Modeling and Stability Analysis of Worm Propagation in Wireless Sensor Network

An improved SIRS model considering communication radius and distributed density of nodes is proposed. The proposed model captures both the spatial and temporal dynamics of worms spread process. Using differential dynamical theories, we investigate dynamics of worm propagation to time in wireless sensor networks (WSNs). Reproductive number which determines global dynamics of worm propagation in WSNs is obtained. Equilibriums and their stabilities are also found. If reproductive number is less than one, the infected fraction of the sensor nodes disappears and if the reproduction number is greater than one, the infected fraction asymptotically stabilizes at the endemic equilibrium. Based on the reproduction number, we discuss the threshold of worm propagation about communication radius and distributed density of nodes inWSNs. Finally, numerical simulations verify the correctness of theoretical analysis.


Introduction
A sensor network is composed of hundreds or even thousands of sensor nodes that are allowed random deployment in inaccessible terrains or disaster relief operations [1].Wireless sensor networks (WSNs), as a kind of new information and communication network, have gained worldwide attention owing to their potential in civil and military applications, for instance, intrusion detection, perimeter monitoring, information gathering, and smart logistics support in an unknown deployed area [2][3][4].
With widespread applications of WSNs, research on WSNs has been a hot topic.Some methods have been proposed for prolonging the lifetime of WSNs focusing on energy consumption [5][6][7], device placement [8], and topology management [9].Because sensor nodes are constrained sources, they have weak defenses and are attacking targets for worms.Injecting malware into some nodes has become a serious threat [10].Recently, malicious codes targeting wireless devices have emerged, which can spread directly from device to device using wireless communication technology, such as Wi-Fi and Bluetooth [11][12][13][14].For instance, computer worm like Cabir uses the Bluetooth interface to spread among cellphones, which means that worms have committed the wireless domain and WSNs are also extremely vulnerable to malware.
Actions of malicious objects on the Internet have been studied by using epidemical models and have provided insights for controlling worm prevalence in networks [15][16][17][18][19][20].In [15], the authors presented an E-mail virus model that accounts for behaviors of E-mail users and analyzed propagation features of E-mail viruses in different network topologies.In [16][17][18][19][20], the authors proposed epidemic models with time delay and analyzed dynamical features of worm prevalence.To effectively defend against worm intrusions, it is necessary to deeply understand dynamical features of worm propagation in WSNs.Existing research prove that epidemical models are valuable for portraying characteristics of worm propagation.Since there is a basic similarity between worm propagation through wireless devices and traditional worm spread on the Internet, the epidemical models extensively are applied to study worm spread in WSNs by some researchers in recent years [11,[21][22][23].In [21], the authors proposed a SIRS malware propagation model with feedback controller and analyzed Hopf bifurcation dynamics of malware prevalence in mobile wireless networks.
The authors in [22] presented an epidemic model with vaccination compartment which captures both the spatial and temporal dynamics of worm spread process, and some mathematical analyses and numerical simulations were performed based on this model.The common problem of the above models is that the characteristics of wireless sensor networks like energy consumption, communication radius, and distributed density of nodes have not been considered in models.In [11], the authors developed a mathematical model for the propagation that incorporates important parameters derived from the communication patterns of the protocol under test.Based on this model, the authors analyzed the propagation rate and the extent of spread of a malware over typical broadcast protocols proposed in the paper.Wang and Li derived an iSIR model describing the process of worm propagation with energy consumption of nodes in WSNs [23].Numerical simulations are performed to observe the effects of the network topology and energy consumption of nodes on worm spread in WSNs.However, the authors have not performed mathematical analyses based on this model.In fact, key parameters of affecting worm spread can be found by explicit mathematical analyses.
To better portrait the features of worm propagation in WSNs, in this paper, we study the attacking behavior of possible worms in WSNs by constructing an improved SIRS epidemic model.In this model, the following three factors are considered: (i) energy consumptions of nodes; (ii) communication radius of nodes; and (iii) distributed density of nodes in WSNs.Based on this model, we analyze the stability of worm prevalence through finding the equilibriums of model.
The rest of this paper is organized as follows: in Section 2, we analyze topology of WSNs and present the model formulation.Section 3 derives the equilibriums of the model and discusses the stability of worm propagation at the equilibriums.In Sections 4 and 5, numerical simulations are performed to verify the correctness of theoretical analyses and some conclusions are given, respectively.

The Proposed Model
2.1.System Description.We model a wireless sensor network composed of  nodes.The nodes are uniformly distributed in  ×  area (nodes average density is  = / 2 ) and the wireless communication range of every node is .The topological structure of a WSN is shown in Figure 1.
Based on the existing  epidemic model [24,25], the nodes in WSNs are classified into three states: (i) Susceptible state (): nodes in  have not been infected by worms, and these nodes are vulnerable to worms in WSNs.
(ii) Infected state (): nodes have been infected by worms and have the ability to infect other nodes in WSNs.
(iii) Recover state (): nodes have installed a detection tool that can identify and remove worms, or nodes have installed a software patch to eliminate the node vulnerability exploited by worms.We consider the following state transitions among these three states: (i) Users may immunize their nodes with countermeasures in states  and  with probabilities  and , respectively.
(ii) As the energy of nodes is exhausted, some nodes become dead nodes with probability .
(iii) Infected nodes  infect susceptible  with effective infection rate .
(iv) Some recovered nodes may become susceptible nodes with probability .
Transition relationships among node states are described in Figure 2.

Model Derivation.
The communication area of a node is denoted by   , and the density of susceptible nodes in a unit area in WSNs is denoted by ().Then the following equations hold: From (1), we can get According to state transition relationships in Figure 2, the mathematical model of worm propagation in WSNs can be derived as follows: For convenience, let Then, system (3) can be written as (5)

Stability Analysis of Equilibriums
In this section, we will find the equilibriums of system (5) and investigate their stability.The equilibriums of system (5) are given by solutions of Let ()() − ( + ) = 0 (the second equation of ( 6)); we have  * = 0 or  * > 0 and  * = ( + )/.For the case of  * = 0, we have worm-free equilibrium For the case of  * > 0, we have endemic equilibrium Let Notably, the endemic equilibrium is meaningful only if  0 > 1.

Worm-Free Equilibrium and Its Stability
Lemma 1.The worm-free equilibrium is locally asymptotically stable if  0 < 1 and unstable if  0 > 1.
Furthermore, the following theorem holds.

Theorem 2. The worm-free equilibrium is globally asymptotically stable if 𝑅
Proof.From the first equation of system ( 5 So, we prove that worm-free equilibrium  0 is globally asymptotically stable.
From the above discussion, we can summarize the following conclusion.Lemma 3. If  0 > 1, then endemic equilibrium is locally asymptotically stable.
Note that the number of nodes in WSNs is relatively stable; that is, at time , the number of nodes (), (), and () in states , , and , respectively, satisfies Hence, the dynamics of system ( 5) is equivalent to the Clearly, when  0 > Now, we state and prove a result on the global stability of the endemic equilibrium ( * 1 ,  * 1 ) of system (19).
Proof.Consider the following Lyapunov function [28]: The time derivative of () along the solution of system ( 19) is given by The proof is completed.

Worm Propagation Threshold Analysis and Numerical Simulations
We have proved that the basic reproductive number  0 equaling zero is the threshold whether worms are eliminated.When  0 ≤ 1, worms in WSNs can be eliminated, and system (5) will stabilize at worm-free equilibrium.When  0 > 1, worms in WSNs will exist consistently, and system (5) will stabilize at the endemic equilibrium.For verifying the correctness of theoretical analysis, we perform worm propagation threshold analyses and numerical simulations from the following two sides.
When  = 2.5 <   and  = 1.6 <   , Figures 4(a) and 4(b) indicate that system (5) stabilizes at the wormfree equilibrium, and worm propagation is controlled finally.Simulation results are consistent with theoretical analysis.
When  = 6.944 >   and  = 10 >   , Figures 4(c) and 4(d) show that the trajectories converge to the endemic equilibrium.The conclusions agree with theoretical analysis.

Conclusions
In this paper, we have proposed an improved SIRS model for analyzing dynamics of worm propagation in WSNs.This model can describe the process of worm propagation with the energy consumption and different distributed density of nodes.Based on this model, a control parameter  0 that completely determines the global dynamics of worm propagation has been obtained by the explicit mathematical analyses.From Theorems 4 and 2, we learn out that worm will be controlled in WSNs when  0 < 1, and they will be prevalent otherwise.Finally, based on  0 , we discuss the threshold of worm propagation about communication radius and distributed densities of nodes in WSNs.Numerical simulations verify the correctness of theoretical analysis.Research results show that decreasing the value of communication radius or reducing distributed density of nodes is an effective method to prevent worms spread in WSNs.Research of this paper provides the theoretical basis for predicting and controlling worm propagation in WSNs.It is worth pointing out that we do not consider physical effects like "collisions" and heterogeneous distribution of nodes on infection rate when modeling, which is our focus in the future.

Figure 1 :Figure 2 :
Figure 1: The topology structure of a WSN.