Modeling and Analysis of Bifurcation in a Delayed Worm Propagation Model

A delayed worm propagation model with birth and death rates is formulated. The stability of the positive equilibrium is studied. Through theoretical analysis, a critical value í µí¼ 0 of Hopf bifurcation is derived. The worm propagation system is locally asymptotically stable when time delay is less than í µí¼ 0. However, Hopf bifurcation appears when time delay í µí¼ passes the threshold í µí¼ 0 , which means that the worm propagation system is unstable and out of control. Consequently, time delay should be adjusted to be less than í µí¼ 0 to ensure the stability of the system stable and better prediction of the scale and speed of Internet worm spreading. Finally, numerical and simulation experiments are presented to simulate the system, which fully support our analysis.


Introduction
In recent years, Internet is undoubtedly one of the fastest increasing scientific technologies, which brings about convenience in people's daily work and changes people's life in variety of aspects.With rapid development of network applications and the increase of network complexity, security problems emerge progressively.Among them, the problem of Internet worms has become the focus with its wide infection range, fast spread speed, and tremendous destruction.Enlightened by the researches in epidemiology, plenty of models have been constructed to predict the spread of worms and some containment strategies have been taken into consideration.In addition, birth and death rates are widely applied in epidemiology because individuals in the ecological system may die during the spread of diseases.Meanwhile baby individuals are born everyday and join the ecological system [1][2][3].In the computer science field, computers are like individuals in an ecological system.As a result of being infected by Internet worms or quarantined by intrusion detection systems (IDS), hosts will get unstable and unreliable which will result in system reinstallation by their owners.Besides, when many new computers are brought, most of them are preinstalled with operating systems without newest safety patches.Furthermore, old computers are discarded and recycled at the same time.These phenomena are quite similar to the death and birth in epidemiology.Thus, in order to imitate the real world, birth and death rates should be introduced to worm propagation model.
Quarantine strategies have been exploited and applied in the control of disease.The implementation of quarantine strategy in computer field relies on the IDS [4].The IDS include two major categories: misuse intrusion detection and anomaly intrusion detection system.The anomaly detection system is commonly used to detect malicious code such as computer virus and worms for its relatively better performance [5,6].Once a deviation from the normal behavior is detected, such behavior is recognized as an attack and appropriate response actions, such as quarantine or vaccination, are triggered.
Mechanism of time window was brought in IDS in order to balance the false negative rate and false positive rate [7].The introduction of time window is used to decide whether an alarm is a true or false positive based on the number of abnormal behaviors detected in a time window.It implies that the size of time window affects both the number of true positive and false positive rates.However, the import of the time window leads to time delay.Therefore, in order to accord

Related Work
Due to the high similarity between the spread of infectious biological viruses and computer worms, some scholars have used epidemic model to simulate and analyze the worm propagation [8][9][10][11][12][13][14].For instance, Staniford first constructs the propagation of Internet worms by imitating epidemic propagation models, called simple epidemic model (SEM) model [9].susceptible-infected-removed (SIR) model plays a significant role in the research of worm propagation model [10].On the basis of SIR model, Zou et al. propose a worm propagation model with two factors on Code Red [11].Ren et al. give a novel computer virus propagation model and study its dynamic behaviors [12].Mishra and Pandey formulate an e-epidemic SIRS model for the fuzzy transmission of worms in computer network [13].L.-X.Yang and X. Yang investigate the propagation behavior of virus programs and propose that infected computers are connected to the Internet with positive probability [14].Mathematical analysis and simulation experiment of these models are conducted, which are helpful to predict the speed and scale of Internet worm propagation.In addition, to our knowledge, the use of quarantine strategies has produced a great effect on controlling disease.Enlightened by this, quarantine strategies are also widely used in worm containment [15][16][17][18].Yao et al. construct a worm propagation model with time delay under quarantine, and its stability of the positive equilibrium is analyzed [15,16].Yao also proposes a pulse quarantine strategy to eliminate worms and obtains its stability condition [17].Wang et al. propose a novel epidemic model which combines both vaccinations and dynamic quarantine methods, referred to as SEIQV model [18].
Furthermore, some scholars have done some researches on time delay [19][20][21].Dong et al. propose a computer virus model with time delay based on SEIR model [19].By proposing an SIRS model with stage structure and time delays, Zhang et al. perform some bifurcation analysis of this model [20].Zhang et al. also consider a delayed predator-prey epidemiological system with disease spreading in predator population [21].In addition, the direction of Hopf bifurcations and the stability of bifurcated periodic solutions are studied, which are our extension direction in the future research.[22], as the basis of our research.

Worm Propagation Model
The KM model assumes that all Internet hosts are in one of three states: susceptible state (), infectious state (), and removed state ().And hosts can only maintain one state at any given moment.Infectious hosts are converted from susceptible hosts by a worm infection and can shift to removed state through killing worms by antivirus softwares and installing safety patches.Once patches are installed, the hosts can no longer be infected by worms.The state transition diagram of the KM model is given in Figure 1.
() denotes the number of susceptible hosts at time , () denotes the number of infectious hosts at time , and () denotes the number of removed hosts at time .The total number of hosts in the network is  and remains constant. is infection rate at which susceptible hosts are infected by infectious hosts, and  is recovery rate at which infectious hosts get recovered.The KM model can be formulated by a set of differential equations from the state transition diagram as follows: Although KM model adopts recovery feature and does generate some braking containment effect on the worm propagation, it only describes the initial stage of worm propagation and does not control the outbreaks of worms.More suppression strategies should be taken to further control the worm propagation.

The Worm Propagation Model with Quarantine Strategy.
Quarantine strategy, which relies on the intrusion detection system, is an effective way to diminish the speed of worm propagation.On the basis of the KM model, quarantine   2.
In this model, vaccinated state equals to removed state in KM model, and () denotes the number of vaccinated hosts at time .Susceptible hosts can be infected by worms with an infection rate  due to their vulnerabilities.After infection, the hosts become infectious hosts, which means the hosts can infect other susceptible hosts.The hosts can be directly patched into the vaccinated state before getting infected at rate .By applying misuse intrusion detection system for its relatively high accuracy, we add a new state called quarantine state, but only infectious hosts will be quarantined.() denotes the number of quarantine hosts at time .Infectious hosts will be quarantined at rate  which depends on the performance of intrusion detection systems and network devices.When infectious hosts are quarantined, the hosts will get rid of worms and get patched at rate .Meanwhile, infectious hosts can be manually patched into vaccinated state at recovery rate .It can be perceived that if a host is patched, it has gained immunity permanently.
The differetial equations of this model are given as ( The total number of this model is set to  = 1, which means the sum of hosts in all four states is equal to one; that is () + () + () + () = 1.Then, the infection-free equilibrium of this model and its stability condition will be studied.
The first, second, and third equations in system (2) have no dependence on the last one; therefore, the last one can be omitted.System (2) can be rewritten as a three-demensional system Due to the infection-free state which the system holds in the end, the number of infectious hosts is equal to 0. Obviously, the number of susceptible hosts and number of quarantined hosts are both equal to 0, because all of the hosts in the network will get patched at last, no matter which way the hosts take.Thus the infection-free equilibrium point  * (0, 0, 0) of system (3) can be obtained.Since () =  − () − () − (), the infection-free equilibrium of the model with quarantine strategy is  * (0, 0, 0, ).
Although all infectious hosts in quarantine model convert to vaccinated hosts, in other words, worms have been eliminated, it is hardly appropriate for real world situation.Actually, not all the hosts will convert to vaccinated hosts, and no-patch hosts are still existing in the network and suffering high risk of worm attack.In addition, considering that hosts are consumer electronic products, the recycling of old hosts happens frequently every day.In order to imitate the facts in the real world, birth and death rates must be taken into consideration.
Additionally, due to the time windows of intrusion detection system, which decreases the number of false positives, time delay should be considered to accord with actual situation.Therefore, in the next section, the new model is proposed.

The Delayed Worm Propagation Model with Birth and
Death Rates.By adding time delay, along with birth and death rates, the delayed worm propagation model with birth and death rates is presented.Figure 3 shows the state transition diagram of the delayed worm propagation model with birth and death rates.
In this model, the total number of hosts denoted by  is divided into five parts.Compared with quarantine model, a new state, delayed state, is added.The hosts do not have the ability to infect other susceptible hosts but are not quarantined yet.Therefore, a new state is needed to represent these hosts.() denotes the hosts in delayed state at time .Furthermore, the hosts in susceptible, infected, quarantined, and removed states have the same rate  to leave the network.If the hosts are quarantined by IDS, some of applications may not access to network because their ports are occupied by worms.At this moment, the users would like to reinstall OS and leave the network system.Thus, the birth and death rates are correlative to the number of infectious hosts and quarantined hosts in the network system.And the rate  is The hosts in delayed state are not likely to leave the network, accounting for the activeness of these hosts.The newborn hosts enter the system with the same rate , of which a portion 1 −  is recovered by installing patches instantly at birth.This differs from the transition denoted by , because the hosts are vaccinated at the time of entering the network by installing patched operating system.The transition  represents the rate by which those susceptible in the network get vaccinated by installing patches later.The delayed differential equations are written as Other notations are identical to those in the previous model.To understand them more clearly, the notations in this model are shown in Table 1.
Proof.From system (5), according to [23], if all the derivatives on the left of equal sign of the system are set to 0, which implies that the system becomes stationary, we can get Substituting the value of each variable in (8) for each of ( 6), then we can get: After solving this equation with respect to  * , a solution of  * is obtained Thus, if ( 1 ) is satisfied, (10) has one unique positive root  * , and there is one unique positive equilibrium  * ( * ,  * ,  * ,  * ,  * ) of system (5).The proof is completed.
According to (6),  =  −  −  −  − , and thus system (5) can be simplified to The Jacobi matrix of (11) about  * ( * ,  * ,  * ,  * ,  * ) is given by where The characteristic equation of that matrix can be obtained by where Let Then Theorem 2. The positive equilibrium  * is locally asymptotically stable without time delay, if the following holds: where is satisfied.
Proof.If  = 0, then (14) reduces to Because  0 +  0 = 0, equation ( 19) can be further reduced to According to Routh-Hurwitz criterion, all the roots of (20) have negative real parts.Therefore, it can be deduced that the positive equilibrium  * is locally asymptotically stable without time delay.The proof is completed.
(ii) If the conditions (a) and (b) are not satisfied, then all roots of (14) have negative real parts for all  ≥ 0.
It is assumed that the coefficients in ℎ() satisfy the condition as follows: Then, according to lemma in [15], it is known that (26) has at least a positive root  0 ; namely, the characteristic equation ( 14) has a pair of purely imaginary roots ± 0 .
In view of the fact that (14) has a pair of purely imaginary roots ± 0 , the corresponding   > 0 is given by eliminating sin() in (21): Let () = V() + () be the root of ( 14) so that V(  ) = 0 and (  ) =  0 are satisfied when  =   .Lemma 5. Suppose that ℎ  ( 0 ) ̸ = 0.If  =  0 , then ± 0 is a pair of simple purely imaginary roots of (14).In addition, if the conditions in Lemma 3 are satisfied, then This signifies that there exists at least one eigenvalue with positive real part for  >   .Differentiating both sides of (14) with respect to , it can be written as where Λ =   It follows the hypothesis ( 3 ) that ℎ  ( 2 0 ) ̸ = 0. Therefore, transversality condition holds and the conditions for Hopf bifurcation are satisfied when  =   , according to Hopf bifurcation theorem [24] for functional differential equations.Then the following results can be obtained.Theorem 6. Suppose that the conditions ( 1 ) and ( 2 ) are satisfied.
Theorem 2 implies to us that when birth and death rates and the mechanism of time window in intrusion detection system are considered, the length of time window is crucial for the stability of the propagation process.When time delay is less than the threshold  0 , the system will stabilize at its infection equilibrium point, which is beneficial to further implement containment strategies to eliminate worms.However, when time delay is greater than the threshold, the system will be unstable and undergo a bifurcation.Although the propagation of worm presents a periodical phenomenon, in real world, complicated environment may make the propagation pass the critical state and reach to an unpredictable chaos.

Numerical and Simulation Experiments
4.1.Numerical Experiments.The parameters of the delayed model will be chosen properly, according to the stability of the positive equilibrium, bifurcation analysis, and the practical environment.500,000 hosts are picked as the population size, and the worm's average scan rate is  = 4000 per second.The worm infection rate can be calculated as  = /2 32 = 0.4657 [11], which means that average 0.4657 hosts of all the hosts can be scanned by one host.The infection ratio is  = /2 32 = 0.0000053.The rest of the parameters are  = 0.03,  0 = 0.026,  = 0.00001,  = 0.56,  = 0.0009, and  = 0.99.Initially, (0) = 50, which means that there are 50 infectious hosts while the rest of the hosts are susceptible at the beginning.Figure 4 shows the curves of five kinds of hosts when  = 5 <  0 .All of the five kinds of hosts get stable within 4 minutes, which illustrates that  * is asymptotically stable.It implies that the number of infectious hosts maintain a constant level and thus can be predicted.Further strategies can be developed and utilized to eliminate worms.But when time delay  gets increased and then reach the threshold  0 ,  * will lose its stability and a bifurcation will occur.Figure 5 shows the susceptible, infected, and recovered hosts when  >  0 .In this firgure, we can clearly see that the number of infectious hosts will outburst after a short period of peace and repeat again and again but not in the same period.
In order to see the influence of time delay,  is set to a different value each time with other parameters remaining the same.Figure 6 shows the number of infected hosts in the Figure 7 gives the four curves in four coordinates.In these two figures, the impact of time delay on infected hosts is evident.Initially, the four curves are overlapped which means that time delay has little effect in the initial stage of worm propagation.With the increase of time delay, the curve begins to oscillate.When time delay passes through the threshold  0 , the infecting process gets unstable.Then simultaneously, it can be discovered that the amplitude and period of the number of infected hosts get increased.
Figure 8(a) shows the projection of the phase portrait of system (5) when  = 15 <  0 in (, , )-space.The curve converges to a fixed point which suggests that the system is Figure 8(b) shows the projection of the phase portrait of system (5) when  = 25 >  0 in (, , )-space.The curve converges to a limit circle which implies that the system is unstable.Figures 8(c) and 8(d) show the phase portraits of susceptible () and infected () as  = 15 <  0 and  = 25 >  0 , respectively.

Simulation Experiments.
The discrete-time simulation is an expanded version of Zou's program simulating Code Red worm propagation and has been modified to run on a Linux server.The system in our simulation experiment consists of 500,000 hosts that can reach each other directly, which is consistent with the numerical experiments, and there is no topology issue in our simulation.At the beginning of simulation, 50 hosts are randomly chosen to be infectious and the others are all susceptible.
Identical with the results of numerical experiments, Figure 9 shows all five kinds of hosts when  = 5 <  0 .We find that the model will reach a stable state after a short period of time, which suggests that the number of infetious hosts can be predicted and we can develop further strategy to eliminate worms.
When time delay increases but is less than the threshold derived from theoretical analysis, the number of infectious hosts and other hosts present a damped oscillation and finally reach an approximately stable state.Figure 10 shows the number of five kinds of hosts when  = 15 <  0 .An interesting result is that the number of each host maintain a slight random vibration.However, the overall amplitude is only 0.273% to the population size, and the maximum amplitude is only 0.953% to the population size.The reason why this phenomenon occurs is due to the random events in simulation experiments.The implement of transition rates of the model is based on probability.That is to say, when the removal rate of infectious hosts is set to 0.03, it means that the probability of transition from infectious hosts to vaccinated state is 3%; it also means that infectious hosts get patched with probability of 3%.To investigate this phenomenon, phase portrait of   susceptible () and infected () is depicted when  = 15 <  0 as shown Figure 11.It shows that the curve is converged to a fixed point, which means that the system gets stable.When time delay passes the threshold, a bifurcation appears.Figure 12 shows the number of susceptible, infectious and vaccinated hosts when  >  0 .Figure 13 shows the difference between simulation and numerical results of susceptible and infectious hosts, respectively.In this figure, the periods of these two curves are well matched, which suggests that the results of numerical and simulation experiments are identical.But there is a difference of 9.6% of total population size in amplitudes.This mainly results from the precision of experiments.The number of hosts in numerical experiments can be either integers or decimals because it is the solution of differential equations.However, in simulation experiments, the number of hosts must be integers.Furthermore, when the number of infectious hosts are very little, this tiny difference will result in a big gap afterwards.

Conclusions
In order to accord with actual facts in the real world, time delay generated by time window in IDS is introduced to construct the worm propagation model.Dynamic birth and death rates are considered in this paper, accounting for the reinstallation of OS which users are more likely to do after when the hosts suffer worm's destruction or quarantined to the Internet.In addition, combined with birth and death rates, time delay may lead to bifurcation and make the worm propagation system unstable.
In this paper, a delayed worm propagation model with birth and death rates is studied.Next, the stability of the positive equilibrium is analyzed.Through theoretical analysis and numerical and simulation experiments, the following conclusions can be derived.(ii) The worm propagation system is stable when time delay  <  0 .In this situation, the worm propagation can be easily predicted and eliminated.
(iii) A bifurcation emerges when time delay  ≥  0 , which means the worm propagation is unstable and may be out of control.
Consequently, time delay  should remain less than  0 by decreasing the time window in IDS, which is helpful to predict the worm propagation and even eliminate the worm.
In this paper, we have only discussed the cases which satisfy conditions ( 1 ), ( 2 ), and ( 3 ).But for cases that satisfy ( 1 ), ( 2 ), and ( 3 ), the dynamical behavior of this model has not been studied.These issues will be studied and discussed in our future work.

Figure 1 :
Figure 1: State transition diagram of the KM model.

Figure 2 :
Figure 2: State transition diagram of the quarantine model.

Figure 3 :
Figure 3: State transition diagram of the delayed model.

Figure 4 :
Figure 4: Worm propagation trend of the model when  <  0 .

Figure 7 :
Figure 7: The number of () when  is changed.
The projection of the phase portrait in (, , )-space when  <  0 The projection of the phase portrait in (, , )-space when  >  0 The phase portrait of susceptible () and infected () when  <  0 The phase portrait of susceptible () and infected () when  >  0

Figure 9 :
Figure 9: Simulation result of the five kinds of hosts when  <  0 .

Figure 10 :
Figure 10: Simulation result of the five kinds of hosts when  = 15.
(i) The introduction of time window in IDS may lead to time delay in worm propagation model, which results in bifurcation.The critical time delay  0 where the bifurcation appears is obtained.

Figure 13 :
Figure 13: The comparison of numerical and simulation experiments.
3.1.The Simple Worm Propagation Model.Realizing the similarities between Internet worms and biological viruses in propagation characteristics, classical epidemic models have been applied to the research of worm propagation models.Initially, we introduce a simple propagation model, the Kermack Mckendrick model (KM model)

Table 1 :
Notations in this paper.