Deterministic and Stochastic Study for an Infected Computer Network Model Powered by a System of Antivirus Programs

We investigate the various conditions that control the extinction and stability of a nonlinear mathematical spread model with stochastic perturbations. This model describes the spread of viruses into an infected computer network which is powered by a system of antivirus software. The system is analyzed by using the stability theory of stochastic differential equations and the computer simulations. First, we study the global stability of the virus-free equilibrium state and the virus-epidemic equilibrium state. Furthermore, we use the Itô formula and some other theoretical theorems of stochastic differential equation to discuss the extinction and the stationary distribution of our system.The analysis gives a sufficient condition for the infection to be extinct (i.e., the number of viruses tends exponentially to zero). The ergodicity of the solution and the stationary distribution can be obtained if the basic reproduction number Rp is bigger than 1, and the intensities of stochastic fluctuations are small enough. Numerical simulations are carried out to illustrate the theoretical results.


Introduction
A computer virus is a small malicious program that spreads from host to host and has a great ability to replicate itself into or over data files during the execution of programs.On a computer network, the interconnectivity of workstations makes the spread of viruses easier.In fact, an infected computer can spread viruses (malware) through the other connected nodes, which causes severe damage like reformatting the hard drive, unexplained data loss, slowing computer performance, corrupting databases, and so forth.Consequently, mathematics specialists are becoming more aware of the importance of protecting systems.To clean and protect the network, an antivirus is a computer program designed to identify and erase malicious software in the system.
Similar to the biological virus systems, many mathematical models have been proposed to describe quantitatively the spread of infections into a computer network [1][2][3][4][5][6][7][8][9].Following a deterministic approach, Mishra and Jha [1] have formulated and analyzed the effect of quarantine on recovered nodes.Yuan and Chen [2] discussed an -SEIR network virusepidemic model using the theory of stability in differential equations.Shukla et al. [3] modeled and studied the effect of antivirus software on infected computer network; they proved that, under certain conditions, the used antivirus can successfully clean the system.
Other authors have followed the stochastic approach to describe the spread of viruses in a computer network [4,5].Zhang et al. [4] proposed and investigated a stochastic computer virus spread model.By constructing a suitable Lyapunov function, they established the necessary conditions for the virus-free equilibrium and viral equilibrium to be stabilized.
To study the effect of antivirus software on its ability to clean an infected computer network, Shukla et al. [3]  (1) here () denotes the number of susceptible nodes at time  ≥ 0, () the number of infected nodes, () the number of protected nodes, and   () the number of antivirus programs used to clean the network, which is considered to be proportional with the number of infected nodes.The total number of nodes in the network is () = () + () + ().The significance of each parameter in the model is as follows:  is the inflow rate of susceptible nodes,  is the transition rate from  to  resulting from the contact between susceptible and infected nodes,  is the rate at which nodes are crashed by another cause other than being attacked by viruses,  is the constant rate at which the nodes are being protected by another antivirus software,  is the rate at which infected nodes become incapable of infecting susceptible nodes,  is the rate at which infected nodes are recovered and become susceptible again,  is the growth rate of antivirus software used to clean the network,  0 is the rate by which it fails to work efficiently, and  0 is the number of antivirus programs permanently present in the system to protect the existing software; all these parameters are assumed to be positive.
In real life, the number of contacts of a susceptible node per unit time cannot always increase linearly with , especially when the number of infectious nodes is large [6], so for more realism, we first suppose that the saturated incidence rate is nonlinear and takes the form /(). Model (1) becomes where  is a positive function satisfying (0) = 1 and   () ≥ 0. Such function  enables the introduction of several effects, like the psychological effects (e.g., (/() = /(1 + )) see [7]).Conforming to the biological epidemic models, this effect is manifested when the number of infected nodes is very large; the infection force may decrease as the number of infections  increases.In relation to our model, in the presence of a very large number of infectious nodes, the users of computers in the network may tend to reduce the number of contacts of their computers.
In the real world, the parameters of a compartmental model are always subject of random variability that affects the dynamic of the population.There exist several types of noise that may represent the environmental random variability; many studies showed that the white noise is an appropriate representation of environmental random variability in terrestrial systems (see Steele 1985 [10]; Vasseur and Yodzis 2004 [11]).For this reason, we introduce a Gaussian white noise disturbance into this model by considering the case where the parameters  and  are subject to random fluctuations.Hence, by using the technique of parameter perturbation, which represents the commonly used procedure in constructing SDE models (e.g., Zhang et al. [4], Ji et al. [12]), we replace  by  +  1  1 and  by  +  2  2 , where  1 () and  2 () are standard one-dimensional independent Brownian motions and  1 and  2 their intensities.The other parameters are the same as in system (1).We obtain the following stochastic system: The added value of this paper is summarized in the fact that presents a deterministic and stochastic study of a global model that takes into consideration the effect of antivirus programs in the spread of malware in a computer network.Also, it contains a global nonlinear saturated incidence rate which reflects more realism.
The remainder of this paper is as follows: in Section 2, we present some preliminary results related to the following study.We investigate in Section 3 the stability of the two equilibrium states of the deterministic system (2).In Section 4, we show that system (3) admits a global and unique positive solution, starting from the initial values ((0), (0), (0),   (0)).Next in Section 5, we give a sufficient condition for the system to be extinct.In Section 6, sufficient condition for the existence of a unique stationary distribution is obtained.We conclude in Section 7 by presenting some numerical simulations to illustrate our results.
Let () be a homogeneous Markov process in   (  denotes the -dimensional Euclidean space) and be described by the following stochastic differential equation: The diffusion matrix is defined as follows: The following lemma is used to prove the theorem related to the stationary distribution for SDE (3) (see [14] for all  ∈ R  , where  : R  → R is a function integrable with respect to the measure .

Equilibrium Analysis and Global Stability of Equilibria
The basic reproduction number is the number of secondary infectious cases produced by an infectious individual during his or her effective infectious period when introduced in a population of susceptibles [15].For model (2) the basic reproduction number is where R  acts as a sharp threshold between extinction and invasion of the disease.Proof.System (2) has the virus-free equilibrium state  0 (/( + ), 0, /( + ),  0 ); this equilibrium is obtained by giving  = 0 (i.e., absence of infection).The positive virus-epidemic equilibrium state is the solution of the following system (equivalent to system (2), except  ̸ = 0): Substituting  and   by their expression in the first equation of system (12), we get the following equation of : since   ≥ 0, then Λ is decreasing.Moreover, we have Thus and also, we have (0) = 1; then where Λ is decreasing; then (15) and (16) imply that Λ has a unique positive zero if and only if R  > 1.
The following theorem gives sufficient conditions for the global stability of equilibria of model (2).Theorem 3. If R  ≤ 1, then the virus-free equilibrium state  0 is globally asymptotically stable.While if R  > 1, then the virus-epidemic equilibrium state  * is globally asymptotically stable.
For the stability of the virus-epidemic equilibrium state  * , we refer the reader to Remark 13 in Section 6.
Remark 4. Theorem 3 showed that the basic reproductive number R  acts as a sharp threshold determining when the disease (i.e., spread of computer viruses) becomes endemic for model (2).Furthermore, the disease is permanent with simple dynamics whenever R  > 1.

Existence and Uniqueness of the Global Nonnegative Solution
The solution ((), (), (),   ()) of (3) presents the sizes of susceptible nodes, infected nodes, protected nodes, and antivirus programs used to clean the network at time , respectively.Then, they should all be nonnegative.For this reason, and to study the dynamical behavior of system (3), the first concern is whether the solution is of global and positive existence.

Extinction
One of the main interests of epidemiology is how to control the disease dynamics so that it will be eliminated in a long term.In this section, we shall establish sufficient conditions for the extinction of viruses in the stochastic model of computer network alimented by a system of antivirus software (3).(36) Proof.Let V() = ()+() and Φ(V) = (1+V)  , where  > 0 will be chosen later.Using Itô's formula, we get where Let  > 0 such that  − (( − 1)/2) 2 1 fl  > 0; then so and let 0 <  < ; we have and thus where here thus from ( 42) in addition to this result, V is continuous, which implies that there exists a constant  > 0, such that with (47), we can proceed as in [8] to complete the proof.(48) Proof.Let  1 = ∫  0 ()/(()) 2 () and  > 2. By using the Burkholder-Davis-Gundy inequality [13] and (47), we have Let  be an arbitrary positive constant; then according to Chebyshev's inequality we have an application of Doob's martingale inequality, and the Borel-Cantelli lemma [13]   This completes the proof of Lemma 7.
Proof.By application of Itô's formula to system (3) we get and then ln  ≤ ln  (0) where 2 therefore, by dividing both sides of (64) by , we obtain Using the strong law of large numbers [13], we obtain lim →∞ ( 1  1 ()/) = 0, a.s., and by (Lemma 7), we have lim taking the limit superior of both sides of (65) and the condition  2 < 2

Stationary Distribution and Positive Recurrence
The following theorem investigates the stability in a stochastic sense; it gives a sufficient condition for the existence of an asymptotically invariant distribution for the solution of model ( 3).The proof is based on Lemma 1 and uses the Lyapunov function method.However, there exist some other methods to investigate the stationary distribution, like the method based on the Markov semigroups theory (see Rudnicki and Pichór [17], Lin et al. [18]).Furthermore, some other authors have given the explicit expression of the density of the stationary distribution through solving the Fokker Planck equation of their proposed model (see Buonocore et al. [19], Xu [20]).
Theorem 10.Consider the stochastic system (3) with positive initial value; suppose that R  > 1 and where Then the solution (, , ,   ) is positive recurrent and admits a unique ergodic stationary distribution.Remark 11.One can see that condition (68) can be verified for sufficiently small environmental noises  1 and  2 .In fact, we have lim Proof.We consider the Lyapunov function  defined for where  1 ,  2 ,  3 ,  4 , and  5 are positive functions defined for (, , ,   ) ∈ R 4 + by and  1 ,  2 ,  3 ,  4 , and  5 are well defined in (70).By applying the differential operator  to  1 , we obtain At the equilibrium state  * ( * ,  * ,  * ,  *  ), we get  * −  * = 0; then An application of the inequality ( + ) 2 ≤ 2( 2 +  2 ) for all (, ) ∈ R 2 yields For the function  2 , we have (78) at the equilibrium state  * we have  −  * −  * −  * −  * = 0; hence Therefore Now, we calculate  3 At the equilibrium state  * , we have we have at the equilibrium state  * ,  * /( * )−−− *  = 0; hence As a result as well, by letting condition (68) hold, and considering a positive constant   such that we have lies entirely in R 4 + .We can take as  any neighborhood of the ellipsoid such that  ⊂ R 4 + , where  is closer to .Thus, (, , ,   ) ≤ −(  − ) for any (, , ,   ) ∈ R 4 + \; this implies that condition (B2) of Lemma 1 is satisfied.Condition (B1) of the same lemma remains to be verified.The diffusion matrix associated with system (3) is given by Since  is a bounded open subset that lies entirely in R 4 + , then for all (, , ,   ) ∈   33 (, , ,   ) =  2  1  2 ≥ min where ] is a positive constant; condition (B1) is met.Consequently we have shown conditions (B1) and (B2) of Lemma 1.

Discussions and Numerical Simulations
In this section, we present some numerical simulations to support our theoretical results.Throughout the following numerical simulations, we choose () = 1 + 2 2 .
Using the above parameters we have R  = 1.15 > 1, which implies from Theorem 3 that model (2) stabilizes at the virus-epidemic equilibrium state  * .Figure 1(b) illustrates this case.
2 = 0.2 < 2 2 2 ( +  +  2 1 /2) = 1.47, (lim →∞ ((ln )/) ≤ −0.99 a.s.).Theorem 8 shows that the disease dies out under large white noise disturbances  1 and  2 .The numerical simulation in Figure 1(a) supports this result; () represented by the green color tends to zero almost surely.Frequency Frequency Frequency Frequency The parameters in Example 15 are chosen to verify the conditions of Theorem 10.Using these parameters, we have R  = 3.41 > 1 and the intensities  1 and  2 are small enough.Thus, there exists a unique ergodic stationary distribution for system (3).The following simulations illustrate this result.
The red lines represent the densities of each stochastic variable (), (), (), and   (), respectively, while the blue ones represent the densities of each deterministic variable.Based on these lines and their corresponding histograms, we can observe the existence of a stationary distribution.The result implies that small intensities of the Brownian motions will strengthen the stability of the system.

Conclusion
In the real world, problems are not deterministic, including stochastic effects into a model that may give more accuracy to investigate and study phenomena.In this paper, we have studied the stability of a deterministic model powered by a system of antivirus programs and with general nonlinear incidence rate.We have next considered a stochastic version of this system with noises introduced in the rate at which nodes are crashed due to reasons other than the attacks of viruses  and the transition rate .We first proved the existence and positivity of a unique global solution of this model.Then, with this system of antivirus programs, we investigate the extinction of viruses, we have proved that, under large noise intensities  1 and  2 , the number of infected nodes () tends to zero exponentially almost surely, and thus the disease dies out with probability one; Figure 1(a) illustrates this case.We have also proved that system (3) has the ergodic property as R  > 1 and the fluctuations are very small.Numerical simulations in Figure 2 are carried out to illustrate this theoretical result.
Also, it is interesting to investigate the stochastic persistence in mean.Furthermore, we may study a stochastic version of (3) including Markovian switching into all parameters [23].These studies are in progress.