Modeling the Effect of External Computers and Removable Devices on a Computer Network with Heterogeneous Immunity

. This paper intends to investigate the impact of external computers and removable devices on virus spread in a network with heterogeneous immunity. For that purpose, a new dynamical model is presented and discussed. Theoretical analysis reveals the existence of a unique viral equilibrium that is locally and globally asymptotically stable with no criteria. This result implies that eﬀorts to eliminate viruses are not possible. Therefore, sensitivity analysis is performed to have more insight into parameters’ impact on virus prevalence. As a result, strategies are suggested to contain virus spread to an acceptable level. Finally, to rationalize the analytical results, we execute some numerical simulations.


Introduction
Virus propagation in networks is one of the areas of focus in computer science due to the rapid developments in network applications. A computer virus is a type of malware that transmits its harmful code by copying itself into programs and applications. After a computer is infected with these copies of malicious code, the infection spreads to other computers when transferring the infected host file from one computer to another. e most common ways to spread viruses are through e-mail attachments, visiting an infected website, viewing an infected ad, or clicking on an infected executable file. Also, the infection spreads while communicating with already infected external computers or removable storage devices, such as USB and hard drives. According to the Internet Security reat Report, 1 in 10 URLs analyzed in 2018 were identified as malicious, rising from 1 in 16 URLs in 2017. Moreover, they found that spam levels continued to increase as 55% of e-mails received in 2018 were spam [1].
Computer virus research and development projects are still ongoing in government, industry, and academia. Today, antivirus and firewall software are the most effective protection measures to safeguard computer systems. However, the latest updates of antivirus programs are sometimes unable to detect a new virus, and therefore the development of antivirus programs, in turn, is lagging behind the development of the virus.
e assumption in the previous models is that when connecting computers for the first time to the Internet, they are uninfected. In fact, infected computers are very likely to be online and offline. For this reason, other models have incorporated the offline reality for all types of computers: susceptibles, infected, and recovered. ey refer to a computer of any type which is not connected to the Internet as an external computer. e models in [21][22][23] are formulated by considering external computers as a compartment, therefore dividing the population of computers into susceptibles, infected, and externals (SIES). On the other hand, the models in [24,25] do not contain a single compartment for external computers, but rather each compartment exits (offline) and enters (online) the model at a specific rate. All of these models studied the influence of external infected computers on virus spread. In addition, some models included the effect of removable media as well ( [23][24][25]).
In this paper, a new model is proposed to investigate the dynamics of virus propagation regarding the effect of external computers and removable devices. Our model accounts for the heterogeneity of susceptible computers. Because network security is highly dependent on users, susceptible computers are divided into two subcompartments based on user awareness [17]. Computers with users of high-security awareness are strongly protected, while computers with users of low-security awareness are weakly protected. We study the dynamics of this model thoroughly. Qualitative analysis shows that the proposed model admits a unique viral equilibrium, which is globally asymptotically stable similar to those models in [21][22][23][24][25]. is implies that no elimination of viruses on the Internet is possible. Consequently, parameter analysis is performed to suggest strategies to contain virus prevalence. e layout of the study is as follows: e model is formulated in Section 2, where notations and assumptions are described. In Section 3, the equilibrium point is obtained, and its stability is investigated. To substantiate the qualitative results, we illustrate numerical simulations in Section 4. Moreover, parameter analysis is performed to examine the influencing parameters that affect the steady level of infected computers. Finally, Section 5 gives a brief conclusion.

Mathematical Model
We assume that, for every pair of computers on the network, the Internet provides a Peer-to-Peer Service (P2P). Consequently, there is no need for a central server to share files between computers. Online computers are identified as internal, whereas offline computers are considered to be external. Moreover, computers with capable installed security software are strongly protected; otherwise, they are weakly protected. We shall abbreviate computers as nodes.
According to our model, the total number of nodes, N, is divided into four compartments: S, W, I, E. Here, S represents strongly protected susceptible nodes that are protected by up-to-date antivirus software. W represents weakly protected susceptible nodes that have weak antivirus software or no security software installed. I represents infective nodes that are currently infected by the virus and can transmit it to susceptible nodes. Lastly, E represents external nodes that are disconnected from the Internet. Let S(t), W(t), I(t), and E(t) denote the number of strongly protected, weakly protected susceptible, infected, and external nodes at time t, respectively. us, N(t) � S(t) + W(t) + I(t) + E(t).
e dynamics of the model is illustrated in Figure 1. e models' notations are summarized in Table 1.
We base our model on the following assumptions: (H1) e total number of computers is constant.
(H2) An antivirus program that has latest updates intalled is strong enough to keep the S-node immune from viruses. (H3) Every node is out of use at a rate of μ. (H4) W-node is infected when contacted with an infected node with probability β per unit time. (H5) An infected removable device infects W-node at a rate of θ. (H6) S-node goes to W-node with the rate α when its antivirus software is expired or does not have latest updates installed. (H7) When W-node is installed by updated antivirus software, it becomes S-node with rate ε. (H8) Infected node is recovered with a rate of c, owing to efficient antivirus software. (H9) All newly accessed computers are external. (H10) An internal node becomes offline at a rate of σ. (H11) An external node is either an S-node, a W-node, or an infected node before it becomes online. (H12) When connecting an external node to the Internet, the node transfers to either an S-node, a W-node, or an infected node with rates η 1 , η 2 , η 3 , respectively.
Under the above assumptions, the dynamical model can be represented by the following system of nonlinear ordinary differential equations: From assumption (H1), the total number of computers is constant (N 0 ); that is, N(t) � W(t) + S(t) + I(t) + E(t) � N 0 for all t ≥ 0. us, we can normalize model (1) by setting the state variables as follows: W � (W/N), S � (S/N), I � (I/N), and E � (E/N). Consequently, model (1) has the equivalent form: with initial conditions S(0) ≥ 0, W(0) ≥ 0, I(0) ≥ 0, and (2) can be reduced to 2 International Journal of Differential Equations Solving the third equation of system (3), we get lim t⟶∞ E(t) � E * . System (3) can be reduced to the limiting system [26].   Internet entry rate from external node to the infected nodes Hour − 1 η 2 Internet entry rate from external node to W-nodes Hour − 1 η 3 Internet entry rate from external node to S-nodes Hour − 1 μ Natural crashing and out-flux rate of nodes

Theorem 1. For system (5), there exists a positively invariant set
Proof. First, we evaluate is implies that all solutions that are nonnegative remain nonnegative for t ≥ 0.
Next, if we combine the first and second equations of system (5), we get where k � min(ε, c). e above inequality can be rewritten as where F � W + I. Using the integrating factor method, we multiply both sides of the above inequality by (e (k+α+σ+μ)t ), and we get Integration over time interval [0, t] gives is implies that is proves that all solutions of system (5) are bounded. Hence, Ω is positively invariant.

Mathematical Analysis of the Model
In this section, we find the equilibrium point of model (5) and examine its stability both locally by linearization method [27] and globally by using the generalized Poincare-Bendixson theorem [28].
To find the equilibrium point, we equate the rates in system (5) to zero; that is, Clearly, system (5) has no feasible virus-free equilibrium. Solving system (13), we find that the system has a unique endemic equilibrium point Eq � (W * , I * ), where Here, Since a > 0 and c < 0, then , which leads to I * > 0. As a result, W * > 0. Consequently, Eq always exists.

Theorem 2.
Eq is locally asymptotically stable with respect to Ω.
Proof. First, we linearize system (5) by evaluating the Jacobian matrix at the equilibrium Eq � (W * , I * ): To find the eigenvalues, we solve the following characteristic equation: where Clearly d, e > 0; therefore, all the eigenvalues have negative real parts. Hence, Eq is locally asymptotically stable. □ Lemma 1. System (5) admits no periodic orbit with respect to Ω.
(ii) Case 2: and W ≠ 0, I ≠ 0; then we have is implies that the orbit, in this case, is either pointed into the region Ω or tangent to the zΩ at this point. Note that k � min(ε, c). Hence, we conclude that there is no periodic orbit that passes through a point on zΩ.
□ Now, we state the following theorem. Theorem 3. Eq is globally asymptotically stable with respect to Ω.
Proof. By combining the generalized Poincare-Bendixson theorem [28] with eorem 2 and Lemmas 1 and 2, the global asymptotic stability of Eq is proved.

Numerical Simulations and Analysis
In this section, we support the analytical results by illustrating some numerical examples. It is concluded that our model admits a unique viral equilibrium and has no virus-free equilibrium.
is means that any effort to eliminate viruses cannot succeed. For this reason, we examine the effect of the parameters on the equilibrium number of infected computers to keep this number as minimum as possible.
In the following examples, we demonstrate numerical experiments by assigning parameters to values empirically.
us, the dependency of E * on the parameters is stated in the following theorem.

Theorem 4.
e following hold true for E * in system (3): (i) E * remains unchanged with parameters: θ, ε, α, c, and β (ii) E * is increasing with parameters: σ and μ (iii) E * is decreasing with parameters: η 1 , η 2 , and η 3 Now, solving the two equations in (13) for I * and using (3) yield where Implicit differentiation of I * in (23) with respect to any parameter, say p, gives  where Δ 6 � 2I * Δ 1 + Δ 2 E * + Δ 3 . We investigate the dependency of I * on the models' parameters in the case where Δ 6 > 0. Accordingly, we have the following: (i) Parameter θ: Since I * ∈ Ω, then Using this and (4), we get (ii) Parameter ε: Here, we have used the fact that the equilibrium point E q � (W * , I * ) satisfies the second equation in (13). (iii) Parameter α: Again, we have used the fact that the equilibrium point E q satisfies the second equation in (13). (iv) Parameter c: (v) Parameter β: Again, since I * ∈ Ω, then International Journal of Differential Equations (vi) Parameters μ and σ: (vii) Parameter η 1 : (viii) Parameter η 2 : (ix) Parameter η 3 : Hence, we state the following theorem.
Theorem 5. If Δ 6 > 0, then the following statements hold true for I * in system (5): (i) I * is increasing with the parameters: θ, α, and β (ii) I * is decreasing with the parameters: ε and c (iii) I * is increasing or decreasing with σ and μ according to Δ 7 > 0 or Δ 7 < 0 (iv) I * is increasing or decreasing with η 1 according to Δ 8 > 0 or Δ 8 < 0 (v) I * is increasing or decreasing with η 2 according to Δ 9 > 0 or Δ 9 < 0 (vi) I * is increasing or decreasing with η 3 according to Δ 10 > 0 or Δ 10 < 0 Next, we fix all values of the models' parameters to 0.1. en we simulate the variation of the steady virus prevalence (I * ) with each parameter at a time by allowing this parameter to take the values from 0 to 1. Figure 4 illustrates the rise in I * with parameters: θ, α, β, η 1 , and η 2 . We see that I * increases to the largest value as η 1 increases, that is, as the rate of connecting infected external nodes to the Internet increases. On the other hand, Figure 5 demonstrates the decline in I * with parameters: ε, c, σ, μ, and η 3 . By comparing the effects of these parameters on I * , c is the one that decreases I * to the lowest value. is means that as the recovery rate of infected nodes increases, I * decreases to a minimum value. e simulations are consistent with eorem 5 for the parameters: θ, ε, α, c, and β. As for the other parameters, the simulations are intuitively consistent. Furthermore, Figure 6 illustrates the effect of η 1 and θ on I * . We see that I * reaches a larger value with increasing η 1 than with increasing θ. A similar effect is shown in Figure 7 with the parameters η 1 and β. is points out the impact of connecting an infected external computer to the Internet. As shown in the figures, virus spread accelerates when external infected computers are connected to the Internet, much higher than the virus spread caused by removable devices or infected internal computers. On the contrary, Figure 8 shows a decline in the size of I * as the parameters c and σ increase. However, with increasing c, the size of I * is less than that with increasing σ. is means that although disconnecting all types of computers from the Internet drops the level of infected internal computers, recovering infected computers on the Internet had a better result. Figure 9 demonstrates the effect of user awareness toward computer immunization against viruses on virus 8 International Journal of Differential Equations spread. We find that weak immunization (α) increases the spread of the virus, unlike strong immunization (ε). Besides, we observe in Figure 10 that strong immunization compared to disconnecting computers from the Internet is a better strategy for reducing virus prevalence.
From the sensitivity analysis, we conclude that infected external computers will pose a more significant threat to internal computers than infected removable devices. Moreover, the critical parameters to control the breakout of viruses are c, the recovery rate of infected computers; ε, the rate of weak computers becoming strong; and σ, the Internet disconnection rate.
Based on this analysis and the simulation results, we propose the following suggestions to reduce the virus spread: (i) Improving users' awareness to keep their computers strongly protected with up-to-date antivirus helps in reducing the w-node conversion rate α and increasing the s-node conversion rate ε. (ii) Disconnecting computers from the Internet whenever they are unused (i.e., increasing the disconnection rate σ) helps in reducing the spread of viruses. (iii) Recovering infected computers (c) by reinstalling well-known real-time security software helps in reducing virus spread. (iv) Running antivirus software on external computers before connecting to the Internet helps in reducing  International Journal of Differential Equations η 1 . Similar action performed on removable devices reduces θ.

Conclusion
In this work, a new deterministic model has been proposed to study the effect of external computers and removable storage on the dynamics of computer viruses with heterogeneous immunity. In reality, the immunization of computers depends on users' awareness. A thorough analytical investigation of the model was carried out, and numerical inspections followed to confirm the analytical results. Also, a sensitivity analysis was executed to find the impact of the models' parameters on virus propagation. We conclusively list some of the main results of the model: (i) Model (5) produced a unique viral equilibrium point (E q ) and admitted no virus-free equilibrium. E q always exists with no conditions. (ii) e viral equilibrium E q is locally and globally asymptotically stable with no criteria. (iii) Since E q always exists, then any attempt to eradicate viruses from the network is not possible. However, efforts to lower the virus prevalence may be accomplished. (iv) Sensitivity analysis revealed the parameters that limit the spread of the virus; they are ε, c, σ, μ, and η 3 . (v) However, the parameters θ, α, β, η 1 , and η 2 increase virus prevalence. (vi) Analytical results are in good agreement with numerical simulations. (vii) External infected computers were found to be the greatest threat to computer networks.
Several suggestions have been made to contain virus spreading, specifically, elevating user awareness to regularly protect computers with updated antivirus, disconnecting computers when not in use, restoring internal infected computers, and checking external computers and removable devices before connecting to a network.
is study may be extended by assuming different disconnection rate for each node and, thus, enabling the examination of the effect of disconnecting only infected computers from the Internet on virus spread.

Data Availability
No data were used to support this study.

Conflicts of Interest
e authors declare that they have no conflicts of interest.