Research Article Adaptive Human Behavior in a Two-Worm Interaction Model

Transcription

1 Discrete Dynamics in ature and Society Volume 22, Article ID , 3 pages doi:.55/22/ Research Article Adaptive Human Behavior in a Two-Worm Interaction Model Li-Peng Song,, 2 Xie Han,, 2 Dong-Ming Liu, and Zhen Jin 3 Department of Computer Science and Technology, orth University of China, Shanxi, Taiyuan 35, China 2 ational Key Laboratory for Electronic Measurement Technology, orth University of China, Shanxi, Taiyuan 35, China 3 Department of Mathematics, orth University of China, Shanxi, Taiyuan 35, China Correspondence should be addressed to Zhen Jin, jinzhn@263.net Received 8 July 22; Accepted 8 October 22 Academic Editor: Bimal Kumar Mishra Copyright q 22 Li-Peng Song et al. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited. The complex interactions among internet worms have great impact on the dynamics of worms. To contain the propagation of worms, it is necessary to characterize these interactions. Therefore, a two-worm interaction model is presented in this paper. Different from previous researches, we have considered the influence of adaptive human reaction stirred by one cooperative worm on the other worm in the model. The model s equilibria and their stability conditions are obtained mathematically and verified by simulations. Results indicate that considering adaptive human behavior significantly changes the prospective propagation course of worms and that this consideration has implications for designing counterworm methods.. Introduction owadays, malware including worms, viruses, botnets et al. is prevalent on the internet, which has led to serious problems to the security of internet. For example, more than one hundred million web-based infections are detected by Kaspersky Lab in February 22. According to Crandall et al. 2, the fight against malware, which is often viewed as an arms race, is quickly becoming unsustainable as so many malware samples are collected each day. However, malware has also created a complex environment for itself. Understanding the effects of interactions of malware with other malware and with its environment may suggest new defense methods that give fundamental advantages to the defender. Mathematical models have been proposed to characterize the spreading of malware. Han and Tan 3 analyzed the influence of time delay on computer virus by using a susceptible-infected-recovered-susceptible model. They obtained the critical value of time delay

2 2 Discrete Dynamics in ature and Society which determined whether the model had periodic solution or not. Song et al. 4 presented a model focusing on the worms spreading via both Web-based scanning and removable devices. They found that the existence of infected removable devices was in favor of the outbreak of worms, and limiting the number of removable devices would prevent the worms outbreak. In 5, Mishra and Pandey focused on the vertical transmission of worms in computer network. Ren et al. 6 presented a novel model and analyzed the effect of antivirus ability. Different from other models, the ability of anti-virus software in their model was dependent on the number of infected computers. Some other models 7 have also been given in recent year. However, all of these studies have focused on one type of malware. Tanachaiwiwat and Helmy proposed the first model focusing on the interactions between two types of competitive worms, to our knowledge. In 2, Song et al. presented an interaction model between two different types of botnets and analyzed the influences of the strategies selected by interacting botnet owners on the propagation of both botnets. In this paper, we present a two-worm model to analyze the influence of one cooperative worm on the other worm. Different from previous models, 2, the influence of adaptive human behavior stirred by the cooperative worm has been included in the model. Our work is motivated by the phenomenon that many worms cooperative worms, e.g., -Worm.Win32.Bagle.p, -Worm.Win32.Roron.2, and so on can block the antivirus software and the firewall, which will be beneficial to the spreading of other worms 3 but may lead to people s reaction to the infection state. The remainder of this paper is organized as follows. In Section 2, we present the model and interpret the actual meanings of the model s parameters. Then, we give the analytical results in Section 3 and validate the analytical results using various simulations in Section 4. After that, we summarize our results in Section Model Description The basic model used in this paper is the susceptible-infected-susceptible SIS model 4. To depict the interactions between one cooperative worm and the other worm, here named as noncooperative worm, we enhance the model by dividing the infected compartment into three parts. Thus, the model, presented here, includes four compartments: susceptible computers S, computers infected by worm cooperative worm I computers that are currently infected by the cooperative worm and are susceptible to the noncooperative worm; computers infected by worm2 noncooperative worm I 2 computers that are currently infected by some noncooperative worm and are susceptible to the cooperative worm, and computers infected by both worms I 2. Here, we assume that the anti-virus software and the firewall will be blocked whenever computers are infected with the cooperative worm. We also assume that a computer s anti-virus software and firewall are always open unless stopped by the cooperative worm. Let β and β 2 denote the susceptible computer s infection rates due to the successful scanning of a computer infected with the cooperative worm and the successful scanning of a computer infected with the noncooperative worm, respectively. To model the influence of anti-virus software and firewall, an increasing factor in infection rate is given by μ μ > while trying to infect a computer with its anti-virus software and firewall closed. As in 2, 5, when the operating system was reinstalled, infected computers would return to the susceptible state. Here, we denote the random reinstallation rate as δ. We also assume an increasing in the reinstallation rate whenever a computer is infected with

3 Discrete Dynamics in ature and Society 3 the cooperative worm. It is reasonable since the cooperative worm will block the anti-virus software and firewall, and this may stimulate user s reaction to the invasion of malware. For simplicity, let δ δ >δ be the rate which combines the random reinstallation rate and the reinstallation rate caused by user s adaptive behavior. The probability of successfully finding a susceptible computer in one scan is S/, where is the total number of computers considered. Then, β S/ and β 2 S/ are the susceptible computer s infection numbers per time step caused by a computer infected with the cooperative worm and the noncooperative worm, respectively. Thus, the model is given below: S β S I I 2 β 2S I 2 I 2 δ I I 2 δi 2, I β S I I 2 μβ 2I I 2 I 2 δ I, I2 β 2S I 2 I 2 β I 2 I I 2 δi 2, I2 μβ 2I I 2 I 2 β I 2 I I 2 δ I 2, 2. where S I I 2 I 2. ote that the model is conservative for total computers since we do not include both new computers and obsolete computers in 2.. Then, the model can be rewritten as I β I I 2 I 2 I2 β 2 I I 2 I 2 I I 2 μβ 2I I 2 I 2 δ I, I 2 I 2 β I 2 I I 2 δi 2, I2 μβ 2I I 2 I 2 β I 2 I I 2 δ I The initial state of the system 2.2 is set to I I, I 2 I 2,andI 2 I 2, where S I I 2 I 2. The values of S, I, I 2,andI 2 are given in the simulation section. 3. Model Analysis 3.. Equilibria The equilibria of system 2.2 are given by β I I 2 I 2 I I 2 μβ 2I I 2 I 2 δ I, 3.a β 2 I I 2 I 2 I 2 I 2 β I 2 I I 2 δi 2, 3.b μβ 2 I I 2 I 2 β I 2 I I 2 δ I 2. 3.c

4 4 Discrete Dynamics in ature and Society Let R be the basic reproduction number, the number of secondary infections deriving from a single primary infection, of the cooperative worm, and R 2, R2 be the basic reproduction numbers of the noncooperative worm when the cooperative worm dies out or exists, respectively. Then, we have R β δ, 3.2 R 2 β 2 δ, 3.3a R 2 β [ 2 δ μi β δ δ )] β δ δ ), δ 3.3b where I b 2 4ac b, 3.4 2a and a μβ 2 β μβ μδ μδ /β, b μ β δ δ 2δ /β μβ 2 δ,and c δ β δ δ β δ /β β 2. As the derivations of R and R2 are very simple, we only give the derivation of R2 here. Adding 3.a to 3.c leads to I I 2 δ β 3.5 or I I R 2 means that the cooperative worm exists. Thus, we only consider the condition when I I 2 δ /β. Using this condition in 3.b and 3.c, weget β2 δ β ) 2I 2 I 2 I 2 β δ δ ) I 2, β ) μβ2 I δ I 2 I 2 β I This yields β β 2 I 2 β 2 δ μβ 2 I β δ δ ) β δ δ ) δ. 3.8 According to the right hand side of 3.8, we can get the term of R 2. Furthermore, 3.4 can be obtained by substituting I 2 in 3.8 into 3.a.

5 Discrete Dynamics in ature and Society 5 For the simplified system 2.2, there always exists a disease-free equilibrium,, for I,I 2,I 2.IfR > andr2 <, there exists an equilibrium δ /β,,, corresponding to the cooperative worm endemic equilibrium. If R < andr2 >, the noncooperative worm endemic equilibrium, δ/β 2, will exist. The coexistence endemic equilibrium I,I 2,I 2 occurs if R > andr2 >, where I is the same as in 3.4, I 2 β [ 2 δ μi β δ δ )] δ β δ δ ), β β 2 I 2 δ β I. 3.9 Thus, 3.3a and 3.3b give the noncooperative worm s existence thresholds when the cooperative worm dies out or exists, respectively, that is, to ensure the existence of noncooperative worm, β 2 must be greater than the threshold value δ predicted by R 2 cooperative worm dies out or the threshold value β δ δ δ / δ μi β δ δ predicted by R 2 cooperative worm exists Stability Theorem 3.. If R < and R2 stable. <, then the disease-free equilibrium,, is asymptotically Theorem 3.2. If R > and R2 <, then the cooperative worm endemic equilibrium δ /β,, is asymptotically stable. Theorem 3.3. If R < and R2 >, then the noncooperative worm endemic equilibrium, δ/β 2, is asymptotically stable. Theorems 3., 3.2,and3.3 are easy to be proven. Here, we only give the detailed proof of the stability of coexistence endemic equilibrium I, I 2, I 2. Let b 3 Y 3 Y2, 3. 3a β st where a 4μ 2, b 2μ 2 δ 8μ 2 δ δ, c 4μ 2 δ δ 3δ δ, d 4μ 2 δ δ δ 2, A b 2 3ac, B bc 9ad, C c 2 3bd,andY,2 Ab 3a B ± B 2 4AC /2. Theorem 3.4. If R >, R2 >, and β >β st, then the coexistence endemic equilibrium I, I 2, I 2 ) is asymptotically stable.

6 6 Discrete Dynamics in ature and Society Proof. The Jacobian matrix of system 2.2 at the coexistence endemic equilibrium is given by Jac I ),I 2,I 2 β 2I I 2 ) 2I 2 μβ 2 I I 2 β 2 I 2 2) I β I 2 β I 2 μβ 2 I I 2 β I 2) I μβ2 I β 2I I 2 ) 2I 2 δ μβ 2I β 2 I 2I 2 ) 2I 2 β I I 2 ) β I I 2) μβ2 I β 2 I 2I 2 2I 2 δ β I 2 β I 2 μβ 2I δ ). 3. By means of similarity transformation upon the matrix 3., we have Jac I,I 2 2),I β δ β 2 I 2 I 2) β I 2 β I 2 μβ 2 I I 2 β 2 I 2I 2 ) 2I 2 β δ δ β δ μβ 2I β 2 I I 2 ) I 2 μβ 2 I I 2 ) I 2. δ 3.2 The characteristic equation of 3.2 is given by ) [ ] λ β δ λ 2 a 22 a 33 λ a 22 a 33 a 23 a 32, 3.3 where a 22 β 2 I 2I 2 2I 2 / β δ δ, a 23 β 2 I I 2 I 2 /, a 32 β δ μβ 2 I /,anda 33 μβ 2 I I 2 I 2 / δ. In 3.3, λ β δ, which is less than zero as R >. Then, we only need to prove that the eigenvalues in the square brackets of 3.3 have negative real parts. According to the Hurwitz criteria 6, H a 22 a 33, H 2 a 22 a 33 a 22 a 33 a 23 a

7 Discrete Dynamics in ature and Society 7 It is easy to see that a 33 < and [ β2 I a 22 a 33 a 23 a 32 2I 2 ) ) 2I 2 μβ2 I β δ δ I 2 ) ) I 2 δ β 2 I I 2 ) I 2 β δ μβ 2I ) ] μβ 2 I [ I 2 β2 2I 2I 2 β 2 β δ δ δ ] μ ) ) β 2 β δ δ ) δ μβ 2I μβ 2 I [ I 2 β2 2I 2I 2 > μβ 2 I I 2 μβ 2 I I 2 a 22. δ β I 2 β 2 β δ δ δ ] μ [ β2 2I 2 2I 2 I ) ] β δ δ Thus, H > andh 2 > provided that a 22 <. Consider a 22 β 2 I 2I 2 ) 2I 2 β δ δ β 2 2β 2 I I 2 β 2I β δ δ β 2 2 [ δ β I 2 /) ) ] δ /β μ I δ β 2I β 2 2 [ β δ δ ) μi / δ ) ) /β 2 δ /β μ β 2 β 2I 2δ μβ 2 I δ β I ) β δ δ ) 2δ β β δ δ δ ] μβ 2 / ) I 2 AI ) 2δ /β 2 β δ δ ) ) δ /β μi β 2I ) β δ δ ) 2δ μ β δ δ μβ2 / ) μ β δ δ ) ) /β I 2 BI ) δ /β 2 β δ δ ) ) δ /β μβ2 μβ μδ μδ ) ) /β I 2 δ I ) δ /β 2 β δ δ ) ) δ /β, μi μi

8 8 Discrete Dynamics in ature and Society where A denotes μ β δ δ 2δ /β μβ 2 2δ and B denotes μ β δ δ 2δ /β μβ 2 δ.as μβ 2 / μ β δ δ /β I 2 μ β δ δ 2δ /β μβ 2 δ I δ /β 2 β δ δ δ /β /μi, we have μβ2 μβ μδ μδ ) ) /β I 2 δ I a 22 ) δ /β 2 β δ δ ) ) δ /β μi μβ2 μβ μδ μδ ) ) ) /β C δ /β 2 β δ δ ) )) δ /β D μi ) δ /β 2 β δ δ ) ) δ /β D < 3.7 μi δ β δ δ ) ) δ /β δ 2 β /4μ μβ μδ μδ ) μβ 2 I δ ] [aβ 4μ 2 β β δ δ ) 3 μβ 2 I bβ2 cβ d, where C denotes I δ β /2μβ 2 μβ μδ μδ 2 and D denotes δ 2 β /4μβ 2 μβ μδ μδ and where a, b, c,andd are the same as in 3.. According to the root extracting formula, the equation, aβ 3 bβ2 cβ d, has one positive real root β st. Furthermore, for any β,ifβ >β st, then aβ3 bβ2 cβ d>. As R > andβ >β st can guarantee a 22 <, according to the text mentioned above, a 22 < can guarantee that both H and H 2 are greater than zero, which means that both eigenvalues in the square brackets of 3.3 have negative real parts. Thus, if R >, R2 > and β >β st, there exists a coexistence endemic equilibrium, and it is asymptotically stable. The proof is completed. 4. Simulation In this paper, we use the improved Euler method to simulate the system 2.2. Inthe simulation, the total number of computers is set to. The initially infected computers with cooperative worm I, the initially infected computers with noncooperative worm I 2, and the initially infected computers with both worms I 2 are set to,, and, respectively, for all simulations. Thus, the initially susceptible computers S are Here, we first give the convergence proof of the numerical method used in the simulation. Let I I,I 2,I 2, a three-dimensional vector. Then, the system 2.2 can be rewritten as I f t, I, where f is a three-dimensional vector function in R 4. It is obvious that f is a continuous and differential function in R 4.Thus,f satisfies the Lipschitz condition, and we have f t, I f t, I 2 L I I 2, where L is a constant. The Euler iteration equation is I k n I n h/2 f t n, I n f t n, I k n, where k,, 2,..., I n I n hf t n, I n,andn,, 2,... h t n t n, representing the step value in the Euler iteration algorithm. Then, I k n I k n h f 2 hl 2 t n, I k n I k n I k n ) ) f t n, I k n

9 Discrete Dynamics in ature and Society 9 ) hl 2 I k 2 n I k 2 n ) hl k I 2 n I n. 4. Thus, the Euler iteration algorithm used in this paper is convergent as we can ensure that hl/2 < by selecting the step value h. To validate the accuracy of the thresholds predicted by 3.3a and 3.3b, we simulated the model 2.2 using four sets of variables: i the cooperative worm exists: β.48, δ.46, β 2.264, and δ.25, ii no cooperative worm: β., δ.46, β 2.264, and δ.25, iii the cooperative worm exists: β.48, δ.46, β 2.288, and δ.3, and iv no cooperative worm: β., δ.46, β 2.288, and δ.3. μ is set to.5 for these simulations. ote that in i β is less than the existence threshold.285 predicted by 3.3b. Thus, the noncooperative worm will die out although β 2 is greater than the existence threshold.25 predicted by 3.3a. Similar results can also be reached with the other three sets of variables. Figure shows the simulation results of the noncooperative worm using the first two sets of variables. Figure 2 shows the simulation results using another two sets of variables. As shown in Figure, when the cooperative worm exists and R 2 <, the noncooperative worm dies out; when the cooperative worm terminates and R 2 >, the noncooperative worm survives. In Figure 2, when the cooperative worm exists and R 2 >, the noncooperative worm survives; when the cooperative worm terminates and R 2 <, the noncooperative worm dies out. Thus, both Figures and 2 demonstrate that the simulation results are consistent with the theoretical prediction. Figures and 2 also show that the cooperative worm has dual influences on the noncooperative worm, which is different from our intuition. In Figure, the existence of cooperative worm i contains the propagation of noncooperative worm. However, the existence of cooperative worm iii favors the propagation of noncooperative worm in Figure 2. To get the effective noncooperative worm containment strategy, we further explore the influence of adaptive human behavior δ on the noncooperative worm. We simulated with various δ and calculated the thresholds of β 2 predicted by R 2 andr2. Figures 3 a, 3 b,and3 c plot the results with μ.2,.5 and 2, respectively. According to Figures 3 a, 3 b, and3 c, adaptive human behavior reflected by δ has great influence on the propagation of noncooperative worm. The threshold dash line increases rapidly with the increase of δ no matter what value μ is. Moreover, when δ.4, the thresholds dash line in all figures are much higher than the corresponding values solid line when no human behavior is considered the cooperative worm dies out, which also means a promising worm-counter-worm method. We also verified the accuracy of coexistence endemic equilibrium s stability thresholds given by Theorem 3.4. Here, the simulation parameters are set to i β.36, δ.46, β 2.3, δ.25, and μ 2 where β is greater than β st.346, and ii β.8, δ.46, β 2.3, δ.25, and μ 2 where β is less than β st. Figures 4 a and 4 b show the simulation results.

10 Discrete Dynamics in ature and Society I + I2)/ Time hour) β =.48,δ =.46, β 2 =.264, and δ =.25 β =.,δ =.46, β 2 =.264, and δ =.25 Figure : Fraction of computers infected with noncooperative worm: i green: the cooperative worm exists and R 2 < and ii blue: the cooperative worm dies out and R2 > I + I2)/ Time hour) β =.48,δ =.46, β 2 =.288, and δ =.3 β =.,δ =.46, β 2 =.288, and δ =.3 Figure 2: Fraction of computers infected with noncooperative worm: iii green: the cooperative worm exists and R 2 > and iv blue: the cooperative worm dies out and R2 <.

11 Discrete Dynamics in ature and Society Threshold of β δ Predicted by R 2 = Predicted by R 2 = a Threshold of β δ Predicted by R 2 = Predicted by R 2 = b Threshold of β δ Predicted by R 2 = Predicted by R 2 = c Figure 3: Thresholds of β 2 predicted by 3.3a and 3.3b with β.24 and δ.595, and a μ.2; b μ.5; c μ 2aregiven.δ is varied in the simulations. ote that the cooperative worm I I 2 δ /β is a constant with any given β and δ. Thus, we only plot the noncooperative worm s propagation process in Figures 4 a and 4 b. As shown in Figure 4 a, when β >β st, the noncooperative worm approaches a stable state. However, in Figure 4 b, when β < β st, we can see a clearly oscillatory epidemic phenomenon, which validates the conclusion of Theorem 3.4.

12 2 Discrete Dynamics in ature and Society.577 I + I2)/ a Time hour).3538 I + I2)/ Time hour) b Figure 4: Fraction of computers infected with noncooperative worm: a β >β st and b β <β st are given. 5. Conclusion Recently, the researches concerning network security and malware have focused on the fight between antimalware system and malware 3. In this paper, we have explored the interactions between one cooperative worm and the other noncooperative worm; especially we focus on the influence of adaptive human behavior, to find an inherent advantage in the fight against attackers. Different from our intuition, the results presented in this paper have shown that the cooperative worm has dual effects on the propagation of the noncooperative worm due to the existence of adaptive human behavior, which is a valuable information for defenders in designing counter-worm methods 7, 8. In the future, we plan to use real trace data to test our model and get the most effective policy to motivate people.

13 Discrete Dynamics in ature and Society 3 Acknowledgment This work is supported by the ational atural Science Foundation of China under Grant no. 734 and the atural Science Foundation of Shanxi Province of China under Grant no References Kaspersky Security Bulletin. Monthly Malware Statistics, February 22, 2 J. R. Crandall, R. Ensafi, S. Forrest, J. Ladau, and B. Shebaro, The ecology of malware, in Proceedings of the ew Security Paradigms Workshop SPW 8), pp. 99 6, September X. Han and Q. Tan, Dynamical behavior of computer virus on Internet, Applied Mathematics and Computation, vol. 27, no. 6, pp , 2. 4 L.-P. Song, Z. Jin, G.-Q. Sun, J. Zhang, and X. Han, Influence of removable devices on computer worms: dynamic analysis and control strategies, Computers & Mathematics with Applications, vol. 6, no. 7, pp , 2. 5 B. K. Mishra and S. K. Pandey, Dynamic model of worms with vertical transmission in computer network, Applied Mathematics and Computation, vol. 27, no. 2, pp , 2. 6 J. Ren, X. Yang, Q. Zhu, L.-X. Yang, and C. Zhang, A novel computer virus model and its dynamics, onlinear Analysis, vol. 3, no., pp , L. Feng, X. Liao, H. Li et al., Hopf bifurcation analysis of a delayed viral infection model in computer networks, Mathematical and Computer Modeling, vol. 56, no. 7, pp , L.-X. Yang and X. Yang, Propagation behavior of virus codes in the situation that infected computers are connected to the internet with positive probability, Discrete Dynamics in ature and Society, vol. 22, Article ID , 3 pages, Q. Zhu, X. Yang, and J. Ren, Modeling and analysis of the spread of computer virus, Communications in onlinear Science and umerical Simulation, vol. 7, no. 2, pp , 22. Y. Li, J.-X. Pan, and Z. Jin, Dynamic modeling and analysis of the virus propagation, Discrete Dynamics in ature and Society, vol. 22, Article ID 47272, 22 pages, 22. S. Tanachaiwiwat and A. Helmy, Encounter-based worms: analysis and defense, Ad Hoc etworks, vol. 7, no. 7, pp , L. P. Song, Z. Jin, and G. Q. Sun, Modeling and analyzing of botnet interactions, Physica A, vol. 39, no. 2, pp , 2. 3 Kaspersky Lab: Securelist, 4 J. D. Murray, Mathematical Biology, Springer, Berlin, Germany, W. H. Debany, Modeling the spread of internet worms via persistently unpatched hosts, IEEE etwork, vol. 22, no. 2, pp , E. A. Barbashin, Introduction to the Theory of Stability, Wolters-oordhoff Publishing, Groningen, The etherlands, S. Funk, M. Salathé, and V. A. A. Jansen, Modelling the influence of human behaviour on the spread of infectious diseases: a review, the Royal Society Interface, vol. 7, no. 5, pp , 2. 8 E. P. Fenichel, C. Castillo-Chavez, and M.G. Ceddia, Adaptive human behavior in epidemiological models, Proceedings of the ational Academy of Sciences of United States of America, vol. 8, no. 5, pp , 2.

14 Advances in Operations Research Advances in Decision Sciences Mathematical Problems in Engineering Algebra Probability and Statistics The Scientific World Journal International Differential Equations Submit your manuscripts at International Advances in Combinatorics Mathematical Physics Complex Analysis International Mathematics and Mathematical Sciences Stochastic Analysis Abstract and Applied Analysis International Mathematics Discrete Dynamics in ature and Society Discrete Mathematics Applied Mathematics Function Spaces Optimization