hosts can infect other susceptible hosts The hosts canbe directly patched into the vaccinated state before gettinginfected at rate 120596 By applying misuse intrusion detectionsystem for its relatively high accuracy we add a new statecalled quarantine state but only infectious hosts will bequarantined 119876(119905) denotes the number of quarantine hosts attime 119905 Infectious hosts will be quarantined at rate 120572 whichdepends on the performance of intrusion detection systemsand network devices When infectious hosts are quarantinedthe hosts will get rid of worms and get patched at rate 120593Meanwhile infectious hosts can be manually patched intovaccinated state at recovery rate 120574 It can be perceived thatif a host is patched it has gained immunity permanently
The differetial equations of this model are given as
119889119878 (119905)
119889119905
= minus 120573119868 (119905) 119878 (119905) minus 120596119878 (119905)
119889119868 (119905)
119889119905
= 120573119868 (119905) 119878 (119905) minus 120574119868 (119905) minus 120572119868 (119905)
119889119876 (119905)
119889119905
= 120572119868 (119905) minus 120593119876 (119905)
119889119881 (119905)
119889119905
= 120596119878 (119905) + 120574119868 (119905) + 120593119876 (119905)
(2)
The total number of this model is set to 119873 = 1 whichmeans the sum of hosts in all four states is equal to one thatis 119878(119905) + 119868(119905) + 119876(119905) + 119881(119905) = 1 Then the infection-free
equilibrium of this model and its stability condition will bestudied
The first second and third equations in system (2) haveno dependence on the last one therefore the last one can beomitted System (2) can be rewritten as a three-demensionalsystem
119889119878 (119905)
119889119905
= minus 120573119868 (119905) 119878 (119905) minus 120596119878 (119905)
119889119868 (119905)
119889119905
= 120573119868 (119905) 119878 (119905) minus 120574119868 (119905) minus 120572119868 (119905)
119889119876 (119905)
119889119905
= 120572119868 (119905) minus 120593119876 (119905)
(3)
Due to the infection-free state which the system holdsin the end the number of infectious hosts is equal to 0Obviously the number of susceptible hosts and number ofquarantined hosts are both equal to 0 because all of thehosts in the network will get patched at last no matter whichway the hosts take Thus the infection-free equilibrium point119864lowast(0 0 0) of system (3) can be obtained Since 119881(119905) = 119873 minus
119878(119905) minus 119868(119905) minus119876(119905) the infection-free equilibrium of the modelwith quarantine strategy is 119864lowast(0 0 0119873)
Although all infectious hosts in quarantine model con-vert to vaccinated hosts in other words worms have beeneliminated it is hardly appropriate for real world situationActually not all the hosts will convert to vaccinated hosts andno-patch hosts are still existing in the network and sufferinghigh risk of worm attack In addition considering that hostsare consumer electronic products the recycling of old hostshappens frequently every day In order to imitate the factsin the real world birth and death rates must be taken intoconsideration
Additionally due to the time windows of intrusion detec-tion system which decreases the number of false positivestime delay should be considered to accord with actualsituation Therefore in the next section the new model isproposed
33 The Delayed Worm Propagation Model with Birth andDeath Rates By adding time delay along with birth anddeath rates the delayed worm propagation model with birthand death rates is presented Figure 3 shows the state transi-tion diagram of the delayed worm propagation model withbirth and death rates
In this model the total number of hosts denoted by119873 isdivided into five parts Compared with quarantine model anew state delayed state is added The hosts do not have theability to infect other susceptible hosts but are not quaran-tined yet Therefore a new state is needed to represent thesehosts 119863(119905) denotes the hosts in delayed state at time 119905 Fur-thermore the hosts in susceptible infected quarantined andremoved states have the same rate 120583 to leave the networkIf the hosts are quarantined by IDS some of applicationsmay not access to network because their ports are occupiedby worms At this moment the users would like to reinstallOS and leave the network system Thus the birth and death
4 Journal of Applied Mathematics
S I120574
Q
V
120593
120583
120583120583120583
120572I
120596
p120583
D
120573I
120572I(t minus 120591)
(1 minus p)120583
Figure 3 State transition diagram of the delayed model
rates are correlative to the number of infectious hosts andquarantined hosts in the network system And the rate 120583 is
120583 = 1205830(
119868 (119905) + 119876 (119905)
119873
) (4)
The hosts in delayed state are not likely to leave thenetwork accounting for the activeness of these hosts Thenewborn hosts enter the system with the same rate 120583 ofwhich a portion 1 minus 119901 is recovered by installing patchesinstantly at birth This differs from the transition denoted by120596 because the hosts are vaccinated at the time of entering thenetwork by installing patched operating system The transi-tion 120596 represents the rate by which those susceptible in thenetwork get vaccinated by installing patches laterThedelayeddifferential equations are written as
119889119878 (119905)
119889119905
= 119901120583 (119873 (119905) minus 119863 (119905)) minus 120573119868 (119905) 119878 (119905) minus 120596119878 (119905) minus 120583119878 (119905)
119889119868 (119905)
119889119905
= 120573119868 (119905) 119878 (119905) minus 120574119868 (119905) minus 120572119868 (119905) minus 120583119868 (119905)
119889119863 (119905)
119889119905
= 120572119868 (119905) minus 120572119868 (119905 minus 120591)
119889119876 (119905)
119889119905
= 120572119868 (119905 minus 120591) minus 120593119876 (119905) minus 120583119876 (119905)
119889119881 (119905)
119889119905
= (1 minus 119901) 120583 (119873 (119905) minus 119863 (119905))
+ 120596119878 (119905) + 120574119868 (119905) + 120593119876 (119905) minus 120583119881 (119905)
(5)
Other notations are identical to those in the previousmodel To understand themmore clearly the notations in thismodel are shown in Table 1
Table 1 Notations in this paper
Notation Definition119873 Total number of hosts in the network119878(119905) Number of susceptible hosts at time 119905119868(119905) Number of infectious hosts at time 119905119863(119905) Number of delayed hosts at time 119905119876(119905) Number of quarantined hosts at time 119905119881(119905) Number of vaccinated hosts at time 119905120573 Infection rate120596 Vaccine rate of susceptible hosts120572 Quarantine rate120593 Removal rate of quaratined hosts120574 Removal rate of infectious hosts120583 Birth and death rates119901 Birth ratio of susceptible hosts120591 Length of the time window in IDS
As mentioned in Table 1 the population size is set to 119873which is set to unity
119878 (119905) + 119868 (119905) + 119863 (119905) + 119876 (119905) + 119881 (119905) = 119873 (6)
34 Stability of the Positive Equilibrium andBifurcation Analysis
Theorem 1 The system has a unique positive equilibrium119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) when the condition
(1198671) (119901120583120573119873(120583 + 120572 + 120574)(120583 + 120596)) gt 1
is satisfied where
119878lowast=
120583 + 120572 + 120574
120573
119863lowast= 120572120591119868
lowast 119876
lowast=
120572119868lowast
120593 + 120583
119881lowast=
120574119868lowast+ 120596119878lowast+ 120593119876lowast+ 120583 (1 minus 119901) (119873 minus 119863
lowast)
120583
(7)
Proof From system (5) according to [23] if all the derivativeson the left of equal sign of the system are set to 0 whichimplies that the system becomes stationary we can get
119878 =
120583 + 120572 + 120574
120573
119863 = 120572120591119868lowast 119876 =
120572119868lowast
120593 + 120583
119881 =
120574119868lowast+ 120596119878lowast+ 120593119876lowast+ 120583 (1 minus 119901) (119873 minus 119863
lowast)
120583
(8)
Substituting the value of each variable in (8) for each of (6)then we can get
120583 + 120572 + 120574
120573
+ 119868 + 120572120591119868 +
120572119868
120593 + 120583
+ 119881 = 119873 (9)
After solving this equation with respect to 119868lowast a solution of 119868lowastis obtained
119868 =
119901119873120583120573 minus (120583 + 120596) (120583 + 120572 + 120574)
120573 (120572 + 120583119901120572120591 + 120583 + 120574)
(10)
Journal of Applied Mathematics 5
Thus if (1198671) is satisfied (10) has one unique positive
root 119868lowast and there is one unique positive equilibrium
119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) of system (5) The proof is com-
pleted
According to (6)119881 = 119873minus119878minus 119868 minus119863minus119876 and thus system(5) can be simplified to
119889119878 (119905)
119889119905
= 119901120583 (119873 (119905) minus 119863 (119905)) minus 120573119868 (119905) 119878 (119905) minus 119908119878 (119905) minus 120583119878 (119905)
119889119868 (119905)
119889119905
= 120573119868 (119905) 119878 (119905) minus 120574119868 (119905) minus 120572119868 (119905) minus 120583119868 (119905)
119889119863 (119905)
119889119905
= 120572119868 (119905) minus 120572119868 (119905 minus 120591)
119889119876 (119905)
119889119905
= 120572119868 (119905 minus 120591) minus 120593119876 (119905) minus 120583119876 (119905)
(11)
The Jacobimatrix of (11) about119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) is givenby
119869 (119864lowast) = (
1198861
1198862
11988631198864
120573119868lowast
1198865
0 1198866
0 120572 minus 120572119890minus120582120591
0 0
0 120572119890minus120582120591
minus 1198867
0 1198868
) (12)
where
1198861= minus
1205830(119868lowast+ 119876lowast)
119873
minus 120596 minus 120573119868lowast
1198862=
1199011205830(119873 minus 119863
lowast)
119873
minus
1205830119878lowast
119873
minus 120573119878lowast
1198863= minus
1199011205830(119868lowast+ 119876lowast)
119873
1198864=
1199011205830(119873 minus 119863
lowast) minus 1205830119878lowast
119873
1198865= 120573119878lowastminus 120572 minus 120574 minus
21205830119868lowast+ 1205830119876lowast
119873
1198866= minus
1205830119868lowast
119873
1198867=
1205830119876lowast
119873
1198868= minus120593 minus
1205830119868lowast+ 21205830119876lowast
119873
(13)
The characteristic equation of that matrix can be obtained by
119875 (120582) + 119876 (120582) 119890minus120582120591
= 0 (14)
where
119875 (120582) = 1205824minus (1198861+ 1198865+ 1198868) 1205823
+ (11988611198865+ 11988611198868+ 11988651198868+ 11988661198867minus 1198862120573119868lowast) 1205822
+ (minus119886111988651198868minus 119886111988661198867+ 11988621198868120573119868lowast
+ 11988641198867120573119868lowastminus 1198863120572120573119868lowast) 120582
+ 11988631198868120572120573119868lowast
119876 (120582) = minus11988661205721205822+ (11988611198866120572 minus 1198864120572120573119868lowast+ 1198863120572120573119868lowast) 120582
minus 11988631198868120572120573119868lowast
(15)
Let1198873= minus (119886
1+ 1198865+ 1198868)
1198872= 11988611198865+ 11988611198868+ 11988651198868+ 11988661198867minus 1198862120573119868lowast
1198871= minus119886111988651198868minus 119886111988661198867+ 11988621198868120573119868lowast
+ 11988641198867120573119868lowastminus 1198863120572120573119868lowast
1198870= 11988631198868120572120573119868lowast
1198882= minus1198866120572
1198881= 11988611198866120572 minus 1198864120572120573119868lowast+ 1198863120572120573119868lowast
1198880= minus11988631198868120572120573119868lowast
(16)
Then119875 (120582) = 120582
4+ 11988731205823+ 11988721205822+ 1198871120582 + 1198870
119876 (120582) = 11988821205822+ 1198881120582 + 1198880
(17)
Theorem 2 The positive equilibrium 119864lowast is locally asymptoti-
cally stable without time delay if the following holds
(1198672) 1198873gt 0 119889
1gt 0 119887
1+ 1198881gt 0
where
1198891= 1198873(1198872+ 1198882) minus (1198871+ 1198881) (18)
is satisfied
Proof If 120591 = 0 then (14) reduces to
1205824+ 11988731205823+ (1198872+ 1198882) 1205822
+ (1198871+ 1198881) 120582 + (119887
0+ 1198880) = 0
(19)
Because 1198870+ 1198880= 0 equation (19) can be further reduced to
1205823+ 11988731205822+ (1198872+ 1198882) 120582 + (119887
1+ 1198881) = 0 (20)
According to Routh-Hurwitz criterion all the roots of(20) have negative real partsTherefore it can be deduced thatthe positive equilibrium 119864
lowast is locally asymptotically stablewithout time delay The proof is completed
Obviously 120582 = 119894120596 (120596 gt 0) is a root of (14) After separat-ing the real and imaginary parts it can be written as
1205964minus 11988721205962+ 1198870+ (1198880minus 11988821205962) cos (120596120591) + 119888
1120596 sin (120596120591) = 0
minus11988731205963+ 1198871120596 + (119888
21205962minus 1198880) sin (120596120591) + 119888
1120596 cos (120596120591) = 0
(21)
6 Journal of Applied Mathematics
From the two equations of (21) the following equationcan be obtained
1198882
11205962+ (1198882
21205962minus 1198880)
2
= (1205964minus 11988721205962+ 1198870)
2
+ (1198871120596 minus 11988731205963)
2
(22)
which implies that
1205968+ 11989831205966+ 11989821205964+ 11989811205962+ 1198980= 0 (23)
where
1198983= 1198872
3minus 21198872
1198982= 1198872
2+ 21198870minus 211988711198873minus 1198882
2
1198981= 1198872
1minus 1198882
1minus 211988721198870+ 211988801198882
1198980= 1198872
0minus 1198882
0
(24)
Then (23) reduces to
1205966+ 11989831205964+ 11989821205962+ 1198981= 0 (25)
Let 119911 = 1205962Then (25) can be written as
ℎ (119911) = 1199113+ 11989831199112+ 1198982119911 + 119898
1 (26)
Δ is defined as Δ = 1198982
3minus 31198982 And we can get a solution
119911lowast= (radicΔ minus 119898
3)3 of h(z)
Lemma 3 Suppose that (1198672) 1198873gt 0 119889
1gt 0 119887
1+ 1198881gt 0 is
satisfied
(i) If one of followings holds (a) Δ gt 0 119911lowast lt 0 (b) Δ gt
0 119911lowast gt 0 and ℎ(119911lowast) gt 0 then all roots of (14) havenegative real parts when 120591 isin [0 120591
0) and 120591
0is a certain
positive constant(ii) If the conditions (a) and (b) are not satisfied then all
roots of (14) have negative real parts for all 120591 ge 0
Proof When 120591 = 0 equation (14) can be reduced to
1205823+ 11988731205822+ (1198872+ 1198882) 120582 + (119887
1+ 1198881) = 0 (27)
By the Routh-Hurwitz criterion all roots of (20) havenegative real parts if and only if 119887
3gt 0 119889
1gt 0 and 119887
1+1198881gt 0
Considering (26) it is easy to see from the characters ofcubic algebra equation that ℎ(119911) is a strictly monotonicallyincreasing function if Δ le 0 If Δ gt 0 and 119911lowast lt 0 or Δ gt 0119911lowastgt 0 but ℎ(119911lowast) gt 0 then ℎ(119911) has no positive root Thus
under these conditions equation (14) has no purely imag-inary roots for any 120591 gt 0 In addition this also implies thatthe positive equilibrium 119864
lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) of system (5)
is absolutely stable Therefore the following theorem on thestability of positive equilibrium 119864
lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) can
be easily obtained
Theorem 4 Assume that (1198671) and (119867
2) are satisfied and Δ gt
0 and 119911lowast lt 0 orΔ gt 0 119911lowast gt 0 and ℎ(119911lowast) gt 0Then the positive
equilibrium 119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) of system (5) is absolutely
stable that is to say 119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) is asymptoticallystable for any time delay 120591 ge 0
It is assumed that the coefficients in ℎ(119911) satisfy thecondition as follows
(1198673) Δ gt 0 119911
lowastgt 0 ℎ(119911
lowast) lt 0
Then according to lemma in [15] it is known that (26) hasat least a positive root 120596
0 namely the characteristic equation
(14) has a pair of purely imaginary roots plusmn1198941205960
In view of the fact that (14) has a pair of purely imaginaryroots plusmn119894120596
0 the corresponding 120591
119896gt 0 is given by eliminating
sin(120596120591) in (21)
120591119896=
1
1205960
arccos[(11988721205962
0minus 1205964
0minus 1198870) (1198880minus 11988821205962
0)
(1198880minus 11988821205962
0)2+ 120596 (119887
31205962minus 1198871minus 1198881)
]
+
2119896120587
1205960
(119896 = 0 1 2 )
(28)
Let 120582(120591) = V(120591) + 119894120596(120591) be the root of (14) so that V(120591119896) = 0
and 120596(120591119896) = 1205960are satisfied when 120591 = 120591
119896
Lemma 5 Suppose that ℎ1015840(1199110) = 0 If 120591 = 120591
0 then plusmn119894120596
0is a
pair of simple purely imaginary roots of (14) In addition if theconditions in Lemma 3 are satisfied then
119889 (Re 120582)119889120591
10038161003816100381610038161003816100381610038161003816120591=120591119896
gt 0 (29)
This signifies that there exists at least one eigenvalue withpositive real part for 120591 gt 120591
119896 Differentiating both sides of (14)
with respect to 120591 it can be written as
(
119889120582
119889120591
)
minus1
= ((41205823+ 311988731205822+ 21198872120582 + 1198871)
+1198881119890minus120582120591
minus (1198881120582 + 1198880) 120591119890minus120582120591
)
times ((1198881120582 + 1198880) 120582119890minus120582120591
)
minus1
(30)
Therefore
sgn119889Re 120582119889120591
120591=120591119896
= sgnRe(119889120582119889120591
)
minus1
120582=1198941205960
= sgn1205962
0
Λ
(41205966
0+ 311989831205964
0
+211989821205962
0+ 1198981)
= sgn1205962
0
Λ
ℎ1015840(1205962
0) = sgn ℎ1015840 (1205962
0)
(31)
where Λ = 1198882
11205964
0+ 11988801205962
0 Then it can be derived that
119889 (Re 120582)119889120591
10038161003816100381610038161003816100381610038161003816120591=120591119896
gt 0 (32)
Journal of Applied Mathematics 7
times105
5
45
4
35
3
25
2
15
1
05
028024020016012080400
Tota
l num
ber o
f hos
ts
S(t)
I(t)
D(t)
Q(t)
R(t)
t (s)
Figure 4 Worm propagation trend of the model when 120591 lt 1205910
It follows the hypothesis (1198673) that ℎ1015840(1205962
0) = 0 Therefore
transversality condition holds and the conditions for Hopfbifurcation are satisfied when 120591 = 120591
119896 according to Hopf
bifurcation theorem [24] for functional differential equationsThen the following results can be obtained
Theorem 6 Suppose that the conditions (1198671) and (119867
2) are
satisfied
(i) For system (5) the equilibrium 119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast)
is locally asymptotically stable when 120591 isin [0 1205910) but
unstable when 120591 gt 1205910
(ii) When condition (1198673) is satisfied system (5) will
undergo a Hopf bifurcation at the positive equilibrium119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) when 120591 = 120591
119896(119896 = 0 1 2 )
where 120591119896is defined by (28)
Theorem 2 implies to us that when birth and death ratesand the mechanism of time window in intrusion detectionsystem are considered the length of time window is crucialfor the stability of the propagation process When time delayis less than the threshold 120591
0 the system will stabilize at
its infection equilibrium point which is beneficial to fur-ther implement containment strategies to eliminate wormsHowever when time delay is greater than the threshold thesystem will be unstable and undergo a bifurcation Althoughthe propagation of worm presents a periodical phenome-non in real world complicated environment may make thepropagation pass the critical state and reach to an unpre-dictable chaos
4 Numerical and Simulation Experiments
41 Numerical Experiments The parameters of the delayedmodelwill be chosen properly according to the stability of thepositive equilibrium bifurcation analysis and the practicalenvironment 500000 hosts are picked as the population sizeand the wormrsquos average scan rate is 120578 = 4000 per secondThe worm infection rate can be calculated as 120576 = 1205781198732
32=
04657 [11] which means that average 04657 hosts of all the
times105
Tota
l num
ber o
f hos
ts
S(t)
I(t)
R(t)
5
4
3
2
1
00 500 1000 1500 2000 2500 3000
t (s)
Figure 5 Worm propagation trend of the model when 120591 gt 1205910
25
2
15
1
05
00 100 200 300 400 500 600 700 800
times105
I(t)
t(s)
Figure 6 The number of 119868(119905) when 120591 is changed
hosts can be scanned by one host The infection ratio is 120573 =
120578232
= 00000053 The rest of the parameters are 120574 = 0031205830= 0026 120596 = 000001 120572 = 056 120593 = 00009 and
119901 = 099 Initially 119868(0) = 50 which means that there are50 infectious hosts while the rest of the hosts are susceptibleat the beginning
Figure 4 shows the curves of five kinds of hosts when120591 = 5 lt 120591
0 All of the five kinds of hosts get stable within
4 minutes which illustrates that 119864lowast is asymptotically stableIt implies that the number of infectious hosts maintain aconstant level and thus can be predicted Further strategiescan be developed and utilized to eliminate worms But whentime delay 120591 gets increased and then reach the threshold 120591
0
119864lowast will lose its stability and a bifurcation will occur Figure 5
shows the susceptible infected and recovered hosts when120591 gt 1205910 In this firgure we can clearly see that the number of
infectious hosts will outburst after a short period of peaceand repeat again and again but not in the same period
In order to see the influence of time delay 120591 is set to adifferent value each time with other parameters remainingthe same Figure 6 shows the number of infected hosts in the
8 Journal of Applied Mathematics
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 5
t (s)
(a)
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 15
t (s)
(b)
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 45
t (s)
(c)
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 90
t (s)
(d)
Figure 7 The number of 119868(119905) when 120591 is changed
same coordinate with time delays 120591 = 5 120591 = 15 120591 = 45 and120591 = 90 respectively
Figure 7 gives the four curves in four coordinates In thesetwo figures the impact of time delay on infected hosts isevident Initially the four curves are overlapped whichmeansthat time delay has little effect in the initial stage of wormpropagationWith the increase of time delay the curve beginsto oscillate When time delay passes through the threshold1205910 the infecting process gets unstable Then simultaneously
it can be discovered that the amplitude and period of thenumber of infected hosts get increased
Figure 8(a) shows the projection of the phase portrait ofsystem (5) when 120591 = 15 lt 120591
0in (119878 119868 119881)-space The curve
converges to a fixed point which suggests that the system isstable Figure 8(b) shows the projection of the phase portraitof system (5) when 120591 = 25 gt 120591
0in (119878 119868 119881)-space The curve
converges to a limit circle which implies that the system isunstable Figures 8(c) and 8(d) show the phase portraits ofsusceptible 119878(119905) and infected 119868(119905) as 120591 = 15 lt 120591
0and 120591 = 25 gt
1205910 respectively
42 Simulation Experiments The discrete-time simulation isan expanded version of Zoursquos program simulating Code Redworm propagation and has been modified to run on a Linuxserver The system in our simulation experiment consistsof 500000 hosts that can reach each other directly which
is consistent with the numerical experiments and there isno topology issue in our simulation At the beginning ofsimulation 50 hosts are randomly chosen to be infectious andthe others are all susceptible
Identical with the results of numerical experimentsFigure 9 shows all five kinds of hosts when 120591 = 5 lt 120591
0 We
find that themodel will reach a stable state after a short periodof time which suggests that the number of infetious hosts canbe predicted and we can develop further strategy to eliminateworms
When time delay increases but is less than the thresholdderived from theoretical analysis the number of infectioushosts and other hosts present a damped oscillation and finallyreach an approximately stable state Figure 10 shows the num-ber of five kinds of hosts when 120591 = 15 lt 120591
0 An interesting
result is that the number of each host maintain a slightrandom vibration However the overall amplitude is only0273 to the population size and themaximumamplitude isonly 0953 to the population size The reason why this phe-nomenon occurs is due to the random events in simulationexperiments The implement of transition rates of the modelis based on probability That is to say when the removal rateof infectious hosts is set to 003 it means that the probabilityof transition from infectious hosts to vaccinated state is 3 italso means that infectious hosts get patched with probabilityof 3 To investigate this phenomenon phase portrait of
Journal of Applied Mathematics 9
0
1
2
3
4
5
0
005
115
2
I(t)
times104
times10 5
times105
S(t)
2
4V(t)
120591 = 15
(a) The projection of the phase portrait in (119878 119868 119877)-space when 120591 lt 1205910
0
1
2
3
4
5
0
005
115
2
I(t)
times104
times10 5
times105
S(t)
2
4V(t)
120591 = 25
(b) The projection of the phase portrait in (119878 119868 119877)-space when 120591 gt 1205910
5
4
3
2
1
00 02 04 06 08 1 12 14 16 18 2
I(t)
S(t)
times105
times105
120591 = 15
(c) The phase portrait of susceptible 119878(119905) and infected 119868(119905) when 120591 lt 1205910
5
4
3
2
1
00 02 04 06 08 1 12 14 16 18 2
I(t)
S(t)
times105
times105
120591 = 25
(d) The phase portrait of susceptible 119878(119905) and infected 119868(119905) when 120591 gt 1205910
Figure 8 The phase portrait when 120591 lt 1205910and 120591 gt 120591
0
S(t)
I(t)
D(t)
Q(t)
V(t)
5
45
4
35
3
25
2
15
1
05
00 50 100 150 200 250 300 350 400 450 500
times105
Num
ber o
f hos
ts
t (s)
Figure 9 Simulation result of the five kinds of hosts when 120591 lt 1205910
susceptible 119878(119905) and infected 119868(119905) is depictedwhen 120591 = 15 lt 1205910
as shown Figure 11 It shows that the curve is converged to afixed point which means that the system gets stable
When time delay passes the threshold a bifurcationappears Figure 12 shows the number of susceptible infectiousand vaccinated hosts when 120591 gt 120591
0 Figure 13 shows the differ-
ence between simulation and numerical results of susceptibleand infectious hosts respectively In this figure the periods
S(t)
I(t)
D(t)
Q(t)
V(t)
5
45
4
35
3
25
2
15
1
05
00 500
times105
Num
ber o
f hos
ts
1000 1500 2000 2500 3000 3500
t (s)
Figure 10 Simulation result of the five kinds of hosts when 120591 = 15
of these two curves are well matched which suggests thatthe results of numerical and simulation experiments areidentical But there is a difference of 96 of total populationsize in amplitudes This mainly results from the precision ofexperiments The number of hosts in numerical experimentscan be either integers or decimals because it is the solution ofdifferential equations However in simulation experimentsthe number of hosts must be integers Furthermore when the
10 Journal of Applied Mathematics
5
45
4
35
3
25
2
15
1
05
0
times105
I(t)
S(t)
times1040 2 4 6 8 10 12 14 16 18
120591 = 15
Figure 11 The phase portrait of susceptible 119878(119905) and infected 119868(119905)
when 120591 = 15
S(t)
I(t)
V(t)
5
45
4
35
3
25
2
15
1
05
00 500
times105
Num
ber o
f hos
ts
1000 1500 2000 2500 3000
t (s)
Figure 12 Simulation result of the three kinds of hosts when 120591 gt 1205910
number of infectious hosts are very little this tiny differencewill result in a big gap afterwards
5 Conclusions
In order to accord with actual facts in the real world timedelay generated by time window in IDS is introduced toconstruct the worm propagation model Dynamic birth anddeath rates are considered in this paper accounting for thereinstallation of OS which users are more likely to do afterwhen the hosts suffer wormrsquos destruction or quarantined tothe Internet In addition combined with birth and deathrates time delay may lead to bifurcation and make the wormpropagation system unstable
In this paper a delayed worm propagation model withbirth and death rates is studied Next the stability of thepositive equilibrium is analyzedThrough theoretical analysisand numerical and simulation experiments the followingconclusions can be derived
(i) The introduction of time window in IDS may lead totime delay in worm propagationmodel which resultsin bifurcation The critical time delay 120591
0where the
bifurcation appears is obtained
S(t)
5
45
4
35
3
25
2
15
1
05
00 500
times105
1000 1500 2000 2500 3000
S(t) in numerical experimentS(t) in simulation experiment
t (s)
(a) The comparison of the number of susceptible hosts
I(t)
25
2
15
1
05
00 500
times105
1000 1500 2000 2500 30000 500 1000 1500 2000 2500 300
I(t) in numerical experimentI(t) in simulation experiment
t (s)
(b) The comparison of the number of infectious hosts
Figure 13 The comparison of numerical and simulation experi-ments
(ii) The worm propagation system is stable when timedelay 120591 lt 120591
0 In this situation the worm propagation
can be easily predicted and eliminated(iii) A bifurcation emerges when time delay 120591 ge 120591
0 which
means the worm propagation is unstable and may beout of control
Consequently time delay 120591 should remain less than 1205910
by decreasing the time window in IDS which is helpful topredict the worm propagation and even eliminate the worm
In this paper we have only discussed the cases whichsatisfy conditions (119867
1) (1198672) and (119867
3) But for cases that
satisfy (1198671) (1198672) and (119867
3) the dynamical behavior of this
model has not been studied These issues will be studied anddiscussed in our future work
Acknowledgments
The authors are very grateful to the anonymous referee formany valuable comments and suggestions which led to asignificant improvement of the original paper This paper
Journal of Applied Mathematics 11
is supported by the National Natural Science Foundationof China under Grant no 60803132 the Natural ScienceFoundation of Liaoning Province of China under Grant no201202059 Program for Liaoning Excellent Talents in Uni-versity under LR2013011 the Fundamental Research Funds ofthe Central Universities under Grant nos N120504006 andN100704001 and MOE-Intel Special Fund of InformationTechnology (MOE-INTEL-2012-06)
References
[1] N Yoshida and T Hara ldquoGlobal stability of a delayed SIR epide-mic model with density dependent birth and death ratesrdquo Jour-nal of Computational and Applied Mathematics vol 201 no 2pp 339ndash347 2007
[2] M Song W Ma and Y Takeuchi ldquoPermanence of a delayedSIR epidemic model with density dependent birth raterdquo Journalof Computational and Applied Mathematics vol 201 no 2 pp389ndash394 2007
[3] J Liu and T Zhang ldquoBifurcation analysis of an SIS epidemicmodel with nonlinear birth raterdquo Chaos Solitons and Fractalsvol 40 no 3 pp 1091ndash1099 2009
[4] V Yegneswaran P Barford and D Plonka ldquoOn the design anduse of internet sinks for network abuse monitoringrdquo ComputerScience vol 3224 pp 146ndash165 2004
[5] D Yeung and Y Ding ldquoHost-based intrusion detection usingdynamic and static behavioralmodelsrdquo Pattern Recognition vol36 no 1 pp 229ndash243 2003
[6] N Stakhanova S Basu and JWong ldquoOn the symbiosis of speci-fication-based and anomaly-based detectionrdquo Computers andSecurity vol 29 no 2 pp 253ndash268 2010
[7] G P Spathoulas and S K Katsikas ldquoReducing false positives inintrusion detection systemsrdquo Computers and Security vol 29no 1 pp 35ndash44 2010
[8] C Lin B Liu H Hu F Xiao and J Zhang ldquoDetecting hid-den Malware method based on ldquoIn-VMrdquo modelrdquo China Com-munications vol 8 no 4 pp 99ndash108 2011
[9] S Staniford V Paxson and N Weaver ldquoHow to own theinternet in your spare timerdquo in Proceedings of the 11th USENIXSecurity Symposium pp 149ndash167 San Francisco Calif USA2002
[10] S Qing and W Wen ldquoA survey and trends on Internet wormsrdquoComputers and Security vol 24 no 4 pp 334ndash346 2005
[11] C C ZouW Gong and D Towsley ldquoWorm propagation mod-eling and analysis under dynamic quarantine defenserdquo in Pro-ceedings of the 2003 ACMWorkshop on Rapid Malcode (WORMrsquo03) pp 51ndash60 Washington DC USA October 2003
[12] J Ren X Yang Q Zhu L Yang and C Zhang ldquoA novel com-puter virus model and its dynamicsrdquo Nonlinear Analysis RealWorld Applications vol 13 no 1 pp 376ndash384 2012
[13] B K Mishra and S K Pandey ldquoFuzzy epidemic model for thetransmission of worms in computer networkrdquo Nonlinear Ana-lysis Real World Applications vol 11 no 5 pp 4335ndash4341 2010
[14] L-X Yang and X Yang ldquoPropagation behavior of virus codesin the situation that infected computers are connected to theinternet with positive probabilityrdquo Discrete Dynamics in Natureand Society vol 2012 Article ID 693695 13 pages 2012
[15] Y Yao X Xie H Guo G Yu F Gao and X Tong ldquoHopf bifur-cation in an Internet worm propagation model with time delayin quarantinerdquoMathematical and Computer Modelling 2011
[16] Y Yao W Xiang A Qu G Yu and F Gao ldquoHopf bifurcationin an SEIDQV worm propagation model with quarantine stra-tegyrdquoDiscrete Dynamics in Nature and Society vol 2012 ArticleID 304868 18 pages 2012
[17] Y Yao L Guo H Guo G Yu F Gao and X Tong ldquoPulsequarantine strategy of internet worm propagation modelingand analysisrdquo Computers and Electrical Engineering 2011
[18] F Wang Y Zhang C Wang J Ma and S Moon ldquoStability ana-lysis of a SEIQV epidemic model for rapid spreading wormsrdquoComputers and Security vol 29 no 4 pp 410ndash418 2010
[19] T Dong X Liao and H Li ldquoStability and Hopf bifurcation ina computer virus model with multistate antivirusrdquo Abstract andApplied Analysis vol 2012 Article ID 841987 16 pages 2012
[20] T Zhang J Liu and Z Teng ldquoStability of Hopf bifurcation of adelayed SIRS epidemic model with stage structurerdquo NonlinearAnalysis Real World Applications vol 11 no 1 pp 293ndash3062010
[21] J Zhang W Li and X Yan ldquoHopf bifurcation and stabilityof periodic solutions in a delayed eco-epidemiological systemrdquoApplied Mathematics and Computation vol 198 no 2 pp 865ndash876 2008
[22] W Kermack and A McKendrick ldquoA contribution to the mathe-matical theory of epidemicsrdquo Proceedings of the Royal Society ofLondon A vol 115 no 772 pp 700ndash721 1927
[23] S Wang Q Liu X Yu and Y Ma ldquoBifurcation analysis of amodel for network worm propagation with time delayrdquoMathe-matical and Computer Modelling vol 52 no 3-4 pp 435ndash4472010
[24] B Hassard D Kazarino and Y WanTheory and Application ofHopf Bifurcation Cambridge University Press Cambridge UK1981
Submit your manuscripts athttpwwwhindawicom
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Mathematical Problems in Engineering
Hindawi Publishing Corporationhttpwwwhindawicom
Differential EquationsInternational Journal of
Volume 2014
Applied MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Mathematical PhysicsAdvances in
Complex AnalysisJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
OptimizationJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
International Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Operations ResearchAdvances in
Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Function Spaces
Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
International Journal of Mathematics and Mathematical Sciences
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Algebra
Discrete Dynamics in Nature and Society
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Decision SciencesAdvances in
Discrete MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom
Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Stochastic AnalysisInternational Journal of
Journal of Applied Mathematics 3
S I120574
Q
V
120593
120596
120573I
120572
Figure 2 State transition diagram of the quarantine model
strategy should be taken into consideration Firstly infectioushosts are detected by the systems and then get quarantinedand patched Moreover considering that hosts could getpatched whatever state the hosts stay we add a new pathfrom hosts in susceptible state to vaccinated state to accordwith actual situation The state transition diagram of theworm propagation model with quarantine strategy is givenin Figure 2
In this model vaccinated state equals to removed statein KM model and 119881(119905) denotes the number of vaccinatedhosts at time 119905 Susceptible hosts can be infected by wormswith an infection rate 120573 due to their vulnerabilities Afterinfection the hosts become infectious hosts which meansthe hosts can infect other susceptible hosts The hosts canbe directly patched into the vaccinated state before gettinginfected at rate 120596 By applying misuse intrusion detectionsystem for its relatively high accuracy we add a new statecalled quarantine state but only infectious hosts will bequarantined 119876(119905) denotes the number of quarantine hosts attime 119905 Infectious hosts will be quarantined at rate 120572 whichdepends on the performance of intrusion detection systemsand network devices When infectious hosts are quarantinedthe hosts will get rid of worms and get patched at rate 120593Meanwhile infectious hosts can be manually patched intovaccinated state at recovery rate 120574 It can be perceived thatif a host is patched it has gained immunity permanently
The differetial equations of this model are given as
119889119878 (119905)
119889119905
= minus 120573119868 (119905) 119878 (119905) minus 120596119878 (119905)
119889119868 (119905)
119889119905
= 120573119868 (119905) 119878 (119905) minus 120574119868 (119905) minus 120572119868 (119905)
119889119876 (119905)
119889119905
= 120572119868 (119905) minus 120593119876 (119905)
119889119881 (119905)
119889119905
= 120596119878 (119905) + 120574119868 (119905) + 120593119876 (119905)
(2)
The total number of this model is set to 119873 = 1 whichmeans the sum of hosts in all four states is equal to one thatis 119878(119905) + 119868(119905) + 119876(119905) + 119881(119905) = 1 Then the infection-free
equilibrium of this model and its stability condition will bestudied
The first second and third equations in system (2) haveno dependence on the last one therefore the last one can beomitted System (2) can be rewritten as a three-demensionalsystem
119889119878 (119905)
119889119905
= minus 120573119868 (119905) 119878 (119905) minus 120596119878 (119905)
119889119868 (119905)
119889119905
= 120573119868 (119905) 119878 (119905) minus 120574119868 (119905) minus 120572119868 (119905)
119889119876 (119905)
119889119905
= 120572119868 (119905) minus 120593119876 (119905)
(3)
Due to the infection-free state which the system holdsin the end the number of infectious hosts is equal to 0Obviously the number of susceptible hosts and number ofquarantined hosts are both equal to 0 because all of thehosts in the network will get patched at last no matter whichway the hosts take Thus the infection-free equilibrium point119864lowast(0 0 0) of system (3) can be obtained Since 119881(119905) = 119873 minus
119878(119905) minus 119868(119905) minus119876(119905) the infection-free equilibrium of the modelwith quarantine strategy is 119864lowast(0 0 0119873)
Although all infectious hosts in quarantine model con-vert to vaccinated hosts in other words worms have beeneliminated it is hardly appropriate for real world situationActually not all the hosts will convert to vaccinated hosts andno-patch hosts are still existing in the network and sufferinghigh risk of worm attack In addition considering that hostsare consumer electronic products the recycling of old hostshappens frequently every day In order to imitate the factsin the real world birth and death rates must be taken intoconsideration
Additionally due to the time windows of intrusion detec-tion system which decreases the number of false positivestime delay should be considered to accord with actualsituation Therefore in the next section the new model isproposed
33 The Delayed Worm Propagation Model with Birth andDeath Rates By adding time delay along with birth anddeath rates the delayed worm propagation model with birthand death rates is presented Figure 3 shows the state transi-tion diagram of the delayed worm propagation model withbirth and death rates
In this model the total number of hosts denoted by119873 isdivided into five parts Compared with quarantine model anew state delayed state is added The hosts do not have theability to infect other susceptible hosts but are not quaran-tined yet Therefore a new state is needed to represent thesehosts 119863(119905) denotes the hosts in delayed state at time 119905 Fur-thermore the hosts in susceptible infected quarantined andremoved states have the same rate 120583 to leave the networkIf the hosts are quarantined by IDS some of applicationsmay not access to network because their ports are occupiedby worms At this moment the users would like to reinstallOS and leave the network system Thus the birth and death
4 Journal of Applied Mathematics
S I120574
Q
V
120593
120583
120583120583120583
120572I
120596
p120583
D
120573I
120572I(t minus 120591)
(1 minus p)120583
Figure 3 State transition diagram of the delayed model
rates are correlative to the number of infectious hosts andquarantined hosts in the network system And the rate 120583 is
120583 = 1205830(
119868 (119905) + 119876 (119905)
119873
) (4)
The hosts in delayed state are not likely to leave thenetwork accounting for the activeness of these hosts Thenewborn hosts enter the system with the same rate 120583 ofwhich a portion 1 minus 119901 is recovered by installing patchesinstantly at birth This differs from the transition denoted by120596 because the hosts are vaccinated at the time of entering thenetwork by installing patched operating system The transi-tion 120596 represents the rate by which those susceptible in thenetwork get vaccinated by installing patches laterThedelayeddifferential equations are written as
119889119878 (119905)
119889119905
= 119901120583 (119873 (119905) minus 119863 (119905)) minus 120573119868 (119905) 119878 (119905) minus 120596119878 (119905) minus 120583119878 (119905)
119889119868 (119905)
119889119905
= 120573119868 (119905) 119878 (119905) minus 120574119868 (119905) minus 120572119868 (119905) minus 120583119868 (119905)
119889119863 (119905)
119889119905
= 120572119868 (119905) minus 120572119868 (119905 minus 120591)
119889119876 (119905)
119889119905
= 120572119868 (119905 minus 120591) minus 120593119876 (119905) minus 120583119876 (119905)
119889119881 (119905)
119889119905
= (1 minus 119901) 120583 (119873 (119905) minus 119863 (119905))
+ 120596119878 (119905) + 120574119868 (119905) + 120593119876 (119905) minus 120583119881 (119905)
(5)
Other notations are identical to those in the previousmodel To understand themmore clearly the notations in thismodel are shown in Table 1
Table 1 Notations in this paper
Notation Definition119873 Total number of hosts in the network119878(119905) Number of susceptible hosts at time 119905119868(119905) Number of infectious hosts at time 119905119863(119905) Number of delayed hosts at time 119905119876(119905) Number of quarantined hosts at time 119905119881(119905) Number of vaccinated hosts at time 119905120573 Infection rate120596 Vaccine rate of susceptible hosts120572 Quarantine rate120593 Removal rate of quaratined hosts120574 Removal rate of infectious hosts120583 Birth and death rates119901 Birth ratio of susceptible hosts120591 Length of the time window in IDS
As mentioned in Table 1 the population size is set to 119873which is set to unity
119878 (119905) + 119868 (119905) + 119863 (119905) + 119876 (119905) + 119881 (119905) = 119873 (6)
34 Stability of the Positive Equilibrium andBifurcation Analysis
Theorem 1 The system has a unique positive equilibrium119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) when the condition
(1198671) (119901120583120573119873(120583 + 120572 + 120574)(120583 + 120596)) gt 1
is satisfied where
119878lowast=
120583 + 120572 + 120574
120573
119863lowast= 120572120591119868
lowast 119876
lowast=
120572119868lowast
120593 + 120583
119881lowast=
120574119868lowast+ 120596119878lowast+ 120593119876lowast+ 120583 (1 minus 119901) (119873 minus 119863
lowast)
120583
(7)
Proof From system (5) according to [23] if all the derivativeson the left of equal sign of the system are set to 0 whichimplies that the system becomes stationary we can get
119878 =
120583 + 120572 + 120574
120573
119863 = 120572120591119868lowast 119876 =
120572119868lowast
120593 + 120583
119881 =
120574119868lowast+ 120596119878lowast+ 120593119876lowast+ 120583 (1 minus 119901) (119873 minus 119863
lowast)
120583
(8)
Substituting the value of each variable in (8) for each of (6)then we can get
120583 + 120572 + 120574
120573
+ 119868 + 120572120591119868 +
120572119868
120593 + 120583
+ 119881 = 119873 (9)
After solving this equation with respect to 119868lowast a solution of 119868lowastis obtained
119868 =
119901119873120583120573 minus (120583 + 120596) (120583 + 120572 + 120574)
120573 (120572 + 120583119901120572120591 + 120583 + 120574)
(10)
Journal of Applied Mathematics 5
Thus if (1198671) is satisfied (10) has one unique positive
root 119868lowast and there is one unique positive equilibrium
119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) of system (5) The proof is com-
pleted
According to (6)119881 = 119873minus119878minus 119868 minus119863minus119876 and thus system(5) can be simplified to
119889119878 (119905)
119889119905
= 119901120583 (119873 (119905) minus 119863 (119905)) minus 120573119868 (119905) 119878 (119905) minus 119908119878 (119905) minus 120583119878 (119905)
119889119868 (119905)
119889119905
= 120573119868 (119905) 119878 (119905) minus 120574119868 (119905) minus 120572119868 (119905) minus 120583119868 (119905)
119889119863 (119905)
119889119905
= 120572119868 (119905) minus 120572119868 (119905 minus 120591)
119889119876 (119905)
119889119905
= 120572119868 (119905 minus 120591) minus 120593119876 (119905) minus 120583119876 (119905)
(11)
The Jacobimatrix of (11) about119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) is givenby
119869 (119864lowast) = (
1198861
1198862
11988631198864
120573119868lowast
1198865
0 1198866
0 120572 minus 120572119890minus120582120591
0 0
0 120572119890minus120582120591
minus 1198867
0 1198868
) (12)
where
1198861= minus
1205830(119868lowast+ 119876lowast)
119873
minus 120596 minus 120573119868lowast
1198862=
1199011205830(119873 minus 119863
lowast)
119873
minus
1205830119878lowast
119873
minus 120573119878lowast
1198863= minus
1199011205830(119868lowast+ 119876lowast)
119873
1198864=
1199011205830(119873 minus 119863
lowast) minus 1205830119878lowast
119873
1198865= 120573119878lowastminus 120572 minus 120574 minus
21205830119868lowast+ 1205830119876lowast
119873
1198866= minus
1205830119868lowast
119873
1198867=
1205830119876lowast
119873
1198868= minus120593 minus
1205830119868lowast+ 21205830119876lowast
119873
(13)
The characteristic equation of that matrix can be obtained by
119875 (120582) + 119876 (120582) 119890minus120582120591
= 0 (14)
where
119875 (120582) = 1205824minus (1198861+ 1198865+ 1198868) 1205823
+ (11988611198865+ 11988611198868+ 11988651198868+ 11988661198867minus 1198862120573119868lowast) 1205822
+ (minus119886111988651198868minus 119886111988661198867+ 11988621198868120573119868lowast
+ 11988641198867120573119868lowastminus 1198863120572120573119868lowast) 120582
+ 11988631198868120572120573119868lowast
119876 (120582) = minus11988661205721205822+ (11988611198866120572 minus 1198864120572120573119868lowast+ 1198863120572120573119868lowast) 120582
minus 11988631198868120572120573119868lowast
(15)
Let1198873= minus (119886
1+ 1198865+ 1198868)
1198872= 11988611198865+ 11988611198868+ 11988651198868+ 11988661198867minus 1198862120573119868lowast
1198871= minus119886111988651198868minus 119886111988661198867+ 11988621198868120573119868lowast
+ 11988641198867120573119868lowastminus 1198863120572120573119868lowast
1198870= 11988631198868120572120573119868lowast
1198882= minus1198866120572
1198881= 11988611198866120572 minus 1198864120572120573119868lowast+ 1198863120572120573119868lowast
1198880= minus11988631198868120572120573119868lowast
(16)
Then119875 (120582) = 120582
4+ 11988731205823+ 11988721205822+ 1198871120582 + 1198870
119876 (120582) = 11988821205822+ 1198881120582 + 1198880
(17)
Theorem 2 The positive equilibrium 119864lowast is locally asymptoti-
cally stable without time delay if the following holds
(1198672) 1198873gt 0 119889
1gt 0 119887
1+ 1198881gt 0
where
1198891= 1198873(1198872+ 1198882) minus (1198871+ 1198881) (18)
is satisfied
Proof If 120591 = 0 then (14) reduces to
1205824+ 11988731205823+ (1198872+ 1198882) 1205822
+ (1198871+ 1198881) 120582 + (119887
0+ 1198880) = 0
(19)
Because 1198870+ 1198880= 0 equation (19) can be further reduced to
1205823+ 11988731205822+ (1198872+ 1198882) 120582 + (119887
1+ 1198881) = 0 (20)
According to Routh-Hurwitz criterion all the roots of(20) have negative real partsTherefore it can be deduced thatthe positive equilibrium 119864
lowast is locally asymptotically stablewithout time delay The proof is completed
Obviously 120582 = 119894120596 (120596 gt 0) is a root of (14) After separat-ing the real and imaginary parts it can be written as
1205964minus 11988721205962+ 1198870+ (1198880minus 11988821205962) cos (120596120591) + 119888
1120596 sin (120596120591) = 0
minus11988731205963+ 1198871120596 + (119888
21205962minus 1198880) sin (120596120591) + 119888
1120596 cos (120596120591) = 0
(21)
6 Journal of Applied Mathematics
From the two equations of (21) the following equationcan be obtained
1198882
11205962+ (1198882
21205962minus 1198880)
2
= (1205964minus 11988721205962+ 1198870)
2
+ (1198871120596 minus 11988731205963)
2
(22)
which implies that
1205968+ 11989831205966+ 11989821205964+ 11989811205962+ 1198980= 0 (23)
where
1198983= 1198872
3minus 21198872
1198982= 1198872
2+ 21198870minus 211988711198873minus 1198882
2
1198981= 1198872
1minus 1198882
1minus 211988721198870+ 211988801198882
1198980= 1198872
0minus 1198882
0
(24)
Then (23) reduces to
1205966+ 11989831205964+ 11989821205962+ 1198981= 0 (25)
Let 119911 = 1205962Then (25) can be written as
ℎ (119911) = 1199113+ 11989831199112+ 1198982119911 + 119898
1 (26)
Δ is defined as Δ = 1198982
3minus 31198982 And we can get a solution
119911lowast= (radicΔ minus 119898
3)3 of h(z)
Lemma 3 Suppose that (1198672) 1198873gt 0 119889
1gt 0 119887
1+ 1198881gt 0 is
satisfied
(i) If one of followings holds (a) Δ gt 0 119911lowast lt 0 (b) Δ gt
0 119911lowast gt 0 and ℎ(119911lowast) gt 0 then all roots of (14) havenegative real parts when 120591 isin [0 120591
0) and 120591
0is a certain
positive constant(ii) If the conditions (a) and (b) are not satisfied then all
roots of (14) have negative real parts for all 120591 ge 0
Proof When 120591 = 0 equation (14) can be reduced to
1205823+ 11988731205822+ (1198872+ 1198882) 120582 + (119887
1+ 1198881) = 0 (27)
By the Routh-Hurwitz criterion all roots of (20) havenegative real parts if and only if 119887
3gt 0 119889
1gt 0 and 119887
1+1198881gt 0
Considering (26) it is easy to see from the characters ofcubic algebra equation that ℎ(119911) is a strictly monotonicallyincreasing function if Δ le 0 If Δ gt 0 and 119911lowast lt 0 or Δ gt 0119911lowastgt 0 but ℎ(119911lowast) gt 0 then ℎ(119911) has no positive root Thus
under these conditions equation (14) has no purely imag-inary roots for any 120591 gt 0 In addition this also implies thatthe positive equilibrium 119864
lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) of system (5)
is absolutely stable Therefore the following theorem on thestability of positive equilibrium 119864
lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) can
be easily obtained
Theorem 4 Assume that (1198671) and (119867
2) are satisfied and Δ gt
0 and 119911lowast lt 0 orΔ gt 0 119911lowast gt 0 and ℎ(119911lowast) gt 0Then the positive
equilibrium 119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) of system (5) is absolutely
stable that is to say 119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) is asymptoticallystable for any time delay 120591 ge 0
It is assumed that the coefficients in ℎ(119911) satisfy thecondition as follows
(1198673) Δ gt 0 119911
lowastgt 0 ℎ(119911
lowast) lt 0
Then according to lemma in [15] it is known that (26) hasat least a positive root 120596
0 namely the characteristic equation
(14) has a pair of purely imaginary roots plusmn1198941205960
In view of the fact that (14) has a pair of purely imaginaryroots plusmn119894120596
0 the corresponding 120591
119896gt 0 is given by eliminating
sin(120596120591) in (21)
120591119896=
1
1205960
arccos[(11988721205962
0minus 1205964
0minus 1198870) (1198880minus 11988821205962
0)
(1198880minus 11988821205962
0)2+ 120596 (119887
31205962minus 1198871minus 1198881)
]
+
2119896120587
1205960
(119896 = 0 1 2 )
(28)
Let 120582(120591) = V(120591) + 119894120596(120591) be the root of (14) so that V(120591119896) = 0
and 120596(120591119896) = 1205960are satisfied when 120591 = 120591
119896
Lemma 5 Suppose that ℎ1015840(1199110) = 0 If 120591 = 120591
0 then plusmn119894120596
0is a
pair of simple purely imaginary roots of (14) In addition if theconditions in Lemma 3 are satisfied then
119889 (Re 120582)119889120591
10038161003816100381610038161003816100381610038161003816120591=120591119896
gt 0 (29)
This signifies that there exists at least one eigenvalue withpositive real part for 120591 gt 120591
119896 Differentiating both sides of (14)
with respect to 120591 it can be written as
(
119889120582
119889120591
)
minus1
= ((41205823+ 311988731205822+ 21198872120582 + 1198871)
+1198881119890minus120582120591
minus (1198881120582 + 1198880) 120591119890minus120582120591
)
times ((1198881120582 + 1198880) 120582119890minus120582120591
)
minus1
(30)
Therefore
sgn119889Re 120582119889120591
120591=120591119896
= sgnRe(119889120582119889120591
)
minus1
120582=1198941205960
= sgn1205962
0
Λ
(41205966
0+ 311989831205964
0
+211989821205962
0+ 1198981)
= sgn1205962
0
Λ
ℎ1015840(1205962
0) = sgn ℎ1015840 (1205962
0)
(31)
where Λ = 1198882
11205964
0+ 11988801205962
0 Then it can be derived that
119889 (Re 120582)119889120591
10038161003816100381610038161003816100381610038161003816120591=120591119896
gt 0 (32)
Journal of Applied Mathematics 7
times105
5
45
4
35
3
25
2
15
1
05
028024020016012080400
Tota
l num
ber o
f hos
ts
S(t)
I(t)
D(t)
Q(t)
R(t)
t (s)
Figure 4 Worm propagation trend of the model when 120591 lt 1205910
It follows the hypothesis (1198673) that ℎ1015840(1205962
0) = 0 Therefore
transversality condition holds and the conditions for Hopfbifurcation are satisfied when 120591 = 120591
119896 according to Hopf
bifurcation theorem [24] for functional differential equationsThen the following results can be obtained
Theorem 6 Suppose that the conditions (1198671) and (119867
2) are
satisfied
(i) For system (5) the equilibrium 119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast)
is locally asymptotically stable when 120591 isin [0 1205910) but
unstable when 120591 gt 1205910
(ii) When condition (1198673) is satisfied system (5) will
undergo a Hopf bifurcation at the positive equilibrium119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) when 120591 = 120591
119896(119896 = 0 1 2 )
where 120591119896is defined by (28)
Theorem 2 implies to us that when birth and death ratesand the mechanism of time window in intrusion detectionsystem are considered the length of time window is crucialfor the stability of the propagation process When time delayis less than the threshold 120591
0 the system will stabilize at
its infection equilibrium point which is beneficial to fur-ther implement containment strategies to eliminate wormsHowever when time delay is greater than the threshold thesystem will be unstable and undergo a bifurcation Althoughthe propagation of worm presents a periodical phenome-non in real world complicated environment may make thepropagation pass the critical state and reach to an unpre-dictable chaos
4 Numerical and Simulation Experiments
41 Numerical Experiments The parameters of the delayedmodelwill be chosen properly according to the stability of thepositive equilibrium bifurcation analysis and the practicalenvironment 500000 hosts are picked as the population sizeand the wormrsquos average scan rate is 120578 = 4000 per secondThe worm infection rate can be calculated as 120576 = 1205781198732
32=
04657 [11] which means that average 04657 hosts of all the
times105
Tota
l num
ber o
f hos
ts
S(t)
I(t)
R(t)
5
4
3
2
1
00 500 1000 1500 2000 2500 3000
t (s)
Figure 5 Worm propagation trend of the model when 120591 gt 1205910
25
2
15
1
05
00 100 200 300 400 500 600 700 800
times105
I(t)
t(s)
Figure 6 The number of 119868(119905) when 120591 is changed
hosts can be scanned by one host The infection ratio is 120573 =
120578232
= 00000053 The rest of the parameters are 120574 = 0031205830= 0026 120596 = 000001 120572 = 056 120593 = 00009 and
119901 = 099 Initially 119868(0) = 50 which means that there are50 infectious hosts while the rest of the hosts are susceptibleat the beginning
Figure 4 shows the curves of five kinds of hosts when120591 = 5 lt 120591
0 All of the five kinds of hosts get stable within
4 minutes which illustrates that 119864lowast is asymptotically stableIt implies that the number of infectious hosts maintain aconstant level and thus can be predicted Further strategiescan be developed and utilized to eliminate worms But whentime delay 120591 gets increased and then reach the threshold 120591
0
119864lowast will lose its stability and a bifurcation will occur Figure 5
shows the susceptible infected and recovered hosts when120591 gt 1205910 In this firgure we can clearly see that the number of
infectious hosts will outburst after a short period of peaceand repeat again and again but not in the same period
In order to see the influence of time delay 120591 is set to adifferent value each time with other parameters remainingthe same Figure 6 shows the number of infected hosts in the
8 Journal of Applied Mathematics
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 5
t (s)
(a)
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 15
t (s)
(b)
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 45
t (s)
(c)
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 90
t (s)
(d)
Figure 7 The number of 119868(119905) when 120591 is changed
same coordinate with time delays 120591 = 5 120591 = 15 120591 = 45 and120591 = 90 respectively
Figure 7 gives the four curves in four coordinates In thesetwo figures the impact of time delay on infected hosts isevident Initially the four curves are overlapped whichmeansthat time delay has little effect in the initial stage of wormpropagationWith the increase of time delay the curve beginsto oscillate When time delay passes through the threshold1205910 the infecting process gets unstable Then simultaneously
it can be discovered that the amplitude and period of thenumber of infected hosts get increased
Figure 8(a) shows the projection of the phase portrait ofsystem (5) when 120591 = 15 lt 120591
0in (119878 119868 119881)-space The curve
converges to a fixed point which suggests that the system isstable Figure 8(b) shows the projection of the phase portraitof system (5) when 120591 = 25 gt 120591
0in (119878 119868 119881)-space The curve
converges to a limit circle which implies that the system isunstable Figures 8(c) and 8(d) show the phase portraits ofsusceptible 119878(119905) and infected 119868(119905) as 120591 = 15 lt 120591
0and 120591 = 25 gt
1205910 respectively
42 Simulation Experiments The discrete-time simulation isan expanded version of Zoursquos program simulating Code Redworm propagation and has been modified to run on a Linuxserver The system in our simulation experiment consistsof 500000 hosts that can reach each other directly which
is consistent with the numerical experiments and there isno topology issue in our simulation At the beginning ofsimulation 50 hosts are randomly chosen to be infectious andthe others are all susceptible
Identical with the results of numerical experimentsFigure 9 shows all five kinds of hosts when 120591 = 5 lt 120591
0 We
find that themodel will reach a stable state after a short periodof time which suggests that the number of infetious hosts canbe predicted and we can develop further strategy to eliminateworms
When time delay increases but is less than the thresholdderived from theoretical analysis the number of infectioushosts and other hosts present a damped oscillation and finallyreach an approximately stable state Figure 10 shows the num-ber of five kinds of hosts when 120591 = 15 lt 120591
0 An interesting
result is that the number of each host maintain a slightrandom vibration However the overall amplitude is only0273 to the population size and themaximumamplitude isonly 0953 to the population size The reason why this phe-nomenon occurs is due to the random events in simulationexperiments The implement of transition rates of the modelis based on probability That is to say when the removal rateof infectious hosts is set to 003 it means that the probabilityof transition from infectious hosts to vaccinated state is 3 italso means that infectious hosts get patched with probabilityof 3 To investigate this phenomenon phase portrait of
Journal of Applied Mathematics 9
0
1
2
3
4
5
0
005
115
2
I(t)
times104
times10 5
times105
S(t)
2
4V(t)
120591 = 15
(a) The projection of the phase portrait in (119878 119868 119877)-space when 120591 lt 1205910
0
1
2
3
4
5
0
005
115
2
I(t)
times104
times10 5
times105
S(t)
2
4V(t)
120591 = 25
(b) The projection of the phase portrait in (119878 119868 119877)-space when 120591 gt 1205910
5
4
3
2
1
00 02 04 06 08 1 12 14 16 18 2
I(t)
S(t)
times105
times105
120591 = 15
(c) The phase portrait of susceptible 119878(119905) and infected 119868(119905) when 120591 lt 1205910
5
4
3
2
1
00 02 04 06 08 1 12 14 16 18 2
I(t)
S(t)
times105
times105
120591 = 25
(d) The phase portrait of susceptible 119878(119905) and infected 119868(119905) when 120591 gt 1205910
Figure 8 The phase portrait when 120591 lt 1205910and 120591 gt 120591
0
S(t)
I(t)
D(t)
Q(t)
V(t)
5
45
4
35
3
25
2
15
1
05
00 50 100 150 200 250 300 350 400 450 500
times105
Num
ber o
f hos
ts
t (s)
Figure 9 Simulation result of the five kinds of hosts when 120591 lt 1205910
susceptible 119878(119905) and infected 119868(119905) is depictedwhen 120591 = 15 lt 1205910
as shown Figure 11 It shows that the curve is converged to afixed point which means that the system gets stable
When time delay passes the threshold a bifurcationappears Figure 12 shows the number of susceptible infectiousand vaccinated hosts when 120591 gt 120591
0 Figure 13 shows the differ-
ence between simulation and numerical results of susceptibleand infectious hosts respectively In this figure the periods
S(t)
I(t)
D(t)
Q(t)
V(t)
5
45
4
35
3
25
2
15
1
05
00 500
times105
Num
ber o
f hos
ts
1000 1500 2000 2500 3000 3500
t (s)
Figure 10 Simulation result of the five kinds of hosts when 120591 = 15
of these two curves are well matched which suggests thatthe results of numerical and simulation experiments areidentical But there is a difference of 96 of total populationsize in amplitudes This mainly results from the precision ofexperiments The number of hosts in numerical experimentscan be either integers or decimals because it is the solution ofdifferential equations However in simulation experimentsthe number of hosts must be integers Furthermore when the
10 Journal of Applied Mathematics
5
45
4
35
3
25
2
15
1
05
0
times105
I(t)
S(t)
times1040 2 4 6 8 10 12 14 16 18
120591 = 15
Figure 11 The phase portrait of susceptible 119878(119905) and infected 119868(119905)
when 120591 = 15
S(t)
I(t)
V(t)
5
45
4
35
3
25
2
15
1
05
00 500
times105
Num
ber o
f hos
ts
1000 1500 2000 2500 3000
t (s)
Figure 12 Simulation result of the three kinds of hosts when 120591 gt 1205910
number of infectious hosts are very little this tiny differencewill result in a big gap afterwards
5 Conclusions
In order to accord with actual facts in the real world timedelay generated by time window in IDS is introduced toconstruct the worm propagation model Dynamic birth anddeath rates are considered in this paper accounting for thereinstallation of OS which users are more likely to do afterwhen the hosts suffer wormrsquos destruction or quarantined tothe Internet In addition combined with birth and deathrates time delay may lead to bifurcation and make the wormpropagation system unstable
In this paper a delayed worm propagation model withbirth and death rates is studied Next the stability of thepositive equilibrium is analyzedThrough theoretical analysisand numerical and simulation experiments the followingconclusions can be derived
(i) The introduction of time window in IDS may lead totime delay in worm propagationmodel which resultsin bifurcation The critical time delay 120591
0where the
bifurcation appears is obtained
S(t)
5
45
4
35
3
25
2
15
1
05
00 500
times105
1000 1500 2000 2500 3000
S(t) in numerical experimentS(t) in simulation experiment
t (s)
(a) The comparison of the number of susceptible hosts
I(t)
25
2
15
1
05
00 500
times105
1000 1500 2000 2500 30000 500 1000 1500 2000 2500 300
I(t) in numerical experimentI(t) in simulation experiment
t (s)
(b) The comparison of the number of infectious hosts
Figure 13 The comparison of numerical and simulation experi-ments
(ii) The worm propagation system is stable when timedelay 120591 lt 120591
0 In this situation the worm propagation
can be easily predicted and eliminated(iii) A bifurcation emerges when time delay 120591 ge 120591
0 which
means the worm propagation is unstable and may beout of control
Consequently time delay 120591 should remain less than 1205910
by decreasing the time window in IDS which is helpful topredict the worm propagation and even eliminate the worm
In this paper we have only discussed the cases whichsatisfy conditions (119867
1) (1198672) and (119867
3) But for cases that
satisfy (1198671) (1198672) and (119867
3) the dynamical behavior of this
model has not been studied These issues will be studied anddiscussed in our future work
Acknowledgments
The authors are very grateful to the anonymous referee formany valuable comments and suggestions which led to asignificant improvement of the original paper This paper
Journal of Applied Mathematics 11
is supported by the National Natural Science Foundationof China under Grant no 60803132 the Natural ScienceFoundation of Liaoning Province of China under Grant no201202059 Program for Liaoning Excellent Talents in Uni-versity under LR2013011 the Fundamental Research Funds ofthe Central Universities under Grant nos N120504006 andN100704001 and MOE-Intel Special Fund of InformationTechnology (MOE-INTEL-2012-06)
References
[1] N Yoshida and T Hara ldquoGlobal stability of a delayed SIR epide-mic model with density dependent birth and death ratesrdquo Jour-nal of Computational and Applied Mathematics vol 201 no 2pp 339ndash347 2007
[2] M Song W Ma and Y Takeuchi ldquoPermanence of a delayedSIR epidemic model with density dependent birth raterdquo Journalof Computational and Applied Mathematics vol 201 no 2 pp389ndash394 2007
[3] J Liu and T Zhang ldquoBifurcation analysis of an SIS epidemicmodel with nonlinear birth raterdquo Chaos Solitons and Fractalsvol 40 no 3 pp 1091ndash1099 2009
[4] V Yegneswaran P Barford and D Plonka ldquoOn the design anduse of internet sinks for network abuse monitoringrdquo ComputerScience vol 3224 pp 146ndash165 2004
[5] D Yeung and Y Ding ldquoHost-based intrusion detection usingdynamic and static behavioralmodelsrdquo Pattern Recognition vol36 no 1 pp 229ndash243 2003
[6] N Stakhanova S Basu and JWong ldquoOn the symbiosis of speci-fication-based and anomaly-based detectionrdquo Computers andSecurity vol 29 no 2 pp 253ndash268 2010
[7] G P Spathoulas and S K Katsikas ldquoReducing false positives inintrusion detection systemsrdquo Computers and Security vol 29no 1 pp 35ndash44 2010
[8] C Lin B Liu H Hu F Xiao and J Zhang ldquoDetecting hid-den Malware method based on ldquoIn-VMrdquo modelrdquo China Com-munications vol 8 no 4 pp 99ndash108 2011
[9] S Staniford V Paxson and N Weaver ldquoHow to own theinternet in your spare timerdquo in Proceedings of the 11th USENIXSecurity Symposium pp 149ndash167 San Francisco Calif USA2002
[10] S Qing and W Wen ldquoA survey and trends on Internet wormsrdquoComputers and Security vol 24 no 4 pp 334ndash346 2005
[11] C C ZouW Gong and D Towsley ldquoWorm propagation mod-eling and analysis under dynamic quarantine defenserdquo in Pro-ceedings of the 2003 ACMWorkshop on Rapid Malcode (WORMrsquo03) pp 51ndash60 Washington DC USA October 2003
[12] J Ren X Yang Q Zhu L Yang and C Zhang ldquoA novel com-puter virus model and its dynamicsrdquo Nonlinear Analysis RealWorld Applications vol 13 no 1 pp 376ndash384 2012
[13] B K Mishra and S K Pandey ldquoFuzzy epidemic model for thetransmission of worms in computer networkrdquo Nonlinear Ana-lysis Real World Applications vol 11 no 5 pp 4335ndash4341 2010
[14] L-X Yang and X Yang ldquoPropagation behavior of virus codesin the situation that infected computers are connected to theinternet with positive probabilityrdquo Discrete Dynamics in Natureand Society vol 2012 Article ID 693695 13 pages 2012
[15] Y Yao X Xie H Guo G Yu F Gao and X Tong ldquoHopf bifur-cation in an Internet worm propagation model with time delayin quarantinerdquoMathematical and Computer Modelling 2011
[16] Y Yao W Xiang A Qu G Yu and F Gao ldquoHopf bifurcationin an SEIDQV worm propagation model with quarantine stra-tegyrdquoDiscrete Dynamics in Nature and Society vol 2012 ArticleID 304868 18 pages 2012
[17] Y Yao L Guo H Guo G Yu F Gao and X Tong ldquoPulsequarantine strategy of internet worm propagation modelingand analysisrdquo Computers and Electrical Engineering 2011
[18] F Wang Y Zhang C Wang J Ma and S Moon ldquoStability ana-lysis of a SEIQV epidemic model for rapid spreading wormsrdquoComputers and Security vol 29 no 4 pp 410ndash418 2010
[19] T Dong X Liao and H Li ldquoStability and Hopf bifurcation ina computer virus model with multistate antivirusrdquo Abstract andApplied Analysis vol 2012 Article ID 841987 16 pages 2012
[20] T Zhang J Liu and Z Teng ldquoStability of Hopf bifurcation of adelayed SIRS epidemic model with stage structurerdquo NonlinearAnalysis Real World Applications vol 11 no 1 pp 293ndash3062010
[21] J Zhang W Li and X Yan ldquoHopf bifurcation and stabilityof periodic solutions in a delayed eco-epidemiological systemrdquoApplied Mathematics and Computation vol 198 no 2 pp 865ndash876 2008
[22] W Kermack and A McKendrick ldquoA contribution to the mathe-matical theory of epidemicsrdquo Proceedings of the Royal Society ofLondon A vol 115 no 772 pp 700ndash721 1927
[23] S Wang Q Liu X Yu and Y Ma ldquoBifurcation analysis of amodel for network worm propagation with time delayrdquoMathe-matical and Computer Modelling vol 52 no 3-4 pp 435ndash4472010
[24] B Hassard D Kazarino and Y WanTheory and Application ofHopf Bifurcation Cambridge University Press Cambridge UK1981
Submit your manuscripts athttpwwwhindawicom
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Mathematical Problems in Engineering
Hindawi Publishing Corporationhttpwwwhindawicom
Differential EquationsInternational Journal of
Volume 2014
Applied MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Mathematical PhysicsAdvances in
Complex AnalysisJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
OptimizationJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
International Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Operations ResearchAdvances in
Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Function Spaces
Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
International Journal of Mathematics and Mathematical Sciences
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Algebra
Discrete Dynamics in Nature and Society
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Decision SciencesAdvances in
Discrete MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom
Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Stochastic AnalysisInternational Journal of
4 Journal of Applied Mathematics
S I120574
Q
V
120593
120583
120583120583120583
120572I
120596
p120583
D
120573I
120572I(t minus 120591)
(1 minus p)120583
Figure 3 State transition diagram of the delayed model
rates are correlative to the number of infectious hosts andquarantined hosts in the network system And the rate 120583 is
120583 = 1205830(
119868 (119905) + 119876 (119905)
119873
) (4)
The hosts in delayed state are not likely to leave thenetwork accounting for the activeness of these hosts Thenewborn hosts enter the system with the same rate 120583 ofwhich a portion 1 minus 119901 is recovered by installing patchesinstantly at birth This differs from the transition denoted by120596 because the hosts are vaccinated at the time of entering thenetwork by installing patched operating system The transi-tion 120596 represents the rate by which those susceptible in thenetwork get vaccinated by installing patches laterThedelayeddifferential equations are written as
119889119878 (119905)
119889119905
= 119901120583 (119873 (119905) minus 119863 (119905)) minus 120573119868 (119905) 119878 (119905) minus 120596119878 (119905) minus 120583119878 (119905)
119889119868 (119905)
119889119905
= 120573119868 (119905) 119878 (119905) minus 120574119868 (119905) minus 120572119868 (119905) minus 120583119868 (119905)
119889119863 (119905)
119889119905
= 120572119868 (119905) minus 120572119868 (119905 minus 120591)
119889119876 (119905)
119889119905
= 120572119868 (119905 minus 120591) minus 120593119876 (119905) minus 120583119876 (119905)
119889119881 (119905)
119889119905
= (1 minus 119901) 120583 (119873 (119905) minus 119863 (119905))
+ 120596119878 (119905) + 120574119868 (119905) + 120593119876 (119905) minus 120583119881 (119905)
(5)
Other notations are identical to those in the previousmodel To understand themmore clearly the notations in thismodel are shown in Table 1
Table 1 Notations in this paper
Notation Definition119873 Total number of hosts in the network119878(119905) Number of susceptible hosts at time 119905119868(119905) Number of infectious hosts at time 119905119863(119905) Number of delayed hosts at time 119905119876(119905) Number of quarantined hosts at time 119905119881(119905) Number of vaccinated hosts at time 119905120573 Infection rate120596 Vaccine rate of susceptible hosts120572 Quarantine rate120593 Removal rate of quaratined hosts120574 Removal rate of infectious hosts120583 Birth and death rates119901 Birth ratio of susceptible hosts120591 Length of the time window in IDS
As mentioned in Table 1 the population size is set to 119873which is set to unity
119878 (119905) + 119868 (119905) + 119863 (119905) + 119876 (119905) + 119881 (119905) = 119873 (6)
34 Stability of the Positive Equilibrium andBifurcation Analysis
Theorem 1 The system has a unique positive equilibrium119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) when the condition
(1198671) (119901120583120573119873(120583 + 120572 + 120574)(120583 + 120596)) gt 1
is satisfied where
119878lowast=
120583 + 120572 + 120574
120573
119863lowast= 120572120591119868
lowast 119876
lowast=
120572119868lowast
120593 + 120583
119881lowast=
120574119868lowast+ 120596119878lowast+ 120593119876lowast+ 120583 (1 minus 119901) (119873 minus 119863
lowast)
120583
(7)
Proof From system (5) according to [23] if all the derivativeson the left of equal sign of the system are set to 0 whichimplies that the system becomes stationary we can get
119878 =
120583 + 120572 + 120574
120573
119863 = 120572120591119868lowast 119876 =
120572119868lowast
120593 + 120583
119881 =
120574119868lowast+ 120596119878lowast+ 120593119876lowast+ 120583 (1 minus 119901) (119873 minus 119863
lowast)
120583
(8)
Substituting the value of each variable in (8) for each of (6)then we can get
120583 + 120572 + 120574
120573
+ 119868 + 120572120591119868 +
120572119868
120593 + 120583
+ 119881 = 119873 (9)
After solving this equation with respect to 119868lowast a solution of 119868lowastis obtained
119868 =
119901119873120583120573 minus (120583 + 120596) (120583 + 120572 + 120574)
120573 (120572 + 120583119901120572120591 + 120583 + 120574)
(10)
Journal of Applied Mathematics 5
Thus if (1198671) is satisfied (10) has one unique positive
root 119868lowast and there is one unique positive equilibrium
119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) of system (5) The proof is com-
pleted
According to (6)119881 = 119873minus119878minus 119868 minus119863minus119876 and thus system(5) can be simplified to
119889119878 (119905)
119889119905
= 119901120583 (119873 (119905) minus 119863 (119905)) minus 120573119868 (119905) 119878 (119905) minus 119908119878 (119905) minus 120583119878 (119905)
119889119868 (119905)
119889119905
= 120573119868 (119905) 119878 (119905) minus 120574119868 (119905) minus 120572119868 (119905) minus 120583119868 (119905)
119889119863 (119905)
119889119905
= 120572119868 (119905) minus 120572119868 (119905 minus 120591)
119889119876 (119905)
119889119905
= 120572119868 (119905 minus 120591) minus 120593119876 (119905) minus 120583119876 (119905)
(11)
The Jacobimatrix of (11) about119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) is givenby
119869 (119864lowast) = (
1198861
1198862
11988631198864
120573119868lowast
1198865
0 1198866
0 120572 minus 120572119890minus120582120591
0 0
0 120572119890minus120582120591
minus 1198867
0 1198868
) (12)
where
1198861= minus
1205830(119868lowast+ 119876lowast)
119873
minus 120596 minus 120573119868lowast
1198862=
1199011205830(119873 minus 119863
lowast)
119873
minus
1205830119878lowast
119873
minus 120573119878lowast
1198863= minus
1199011205830(119868lowast+ 119876lowast)
119873
1198864=
1199011205830(119873 minus 119863
lowast) minus 1205830119878lowast
119873
1198865= 120573119878lowastminus 120572 minus 120574 minus
21205830119868lowast+ 1205830119876lowast
119873
1198866= minus
1205830119868lowast
119873
1198867=
1205830119876lowast
119873
1198868= minus120593 minus
1205830119868lowast+ 21205830119876lowast
119873
(13)
The characteristic equation of that matrix can be obtained by
119875 (120582) + 119876 (120582) 119890minus120582120591
= 0 (14)
where
119875 (120582) = 1205824minus (1198861+ 1198865+ 1198868) 1205823
+ (11988611198865+ 11988611198868+ 11988651198868+ 11988661198867minus 1198862120573119868lowast) 1205822
+ (minus119886111988651198868minus 119886111988661198867+ 11988621198868120573119868lowast
+ 11988641198867120573119868lowastminus 1198863120572120573119868lowast) 120582
+ 11988631198868120572120573119868lowast
119876 (120582) = minus11988661205721205822+ (11988611198866120572 minus 1198864120572120573119868lowast+ 1198863120572120573119868lowast) 120582
minus 11988631198868120572120573119868lowast
(15)
Let1198873= minus (119886
1+ 1198865+ 1198868)
1198872= 11988611198865+ 11988611198868+ 11988651198868+ 11988661198867minus 1198862120573119868lowast
1198871= minus119886111988651198868minus 119886111988661198867+ 11988621198868120573119868lowast
+ 11988641198867120573119868lowastminus 1198863120572120573119868lowast
1198870= 11988631198868120572120573119868lowast
1198882= minus1198866120572
1198881= 11988611198866120572 minus 1198864120572120573119868lowast+ 1198863120572120573119868lowast
1198880= minus11988631198868120572120573119868lowast
(16)
Then119875 (120582) = 120582
4+ 11988731205823+ 11988721205822+ 1198871120582 + 1198870
119876 (120582) = 11988821205822+ 1198881120582 + 1198880
(17)
Theorem 2 The positive equilibrium 119864lowast is locally asymptoti-
cally stable without time delay if the following holds
(1198672) 1198873gt 0 119889
1gt 0 119887
1+ 1198881gt 0
where
1198891= 1198873(1198872+ 1198882) minus (1198871+ 1198881) (18)
is satisfied
Proof If 120591 = 0 then (14) reduces to
1205824+ 11988731205823+ (1198872+ 1198882) 1205822
+ (1198871+ 1198881) 120582 + (119887
0+ 1198880) = 0
(19)
Because 1198870+ 1198880= 0 equation (19) can be further reduced to
1205823+ 11988731205822+ (1198872+ 1198882) 120582 + (119887
1+ 1198881) = 0 (20)
According to Routh-Hurwitz criterion all the roots of(20) have negative real partsTherefore it can be deduced thatthe positive equilibrium 119864
lowast is locally asymptotically stablewithout time delay The proof is completed
Obviously 120582 = 119894120596 (120596 gt 0) is a root of (14) After separat-ing the real and imaginary parts it can be written as
1205964minus 11988721205962+ 1198870+ (1198880minus 11988821205962) cos (120596120591) + 119888
1120596 sin (120596120591) = 0
minus11988731205963+ 1198871120596 + (119888
21205962minus 1198880) sin (120596120591) + 119888
1120596 cos (120596120591) = 0
(21)
6 Journal of Applied Mathematics
From the two equations of (21) the following equationcan be obtained
1198882
11205962+ (1198882
21205962minus 1198880)
2
= (1205964minus 11988721205962+ 1198870)
2
+ (1198871120596 minus 11988731205963)
2
(22)
which implies that
1205968+ 11989831205966+ 11989821205964+ 11989811205962+ 1198980= 0 (23)
where
1198983= 1198872
3minus 21198872
1198982= 1198872
2+ 21198870minus 211988711198873minus 1198882
2
1198981= 1198872
1minus 1198882
1minus 211988721198870+ 211988801198882
1198980= 1198872
0minus 1198882
0
(24)
Then (23) reduces to
1205966+ 11989831205964+ 11989821205962+ 1198981= 0 (25)
Let 119911 = 1205962Then (25) can be written as
ℎ (119911) = 1199113+ 11989831199112+ 1198982119911 + 119898
1 (26)
Δ is defined as Δ = 1198982
3minus 31198982 And we can get a solution
119911lowast= (radicΔ minus 119898
3)3 of h(z)
Lemma 3 Suppose that (1198672) 1198873gt 0 119889
1gt 0 119887
1+ 1198881gt 0 is
satisfied
(i) If one of followings holds (a) Δ gt 0 119911lowast lt 0 (b) Δ gt
0 119911lowast gt 0 and ℎ(119911lowast) gt 0 then all roots of (14) havenegative real parts when 120591 isin [0 120591
0) and 120591
0is a certain
positive constant(ii) If the conditions (a) and (b) are not satisfied then all
roots of (14) have negative real parts for all 120591 ge 0
Proof When 120591 = 0 equation (14) can be reduced to
1205823+ 11988731205822+ (1198872+ 1198882) 120582 + (119887
1+ 1198881) = 0 (27)
By the Routh-Hurwitz criterion all roots of (20) havenegative real parts if and only if 119887
3gt 0 119889
1gt 0 and 119887
1+1198881gt 0
Considering (26) it is easy to see from the characters ofcubic algebra equation that ℎ(119911) is a strictly monotonicallyincreasing function if Δ le 0 If Δ gt 0 and 119911lowast lt 0 or Δ gt 0119911lowastgt 0 but ℎ(119911lowast) gt 0 then ℎ(119911) has no positive root Thus
under these conditions equation (14) has no purely imag-inary roots for any 120591 gt 0 In addition this also implies thatthe positive equilibrium 119864
lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) of system (5)
is absolutely stable Therefore the following theorem on thestability of positive equilibrium 119864
lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) can
be easily obtained
Theorem 4 Assume that (1198671) and (119867
2) are satisfied and Δ gt
0 and 119911lowast lt 0 orΔ gt 0 119911lowast gt 0 and ℎ(119911lowast) gt 0Then the positive
equilibrium 119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) of system (5) is absolutely
stable that is to say 119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) is asymptoticallystable for any time delay 120591 ge 0
It is assumed that the coefficients in ℎ(119911) satisfy thecondition as follows
(1198673) Δ gt 0 119911
lowastgt 0 ℎ(119911
lowast) lt 0
Then according to lemma in [15] it is known that (26) hasat least a positive root 120596
0 namely the characteristic equation
(14) has a pair of purely imaginary roots plusmn1198941205960
In view of the fact that (14) has a pair of purely imaginaryroots plusmn119894120596
0 the corresponding 120591
119896gt 0 is given by eliminating
sin(120596120591) in (21)
120591119896=
1
1205960
arccos[(11988721205962
0minus 1205964
0minus 1198870) (1198880minus 11988821205962
0)
(1198880minus 11988821205962
0)2+ 120596 (119887
31205962minus 1198871minus 1198881)
]
+
2119896120587
1205960
(119896 = 0 1 2 )
(28)
Let 120582(120591) = V(120591) + 119894120596(120591) be the root of (14) so that V(120591119896) = 0
and 120596(120591119896) = 1205960are satisfied when 120591 = 120591
119896
Lemma 5 Suppose that ℎ1015840(1199110) = 0 If 120591 = 120591
0 then plusmn119894120596
0is a
pair of simple purely imaginary roots of (14) In addition if theconditions in Lemma 3 are satisfied then
119889 (Re 120582)119889120591
10038161003816100381610038161003816100381610038161003816120591=120591119896
gt 0 (29)
This signifies that there exists at least one eigenvalue withpositive real part for 120591 gt 120591
119896 Differentiating both sides of (14)
with respect to 120591 it can be written as
(
119889120582
119889120591
)
minus1
= ((41205823+ 311988731205822+ 21198872120582 + 1198871)
+1198881119890minus120582120591
minus (1198881120582 + 1198880) 120591119890minus120582120591
)
times ((1198881120582 + 1198880) 120582119890minus120582120591
)
minus1
(30)
Therefore
sgn119889Re 120582119889120591
120591=120591119896
= sgnRe(119889120582119889120591
)
minus1
120582=1198941205960
= sgn1205962
0
Λ
(41205966
0+ 311989831205964
0
+211989821205962
0+ 1198981)
= sgn1205962
0
Λ
ℎ1015840(1205962
0) = sgn ℎ1015840 (1205962
0)
(31)
where Λ = 1198882
11205964
0+ 11988801205962
0 Then it can be derived that
119889 (Re 120582)119889120591
10038161003816100381610038161003816100381610038161003816120591=120591119896
gt 0 (32)
Journal of Applied Mathematics 7
times105
5
45
4
35
3
25
2
15
1
05
028024020016012080400
Tota
l num
ber o
f hos
ts
S(t)
I(t)
D(t)
Q(t)
R(t)
t (s)
Figure 4 Worm propagation trend of the model when 120591 lt 1205910
It follows the hypothesis (1198673) that ℎ1015840(1205962
0) = 0 Therefore
transversality condition holds and the conditions for Hopfbifurcation are satisfied when 120591 = 120591
119896 according to Hopf
bifurcation theorem [24] for functional differential equationsThen the following results can be obtained
Theorem 6 Suppose that the conditions (1198671) and (119867
2) are
satisfied
(i) For system (5) the equilibrium 119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast)
is locally asymptotically stable when 120591 isin [0 1205910) but
unstable when 120591 gt 1205910
(ii) When condition (1198673) is satisfied system (5) will
undergo a Hopf bifurcation at the positive equilibrium119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) when 120591 = 120591
119896(119896 = 0 1 2 )
where 120591119896is defined by (28)
Theorem 2 implies to us that when birth and death ratesand the mechanism of time window in intrusion detectionsystem are considered the length of time window is crucialfor the stability of the propagation process When time delayis less than the threshold 120591
0 the system will stabilize at
its infection equilibrium point which is beneficial to fur-ther implement containment strategies to eliminate wormsHowever when time delay is greater than the threshold thesystem will be unstable and undergo a bifurcation Althoughthe propagation of worm presents a periodical phenome-non in real world complicated environment may make thepropagation pass the critical state and reach to an unpre-dictable chaos
4 Numerical and Simulation Experiments
41 Numerical Experiments The parameters of the delayedmodelwill be chosen properly according to the stability of thepositive equilibrium bifurcation analysis and the practicalenvironment 500000 hosts are picked as the population sizeand the wormrsquos average scan rate is 120578 = 4000 per secondThe worm infection rate can be calculated as 120576 = 1205781198732
32=
04657 [11] which means that average 04657 hosts of all the
times105
Tota
l num
ber o
f hos
ts
S(t)
I(t)
R(t)
5
4
3
2
1
00 500 1000 1500 2000 2500 3000
t (s)
Figure 5 Worm propagation trend of the model when 120591 gt 1205910
25
2
15
1
05
00 100 200 300 400 500 600 700 800
times105
I(t)
t(s)
Figure 6 The number of 119868(119905) when 120591 is changed
hosts can be scanned by one host The infection ratio is 120573 =
120578232
= 00000053 The rest of the parameters are 120574 = 0031205830= 0026 120596 = 000001 120572 = 056 120593 = 00009 and
119901 = 099 Initially 119868(0) = 50 which means that there are50 infectious hosts while the rest of the hosts are susceptibleat the beginning
Figure 4 shows the curves of five kinds of hosts when120591 = 5 lt 120591
0 All of the five kinds of hosts get stable within
4 minutes which illustrates that 119864lowast is asymptotically stableIt implies that the number of infectious hosts maintain aconstant level and thus can be predicted Further strategiescan be developed and utilized to eliminate worms But whentime delay 120591 gets increased and then reach the threshold 120591
0
119864lowast will lose its stability and a bifurcation will occur Figure 5
shows the susceptible infected and recovered hosts when120591 gt 1205910 In this firgure we can clearly see that the number of
infectious hosts will outburst after a short period of peaceand repeat again and again but not in the same period
In order to see the influence of time delay 120591 is set to adifferent value each time with other parameters remainingthe same Figure 6 shows the number of infected hosts in the
8 Journal of Applied Mathematics
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 5
t (s)
(a)
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 15
t (s)
(b)
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 45
t (s)
(c)
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 90
t (s)
(d)
Figure 7 The number of 119868(119905) when 120591 is changed
same coordinate with time delays 120591 = 5 120591 = 15 120591 = 45 and120591 = 90 respectively
Figure 7 gives the four curves in four coordinates In thesetwo figures the impact of time delay on infected hosts isevident Initially the four curves are overlapped whichmeansthat time delay has little effect in the initial stage of wormpropagationWith the increase of time delay the curve beginsto oscillate When time delay passes through the threshold1205910 the infecting process gets unstable Then simultaneously
it can be discovered that the amplitude and period of thenumber of infected hosts get increased
Figure 8(a) shows the projection of the phase portrait ofsystem (5) when 120591 = 15 lt 120591
0in (119878 119868 119881)-space The curve
converges to a fixed point which suggests that the system isstable Figure 8(b) shows the projection of the phase portraitof system (5) when 120591 = 25 gt 120591
0in (119878 119868 119881)-space The curve
converges to a limit circle which implies that the system isunstable Figures 8(c) and 8(d) show the phase portraits ofsusceptible 119878(119905) and infected 119868(119905) as 120591 = 15 lt 120591
0and 120591 = 25 gt
1205910 respectively
42 Simulation Experiments The discrete-time simulation isan expanded version of Zoursquos program simulating Code Redworm propagation and has been modified to run on a Linuxserver The system in our simulation experiment consistsof 500000 hosts that can reach each other directly which
is consistent with the numerical experiments and there isno topology issue in our simulation At the beginning ofsimulation 50 hosts are randomly chosen to be infectious andthe others are all susceptible
Identical with the results of numerical experimentsFigure 9 shows all five kinds of hosts when 120591 = 5 lt 120591
0 We
find that themodel will reach a stable state after a short periodof time which suggests that the number of infetious hosts canbe predicted and we can develop further strategy to eliminateworms
When time delay increases but is less than the thresholdderived from theoretical analysis the number of infectioushosts and other hosts present a damped oscillation and finallyreach an approximately stable state Figure 10 shows the num-ber of five kinds of hosts when 120591 = 15 lt 120591
0 An interesting
result is that the number of each host maintain a slightrandom vibration However the overall amplitude is only0273 to the population size and themaximumamplitude isonly 0953 to the population size The reason why this phe-nomenon occurs is due to the random events in simulationexperiments The implement of transition rates of the modelis based on probability That is to say when the removal rateof infectious hosts is set to 003 it means that the probabilityof transition from infectious hosts to vaccinated state is 3 italso means that infectious hosts get patched with probabilityof 3 To investigate this phenomenon phase portrait of
Journal of Applied Mathematics 9
0
1
2
3
4
5
0
005
115
2
I(t)
times104
times10 5
times105
S(t)
2
4V(t)
120591 = 15
(a) The projection of the phase portrait in (119878 119868 119877)-space when 120591 lt 1205910
0
1
2
3
4
5
0
005
115
2
I(t)
times104
times10 5
times105
S(t)
2
4V(t)
120591 = 25
(b) The projection of the phase portrait in (119878 119868 119877)-space when 120591 gt 1205910
5
4
3
2
1
00 02 04 06 08 1 12 14 16 18 2
I(t)
S(t)
times105
times105
120591 = 15
(c) The phase portrait of susceptible 119878(119905) and infected 119868(119905) when 120591 lt 1205910
5
4
3
2
1
00 02 04 06 08 1 12 14 16 18 2
I(t)
S(t)
times105
times105
120591 = 25
(d) The phase portrait of susceptible 119878(119905) and infected 119868(119905) when 120591 gt 1205910
Figure 8 The phase portrait when 120591 lt 1205910and 120591 gt 120591
0
S(t)
I(t)
D(t)
Q(t)
V(t)
5
45
4
35
3
25
2
15
1
05
00 50 100 150 200 250 300 350 400 450 500
times105
Num
ber o
f hos
ts
t (s)
Figure 9 Simulation result of the five kinds of hosts when 120591 lt 1205910
susceptible 119878(119905) and infected 119868(119905) is depictedwhen 120591 = 15 lt 1205910
as shown Figure 11 It shows that the curve is converged to afixed point which means that the system gets stable
When time delay passes the threshold a bifurcationappears Figure 12 shows the number of susceptible infectiousand vaccinated hosts when 120591 gt 120591
0 Figure 13 shows the differ-
ence between simulation and numerical results of susceptibleand infectious hosts respectively In this figure the periods
S(t)
I(t)
D(t)
Q(t)
V(t)
5
45
4
35
3
25
2
15
1
05
00 500
times105
Num
ber o
f hos
ts
1000 1500 2000 2500 3000 3500
t (s)
Figure 10 Simulation result of the five kinds of hosts when 120591 = 15
of these two curves are well matched which suggests thatthe results of numerical and simulation experiments areidentical But there is a difference of 96 of total populationsize in amplitudes This mainly results from the precision ofexperiments The number of hosts in numerical experimentscan be either integers or decimals because it is the solution ofdifferential equations However in simulation experimentsthe number of hosts must be integers Furthermore when the
10 Journal of Applied Mathematics
5
45
4
35
3
25
2
15
1
05
0
times105
I(t)
S(t)
times1040 2 4 6 8 10 12 14 16 18
120591 = 15
Figure 11 The phase portrait of susceptible 119878(119905) and infected 119868(119905)
when 120591 = 15
S(t)
I(t)
V(t)
5
45
4
35
3
25
2
15
1
05
00 500
times105
Num
ber o
f hos
ts
1000 1500 2000 2500 3000
t (s)
Figure 12 Simulation result of the three kinds of hosts when 120591 gt 1205910
number of infectious hosts are very little this tiny differencewill result in a big gap afterwards
5 Conclusions
In order to accord with actual facts in the real world timedelay generated by time window in IDS is introduced toconstruct the worm propagation model Dynamic birth anddeath rates are considered in this paper accounting for thereinstallation of OS which users are more likely to do afterwhen the hosts suffer wormrsquos destruction or quarantined tothe Internet In addition combined with birth and deathrates time delay may lead to bifurcation and make the wormpropagation system unstable
In this paper a delayed worm propagation model withbirth and death rates is studied Next the stability of thepositive equilibrium is analyzedThrough theoretical analysisand numerical and simulation experiments the followingconclusions can be derived
(i) The introduction of time window in IDS may lead totime delay in worm propagationmodel which resultsin bifurcation The critical time delay 120591
0where the
bifurcation appears is obtained
S(t)
5
45
4
35
3
25
2
15
1
05
00 500
times105
1000 1500 2000 2500 3000
S(t) in numerical experimentS(t) in simulation experiment
t (s)
(a) The comparison of the number of susceptible hosts
I(t)
25
2
15
1
05
00 500
times105
1000 1500 2000 2500 30000 500 1000 1500 2000 2500 300
I(t) in numerical experimentI(t) in simulation experiment
t (s)
(b) The comparison of the number of infectious hosts
Figure 13 The comparison of numerical and simulation experi-ments
(ii) The worm propagation system is stable when timedelay 120591 lt 120591
0 In this situation the worm propagation
can be easily predicted and eliminated(iii) A bifurcation emerges when time delay 120591 ge 120591
0 which
means the worm propagation is unstable and may beout of control
Consequently time delay 120591 should remain less than 1205910
by decreasing the time window in IDS which is helpful topredict the worm propagation and even eliminate the worm
In this paper we have only discussed the cases whichsatisfy conditions (119867
1) (1198672) and (119867
3) But for cases that
satisfy (1198671) (1198672) and (119867
3) the dynamical behavior of this
model has not been studied These issues will be studied anddiscussed in our future work
Acknowledgments
The authors are very grateful to the anonymous referee formany valuable comments and suggestions which led to asignificant improvement of the original paper This paper
Journal of Applied Mathematics 11
is supported by the National Natural Science Foundationof China under Grant no 60803132 the Natural ScienceFoundation of Liaoning Province of China under Grant no201202059 Program for Liaoning Excellent Talents in Uni-versity under LR2013011 the Fundamental Research Funds ofthe Central Universities under Grant nos N120504006 andN100704001 and MOE-Intel Special Fund of InformationTechnology (MOE-INTEL-2012-06)
References
[1] N Yoshida and T Hara ldquoGlobal stability of a delayed SIR epide-mic model with density dependent birth and death ratesrdquo Jour-nal of Computational and Applied Mathematics vol 201 no 2pp 339ndash347 2007
[2] M Song W Ma and Y Takeuchi ldquoPermanence of a delayedSIR epidemic model with density dependent birth raterdquo Journalof Computational and Applied Mathematics vol 201 no 2 pp389ndash394 2007
[3] J Liu and T Zhang ldquoBifurcation analysis of an SIS epidemicmodel with nonlinear birth raterdquo Chaos Solitons and Fractalsvol 40 no 3 pp 1091ndash1099 2009
[4] V Yegneswaran P Barford and D Plonka ldquoOn the design anduse of internet sinks for network abuse monitoringrdquo ComputerScience vol 3224 pp 146ndash165 2004
[5] D Yeung and Y Ding ldquoHost-based intrusion detection usingdynamic and static behavioralmodelsrdquo Pattern Recognition vol36 no 1 pp 229ndash243 2003
[6] N Stakhanova S Basu and JWong ldquoOn the symbiosis of speci-fication-based and anomaly-based detectionrdquo Computers andSecurity vol 29 no 2 pp 253ndash268 2010
[7] G P Spathoulas and S K Katsikas ldquoReducing false positives inintrusion detection systemsrdquo Computers and Security vol 29no 1 pp 35ndash44 2010
[8] C Lin B Liu H Hu F Xiao and J Zhang ldquoDetecting hid-den Malware method based on ldquoIn-VMrdquo modelrdquo China Com-munications vol 8 no 4 pp 99ndash108 2011
[9] S Staniford V Paxson and N Weaver ldquoHow to own theinternet in your spare timerdquo in Proceedings of the 11th USENIXSecurity Symposium pp 149ndash167 San Francisco Calif USA2002
[10] S Qing and W Wen ldquoA survey and trends on Internet wormsrdquoComputers and Security vol 24 no 4 pp 334ndash346 2005
[11] C C ZouW Gong and D Towsley ldquoWorm propagation mod-eling and analysis under dynamic quarantine defenserdquo in Pro-ceedings of the 2003 ACMWorkshop on Rapid Malcode (WORMrsquo03) pp 51ndash60 Washington DC USA October 2003
[12] J Ren X Yang Q Zhu L Yang and C Zhang ldquoA novel com-puter virus model and its dynamicsrdquo Nonlinear Analysis RealWorld Applications vol 13 no 1 pp 376ndash384 2012
[13] B K Mishra and S K Pandey ldquoFuzzy epidemic model for thetransmission of worms in computer networkrdquo Nonlinear Ana-lysis Real World Applications vol 11 no 5 pp 4335ndash4341 2010
[14] L-X Yang and X Yang ldquoPropagation behavior of virus codesin the situation that infected computers are connected to theinternet with positive probabilityrdquo Discrete Dynamics in Natureand Society vol 2012 Article ID 693695 13 pages 2012
[15] Y Yao X Xie H Guo G Yu F Gao and X Tong ldquoHopf bifur-cation in an Internet worm propagation model with time delayin quarantinerdquoMathematical and Computer Modelling 2011
[16] Y Yao W Xiang A Qu G Yu and F Gao ldquoHopf bifurcationin an SEIDQV worm propagation model with quarantine stra-tegyrdquoDiscrete Dynamics in Nature and Society vol 2012 ArticleID 304868 18 pages 2012
[17] Y Yao L Guo H Guo G Yu F Gao and X Tong ldquoPulsequarantine strategy of internet worm propagation modelingand analysisrdquo Computers and Electrical Engineering 2011
[18] F Wang Y Zhang C Wang J Ma and S Moon ldquoStability ana-lysis of a SEIQV epidemic model for rapid spreading wormsrdquoComputers and Security vol 29 no 4 pp 410ndash418 2010
[19] T Dong X Liao and H Li ldquoStability and Hopf bifurcation ina computer virus model with multistate antivirusrdquo Abstract andApplied Analysis vol 2012 Article ID 841987 16 pages 2012
[20] T Zhang J Liu and Z Teng ldquoStability of Hopf bifurcation of adelayed SIRS epidemic model with stage structurerdquo NonlinearAnalysis Real World Applications vol 11 no 1 pp 293ndash3062010
[21] J Zhang W Li and X Yan ldquoHopf bifurcation and stabilityof periodic solutions in a delayed eco-epidemiological systemrdquoApplied Mathematics and Computation vol 198 no 2 pp 865ndash876 2008
[22] W Kermack and A McKendrick ldquoA contribution to the mathe-matical theory of epidemicsrdquo Proceedings of the Royal Society ofLondon A vol 115 no 772 pp 700ndash721 1927
[23] S Wang Q Liu X Yu and Y Ma ldquoBifurcation analysis of amodel for network worm propagation with time delayrdquoMathe-matical and Computer Modelling vol 52 no 3-4 pp 435ndash4472010
[24] B Hassard D Kazarino and Y WanTheory and Application ofHopf Bifurcation Cambridge University Press Cambridge UK1981
Submit your manuscripts athttpwwwhindawicom
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Mathematical Problems in Engineering
Hindawi Publishing Corporationhttpwwwhindawicom
Differential EquationsInternational Journal of
Volume 2014
Applied MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Mathematical PhysicsAdvances in
Complex AnalysisJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
OptimizationJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
International Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Operations ResearchAdvances in
Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Function Spaces
Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
International Journal of Mathematics and Mathematical Sciences
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Algebra
Discrete Dynamics in Nature and Society
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Decision SciencesAdvances in
Discrete MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom
Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Stochastic AnalysisInternational Journal of
Journal of Applied Mathematics 5
Thus if (1198671) is satisfied (10) has one unique positive
root 119868lowast and there is one unique positive equilibrium
119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) of system (5) The proof is com-
pleted
According to (6)119881 = 119873minus119878minus 119868 minus119863minus119876 and thus system(5) can be simplified to
119889119878 (119905)
119889119905
= 119901120583 (119873 (119905) minus 119863 (119905)) minus 120573119868 (119905) 119878 (119905) minus 119908119878 (119905) minus 120583119878 (119905)
119889119868 (119905)
119889119905
= 120573119868 (119905) 119878 (119905) minus 120574119868 (119905) minus 120572119868 (119905) minus 120583119868 (119905)
119889119863 (119905)
119889119905
= 120572119868 (119905) minus 120572119868 (119905 minus 120591)
119889119876 (119905)
119889119905
= 120572119868 (119905 minus 120591) minus 120593119876 (119905) minus 120583119876 (119905)
(11)
The Jacobimatrix of (11) about119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) is givenby
119869 (119864lowast) = (
1198861
1198862
11988631198864
120573119868lowast
1198865
0 1198866
0 120572 minus 120572119890minus120582120591
0 0
0 120572119890minus120582120591
minus 1198867
0 1198868
) (12)
where
1198861= minus
1205830(119868lowast+ 119876lowast)
119873
minus 120596 minus 120573119868lowast
1198862=
1199011205830(119873 minus 119863
lowast)
119873
minus
1205830119878lowast
119873
minus 120573119878lowast
1198863= minus
1199011205830(119868lowast+ 119876lowast)
119873
1198864=
1199011205830(119873 minus 119863
lowast) minus 1205830119878lowast
119873
1198865= 120573119878lowastminus 120572 minus 120574 minus
21205830119868lowast+ 1205830119876lowast
119873
1198866= minus
1205830119868lowast
119873
1198867=
1205830119876lowast
119873
1198868= minus120593 minus
1205830119868lowast+ 21205830119876lowast
119873
(13)
The characteristic equation of that matrix can be obtained by
119875 (120582) + 119876 (120582) 119890minus120582120591
= 0 (14)
where
119875 (120582) = 1205824minus (1198861+ 1198865+ 1198868) 1205823
+ (11988611198865+ 11988611198868+ 11988651198868+ 11988661198867minus 1198862120573119868lowast) 1205822
+ (minus119886111988651198868minus 119886111988661198867+ 11988621198868120573119868lowast
+ 11988641198867120573119868lowastminus 1198863120572120573119868lowast) 120582
+ 11988631198868120572120573119868lowast
119876 (120582) = minus11988661205721205822+ (11988611198866120572 minus 1198864120572120573119868lowast+ 1198863120572120573119868lowast) 120582
minus 11988631198868120572120573119868lowast
(15)
Let1198873= minus (119886
1+ 1198865+ 1198868)
1198872= 11988611198865+ 11988611198868+ 11988651198868+ 11988661198867minus 1198862120573119868lowast
1198871= minus119886111988651198868minus 119886111988661198867+ 11988621198868120573119868lowast
+ 11988641198867120573119868lowastminus 1198863120572120573119868lowast
1198870= 11988631198868120572120573119868lowast
1198882= minus1198866120572
1198881= 11988611198866120572 minus 1198864120572120573119868lowast+ 1198863120572120573119868lowast
1198880= minus11988631198868120572120573119868lowast
(16)
Then119875 (120582) = 120582
4+ 11988731205823+ 11988721205822+ 1198871120582 + 1198870
119876 (120582) = 11988821205822+ 1198881120582 + 1198880
(17)
Theorem 2 The positive equilibrium 119864lowast is locally asymptoti-
cally stable without time delay if the following holds
(1198672) 1198873gt 0 119889
1gt 0 119887
1+ 1198881gt 0
where
1198891= 1198873(1198872+ 1198882) minus (1198871+ 1198881) (18)
is satisfied
Proof If 120591 = 0 then (14) reduces to
1205824+ 11988731205823+ (1198872+ 1198882) 1205822
+ (1198871+ 1198881) 120582 + (119887
0+ 1198880) = 0
(19)
Because 1198870+ 1198880= 0 equation (19) can be further reduced to
1205823+ 11988731205822+ (1198872+ 1198882) 120582 + (119887
1+ 1198881) = 0 (20)
According to Routh-Hurwitz criterion all the roots of(20) have negative real partsTherefore it can be deduced thatthe positive equilibrium 119864
lowast is locally asymptotically stablewithout time delay The proof is completed
Obviously 120582 = 119894120596 (120596 gt 0) is a root of (14) After separat-ing the real and imaginary parts it can be written as
1205964minus 11988721205962+ 1198870+ (1198880minus 11988821205962) cos (120596120591) + 119888
1120596 sin (120596120591) = 0
minus11988731205963+ 1198871120596 + (119888
21205962minus 1198880) sin (120596120591) + 119888
1120596 cos (120596120591) = 0
(21)
6 Journal of Applied Mathematics
From the two equations of (21) the following equationcan be obtained
1198882
11205962+ (1198882
21205962minus 1198880)
2
= (1205964minus 11988721205962+ 1198870)
2
+ (1198871120596 minus 11988731205963)
2
(22)
which implies that
1205968+ 11989831205966+ 11989821205964+ 11989811205962+ 1198980= 0 (23)
where
1198983= 1198872
3minus 21198872
1198982= 1198872
2+ 21198870minus 211988711198873minus 1198882
2
1198981= 1198872
1minus 1198882
1minus 211988721198870+ 211988801198882
1198980= 1198872
0minus 1198882
0
(24)
Then (23) reduces to
1205966+ 11989831205964+ 11989821205962+ 1198981= 0 (25)
Let 119911 = 1205962Then (25) can be written as
ℎ (119911) = 1199113+ 11989831199112+ 1198982119911 + 119898
1 (26)
Δ is defined as Δ = 1198982
3minus 31198982 And we can get a solution
119911lowast= (radicΔ minus 119898
3)3 of h(z)
Lemma 3 Suppose that (1198672) 1198873gt 0 119889
1gt 0 119887
1+ 1198881gt 0 is
satisfied
(i) If one of followings holds (a) Δ gt 0 119911lowast lt 0 (b) Δ gt
0 119911lowast gt 0 and ℎ(119911lowast) gt 0 then all roots of (14) havenegative real parts when 120591 isin [0 120591
0) and 120591
0is a certain
positive constant(ii) If the conditions (a) and (b) are not satisfied then all
roots of (14) have negative real parts for all 120591 ge 0
Proof When 120591 = 0 equation (14) can be reduced to
1205823+ 11988731205822+ (1198872+ 1198882) 120582 + (119887
1+ 1198881) = 0 (27)
By the Routh-Hurwitz criterion all roots of (20) havenegative real parts if and only if 119887
3gt 0 119889
1gt 0 and 119887
1+1198881gt 0
Considering (26) it is easy to see from the characters ofcubic algebra equation that ℎ(119911) is a strictly monotonicallyincreasing function if Δ le 0 If Δ gt 0 and 119911lowast lt 0 or Δ gt 0119911lowastgt 0 but ℎ(119911lowast) gt 0 then ℎ(119911) has no positive root Thus
under these conditions equation (14) has no purely imag-inary roots for any 120591 gt 0 In addition this also implies thatthe positive equilibrium 119864
lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) of system (5)
is absolutely stable Therefore the following theorem on thestability of positive equilibrium 119864
lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) can
be easily obtained
Theorem 4 Assume that (1198671) and (119867
2) are satisfied and Δ gt
0 and 119911lowast lt 0 orΔ gt 0 119911lowast gt 0 and ℎ(119911lowast) gt 0Then the positive
equilibrium 119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) of system (5) is absolutely
stable that is to say 119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) is asymptoticallystable for any time delay 120591 ge 0
It is assumed that the coefficients in ℎ(119911) satisfy thecondition as follows
(1198673) Δ gt 0 119911
lowastgt 0 ℎ(119911
lowast) lt 0
Then according to lemma in [15] it is known that (26) hasat least a positive root 120596
0 namely the characteristic equation
(14) has a pair of purely imaginary roots plusmn1198941205960
In view of the fact that (14) has a pair of purely imaginaryroots plusmn119894120596
0 the corresponding 120591
119896gt 0 is given by eliminating
sin(120596120591) in (21)
120591119896=
1
1205960
arccos[(11988721205962
0minus 1205964
0minus 1198870) (1198880minus 11988821205962
0)
(1198880minus 11988821205962
0)2+ 120596 (119887
31205962minus 1198871minus 1198881)
]
+
2119896120587
1205960
(119896 = 0 1 2 )
(28)
Let 120582(120591) = V(120591) + 119894120596(120591) be the root of (14) so that V(120591119896) = 0
and 120596(120591119896) = 1205960are satisfied when 120591 = 120591
119896
Lemma 5 Suppose that ℎ1015840(1199110) = 0 If 120591 = 120591
0 then plusmn119894120596
0is a
pair of simple purely imaginary roots of (14) In addition if theconditions in Lemma 3 are satisfied then
119889 (Re 120582)119889120591
10038161003816100381610038161003816100381610038161003816120591=120591119896
gt 0 (29)
This signifies that there exists at least one eigenvalue withpositive real part for 120591 gt 120591
119896 Differentiating both sides of (14)
with respect to 120591 it can be written as
(
119889120582
119889120591
)
minus1
= ((41205823+ 311988731205822+ 21198872120582 + 1198871)
+1198881119890minus120582120591
minus (1198881120582 + 1198880) 120591119890minus120582120591
)
times ((1198881120582 + 1198880) 120582119890minus120582120591
)
minus1
(30)
Therefore
sgn119889Re 120582119889120591
120591=120591119896
= sgnRe(119889120582119889120591
)
minus1
120582=1198941205960
= sgn1205962
0
Λ
(41205966
0+ 311989831205964
0
+211989821205962
0+ 1198981)
= sgn1205962
0
Λ
ℎ1015840(1205962
0) = sgn ℎ1015840 (1205962
0)
(31)
where Λ = 1198882
11205964
0+ 11988801205962
0 Then it can be derived that
119889 (Re 120582)119889120591
10038161003816100381610038161003816100381610038161003816120591=120591119896
gt 0 (32)
Journal of Applied Mathematics 7
times105
5
45
4
35
3
25
2
15
1
05
028024020016012080400
Tota
l num
ber o
f hos
ts
S(t)
I(t)
D(t)
Q(t)
R(t)
t (s)
Figure 4 Worm propagation trend of the model when 120591 lt 1205910
It follows the hypothesis (1198673) that ℎ1015840(1205962
0) = 0 Therefore
transversality condition holds and the conditions for Hopfbifurcation are satisfied when 120591 = 120591
119896 according to Hopf
bifurcation theorem [24] for functional differential equationsThen the following results can be obtained
Theorem 6 Suppose that the conditions (1198671) and (119867
2) are
satisfied
(i) For system (5) the equilibrium 119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast)
is locally asymptotically stable when 120591 isin [0 1205910) but
unstable when 120591 gt 1205910
(ii) When condition (1198673) is satisfied system (5) will
undergo a Hopf bifurcation at the positive equilibrium119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) when 120591 = 120591
119896(119896 = 0 1 2 )
where 120591119896is defined by (28)
Theorem 2 implies to us that when birth and death ratesand the mechanism of time window in intrusion detectionsystem are considered the length of time window is crucialfor the stability of the propagation process When time delayis less than the threshold 120591
0 the system will stabilize at
its infection equilibrium point which is beneficial to fur-ther implement containment strategies to eliminate wormsHowever when time delay is greater than the threshold thesystem will be unstable and undergo a bifurcation Althoughthe propagation of worm presents a periodical phenome-non in real world complicated environment may make thepropagation pass the critical state and reach to an unpre-dictable chaos
4 Numerical and Simulation Experiments
41 Numerical Experiments The parameters of the delayedmodelwill be chosen properly according to the stability of thepositive equilibrium bifurcation analysis and the practicalenvironment 500000 hosts are picked as the population sizeand the wormrsquos average scan rate is 120578 = 4000 per secondThe worm infection rate can be calculated as 120576 = 1205781198732
32=
04657 [11] which means that average 04657 hosts of all the
times105
Tota
l num
ber o
f hos
ts
S(t)
I(t)
R(t)
5
4
3
2
1
00 500 1000 1500 2000 2500 3000
t (s)
Figure 5 Worm propagation trend of the model when 120591 gt 1205910
25
2
15
1
05
00 100 200 300 400 500 600 700 800
times105
I(t)
t(s)
Figure 6 The number of 119868(119905) when 120591 is changed
hosts can be scanned by one host The infection ratio is 120573 =
120578232
= 00000053 The rest of the parameters are 120574 = 0031205830= 0026 120596 = 000001 120572 = 056 120593 = 00009 and
119901 = 099 Initially 119868(0) = 50 which means that there are50 infectious hosts while the rest of the hosts are susceptibleat the beginning
Figure 4 shows the curves of five kinds of hosts when120591 = 5 lt 120591
0 All of the five kinds of hosts get stable within
4 minutes which illustrates that 119864lowast is asymptotically stableIt implies that the number of infectious hosts maintain aconstant level and thus can be predicted Further strategiescan be developed and utilized to eliminate worms But whentime delay 120591 gets increased and then reach the threshold 120591
0
119864lowast will lose its stability and a bifurcation will occur Figure 5
shows the susceptible infected and recovered hosts when120591 gt 1205910 In this firgure we can clearly see that the number of
infectious hosts will outburst after a short period of peaceand repeat again and again but not in the same period
In order to see the influence of time delay 120591 is set to adifferent value each time with other parameters remainingthe same Figure 6 shows the number of infected hosts in the
8 Journal of Applied Mathematics
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 5
t (s)
(a)
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 15
t (s)
(b)
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 45
t (s)
(c)
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 90
t (s)
(d)
Figure 7 The number of 119868(119905) when 120591 is changed
same coordinate with time delays 120591 = 5 120591 = 15 120591 = 45 and120591 = 90 respectively
Figure 7 gives the four curves in four coordinates In thesetwo figures the impact of time delay on infected hosts isevident Initially the four curves are overlapped whichmeansthat time delay has little effect in the initial stage of wormpropagationWith the increase of time delay the curve beginsto oscillate When time delay passes through the threshold1205910 the infecting process gets unstable Then simultaneously
it can be discovered that the amplitude and period of thenumber of infected hosts get increased
Figure 8(a) shows the projection of the phase portrait ofsystem (5) when 120591 = 15 lt 120591
0in (119878 119868 119881)-space The curve
converges to a fixed point which suggests that the system isstable Figure 8(b) shows the projection of the phase portraitof system (5) when 120591 = 25 gt 120591
0in (119878 119868 119881)-space The curve
converges to a limit circle which implies that the system isunstable Figures 8(c) and 8(d) show the phase portraits ofsusceptible 119878(119905) and infected 119868(119905) as 120591 = 15 lt 120591
0and 120591 = 25 gt
1205910 respectively
42 Simulation Experiments The discrete-time simulation isan expanded version of Zoursquos program simulating Code Redworm propagation and has been modified to run on a Linuxserver The system in our simulation experiment consistsof 500000 hosts that can reach each other directly which
is consistent with the numerical experiments and there isno topology issue in our simulation At the beginning ofsimulation 50 hosts are randomly chosen to be infectious andthe others are all susceptible
Identical with the results of numerical experimentsFigure 9 shows all five kinds of hosts when 120591 = 5 lt 120591
0 We
find that themodel will reach a stable state after a short periodof time which suggests that the number of infetious hosts canbe predicted and we can develop further strategy to eliminateworms
When time delay increases but is less than the thresholdderived from theoretical analysis the number of infectioushosts and other hosts present a damped oscillation and finallyreach an approximately stable state Figure 10 shows the num-ber of five kinds of hosts when 120591 = 15 lt 120591
0 An interesting
result is that the number of each host maintain a slightrandom vibration However the overall amplitude is only0273 to the population size and themaximumamplitude isonly 0953 to the population size The reason why this phe-nomenon occurs is due to the random events in simulationexperiments The implement of transition rates of the modelis based on probability That is to say when the removal rateof infectious hosts is set to 003 it means that the probabilityof transition from infectious hosts to vaccinated state is 3 italso means that infectious hosts get patched with probabilityof 3 To investigate this phenomenon phase portrait of
Journal of Applied Mathematics 9
0
1
2
3
4
5
0
005
115
2
I(t)
times104
times10 5
times105
S(t)
2
4V(t)
120591 = 15
(a) The projection of the phase portrait in (119878 119868 119877)-space when 120591 lt 1205910
0
1
2
3
4
5
0
005
115
2
I(t)
times104
times10 5
times105
S(t)
2
4V(t)
120591 = 25
(b) The projection of the phase portrait in (119878 119868 119877)-space when 120591 gt 1205910
5
4
3
2
1
00 02 04 06 08 1 12 14 16 18 2
I(t)
S(t)
times105
times105
120591 = 15
(c) The phase portrait of susceptible 119878(119905) and infected 119868(119905) when 120591 lt 1205910
5
4
3
2
1
00 02 04 06 08 1 12 14 16 18 2
I(t)
S(t)
times105
times105
120591 = 25
(d) The phase portrait of susceptible 119878(119905) and infected 119868(119905) when 120591 gt 1205910
Figure 8 The phase portrait when 120591 lt 1205910and 120591 gt 120591
0
S(t)
I(t)
D(t)
Q(t)
V(t)
5
45
4
35
3
25
2
15
1
05
00 50 100 150 200 250 300 350 400 450 500
times105
Num
ber o
f hos
ts
t (s)
Figure 9 Simulation result of the five kinds of hosts when 120591 lt 1205910
susceptible 119878(119905) and infected 119868(119905) is depictedwhen 120591 = 15 lt 1205910
as shown Figure 11 It shows that the curve is converged to afixed point which means that the system gets stable
When time delay passes the threshold a bifurcationappears Figure 12 shows the number of susceptible infectiousand vaccinated hosts when 120591 gt 120591
0 Figure 13 shows the differ-
ence between simulation and numerical results of susceptibleand infectious hosts respectively In this figure the periods
S(t)
I(t)
D(t)
Q(t)
V(t)
5
45
4
35
3
25
2
15
1
05
00 500
times105
Num
ber o
f hos
ts
1000 1500 2000 2500 3000 3500
t (s)
Figure 10 Simulation result of the five kinds of hosts when 120591 = 15
of these two curves are well matched which suggests thatthe results of numerical and simulation experiments areidentical But there is a difference of 96 of total populationsize in amplitudes This mainly results from the precision ofexperiments The number of hosts in numerical experimentscan be either integers or decimals because it is the solution ofdifferential equations However in simulation experimentsthe number of hosts must be integers Furthermore when the
10 Journal of Applied Mathematics
5
45
4
35
3
25
2
15
1
05
0
times105
I(t)
S(t)
times1040 2 4 6 8 10 12 14 16 18
120591 = 15
Figure 11 The phase portrait of susceptible 119878(119905) and infected 119868(119905)
when 120591 = 15
S(t)
I(t)
V(t)
5
45
4
35
3
25
2
15
1
05
00 500
times105
Num
ber o
f hos
ts
1000 1500 2000 2500 3000
t (s)
Figure 12 Simulation result of the three kinds of hosts when 120591 gt 1205910
number of infectious hosts are very little this tiny differencewill result in a big gap afterwards
5 Conclusions
In order to accord with actual facts in the real world timedelay generated by time window in IDS is introduced toconstruct the worm propagation model Dynamic birth anddeath rates are considered in this paper accounting for thereinstallation of OS which users are more likely to do afterwhen the hosts suffer wormrsquos destruction or quarantined tothe Internet In addition combined with birth and deathrates time delay may lead to bifurcation and make the wormpropagation system unstable
In this paper a delayed worm propagation model withbirth and death rates is studied Next the stability of thepositive equilibrium is analyzedThrough theoretical analysisand numerical and simulation experiments the followingconclusions can be derived
(i) The introduction of time window in IDS may lead totime delay in worm propagationmodel which resultsin bifurcation The critical time delay 120591
0where the
bifurcation appears is obtained
S(t)
5
45
4
35
3
25
2
15
1
05
00 500
times105
1000 1500 2000 2500 3000
S(t) in numerical experimentS(t) in simulation experiment
t (s)
(a) The comparison of the number of susceptible hosts
I(t)
25
2
15
1
05
00 500
times105
1000 1500 2000 2500 30000 500 1000 1500 2000 2500 300
I(t) in numerical experimentI(t) in simulation experiment
t (s)
(b) The comparison of the number of infectious hosts
Figure 13 The comparison of numerical and simulation experi-ments
(ii) The worm propagation system is stable when timedelay 120591 lt 120591
0 In this situation the worm propagation
can be easily predicted and eliminated(iii) A bifurcation emerges when time delay 120591 ge 120591
0 which
means the worm propagation is unstable and may beout of control
Consequently time delay 120591 should remain less than 1205910
by decreasing the time window in IDS which is helpful topredict the worm propagation and even eliminate the worm
In this paper we have only discussed the cases whichsatisfy conditions (119867
1) (1198672) and (119867
3) But for cases that
satisfy (1198671) (1198672) and (119867
3) the dynamical behavior of this
model has not been studied These issues will be studied anddiscussed in our future work
Acknowledgments
The authors are very grateful to the anonymous referee formany valuable comments and suggestions which led to asignificant improvement of the original paper This paper
Journal of Applied Mathematics 11
is supported by the National Natural Science Foundationof China under Grant no 60803132 the Natural ScienceFoundation of Liaoning Province of China under Grant no201202059 Program for Liaoning Excellent Talents in Uni-versity under LR2013011 the Fundamental Research Funds ofthe Central Universities under Grant nos N120504006 andN100704001 and MOE-Intel Special Fund of InformationTechnology (MOE-INTEL-2012-06)
References
[1] N Yoshida and T Hara ldquoGlobal stability of a delayed SIR epide-mic model with density dependent birth and death ratesrdquo Jour-nal of Computational and Applied Mathematics vol 201 no 2pp 339ndash347 2007
[2] M Song W Ma and Y Takeuchi ldquoPermanence of a delayedSIR epidemic model with density dependent birth raterdquo Journalof Computational and Applied Mathematics vol 201 no 2 pp389ndash394 2007
[3] J Liu and T Zhang ldquoBifurcation analysis of an SIS epidemicmodel with nonlinear birth raterdquo Chaos Solitons and Fractalsvol 40 no 3 pp 1091ndash1099 2009
[4] V Yegneswaran P Barford and D Plonka ldquoOn the design anduse of internet sinks for network abuse monitoringrdquo ComputerScience vol 3224 pp 146ndash165 2004
[5] D Yeung and Y Ding ldquoHost-based intrusion detection usingdynamic and static behavioralmodelsrdquo Pattern Recognition vol36 no 1 pp 229ndash243 2003
[6] N Stakhanova S Basu and JWong ldquoOn the symbiosis of speci-fication-based and anomaly-based detectionrdquo Computers andSecurity vol 29 no 2 pp 253ndash268 2010
[7] G P Spathoulas and S K Katsikas ldquoReducing false positives inintrusion detection systemsrdquo Computers and Security vol 29no 1 pp 35ndash44 2010
[8] C Lin B Liu H Hu F Xiao and J Zhang ldquoDetecting hid-den Malware method based on ldquoIn-VMrdquo modelrdquo China Com-munications vol 8 no 4 pp 99ndash108 2011
[9] S Staniford V Paxson and N Weaver ldquoHow to own theinternet in your spare timerdquo in Proceedings of the 11th USENIXSecurity Symposium pp 149ndash167 San Francisco Calif USA2002
[10] S Qing and W Wen ldquoA survey and trends on Internet wormsrdquoComputers and Security vol 24 no 4 pp 334ndash346 2005
[11] C C ZouW Gong and D Towsley ldquoWorm propagation mod-eling and analysis under dynamic quarantine defenserdquo in Pro-ceedings of the 2003 ACMWorkshop on Rapid Malcode (WORMrsquo03) pp 51ndash60 Washington DC USA October 2003
[12] J Ren X Yang Q Zhu L Yang and C Zhang ldquoA novel com-puter virus model and its dynamicsrdquo Nonlinear Analysis RealWorld Applications vol 13 no 1 pp 376ndash384 2012
[13] B K Mishra and S K Pandey ldquoFuzzy epidemic model for thetransmission of worms in computer networkrdquo Nonlinear Ana-lysis Real World Applications vol 11 no 5 pp 4335ndash4341 2010
[14] L-X Yang and X Yang ldquoPropagation behavior of virus codesin the situation that infected computers are connected to theinternet with positive probabilityrdquo Discrete Dynamics in Natureand Society vol 2012 Article ID 693695 13 pages 2012
[15] Y Yao X Xie H Guo G Yu F Gao and X Tong ldquoHopf bifur-cation in an Internet worm propagation model with time delayin quarantinerdquoMathematical and Computer Modelling 2011
[16] Y Yao W Xiang A Qu G Yu and F Gao ldquoHopf bifurcationin an SEIDQV worm propagation model with quarantine stra-tegyrdquoDiscrete Dynamics in Nature and Society vol 2012 ArticleID 304868 18 pages 2012
[17] Y Yao L Guo H Guo G Yu F Gao and X Tong ldquoPulsequarantine strategy of internet worm propagation modelingand analysisrdquo Computers and Electrical Engineering 2011
[18] F Wang Y Zhang C Wang J Ma and S Moon ldquoStability ana-lysis of a SEIQV epidemic model for rapid spreading wormsrdquoComputers and Security vol 29 no 4 pp 410ndash418 2010
[19] T Dong X Liao and H Li ldquoStability and Hopf bifurcation ina computer virus model with multistate antivirusrdquo Abstract andApplied Analysis vol 2012 Article ID 841987 16 pages 2012
[20] T Zhang J Liu and Z Teng ldquoStability of Hopf bifurcation of adelayed SIRS epidemic model with stage structurerdquo NonlinearAnalysis Real World Applications vol 11 no 1 pp 293ndash3062010
[21] J Zhang W Li and X Yan ldquoHopf bifurcation and stabilityof periodic solutions in a delayed eco-epidemiological systemrdquoApplied Mathematics and Computation vol 198 no 2 pp 865ndash876 2008
[22] W Kermack and A McKendrick ldquoA contribution to the mathe-matical theory of epidemicsrdquo Proceedings of the Royal Society ofLondon A vol 115 no 772 pp 700ndash721 1927
[23] S Wang Q Liu X Yu and Y Ma ldquoBifurcation analysis of amodel for network worm propagation with time delayrdquoMathe-matical and Computer Modelling vol 52 no 3-4 pp 435ndash4472010
[24] B Hassard D Kazarino and Y WanTheory and Application ofHopf Bifurcation Cambridge University Press Cambridge UK1981
Submit your manuscripts athttpwwwhindawicom
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Mathematical Problems in Engineering
Hindawi Publishing Corporationhttpwwwhindawicom
Differential EquationsInternational Journal of
Volume 2014
Applied MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Mathematical PhysicsAdvances in
Complex AnalysisJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
OptimizationJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
International Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Operations ResearchAdvances in
Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Function Spaces
Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
International Journal of Mathematics and Mathematical Sciences
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Algebra
Discrete Dynamics in Nature and Society
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Decision SciencesAdvances in
Discrete MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom
Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Stochastic AnalysisInternational Journal of
6 Journal of Applied Mathematics
From the two equations of (21) the following equationcan be obtained
1198882
11205962+ (1198882
21205962minus 1198880)
2
= (1205964minus 11988721205962+ 1198870)
2
+ (1198871120596 minus 11988731205963)
2
(22)
which implies that
1205968+ 11989831205966+ 11989821205964+ 11989811205962+ 1198980= 0 (23)
where
1198983= 1198872
3minus 21198872
1198982= 1198872
2+ 21198870minus 211988711198873minus 1198882
2
1198981= 1198872
1minus 1198882
1minus 211988721198870+ 211988801198882
1198980= 1198872
0minus 1198882
0
(24)
Then (23) reduces to
1205966+ 11989831205964+ 11989821205962+ 1198981= 0 (25)
Let 119911 = 1205962Then (25) can be written as
ℎ (119911) = 1199113+ 11989831199112+ 1198982119911 + 119898
1 (26)
Δ is defined as Δ = 1198982
3minus 31198982 And we can get a solution
119911lowast= (radicΔ minus 119898
3)3 of h(z)
Lemma 3 Suppose that (1198672) 1198873gt 0 119889
1gt 0 119887
1+ 1198881gt 0 is
satisfied
(i) If one of followings holds (a) Δ gt 0 119911lowast lt 0 (b) Δ gt
0 119911lowast gt 0 and ℎ(119911lowast) gt 0 then all roots of (14) havenegative real parts when 120591 isin [0 120591
0) and 120591
0is a certain
positive constant(ii) If the conditions (a) and (b) are not satisfied then all
roots of (14) have negative real parts for all 120591 ge 0
Proof When 120591 = 0 equation (14) can be reduced to
1205823+ 11988731205822+ (1198872+ 1198882) 120582 + (119887
1+ 1198881) = 0 (27)
By the Routh-Hurwitz criterion all roots of (20) havenegative real parts if and only if 119887
3gt 0 119889
1gt 0 and 119887
1+1198881gt 0
Considering (26) it is easy to see from the characters ofcubic algebra equation that ℎ(119911) is a strictly monotonicallyincreasing function if Δ le 0 If Δ gt 0 and 119911lowast lt 0 or Δ gt 0119911lowastgt 0 but ℎ(119911lowast) gt 0 then ℎ(119911) has no positive root Thus
under these conditions equation (14) has no purely imag-inary roots for any 120591 gt 0 In addition this also implies thatthe positive equilibrium 119864
lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) of system (5)
is absolutely stable Therefore the following theorem on thestability of positive equilibrium 119864
lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) can
be easily obtained
Theorem 4 Assume that (1198671) and (119867
2) are satisfied and Δ gt
0 and 119911lowast lt 0 orΔ gt 0 119911lowast gt 0 and ℎ(119911lowast) gt 0Then the positive
equilibrium 119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) of system (5) is absolutely
stable that is to say 119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) is asymptoticallystable for any time delay 120591 ge 0
It is assumed that the coefficients in ℎ(119911) satisfy thecondition as follows
(1198673) Δ gt 0 119911
lowastgt 0 ℎ(119911
lowast) lt 0
Then according to lemma in [15] it is known that (26) hasat least a positive root 120596
0 namely the characteristic equation
(14) has a pair of purely imaginary roots plusmn1198941205960
In view of the fact that (14) has a pair of purely imaginaryroots plusmn119894120596
0 the corresponding 120591
119896gt 0 is given by eliminating
sin(120596120591) in (21)
120591119896=
1
1205960
arccos[(11988721205962
0minus 1205964
0minus 1198870) (1198880minus 11988821205962
0)
(1198880minus 11988821205962
0)2+ 120596 (119887
31205962minus 1198871minus 1198881)
]
+
2119896120587
1205960
(119896 = 0 1 2 )
(28)
Let 120582(120591) = V(120591) + 119894120596(120591) be the root of (14) so that V(120591119896) = 0
and 120596(120591119896) = 1205960are satisfied when 120591 = 120591
119896
Lemma 5 Suppose that ℎ1015840(1199110) = 0 If 120591 = 120591
0 then plusmn119894120596
0is a
pair of simple purely imaginary roots of (14) In addition if theconditions in Lemma 3 are satisfied then
119889 (Re 120582)119889120591
10038161003816100381610038161003816100381610038161003816120591=120591119896
gt 0 (29)
This signifies that there exists at least one eigenvalue withpositive real part for 120591 gt 120591
119896 Differentiating both sides of (14)
with respect to 120591 it can be written as
(
119889120582
119889120591
)
minus1
= ((41205823+ 311988731205822+ 21198872120582 + 1198871)
+1198881119890minus120582120591
minus (1198881120582 + 1198880) 120591119890minus120582120591
)
times ((1198881120582 + 1198880) 120582119890minus120582120591
)
minus1
(30)
Therefore
sgn119889Re 120582119889120591
120591=120591119896
= sgnRe(119889120582119889120591
)
minus1
120582=1198941205960
= sgn1205962
0
Λ
(41205966
0+ 311989831205964
0
+211989821205962
0+ 1198981)
= sgn1205962
0
Λ
ℎ1015840(1205962
0) = sgn ℎ1015840 (1205962
0)
(31)
where Λ = 1198882
11205964
0+ 11988801205962
0 Then it can be derived that
119889 (Re 120582)119889120591
10038161003816100381610038161003816100381610038161003816120591=120591119896
gt 0 (32)
Journal of Applied Mathematics 7
times105
5
45
4
35
3
25
2
15
1
05
028024020016012080400
Tota
l num
ber o
f hos
ts
S(t)
I(t)
D(t)
Q(t)
R(t)
t (s)
Figure 4 Worm propagation trend of the model when 120591 lt 1205910
It follows the hypothesis (1198673) that ℎ1015840(1205962
0) = 0 Therefore
transversality condition holds and the conditions for Hopfbifurcation are satisfied when 120591 = 120591
119896 according to Hopf
bifurcation theorem [24] for functional differential equationsThen the following results can be obtained
Theorem 6 Suppose that the conditions (1198671) and (119867
2) are
satisfied
(i) For system (5) the equilibrium 119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast)
is locally asymptotically stable when 120591 isin [0 1205910) but
unstable when 120591 gt 1205910
(ii) When condition (1198673) is satisfied system (5) will
undergo a Hopf bifurcation at the positive equilibrium119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) when 120591 = 120591
119896(119896 = 0 1 2 )
where 120591119896is defined by (28)
Theorem 2 implies to us that when birth and death ratesand the mechanism of time window in intrusion detectionsystem are considered the length of time window is crucialfor the stability of the propagation process When time delayis less than the threshold 120591
0 the system will stabilize at
its infection equilibrium point which is beneficial to fur-ther implement containment strategies to eliminate wormsHowever when time delay is greater than the threshold thesystem will be unstable and undergo a bifurcation Althoughthe propagation of worm presents a periodical phenome-non in real world complicated environment may make thepropagation pass the critical state and reach to an unpre-dictable chaos
4 Numerical and Simulation Experiments
41 Numerical Experiments The parameters of the delayedmodelwill be chosen properly according to the stability of thepositive equilibrium bifurcation analysis and the practicalenvironment 500000 hosts are picked as the population sizeand the wormrsquos average scan rate is 120578 = 4000 per secondThe worm infection rate can be calculated as 120576 = 1205781198732
32=
04657 [11] which means that average 04657 hosts of all the
times105
Tota
l num
ber o
f hos
ts
S(t)
I(t)
R(t)
5
4
3
2
1
00 500 1000 1500 2000 2500 3000
t (s)
Figure 5 Worm propagation trend of the model when 120591 gt 1205910
25
2
15
1
05
00 100 200 300 400 500 600 700 800
times105
I(t)
t(s)
Figure 6 The number of 119868(119905) when 120591 is changed
hosts can be scanned by one host The infection ratio is 120573 =
120578232
= 00000053 The rest of the parameters are 120574 = 0031205830= 0026 120596 = 000001 120572 = 056 120593 = 00009 and
119901 = 099 Initially 119868(0) = 50 which means that there are50 infectious hosts while the rest of the hosts are susceptibleat the beginning
Figure 4 shows the curves of five kinds of hosts when120591 = 5 lt 120591
0 All of the five kinds of hosts get stable within
4 minutes which illustrates that 119864lowast is asymptotically stableIt implies that the number of infectious hosts maintain aconstant level and thus can be predicted Further strategiescan be developed and utilized to eliminate worms But whentime delay 120591 gets increased and then reach the threshold 120591
0
119864lowast will lose its stability and a bifurcation will occur Figure 5
shows the susceptible infected and recovered hosts when120591 gt 1205910 In this firgure we can clearly see that the number of
infectious hosts will outburst after a short period of peaceand repeat again and again but not in the same period
In order to see the influence of time delay 120591 is set to adifferent value each time with other parameters remainingthe same Figure 6 shows the number of infected hosts in the
8 Journal of Applied Mathematics
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 5
t (s)
(a)
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 15
t (s)
(b)
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 45
t (s)
(c)
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 90
t (s)
(d)
Figure 7 The number of 119868(119905) when 120591 is changed
same coordinate with time delays 120591 = 5 120591 = 15 120591 = 45 and120591 = 90 respectively
Figure 7 gives the four curves in four coordinates In thesetwo figures the impact of time delay on infected hosts isevident Initially the four curves are overlapped whichmeansthat time delay has little effect in the initial stage of wormpropagationWith the increase of time delay the curve beginsto oscillate When time delay passes through the threshold1205910 the infecting process gets unstable Then simultaneously
it can be discovered that the amplitude and period of thenumber of infected hosts get increased
Figure 8(a) shows the projection of the phase portrait ofsystem (5) when 120591 = 15 lt 120591
0in (119878 119868 119881)-space The curve
converges to a fixed point which suggests that the system isstable Figure 8(b) shows the projection of the phase portraitof system (5) when 120591 = 25 gt 120591
0in (119878 119868 119881)-space The curve
converges to a limit circle which implies that the system isunstable Figures 8(c) and 8(d) show the phase portraits ofsusceptible 119878(119905) and infected 119868(119905) as 120591 = 15 lt 120591
0and 120591 = 25 gt
1205910 respectively
42 Simulation Experiments The discrete-time simulation isan expanded version of Zoursquos program simulating Code Redworm propagation and has been modified to run on a Linuxserver The system in our simulation experiment consistsof 500000 hosts that can reach each other directly which
is consistent with the numerical experiments and there isno topology issue in our simulation At the beginning ofsimulation 50 hosts are randomly chosen to be infectious andthe others are all susceptible
Identical with the results of numerical experimentsFigure 9 shows all five kinds of hosts when 120591 = 5 lt 120591
0 We
find that themodel will reach a stable state after a short periodof time which suggests that the number of infetious hosts canbe predicted and we can develop further strategy to eliminateworms
When time delay increases but is less than the thresholdderived from theoretical analysis the number of infectioushosts and other hosts present a damped oscillation and finallyreach an approximately stable state Figure 10 shows the num-ber of five kinds of hosts when 120591 = 15 lt 120591
0 An interesting
result is that the number of each host maintain a slightrandom vibration However the overall amplitude is only0273 to the population size and themaximumamplitude isonly 0953 to the population size The reason why this phe-nomenon occurs is due to the random events in simulationexperiments The implement of transition rates of the modelis based on probability That is to say when the removal rateof infectious hosts is set to 003 it means that the probabilityof transition from infectious hosts to vaccinated state is 3 italso means that infectious hosts get patched with probabilityof 3 To investigate this phenomenon phase portrait of
Journal of Applied Mathematics 9
0
1
2
3
4
5
0
005
115
2
I(t)
times104
times10 5
times105
S(t)
2
4V(t)
120591 = 15
(a) The projection of the phase portrait in (119878 119868 119877)-space when 120591 lt 1205910
0
1
2
3
4
5
0
005
115
2
I(t)
times104
times10 5
times105
S(t)
2
4V(t)
120591 = 25
(b) The projection of the phase portrait in (119878 119868 119877)-space when 120591 gt 1205910
5
4
3
2
1
00 02 04 06 08 1 12 14 16 18 2
I(t)
S(t)
times105
times105
120591 = 15
(c) The phase portrait of susceptible 119878(119905) and infected 119868(119905) when 120591 lt 1205910
5
4
3
2
1
00 02 04 06 08 1 12 14 16 18 2
I(t)
S(t)
times105
times105
120591 = 25
(d) The phase portrait of susceptible 119878(119905) and infected 119868(119905) when 120591 gt 1205910
Figure 8 The phase portrait when 120591 lt 1205910and 120591 gt 120591
0
S(t)
I(t)
D(t)
Q(t)
V(t)
5
45
4
35
3
25
2
15
1
05
00 50 100 150 200 250 300 350 400 450 500
times105
Num
ber o
f hos
ts
t (s)
Figure 9 Simulation result of the five kinds of hosts when 120591 lt 1205910
susceptible 119878(119905) and infected 119868(119905) is depictedwhen 120591 = 15 lt 1205910
as shown Figure 11 It shows that the curve is converged to afixed point which means that the system gets stable
When time delay passes the threshold a bifurcationappears Figure 12 shows the number of susceptible infectiousand vaccinated hosts when 120591 gt 120591
0 Figure 13 shows the differ-
ence between simulation and numerical results of susceptibleand infectious hosts respectively In this figure the periods
S(t)
I(t)
D(t)
Q(t)
V(t)
5
45
4
35
3
25
2
15
1
05
00 500
times105
Num
ber o
f hos
ts
1000 1500 2000 2500 3000 3500
t (s)
Figure 10 Simulation result of the five kinds of hosts when 120591 = 15
of these two curves are well matched which suggests thatthe results of numerical and simulation experiments areidentical But there is a difference of 96 of total populationsize in amplitudes This mainly results from the precision ofexperiments The number of hosts in numerical experimentscan be either integers or decimals because it is the solution ofdifferential equations However in simulation experimentsthe number of hosts must be integers Furthermore when the
10 Journal of Applied Mathematics
5
45
4
35
3
25
2
15
1
05
0
times105
I(t)
S(t)
times1040 2 4 6 8 10 12 14 16 18
120591 = 15
Figure 11 The phase portrait of susceptible 119878(119905) and infected 119868(119905)
when 120591 = 15
S(t)
I(t)
V(t)
5
45
4
35
3
25
2
15
1
05
00 500
times105
Num
ber o
f hos
ts
1000 1500 2000 2500 3000
t (s)
Figure 12 Simulation result of the three kinds of hosts when 120591 gt 1205910
number of infectious hosts are very little this tiny differencewill result in a big gap afterwards
5 Conclusions
In order to accord with actual facts in the real world timedelay generated by time window in IDS is introduced toconstruct the worm propagation model Dynamic birth anddeath rates are considered in this paper accounting for thereinstallation of OS which users are more likely to do afterwhen the hosts suffer wormrsquos destruction or quarantined tothe Internet In addition combined with birth and deathrates time delay may lead to bifurcation and make the wormpropagation system unstable
In this paper a delayed worm propagation model withbirth and death rates is studied Next the stability of thepositive equilibrium is analyzedThrough theoretical analysisand numerical and simulation experiments the followingconclusions can be derived
(i) The introduction of time window in IDS may lead totime delay in worm propagationmodel which resultsin bifurcation The critical time delay 120591
0where the
bifurcation appears is obtained
S(t)
5
45
4
35
3
25
2
15
1
05
00 500
times105
1000 1500 2000 2500 3000
S(t) in numerical experimentS(t) in simulation experiment
t (s)
(a) The comparison of the number of susceptible hosts
I(t)
25
2
15
1
05
00 500
times105
1000 1500 2000 2500 30000 500 1000 1500 2000 2500 300
I(t) in numerical experimentI(t) in simulation experiment
t (s)
(b) The comparison of the number of infectious hosts
Figure 13 The comparison of numerical and simulation experi-ments
(ii) The worm propagation system is stable when timedelay 120591 lt 120591
0 In this situation the worm propagation
can be easily predicted and eliminated(iii) A bifurcation emerges when time delay 120591 ge 120591
0 which
means the worm propagation is unstable and may beout of control
Consequently time delay 120591 should remain less than 1205910
by decreasing the time window in IDS which is helpful topredict the worm propagation and even eliminate the worm
In this paper we have only discussed the cases whichsatisfy conditions (119867
1) (1198672) and (119867
3) But for cases that
satisfy (1198671) (1198672) and (119867
3) the dynamical behavior of this
model has not been studied These issues will be studied anddiscussed in our future work
Acknowledgments
The authors are very grateful to the anonymous referee formany valuable comments and suggestions which led to asignificant improvement of the original paper This paper
Journal of Applied Mathematics 11
is supported by the National Natural Science Foundationof China under Grant no 60803132 the Natural ScienceFoundation of Liaoning Province of China under Grant no201202059 Program for Liaoning Excellent Talents in Uni-versity under LR2013011 the Fundamental Research Funds ofthe Central Universities under Grant nos N120504006 andN100704001 and MOE-Intel Special Fund of InformationTechnology (MOE-INTEL-2012-06)
References
[1] N Yoshida and T Hara ldquoGlobal stability of a delayed SIR epide-mic model with density dependent birth and death ratesrdquo Jour-nal of Computational and Applied Mathematics vol 201 no 2pp 339ndash347 2007
[2] M Song W Ma and Y Takeuchi ldquoPermanence of a delayedSIR epidemic model with density dependent birth raterdquo Journalof Computational and Applied Mathematics vol 201 no 2 pp389ndash394 2007
[3] J Liu and T Zhang ldquoBifurcation analysis of an SIS epidemicmodel with nonlinear birth raterdquo Chaos Solitons and Fractalsvol 40 no 3 pp 1091ndash1099 2009
[4] V Yegneswaran P Barford and D Plonka ldquoOn the design anduse of internet sinks for network abuse monitoringrdquo ComputerScience vol 3224 pp 146ndash165 2004
[5] D Yeung and Y Ding ldquoHost-based intrusion detection usingdynamic and static behavioralmodelsrdquo Pattern Recognition vol36 no 1 pp 229ndash243 2003
[6] N Stakhanova S Basu and JWong ldquoOn the symbiosis of speci-fication-based and anomaly-based detectionrdquo Computers andSecurity vol 29 no 2 pp 253ndash268 2010
[7] G P Spathoulas and S K Katsikas ldquoReducing false positives inintrusion detection systemsrdquo Computers and Security vol 29no 1 pp 35ndash44 2010
[8] C Lin B Liu H Hu F Xiao and J Zhang ldquoDetecting hid-den Malware method based on ldquoIn-VMrdquo modelrdquo China Com-munications vol 8 no 4 pp 99ndash108 2011
[9] S Staniford V Paxson and N Weaver ldquoHow to own theinternet in your spare timerdquo in Proceedings of the 11th USENIXSecurity Symposium pp 149ndash167 San Francisco Calif USA2002
[10] S Qing and W Wen ldquoA survey and trends on Internet wormsrdquoComputers and Security vol 24 no 4 pp 334ndash346 2005
[11] C C ZouW Gong and D Towsley ldquoWorm propagation mod-eling and analysis under dynamic quarantine defenserdquo in Pro-ceedings of the 2003 ACMWorkshop on Rapid Malcode (WORMrsquo03) pp 51ndash60 Washington DC USA October 2003
[12] J Ren X Yang Q Zhu L Yang and C Zhang ldquoA novel com-puter virus model and its dynamicsrdquo Nonlinear Analysis RealWorld Applications vol 13 no 1 pp 376ndash384 2012
[13] B K Mishra and S K Pandey ldquoFuzzy epidemic model for thetransmission of worms in computer networkrdquo Nonlinear Ana-lysis Real World Applications vol 11 no 5 pp 4335ndash4341 2010
[14] L-X Yang and X Yang ldquoPropagation behavior of virus codesin the situation that infected computers are connected to theinternet with positive probabilityrdquo Discrete Dynamics in Natureand Society vol 2012 Article ID 693695 13 pages 2012
[15] Y Yao X Xie H Guo G Yu F Gao and X Tong ldquoHopf bifur-cation in an Internet worm propagation model with time delayin quarantinerdquoMathematical and Computer Modelling 2011
[16] Y Yao W Xiang A Qu G Yu and F Gao ldquoHopf bifurcationin an SEIDQV worm propagation model with quarantine stra-tegyrdquoDiscrete Dynamics in Nature and Society vol 2012 ArticleID 304868 18 pages 2012
[17] Y Yao L Guo H Guo G Yu F Gao and X Tong ldquoPulsequarantine strategy of internet worm propagation modelingand analysisrdquo Computers and Electrical Engineering 2011
[18] F Wang Y Zhang C Wang J Ma and S Moon ldquoStability ana-lysis of a SEIQV epidemic model for rapid spreading wormsrdquoComputers and Security vol 29 no 4 pp 410ndash418 2010
[19] T Dong X Liao and H Li ldquoStability and Hopf bifurcation ina computer virus model with multistate antivirusrdquo Abstract andApplied Analysis vol 2012 Article ID 841987 16 pages 2012
[20] T Zhang J Liu and Z Teng ldquoStability of Hopf bifurcation of adelayed SIRS epidemic model with stage structurerdquo NonlinearAnalysis Real World Applications vol 11 no 1 pp 293ndash3062010
[21] J Zhang W Li and X Yan ldquoHopf bifurcation and stabilityof periodic solutions in a delayed eco-epidemiological systemrdquoApplied Mathematics and Computation vol 198 no 2 pp 865ndash876 2008
[22] W Kermack and A McKendrick ldquoA contribution to the mathe-matical theory of epidemicsrdquo Proceedings of the Royal Society ofLondon A vol 115 no 772 pp 700ndash721 1927
[23] S Wang Q Liu X Yu and Y Ma ldquoBifurcation analysis of amodel for network worm propagation with time delayrdquoMathe-matical and Computer Modelling vol 52 no 3-4 pp 435ndash4472010
[24] B Hassard D Kazarino and Y WanTheory and Application ofHopf Bifurcation Cambridge University Press Cambridge UK1981
Submit your manuscripts athttpwwwhindawicom
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Mathematical Problems in Engineering
Hindawi Publishing Corporationhttpwwwhindawicom
Differential EquationsInternational Journal of
Volume 2014
Applied MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Mathematical PhysicsAdvances in
Complex AnalysisJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
OptimizationJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
International Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Operations ResearchAdvances in
Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Function Spaces
Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
International Journal of Mathematics and Mathematical Sciences
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Algebra
Discrete Dynamics in Nature and Society
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Decision SciencesAdvances in
Discrete MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom
Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Stochastic AnalysisInternational Journal of
Journal of Applied Mathematics 7
times105
5
45
4
35
3
25
2
15
1
05
028024020016012080400
Tota
l num
ber o
f hos
ts
S(t)
I(t)
D(t)
Q(t)
R(t)
t (s)
Figure 4 Worm propagation trend of the model when 120591 lt 1205910
It follows the hypothesis (1198673) that ℎ1015840(1205962
0) = 0 Therefore
transversality condition holds and the conditions for Hopfbifurcation are satisfied when 120591 = 120591
119896 according to Hopf
bifurcation theorem [24] for functional differential equationsThen the following results can be obtained
Theorem 6 Suppose that the conditions (1198671) and (119867
2) are
satisfied
(i) For system (5) the equilibrium 119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast)
is locally asymptotically stable when 120591 isin [0 1205910) but
unstable when 120591 gt 1205910
(ii) When condition (1198673) is satisfied system (5) will
undergo a Hopf bifurcation at the positive equilibrium119864lowast(119878lowast 119868lowast 119863lowast 119876lowast 119881lowast) when 120591 = 120591
119896(119896 = 0 1 2 )
where 120591119896is defined by (28)
Theorem 2 implies to us that when birth and death ratesand the mechanism of time window in intrusion detectionsystem are considered the length of time window is crucialfor the stability of the propagation process When time delayis less than the threshold 120591
0 the system will stabilize at
its infection equilibrium point which is beneficial to fur-ther implement containment strategies to eliminate wormsHowever when time delay is greater than the threshold thesystem will be unstable and undergo a bifurcation Althoughthe propagation of worm presents a periodical phenome-non in real world complicated environment may make thepropagation pass the critical state and reach to an unpre-dictable chaos
4 Numerical and Simulation Experiments
41 Numerical Experiments The parameters of the delayedmodelwill be chosen properly according to the stability of thepositive equilibrium bifurcation analysis and the practicalenvironment 500000 hosts are picked as the population sizeand the wormrsquos average scan rate is 120578 = 4000 per secondThe worm infection rate can be calculated as 120576 = 1205781198732
32=
04657 [11] which means that average 04657 hosts of all the
times105
Tota
l num
ber o
f hos
ts
S(t)
I(t)
R(t)
5
4
3
2
1
00 500 1000 1500 2000 2500 3000
t (s)
Figure 5 Worm propagation trend of the model when 120591 gt 1205910
25
2
15
1
05
00 100 200 300 400 500 600 700 800
times105
I(t)
t(s)
Figure 6 The number of 119868(119905) when 120591 is changed
hosts can be scanned by one host The infection ratio is 120573 =
120578232
= 00000053 The rest of the parameters are 120574 = 0031205830= 0026 120596 = 000001 120572 = 056 120593 = 00009 and
119901 = 099 Initially 119868(0) = 50 which means that there are50 infectious hosts while the rest of the hosts are susceptibleat the beginning
Figure 4 shows the curves of five kinds of hosts when120591 = 5 lt 120591
0 All of the five kinds of hosts get stable within
4 minutes which illustrates that 119864lowast is asymptotically stableIt implies that the number of infectious hosts maintain aconstant level and thus can be predicted Further strategiescan be developed and utilized to eliminate worms But whentime delay 120591 gets increased and then reach the threshold 120591
0
119864lowast will lose its stability and a bifurcation will occur Figure 5
shows the susceptible infected and recovered hosts when120591 gt 1205910 In this firgure we can clearly see that the number of
infectious hosts will outburst after a short period of peaceand repeat again and again but not in the same period
In order to see the influence of time delay 120591 is set to adifferent value each time with other parameters remainingthe same Figure 6 shows the number of infected hosts in the
8 Journal of Applied Mathematics
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 5
t (s)
(a)
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 15
t (s)
(b)
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 45
t (s)
(c)
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 90
t (s)
(d)
Figure 7 The number of 119868(119905) when 120591 is changed
same coordinate with time delays 120591 = 5 120591 = 15 120591 = 45 and120591 = 90 respectively
Figure 7 gives the four curves in four coordinates In thesetwo figures the impact of time delay on infected hosts isevident Initially the four curves are overlapped whichmeansthat time delay has little effect in the initial stage of wormpropagationWith the increase of time delay the curve beginsto oscillate When time delay passes through the threshold1205910 the infecting process gets unstable Then simultaneously
it can be discovered that the amplitude and period of thenumber of infected hosts get increased
Figure 8(a) shows the projection of the phase portrait ofsystem (5) when 120591 = 15 lt 120591
0in (119878 119868 119881)-space The curve
converges to a fixed point which suggests that the system isstable Figure 8(b) shows the projection of the phase portraitof system (5) when 120591 = 25 gt 120591
0in (119878 119868 119881)-space The curve
converges to a limit circle which implies that the system isunstable Figures 8(c) and 8(d) show the phase portraits ofsusceptible 119878(119905) and infected 119868(119905) as 120591 = 15 lt 120591
0and 120591 = 25 gt
1205910 respectively
42 Simulation Experiments The discrete-time simulation isan expanded version of Zoursquos program simulating Code Redworm propagation and has been modified to run on a Linuxserver The system in our simulation experiment consistsof 500000 hosts that can reach each other directly which
is consistent with the numerical experiments and there isno topology issue in our simulation At the beginning ofsimulation 50 hosts are randomly chosen to be infectious andthe others are all susceptible
Identical with the results of numerical experimentsFigure 9 shows all five kinds of hosts when 120591 = 5 lt 120591
0 We
find that themodel will reach a stable state after a short periodof time which suggests that the number of infetious hosts canbe predicted and we can develop further strategy to eliminateworms
When time delay increases but is less than the thresholdderived from theoretical analysis the number of infectioushosts and other hosts present a damped oscillation and finallyreach an approximately stable state Figure 10 shows the num-ber of five kinds of hosts when 120591 = 15 lt 120591
0 An interesting
result is that the number of each host maintain a slightrandom vibration However the overall amplitude is only0273 to the population size and themaximumamplitude isonly 0953 to the population size The reason why this phe-nomenon occurs is due to the random events in simulationexperiments The implement of transition rates of the modelis based on probability That is to say when the removal rateof infectious hosts is set to 003 it means that the probabilityof transition from infectious hosts to vaccinated state is 3 italso means that infectious hosts get patched with probabilityof 3 To investigate this phenomenon phase portrait of
Journal of Applied Mathematics 9
0
1
2
3
4
5
0
005
115
2
I(t)
times104
times10 5
times105
S(t)
2
4V(t)
120591 = 15
(a) The projection of the phase portrait in (119878 119868 119877)-space when 120591 lt 1205910
0
1
2
3
4
5
0
005
115
2
I(t)
times104
times10 5
times105
S(t)
2
4V(t)
120591 = 25
(b) The projection of the phase portrait in (119878 119868 119877)-space when 120591 gt 1205910
5
4
3
2
1
00 02 04 06 08 1 12 14 16 18 2
I(t)
S(t)
times105
times105
120591 = 15
(c) The phase portrait of susceptible 119878(119905) and infected 119868(119905) when 120591 lt 1205910
5
4
3
2
1
00 02 04 06 08 1 12 14 16 18 2
I(t)
S(t)
times105
times105
120591 = 25
(d) The phase portrait of susceptible 119878(119905) and infected 119868(119905) when 120591 gt 1205910
Figure 8 The phase portrait when 120591 lt 1205910and 120591 gt 120591
0
S(t)
I(t)
D(t)
Q(t)
V(t)
5
45
4
35
3
25
2
15
1
05
00 50 100 150 200 250 300 350 400 450 500
times105
Num
ber o
f hos
ts
t (s)
Figure 9 Simulation result of the five kinds of hosts when 120591 lt 1205910
susceptible 119878(119905) and infected 119868(119905) is depictedwhen 120591 = 15 lt 1205910
as shown Figure 11 It shows that the curve is converged to afixed point which means that the system gets stable
When time delay passes the threshold a bifurcationappears Figure 12 shows the number of susceptible infectiousand vaccinated hosts when 120591 gt 120591
0 Figure 13 shows the differ-
ence between simulation and numerical results of susceptibleand infectious hosts respectively In this figure the periods
S(t)
I(t)
D(t)
Q(t)
V(t)
5
45
4
35
3
25
2
15
1
05
00 500
times105
Num
ber o
f hos
ts
1000 1500 2000 2500 3000 3500
t (s)
Figure 10 Simulation result of the five kinds of hosts when 120591 = 15
of these two curves are well matched which suggests thatthe results of numerical and simulation experiments areidentical But there is a difference of 96 of total populationsize in amplitudes This mainly results from the precision ofexperiments The number of hosts in numerical experimentscan be either integers or decimals because it is the solution ofdifferential equations However in simulation experimentsthe number of hosts must be integers Furthermore when the
10 Journal of Applied Mathematics
5
45
4
35
3
25
2
15
1
05
0
times105
I(t)
S(t)
times1040 2 4 6 8 10 12 14 16 18
120591 = 15
Figure 11 The phase portrait of susceptible 119878(119905) and infected 119868(119905)
when 120591 = 15
S(t)
I(t)
V(t)
5
45
4
35
3
25
2
15
1
05
00 500
times105
Num
ber o
f hos
ts
1000 1500 2000 2500 3000
t (s)
Figure 12 Simulation result of the three kinds of hosts when 120591 gt 1205910
number of infectious hosts are very little this tiny differencewill result in a big gap afterwards
5 Conclusions
In order to accord with actual facts in the real world timedelay generated by time window in IDS is introduced toconstruct the worm propagation model Dynamic birth anddeath rates are considered in this paper accounting for thereinstallation of OS which users are more likely to do afterwhen the hosts suffer wormrsquos destruction or quarantined tothe Internet In addition combined with birth and deathrates time delay may lead to bifurcation and make the wormpropagation system unstable
In this paper a delayed worm propagation model withbirth and death rates is studied Next the stability of thepositive equilibrium is analyzedThrough theoretical analysisand numerical and simulation experiments the followingconclusions can be derived
(i) The introduction of time window in IDS may lead totime delay in worm propagationmodel which resultsin bifurcation The critical time delay 120591
0where the
bifurcation appears is obtained
S(t)
5
45
4
35
3
25
2
15
1
05
00 500
times105
1000 1500 2000 2500 3000
S(t) in numerical experimentS(t) in simulation experiment
t (s)
(a) The comparison of the number of susceptible hosts
I(t)
25
2
15
1
05
00 500
times105
1000 1500 2000 2500 30000 500 1000 1500 2000 2500 300
I(t) in numerical experimentI(t) in simulation experiment
t (s)
(b) The comparison of the number of infectious hosts
Figure 13 The comparison of numerical and simulation experi-ments
(ii) The worm propagation system is stable when timedelay 120591 lt 120591
0 In this situation the worm propagation
can be easily predicted and eliminated(iii) A bifurcation emerges when time delay 120591 ge 120591
0 which
means the worm propagation is unstable and may beout of control
Consequently time delay 120591 should remain less than 1205910
by decreasing the time window in IDS which is helpful topredict the worm propagation and even eliminate the worm
In this paper we have only discussed the cases whichsatisfy conditions (119867
1) (1198672) and (119867
3) But for cases that
satisfy (1198671) (1198672) and (119867
3) the dynamical behavior of this
model has not been studied These issues will be studied anddiscussed in our future work
Acknowledgments
The authors are very grateful to the anonymous referee formany valuable comments and suggestions which led to asignificant improvement of the original paper This paper
Journal of Applied Mathematics 11
is supported by the National Natural Science Foundationof China under Grant no 60803132 the Natural ScienceFoundation of Liaoning Province of China under Grant no201202059 Program for Liaoning Excellent Talents in Uni-versity under LR2013011 the Fundamental Research Funds ofthe Central Universities under Grant nos N120504006 andN100704001 and MOE-Intel Special Fund of InformationTechnology (MOE-INTEL-2012-06)
References
[1] N Yoshida and T Hara ldquoGlobal stability of a delayed SIR epide-mic model with density dependent birth and death ratesrdquo Jour-nal of Computational and Applied Mathematics vol 201 no 2pp 339ndash347 2007
[2] M Song W Ma and Y Takeuchi ldquoPermanence of a delayedSIR epidemic model with density dependent birth raterdquo Journalof Computational and Applied Mathematics vol 201 no 2 pp389ndash394 2007
[3] J Liu and T Zhang ldquoBifurcation analysis of an SIS epidemicmodel with nonlinear birth raterdquo Chaos Solitons and Fractalsvol 40 no 3 pp 1091ndash1099 2009
[4] V Yegneswaran P Barford and D Plonka ldquoOn the design anduse of internet sinks for network abuse monitoringrdquo ComputerScience vol 3224 pp 146ndash165 2004
[5] D Yeung and Y Ding ldquoHost-based intrusion detection usingdynamic and static behavioralmodelsrdquo Pattern Recognition vol36 no 1 pp 229ndash243 2003
[6] N Stakhanova S Basu and JWong ldquoOn the symbiosis of speci-fication-based and anomaly-based detectionrdquo Computers andSecurity vol 29 no 2 pp 253ndash268 2010
[7] G P Spathoulas and S K Katsikas ldquoReducing false positives inintrusion detection systemsrdquo Computers and Security vol 29no 1 pp 35ndash44 2010
[8] C Lin B Liu H Hu F Xiao and J Zhang ldquoDetecting hid-den Malware method based on ldquoIn-VMrdquo modelrdquo China Com-munications vol 8 no 4 pp 99ndash108 2011
[9] S Staniford V Paxson and N Weaver ldquoHow to own theinternet in your spare timerdquo in Proceedings of the 11th USENIXSecurity Symposium pp 149ndash167 San Francisco Calif USA2002
[10] S Qing and W Wen ldquoA survey and trends on Internet wormsrdquoComputers and Security vol 24 no 4 pp 334ndash346 2005
[11] C C ZouW Gong and D Towsley ldquoWorm propagation mod-eling and analysis under dynamic quarantine defenserdquo in Pro-ceedings of the 2003 ACMWorkshop on Rapid Malcode (WORMrsquo03) pp 51ndash60 Washington DC USA October 2003
[12] J Ren X Yang Q Zhu L Yang and C Zhang ldquoA novel com-puter virus model and its dynamicsrdquo Nonlinear Analysis RealWorld Applications vol 13 no 1 pp 376ndash384 2012
[13] B K Mishra and S K Pandey ldquoFuzzy epidemic model for thetransmission of worms in computer networkrdquo Nonlinear Ana-lysis Real World Applications vol 11 no 5 pp 4335ndash4341 2010
[14] L-X Yang and X Yang ldquoPropagation behavior of virus codesin the situation that infected computers are connected to theinternet with positive probabilityrdquo Discrete Dynamics in Natureand Society vol 2012 Article ID 693695 13 pages 2012
[15] Y Yao X Xie H Guo G Yu F Gao and X Tong ldquoHopf bifur-cation in an Internet worm propagation model with time delayin quarantinerdquoMathematical and Computer Modelling 2011
[16] Y Yao W Xiang A Qu G Yu and F Gao ldquoHopf bifurcationin an SEIDQV worm propagation model with quarantine stra-tegyrdquoDiscrete Dynamics in Nature and Society vol 2012 ArticleID 304868 18 pages 2012
[17] Y Yao L Guo H Guo G Yu F Gao and X Tong ldquoPulsequarantine strategy of internet worm propagation modelingand analysisrdquo Computers and Electrical Engineering 2011
[18] F Wang Y Zhang C Wang J Ma and S Moon ldquoStability ana-lysis of a SEIQV epidemic model for rapid spreading wormsrdquoComputers and Security vol 29 no 4 pp 410ndash418 2010
[19] T Dong X Liao and H Li ldquoStability and Hopf bifurcation ina computer virus model with multistate antivirusrdquo Abstract andApplied Analysis vol 2012 Article ID 841987 16 pages 2012
[20] T Zhang J Liu and Z Teng ldquoStability of Hopf bifurcation of adelayed SIRS epidemic model with stage structurerdquo NonlinearAnalysis Real World Applications vol 11 no 1 pp 293ndash3062010
[21] J Zhang W Li and X Yan ldquoHopf bifurcation and stabilityof periodic solutions in a delayed eco-epidemiological systemrdquoApplied Mathematics and Computation vol 198 no 2 pp 865ndash876 2008
[22] W Kermack and A McKendrick ldquoA contribution to the mathe-matical theory of epidemicsrdquo Proceedings of the Royal Society ofLondon A vol 115 no 772 pp 700ndash721 1927
[23] S Wang Q Liu X Yu and Y Ma ldquoBifurcation analysis of amodel for network worm propagation with time delayrdquoMathe-matical and Computer Modelling vol 52 no 3-4 pp 435ndash4472010
[24] B Hassard D Kazarino and Y WanTheory and Application ofHopf Bifurcation Cambridge University Press Cambridge UK1981
Submit your manuscripts athttpwwwhindawicom
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Mathematical Problems in Engineering
Hindawi Publishing Corporationhttpwwwhindawicom
Differential EquationsInternational Journal of
Volume 2014
Applied MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Mathematical PhysicsAdvances in
Complex AnalysisJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
OptimizationJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
International Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Operations ResearchAdvances in
Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Function Spaces
Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
International Journal of Mathematics and Mathematical Sciences
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Algebra
Discrete Dynamics in Nature and Society
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Decision SciencesAdvances in
Discrete MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom
Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Stochastic AnalysisInternational Journal of
8 Journal of Applied Mathematics
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 5
t (s)
(a)
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 15
t (s)
(b)
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 45
t (s)
(c)
times105
0 500 1000 1500
25
2
15
1
05
0
I(t)
120591 = 90
t (s)
(d)
Figure 7 The number of 119868(119905) when 120591 is changed
same coordinate with time delays 120591 = 5 120591 = 15 120591 = 45 and120591 = 90 respectively
Figure 7 gives the four curves in four coordinates In thesetwo figures the impact of time delay on infected hosts isevident Initially the four curves are overlapped whichmeansthat time delay has little effect in the initial stage of wormpropagationWith the increase of time delay the curve beginsto oscillate When time delay passes through the threshold1205910 the infecting process gets unstable Then simultaneously
it can be discovered that the amplitude and period of thenumber of infected hosts get increased
Figure 8(a) shows the projection of the phase portrait ofsystem (5) when 120591 = 15 lt 120591
0in (119878 119868 119881)-space The curve
converges to a fixed point which suggests that the system isstable Figure 8(b) shows the projection of the phase portraitof system (5) when 120591 = 25 gt 120591
0in (119878 119868 119881)-space The curve
converges to a limit circle which implies that the system isunstable Figures 8(c) and 8(d) show the phase portraits ofsusceptible 119878(119905) and infected 119868(119905) as 120591 = 15 lt 120591
0and 120591 = 25 gt
1205910 respectively
42 Simulation Experiments The discrete-time simulation isan expanded version of Zoursquos program simulating Code Redworm propagation and has been modified to run on a Linuxserver The system in our simulation experiment consistsof 500000 hosts that can reach each other directly which
is consistent with the numerical experiments and there isno topology issue in our simulation At the beginning ofsimulation 50 hosts are randomly chosen to be infectious andthe others are all susceptible
Identical with the results of numerical experimentsFigure 9 shows all five kinds of hosts when 120591 = 5 lt 120591
0 We
find that themodel will reach a stable state after a short periodof time which suggests that the number of infetious hosts canbe predicted and we can develop further strategy to eliminateworms
When time delay increases but is less than the thresholdderived from theoretical analysis the number of infectioushosts and other hosts present a damped oscillation and finallyreach an approximately stable state Figure 10 shows the num-ber of five kinds of hosts when 120591 = 15 lt 120591
0 An interesting
result is that the number of each host maintain a slightrandom vibration However the overall amplitude is only0273 to the population size and themaximumamplitude isonly 0953 to the population size The reason why this phe-nomenon occurs is due to the random events in simulationexperiments The implement of transition rates of the modelis based on probability That is to say when the removal rateof infectious hosts is set to 003 it means that the probabilityof transition from infectious hosts to vaccinated state is 3 italso means that infectious hosts get patched with probabilityof 3 To investigate this phenomenon phase portrait of
Journal of Applied Mathematics 9
0
1
2
3
4
5
0
005
115
2
I(t)
times104
times10 5
times105
S(t)
2
4V(t)
120591 = 15
(a) The projection of the phase portrait in (119878 119868 119877)-space when 120591 lt 1205910
0
1
2
3
4
5
0
005
115
2
I(t)
times104
times10 5
times105
S(t)
2
4V(t)
120591 = 25
(b) The projection of the phase portrait in (119878 119868 119877)-space when 120591 gt 1205910
5
4
3
2
1
00 02 04 06 08 1 12 14 16 18 2
I(t)
S(t)
times105
times105
120591 = 15
(c) The phase portrait of susceptible 119878(119905) and infected 119868(119905) when 120591 lt 1205910
5
4
3
2
1
00 02 04 06 08 1 12 14 16 18 2
I(t)
S(t)
times105
times105
120591 = 25
(d) The phase portrait of susceptible 119878(119905) and infected 119868(119905) when 120591 gt 1205910
Figure 8 The phase portrait when 120591 lt 1205910and 120591 gt 120591
0
S(t)
I(t)
D(t)
Q(t)
V(t)
5
45
4
35
3
25
2
15
1
05
00 50 100 150 200 250 300 350 400 450 500
times105
Num
ber o
f hos
ts
t (s)
Figure 9 Simulation result of the five kinds of hosts when 120591 lt 1205910
susceptible 119878(119905) and infected 119868(119905) is depictedwhen 120591 = 15 lt 1205910
as shown Figure 11 It shows that the curve is converged to afixed point which means that the system gets stable
When time delay passes the threshold a bifurcationappears Figure 12 shows the number of susceptible infectiousand vaccinated hosts when 120591 gt 120591
0 Figure 13 shows the differ-
ence between simulation and numerical results of susceptibleand infectious hosts respectively In this figure the periods
S(t)
I(t)
D(t)
Q(t)
V(t)
5
45
4
35
3
25
2
15
1
05
00 500
times105
Num
ber o
f hos
ts
1000 1500 2000 2500 3000 3500
t (s)
Figure 10 Simulation result of the five kinds of hosts when 120591 = 15
of these two curves are well matched which suggests thatthe results of numerical and simulation experiments areidentical But there is a difference of 96 of total populationsize in amplitudes This mainly results from the precision ofexperiments The number of hosts in numerical experimentscan be either integers or decimals because it is the solution ofdifferential equations However in simulation experimentsthe number of hosts must be integers Furthermore when the
10 Journal of Applied Mathematics
5
45
4
35
3
25
2
15
1
05
0
times105
I(t)
S(t)
times1040 2 4 6 8 10 12 14 16 18
120591 = 15
Figure 11 The phase portrait of susceptible 119878(119905) and infected 119868(119905)
when 120591 = 15
S(t)
I(t)
V(t)
5
45
4
35
3
25
2
15
1
05
00 500
times105
Num
ber o
f hos
ts
1000 1500 2000 2500 3000
t (s)
Figure 12 Simulation result of the three kinds of hosts when 120591 gt 1205910
number of infectious hosts are very little this tiny differencewill result in a big gap afterwards
5 Conclusions
In order to accord with actual facts in the real world timedelay generated by time window in IDS is introduced toconstruct the worm propagation model Dynamic birth anddeath rates are considered in this paper accounting for thereinstallation of OS which users are more likely to do afterwhen the hosts suffer wormrsquos destruction or quarantined tothe Internet In addition combined with birth and deathrates time delay may lead to bifurcation and make the wormpropagation system unstable
In this paper a delayed worm propagation model withbirth and death rates is studied Next the stability of thepositive equilibrium is analyzedThrough theoretical analysisand numerical and simulation experiments the followingconclusions can be derived
(i) The introduction of time window in IDS may lead totime delay in worm propagationmodel which resultsin bifurcation The critical time delay 120591
0where the
bifurcation appears is obtained
S(t)
5
45
4
35
3
25
2
15
1
05
00 500
times105
1000 1500 2000 2500 3000
S(t) in numerical experimentS(t) in simulation experiment
t (s)
(a) The comparison of the number of susceptible hosts
I(t)
25
2
15
1
05
00 500
times105
1000 1500 2000 2500 30000 500 1000 1500 2000 2500 300
I(t) in numerical experimentI(t) in simulation experiment
t (s)
(b) The comparison of the number of infectious hosts
Figure 13 The comparison of numerical and simulation experi-ments
(ii) The worm propagation system is stable when timedelay 120591 lt 120591
0 In this situation the worm propagation
can be easily predicted and eliminated(iii) A bifurcation emerges when time delay 120591 ge 120591
0 which
means the worm propagation is unstable and may beout of control
Consequently time delay 120591 should remain less than 1205910
by decreasing the time window in IDS which is helpful topredict the worm propagation and even eliminate the worm
In this paper we have only discussed the cases whichsatisfy conditions (119867
1) (1198672) and (119867
3) But for cases that
satisfy (1198671) (1198672) and (119867
3) the dynamical behavior of this
model has not been studied These issues will be studied anddiscussed in our future work
Acknowledgments
The authors are very grateful to the anonymous referee formany valuable comments and suggestions which led to asignificant improvement of the original paper This paper
Journal of Applied Mathematics 11
is supported by the National Natural Science Foundationof China under Grant no 60803132 the Natural ScienceFoundation of Liaoning Province of China under Grant no201202059 Program for Liaoning Excellent Talents in Uni-versity under LR2013011 the Fundamental Research Funds ofthe Central Universities under Grant nos N120504006 andN100704001 and MOE-Intel Special Fund of InformationTechnology (MOE-INTEL-2012-06)
References
[1] N Yoshida and T Hara ldquoGlobal stability of a delayed SIR epide-mic model with density dependent birth and death ratesrdquo Jour-nal of Computational and Applied Mathematics vol 201 no 2pp 339ndash347 2007
[2] M Song W Ma and Y Takeuchi ldquoPermanence of a delayedSIR epidemic model with density dependent birth raterdquo Journalof Computational and Applied Mathematics vol 201 no 2 pp389ndash394 2007
[3] J Liu and T Zhang ldquoBifurcation analysis of an SIS epidemicmodel with nonlinear birth raterdquo Chaos Solitons and Fractalsvol 40 no 3 pp 1091ndash1099 2009
[4] V Yegneswaran P Barford and D Plonka ldquoOn the design anduse of internet sinks for network abuse monitoringrdquo ComputerScience vol 3224 pp 146ndash165 2004
[5] D Yeung and Y Ding ldquoHost-based intrusion detection usingdynamic and static behavioralmodelsrdquo Pattern Recognition vol36 no 1 pp 229ndash243 2003
[6] N Stakhanova S Basu and JWong ldquoOn the symbiosis of speci-fication-based and anomaly-based detectionrdquo Computers andSecurity vol 29 no 2 pp 253ndash268 2010
[7] G P Spathoulas and S K Katsikas ldquoReducing false positives inintrusion detection systemsrdquo Computers and Security vol 29no 1 pp 35ndash44 2010
[8] C Lin B Liu H Hu F Xiao and J Zhang ldquoDetecting hid-den Malware method based on ldquoIn-VMrdquo modelrdquo China Com-munications vol 8 no 4 pp 99ndash108 2011
[9] S Staniford V Paxson and N Weaver ldquoHow to own theinternet in your spare timerdquo in Proceedings of the 11th USENIXSecurity Symposium pp 149ndash167 San Francisco Calif USA2002
[10] S Qing and W Wen ldquoA survey and trends on Internet wormsrdquoComputers and Security vol 24 no 4 pp 334ndash346 2005
[11] C C ZouW Gong and D Towsley ldquoWorm propagation mod-eling and analysis under dynamic quarantine defenserdquo in Pro-ceedings of the 2003 ACMWorkshop on Rapid Malcode (WORMrsquo03) pp 51ndash60 Washington DC USA October 2003
[12] J Ren X Yang Q Zhu L Yang and C Zhang ldquoA novel com-puter virus model and its dynamicsrdquo Nonlinear Analysis RealWorld Applications vol 13 no 1 pp 376ndash384 2012
[13] B K Mishra and S K Pandey ldquoFuzzy epidemic model for thetransmission of worms in computer networkrdquo Nonlinear Ana-lysis Real World Applications vol 11 no 5 pp 4335ndash4341 2010
[14] L-X Yang and X Yang ldquoPropagation behavior of virus codesin the situation that infected computers are connected to theinternet with positive probabilityrdquo Discrete Dynamics in Natureand Society vol 2012 Article ID 693695 13 pages 2012
[15] Y Yao X Xie H Guo G Yu F Gao and X Tong ldquoHopf bifur-cation in an Internet worm propagation model with time delayin quarantinerdquoMathematical and Computer Modelling 2011
[16] Y Yao W Xiang A Qu G Yu and F Gao ldquoHopf bifurcationin an SEIDQV worm propagation model with quarantine stra-tegyrdquoDiscrete Dynamics in Nature and Society vol 2012 ArticleID 304868 18 pages 2012
[17] Y Yao L Guo H Guo G Yu F Gao and X Tong ldquoPulsequarantine strategy of internet worm propagation modelingand analysisrdquo Computers and Electrical Engineering 2011
[18] F Wang Y Zhang C Wang J Ma and S Moon ldquoStability ana-lysis of a SEIQV epidemic model for rapid spreading wormsrdquoComputers and Security vol 29 no 4 pp 410ndash418 2010
[19] T Dong X Liao and H Li ldquoStability and Hopf bifurcation ina computer virus model with multistate antivirusrdquo Abstract andApplied Analysis vol 2012 Article ID 841987 16 pages 2012
[20] T Zhang J Liu and Z Teng ldquoStability of Hopf bifurcation of adelayed SIRS epidemic model with stage structurerdquo NonlinearAnalysis Real World Applications vol 11 no 1 pp 293ndash3062010
[21] J Zhang W Li and X Yan ldquoHopf bifurcation and stabilityof periodic solutions in a delayed eco-epidemiological systemrdquoApplied Mathematics and Computation vol 198 no 2 pp 865ndash876 2008
[22] W Kermack and A McKendrick ldquoA contribution to the mathe-matical theory of epidemicsrdquo Proceedings of the Royal Society ofLondon A vol 115 no 772 pp 700ndash721 1927
[23] S Wang Q Liu X Yu and Y Ma ldquoBifurcation analysis of amodel for network worm propagation with time delayrdquoMathe-matical and Computer Modelling vol 52 no 3-4 pp 435ndash4472010
[24] B Hassard D Kazarino and Y WanTheory and Application ofHopf Bifurcation Cambridge University Press Cambridge UK1981
Submit your manuscripts athttpwwwhindawicom
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Mathematical Problems in Engineering
Hindawi Publishing Corporationhttpwwwhindawicom
Differential EquationsInternational Journal of
Volume 2014
Applied MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Mathematical PhysicsAdvances in
Complex AnalysisJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
OptimizationJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
International Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Operations ResearchAdvances in
Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Function Spaces
Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
International Journal of Mathematics and Mathematical Sciences
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Algebra
Discrete Dynamics in Nature and Society
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Decision SciencesAdvances in
Discrete MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom
Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Stochastic AnalysisInternational Journal of
Journal of Applied Mathematics 9
0
1
2
3
4
5
0
005
115
2
I(t)
times104
times10 5
times105
S(t)
2
4V(t)
120591 = 15
(a) The projection of the phase portrait in (119878 119868 119877)-space when 120591 lt 1205910
0
1
2
3
4
5
0
005
115
2
I(t)
times104
times10 5
times105
S(t)
2
4V(t)
120591 = 25
(b) The projection of the phase portrait in (119878 119868 119877)-space when 120591 gt 1205910
5
4
3
2
1
00 02 04 06 08 1 12 14 16 18 2
I(t)
S(t)
times105
times105
120591 = 15
(c) The phase portrait of susceptible 119878(119905) and infected 119868(119905) when 120591 lt 1205910
5
4
3
2
1
00 02 04 06 08 1 12 14 16 18 2
I(t)
S(t)
times105
times105
120591 = 25
(d) The phase portrait of susceptible 119878(119905) and infected 119868(119905) when 120591 gt 1205910
Figure 8 The phase portrait when 120591 lt 1205910and 120591 gt 120591
0
S(t)
I(t)
D(t)
Q(t)
V(t)
5
45
4
35
3
25
2
15
1
05
00 50 100 150 200 250 300 350 400 450 500
times105
Num
ber o
f hos
ts
t (s)
Figure 9 Simulation result of the five kinds of hosts when 120591 lt 1205910
susceptible 119878(119905) and infected 119868(119905) is depictedwhen 120591 = 15 lt 1205910
as shown Figure 11 It shows that the curve is converged to afixed point which means that the system gets stable
When time delay passes the threshold a bifurcationappears Figure 12 shows the number of susceptible infectiousand vaccinated hosts when 120591 gt 120591
0 Figure 13 shows the differ-
ence between simulation and numerical results of susceptibleand infectious hosts respectively In this figure the periods
S(t)
I(t)
D(t)
Q(t)
V(t)
5
45
4
35
3
25
2
15
1
05
00 500
times105
Num
ber o
f hos
ts
1000 1500 2000 2500 3000 3500
t (s)
Figure 10 Simulation result of the five kinds of hosts when 120591 = 15
of these two curves are well matched which suggests thatthe results of numerical and simulation experiments areidentical But there is a difference of 96 of total populationsize in amplitudes This mainly results from the precision ofexperiments The number of hosts in numerical experimentscan be either integers or decimals because it is the solution ofdifferential equations However in simulation experimentsthe number of hosts must be integers Furthermore when the
10 Journal of Applied Mathematics
5
45
4
35
3
25
2
15
1
05
0
times105
I(t)
S(t)
times1040 2 4 6 8 10 12 14 16 18
120591 = 15
Figure 11 The phase portrait of susceptible 119878(119905) and infected 119868(119905)
when 120591 = 15
S(t)
I(t)
V(t)
5
45
4
35
3
25
2
15
1
05
00 500
times105
Num
ber o
f hos
ts
1000 1500 2000 2500 3000
t (s)
Figure 12 Simulation result of the three kinds of hosts when 120591 gt 1205910
number of infectious hosts are very little this tiny differencewill result in a big gap afterwards
5 Conclusions
In order to accord with actual facts in the real world timedelay generated by time window in IDS is introduced toconstruct the worm propagation model Dynamic birth anddeath rates are considered in this paper accounting for thereinstallation of OS which users are more likely to do afterwhen the hosts suffer wormrsquos destruction or quarantined tothe Internet In addition combined with birth and deathrates time delay may lead to bifurcation and make the wormpropagation system unstable
In this paper a delayed worm propagation model withbirth and death rates is studied Next the stability of thepositive equilibrium is analyzedThrough theoretical analysisand numerical and simulation experiments the followingconclusions can be derived
(i) The introduction of time window in IDS may lead totime delay in worm propagationmodel which resultsin bifurcation The critical time delay 120591
0where the
bifurcation appears is obtained
S(t)
5
45
4
35
3
25
2
15
1
05
00 500
times105
1000 1500 2000 2500 3000
S(t) in numerical experimentS(t) in simulation experiment
t (s)
(a) The comparison of the number of susceptible hosts
I(t)
25
2
15
1
05
00 500
times105
1000 1500 2000 2500 30000 500 1000 1500 2000 2500 300
I(t) in numerical experimentI(t) in simulation experiment
t (s)
(b) The comparison of the number of infectious hosts
Figure 13 The comparison of numerical and simulation experi-ments
(ii) The worm propagation system is stable when timedelay 120591 lt 120591
0 In this situation the worm propagation
can be easily predicted and eliminated(iii) A bifurcation emerges when time delay 120591 ge 120591
0 which
means the worm propagation is unstable and may beout of control
Consequently time delay 120591 should remain less than 1205910
by decreasing the time window in IDS which is helpful topredict the worm propagation and even eliminate the worm
In this paper we have only discussed the cases whichsatisfy conditions (119867
1) (1198672) and (119867
3) But for cases that
satisfy (1198671) (1198672) and (119867
3) the dynamical behavior of this
model has not been studied These issues will be studied anddiscussed in our future work
Acknowledgments
The authors are very grateful to the anonymous referee formany valuable comments and suggestions which led to asignificant improvement of the original paper This paper
Journal of Applied Mathematics 11
is supported by the National Natural Science Foundationof China under Grant no 60803132 the Natural ScienceFoundation of Liaoning Province of China under Grant no201202059 Program for Liaoning Excellent Talents in Uni-versity under LR2013011 the Fundamental Research Funds ofthe Central Universities under Grant nos N120504006 andN100704001 and MOE-Intel Special Fund of InformationTechnology (MOE-INTEL-2012-06)
References
[1] N Yoshida and T Hara ldquoGlobal stability of a delayed SIR epide-mic model with density dependent birth and death ratesrdquo Jour-nal of Computational and Applied Mathematics vol 201 no 2pp 339ndash347 2007
[2] M Song W Ma and Y Takeuchi ldquoPermanence of a delayedSIR epidemic model with density dependent birth raterdquo Journalof Computational and Applied Mathematics vol 201 no 2 pp389ndash394 2007
[3] J Liu and T Zhang ldquoBifurcation analysis of an SIS epidemicmodel with nonlinear birth raterdquo Chaos Solitons and Fractalsvol 40 no 3 pp 1091ndash1099 2009
[4] V Yegneswaran P Barford and D Plonka ldquoOn the design anduse of internet sinks for network abuse monitoringrdquo ComputerScience vol 3224 pp 146ndash165 2004
[5] D Yeung and Y Ding ldquoHost-based intrusion detection usingdynamic and static behavioralmodelsrdquo Pattern Recognition vol36 no 1 pp 229ndash243 2003
[6] N Stakhanova S Basu and JWong ldquoOn the symbiosis of speci-fication-based and anomaly-based detectionrdquo Computers andSecurity vol 29 no 2 pp 253ndash268 2010
[7] G P Spathoulas and S K Katsikas ldquoReducing false positives inintrusion detection systemsrdquo Computers and Security vol 29no 1 pp 35ndash44 2010
[8] C Lin B Liu H Hu F Xiao and J Zhang ldquoDetecting hid-den Malware method based on ldquoIn-VMrdquo modelrdquo China Com-munications vol 8 no 4 pp 99ndash108 2011
[9] S Staniford V Paxson and N Weaver ldquoHow to own theinternet in your spare timerdquo in Proceedings of the 11th USENIXSecurity Symposium pp 149ndash167 San Francisco Calif USA2002
[10] S Qing and W Wen ldquoA survey and trends on Internet wormsrdquoComputers and Security vol 24 no 4 pp 334ndash346 2005
[11] C C ZouW Gong and D Towsley ldquoWorm propagation mod-eling and analysis under dynamic quarantine defenserdquo in Pro-ceedings of the 2003 ACMWorkshop on Rapid Malcode (WORMrsquo03) pp 51ndash60 Washington DC USA October 2003
[12] J Ren X Yang Q Zhu L Yang and C Zhang ldquoA novel com-puter virus model and its dynamicsrdquo Nonlinear Analysis RealWorld Applications vol 13 no 1 pp 376ndash384 2012
[13] B K Mishra and S K Pandey ldquoFuzzy epidemic model for thetransmission of worms in computer networkrdquo Nonlinear Ana-lysis Real World Applications vol 11 no 5 pp 4335ndash4341 2010
[14] L-X Yang and X Yang ldquoPropagation behavior of virus codesin the situation that infected computers are connected to theinternet with positive probabilityrdquo Discrete Dynamics in Natureand Society vol 2012 Article ID 693695 13 pages 2012
[15] Y Yao X Xie H Guo G Yu F Gao and X Tong ldquoHopf bifur-cation in an Internet worm propagation model with time delayin quarantinerdquoMathematical and Computer Modelling 2011
[16] Y Yao W Xiang A Qu G Yu and F Gao ldquoHopf bifurcationin an SEIDQV worm propagation model with quarantine stra-tegyrdquoDiscrete Dynamics in Nature and Society vol 2012 ArticleID 304868 18 pages 2012
[17] Y Yao L Guo H Guo G Yu F Gao and X Tong ldquoPulsequarantine strategy of internet worm propagation modelingand analysisrdquo Computers and Electrical Engineering 2011
[18] F Wang Y Zhang C Wang J Ma and S Moon ldquoStability ana-lysis of a SEIQV epidemic model for rapid spreading wormsrdquoComputers and Security vol 29 no 4 pp 410ndash418 2010
[19] T Dong X Liao and H Li ldquoStability and Hopf bifurcation ina computer virus model with multistate antivirusrdquo Abstract andApplied Analysis vol 2012 Article ID 841987 16 pages 2012
[20] T Zhang J Liu and Z Teng ldquoStability of Hopf bifurcation of adelayed SIRS epidemic model with stage structurerdquo NonlinearAnalysis Real World Applications vol 11 no 1 pp 293ndash3062010
[21] J Zhang W Li and X Yan ldquoHopf bifurcation and stabilityof periodic solutions in a delayed eco-epidemiological systemrdquoApplied Mathematics and Computation vol 198 no 2 pp 865ndash876 2008
[22] W Kermack and A McKendrick ldquoA contribution to the mathe-matical theory of epidemicsrdquo Proceedings of the Royal Society ofLondon A vol 115 no 772 pp 700ndash721 1927
[23] S Wang Q Liu X Yu and Y Ma ldquoBifurcation analysis of amodel for network worm propagation with time delayrdquoMathe-matical and Computer Modelling vol 52 no 3-4 pp 435ndash4472010
[24] B Hassard D Kazarino and Y WanTheory and Application ofHopf Bifurcation Cambridge University Press Cambridge UK1981
Submit your manuscripts athttpwwwhindawicom
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Mathematical Problems in Engineering
Hindawi Publishing Corporationhttpwwwhindawicom
Differential EquationsInternational Journal of
Volume 2014
Applied MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Mathematical PhysicsAdvances in
Complex AnalysisJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
OptimizationJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
International Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Operations ResearchAdvances in
Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Function Spaces
Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
International Journal of Mathematics and Mathematical Sciences
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Algebra
Discrete Dynamics in Nature and Society
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Decision SciencesAdvances in
Discrete MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom
Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Stochastic AnalysisInternational Journal of
10 Journal of Applied Mathematics
5
45
4
35
3
25
2
15
1
05
0
times105
I(t)
S(t)
times1040 2 4 6 8 10 12 14 16 18
120591 = 15
Figure 11 The phase portrait of susceptible 119878(119905) and infected 119868(119905)
when 120591 = 15
S(t)
I(t)
V(t)
5
45
4
35
3
25
2
15
1
05
00 500
times105
Num
ber o
f hos
ts
1000 1500 2000 2500 3000
t (s)
Figure 12 Simulation result of the three kinds of hosts when 120591 gt 1205910
number of infectious hosts are very little this tiny differencewill result in a big gap afterwards
5 Conclusions
In order to accord with actual facts in the real world timedelay generated by time window in IDS is introduced toconstruct the worm propagation model Dynamic birth anddeath rates are considered in this paper accounting for thereinstallation of OS which users are more likely to do afterwhen the hosts suffer wormrsquos destruction or quarantined tothe Internet In addition combined with birth and deathrates time delay may lead to bifurcation and make the wormpropagation system unstable
In this paper a delayed worm propagation model withbirth and death rates is studied Next the stability of thepositive equilibrium is analyzedThrough theoretical analysisand numerical and simulation experiments the followingconclusions can be derived
(i) The introduction of time window in IDS may lead totime delay in worm propagationmodel which resultsin bifurcation The critical time delay 120591
0where the
bifurcation appears is obtained
S(t)
5
45
4
35
3
25
2
15
1
05
00 500
times105
1000 1500 2000 2500 3000
S(t) in numerical experimentS(t) in simulation experiment
t (s)
(a) The comparison of the number of susceptible hosts
I(t)
25
2
15
1
05
00 500
times105
1000 1500 2000 2500 30000 500 1000 1500 2000 2500 300
I(t) in numerical experimentI(t) in simulation experiment
t (s)
(b) The comparison of the number of infectious hosts
Figure 13 The comparison of numerical and simulation experi-ments
(ii) The worm propagation system is stable when timedelay 120591 lt 120591
0 In this situation the worm propagation
can be easily predicted and eliminated(iii) A bifurcation emerges when time delay 120591 ge 120591
0 which
means the worm propagation is unstable and may beout of control
Consequently time delay 120591 should remain less than 1205910
by decreasing the time window in IDS which is helpful topredict the worm propagation and even eliminate the worm
In this paper we have only discussed the cases whichsatisfy conditions (119867
1) (1198672) and (119867
3) But for cases that
satisfy (1198671) (1198672) and (119867
3) the dynamical behavior of this
model has not been studied These issues will be studied anddiscussed in our future work
Acknowledgments
The authors are very grateful to the anonymous referee formany valuable comments and suggestions which led to asignificant improvement of the original paper This paper
Journal of Applied Mathematics 11
is supported by the National Natural Science Foundationof China under Grant no 60803132 the Natural ScienceFoundation of Liaoning Province of China under Grant no201202059 Program for Liaoning Excellent Talents in Uni-versity under LR2013011 the Fundamental Research Funds ofthe Central Universities under Grant nos N120504006 andN100704001 and MOE-Intel Special Fund of InformationTechnology (MOE-INTEL-2012-06)
References
[1] N Yoshida and T Hara ldquoGlobal stability of a delayed SIR epide-mic model with density dependent birth and death ratesrdquo Jour-nal of Computational and Applied Mathematics vol 201 no 2pp 339ndash347 2007
[2] M Song W Ma and Y Takeuchi ldquoPermanence of a delayedSIR epidemic model with density dependent birth raterdquo Journalof Computational and Applied Mathematics vol 201 no 2 pp389ndash394 2007
[3] J Liu and T Zhang ldquoBifurcation analysis of an SIS epidemicmodel with nonlinear birth raterdquo Chaos Solitons and Fractalsvol 40 no 3 pp 1091ndash1099 2009
[4] V Yegneswaran P Barford and D Plonka ldquoOn the design anduse of internet sinks for network abuse monitoringrdquo ComputerScience vol 3224 pp 146ndash165 2004
[5] D Yeung and Y Ding ldquoHost-based intrusion detection usingdynamic and static behavioralmodelsrdquo Pattern Recognition vol36 no 1 pp 229ndash243 2003
[6] N Stakhanova S Basu and JWong ldquoOn the symbiosis of speci-fication-based and anomaly-based detectionrdquo Computers andSecurity vol 29 no 2 pp 253ndash268 2010
[7] G P Spathoulas and S K Katsikas ldquoReducing false positives inintrusion detection systemsrdquo Computers and Security vol 29no 1 pp 35ndash44 2010
[8] C Lin B Liu H Hu F Xiao and J Zhang ldquoDetecting hid-den Malware method based on ldquoIn-VMrdquo modelrdquo China Com-munications vol 8 no 4 pp 99ndash108 2011
[9] S Staniford V Paxson and N Weaver ldquoHow to own theinternet in your spare timerdquo in Proceedings of the 11th USENIXSecurity Symposium pp 149ndash167 San Francisco Calif USA2002
[10] S Qing and W Wen ldquoA survey and trends on Internet wormsrdquoComputers and Security vol 24 no 4 pp 334ndash346 2005
[11] C C ZouW Gong and D Towsley ldquoWorm propagation mod-eling and analysis under dynamic quarantine defenserdquo in Pro-ceedings of the 2003 ACMWorkshop on Rapid Malcode (WORMrsquo03) pp 51ndash60 Washington DC USA October 2003
[12] J Ren X Yang Q Zhu L Yang and C Zhang ldquoA novel com-puter virus model and its dynamicsrdquo Nonlinear Analysis RealWorld Applications vol 13 no 1 pp 376ndash384 2012
[13] B K Mishra and S K Pandey ldquoFuzzy epidemic model for thetransmission of worms in computer networkrdquo Nonlinear Ana-lysis Real World Applications vol 11 no 5 pp 4335ndash4341 2010
[14] L-X Yang and X Yang ldquoPropagation behavior of virus codesin the situation that infected computers are connected to theinternet with positive probabilityrdquo Discrete Dynamics in Natureand Society vol 2012 Article ID 693695 13 pages 2012
[15] Y Yao X Xie H Guo G Yu F Gao and X Tong ldquoHopf bifur-cation in an Internet worm propagation model with time delayin quarantinerdquoMathematical and Computer Modelling 2011
[16] Y Yao W Xiang A Qu G Yu and F Gao ldquoHopf bifurcationin an SEIDQV worm propagation model with quarantine stra-tegyrdquoDiscrete Dynamics in Nature and Society vol 2012 ArticleID 304868 18 pages 2012
[17] Y Yao L Guo H Guo G Yu F Gao and X Tong ldquoPulsequarantine strategy of internet worm propagation modelingand analysisrdquo Computers and Electrical Engineering 2011
[18] F Wang Y Zhang C Wang J Ma and S Moon ldquoStability ana-lysis of a SEIQV epidemic model for rapid spreading wormsrdquoComputers and Security vol 29 no 4 pp 410ndash418 2010
[19] T Dong X Liao and H Li ldquoStability and Hopf bifurcation ina computer virus model with multistate antivirusrdquo Abstract andApplied Analysis vol 2012 Article ID 841987 16 pages 2012
[20] T Zhang J Liu and Z Teng ldquoStability of Hopf bifurcation of adelayed SIRS epidemic model with stage structurerdquo NonlinearAnalysis Real World Applications vol 11 no 1 pp 293ndash3062010
[21] J Zhang W Li and X Yan ldquoHopf bifurcation and stabilityof periodic solutions in a delayed eco-epidemiological systemrdquoApplied Mathematics and Computation vol 198 no 2 pp 865ndash876 2008
[22] W Kermack and A McKendrick ldquoA contribution to the mathe-matical theory of epidemicsrdquo Proceedings of the Royal Society ofLondon A vol 115 no 772 pp 700ndash721 1927
[23] S Wang Q Liu X Yu and Y Ma ldquoBifurcation analysis of amodel for network worm propagation with time delayrdquoMathe-matical and Computer Modelling vol 52 no 3-4 pp 435ndash4472010
[24] B Hassard D Kazarino and Y WanTheory and Application ofHopf Bifurcation Cambridge University Press Cambridge UK1981
Submit your manuscripts athttpwwwhindawicom
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Mathematical Problems in Engineering
Hindawi Publishing Corporationhttpwwwhindawicom
Differential EquationsInternational Journal of
Volume 2014
Applied MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Mathematical PhysicsAdvances in
Complex AnalysisJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
OptimizationJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
International Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Operations ResearchAdvances in
Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Function Spaces
Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
International Journal of Mathematics and Mathematical Sciences
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Algebra
Discrete Dynamics in Nature and Society
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Decision SciencesAdvances in
Discrete MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom
Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Stochastic AnalysisInternational Journal of
Journal of Applied Mathematics 11
is supported by the National Natural Science Foundationof China under Grant no 60803132 the Natural ScienceFoundation of Liaoning Province of China under Grant no201202059 Program for Liaoning Excellent Talents in Uni-versity under LR2013011 the Fundamental Research Funds ofthe Central Universities under Grant nos N120504006 andN100704001 and MOE-Intel Special Fund of InformationTechnology (MOE-INTEL-2012-06)
References
[1] N Yoshida and T Hara ldquoGlobal stability of a delayed SIR epide-mic model with density dependent birth and death ratesrdquo Jour-nal of Computational and Applied Mathematics vol 201 no 2pp 339ndash347 2007
[2] M Song W Ma and Y Takeuchi ldquoPermanence of a delayedSIR epidemic model with density dependent birth raterdquo Journalof Computational and Applied Mathematics vol 201 no 2 pp389ndash394 2007
[3] J Liu and T Zhang ldquoBifurcation analysis of an SIS epidemicmodel with nonlinear birth raterdquo Chaos Solitons and Fractalsvol 40 no 3 pp 1091ndash1099 2009
[4] V Yegneswaran P Barford and D Plonka ldquoOn the design anduse of internet sinks for network abuse monitoringrdquo ComputerScience vol 3224 pp 146ndash165 2004
[5] D Yeung and Y Ding ldquoHost-based intrusion detection usingdynamic and static behavioralmodelsrdquo Pattern Recognition vol36 no 1 pp 229ndash243 2003
[6] N Stakhanova S Basu and JWong ldquoOn the symbiosis of speci-fication-based and anomaly-based detectionrdquo Computers andSecurity vol 29 no 2 pp 253ndash268 2010
[7] G P Spathoulas and S K Katsikas ldquoReducing false positives inintrusion detection systemsrdquo Computers and Security vol 29no 1 pp 35ndash44 2010
[8] C Lin B Liu H Hu F Xiao and J Zhang ldquoDetecting hid-den Malware method based on ldquoIn-VMrdquo modelrdquo China Com-munications vol 8 no 4 pp 99ndash108 2011
[9] S Staniford V Paxson and N Weaver ldquoHow to own theinternet in your spare timerdquo in Proceedings of the 11th USENIXSecurity Symposium pp 149ndash167 San Francisco Calif USA2002
[10] S Qing and W Wen ldquoA survey and trends on Internet wormsrdquoComputers and Security vol 24 no 4 pp 334ndash346 2005
[11] C C ZouW Gong and D Towsley ldquoWorm propagation mod-eling and analysis under dynamic quarantine defenserdquo in Pro-ceedings of the 2003 ACMWorkshop on Rapid Malcode (WORMrsquo03) pp 51ndash60 Washington DC USA October 2003
[12] J Ren X Yang Q Zhu L Yang and C Zhang ldquoA novel com-puter virus model and its dynamicsrdquo Nonlinear Analysis RealWorld Applications vol 13 no 1 pp 376ndash384 2012
[13] B K Mishra and S K Pandey ldquoFuzzy epidemic model for thetransmission of worms in computer networkrdquo Nonlinear Ana-lysis Real World Applications vol 11 no 5 pp 4335ndash4341 2010
[14] L-X Yang and X Yang ldquoPropagation behavior of virus codesin the situation that infected computers are connected to theinternet with positive probabilityrdquo Discrete Dynamics in Natureand Society vol 2012 Article ID 693695 13 pages 2012
[15] Y Yao X Xie H Guo G Yu F Gao and X Tong ldquoHopf bifur-cation in an Internet worm propagation model with time delayin quarantinerdquoMathematical and Computer Modelling 2011
[16] Y Yao W Xiang A Qu G Yu and F Gao ldquoHopf bifurcationin an SEIDQV worm propagation model with quarantine stra-tegyrdquoDiscrete Dynamics in Nature and Society vol 2012 ArticleID 304868 18 pages 2012
[17] Y Yao L Guo H Guo G Yu F Gao and X Tong ldquoPulsequarantine strategy of internet worm propagation modelingand analysisrdquo Computers and Electrical Engineering 2011
[18] F Wang Y Zhang C Wang J Ma and S Moon ldquoStability ana-lysis of a SEIQV epidemic model for rapid spreading wormsrdquoComputers and Security vol 29 no 4 pp 410ndash418 2010
[19] T Dong X Liao and H Li ldquoStability and Hopf bifurcation ina computer virus model with multistate antivirusrdquo Abstract andApplied Analysis vol 2012 Article ID 841987 16 pages 2012
[20] T Zhang J Liu and Z Teng ldquoStability of Hopf bifurcation of adelayed SIRS epidemic model with stage structurerdquo NonlinearAnalysis Real World Applications vol 11 no 1 pp 293ndash3062010
[21] J Zhang W Li and X Yan ldquoHopf bifurcation and stabilityof periodic solutions in a delayed eco-epidemiological systemrdquoApplied Mathematics and Computation vol 198 no 2 pp 865ndash876 2008
[22] W Kermack and A McKendrick ldquoA contribution to the mathe-matical theory of epidemicsrdquo Proceedings of the Royal Society ofLondon A vol 115 no 772 pp 700ndash721 1927
[23] S Wang Q Liu X Yu and Y Ma ldquoBifurcation analysis of amodel for network worm propagation with time delayrdquoMathe-matical and Computer Modelling vol 52 no 3-4 pp 435ndash4472010
[24] B Hassard D Kazarino and Y WanTheory and Application ofHopf Bifurcation Cambridge University Press Cambridge UK1981
Submit your manuscripts athttpwwwhindawicom
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Mathematical Problems in Engineering
Hindawi Publishing Corporationhttpwwwhindawicom
Differential EquationsInternational Journal of
Volume 2014
Applied MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Mathematical PhysicsAdvances in
Complex AnalysisJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
OptimizationJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
International Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Operations ResearchAdvances in
Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Function Spaces
Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
International Journal of Mathematics and Mathematical Sciences
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Algebra
Discrete Dynamics in Nature and Society
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Decision SciencesAdvances in
Discrete MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom
Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Stochastic AnalysisInternational Journal of
Submit your manuscripts athttpwwwhindawicom
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Mathematical Problems in Engineering
Hindawi Publishing Corporationhttpwwwhindawicom
Differential EquationsInternational Journal of
Volume 2014
Applied MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Mathematical PhysicsAdvances in
Complex AnalysisJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
OptimizationJournal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
International Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Operations ResearchAdvances in
Journal of
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Function Spaces
Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014
International Journal of Mathematics and Mathematical Sciences
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Algebra
Discrete Dynamics in Nature and Society
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Decision SciencesAdvances in
Discrete MathematicsJournal of
Hindawi Publishing Corporationhttpwwwhindawicom
Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014
Stochastic AnalysisInternational Journal of
