Nonlinear Analysis: Real World Applications

Transcription

1 Nonlinear Analysis: Real World Applications 11 (21) Contents lists available at ScienceDirect Nonlinear Analysis: Real World Applications journal homepage: Fuzzy epidemic model for the transmission of worms in computer network Bimal Kumar Mishra a,, Samir Kumar Pandey b a Department of Applied Mathematics, Birla Institute of Technology, Mesra, Ranchi, , India b Department of Applied Mathematics, Ramchandra Chandravansi Institute of Technology, Bishrampur, Palamau, , India a r t i c l e i n f o a b s t r a c t Article history: Received 3 February 21 Accepted 1 May 21 Keywords: Epidemic model Worms Fuzzy sets/logic Computer network Fuzzy reproductive number An e-epidemic SIRS (susceptible infectious recovered susceptible) model for the fuzzy transmission of worms in computer network is formulated. We have analyzed the comparison between classical basic reproduction number and fuzzy basic reproduction number, that is, when both coincide and when both differ. The three cases of epidemic control strategies of worms in the computer network low, medium, and, high are analyzed, which may help us to understand the attacking behavior and also may lead to control of worms. Numerical methods are employed to solve and simulate the system of equations developed. 21 Elsevier Ltd. All rights reserved. 1. Introduction The growth of Internet technology has thrown severe challenges in form of requirement of a suitable cyber defense system to safeguard the valuable information stored on system and for information in transit. Towards this goal it makes us necessary to study and understand the different type of worms and develop mathematical models to represent their behavior. Worms behave like infectious diseases and are epidemic in nature. A computer worm is a self contained program that is able to spread functional copies of itself or its segment to other computer system without a dependency on another program to host its code. Model s ability to predict worm s behavior depends greatly on the assumptions made in the modeling process. The mathematical models will be generalized to represent the behavior of numerous other worms. The generalized model will be incorporated into a cyber defense system to proactively safeguard the information and information interchange. The action of worms throughout a network can be studied by using epidemiological models for disease propagation [1 1]. Based on the Kermack and McKendrick SIR classical epidemic model [11 13], dynamical models for malicious objects propagation were proposed, providing estimations for temporal evolutions of nodes depending on network parameters considering topological aspects of the network [1 3,14 17]. The kind of approach was applied to propagation schemes [18] and modification of SIR models generated guides for infection prevention by using the concept of epidemiological threshold [1 3,19]. Richard and Mark [2] propose an improved SEI (susceptible exposed infected) model to simulate virus propagation. However, they do not show the length of latency and take into account the impact of anti-virus software. The model SEIR proposed by the authors [21] assumes that recovery hosts have a permanent immunization period with a certain probability, which is not consistent with real situation. In order to overcome limitation, Mishra and Saini [1] present an SEIRS model with latent and temporary immune periods, which can reveal common worm propagation. Recently, more research attention has been paid to the combination of virus propagation model and antivirus countermeasures to study the prevalence of virus, e.g., virus immunization [3,22 26] and quarantine [27 29]. Extending the SEIRS model of [1], Mishra et al. introduced new compartment quarantine and its effect has been analyzed in [3]. Corresponding author. Tel.: addresses: drbimalmishra@gmail.com (B.K. Mishra), samir.phd29@gmail.com (S.K. Pandey) /$ see front matter 21 Elsevier Ltd. All rights reserved. doi:1.116/j.nonrwa

2 4336 B.K. Mishra, S.K. Pandey / Nonlinear Analysis: Real World Applications 11 (21) α ε γ Fig. 1. Schematic diagram for flow of worms in computer network. Transmissions of malicious objects (virus, worms, Trojans) in computer network are analogous to biological infectious diseases and are epidemic in nature. Epidemic systems, in particular those dealing with infectious diseases, have strong non-linearities and should be treated in a different way. These non-linearities are due to the fact that force of epidemic of an infectious agent, depends, among other things, on the fraction of susceptible nodes and fraction of infectious nodes. Both susceptibility and infectiousness are intrinsically fuzzy concepts and are, therefore, ideal subjects for fuzzy logic analysis. The mathematical models of transmission of worms in computer network are always subject to inaccuracies related to the nature of the state variables involved, parameters and/or initial conditions. In these models, the estimation of parameters is usually based on statistical methods, starting from data obtained experimentally to the choice of the method adapted to their identification. In this paper, we have used the concept of Fuzzy Set/Relations Theory which is an extension of the concept of a crisp set. It also deals with the techniques of computing and manipulating with fuzzy sets. Though Fuzzy epidemic models for human infectious disease have been well studied [31 39] but very few applications and research papers, using fuzzy logic, in the transmission of malicious objects in computer network exists in literature. 2. The simple SIRS model A simple classical SIRS model describe the dynamics of directly transmitted worms with interaction among susceptible, infected and recovered nodes in the computer network without neither vital dynamics (i.e. the rates of birth and mortality (reason other than attack of worms) are not considered), nor additional disease fatality rate. The Schematic diagram for the flow of worms in computer network (Fig. 1) model can be represented as: The system of differential equations of such models is given by: ds = αis + γ S di = αis εr dr = εr γ S where, S + I + R = 1, and S is the proportion of susceptible nodes, I is the proportion of infected nodes, R is the proportion of recovered nodes, α is the contact rate, ε is the recovery rate and γ is the rate of susceptible after recovery. We now suppose an extension of the SIRS model incorporating heterogeneities, considering that nodes with different amount of worms contribute differently to the worm propagation. 3. The SIRS fuzzy model We assume that the population heterogeneity is given by the worm load of infected nodes. That is, the higher the worm load, the higher will be the chance of worm transmission. We take α = α(x) measures the chance of a transmission to occur in a meeting between a susceptible and an infected nodes with an amount of worms x. Then some values of α are more possible than others and that turns α into a membership function of a fuzzy number. To obtain the membership function α, we assume when the amount of worms in a node is relatively low, the chance of transmission is negligible and that there is a minimum amount of worms x min needed to cause transmission. Furthermore, for a certain amount of worms x M, the chance of transmission is maximum and equal to one. We also suppose that the amount of worms in a node in a computer is always limited by. Then we define the following membership function, whose representation is depicted in Fig. 2 [39]. α(x) =, if x < x min x x min, if x min < x < x M x M x min 1, if x M < x <. Now, the node s recovery rate ε = ε(x) is also a function of the worm load. The higher the worm load, the longer it will take to recover from infection. i.e., ε should be a decreasing function of x (Fig. 3). That is, ε(x) = ε 1 x + 1 (4) where, ε > is the lowest recovery rate. (1) (2) (3)

3 B.K. Mishra, S.K. Pandey / Nonlinear Analysis: Real World Applications 11 (21) α (x) x min x M Fig. 2. Fuzzy coefficient of worm transmission α = α(x). ε (x) ε x Fig. 3. Recovery fuzzy rate ε = ε(x). γ (x) γ x Fig. 4. Fuzzy rate of susceptibility γ = γ (x). Now, γ = γ (x) is the rate of susceptible after recovery, that is, the recovered nodes may be susceptible again. The higher we use secondary devices and/or internet services, the higher it will be susceptible after recovery. So, it will be increasing function of x (Fig. 4) and we define this function as, γ (x) = 1 γ x where, γ > (and <1) is the lowest susceptibility rate after recovery. We also assume that the amount of worms differ in different nodes of the computer network, that is, x can be seen as a fuzzy number with a triangular shape, according to the following membership function (Fig. 5): ρ(x) = x x 1, if x [ x δ, x + δ] δ, if x [ x δ, x + δ] where the parameter x is a central value and δ gives the dispersion of each one of the fuzzy sets assumed by x. For a fixed x, ρ(x) can has a linguistic meaning such as, low, medium and so on. (5) (6)

4 4338 B.K. Mishra, S.K. Pandey / Nonlinear Analysis: Real World Applications 11 (21) ρ + Fig. 5. Membership function of the variable x, mount of the worms ρ [39]. 4. Solution and equilibrium points To study the evolution of number of infected nodes, that is, if the number of infected nodes increases indefinitely or not, we study the stability of equilibrium points. For this, from the system (1) and Eq. (2), we have ds = αis + γ S di = αis ε(1 S I). Then, for the equilibrium points, we take, ds = and di =, we get three equilibrium points P 1 (1,, ), P 2 (, 1, ) and ( ) ε(α γ ) P 3 α(γ +ε), γ α, γ (α γ ). The analysis of the stability of the system (1) shows that P α(γ +ε) 1, P 2 are unstable but P 3 (with γ α) is asymptotically stable, which indicates that even if the number of infected nodes increases (supposing initially I small), this number will stabilize in γ (α γ ) ε(α γ ). Moreover, of the population will not be affected. α(γ +ε) α(γ +ε) Now, taking into account the worm load, we have, ( ε(x)(α(x) γ (x)) P 3 = α(x)(γ (x) + ε(x)), γ (x) ) γ (x)(α(x) γ (x)),. α(x) α(x)(γ (x) + ε(x)) As γ (x) α(x) < 1, so, a value of bifurcation for x is x, the solution of the equation γ (x) = α(x) will be, x = x M + (1 γ )(x M x min ). And x min x x M. The worm load x is the value of the bifurcation of the model since for the values x < x the model has two unstable equilibrium points P 1 and P 2 and if x > x the model has an asymptotically stable point P 3. In this way, we can think of x as a parameter related to the worm control in the sense that if a worm is transmitted in some number of nodes, it should be noted that, x is not higher than x. (A) (7) 5. The basic reproduction number As we know that, the basic reproduction number (R ) is obtained through the analysis of the stability of the trivial equilibrium point. For the classical SIRS model R = α ε, that is, the worms will not be in nodes if α ε < 1 and it will be if α ε > 1. As in this case, we have taken, α = α(x) and ε = ε(x), then we write, R (x) = α(x) ε(x). To control the worm transmission, we impose max R (x) < 1. But it is better to take an average value of R (x) because it can be an extreme attitude. For this, we consider the distribution of the worm load as given by a triangular fuzzy number ρ(x). Then, we define the fuzzy basic reproduction number, R f = 1 ε FEV[ε R (x)] (8)

5 B.K. Mishra, S.K. Pandey / Nonlinear Analysis: Real World Applications 11 (21) where FEV is Fuzzy Expected Value. Note that R (x) may be greater than one but ε R (x) 1, so that the value R f is well defined. This is defined as the average number of secondary cases caused by just one infected node introduced into entirely susceptible nodes. To get FEV[ε R (x)] we need to define a fuzzy measure µ and use the possibility measure: µ(a) = sup ρ(x), A R. x A This is a measure tells that the infectivity of a group is the one presented by the node belonging to the group with the maximal infectivity. We now estimate R f assuming that the amount of worms classified as low, medium and high. The fuzzy sets given by the membership function ρ(x) for different cases are: (a) low, if x + δ < x min ; (b) medium, if x δ > x min and x + δ x M ; and (c) high, if x δ > x M. Case (a) It is quite obvious that R f < 1 if x is low. Now, to obtain R f for cases (b) and (c), since R (x) = α(x) ε(x) is an increasing function of x, then H(θ) = µ[x, ] = sup x x ρ(x), where, H(θ) = µ{i(x, t) θ} and FEV[I(x, t)] is the fixed point of H(θ) [38] and x is the solution of the α(x) equation ε ε(x) = θ. Since the fixed point of H(θ) is same as that of FEV[ε R (x)]. Case (b) By the direct calculation, we conclude that, α( x) 1 if θ ε ε( x) H(θ) = ρ(x α( x) ) if ε ε( x) < θ ε α( x + δ). ε( x + δ) α( x + δ) if ε ε( x + δ) < θ 1 Obviously, if δ >, H is a continuous and decreasing function, and in this case, we have that FEV[ε R (x)] is equal to the fixed point of H. Also, we have by direct calculation, α( x) ε x < FEV[ε R (x)] α( x + δ) < ε ε( x + δ) Case (c) As in the previous case, we conclude that, R f > 1 ε( x) > 1. or R ( x) < R f < R ( x + δ). 1 < R f ε( x) < 1 and it guarantees that the worms invade since ε( x+δ) 6. Comparison between R and R f Here we have analyzed the three cases discussed in the previous section related to the three classifications for the amount of infections: low, medium and high worm load. In any of the three cases, we have, α( x) ε( x) < FEV[ε R (x)] α( x + δ) < ε ε( x + δ) or R ( x) < R f < R ( x + δ). As the function R (x) = α(x) is continuous and curved shape based on the Intermediate Value Theorem, there is only one ˆx, ε(x) with x < ˆx < x + δ, so that: R f = R (ˆx) > R ( x). (9) It means that, there is an amount of infection ˆx where R (classical) and the R f (fuzzy) coincide. Moreover, the medium value of the number of secondary cases (R f ) is higher than the number of secondary cases due to the medium amount of infection (R ( x)). 7. Epidemic control strategies The system of Eqs. (1) is the classical mathematical model to study about the worm transmission of SIRS type in a homogeneous system of total number of nodes in computer network. Although we use such a system of equations to model the evolution of worm transmission in a heterogeneous system of nodes, such as the one presented in our model where the nodes are distinguished by the amount of infection and, consequently, they present different rates of contact α(x), of recovery ε(x) and of susceptibility γ (x). We understand (1) as a family of systems depending on the parameter x. However,

6 434 B.K. Mishra, S.K. Pandey / Nonlinear Analysis: Real World Applications 11 (21) POPULATION GROUPS- S, I AND R GRAPHS FOR THE SIR MODEL SUSCEPTIBLE INFECTED REMOVED TIME Fig. 6. Dynamical behavior of the system with α =.4, ε =.2, γ =.24. if we intend to simplify it in the sense of replacing that family of systems by a unique system of equations, with the same outcomes (that is, the same number of secondary cases) that the family as a whole, the above analysis shows that, among the different systems of families, there is one which performs this role, namely, that which parameters are α = α(ˆx), ε = ε(ˆx) and γ = γ (ˆx) and not that which represents the system of nodes with medium amount of infection ˆx. Moreover, according to (9), R ( x) as an indicator of worm control forces us to find out the correct parameter for the total number of nodes as a whole, that is R (ˆx). To justify even more the legitimacy of system (1) with the parameter ˆx, to describe the dynamics of the worms in the total number of nodes as a whole, we will study the control of the worms in the total number of nodes through R (ˆx) = R f : i. For the case where the amount of infection is low, we have ˆx < x + δ x min. Therefore R (ˆx) = and the worm will not establish itself. ii. For the case the amount of infection is high, we have ˆx > x > x + δ x M. Therefore, R (ˆx) = 1 ε( x) the worm will invade. iii. For the case of medium amount of infection we have: a. if x > ˆx then R (ˆx) = α(ˆx) ε(ˆx) < α(x ) ε(x = 1, indicating that the worm will not invade; and ) b. if x < ˆx then R (ˆx) = α(ˆx) ε(ˆx) > α(x ) ε(x = 1 indicating that the worm will invade. ) > 1, indicating that Finally, it is shown that R f is the positive solution of an equation of second degree, with characteristics that allow us to deduce and decrease the medium amount of infection, by the use of continuous run of anti-virus software, for example, and quarantine (decreasing δ) of the infected nodes. 8. Conclusion A compartmental e-epidemic model SIRS for the transmission of worms in computer network is studied. Numerical methods are employed to solve the system (A) and the behavior of the susceptible, infectious, and recovered nodes with respect to time are observed which is depicted in Fig. 6. Stability of the system can be observed from Fig. 6. The parameters, we have used to develop the system of equations, are treated as a membership function depending on x, a fuzzy number, and also the family of system depending on this fuzzy number x. Using this, we get R f (fuzzy basic reproduction number), by the help of R (classical basic reproduction number) and conclude that, by the help of Intermediate Value Theorem, there will be an amount of infected nodes in the computer network, where both R and R f coincides. We also analyzed the three cases of epidemic control strategies as, when the amount of infection will be low, worms will not be in the network, for the high amount of infection, worm will invade and for the medium amount of infection, worm may or may not invade the computer network.

7 B.K. Mishra, S.K. Pandey / Nonlinear Analysis: Real World Applications 11 (21) References [1] Bimal Kumar Mishra, D.K. Saini, SEIRS epidemic model with delay for transmission of malicious objects in computer network, Appl. Math. Comput. 188 (2) (27) [2] Bimal Kumar Mishra, Dinesh Saini, Mathematical models on computer viruses, Appl. Math. Comput. 187 (2) (27) [3] Bimal Kumar Mishra, Navnit Jha, Fixed period of temporary immunity after run of anti-malicious software on computer nodes, Appl. Math. Comput. 19 (2) (27) [4] E. Gelenbe, Dealing with software viruses: a biological paradigm, Inform. Secur. Tech. Rep. 12 (4) (27) [5] Erol Gelenbe, Keeping viruses under control, in: Computer and Information Sciences ISCIS 25, 2th International Symposium, in: Lecturer Notes in Computer Science, vol. 3733, Springer, 25. [6] Erol Gelenbe, Varol Kaptan, Yu Wang, Biological metaphors for agent behavior, in: Computer and Information Sciences ISCIS 24, 19th International Symposium, in: Lecturer Notes in Computer Science, vol. 328, Springer-Verlag, 24, pp [7] J.R.C. Piqueira, F.B. Cesar, Dynamic models for computer virus propagation, Math. Probl. Eng. doi:1.1155/28/ [8] J.R.C. Piqueira, B.F. Navarro, L.H.A. Monteiro, Epidemiological models applied to virus in computer network, J. Comput. Sci. 1 (1) (25) [9] S. Forest, S. Hofmeyr, A. Somayaji, T. Longstaff, Self-nonself discrimination in a computer, in: Proceeding of IEEE Symposium on Computer Security and Privacy, 1994, pp [1] Y. Wang, C.X. Wang, Modeling the effect of timing parameters on virus propagation, in: 23 ACM Workshop on Rapid Malcode, ACM, 23, pp [11] W.O. Kermack, A.G. McKendrick, Contributions of mathematical theory to epidemics, Proc. R. Soc. Lond. Ser. A 115 (1927) [12] W.O. Kermack, A.G. McKendrick, Contributions of mathematical theory to epidemics, Proc. R. Soc. Lond. Ser. A 138 (1932) [13] W.O. Kermack, A.G. McKendrick, Contributions of mathematical theory to epidemics, Proc. R. Soc. Lond. Ser. A 141 (1933) [14] C.C. Zou, W.B. Gong, D. Towsley, L.X. Gao, The monitoring and early detection of internet worms, IEEE/ACM Trans. Netw. 13 (5) (25) [15] J.O. Kephart, S.R. White, D.M. Chess, Computers and epidemiology, IEEE Spectr. (1993) [16] M.J. Keeling, K.T.D. Eames, Network and epidemic models, J. R. Soc. Interface 2 (4) (25) [17] Ma.M. Williamson, J. Leill, An epidemiological model of virus spread and cleanup, [18] M.E.J. Newman, S. Forrest, J. Balthrop, networks and the spread of computer virus, Phys. Rev. E 66 (22) [19] M. Draief, A. Ganesh, L. Massouili, Thresholds for virus spread on network, Ann. Appl. Probab. 18 (2) (28) [2] W.T. Richard, J.C. Mark, Modeling virus propagation in peer-to-peer networks, in: IEEE International Conference on Information, Communication and Signal Processing, ICICS, 25, pp [21] Ping Yan, Shengqiang Liu, SEIR epidemic model with delay, J. Aust. Math. Soc. Ser. B 48 (1) (26) [22] J.O. Kephart, A biologically inspired immune system for computers, in: Proceeding of International Joint Conference on Artificial Intelligence, [23] N. Madar, T. Kalisky, R. Cohen, D. Ben Avraham, S. Havlin, Immunization and epidemic dynamics in complex networks, Eur. Phys. J. B 38 (24) [24] R. Pastor-Satorras, A. Vespignani, Epidemics and immunization in scale-free networks, in: Handbook of Graphs and Network: From the Genome to the Internet, Wiley-VCH, Berlin, 22. [25] R.M. May, A.L. Lloyd, Infection dynamics on scale-free networks, Phys. Rev. E 64 (66112) (21) 1 3. [26] S. Datta, H. Wang, The effectiveness of vaccinations on the spread of -borne computer virus, in: IEEE CCECE/CCGEL, IEEE, 25, pp [27] C.C. Zou, W. Gong, D. Towsley, Worm propagation modeling and analysis under dynamic quarantine defense, in: Proceeding of the ACM CCS Workshop on Rapid Malcode, ACM, 23, pp [28] D. Moore, C. Shannon, G.M. Voelker, S. Savage, Internet quarantine: requirements for containing self-propagating code, in: Proceeding of IEEE INFOCOM 23, IEEE, 23. [29] T. Chen, N. Jamil, Effectiveness of quarantine in worm epidemic, in: IEEE International Conference on Communications 26, IEEE, 26, pp [3] Bimal K. Mishra, Navnit Jha, SEIQRS model for the transmission of malicious objects in computer network, Appl. Math. Model. 34 (21) [31] G.J. Klir, B. Yuan, Fuzzy Sets and Fuzzy Logic, Prentice Hall, Upper Saddle River, [32] E. Massad, M.N. Burattini, N.R.S. Ortega, Fuzzy logic and measles vaccination: designing a control strategy, Int. J. Epidemiol. 28 (3) (1999) [33] N.R.S. Ortega, P.C. Sallum, E. Massad, Fuzzy dynamical systems in epidemic modelling, Kybernetes 29 (12) (2) [34] K.J. Rothman, S. Greenland, Modern Epidemiology, Lippincott-Raven, Philadelphia, [35] G. Shafer, Belief functions and possibility measures, in: Bezdek J.C. (Ed.), Analysis of Fuzzy Information Mathematics and Logic, vol. 1, USA, 1987, pp [36] R.R. Yager, D.P. Filev, Essentials of Fuzzy Modeling and Control, Wiley-Interscience, New York, [37] J. Yen, R. Langari, Fuzzy Logic: Intelligence, Control, and Information, Prentice-Hall, New Jersey, [38] E. Massad, et al., Fuzzy Logic in Action: Applications and Epidemiology and Beyond, in: STUDFUZZ, vol. 232, Springer-Verlag, Berlin, Heidelberg, 28. [39] L.C. Barros, R.C. Bassanezi, M.B.F. Leite, The epidemiological models SI with a fuzzy transmission, Comput. Math. Appl. 45 (23)