Research ArticleModeling and Bifurcation Research of a Worm PropagationDynamical System with Time Delay

Yu Yao12 Zhao Zhang1 Wenlong Xiang1 Wei Yang2 and Fuxiang Gao1

1 College of Information Science and Engineering Northeastern University Shenyang 110819 China2 Key Laboratory of Medical Image Computing Northeastern University Ministry of Education Shenyang 110819 China

Correspondence should be addressed to Yu Yao yaoyumailneueducn

Received 23 March 2014 Revised 13 June 2014 Accepted 16 June 2014 Published 3 July 2014

Academic Editor Yuxin Zhao

Copyright copy 2014 Yu Yao et al This is an open access article distributed under the Creative Commons Attribution License whichpermits unrestricted use distribution and reproduction in any medium provided the original work is properly cited

Both vaccination and quarantine strategy are adopted to control the Internet worm propagation By considering the interactioninfection between computers and external removable devices a worm propagation dynamical system with time delay underquarantine strategy is constructed based on anomaly intrusion detection system (IDS) By regarding the time delay causedby time window of anomaly IDS as the bifurcation parameter local asymptotic stability at the positive equilibrium and localHopf bifurcation are discussed Through theoretical analysis a threshold 120591

0is derived When time delay is less than 120591

0 the

worm propagation is stable and easy to predict otherwise Hopf bifurcation occurs so that the system is out of control and thecontainment strategy does not work effectively Numerical analysis and discrete-time simulation experiments are given to illustratethe correctness of theoretical analysis

1 Introduction

Internet worms a great threat to the network security canspread quickly among hosts via wired or wireless networksIn real network environment many intelligent worms suchas Conficker Stuxnet and Flamer can also spread themselvesvia external removable devices (USB drives CDDVD drivesexternal hard drives etc) which have become one of themain means of infection transmission as well as networksConficker can copy itself as the autoruninf to removablemedia drives in the system thereby forcing the executableto be launched every time a removable drive is inserted intoa system [1 2] Discovered in the summer of 2010 Stuxnetis a threat targeting a specific industrial control system(ICS) likely in Iran such as a gas pipeline or power plantRemovable device is one of the main pathways for Stuxnetto migrate from the outside world to supposedly isolatedand secure ICS [3ndash5] Discovered in May 2012 Flamer canspread via removable drives using a special folder that hidesthe files and can result in automatic execution on viewingthe removable drive when combined with the Microsoft

Windows Shortcut ldquoLNKPIFrdquo File Automatic File ExecutionVulnerability (CVE-2010-2568) [6 7] Therefore it is time toanalyze the dynamic behavior and containment strategy ofsuch worms

Worm propagation dynamical system plays an importantrole in predicting the spread of worms It aids in identifyingthe weakness in the worm spreading chain and providesaccurate prediction for the purpose of damage assessment fora new worm threat Over decades of years many researcheson wormsrsquo dynamical behavior have been done Kermackand Mckendrick [8] proposed the classical SIR model toexplain the rapid rise and fall in the number of infectedpatients observed in epidemics which also suits the wormspread Based on the classical SIR model Zou et al derivedan Internet worm model called the two-factor model [9]Quarantine strategy which borrows from the method ofepidemic disease control has been widely used in wormcontainment and produced a tremendous effect on con-trolling worm propagation [10ndash14] Zou et al proposed aworm propagationmodel under dynamic quarantine defensebased on the principle ldquoassume [sic] guilty before proven

Hindawi Publishing CorporationMathematical Problems in EngineeringVolume 2014 Article ID 408183 13 pageshttpdxdoiorg1011552014408183

2 Mathematical Problems in Engineering

innocentrdquo [10] Wang et al proposed a novel epidemic modelnamed SEIQVmodel which combines both vaccinations anddynamic quarantine methods [11] However there is timedelay in actual network environment which may lead tobifurcation phenomenon Much research has been done ontime delay and bifurcation [15ndash25] Han and Tan studiedthe dynamic spread behavior of worms by incorporatingthe delay factor [19] Dong et al proposed a computervirus model with time delay based on SEIR model andregarded time delay as bifurcating parameter to study thedynamical behaviors including local asymptotical stabilityand local Hopf bifurcation [20] Yao et al constructed amodel with time delay under quarantine strategy [21] Wuet al investigated the problem of sliding mode control ofMarkovian jump singular time-delay systems [23] Li andZhang established a delay-dependent bounded real lemmafor singular linear parameter-varying systems with time-variant delay [24]The problems of D-stability and nonfragilecontrol for a class of discrete-time descriptor Takagi-Sugenofuzzy systems with multiple state delays are discussed in [25]

However the above works consider less of the effectof removable devices on worm propagation As mentionedabove removable devices have become a main pathway forsome worms to intrude those hosts not connected to theInternet Song et al presented a worm model incorporatingspecific features to worms spreading via both web-basedscanning and removable devices [26] Zhu et al studiedthe dynamics of interaction infection between computersand removable devices in [27] However time delay andbifurcation research are not considered in their work In thispaper by considering the interaction infection between hostsand removable devices we model a delayed worm propa-gation dynamical system which combines both vaccinationand quarantine strategy Local asymptotic stability of thepositive equilibrium and local Hopf bifurcation are discussedto analyze the influence of time delay on worm propagationdynamical system

The main contributions of this paper can be summarizedas follows

(1) Considering the influence of removable devices onInternet worm propagation and the time delay causedby anomaly IDS we propose a novel worm propaga-tion dynamical system with time delay

(2) We analyze the system stability at positive equilibriumand derive the time delay threshold at which Hopfbifurcation occurs

(3) By numerical analysis we illustrate the correctness oftheoretical analysis

(4) The discrete-time simulation is adopted to simulatethe worm propagation in real network environmentThe results demonstrate the reasonableness of theworm propagation model

The rest of the paper is organized as follows In Section 2considering the influence of removable devices a wormprop-agation dynamical system with time delay under quarantinestrategy is constructed In Section 3 local stability of the

positive equilibrium and local Hopf bifurcation are investi-gated In Section 4 several numerical analyses supporting thetheoretical analysis are given Section 5 makes a comparisonbetween simulation experiments and numerical ones Finallywe give our conclusions in Section 6

2 Model Formulation

The system contains both hosts and removable devices Inthis model all hosts are in one of following five statessusceptible (119878) infectious (119868) delayed (119863) quarantined (119876)and removed (119877) All removable devices are divided intotwo groups susceptible (119877

119878) and infectious (119877

119868) 119873 and 119877

119873

denote the total number of hosts and removable devicesrespectively That is 119878 + 119868 + 119863 + 119876 + 119877 = 119873 119877

119878+ 119877119868=

119877119873 Susceptible (119878) hosts which are vulnerable to the attack

fromworms will be infected by infectious hosts or removabledevices then theywill infect other hosts connected to themorremovable devices plugged into them Infectious (119868) hosts willbe immunized by antivirus software at the rate of 120574

1 Removed

(119877) hosts which have been immunized by antivirus softwarewill become susceptible at reassembly rate 120596 Hosts whosebehavior looks anomaly will be quarantined by IDS and thenthey will become in a quarantined (119876) state A susceptibleremovable device (119877

119878) will be infected when inserted into an

infectious host Worm in an infectious removable device (119877119868)

will be eliminated when connected to removed hosts then itwill become in a susceptible state

The quarantine strategy is an effective measure to defendagainst wormsrsquo attack and make up the deficiency of vacci-nation strategy In this paper anomaly intrusion detectionsystem is chosen for applying quarantine strategy Comparingwith misuse IDS anomaly IDS has great advantage in detect-ing unknown intrusion or the variants of known intrusionHowever anomaly IDS judges whether a detected behavioris an attack or not via comparing detected behavior with thenormal or expected behavior of system anduser If a deviationoccurs the detected behavior is treated as an intrusion imme-diately Because of the difficulty in collecting and building thenormal behavior database high false-alarm rate is consideredthe main drawback of anomaly IDS In order to reduce thefalse alarm of anomaly IDS the mechanism of time windowis adopted A suspicious behavior will not trigger an alarmimmediately On the contrary anomaly IDS has a periodof time to analyze the accumulated behavior Thereforean intermediate state delayed (119863) state is added into thepropagation model The larger the value of time windowthe less the false alarm aroused by anomaly IDS becausethere is enough time for anomaly IDS to recognize whether abehavior is an intrusion or not However the overlarge timewindow may lead to worm propagation dynamical systembeing unstable and out of control The main notations anddefinitions are listed in Table 1 The state transition diagramis given by Figure 1

On the basis of current research we present a delayedworm propagation model which combines both vaccinationand quarantine strategy Several appropriate assumptions aregiven as follows

Mathematical Problems in Engineering 3

Table 1 Notations and definitions of the model

Notations Definitions119873 Total number of hosts in the network119877119873

Total number of removable devices in the network119878(119905) Number of susceptible hosts at time 119905119868(119905) Number of infectious hosts at time 119905119863(119905) Number of delayed hosts at time 119905119876(119905) Number of quarantined hosts at time 119905 minus 120591

119877(119905) Number of removed hosts at time 119905119877119878(119905) Number of susceptible removable devices at time 119905

119877119868(119905) Number of infectious removable devices at time 119905

1205731

Infection ratio of infectious hosts

1205732

Contact infection rate between computers andremovable devices

1205741

Recovery rate of infectious hosts1205742

Recovery rate of infectious removable devices120596 Reassembly rate of immunized hosts1205791

Quarantine rate of susceptible hosts1205792

Quarantine rate of infectious hosts120575 Immunization rate of quarantined hosts

120591Time delay of detection by anomaly intrusiondetection system

(1) 1205731denotes the infection ratio of infectious hosts

Therefore at time t the infection force of infec-tious computers to susceptible computers is given by1205731119878(119905)119868(119905)

(2) Infectious removable devices have the same infectiousability as the infectious hosts 120573

2is the contact infec-

tion rate between computers and removable devicesthat is the interactive infection ratewhen a removabledevice links to a host The probability of connectingremovable devices for every host is 119877

119873119873 and the

probability of removable device exactly being in theinfectious state is 119877

119868(t)119877119873 Therefore the infection

force of infectious removable devices to susceptiblehosts is 120573

2(119877119873119873)(119877

119868(119905)119877119873)119878(119905)

(3) Susceptible removable devices will be infected whenconnecting to an infectious host and then theywill infect any other hosts to which they are con-nected Meanwhile worms of infectious remov-able devices will be eliminated when connectingto one immunized host That is the infectionforce of infectious hosts to susceptible removabledevices is 120573

2(119868(119905)119873)119877

119878(119905) and the recovery force

of removed hosts to infectious removable devices is1205742(119877(119905)119873)119877

119868(119905)

(4) Owing to the influence of time delay 120591 the incrementof the number of quarantined hosts is the onesquarantined at time 119905 minus 120591 Therefore the incrementis 1205791119878(119905 minus 120591) + 120579

2119868(119905 minus 120591)

(5) The timewindowmechanism leads to an intermediatestate delayed state (119863) The increment of the number

of delayed hosts at time t is given by 1205791119878(119905) + 120579

2119868(119905)

the decrement of delayed hosts is the number of thosebeing quarantined that is 120579

1119878(119905 minus 120591) + 120579

2119868(119905 minus 120591)

Based on the analyses and assumptions above the delayeddifferential equations of the model are formulated as (1) Thedifferential on the left of equations means the change rate ofrelated states at time t Consider

119889119878 (119905)

119889119905

= minus1205731119878 (119905) 119868 (119905) minus 120573

2

119877119868(119905)

119873

119878 (119905) + 120596119877 (119905) minus 1205791119878 (119905)

119889119868 (119905)

119889119905

= 1205731119878 (119905) 119868 (119905) + 120573

2

119877119868(119905)

119873

119878 (119905) minus 1205741119868 (119905) minus 120579

2119868 (119905)

119889119877 (119905)

119889119905

= 1205741119868 (119905) minus 120596119877 (119905) + 120575119876 (119905)

119889119863 (119905)

119889119905

= 1205791119878 (119905) minus 120579

1119878 (119905 minus 120591) + 120579

2119868 (119905) minus 120579

2119868 (119905 minus 120591)

119889119876 (119905)

119889119905

= 1205791119878 (119905 minus 120591) + 120579

2119868 (119905 minus 120591) minus 120575119876 (119905)

119889119877119878 (119905)

119889119905

= minus1205732

119868 (119905)

119873

119877119878 (119905) + 1205742

119877 (119905)

119873

119877119868 (119905)

119889119877119868(119905)

119889119905

= 1205732

119868 (119905)

119873

119877119878(119905) minus 120574

2

119877 (119905)

119873

119877119868(119905)

(1)

3 Stability at the Positive Equilibriumand Bifurcation Analysis

Theorem 1 The system (1) has a unique positive equilibrium119864lowast= (119878lowast 119868lowast 119863lowast 119876lowast 119877lowast 119877lowast

119878 119877lowast

119868) where

119868lowast=

1198872119878lowast2

+ 1198873119878lowast

1198874minus 1198871119878lowast

119863lowast= 1205791119878lowast120591 + 1205792119868lowast120591

119876lowast=

1205791119878lowast+ 1205792119868lowast

120575

119877lowast=

1205741119868lowast+ 1205791119878lowast+ 1205792119868lowast

120596

119877lowast

119868=

1205732119877119873119868lowast

1205732119868lowast+ 1205742119877lowast

(2)

Proof For system (1) according to [28] if all the derivativeson the left of equal sign of the system are set to 0 whichimplies that the system becomes stable we can derive

119868 =

1198872119878lowast2

+ 1198873119878lowast

1198874minus 1198871119878lowast

119876 =

1205791119878lowast+ 1205792119868lowast

120575

119877 =

1205741119868lowast+ 1205791119878lowast+ 1205792119868lowast

120596

119877119868=

1205732119877119873119868lowast

1205732119868lowast+ 1205742119877lowast

(3)

4 Mathematical Problems in Engineering

1205731SIS R

D

Q

I

1205792I

120575

1205741I

1205791S

120596

1205791S(t minus 120591)+

1205792I(t minus 120591)

RS RI

1205742(RN)R1

1205732(R1N)S

1205732(1N)RS

Figure 1 The state transition diagram

where

1198871= 12059612057311205732+ 120574112057421205731+ 120573112057421205792

1198872= 120573112057421205791 119887

3=

1205732

2120596119877119873

119873 minus 12057911205742(1205741+ 1205792)

1198874= (1205741+ 1205792) (1205961205732+ 12057411205742+ 12057421205792)

(4)

Assume that system (1) becomes stable at time 119879 By integrat-ing the fourth equation of system (1) with time 119905 from 0 to119879 + 120591 we can get

119863 = 1205791119878lowast120591 + 1205792119868lowast120591 (5)

Since 119878 + 119868 + 119863 + 119876 + 119877 = 119873

119878lowast+

1198872119878lowast2

+ 1198873119878lowast

1198874minus 1198871119878lowast

+ 1205791119878lowast120591 + 1205792119868lowast120591

+

1205791119878lowast+ 1205792119868lowast

120575

+

1205741119868lowast+ 1205791119878lowast+ 1205792119868lowast

120596

= 119873

(6)

Obviously (6) has one unique positive root 119868lowast So there is oneunique positive equilibrium119864

lowast= (119878lowast 119868lowast 119863lowast 119876lowast 119877lowast 119877lowast

119878 119877lowast

119868)

of system (1) The proof is completed

Since 119878 + 119868 + 119863 + 119876 + 119877 = 119873 119877119878+ 119877119868= 119877119873 119876 = 119873 minus 119878 minus

119868 minus 119863 minus 119877 119877119878= 119877119873minus 119877119868 System (1) can be simplified to

119889119878 (119905)

119889119905

= minus1205731119878 (119905) 119868 (119905) minus 120573

2

119877119868 (119905)

119873

119878 (119905) + 120596119877 (119905) minus 1205791119878 (119905)

119889119868 (119905)

119889119905

= 1205731119878 (119905) 119868 (119905) + 120573

2

119877119868 (119905)

119873

119878 (119905) minus 1205741119868 (119905) minus 120579

2119868 (119905)

119889119877 (119905)

119889119905

= 1205741119868 (119905) minus 120596119877 (119905)

+ 120575 (119873 minus 119878 (119905) minus 119868 (119905) minus 119863 (119905) minus 119877 (119905))

119889119863 (119905)

119889119905

= 1205791119878 (119905) minus 120579

1119878 (119905 minus 120591) + 120579

2119868 (119905) minus 120579

2119868 (119905 minus 120591)

119889119877119868(119905)

119889119905

= 1205732

119868 (119905)

119873

(119877119873minus 119877119868 (119905)) minus 120574

2

119877 (119905)

119873

119877119868 (119905)

(7)The Jacobian matrix of (7) about 119864lowast = (119878

lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) is

given by

119869 (119864lowast) =

((((

(

minus1205731119868lowastminus 1205732

119877lowast

119868

119873

minus 1205791

minus1205731119878lowast

120596 0 minus

1205732119878lowast

119873

1205731119868lowast+ 1205732

119877lowast

119868

119873

1205731119878lowastminus 1205741minus 1205792

0 0

1205732119878lowast

119873

minus120575 1205741minus 120575 minus120596 minus 120575 minus120575 0

1205791minus 1205791119890minus120582120591

1205792minus 1205792119890minus120582120591

0 0 0

0

1205732(119877119873minus 119877lowast

119868)

119873

minus

1205742119877lowast

119868

119873

0 minus

1205732119868lowast+ 1205742119877lowast

119873

))))

)

(8)

Let

1198881= 1205731119868lowast+ 1205732

119877lowast

119868

119873

1198882= 1205731119878lowast

1198883=

1205732119878lowast

119873

1198884=

1205732(119877119873minus 119877lowast

119868)

119873

Mathematical Problems in Engineering 5

1198885=

1205742119877lowast

119868

119873

1198886=

1205732119868lowast+ 1205742119877lowast

119873

1199014= 1198886minus 1198882+ 1205741+ 1205792+ 120596 + 120575 + 119888

1+ 1205791

1199013= 1198886(minus1198882+ 1205741+ 1205792) + (120596 + 120575 + 119888

1+ 1205791) (1198886minus 1198882+ 1199031+ 1205792)

+ (1198881+ 1205791) (120596 + 120575) minus 119888

31198884+ 11988811198882+ 120575120596

1199012= 1198886(120596 + 120575 + 119888

1+ 1205791) (minus1198882+ 1205741+ 1205792)

+ ((1198881+ 1205791) (120596 + 120575) + 120575120596) (119888

6minus 1198882+ 1205741+ 1205792)

minus 11988831198884(1205791+ 120596 + 120575) + 119888

11198882(1198886+ 120596 + 120575)

+ (1198881120596 minus 11988831198885) (120575 minus 120574

1) + 120575 (119888

3+ 1205961205791)

1199011= (1198886(1198881+ 1205791) (120596 + 120575) + 119888

6120575120596 + 120575119888

3) (minus1198882+ 1205741+ 1205792)

+ (119888111988821198886minus 120579111988831198884) (120596 + 120575) + (119888

11198886120596 minus 120579111988831198885) (120575 minus 120574

1)

minus 120575120596 (11988831198884+ 1205792+ 1205791(1198886minus 1198882+ 1205741+ 1205792))

+ 1205751198885(11988821198883+ 11988831205791minus 12057921205793)

1199010= 120575120596 (120579

21198886minus 120579111988831198884+ 12057911198886(minus1198882+ 1205741+ 1205792))

+ 1205751198885(120579111988821198883+ 120579211988811198883+ 11988831205791(minus1198882+ 1205741+ 1205792)

minus11988831205792(1198881+ 1205791))

1199022= minus120575120579

1120596

1199021= minus120575120596 (120579

2+ 1205791(1198886minus 1198882+ 1205741+ 1205792)) minus 120575119888

5(11988831205791minus 11988831205792)

1199020= 120575120596 (120579

21198886minus 120579111988831198884+ 11988861205791(minus1198882+ 1205741+ 1205792))

+ 1205751198885(120579111988821198883+ 120579211988811198883+ 12057911198883(minus1198882+ 1205741+ 1205792)

minus11988831205792(1198881+ 1205791))

(9)The characteristic equation of system (8) can be obtained by

119875 (120582) + 119876 (120582) 119890minus120582120591

= 0 (10)where

119875 (120582) = 1205825+ 11990141205824+ 11990131205823+ 11990121205822+ 1199011120582 + 1199010

119876 (120582) = 11990221205822+ 1199021120582 + 1199020

(11)

Theorem 2 The positive equilibrium 119864lowast is locally asymptoti-

cally stable without time delay if condition (1198671) is satisfied

1198671 1199014gt 0 119889

1gt 0 119889

2gt 0

(1199012+ 1199022) 1198891minus 1199012

41198892gt 0

(12)

where1198891= 11990131199014minus (1199012+ 1199022) 119889

2= 1199011+ 1199021 (13)

Proof When 120591 = 0 (10) reduces to

1205825+ 11990141205824+ 11990131205823+ (1199012+ 1199022) 1205822

+ (1199011+ 1199021) 120582 + (119901

0+ 1199020) = 0

(14)

According to Routh-Hurwitz criterion all roots of (14)have negative real parts Therefore it can be concludedthat the positive equilibrium 119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) is

locally asymptotically stable without time delay The proof iscompleted

If 120582 = 119894120596 (120596 gt 0) is the root of (10) separating thereal and imaginary parts the following two equations can beobtained

11990141205964minus 11990121205962+ 1199010+ 1199021120596 sin (120596120591)

minus 11990221205962 cos (120596120591) + 119902

0cos (120596120591) = 0

1205965minus 11990131205963+ 1199011120596 + 1199021120596 cos (120596120591)

+ 11990221205962 sin (120596120591) minus 119902

0sin (120596120591) = 0

(15)

From (15) the following equation can be obtained

1199022

11205962+ (1199020minus 11990221205962)

2

= (11990141205964minus 11990121205962+ 1199010)

2

+ (1205965minus 11990131205963+ 1199011120596)

2

(16)

That is

1205968+ 11986331205966+ 11986321205964+ 11986311205962+ 1198630= 0 (17)

where

1198633= 1199012

4minus 21199013 119863

2= 1199012

3+ 21199011minus 211990121199014

1198631= 1199012

2minus 1199022

2+ 211990101199014minus 211990111199013

1198630= 1199012

1minus 1199022

1+ 211990201199022minus 211990101199012

(18)

Letting 119911 = 1205962 (17) can be written as

ℎ (119911) = 1199114+ 11986331199113+ 11986321199112+ 1198631119911 + 119863

0 (19)

Zhang et al [18] obtained the following results on thedistribution of roots of (19) Denote

119898 =

1

2

1198632minus

3

16

1198632

3 119899 =

1

32

1198633

3minus

1

8

11986331198632+ 1198631

Δ = (

119899

2

)

2

+ (

119898

3

)

3

120590 =

minus1 + radic3119894

2

1199101=3radicminus

119899

2

+ radicΔ +3radicminus

119899

2

minus radicΔ

1199102=3radicminus

119899

2

+ radicΔ120590 +3radicminus

119899

2

minus radicΔ1205902

6 Mathematical Problems in Engineering

1199103=3radicminus

119899

2

+ radicΔ1205902+3radicminus

119899

2

minus radicΔ120590

119911119894= 119910119894minus

31198633

4

(119894 = 1 2 3)

(20)

Lemma 3 For the polynomial equation (19)

(1) if1198630lt 0 then (19) has at least one positive root

(2) if 1198630ge 0 and Δ ge 0 then (19) has positive root if and

only if 1199111gt 0 and ℎ(119911

1) lt 0

(3) if 1198630ge 0 and Δ lt 0 then (19) has positive root if and

only if there exists at least one 119911lowast isin (1199111 1199112 1199113) such

that 119911lowast gt 0 and ℎ(119911lowast) le 0

Lemma 4 Suppose that condition1198671 1199014gt 0 119889

1gt 0 119889

2gt 0

(1199012+ 1199022)1198891minus 1199012

41198892gt 0 is satisfied

(1) If one of the followings holds (a) 1198630lt 0 (b) 119863

0ge

0 Δ ge 0 1199111gt 0 and ℎ(119911

1) lt 0 (c) 119863

0ge 0 and

Δ lt 0 and there exits at least a 119911lowastisin (1199111 1199112 1199113) such

that 119911lowast gt 0 and ℎ(119911lowast) le 0 then all roots of (10) have

negative real parts when 120591 isin [0 1205910) here 120591

0is a certain

positive constant

(2) If conditions (a)ndash(c) of (1) are not satisfied then all rootsof (10) have negative real parts for all 120591 ge 0

Proof When 120591 = 0 (10) can be reduced to

1205824+ 11990141205823+ 11990131205822+ (1199012+ 1199022) 120582 + (119901

1+ 1199021) = 0 (21)

According to the Routh-Hurwitz criterion all roots of(21) have negative real parts if and only if 119901

4gt 0 119889

1gt 0

1198892gt 0 and (119901

2+ 1199022)1198891minus 1199012

41198892gt 0

From Lemma 3 it can be known that if (a)ndash(c) are notsatisfied then (10) has no roots with zero real part for all 120591 ge

0 if one of (a)ndash(c) holds when 120591 = 120591(119895)

119896 119896 = 1 2 3 4 119895 gt 1

(10) has no roots with zero real part and 1205910is the minimum

value of 120591 so (10) has purely imaginary roots According to[18] one obtains the conclusion of the lemma

Let 120582(120591) = V(120591) + 119894120596(120591) be the root of (10) V(1205910) = 0 and

120596(1205910) = 1205960

From Lemmas 3 and 4 the following are obtained

When conditions (a)ndash(c) of Lemma 4(1) are not sat-isfied ℎ(119911) always has no positive root Therefore underthese conditions (10) has no purely imaginary roots forany 120591 gt 0 which implies that the positive equilibrium119864lowast

= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) of system (7) is absolutely stable

Therefore the following theorem on the stability of pos-itive equilibrium 119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) can be easily

obtained

0 50 100 150 200 250 3000

1

2

3

4

5

6

7

8times105

Time (s)

Hos

ts in

each

stat

e

S(t)

I(t)

Q(t)

D(t)

R(t)

Figure 2 Propagation trend of the five kinds of hosts when 120591 lt 1205910

0 500 1000 1500 20000

1

2

3

4

5

Rem

ovab

le d

evic

es in

each

stat

e

RS

R1

Time (s)

times104

Figure 3 Propagation trend of the two kinds of removable deviceswhen 120591 lt 120591

0

Theorem 5 Supposing that condition (1198671) is satisfied (a)

1198630ge 0 Δ ge 0 119911

1lt 0 and ℎ(119911

1) gt 0 (b) 119863

0ge 0 and Δ lt 0

and there is no 119911lowast isin (1199111 1199112 1199113) such that 119911lowast gt 0 and ℎ(119911

lowast) le

0 then the positive equilibrium 119864lowast

= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) of

system (7) is absolutely stableIn what follows it is assumed that the coefficients in ℎ(119911)

satisfy the condition(1198672) (a) 119863

0ge 0 Δ ge 0 119911

1lt 0 and ℎ(119911

1) gt 0 (b) 119863

0ge

0 Δ lt 0 and there is no 119911lowast isin (1199111 1199112 1199113) such that 119911lowast gt 0 and

ℎ(119911lowast) le 0According to [29] it is known that (19) has at least a positive

root 1205960 which implies that characteristic equation (10) has a

pair of purely imaginary roots plusmn1198941205960

Mathematical Problems in Engineering 7

0 500 1000 1500 2000 2500 3000 35000

1

2

3

4

5

6

7

8

Time (s)

Hos

ts in

each

stat

e

times105

S(t)

I(t)Q(t)

R(t)

Figure 4 Propagation trend of the four kinds of hosts when 120591 gt 1205910

0 500 1000 1500 2000 2500 3000 35000

1

2

3

4

5

Num

ber o

f rem

ovab

le d

evic

es

Time (s)

times104

RS

R1

Figure 5 Propagation trend of the two kinds of removable deviceswhen 120591 gt 120591

0

Since (10) has a pair of purely imaginary roots plusmn1198941205960 the

corresponding 120591119896gt 0 is given by (15) Consider

120591119896=

1

1205960

arccos [ ((1199020minus 11990221205962) (11990121205962

0minus 11990141205964

0minus 1199010)

+11990211205960(11990131205963

0minus 1205965

0minus 11990111205960))

times((1199020minus 11990221205962)

2

+ 1199022

11205962

0)

minus1

] +

2119896120587

1205960

(119896 = 0 1 2 3 )

(22)

0 100 200 300 400 500 6000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

120591 = 5120591 = 15

120591 = 45120591 = 90

Time (s)

times105

Figure 6 The number of infectious hosts when 120591 is changed in onecoordinate

Let 120582(120591) = V(120591) + 119894120596(120591) be the root of (10) V(120591119896) = 0 and

120596(120591119896) = 1205960are satisfied when 120591 = 120591

119896

Lemma 6 Suppose that ℎ1015840(1199110) = 0 If 120591 = 120591

0 then plusmn119894120596

0is

a pair of purely imaginary roots of (10) In addition if theconditions of Lemma 4(1) are satisfied then 119889Re 120582(120591

0)119889120591 gt 0

It is claimed that

sgn [119889Re 120582119889120591

]

120591=120591119896

= sgn ℎ1015840 (12059620) (23)

This signifies that there is at least one eigenvalue with positivereal part for 120591 gt 120591

119896

Differentiating two sides of (10) with respect to 120591 it can bewritten as

(

119889120582

119889120591

)

minus1

= ((51205824+ 411990141205823+ 311990131205822+ 21199012120582 + 1199011)

+ (21199022120582 + 1199021) 119890minus120582120591

minus (11990221205822+ 1199021120582 + 1199020) 120591119890minus120582120591

)

times ((11990221205822+ 1199021120582 + 1199020) 120582119890minus120582120591

)

minus1

=

(51205824+ 411990141205823+ 311990131205822+ 21199012120582 + 1199011) 119890120582120591

(11990221205822+ 1199021120582 + 1199020) 120582

+

21199022120582 + 1199021

(11990221205822+ 1199021120582 + 1199020) 120582

minus

120591

120582

(24)

8 Mathematical Problems in Engineering

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

120591 = 5

Time (s)

times105

(a)

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

Time (s)

times105 120591 = 15

(b)

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3120591 = 45

Num

ber o

f inf

ectio

us h

osts

Time (s)

times105

(c)

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3N

umbe

r of i

nfec

tious

hos

ts

Time (s)

times105 120591 = 90

(d)

Figure 7 The number of infectious hosts when 120591 is changed in four coordinates

0 05 1 15 2 25 30

1

2

3

4

5

6

7

8

I(t)

S(t)

times105

times105

120591 = 30

(a)

0 05 1 15 2 25 30

1

2

3

4

5

6

7

8

I(t)

S(t)

times105

times105

120591 = 60

(b)

Figure 8 The phase portrait of susceptible hosts 119878(119905) and infectious hosts 119868(119905)

Mathematical Problems in Engineering 9

0

12

1 23

0 0

2

4

6

8

I(t)

S(t)

times105

times105times105

R(t)

120591 = 30

(a)

0

12

12

3

0 0

2

4

6

8

I(t)

S(t)

times105

times105times105

R(t)

120591 = 60

(b)

Figure 9 The projection of the phase portrait of system (1) in (119878 119868 119877)-space

Therefore

sgn [119889Re 120582119889120591

]

120591=120591119896

= sgn[Re(119889120582

119889120591

)

minus1

]

120582=1198941205960

= sgn[Re((51205824+ 411990141205823+ 311990131205822+ 21199012120582 + 1199011) 119890120582120591

(11990221205822+ 1199021120582 + 1199020) 120582

+

21199022120582 + 1199021

(11990221205822+ 1199021120582 + 1199020) 120582

minus

120591

120582

)]

120582=1198941205960

= sgnRe ((51205964

0minus 411990141205963

0119894 minus 3119901

31205962

0+ 211990121205960119894 + 1199011)

times [cos (1205960120591119896) + 119894 sin (120596

0120591119896)] )

times ((11990211205960119894 + 1199020minus 11990221205962) 1205960119894)

minus1

+

211990221205960119894 + 1199021

(11990211205960119894 + 1199020minus 11990221205962) 1205960119894

= sgn1205962

0

119870

[41205966

0+ (3119901

2

4minus 61199013) 1205964

0

+ (21199012

3+ 41199011minus 411990121199014) 1205962

0

+ (1199012

2+ 211990101199014minus 211990111199013)]

= sgn1205962

0

Γ

= sgn1205962

0

Γ

ℎ1015840(1205962

0) = sgn ℎ1015840 (1205962

0)

(25)

where119870 = 1199022

11205964

0+(11990201205960minus11990221205963

0)2 It follows from the hypothesis

(1198672) that ℎ1015840(1205962

0) = 0 and therefore the transversality condition

holds It can be obtained that

119889(Re 120582)119889120591

10038161003816100381610038161003816100381610038161003816120591=120591119896

gt 0 (26)

0 10 20 30 40 50 60 70 80 900

2

4

6

8

10

12

14

16

Num

ber o

f inf

ectio

us h

osts

Hopf bifurcation

120591(S)

times104

Figure 10 Bifurcation diagram of system (1) with 120591 ranging from 1to 90

The root of characteristic equation (10) crosses from theleft to the right on the imaginary axis as 120591 continuously variesfrom a value less than 120591

119896to one greater than 120591

119896according

to Rouchersquos theorem [15] Therefore according to the Hopfbifurcation theorem [30] for functional differential equationsthe transversality condition holds and the conditions for Hopfbifurcation are satisfied at 120591 = 120591

119896 Then the following result can

be obtained

Theorem 7 Supposing that condition (1198671) is satisfied

(1) if 120591 isin [0 1205910) then the positive equilibrium 119864

lowast=

(119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) of system (7) is asymptotically

stable and unstable when 120591 gt 1205910

(2) if condition (1198672) is satisfied system (7) will undergo

a Hopf bifurcation at the positive equilibrium 119864lowast

=

(119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) when 120591 = 120591

119896(119896 = 0 1 2 )

where 120591119896is defined by (22)

This implies that when the time delay 120591 lt 1205910 the system

will stabilize at its infection equilibrium point which isbeneficial for us to implement a containment strategy whentime delay 120591 gt 120591

0 the system will be unstable and worms

cannot be effectively controlled

10 Mathematical Problems in Engineering

0 100 200 300 4000

2

4

6

8

Time (s)

Num

ber o

f sus

cept

ible

hos

tstimes105

Numerical curveSimulation curve

(a)

0 100 200 300 4000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

Time (s)

times105

Numerical curveSimulation curve

(b)

0 100 200 300 4000

1

2

3

4

5

Num

ber o

f qua

rant

ined

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(c)

0 100 200 300 4000

05

1

15

2N

umbe

r of r

emov

ed h

osts

Time (s)

times105

Numerical curveSimulation curve

(d)

Figure 11 Comparisons between numerical curves and simulation curves when 120591 lt 1205910

4 Numerical Analysis

In this section several numerical results are presented toprove the correctness of theoretical analysis above 750000hosts and 50000 removable devices are selected as thepopulation size the wormrsquos average scan rate is 120578 = 4000

per second The worm infection rate can be calculated as 120572 =

120578119873232

= 0698 which means that average 0698 hosts of allthe hosts can be scanned by one infectious hostThe infectionratio is 120573

1= 1205782

32= 000000093 The contact infection rate

between hosts and removable devices is 1205732= 00045 The

recovery rates of infectious hosts and removable devices are1205741= 002 and 120574

2= 0005 respectively The immunization

rate of quarantined hosts is 120575 = 005 and the reassembly rateof immunization hosts is 120596 = 008 At the beginning there

are 50 infectious hosts and 20 infectious removable deviceswhile the rest of hosts and removable devices are susceptible

In anomaly intrusion detection system the rate at whichinfected hosts are detected and quarantined is 120579

2= 02 per

second It means that an infected host can be detected andquarantined in about 5 s The rate at which susceptible hostsare detected and quarantined is 120579

1= 000002315 per second

that is about two false alarms are generated by the anomalyintrusion detection system per day

When 120591 = 5 lt 1205910 Figure 2 presents the changes

of the number of five kinds of hosts and Figure 3 showsthe curves of two kinds of removable devices According toTheorem 5 the positive equilibrium119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868)

is asymptotically stable when 120591 isin [0 1205910) which is illustrated

by the numerical simulations in Figures 2 and 3 Finally the

Mathematical Problems in Engineering 11

0 500 1000 1500 20000

2

4

6

8

Num

ber o

f sus

cept

ible

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(a)

0 500 1000 1500 20000

05

1

15

2

25

3

Time (s)

Num

ber o

f inf

ectio

us h

osts

times105

Numerical curveSimulation curve

(b)

0 500 1000 1500 20000

1

2

3

4

5

Num

ber o

f qua

rant

ined

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(c)

0 500 1000 1500 20000

05

1

15

2

Num

ber o

f rem

oved

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(d)

Figure 12 Comparisons between numerical curves and simulation curves when 120591 gt 1205910

number of every kind of host and removable device keepsstable

When 120591 gets increased and passes through the threshold1205910 the positive equilibrium 119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) will

lose its stability and a Hopf bifurcation will occur A familyof periodic solution bifurcates from the positive equilibrium119864lowast When 120591 = 45 gt 120591

0 Figure 4 shows the curves of

susceptible infectious quarantined and removed hosts andthe numerical simulation results of two kinds of removabledevices are depicted by Figure 5 FromFigures 4 and 5 we canclearly see that every state of hosts and removable devices isunstable Figure 4 shows that the number of infectious hostswill outburst after a short period of peace and repeat againand again

In order to state the influence of time delay the delay 120591

is set to a different value each time with other parameters

remaining unchanged Figure 6 shows four curves of thenumber of infectious hosts in the same coordinate with fourdelays 120591 = 5 120591 = 15 120591 = 45 and 120591 = 90 respectively Figures7(a)ndash7(c) show four curves of the number of infectious hostsin four coordinates Initially the four curves are overlappedwhich means that the time delay has little effect on the initialstate of worm spread With the increase of the time T thetime delay affects the number of infectious hosts With theincrease of time delay the curve begins to oscillate Thesystem becomes unstable as time delay passes through thecritical value 120591

0 At the same time it can be discovered that

the amplitude and period of the number of infectious hostsgradually increase

Figures 8(a) and 8(b) show the phase portraits of suscep-tible hosts 119878(119905) and infectious hosts 119868(119905) with 120591 = 30 lt 120591

0

and 120591 = 60 gt 1205910 respectively Figures 9(a) and 9(b) show

12 Mathematical Problems in Engineering

the projection of the phase portrait of system (1) in (119878 119868 119877)-space when 120591 = 30 lt 120591

0and 120591 = 60 gt 120591

0 respectively It is

clear that the curve converges to a fixed point when 120591 lt 1205910

whichmeans that the system is stableWhen 120591 gt 1205910 the curve

converges to a limit circle which implies that the system isunstable and the worm propagation is out of control

Figure 10 shows the bifurcation diagram with 120591 from 1 to90 It is clear that Hopf bifurcation will occur when 120591 = 120591

0=

35

5 Simulation Experiments

In our simulation experiments the discrete-time simulationis adopted because of its accuracy and is less time-consumingThe discrete-time simulation is an expanded version of Zoursquosprogram simulating Code Red worm propagation All of theparameters are consistent with the numerical experiments

Figures 11(a)ndash11(d) show the comparisons betweennumerical and simulation curves of susceptible infectiousquarantined and removed hosts when 120591 = 5 lt 120591

0

respectively It is clearly seen that the simulation curvesmatch the numerical ones very well Figures 12(a)ndash12(d)show the comparisons between numerical and simulationresults of four kinds of hosts when 120591 = 90 gt 120591

0 In this

figure two curves are still matched well It fully illustratesthe correctness of our theoretical analysis

6 Conclusions

In this paper considering the influence of removable devicesa delayed worm propagation dynamical system based onanomaly IDS has been constructed By regarding the timedelay caused by time window of anomaly IDS as the bifur-cation parameter the local asymptotic stability at the posi-tive equilibrium and local Hopf bifurcation were discussedThrough theoretical analysis and related experiments themain conclusions can be summarized as follows

(a) The critical time delay 1205910where Hopf bifurcation

appears is derived

1205910=

1

1205960

arccos [ ((1199020minus 11990221205962) (11990121205962

0minus 11990141205964

0minus 1199010)

+11990211205960(11990131205963

0minus 1205965

0minus 11990111205960))

times((1199020minus 11990221205962)

2

+ 1199022

11205962

0)

minus1

]

(27)

(b) When the time delay 120591 lt 1205910 worm propagation sys-

tem is stable and wormsrsquo behavior is easy to predictwhich is beneficial for us to implement containmentstrategy to control and eliminate the worm

(c) When time delay 120591 ge 1205910 Hopf bifurcation occurs

which implies that the system will be unstable andcontainment strategy does not work effectively

Thus in order to control and even eliminate the wormthe size of time window of anomaly IDS must be less than

1205910 In real network environment various factors can affect

worm propagationThis paper concentrates on analyzing theinfluence of time delay caused by anomaly IDS other factorshaving an impact on worm propagation will be the center ofour future study

Conflict of Interests

The authors declare that there is no conflict of interestsregarding the publication of this paper

Acknowledgments

This paper is supported by the Program for New CenturyExcellent Talents in University (NCET-13-0113) Natural Sci-ence Foundation of Liaoning Province of China under Grantno 201202059 Program for Liaoning Excellent Talents inUniversity under LR2013011 Fundamental Research Funds ofthe Central Universities under Grant nos N120504006 andN100704001 and MOE-Intel Special Fund of InformationTechnology (MOE-INTEL-2012-06)

References

[1] P Porras H Saidi and V Yegneswaran An Analysis of Con-fickerrsquos Logic and Rendezvous Point SRI International 2009

[2] Unruly USB ldquoDevices Expose Networks to Malwarerdquo httpwwwaspirantinfotechcomsgdownloadlumensionbrochureUnruly-USB-Devices-Expose-Networks-to-Malwarepdf

[3] E Byres A Ginter and J Langill ldquoHow stuxnet spreadsmdashastudy of infection paths in best practice systemsrdquo White Paper2011

[4] N Falliere L O Murchu and E Chien ldquoW32Stuxnet DossierrdquoSymantec Security Response 2011

[5] Win32Stuxnet httpwwwsymanteccomsecurity responsewriteupjspdocid=2010-071400-3123-99

[6] Flamer Highly Sophisticated and Discreet Threat Targets theMiddle East httpwwwsymanteccomconnectblogsflamer-highly-sophisticated-and-discreet-threat-targets-middle-east

[7] W32Flamer httpwwwsymanteccomsecurity responsewriteupjspdocid=2012-052811-0308-99

[8] W O Kermack and A G Mckendrick ldquoA contribution to themathematical theory of epidemicsrdquo Proceedings of the RoyalSociety A vol 115 no 772 pp 700ndash721 1927

[9] C C Zou W Gong and D Towsley ldquoCode red worm prop-agation modeling and analysisrdquo in Proceedings of the 9th ACMConference onComputer andCommunications Security pp 138ndash147 Washington DC USA November 2002

[10] C C Zou W B Gong and D Towsley ldquoWorm propagationmodeling and analysis under dynamic quarantine defenserdquo inProceedings of the ACM Workshop on Rapid Malcode (WORMrsquo03) pp 51ndash60 Washington DC USA October 2003

[11] F Wang Y Zhang C Wang J Ma and S Moon ldquoStabilityanalysis of a SEIQV epidemic model for rapid spreadingwormsrdquo Computers and Security vol 29 no 4 pp 410ndash4182010

[12] Y Yao W Xiang A Qu G Yu and F Gao ldquoHopf bifurcationin an SEIDQV worm propagation model with quarantinestrategyrdquo Discrete Dynamics in Nature and Society vol 2012Article ID 304868 18 pages 2012

Mathematical Problems in Engineering 13

[13] Y Yao L Guo H Guo G Yu F Gao and X Tong ldquoPulsequarantine strategy of internet worm propagation modelingand analysisrdquo Computers and Electrical Engineering vol 38 no5 pp 1047ndash1061 2012

[14] B KMishra andN Jha ldquoSEIQRSmodel for the transmission ofmalicious objects in computer networkrdquo Applied MathematicalModelling vol 34 no 3 pp 710ndash715 2010

[15] B D Hassard N D Kazarinoff and Y H Wan Theory andApplications of Hopf Bifurcation vol 41 of LondonMathematicalSociety Lecture Note Series Cambridge University Press Cam-bridge UK 1981

[16] Y Yao N Zhang W Xiang G Yu and F Gao ldquoModeling andanalysis of bifurcation in a delayed worm propagation modelrdquoJournal of Applied Mathematics vol 2013 Article ID 927369 11pages 2013

[17] W Yu and J Cao ldquoHopf bifurcation and stability of periodicsolutions for van der Pol equation with time delayrdquo NonlinearAnalysis Theory Methods and Applications vol 62 no 1 pp141ndash165 2005

[18] J Zhang W Li and X Yan ldquoHopf bifurcation and stabilityof periodic solutions in a delayed eco-epidemiological systemrdquoApplied Mathematics and Computation vol 198 no 2 pp 865ndash876 2008

[19] X Han and Q Tan ldquoDynamical behavior of computer virus onInternetrdquoAppliedMathematics and Computation vol 217 no 6pp 2520ndash2526 2010

[20] T Dong X Liao and H Li ldquoStability and Hopf bifurcation ina computer virus model with multistate antivirusrdquo Abstract andApplied Analysis vol 2012 Article ID 841987 16 pages 2012

[21] Y Yao X Xie H Guo G Yu F Gao and X Tong ldquoHopfbifurcation in an Internet worm propagation model with timedelay in quarantinerdquo Mathematical and Computer Modellingvol 57 no 11-12 pp 2635ndash2646 2013

[22] J Ren X Yang Q Zhu L Yang and C Zhang ldquoA novelcomputer virus model and its dynamicsrdquo Nonlinear AnalysisReal World Applications vol 13 no 1 pp 376ndash384 2012

[23] L Wu X Su and P Shi ldquoSliding mode control with bounded1198972gain performance of Markovian jump singular time-delay

systemsrdquo Automatica vol 48 no 8 pp 1929ndash1933 2012[24] F Li and X Zhang ldquoA delay-dependent bounded real lemma

for singular LPV systems with time-variant delayrdquo InternationalJournal of Robust and Nonlinear Control vol 22 no 5 pp 559ndash574 2012

[25] F Li P Shi L Wu and X Zhang ldquoFuzzy-model-based D-stability and non-fragile control for discrete-time descriptorsystems with multiple delaysrdquo IEEE Transaction on FuzzySystem vol 99 1 page 2013

[26] L Song J Zhen G Sun J Zhang and X Han ldquoInfluence ofremovable devices on computer worms dynamic analysis andcontrol strategiesrdquo Computers and Mathematics with Applica-tions vol 61 no 7 pp 1823ndash1829 2011

[27] Q Zhu X Yang and J Ren ldquoModeling and analysis ofthe spread of computer virusrdquo Communications in NonlinearScience and Numerical Simulation vol 17 no 12 pp 5117ndash51242012

[28] S Wang Q Liu X Yu and Y Ma ldquoBifurcation analysisof a model for network worm propagation with time delayrdquoMathematical and ComputerModelling vol 52 no 3-4 pp 435ndash447 2010

[29] LWang Y Fan andW Li ldquoMultiple bifurcations in a predator-prey system with monotonic functional responserdquo Applied

Mathematics and Computation vol 172 no 2 pp 1103ndash11202006

[30] J K Hale and S M Verduyn Lunel Introduction to FunctionalDifferential Equations vol 99 Springer New York NY USA1993

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

2 Mathematical Problems in Engineering

innocentrdquo [10] Wang et al proposed a novel epidemic modelnamed SEIQVmodel which combines both vaccinations anddynamic quarantine methods [11] However there is timedelay in actual network environment which may lead tobifurcation phenomenon Much research has been done ontime delay and bifurcation [15ndash25] Han and Tan studiedthe dynamic spread behavior of worms by incorporatingthe delay factor [19] Dong et al proposed a computervirus model with time delay based on SEIR model andregarded time delay as bifurcating parameter to study thedynamical behaviors including local asymptotical stabilityand local Hopf bifurcation [20] Yao et al constructed amodel with time delay under quarantine strategy [21] Wuet al investigated the problem of sliding mode control ofMarkovian jump singular time-delay systems [23] Li andZhang established a delay-dependent bounded real lemmafor singular linear parameter-varying systems with time-variant delay [24]The problems of D-stability and nonfragilecontrol for a class of discrete-time descriptor Takagi-Sugenofuzzy systems with multiple state delays are discussed in [25]

However the above works consider less of the effectof removable devices on worm propagation As mentionedabove removable devices have become a main pathway forsome worms to intrude those hosts not connected to theInternet Song et al presented a worm model incorporatingspecific features to worms spreading via both web-basedscanning and removable devices [26] Zhu et al studiedthe dynamics of interaction infection between computersand removable devices in [27] However time delay andbifurcation research are not considered in their work In thispaper by considering the interaction infection between hostsand removable devices we model a delayed worm propa-gation dynamical system which combines both vaccinationand quarantine strategy Local asymptotic stability of thepositive equilibrium and local Hopf bifurcation are discussedto analyze the influence of time delay on worm propagationdynamical system

The main contributions of this paper can be summarizedas follows

(1) Considering the influence of removable devices onInternet worm propagation and the time delay causedby anomaly IDS we propose a novel worm propaga-tion dynamical system with time delay

(2) We analyze the system stability at positive equilibriumand derive the time delay threshold at which Hopfbifurcation occurs

(3) By numerical analysis we illustrate the correctness oftheoretical analysis

(4) The discrete-time simulation is adopted to simulatethe worm propagation in real network environmentThe results demonstrate the reasonableness of theworm propagation model

The rest of the paper is organized as follows In Section 2considering the influence of removable devices a wormprop-agation dynamical system with time delay under quarantinestrategy is constructed In Section 3 local stability of the

positive equilibrium and local Hopf bifurcation are investi-gated In Section 4 several numerical analyses supporting thetheoretical analysis are given Section 5 makes a comparisonbetween simulation experiments and numerical ones Finallywe give our conclusions in Section 6

2 Model Formulation

The system contains both hosts and removable devices Inthis model all hosts are in one of following five statessusceptible (119878) infectious (119868) delayed (119863) quarantined (119876)and removed (119877) All removable devices are divided intotwo groups susceptible (119877

119878) and infectious (119877

119868) 119873 and 119877

119873

denote the total number of hosts and removable devicesrespectively That is 119878 + 119868 + 119863 + 119876 + 119877 = 119873 119877

119878+ 119877119868=

119877119873 Susceptible (119878) hosts which are vulnerable to the attack

fromworms will be infected by infectious hosts or removabledevices then theywill infect other hosts connected to themorremovable devices plugged into them Infectious (119868) hosts willbe immunized by antivirus software at the rate of 120574

1 Removed

(119877) hosts which have been immunized by antivirus softwarewill become susceptible at reassembly rate 120596 Hosts whosebehavior looks anomaly will be quarantined by IDS and thenthey will become in a quarantined (119876) state A susceptibleremovable device (119877

119878) will be infected when inserted into an

infectious host Worm in an infectious removable device (119877119868)

will be eliminated when connected to removed hosts then itwill become in a susceptible state

The quarantine strategy is an effective measure to defendagainst wormsrsquo attack and make up the deficiency of vacci-nation strategy In this paper anomaly intrusion detectionsystem is chosen for applying quarantine strategy Comparingwith misuse IDS anomaly IDS has great advantage in detect-ing unknown intrusion or the variants of known intrusionHowever anomaly IDS judges whether a detected behavioris an attack or not via comparing detected behavior with thenormal or expected behavior of system anduser If a deviationoccurs the detected behavior is treated as an intrusion imme-diately Because of the difficulty in collecting and building thenormal behavior database high false-alarm rate is consideredthe main drawback of anomaly IDS In order to reduce thefalse alarm of anomaly IDS the mechanism of time windowis adopted A suspicious behavior will not trigger an alarmimmediately On the contrary anomaly IDS has a periodof time to analyze the accumulated behavior Thereforean intermediate state delayed (119863) state is added into thepropagation model The larger the value of time windowthe less the false alarm aroused by anomaly IDS becausethere is enough time for anomaly IDS to recognize whether abehavior is an intrusion or not However the overlarge timewindow may lead to worm propagation dynamical systembeing unstable and out of control The main notations anddefinitions are listed in Table 1 The state transition diagramis given by Figure 1

On the basis of current research we present a delayedworm propagation model which combines both vaccinationand quarantine strategy Several appropriate assumptions aregiven as follows

Mathematical Problems in Engineering 3

Table 1 Notations and definitions of the model

Notations Definitions119873 Total number of hosts in the network119877119873

Total number of removable devices in the network119878(119905) Number of susceptible hosts at time 119905119868(119905) Number of infectious hosts at time 119905119863(119905) Number of delayed hosts at time 119905119876(119905) Number of quarantined hosts at time 119905 minus 120591

119877(119905) Number of removed hosts at time 119905119877119878(119905) Number of susceptible removable devices at time 119905

119877119868(119905) Number of infectious removable devices at time 119905

1205731

Infection ratio of infectious hosts

1205732

Contact infection rate between computers andremovable devices

1205741

Recovery rate of infectious hosts1205742

Recovery rate of infectious removable devices120596 Reassembly rate of immunized hosts1205791

Quarantine rate of susceptible hosts1205792

Quarantine rate of infectious hosts120575 Immunization rate of quarantined hosts

120591Time delay of detection by anomaly intrusiondetection system

(1) 1205731denotes the infection ratio of infectious hosts

Therefore at time t the infection force of infec-tious computers to susceptible computers is given by1205731119878(119905)119868(119905)

(2) Infectious removable devices have the same infectiousability as the infectious hosts 120573

2is the contact infec-

tion rate between computers and removable devicesthat is the interactive infection ratewhen a removabledevice links to a host The probability of connectingremovable devices for every host is 119877

119873119873 and the

probability of removable device exactly being in theinfectious state is 119877

119868(t)119877119873 Therefore the infection

force of infectious removable devices to susceptiblehosts is 120573

2(119877119873119873)(119877

119868(119905)119877119873)119878(119905)

(3) Susceptible removable devices will be infected whenconnecting to an infectious host and then theywill infect any other hosts to which they are con-nected Meanwhile worms of infectious remov-able devices will be eliminated when connectingto one immunized host That is the infectionforce of infectious hosts to susceptible removabledevices is 120573

2(119868(119905)119873)119877

119878(119905) and the recovery force

of removed hosts to infectious removable devices is1205742(119877(119905)119873)119877

119868(119905)

(4) Owing to the influence of time delay 120591 the incrementof the number of quarantined hosts is the onesquarantined at time 119905 minus 120591 Therefore the incrementis 1205791119878(119905 minus 120591) + 120579

2119868(119905 minus 120591)

(5) The timewindowmechanism leads to an intermediatestate delayed state (119863) The increment of the number

of delayed hosts at time t is given by 1205791119878(119905) + 120579

2119868(119905)

the decrement of delayed hosts is the number of thosebeing quarantined that is 120579

1119878(119905 minus 120591) + 120579

2119868(119905 minus 120591)

Based on the analyses and assumptions above the delayeddifferential equations of the model are formulated as (1) Thedifferential on the left of equations means the change rate ofrelated states at time t Consider

119889119878 (119905)

119889119905

= minus1205731119878 (119905) 119868 (119905) minus 120573

2

119877119868(119905)

119873

119878 (119905) + 120596119877 (119905) minus 1205791119878 (119905)

119889119868 (119905)

119889119905

= 1205731119878 (119905) 119868 (119905) + 120573

2

119877119868(119905)

119873

119878 (119905) minus 1205741119868 (119905) minus 120579

2119868 (119905)

119889119877 (119905)

119889119905

= 1205741119868 (119905) minus 120596119877 (119905) + 120575119876 (119905)

119889119863 (119905)

119889119905

= 1205791119878 (119905) minus 120579

1119878 (119905 minus 120591) + 120579

2119868 (119905) minus 120579

2119868 (119905 minus 120591)

119889119876 (119905)

119889119905

= 1205791119878 (119905 minus 120591) + 120579

2119868 (119905 minus 120591) minus 120575119876 (119905)

119889119877119878 (119905)

119889119905

= minus1205732

119868 (119905)

119873

119877119878 (119905) + 1205742

119877 (119905)

119873

119877119868 (119905)

119889119877119868(119905)

119889119905

= 1205732

119868 (119905)

119873

119877119878(119905) minus 120574

2

119877 (119905)

119873

119877119868(119905)

(1)

3 Stability at the Positive Equilibriumand Bifurcation Analysis

Theorem 1 The system (1) has a unique positive equilibrium119864lowast= (119878lowast 119868lowast 119863lowast 119876lowast 119877lowast 119877lowast

119878 119877lowast

119868) where

119868lowast=

1198872119878lowast2

+ 1198873119878lowast

1198874minus 1198871119878lowast

119863lowast= 1205791119878lowast120591 + 1205792119868lowast120591

119876lowast=

1205791119878lowast+ 1205792119868lowast

120575

119877lowast=

1205741119868lowast+ 1205791119878lowast+ 1205792119868lowast

120596

119877lowast

119868=

1205732119877119873119868lowast

1205732119868lowast+ 1205742119877lowast

(2)

Proof For system (1) according to [28] if all the derivativeson the left of equal sign of the system are set to 0 whichimplies that the system becomes stable we can derive

119868 =

1198872119878lowast2

+ 1198873119878lowast

1198874minus 1198871119878lowast

119876 =

1205791119878lowast+ 1205792119868lowast

120575

119877 =

1205741119868lowast+ 1205791119878lowast+ 1205792119868lowast

120596

119877119868=

1205732119877119873119868lowast

1205732119868lowast+ 1205742119877lowast

(3)

4 Mathematical Problems in Engineering

1205731SIS R

D

Q

I

1205792I

120575

1205741I

1205791S

120596

1205791S(t minus 120591)+

1205792I(t minus 120591)

RS RI

1205742(RN)R1

1205732(R1N)S

1205732(1N)RS

Figure 1 The state transition diagram

where

1198871= 12059612057311205732+ 120574112057421205731+ 120573112057421205792

1198872= 120573112057421205791 119887

3=

1205732

2120596119877119873

119873 minus 12057911205742(1205741+ 1205792)

1198874= (1205741+ 1205792) (1205961205732+ 12057411205742+ 12057421205792)

(4)

Assume that system (1) becomes stable at time 119879 By integrat-ing the fourth equation of system (1) with time 119905 from 0 to119879 + 120591 we can get

119863 = 1205791119878lowast120591 + 1205792119868lowast120591 (5)

Since 119878 + 119868 + 119863 + 119876 + 119877 = 119873

119878lowast+

1198872119878lowast2

+ 1198873119878lowast

1198874minus 1198871119878lowast

+ 1205791119878lowast120591 + 1205792119868lowast120591

+

1205791119878lowast+ 1205792119868lowast

120575

+

1205741119868lowast+ 1205791119878lowast+ 1205792119868lowast

120596

= 119873

(6)

Obviously (6) has one unique positive root 119868lowast So there is oneunique positive equilibrium119864

lowast= (119878lowast 119868lowast 119863lowast 119876lowast 119877lowast 119877lowast

119878 119877lowast

119868)

of system (1) The proof is completed

Since 119878 + 119868 + 119863 + 119876 + 119877 = 119873 119877119878+ 119877119868= 119877119873 119876 = 119873 minus 119878 minus

119868 minus 119863 minus 119877 119877119878= 119877119873minus 119877119868 System (1) can be simplified to

119889119878 (119905)

119889119905

= minus1205731119878 (119905) 119868 (119905) minus 120573

2

119877119868 (119905)

119873

119878 (119905) + 120596119877 (119905) minus 1205791119878 (119905)

119889119868 (119905)

119889119905

= 1205731119878 (119905) 119868 (119905) + 120573

2

119877119868 (119905)

119873

119878 (119905) minus 1205741119868 (119905) minus 120579

2119868 (119905)

119889119877 (119905)

119889119905

= 1205741119868 (119905) minus 120596119877 (119905)

+ 120575 (119873 minus 119878 (119905) minus 119868 (119905) minus 119863 (119905) minus 119877 (119905))

119889119863 (119905)

119889119905

= 1205791119878 (119905) minus 120579

1119878 (119905 minus 120591) + 120579

2119868 (119905) minus 120579

2119868 (119905 minus 120591)

119889119877119868(119905)

119889119905

= 1205732

119868 (119905)

119873

(119877119873minus 119877119868 (119905)) minus 120574

2

119877 (119905)

119873

119877119868 (119905)

(7)The Jacobian matrix of (7) about 119864lowast = (119878

lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) is

given by

119869 (119864lowast) =

((((

(

minus1205731119868lowastminus 1205732

119877lowast

119868

119873

minus 1205791

minus1205731119878lowast

120596 0 minus

1205732119878lowast

119873

1205731119868lowast+ 1205732

119877lowast

119868

119873

1205731119878lowastminus 1205741minus 1205792

0 0

1205732119878lowast

119873

minus120575 1205741minus 120575 minus120596 minus 120575 minus120575 0

1205791minus 1205791119890minus120582120591

1205792minus 1205792119890minus120582120591

0 0 0

0

1205732(119877119873minus 119877lowast

119868)

119873

minus

1205742119877lowast

119868

119873

0 minus

1205732119868lowast+ 1205742119877lowast

119873

))))

)

(8)

Let

1198881= 1205731119868lowast+ 1205732

119877lowast

119868

119873

1198882= 1205731119878lowast

1198883=

1205732119878lowast

119873

1198884=

1205732(119877119873minus 119877lowast

119868)

119873

Mathematical Problems in Engineering 5

1198885=

1205742119877lowast

119868

119873

1198886=

1205732119868lowast+ 1205742119877lowast

119873

1199014= 1198886minus 1198882+ 1205741+ 1205792+ 120596 + 120575 + 119888

1+ 1205791

1199013= 1198886(minus1198882+ 1205741+ 1205792) + (120596 + 120575 + 119888

1+ 1205791) (1198886minus 1198882+ 1199031+ 1205792)

+ (1198881+ 1205791) (120596 + 120575) minus 119888

31198884+ 11988811198882+ 120575120596

1199012= 1198886(120596 + 120575 + 119888

1+ 1205791) (minus1198882+ 1205741+ 1205792)

+ ((1198881+ 1205791) (120596 + 120575) + 120575120596) (119888

6minus 1198882+ 1205741+ 1205792)

minus 11988831198884(1205791+ 120596 + 120575) + 119888

11198882(1198886+ 120596 + 120575)

+ (1198881120596 minus 11988831198885) (120575 minus 120574

1) + 120575 (119888

3+ 1205961205791)

1199011= (1198886(1198881+ 1205791) (120596 + 120575) + 119888

6120575120596 + 120575119888

3) (minus1198882+ 1205741+ 1205792)

+ (119888111988821198886minus 120579111988831198884) (120596 + 120575) + (119888

11198886120596 minus 120579111988831198885) (120575 minus 120574

1)

minus 120575120596 (11988831198884+ 1205792+ 1205791(1198886minus 1198882+ 1205741+ 1205792))

+ 1205751198885(11988821198883+ 11988831205791minus 12057921205793)

1199010= 120575120596 (120579

21198886minus 120579111988831198884+ 12057911198886(minus1198882+ 1205741+ 1205792))

+ 1205751198885(120579111988821198883+ 120579211988811198883+ 11988831205791(minus1198882+ 1205741+ 1205792)

minus11988831205792(1198881+ 1205791))

1199022= minus120575120579

1120596

1199021= minus120575120596 (120579

2+ 1205791(1198886minus 1198882+ 1205741+ 1205792)) minus 120575119888

5(11988831205791minus 11988831205792)

1199020= 120575120596 (120579

21198886minus 120579111988831198884+ 11988861205791(minus1198882+ 1205741+ 1205792))

+ 1205751198885(120579111988821198883+ 120579211988811198883+ 12057911198883(minus1198882+ 1205741+ 1205792)

minus11988831205792(1198881+ 1205791))

(9)The characteristic equation of system (8) can be obtained by

119875 (120582) + 119876 (120582) 119890minus120582120591

= 0 (10)where

119875 (120582) = 1205825+ 11990141205824+ 11990131205823+ 11990121205822+ 1199011120582 + 1199010

119876 (120582) = 11990221205822+ 1199021120582 + 1199020

(11)

Theorem 2 The positive equilibrium 119864lowast is locally asymptoti-

cally stable without time delay if condition (1198671) is satisfied

1198671 1199014gt 0 119889

1gt 0 119889

2gt 0

(1199012+ 1199022) 1198891minus 1199012

41198892gt 0

(12)

where1198891= 11990131199014minus (1199012+ 1199022) 119889

2= 1199011+ 1199021 (13)

Proof When 120591 = 0 (10) reduces to

1205825+ 11990141205824+ 11990131205823+ (1199012+ 1199022) 1205822

+ (1199011+ 1199021) 120582 + (119901

0+ 1199020) = 0

(14)

According to Routh-Hurwitz criterion all roots of (14)have negative real parts Therefore it can be concludedthat the positive equilibrium 119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) is

locally asymptotically stable without time delay The proof iscompleted

If 120582 = 119894120596 (120596 gt 0) is the root of (10) separating thereal and imaginary parts the following two equations can beobtained

11990141205964minus 11990121205962+ 1199010+ 1199021120596 sin (120596120591)

minus 11990221205962 cos (120596120591) + 119902

0cos (120596120591) = 0

1205965minus 11990131205963+ 1199011120596 + 1199021120596 cos (120596120591)

+ 11990221205962 sin (120596120591) minus 119902

0sin (120596120591) = 0

(15)

From (15) the following equation can be obtained

1199022

11205962+ (1199020minus 11990221205962)

2

= (11990141205964minus 11990121205962+ 1199010)

2

+ (1205965minus 11990131205963+ 1199011120596)

2

(16)

That is

1205968+ 11986331205966+ 11986321205964+ 11986311205962+ 1198630= 0 (17)

where

1198633= 1199012

4minus 21199013 119863

2= 1199012

3+ 21199011minus 211990121199014

1198631= 1199012

2minus 1199022

2+ 211990101199014minus 211990111199013

1198630= 1199012

1minus 1199022

1+ 211990201199022minus 211990101199012

(18)

Letting 119911 = 1205962 (17) can be written as

ℎ (119911) = 1199114+ 11986331199113+ 11986321199112+ 1198631119911 + 119863

0 (19)

Zhang et al [18] obtained the following results on thedistribution of roots of (19) Denote

119898 =

1

2

1198632minus

3

16

1198632

3 119899 =

1

32

1198633

3minus

1

8

11986331198632+ 1198631

Δ = (

119899

2

)

2

+ (

119898

3

)

3

120590 =

minus1 + radic3119894

2

1199101=3radicminus

119899

2

+ radicΔ +3radicminus

119899

2

minus radicΔ

1199102=3radicminus

119899

2

+ radicΔ120590 +3radicminus

119899

2

minus radicΔ1205902

6 Mathematical Problems in Engineering

1199103=3radicminus

119899

2

+ radicΔ1205902+3radicminus

119899

2

minus radicΔ120590

119911119894= 119910119894minus

31198633

4

(119894 = 1 2 3)

(20)

Lemma 3 For the polynomial equation (19)

(1) if1198630lt 0 then (19) has at least one positive root

(2) if 1198630ge 0 and Δ ge 0 then (19) has positive root if and

only if 1199111gt 0 and ℎ(119911

1) lt 0

(3) if 1198630ge 0 and Δ lt 0 then (19) has positive root if and

only if there exists at least one 119911lowast isin (1199111 1199112 1199113) such

that 119911lowast gt 0 and ℎ(119911lowast) le 0

Lemma 4 Suppose that condition1198671 1199014gt 0 119889

1gt 0 119889

2gt 0

(1199012+ 1199022)1198891minus 1199012

41198892gt 0 is satisfied

(1) If one of the followings holds (a) 1198630lt 0 (b) 119863

0ge

0 Δ ge 0 1199111gt 0 and ℎ(119911

1) lt 0 (c) 119863

0ge 0 and

Δ lt 0 and there exits at least a 119911lowastisin (1199111 1199112 1199113) such

that 119911lowast gt 0 and ℎ(119911lowast) le 0 then all roots of (10) have

negative real parts when 120591 isin [0 1205910) here 120591

0is a certain

positive constant

(2) If conditions (a)ndash(c) of (1) are not satisfied then all rootsof (10) have negative real parts for all 120591 ge 0

Proof When 120591 = 0 (10) can be reduced to

1205824+ 11990141205823+ 11990131205822+ (1199012+ 1199022) 120582 + (119901

1+ 1199021) = 0 (21)

According to the Routh-Hurwitz criterion all roots of(21) have negative real parts if and only if 119901

4gt 0 119889

1gt 0

1198892gt 0 and (119901

2+ 1199022)1198891minus 1199012

41198892gt 0

From Lemma 3 it can be known that if (a)ndash(c) are notsatisfied then (10) has no roots with zero real part for all 120591 ge

0 if one of (a)ndash(c) holds when 120591 = 120591(119895)

119896 119896 = 1 2 3 4 119895 gt 1

(10) has no roots with zero real part and 1205910is the minimum

value of 120591 so (10) has purely imaginary roots According to[18] one obtains the conclusion of the lemma

Let 120582(120591) = V(120591) + 119894120596(120591) be the root of (10) V(1205910) = 0 and

120596(1205910) = 1205960

From Lemmas 3 and 4 the following are obtained

When conditions (a)ndash(c) of Lemma 4(1) are not sat-isfied ℎ(119911) always has no positive root Therefore underthese conditions (10) has no purely imaginary roots forany 120591 gt 0 which implies that the positive equilibrium119864lowast

= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) of system (7) is absolutely stable

Therefore the following theorem on the stability of pos-itive equilibrium 119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) can be easily

obtained

0 50 100 150 200 250 3000

1

2

3

4

5

6

7

8times105

Time (s)

Hos

ts in

each

stat

e

S(t)

I(t)

Q(t)

D(t)

R(t)

Figure 2 Propagation trend of the five kinds of hosts when 120591 lt 1205910

0 500 1000 1500 20000

1

2

3

4

5

Rem

ovab

le d

evic

es in

each

stat

e

RS

R1

Time (s)

times104

Figure 3 Propagation trend of the two kinds of removable deviceswhen 120591 lt 120591

0

Theorem 5 Supposing that condition (1198671) is satisfied (a)

1198630ge 0 Δ ge 0 119911

1lt 0 and ℎ(119911

1) gt 0 (b) 119863

0ge 0 and Δ lt 0

and there is no 119911lowast isin (1199111 1199112 1199113) such that 119911lowast gt 0 and ℎ(119911

lowast) le

0 then the positive equilibrium 119864lowast

= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) of

system (7) is absolutely stableIn what follows it is assumed that the coefficients in ℎ(119911)

satisfy the condition(1198672) (a) 119863

0ge 0 Δ ge 0 119911

1lt 0 and ℎ(119911

1) gt 0 (b) 119863

0ge

0 Δ lt 0 and there is no 119911lowast isin (1199111 1199112 1199113) such that 119911lowast gt 0 and

ℎ(119911lowast) le 0According to [29] it is known that (19) has at least a positive

root 1205960 which implies that characteristic equation (10) has a

pair of purely imaginary roots plusmn1198941205960

Mathematical Problems in Engineering 7

0 500 1000 1500 2000 2500 3000 35000

1

2

3

4

5

6

7

8

Time (s)

Hos

ts in

each

stat

e

times105

S(t)

I(t)Q(t)

R(t)

Figure 4 Propagation trend of the four kinds of hosts when 120591 gt 1205910

0 500 1000 1500 2000 2500 3000 35000

1

2

3

4

5

Num

ber o

f rem

ovab

le d

evic

es

Time (s)

times104

RS

R1

Figure 5 Propagation trend of the two kinds of removable deviceswhen 120591 gt 120591

0

Since (10) has a pair of purely imaginary roots plusmn1198941205960 the

corresponding 120591119896gt 0 is given by (15) Consider

120591119896=

1

1205960

arccos [ ((1199020minus 11990221205962) (11990121205962

0minus 11990141205964

0minus 1199010)

+11990211205960(11990131205963

0minus 1205965

0minus 11990111205960))

times((1199020minus 11990221205962)

2

+ 1199022

11205962

0)

minus1

] +

2119896120587

1205960

(119896 = 0 1 2 3 )

(22)

0 100 200 300 400 500 6000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

120591 = 5120591 = 15

120591 = 45120591 = 90

Time (s)

times105

Figure 6 The number of infectious hosts when 120591 is changed in onecoordinate

Let 120582(120591) = V(120591) + 119894120596(120591) be the root of (10) V(120591119896) = 0 and

120596(120591119896) = 1205960are satisfied when 120591 = 120591

119896

Lemma 6 Suppose that ℎ1015840(1199110) = 0 If 120591 = 120591

0 then plusmn119894120596

0is

a pair of purely imaginary roots of (10) In addition if theconditions of Lemma 4(1) are satisfied then 119889Re 120582(120591

0)119889120591 gt 0

It is claimed that

sgn [119889Re 120582119889120591

]

120591=120591119896

= sgn ℎ1015840 (12059620) (23)

This signifies that there is at least one eigenvalue with positivereal part for 120591 gt 120591

119896

Differentiating two sides of (10) with respect to 120591 it can bewritten as

(

119889120582

119889120591

)

minus1

= ((51205824+ 411990141205823+ 311990131205822+ 21199012120582 + 1199011)

+ (21199022120582 + 1199021) 119890minus120582120591

minus (11990221205822+ 1199021120582 + 1199020) 120591119890minus120582120591

)

times ((11990221205822+ 1199021120582 + 1199020) 120582119890minus120582120591

)

minus1

=

(51205824+ 411990141205823+ 311990131205822+ 21199012120582 + 1199011) 119890120582120591

(11990221205822+ 1199021120582 + 1199020) 120582

+

21199022120582 + 1199021

(11990221205822+ 1199021120582 + 1199020) 120582

minus

120591

120582

(24)

8 Mathematical Problems in Engineering

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

120591 = 5

Time (s)

times105

(a)

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

Time (s)

times105 120591 = 15

(b)

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3120591 = 45

Num

ber o

f inf

ectio

us h

osts

Time (s)

times105

(c)

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3N

umbe

r of i

nfec

tious

hos

ts

Time (s)

times105 120591 = 90

(d)

Figure 7 The number of infectious hosts when 120591 is changed in four coordinates

0 05 1 15 2 25 30

1

2

3

4

5

6

7

8

I(t)

S(t)

times105

times105

120591 = 30

(a)

0 05 1 15 2 25 30

1

2

3

4

5

6

7

8

I(t)

S(t)

times105

times105

120591 = 60

(b)

Figure 8 The phase portrait of susceptible hosts 119878(119905) and infectious hosts 119868(119905)

Mathematical Problems in Engineering 9

0

12

1 23

0 0

2

4

6

8

I(t)

S(t)

times105

times105times105

R(t)

120591 = 30

(a)

0

12

12

3

0 0

2

4

6

8

I(t)

S(t)

times105

times105times105

R(t)

120591 = 60

(b)

Figure 9 The projection of the phase portrait of system (1) in (119878 119868 119877)-space

Therefore

sgn [119889Re 120582119889120591

]

120591=120591119896

= sgn[Re(119889120582

119889120591

)

minus1

]

120582=1198941205960

= sgn[Re((51205824+ 411990141205823+ 311990131205822+ 21199012120582 + 1199011) 119890120582120591

(11990221205822+ 1199021120582 + 1199020) 120582

+

21199022120582 + 1199021

(11990221205822+ 1199021120582 + 1199020) 120582

minus

120591

120582

)]

120582=1198941205960

= sgnRe ((51205964

0minus 411990141205963

0119894 minus 3119901

31205962

0+ 211990121205960119894 + 1199011)

times [cos (1205960120591119896) + 119894 sin (120596

0120591119896)] )

times ((11990211205960119894 + 1199020minus 11990221205962) 1205960119894)

minus1

+

211990221205960119894 + 1199021

(11990211205960119894 + 1199020minus 11990221205962) 1205960119894

= sgn1205962

0

119870

[41205966

0+ (3119901

2

4minus 61199013) 1205964

0

+ (21199012

3+ 41199011minus 411990121199014) 1205962

0

+ (1199012

2+ 211990101199014minus 211990111199013)]

= sgn1205962

0

Γ

= sgn1205962

0

Γ

ℎ1015840(1205962

0) = sgn ℎ1015840 (1205962

0)

(25)

where119870 = 1199022

11205964

0+(11990201205960minus11990221205963

0)2 It follows from the hypothesis

(1198672) that ℎ1015840(1205962

0) = 0 and therefore the transversality condition

holds It can be obtained that

119889(Re 120582)119889120591

10038161003816100381610038161003816100381610038161003816120591=120591119896

gt 0 (26)

0 10 20 30 40 50 60 70 80 900

2

4

6

8

10

12

14

16

Num

ber o

f inf

ectio

us h

osts

Hopf bifurcation

120591(S)

times104

Figure 10 Bifurcation diagram of system (1) with 120591 ranging from 1to 90

The root of characteristic equation (10) crosses from theleft to the right on the imaginary axis as 120591 continuously variesfrom a value less than 120591

119896to one greater than 120591

119896according

to Rouchersquos theorem [15] Therefore according to the Hopfbifurcation theorem [30] for functional differential equationsthe transversality condition holds and the conditions for Hopfbifurcation are satisfied at 120591 = 120591

119896 Then the following result can

be obtained

Theorem 7 Supposing that condition (1198671) is satisfied

(1) if 120591 isin [0 1205910) then the positive equilibrium 119864

lowast=

(119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) of system (7) is asymptotically

stable and unstable when 120591 gt 1205910

(2) if condition (1198672) is satisfied system (7) will undergo

a Hopf bifurcation at the positive equilibrium 119864lowast

=

(119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) when 120591 = 120591

119896(119896 = 0 1 2 )

where 120591119896is defined by (22)

This implies that when the time delay 120591 lt 1205910 the system

will stabilize at its infection equilibrium point which isbeneficial for us to implement a containment strategy whentime delay 120591 gt 120591

0 the system will be unstable and worms

cannot be effectively controlled

10 Mathematical Problems in Engineering

0 100 200 300 4000

2

4

6

8

Time (s)

Num

ber o

f sus

cept

ible

hos

tstimes105

Numerical curveSimulation curve

(a)

0 100 200 300 4000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

Time (s)

times105

Numerical curveSimulation curve

(b)

0 100 200 300 4000

1

2

3

4

5

Num

ber o

f qua

rant

ined

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(c)

0 100 200 300 4000

05

1

15

2N

umbe

r of r

emov

ed h

osts

Time (s)

times105

Numerical curveSimulation curve

(d)

Figure 11 Comparisons between numerical curves and simulation curves when 120591 lt 1205910

4 Numerical Analysis

In this section several numerical results are presented toprove the correctness of theoretical analysis above 750000hosts and 50000 removable devices are selected as thepopulation size the wormrsquos average scan rate is 120578 = 4000

per second The worm infection rate can be calculated as 120572 =

120578119873232

= 0698 which means that average 0698 hosts of allthe hosts can be scanned by one infectious hostThe infectionratio is 120573

1= 1205782

32= 000000093 The contact infection rate

between hosts and removable devices is 1205732= 00045 The

recovery rates of infectious hosts and removable devices are1205741= 002 and 120574

2= 0005 respectively The immunization

rate of quarantined hosts is 120575 = 005 and the reassembly rateof immunization hosts is 120596 = 008 At the beginning there

are 50 infectious hosts and 20 infectious removable deviceswhile the rest of hosts and removable devices are susceptible

In anomaly intrusion detection system the rate at whichinfected hosts are detected and quarantined is 120579

2= 02 per

second It means that an infected host can be detected andquarantined in about 5 s The rate at which susceptible hostsare detected and quarantined is 120579

1= 000002315 per second

that is about two false alarms are generated by the anomalyintrusion detection system per day

When 120591 = 5 lt 1205910 Figure 2 presents the changes

of the number of five kinds of hosts and Figure 3 showsthe curves of two kinds of removable devices According toTheorem 5 the positive equilibrium119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868)

is asymptotically stable when 120591 isin [0 1205910) which is illustrated

by the numerical simulations in Figures 2 and 3 Finally the

Mathematical Problems in Engineering 11

0 500 1000 1500 20000

2

4

6

8

Num

ber o

f sus

cept

ible

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(a)

0 500 1000 1500 20000

05

1

15

2

25

3

Time (s)

Num

ber o

f inf

ectio

us h

osts

times105

Numerical curveSimulation curve

(b)

0 500 1000 1500 20000

1

2

3

4

5

Num

ber o

f qua

rant

ined

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(c)

0 500 1000 1500 20000

05

1

15

2

Num

ber o

f rem

oved

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(d)

Figure 12 Comparisons between numerical curves and simulation curves when 120591 gt 1205910

number of every kind of host and removable device keepsstable

When 120591 gets increased and passes through the threshold1205910 the positive equilibrium 119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) will

lose its stability and a Hopf bifurcation will occur A familyof periodic solution bifurcates from the positive equilibrium119864lowast When 120591 = 45 gt 120591

0 Figure 4 shows the curves of

susceptible infectious quarantined and removed hosts andthe numerical simulation results of two kinds of removabledevices are depicted by Figure 5 FromFigures 4 and 5 we canclearly see that every state of hosts and removable devices isunstable Figure 4 shows that the number of infectious hostswill outburst after a short period of peace and repeat againand again

In order to state the influence of time delay the delay 120591

is set to a different value each time with other parameters

remaining unchanged Figure 6 shows four curves of thenumber of infectious hosts in the same coordinate with fourdelays 120591 = 5 120591 = 15 120591 = 45 and 120591 = 90 respectively Figures7(a)ndash7(c) show four curves of the number of infectious hostsin four coordinates Initially the four curves are overlappedwhich means that the time delay has little effect on the initialstate of worm spread With the increase of the time T thetime delay affects the number of infectious hosts With theincrease of time delay the curve begins to oscillate Thesystem becomes unstable as time delay passes through thecritical value 120591

0 At the same time it can be discovered that

the amplitude and period of the number of infectious hostsgradually increase

Figures 8(a) and 8(b) show the phase portraits of suscep-tible hosts 119878(119905) and infectious hosts 119868(119905) with 120591 = 30 lt 120591

0

and 120591 = 60 gt 1205910 respectively Figures 9(a) and 9(b) show

12 Mathematical Problems in Engineering

the projection of the phase portrait of system (1) in (119878 119868 119877)-space when 120591 = 30 lt 120591

0and 120591 = 60 gt 120591

0 respectively It is

clear that the curve converges to a fixed point when 120591 lt 1205910

whichmeans that the system is stableWhen 120591 gt 1205910 the curve

converges to a limit circle which implies that the system isunstable and the worm propagation is out of control

Figure 10 shows the bifurcation diagram with 120591 from 1 to90 It is clear that Hopf bifurcation will occur when 120591 = 120591

0=

35

5 Simulation Experiments

In our simulation experiments the discrete-time simulationis adopted because of its accuracy and is less time-consumingThe discrete-time simulation is an expanded version of Zoursquosprogram simulating Code Red worm propagation All of theparameters are consistent with the numerical experiments

Figures 11(a)ndash11(d) show the comparisons betweennumerical and simulation curves of susceptible infectiousquarantined and removed hosts when 120591 = 5 lt 120591

0

respectively It is clearly seen that the simulation curvesmatch the numerical ones very well Figures 12(a)ndash12(d)show the comparisons between numerical and simulationresults of four kinds of hosts when 120591 = 90 gt 120591

0 In this

figure two curves are still matched well It fully illustratesthe correctness of our theoretical analysis

6 Conclusions

In this paper considering the influence of removable devicesa delayed worm propagation dynamical system based onanomaly IDS has been constructed By regarding the timedelay caused by time window of anomaly IDS as the bifur-cation parameter the local asymptotic stability at the posi-tive equilibrium and local Hopf bifurcation were discussedThrough theoretical analysis and related experiments themain conclusions can be summarized as follows

(a) The critical time delay 1205910where Hopf bifurcation

appears is derived

1205910=

1

1205960

arccos [ ((1199020minus 11990221205962) (11990121205962

0minus 11990141205964

0minus 1199010)

+11990211205960(11990131205963

0minus 1205965

0minus 11990111205960))

times((1199020minus 11990221205962)

2

+ 1199022

11205962

0)

minus1

]

(27)

(b) When the time delay 120591 lt 1205910 worm propagation sys-

tem is stable and wormsrsquo behavior is easy to predictwhich is beneficial for us to implement containmentstrategy to control and eliminate the worm

(c) When time delay 120591 ge 1205910 Hopf bifurcation occurs

which implies that the system will be unstable andcontainment strategy does not work effectively

Thus in order to control and even eliminate the wormthe size of time window of anomaly IDS must be less than

1205910 In real network environment various factors can affect

worm propagationThis paper concentrates on analyzing theinfluence of time delay caused by anomaly IDS other factorshaving an impact on worm propagation will be the center ofour future study

Conflict of Interests

The authors declare that there is no conflict of interestsregarding the publication of this paper

Acknowledgments

This paper is supported by the Program for New CenturyExcellent Talents in University (NCET-13-0113) Natural Sci-ence Foundation of Liaoning Province of China under Grantno 201202059 Program for Liaoning Excellent Talents inUniversity under LR2013011 Fundamental Research Funds ofthe Central Universities under Grant nos N120504006 andN100704001 and MOE-Intel Special Fund of InformationTechnology (MOE-INTEL-2012-06)

References

[1] P Porras H Saidi and V Yegneswaran An Analysis of Con-fickerrsquos Logic and Rendezvous Point SRI International 2009

[2] Unruly USB ldquoDevices Expose Networks to Malwarerdquo httpwwwaspirantinfotechcomsgdownloadlumensionbrochureUnruly-USB-Devices-Expose-Networks-to-Malwarepdf

[3] E Byres A Ginter and J Langill ldquoHow stuxnet spreadsmdashastudy of infection paths in best practice systemsrdquo White Paper2011

[4] N Falliere L O Murchu and E Chien ldquoW32Stuxnet DossierrdquoSymantec Security Response 2011

[5] Win32Stuxnet httpwwwsymanteccomsecurity responsewriteupjspdocid=2010-071400-3123-99

[6] Flamer Highly Sophisticated and Discreet Threat Targets theMiddle East httpwwwsymanteccomconnectblogsflamer-highly-sophisticated-and-discreet-threat-targets-middle-east

[7] W32Flamer httpwwwsymanteccomsecurity responsewriteupjspdocid=2012-052811-0308-99

[8] W O Kermack and A G Mckendrick ldquoA contribution to themathematical theory of epidemicsrdquo Proceedings of the RoyalSociety A vol 115 no 772 pp 700ndash721 1927

[9] C C Zou W Gong and D Towsley ldquoCode red worm prop-agation modeling and analysisrdquo in Proceedings of the 9th ACMConference onComputer andCommunications Security pp 138ndash147 Washington DC USA November 2002

[10] C C Zou W B Gong and D Towsley ldquoWorm propagationmodeling and analysis under dynamic quarantine defenserdquo inProceedings of the ACM Workshop on Rapid Malcode (WORMrsquo03) pp 51ndash60 Washington DC USA October 2003

[11] F Wang Y Zhang C Wang J Ma and S Moon ldquoStabilityanalysis of a SEIQV epidemic model for rapid spreadingwormsrdquo Computers and Security vol 29 no 4 pp 410ndash4182010

[12] Y Yao W Xiang A Qu G Yu and F Gao ldquoHopf bifurcationin an SEIDQV worm propagation model with quarantinestrategyrdquo Discrete Dynamics in Nature and Society vol 2012Article ID 304868 18 pages 2012

Mathematical Problems in Engineering 13

[13] Y Yao L Guo H Guo G Yu F Gao and X Tong ldquoPulsequarantine strategy of internet worm propagation modelingand analysisrdquo Computers and Electrical Engineering vol 38 no5 pp 1047ndash1061 2012

[14] B KMishra andN Jha ldquoSEIQRSmodel for the transmission ofmalicious objects in computer networkrdquo Applied MathematicalModelling vol 34 no 3 pp 710ndash715 2010

[15] B D Hassard N D Kazarinoff and Y H Wan Theory andApplications of Hopf Bifurcation vol 41 of LondonMathematicalSociety Lecture Note Series Cambridge University Press Cam-bridge UK 1981

[16] Y Yao N Zhang W Xiang G Yu and F Gao ldquoModeling andanalysis of bifurcation in a delayed worm propagation modelrdquoJournal of Applied Mathematics vol 2013 Article ID 927369 11pages 2013

[17] W Yu and J Cao ldquoHopf bifurcation and stability of periodicsolutions for van der Pol equation with time delayrdquo NonlinearAnalysis Theory Methods and Applications vol 62 no 1 pp141ndash165 2005

[18] J Zhang W Li and X Yan ldquoHopf bifurcation and stabilityof periodic solutions in a delayed eco-epidemiological systemrdquoApplied Mathematics and Computation vol 198 no 2 pp 865ndash876 2008

[19] X Han and Q Tan ldquoDynamical behavior of computer virus onInternetrdquoAppliedMathematics and Computation vol 217 no 6pp 2520ndash2526 2010

[20] T Dong X Liao and H Li ldquoStability and Hopf bifurcation ina computer virus model with multistate antivirusrdquo Abstract andApplied Analysis vol 2012 Article ID 841987 16 pages 2012

[21] Y Yao X Xie H Guo G Yu F Gao and X Tong ldquoHopfbifurcation in an Internet worm propagation model with timedelay in quarantinerdquo Mathematical and Computer Modellingvol 57 no 11-12 pp 2635ndash2646 2013

[22] J Ren X Yang Q Zhu L Yang and C Zhang ldquoA novelcomputer virus model and its dynamicsrdquo Nonlinear AnalysisReal World Applications vol 13 no 1 pp 376ndash384 2012

[23] L Wu X Su and P Shi ldquoSliding mode control with bounded1198972gain performance of Markovian jump singular time-delay

systemsrdquo Automatica vol 48 no 8 pp 1929ndash1933 2012[24] F Li and X Zhang ldquoA delay-dependent bounded real lemma

for singular LPV systems with time-variant delayrdquo InternationalJournal of Robust and Nonlinear Control vol 22 no 5 pp 559ndash574 2012

[25] F Li P Shi L Wu and X Zhang ldquoFuzzy-model-based D-stability and non-fragile control for discrete-time descriptorsystems with multiple delaysrdquo IEEE Transaction on FuzzySystem vol 99 1 page 2013

[26] L Song J Zhen G Sun J Zhang and X Han ldquoInfluence ofremovable devices on computer worms dynamic analysis andcontrol strategiesrdquo Computers and Mathematics with Applica-tions vol 61 no 7 pp 1823ndash1829 2011

[27] Q Zhu X Yang and J Ren ldquoModeling and analysis ofthe spread of computer virusrdquo Communications in NonlinearScience and Numerical Simulation vol 17 no 12 pp 5117ndash51242012

[28] S Wang Q Liu X Yu and Y Ma ldquoBifurcation analysisof a model for network worm propagation with time delayrdquoMathematical and ComputerModelling vol 52 no 3-4 pp 435ndash447 2010

[29] LWang Y Fan andW Li ldquoMultiple bifurcations in a predator-prey system with monotonic functional responserdquo Applied

Mathematics and Computation vol 172 no 2 pp 1103ndash11202006

[30] J K Hale and S M Verduyn Lunel Introduction to FunctionalDifferential Equations vol 99 Springer New York NY USA1993

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

Mathematical Problems in Engineering 3

Table 1 Notations and definitions of the model

Notations Definitions119873 Total number of hosts in the network119877119873

Total number of removable devices in the network119878(119905) Number of susceptible hosts at time 119905119868(119905) Number of infectious hosts at time 119905119863(119905) Number of delayed hosts at time 119905119876(119905) Number of quarantined hosts at time 119905 minus 120591

119877(119905) Number of removed hosts at time 119905119877119878(119905) Number of susceptible removable devices at time 119905

119877119868(119905) Number of infectious removable devices at time 119905

1205731

Infection ratio of infectious hosts

1205732

Contact infection rate between computers andremovable devices

1205741

Recovery rate of infectious hosts1205742

Recovery rate of infectious removable devices120596 Reassembly rate of immunized hosts1205791

Quarantine rate of susceptible hosts1205792

Quarantine rate of infectious hosts120575 Immunization rate of quarantined hosts

120591Time delay of detection by anomaly intrusiondetection system

(1) 1205731denotes the infection ratio of infectious hosts

Therefore at time t the infection force of infec-tious computers to susceptible computers is given by1205731119878(119905)119868(119905)

(2) Infectious removable devices have the same infectiousability as the infectious hosts 120573

2is the contact infec-

tion rate between computers and removable devicesthat is the interactive infection ratewhen a removabledevice links to a host The probability of connectingremovable devices for every host is 119877

119873119873 and the

probability of removable device exactly being in theinfectious state is 119877

119868(t)119877119873 Therefore the infection

force of infectious removable devices to susceptiblehosts is 120573

2(119877119873119873)(119877

119868(119905)119877119873)119878(119905)

(3) Susceptible removable devices will be infected whenconnecting to an infectious host and then theywill infect any other hosts to which they are con-nected Meanwhile worms of infectious remov-able devices will be eliminated when connectingto one immunized host That is the infectionforce of infectious hosts to susceptible removabledevices is 120573

2(119868(119905)119873)119877

119878(119905) and the recovery force

of removed hosts to infectious removable devices is1205742(119877(119905)119873)119877

119868(119905)

(4) Owing to the influence of time delay 120591 the incrementof the number of quarantined hosts is the onesquarantined at time 119905 minus 120591 Therefore the incrementis 1205791119878(119905 minus 120591) + 120579

2119868(119905 minus 120591)

(5) The timewindowmechanism leads to an intermediatestate delayed state (119863) The increment of the number

of delayed hosts at time t is given by 1205791119878(119905) + 120579

2119868(119905)

the decrement of delayed hosts is the number of thosebeing quarantined that is 120579

1119878(119905 minus 120591) + 120579

2119868(119905 minus 120591)

Based on the analyses and assumptions above the delayeddifferential equations of the model are formulated as (1) Thedifferential on the left of equations means the change rate ofrelated states at time t Consider

119889119878 (119905)

119889119905

= minus1205731119878 (119905) 119868 (119905) minus 120573

2

119877119868(119905)

119873

119878 (119905) + 120596119877 (119905) minus 1205791119878 (119905)

119889119868 (119905)

119889119905

= 1205731119878 (119905) 119868 (119905) + 120573

2

119877119868(119905)

119873

119878 (119905) minus 1205741119868 (119905) minus 120579

2119868 (119905)

119889119877 (119905)

119889119905

= 1205741119868 (119905) minus 120596119877 (119905) + 120575119876 (119905)

119889119863 (119905)

119889119905

= 1205791119878 (119905) minus 120579

1119878 (119905 minus 120591) + 120579

2119868 (119905) minus 120579

2119868 (119905 minus 120591)

119889119876 (119905)

119889119905

= 1205791119878 (119905 minus 120591) + 120579

2119868 (119905 minus 120591) minus 120575119876 (119905)

119889119877119878 (119905)

119889119905

= minus1205732

119868 (119905)

119873

119877119878 (119905) + 1205742

119877 (119905)

119873

119877119868 (119905)

119889119877119868(119905)

119889119905

= 1205732

119868 (119905)

119873

119877119878(119905) minus 120574

2

119877 (119905)

119873

119877119868(119905)

(1)

3 Stability at the Positive Equilibriumand Bifurcation Analysis

Theorem 1 The system (1) has a unique positive equilibrium119864lowast= (119878lowast 119868lowast 119863lowast 119876lowast 119877lowast 119877lowast

119878 119877lowast

119868) where

119868lowast=

1198872119878lowast2

+ 1198873119878lowast

1198874minus 1198871119878lowast

119863lowast= 1205791119878lowast120591 + 1205792119868lowast120591

119876lowast=

1205791119878lowast+ 1205792119868lowast

120575

119877lowast=

1205741119868lowast+ 1205791119878lowast+ 1205792119868lowast

120596

119877lowast

119868=

1205732119877119873119868lowast

1205732119868lowast+ 1205742119877lowast

(2)

Proof For system (1) according to [28] if all the derivativeson the left of equal sign of the system are set to 0 whichimplies that the system becomes stable we can derive

119868 =

1198872119878lowast2

+ 1198873119878lowast

1198874minus 1198871119878lowast

119876 =

1205791119878lowast+ 1205792119868lowast

120575

119877 =

1205741119868lowast+ 1205791119878lowast+ 1205792119868lowast

120596

119877119868=

1205732119877119873119868lowast

1205732119868lowast+ 1205742119877lowast

(3)

4 Mathematical Problems in Engineering

1205731SIS R

D

Q

I

1205792I

120575

1205741I

1205791S

120596

1205791S(t minus 120591)+

1205792I(t minus 120591)

RS RI

1205742(RN)R1

1205732(R1N)S

1205732(1N)RS

Figure 1 The state transition diagram

where

1198871= 12059612057311205732+ 120574112057421205731+ 120573112057421205792

1198872= 120573112057421205791 119887

3=

1205732

2120596119877119873

119873 minus 12057911205742(1205741+ 1205792)

1198874= (1205741+ 1205792) (1205961205732+ 12057411205742+ 12057421205792)

(4)

Assume that system (1) becomes stable at time 119879 By integrat-ing the fourth equation of system (1) with time 119905 from 0 to119879 + 120591 we can get

119863 = 1205791119878lowast120591 + 1205792119868lowast120591 (5)

Since 119878 + 119868 + 119863 + 119876 + 119877 = 119873

119878lowast+

1198872119878lowast2

+ 1198873119878lowast

1198874minus 1198871119878lowast

+ 1205791119878lowast120591 + 1205792119868lowast120591

+

1205791119878lowast+ 1205792119868lowast

120575

+

1205741119868lowast+ 1205791119878lowast+ 1205792119868lowast

120596

= 119873

(6)

Obviously (6) has one unique positive root 119868lowast So there is oneunique positive equilibrium119864

lowast= (119878lowast 119868lowast 119863lowast 119876lowast 119877lowast 119877lowast

119878 119877lowast

119868)

of system (1) The proof is completed

Since 119878 + 119868 + 119863 + 119876 + 119877 = 119873 119877119878+ 119877119868= 119877119873 119876 = 119873 minus 119878 minus

119868 minus 119863 minus 119877 119877119878= 119877119873minus 119877119868 System (1) can be simplified to

119889119878 (119905)

119889119905

= minus1205731119878 (119905) 119868 (119905) minus 120573

2

119877119868 (119905)

119873

119878 (119905) + 120596119877 (119905) minus 1205791119878 (119905)

119889119868 (119905)

119889119905

= 1205731119878 (119905) 119868 (119905) + 120573

2

119877119868 (119905)

119873

119878 (119905) minus 1205741119868 (119905) minus 120579

2119868 (119905)

119889119877 (119905)

119889119905

= 1205741119868 (119905) minus 120596119877 (119905)

+ 120575 (119873 minus 119878 (119905) minus 119868 (119905) minus 119863 (119905) minus 119877 (119905))

119889119863 (119905)

119889119905

= 1205791119878 (119905) minus 120579

1119878 (119905 minus 120591) + 120579

2119868 (119905) minus 120579

2119868 (119905 minus 120591)

119889119877119868(119905)

119889119905

= 1205732

119868 (119905)

119873

(119877119873minus 119877119868 (119905)) minus 120574

2

119877 (119905)

119873

119877119868 (119905)

(7)The Jacobian matrix of (7) about 119864lowast = (119878

lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) is

given by

119869 (119864lowast) =

((((

(

minus1205731119868lowastminus 1205732

119877lowast

119868

119873

minus 1205791

minus1205731119878lowast

120596 0 minus

1205732119878lowast

119873

1205731119868lowast+ 1205732

119877lowast

119868

119873

1205731119878lowastminus 1205741minus 1205792

0 0

1205732119878lowast

119873

minus120575 1205741minus 120575 minus120596 minus 120575 minus120575 0

1205791minus 1205791119890minus120582120591

1205792minus 1205792119890minus120582120591

0 0 0

0

1205732(119877119873minus 119877lowast

119868)

119873

minus

1205742119877lowast

119868

119873

0 minus

1205732119868lowast+ 1205742119877lowast

119873

))))

)

(8)

Let

1198881= 1205731119868lowast+ 1205732

119877lowast

119868

119873

1198882= 1205731119878lowast

1198883=

1205732119878lowast

119873

1198884=

1205732(119877119873minus 119877lowast

119868)

119873

Mathematical Problems in Engineering 5

1198885=

1205742119877lowast

119868

119873

1198886=

1205732119868lowast+ 1205742119877lowast

119873

1199014= 1198886minus 1198882+ 1205741+ 1205792+ 120596 + 120575 + 119888

1+ 1205791

1199013= 1198886(minus1198882+ 1205741+ 1205792) + (120596 + 120575 + 119888

1+ 1205791) (1198886minus 1198882+ 1199031+ 1205792)

+ (1198881+ 1205791) (120596 + 120575) minus 119888

31198884+ 11988811198882+ 120575120596

1199012= 1198886(120596 + 120575 + 119888

1+ 1205791) (minus1198882+ 1205741+ 1205792)

+ ((1198881+ 1205791) (120596 + 120575) + 120575120596) (119888

6minus 1198882+ 1205741+ 1205792)

minus 11988831198884(1205791+ 120596 + 120575) + 119888

11198882(1198886+ 120596 + 120575)

+ (1198881120596 minus 11988831198885) (120575 minus 120574

1) + 120575 (119888

3+ 1205961205791)

1199011= (1198886(1198881+ 1205791) (120596 + 120575) + 119888

6120575120596 + 120575119888

3) (minus1198882+ 1205741+ 1205792)

+ (119888111988821198886minus 120579111988831198884) (120596 + 120575) + (119888

11198886120596 minus 120579111988831198885) (120575 minus 120574

1)

minus 120575120596 (11988831198884+ 1205792+ 1205791(1198886minus 1198882+ 1205741+ 1205792))

+ 1205751198885(11988821198883+ 11988831205791minus 12057921205793)

1199010= 120575120596 (120579

21198886minus 120579111988831198884+ 12057911198886(minus1198882+ 1205741+ 1205792))

+ 1205751198885(120579111988821198883+ 120579211988811198883+ 11988831205791(minus1198882+ 1205741+ 1205792)

minus11988831205792(1198881+ 1205791))

1199022= minus120575120579

1120596

1199021= minus120575120596 (120579

2+ 1205791(1198886minus 1198882+ 1205741+ 1205792)) minus 120575119888

5(11988831205791minus 11988831205792)

1199020= 120575120596 (120579

21198886minus 120579111988831198884+ 11988861205791(minus1198882+ 1205741+ 1205792))

+ 1205751198885(120579111988821198883+ 120579211988811198883+ 12057911198883(minus1198882+ 1205741+ 1205792)

minus11988831205792(1198881+ 1205791))

(9)The characteristic equation of system (8) can be obtained by

119875 (120582) + 119876 (120582) 119890minus120582120591

= 0 (10)where

119875 (120582) = 1205825+ 11990141205824+ 11990131205823+ 11990121205822+ 1199011120582 + 1199010

119876 (120582) = 11990221205822+ 1199021120582 + 1199020

(11)

Theorem 2 The positive equilibrium 119864lowast is locally asymptoti-

cally stable without time delay if condition (1198671) is satisfied

1198671 1199014gt 0 119889

1gt 0 119889

2gt 0

(1199012+ 1199022) 1198891minus 1199012

41198892gt 0

(12)

where1198891= 11990131199014minus (1199012+ 1199022) 119889

2= 1199011+ 1199021 (13)

Proof When 120591 = 0 (10) reduces to

1205825+ 11990141205824+ 11990131205823+ (1199012+ 1199022) 1205822

+ (1199011+ 1199021) 120582 + (119901

0+ 1199020) = 0

(14)

According to Routh-Hurwitz criterion all roots of (14)have negative real parts Therefore it can be concludedthat the positive equilibrium 119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) is

locally asymptotically stable without time delay The proof iscompleted

If 120582 = 119894120596 (120596 gt 0) is the root of (10) separating thereal and imaginary parts the following two equations can beobtained

11990141205964minus 11990121205962+ 1199010+ 1199021120596 sin (120596120591)

minus 11990221205962 cos (120596120591) + 119902

0cos (120596120591) = 0

1205965minus 11990131205963+ 1199011120596 + 1199021120596 cos (120596120591)

+ 11990221205962 sin (120596120591) minus 119902

0sin (120596120591) = 0

(15)

From (15) the following equation can be obtained

1199022

11205962+ (1199020minus 11990221205962)

2

= (11990141205964minus 11990121205962+ 1199010)

2

+ (1205965minus 11990131205963+ 1199011120596)

2

(16)

That is

1205968+ 11986331205966+ 11986321205964+ 11986311205962+ 1198630= 0 (17)

where

1198633= 1199012

4minus 21199013 119863

2= 1199012

3+ 21199011minus 211990121199014

1198631= 1199012

2minus 1199022

2+ 211990101199014minus 211990111199013

1198630= 1199012

1minus 1199022

1+ 211990201199022minus 211990101199012

(18)

Letting 119911 = 1205962 (17) can be written as

ℎ (119911) = 1199114+ 11986331199113+ 11986321199112+ 1198631119911 + 119863

0 (19)

Zhang et al [18] obtained the following results on thedistribution of roots of (19) Denote

119898 =

1

2

1198632minus

3

16

1198632

3 119899 =

1

32

1198633

3minus

1

8

11986331198632+ 1198631

Δ = (

119899

2

)

2

+ (

119898

3

)

3

120590 =

minus1 + radic3119894

2

1199101=3radicminus

119899

2

+ radicΔ +3radicminus

119899

2

minus radicΔ

1199102=3radicminus

119899

2

+ radicΔ120590 +3radicminus

119899

2

minus radicΔ1205902

6 Mathematical Problems in Engineering

1199103=3radicminus

119899

2

+ radicΔ1205902+3radicminus

119899

2

minus radicΔ120590

119911119894= 119910119894minus

31198633

4

(119894 = 1 2 3)

(20)

Lemma 3 For the polynomial equation (19)

(1) if1198630lt 0 then (19) has at least one positive root

(2) if 1198630ge 0 and Δ ge 0 then (19) has positive root if and

only if 1199111gt 0 and ℎ(119911

1) lt 0

(3) if 1198630ge 0 and Δ lt 0 then (19) has positive root if and

only if there exists at least one 119911lowast isin (1199111 1199112 1199113) such

that 119911lowast gt 0 and ℎ(119911lowast) le 0

Lemma 4 Suppose that condition1198671 1199014gt 0 119889

1gt 0 119889

2gt 0

(1199012+ 1199022)1198891minus 1199012

41198892gt 0 is satisfied

(1) If one of the followings holds (a) 1198630lt 0 (b) 119863

0ge

0 Δ ge 0 1199111gt 0 and ℎ(119911

1) lt 0 (c) 119863

0ge 0 and

Δ lt 0 and there exits at least a 119911lowastisin (1199111 1199112 1199113) such

that 119911lowast gt 0 and ℎ(119911lowast) le 0 then all roots of (10) have

negative real parts when 120591 isin [0 1205910) here 120591

0is a certain

positive constant

(2) If conditions (a)ndash(c) of (1) are not satisfied then all rootsof (10) have negative real parts for all 120591 ge 0

Proof When 120591 = 0 (10) can be reduced to

1205824+ 11990141205823+ 11990131205822+ (1199012+ 1199022) 120582 + (119901

1+ 1199021) = 0 (21)

According to the Routh-Hurwitz criterion all roots of(21) have negative real parts if and only if 119901

4gt 0 119889

1gt 0

1198892gt 0 and (119901

2+ 1199022)1198891minus 1199012

41198892gt 0

From Lemma 3 it can be known that if (a)ndash(c) are notsatisfied then (10) has no roots with zero real part for all 120591 ge

0 if one of (a)ndash(c) holds when 120591 = 120591(119895)

119896 119896 = 1 2 3 4 119895 gt 1

(10) has no roots with zero real part and 1205910is the minimum

value of 120591 so (10) has purely imaginary roots According to[18] one obtains the conclusion of the lemma

Let 120582(120591) = V(120591) + 119894120596(120591) be the root of (10) V(1205910) = 0 and

120596(1205910) = 1205960

From Lemmas 3 and 4 the following are obtained

When conditions (a)ndash(c) of Lemma 4(1) are not sat-isfied ℎ(119911) always has no positive root Therefore underthese conditions (10) has no purely imaginary roots forany 120591 gt 0 which implies that the positive equilibrium119864lowast

= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) of system (7) is absolutely stable

Therefore the following theorem on the stability of pos-itive equilibrium 119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) can be easily

obtained

0 50 100 150 200 250 3000

1

2

3

4

5

6

7

8times105

Time (s)

Hos

ts in

each

stat

e

S(t)

I(t)

Q(t)

D(t)

R(t)

Figure 2 Propagation trend of the five kinds of hosts when 120591 lt 1205910

0 500 1000 1500 20000

1

2

3

4

5

Rem

ovab

le d

evic

es in

each

stat

e

RS

R1

Time (s)

times104

Figure 3 Propagation trend of the two kinds of removable deviceswhen 120591 lt 120591

0

Theorem 5 Supposing that condition (1198671) is satisfied (a)

1198630ge 0 Δ ge 0 119911

1lt 0 and ℎ(119911

1) gt 0 (b) 119863

0ge 0 and Δ lt 0

and there is no 119911lowast isin (1199111 1199112 1199113) such that 119911lowast gt 0 and ℎ(119911

lowast) le

0 then the positive equilibrium 119864lowast

= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) of

system (7) is absolutely stableIn what follows it is assumed that the coefficients in ℎ(119911)

satisfy the condition(1198672) (a) 119863

0ge 0 Δ ge 0 119911

1lt 0 and ℎ(119911

1) gt 0 (b) 119863

0ge

0 Δ lt 0 and there is no 119911lowast isin (1199111 1199112 1199113) such that 119911lowast gt 0 and

ℎ(119911lowast) le 0According to [29] it is known that (19) has at least a positive

root 1205960 which implies that characteristic equation (10) has a

pair of purely imaginary roots plusmn1198941205960

Mathematical Problems in Engineering 7

0 500 1000 1500 2000 2500 3000 35000

1

2

3

4

5

6

7

8

Time (s)

Hos

ts in

each

stat

e

times105

S(t)

I(t)Q(t)

R(t)

Figure 4 Propagation trend of the four kinds of hosts when 120591 gt 1205910

0 500 1000 1500 2000 2500 3000 35000

1

2

3

4

5

Num

ber o

f rem

ovab

le d

evic

es

Time (s)

times104

RS

R1

Figure 5 Propagation trend of the two kinds of removable deviceswhen 120591 gt 120591

0

Since (10) has a pair of purely imaginary roots plusmn1198941205960 the

corresponding 120591119896gt 0 is given by (15) Consider

120591119896=

1

1205960

arccos [ ((1199020minus 11990221205962) (11990121205962

0minus 11990141205964

0minus 1199010)

+11990211205960(11990131205963

0minus 1205965

0minus 11990111205960))

times((1199020minus 11990221205962)

2

+ 1199022

11205962

0)

minus1

] +

2119896120587

1205960

(119896 = 0 1 2 3 )

(22)

0 100 200 300 400 500 6000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

120591 = 5120591 = 15

120591 = 45120591 = 90

Time (s)

times105

Figure 6 The number of infectious hosts when 120591 is changed in onecoordinate

Let 120582(120591) = V(120591) + 119894120596(120591) be the root of (10) V(120591119896) = 0 and

120596(120591119896) = 1205960are satisfied when 120591 = 120591

119896

Lemma 6 Suppose that ℎ1015840(1199110) = 0 If 120591 = 120591

0 then plusmn119894120596

0is

a pair of purely imaginary roots of (10) In addition if theconditions of Lemma 4(1) are satisfied then 119889Re 120582(120591

0)119889120591 gt 0

It is claimed that

sgn [119889Re 120582119889120591

]

120591=120591119896

= sgn ℎ1015840 (12059620) (23)

This signifies that there is at least one eigenvalue with positivereal part for 120591 gt 120591

119896

Differentiating two sides of (10) with respect to 120591 it can bewritten as

(

119889120582

119889120591

)

minus1

= ((51205824+ 411990141205823+ 311990131205822+ 21199012120582 + 1199011)

+ (21199022120582 + 1199021) 119890minus120582120591

minus (11990221205822+ 1199021120582 + 1199020) 120591119890minus120582120591

)

times ((11990221205822+ 1199021120582 + 1199020) 120582119890minus120582120591

)

minus1

=

(51205824+ 411990141205823+ 311990131205822+ 21199012120582 + 1199011) 119890120582120591

(11990221205822+ 1199021120582 + 1199020) 120582

+

21199022120582 + 1199021

(11990221205822+ 1199021120582 + 1199020) 120582

minus

120591

120582

(24)

8 Mathematical Problems in Engineering

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

120591 = 5

Time (s)

times105

(a)

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

Time (s)

times105 120591 = 15

(b)

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3120591 = 45

Num

ber o

f inf

ectio

us h

osts

Time (s)

times105

(c)

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3N

umbe

r of i

nfec

tious

hos

ts

Time (s)

times105 120591 = 90

(d)

Figure 7 The number of infectious hosts when 120591 is changed in four coordinates

0 05 1 15 2 25 30

1

2

3

4

5

6

7

8

I(t)

S(t)

times105

times105

120591 = 30

(a)

0 05 1 15 2 25 30

1

2

3

4

5

6

7

8

I(t)

S(t)

times105

times105

120591 = 60

(b)

Figure 8 The phase portrait of susceptible hosts 119878(119905) and infectious hosts 119868(119905)

Mathematical Problems in Engineering 9

0

12

1 23

0 0

2

4

6

8

I(t)

S(t)

times105

times105times105

R(t)

120591 = 30

(a)

0

12

12

3

0 0

2

4

6

8

I(t)

S(t)

times105

times105times105

R(t)

120591 = 60

(b)

Figure 9 The projection of the phase portrait of system (1) in (119878 119868 119877)-space

Therefore

sgn [119889Re 120582119889120591

]

120591=120591119896

= sgn[Re(119889120582

119889120591

)

minus1

]

120582=1198941205960

= sgn[Re((51205824+ 411990141205823+ 311990131205822+ 21199012120582 + 1199011) 119890120582120591

(11990221205822+ 1199021120582 + 1199020) 120582

+

21199022120582 + 1199021

(11990221205822+ 1199021120582 + 1199020) 120582

minus

120591

120582

)]

120582=1198941205960

= sgnRe ((51205964

0minus 411990141205963

0119894 minus 3119901

31205962

0+ 211990121205960119894 + 1199011)

times [cos (1205960120591119896) + 119894 sin (120596

0120591119896)] )

times ((11990211205960119894 + 1199020minus 11990221205962) 1205960119894)

minus1

+

211990221205960119894 + 1199021

(11990211205960119894 + 1199020minus 11990221205962) 1205960119894

= sgn1205962

0

119870

[41205966

0+ (3119901

2

4minus 61199013) 1205964

0

+ (21199012

3+ 41199011minus 411990121199014) 1205962

0

+ (1199012

2+ 211990101199014minus 211990111199013)]

= sgn1205962

0

Γ

= sgn1205962

0

Γ

ℎ1015840(1205962

0) = sgn ℎ1015840 (1205962

0)

(25)

where119870 = 1199022

11205964

0+(11990201205960minus11990221205963

0)2 It follows from the hypothesis

(1198672) that ℎ1015840(1205962

0) = 0 and therefore the transversality condition

holds It can be obtained that

119889(Re 120582)119889120591

10038161003816100381610038161003816100381610038161003816120591=120591119896

gt 0 (26)

0 10 20 30 40 50 60 70 80 900

2

4

6

8

10

12

14

16

Num

ber o

f inf

ectio

us h

osts

Hopf bifurcation

120591(S)

times104

Figure 10 Bifurcation diagram of system (1) with 120591 ranging from 1to 90

The root of characteristic equation (10) crosses from theleft to the right on the imaginary axis as 120591 continuously variesfrom a value less than 120591

119896to one greater than 120591

119896according

to Rouchersquos theorem [15] Therefore according to the Hopfbifurcation theorem [30] for functional differential equationsthe transversality condition holds and the conditions for Hopfbifurcation are satisfied at 120591 = 120591

119896 Then the following result can

be obtained

Theorem 7 Supposing that condition (1198671) is satisfied

(1) if 120591 isin [0 1205910) then the positive equilibrium 119864

lowast=

(119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) of system (7) is asymptotically

stable and unstable when 120591 gt 1205910

(2) if condition (1198672) is satisfied system (7) will undergo

a Hopf bifurcation at the positive equilibrium 119864lowast

=

(119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) when 120591 = 120591

119896(119896 = 0 1 2 )

where 120591119896is defined by (22)

This implies that when the time delay 120591 lt 1205910 the system

will stabilize at its infection equilibrium point which isbeneficial for us to implement a containment strategy whentime delay 120591 gt 120591

0 the system will be unstable and worms

cannot be effectively controlled

10 Mathematical Problems in Engineering

0 100 200 300 4000

2

4

6

8

Time (s)

Num

ber o

f sus

cept

ible

hos

tstimes105

Numerical curveSimulation curve

(a)

0 100 200 300 4000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

Time (s)

times105

Numerical curveSimulation curve

(b)

0 100 200 300 4000

1

2

3

4

5

Num

ber o

f qua

rant

ined

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(c)

0 100 200 300 4000

05

1

15

2N

umbe

r of r

emov

ed h

osts

Time (s)

times105

Numerical curveSimulation curve

(d)

Figure 11 Comparisons between numerical curves and simulation curves when 120591 lt 1205910

4 Numerical Analysis

In this section several numerical results are presented toprove the correctness of theoretical analysis above 750000hosts and 50000 removable devices are selected as thepopulation size the wormrsquos average scan rate is 120578 = 4000

per second The worm infection rate can be calculated as 120572 =

120578119873232

= 0698 which means that average 0698 hosts of allthe hosts can be scanned by one infectious hostThe infectionratio is 120573

1= 1205782

32= 000000093 The contact infection rate

between hosts and removable devices is 1205732= 00045 The

recovery rates of infectious hosts and removable devices are1205741= 002 and 120574

2= 0005 respectively The immunization

rate of quarantined hosts is 120575 = 005 and the reassembly rateof immunization hosts is 120596 = 008 At the beginning there

are 50 infectious hosts and 20 infectious removable deviceswhile the rest of hosts and removable devices are susceptible

In anomaly intrusion detection system the rate at whichinfected hosts are detected and quarantined is 120579

2= 02 per

second It means that an infected host can be detected andquarantined in about 5 s The rate at which susceptible hostsare detected and quarantined is 120579

1= 000002315 per second

that is about two false alarms are generated by the anomalyintrusion detection system per day

When 120591 = 5 lt 1205910 Figure 2 presents the changes

of the number of five kinds of hosts and Figure 3 showsthe curves of two kinds of removable devices According toTheorem 5 the positive equilibrium119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868)

is asymptotically stable when 120591 isin [0 1205910) which is illustrated

by the numerical simulations in Figures 2 and 3 Finally the

Mathematical Problems in Engineering 11

0 500 1000 1500 20000

2

4

6

8

Num

ber o

f sus

cept

ible

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(a)

0 500 1000 1500 20000

05

1

15

2

25

3

Time (s)

Num

ber o

f inf

ectio

us h

osts

times105

Numerical curveSimulation curve

(b)

0 500 1000 1500 20000

1

2

3

4

5

Num

ber o

f qua

rant

ined

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(c)

0 500 1000 1500 20000

05

1

15

2

Num

ber o

f rem

oved

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(d)

Figure 12 Comparisons between numerical curves and simulation curves when 120591 gt 1205910

number of every kind of host and removable device keepsstable

When 120591 gets increased and passes through the threshold1205910 the positive equilibrium 119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) will

lose its stability and a Hopf bifurcation will occur A familyof periodic solution bifurcates from the positive equilibrium119864lowast When 120591 = 45 gt 120591

0 Figure 4 shows the curves of

susceptible infectious quarantined and removed hosts andthe numerical simulation results of two kinds of removabledevices are depicted by Figure 5 FromFigures 4 and 5 we canclearly see that every state of hosts and removable devices isunstable Figure 4 shows that the number of infectious hostswill outburst after a short period of peace and repeat againand again

In order to state the influence of time delay the delay 120591

is set to a different value each time with other parameters

remaining unchanged Figure 6 shows four curves of thenumber of infectious hosts in the same coordinate with fourdelays 120591 = 5 120591 = 15 120591 = 45 and 120591 = 90 respectively Figures7(a)ndash7(c) show four curves of the number of infectious hostsin four coordinates Initially the four curves are overlappedwhich means that the time delay has little effect on the initialstate of worm spread With the increase of the time T thetime delay affects the number of infectious hosts With theincrease of time delay the curve begins to oscillate Thesystem becomes unstable as time delay passes through thecritical value 120591

0 At the same time it can be discovered that

the amplitude and period of the number of infectious hostsgradually increase

Figures 8(a) and 8(b) show the phase portraits of suscep-tible hosts 119878(119905) and infectious hosts 119868(119905) with 120591 = 30 lt 120591

0

and 120591 = 60 gt 1205910 respectively Figures 9(a) and 9(b) show

12 Mathematical Problems in Engineering

the projection of the phase portrait of system (1) in (119878 119868 119877)-space when 120591 = 30 lt 120591

0and 120591 = 60 gt 120591

0 respectively It is

clear that the curve converges to a fixed point when 120591 lt 1205910

whichmeans that the system is stableWhen 120591 gt 1205910 the curve

converges to a limit circle which implies that the system isunstable and the worm propagation is out of control

Figure 10 shows the bifurcation diagram with 120591 from 1 to90 It is clear that Hopf bifurcation will occur when 120591 = 120591

0=

35

5 Simulation Experiments

In our simulation experiments the discrete-time simulationis adopted because of its accuracy and is less time-consumingThe discrete-time simulation is an expanded version of Zoursquosprogram simulating Code Red worm propagation All of theparameters are consistent with the numerical experiments

Figures 11(a)ndash11(d) show the comparisons betweennumerical and simulation curves of susceptible infectiousquarantined and removed hosts when 120591 = 5 lt 120591

0

respectively It is clearly seen that the simulation curvesmatch the numerical ones very well Figures 12(a)ndash12(d)show the comparisons between numerical and simulationresults of four kinds of hosts when 120591 = 90 gt 120591

0 In this

figure two curves are still matched well It fully illustratesthe correctness of our theoretical analysis

6 Conclusions

In this paper considering the influence of removable devicesa delayed worm propagation dynamical system based onanomaly IDS has been constructed By regarding the timedelay caused by time window of anomaly IDS as the bifur-cation parameter the local asymptotic stability at the posi-tive equilibrium and local Hopf bifurcation were discussedThrough theoretical analysis and related experiments themain conclusions can be summarized as follows

(a) The critical time delay 1205910where Hopf bifurcation

appears is derived

1205910=

1

1205960

arccos [ ((1199020minus 11990221205962) (11990121205962

0minus 11990141205964

0minus 1199010)

+11990211205960(11990131205963

0minus 1205965

0minus 11990111205960))

times((1199020minus 11990221205962)

2

+ 1199022

11205962

0)

minus1

]

(27)

(b) When the time delay 120591 lt 1205910 worm propagation sys-

tem is stable and wormsrsquo behavior is easy to predictwhich is beneficial for us to implement containmentstrategy to control and eliminate the worm

(c) When time delay 120591 ge 1205910 Hopf bifurcation occurs

which implies that the system will be unstable andcontainment strategy does not work effectively

Thus in order to control and even eliminate the wormthe size of time window of anomaly IDS must be less than

1205910 In real network environment various factors can affect

worm propagationThis paper concentrates on analyzing theinfluence of time delay caused by anomaly IDS other factorshaving an impact on worm propagation will be the center ofour future study

Conflict of Interests

The authors declare that there is no conflict of interestsregarding the publication of this paper

Acknowledgments

This paper is supported by the Program for New CenturyExcellent Talents in University (NCET-13-0113) Natural Sci-ence Foundation of Liaoning Province of China under Grantno 201202059 Program for Liaoning Excellent Talents inUniversity under LR2013011 Fundamental Research Funds ofthe Central Universities under Grant nos N120504006 andN100704001 and MOE-Intel Special Fund of InformationTechnology (MOE-INTEL-2012-06)

References

[1] P Porras H Saidi and V Yegneswaran An Analysis of Con-fickerrsquos Logic and Rendezvous Point SRI International 2009

[2] Unruly USB ldquoDevices Expose Networks to Malwarerdquo httpwwwaspirantinfotechcomsgdownloadlumensionbrochureUnruly-USB-Devices-Expose-Networks-to-Malwarepdf

[3] E Byres A Ginter and J Langill ldquoHow stuxnet spreadsmdashastudy of infection paths in best practice systemsrdquo White Paper2011

[4] N Falliere L O Murchu and E Chien ldquoW32Stuxnet DossierrdquoSymantec Security Response 2011

[5] Win32Stuxnet httpwwwsymanteccomsecurity responsewriteupjspdocid=2010-071400-3123-99

[6] Flamer Highly Sophisticated and Discreet Threat Targets theMiddle East httpwwwsymanteccomconnectblogsflamer-highly-sophisticated-and-discreet-threat-targets-middle-east

[7] W32Flamer httpwwwsymanteccomsecurity responsewriteupjspdocid=2012-052811-0308-99

[8] W O Kermack and A G Mckendrick ldquoA contribution to themathematical theory of epidemicsrdquo Proceedings of the RoyalSociety A vol 115 no 772 pp 700ndash721 1927

[9] C C Zou W Gong and D Towsley ldquoCode red worm prop-agation modeling and analysisrdquo in Proceedings of the 9th ACMConference onComputer andCommunications Security pp 138ndash147 Washington DC USA November 2002

[10] C C Zou W B Gong and D Towsley ldquoWorm propagationmodeling and analysis under dynamic quarantine defenserdquo inProceedings of the ACM Workshop on Rapid Malcode (WORMrsquo03) pp 51ndash60 Washington DC USA October 2003

[11] F Wang Y Zhang C Wang J Ma and S Moon ldquoStabilityanalysis of a SEIQV epidemic model for rapid spreadingwormsrdquo Computers and Security vol 29 no 4 pp 410ndash4182010

[12] Y Yao W Xiang A Qu G Yu and F Gao ldquoHopf bifurcationin an SEIDQV worm propagation model with quarantinestrategyrdquo Discrete Dynamics in Nature and Society vol 2012Article ID 304868 18 pages 2012

Mathematical Problems in Engineering 13

[13] Y Yao L Guo H Guo G Yu F Gao and X Tong ldquoPulsequarantine strategy of internet worm propagation modelingand analysisrdquo Computers and Electrical Engineering vol 38 no5 pp 1047ndash1061 2012

[14] B KMishra andN Jha ldquoSEIQRSmodel for the transmission ofmalicious objects in computer networkrdquo Applied MathematicalModelling vol 34 no 3 pp 710ndash715 2010

[15] B D Hassard N D Kazarinoff and Y H Wan Theory andApplications of Hopf Bifurcation vol 41 of LondonMathematicalSociety Lecture Note Series Cambridge University Press Cam-bridge UK 1981

[16] Y Yao N Zhang W Xiang G Yu and F Gao ldquoModeling andanalysis of bifurcation in a delayed worm propagation modelrdquoJournal of Applied Mathematics vol 2013 Article ID 927369 11pages 2013

[17] W Yu and J Cao ldquoHopf bifurcation and stability of periodicsolutions for van der Pol equation with time delayrdquo NonlinearAnalysis Theory Methods and Applications vol 62 no 1 pp141ndash165 2005

[18] J Zhang W Li and X Yan ldquoHopf bifurcation and stabilityof periodic solutions in a delayed eco-epidemiological systemrdquoApplied Mathematics and Computation vol 198 no 2 pp 865ndash876 2008

[19] X Han and Q Tan ldquoDynamical behavior of computer virus onInternetrdquoAppliedMathematics and Computation vol 217 no 6pp 2520ndash2526 2010

[20] T Dong X Liao and H Li ldquoStability and Hopf bifurcation ina computer virus model with multistate antivirusrdquo Abstract andApplied Analysis vol 2012 Article ID 841987 16 pages 2012

[21] Y Yao X Xie H Guo G Yu F Gao and X Tong ldquoHopfbifurcation in an Internet worm propagation model with timedelay in quarantinerdquo Mathematical and Computer Modellingvol 57 no 11-12 pp 2635ndash2646 2013

[22] J Ren X Yang Q Zhu L Yang and C Zhang ldquoA novelcomputer virus model and its dynamicsrdquo Nonlinear AnalysisReal World Applications vol 13 no 1 pp 376ndash384 2012

[23] L Wu X Su and P Shi ldquoSliding mode control with bounded1198972gain performance of Markovian jump singular time-delay

systemsrdquo Automatica vol 48 no 8 pp 1929ndash1933 2012[24] F Li and X Zhang ldquoA delay-dependent bounded real lemma

for singular LPV systems with time-variant delayrdquo InternationalJournal of Robust and Nonlinear Control vol 22 no 5 pp 559ndash574 2012

[25] F Li P Shi L Wu and X Zhang ldquoFuzzy-model-based D-stability and non-fragile control for discrete-time descriptorsystems with multiple delaysrdquo IEEE Transaction on FuzzySystem vol 99 1 page 2013

[26] L Song J Zhen G Sun J Zhang and X Han ldquoInfluence ofremovable devices on computer worms dynamic analysis andcontrol strategiesrdquo Computers and Mathematics with Applica-tions vol 61 no 7 pp 1823ndash1829 2011

[27] Q Zhu X Yang and J Ren ldquoModeling and analysis ofthe spread of computer virusrdquo Communications in NonlinearScience and Numerical Simulation vol 17 no 12 pp 5117ndash51242012

[28] S Wang Q Liu X Yu and Y Ma ldquoBifurcation analysisof a model for network worm propagation with time delayrdquoMathematical and ComputerModelling vol 52 no 3-4 pp 435ndash447 2010

[29] LWang Y Fan andW Li ldquoMultiple bifurcations in a predator-prey system with monotonic functional responserdquo Applied

Mathematics and Computation vol 172 no 2 pp 1103ndash11202006

[30] J K Hale and S M Verduyn Lunel Introduction to FunctionalDifferential Equations vol 99 Springer New York NY USA1993

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

4 Mathematical Problems in Engineering

1205731SIS R

D

Q

I

1205792I

120575

1205741I

1205791S

120596

1205791S(t minus 120591)+

1205792I(t minus 120591)

RS RI

1205742(RN)R1

1205732(R1N)S

1205732(1N)RS

Figure 1 The state transition diagram

where

1198871= 12059612057311205732+ 120574112057421205731+ 120573112057421205792

1198872= 120573112057421205791 119887

3=

1205732

2120596119877119873

119873 minus 12057911205742(1205741+ 1205792)

1198874= (1205741+ 1205792) (1205961205732+ 12057411205742+ 12057421205792)

(4)

Assume that system (1) becomes stable at time 119879 By integrat-ing the fourth equation of system (1) with time 119905 from 0 to119879 + 120591 we can get

119863 = 1205791119878lowast120591 + 1205792119868lowast120591 (5)

Since 119878 + 119868 + 119863 + 119876 + 119877 = 119873

119878lowast+

1198872119878lowast2

+ 1198873119878lowast

1198874minus 1198871119878lowast

+ 1205791119878lowast120591 + 1205792119868lowast120591

+

1205791119878lowast+ 1205792119868lowast

120575

+

1205741119868lowast+ 1205791119878lowast+ 1205792119868lowast

120596

= 119873

(6)

Obviously (6) has one unique positive root 119868lowast So there is oneunique positive equilibrium119864

lowast= (119878lowast 119868lowast 119863lowast 119876lowast 119877lowast 119877lowast

119878 119877lowast

119868)

of system (1) The proof is completed

Since 119878 + 119868 + 119863 + 119876 + 119877 = 119873 119877119878+ 119877119868= 119877119873 119876 = 119873 minus 119878 minus

119868 minus 119863 minus 119877 119877119878= 119877119873minus 119877119868 System (1) can be simplified to

119889119878 (119905)

119889119905

= minus1205731119878 (119905) 119868 (119905) minus 120573

2

119877119868 (119905)

119873

119878 (119905) + 120596119877 (119905) minus 1205791119878 (119905)

119889119868 (119905)

119889119905

= 1205731119878 (119905) 119868 (119905) + 120573

2

119877119868 (119905)

119873

119878 (119905) minus 1205741119868 (119905) minus 120579

2119868 (119905)

119889119877 (119905)

119889119905

= 1205741119868 (119905) minus 120596119877 (119905)

+ 120575 (119873 minus 119878 (119905) minus 119868 (119905) minus 119863 (119905) minus 119877 (119905))

119889119863 (119905)

119889119905

= 1205791119878 (119905) minus 120579

1119878 (119905 minus 120591) + 120579

2119868 (119905) minus 120579

2119868 (119905 minus 120591)

119889119877119868(119905)

119889119905

= 1205732

119868 (119905)

119873

(119877119873minus 119877119868 (119905)) minus 120574

2

119877 (119905)

119873

119877119868 (119905)

(7)The Jacobian matrix of (7) about 119864lowast = (119878

lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) is

given by

119869 (119864lowast) =

((((

(

minus1205731119868lowastminus 1205732

119877lowast

119868

119873

minus 1205791

minus1205731119878lowast

120596 0 minus

1205732119878lowast

119873

1205731119868lowast+ 1205732

119877lowast

119868

119873

1205731119878lowastminus 1205741minus 1205792

0 0

1205732119878lowast

119873

minus120575 1205741minus 120575 minus120596 minus 120575 minus120575 0

1205791minus 1205791119890minus120582120591

1205792minus 1205792119890minus120582120591

0 0 0

0

1205732(119877119873minus 119877lowast

119868)

119873

minus

1205742119877lowast

119868

119873

0 minus

1205732119868lowast+ 1205742119877lowast

119873

))))

)

(8)

Let

1198881= 1205731119868lowast+ 1205732

119877lowast

119868

119873

1198882= 1205731119878lowast

1198883=

1205732119878lowast

119873

1198884=

1205732(119877119873minus 119877lowast

119868)

119873

Mathematical Problems in Engineering 5

1198885=

1205742119877lowast

119868

119873

1198886=

1205732119868lowast+ 1205742119877lowast

119873

1199014= 1198886minus 1198882+ 1205741+ 1205792+ 120596 + 120575 + 119888

1+ 1205791

1199013= 1198886(minus1198882+ 1205741+ 1205792) + (120596 + 120575 + 119888

1+ 1205791) (1198886minus 1198882+ 1199031+ 1205792)

+ (1198881+ 1205791) (120596 + 120575) minus 119888

31198884+ 11988811198882+ 120575120596

1199012= 1198886(120596 + 120575 + 119888

1+ 1205791) (minus1198882+ 1205741+ 1205792)

+ ((1198881+ 1205791) (120596 + 120575) + 120575120596) (119888

6minus 1198882+ 1205741+ 1205792)

minus 11988831198884(1205791+ 120596 + 120575) + 119888

11198882(1198886+ 120596 + 120575)

+ (1198881120596 minus 11988831198885) (120575 minus 120574

1) + 120575 (119888

3+ 1205961205791)

1199011= (1198886(1198881+ 1205791) (120596 + 120575) + 119888

6120575120596 + 120575119888

3) (minus1198882+ 1205741+ 1205792)

+ (119888111988821198886minus 120579111988831198884) (120596 + 120575) + (119888

11198886120596 minus 120579111988831198885) (120575 minus 120574

1)

minus 120575120596 (11988831198884+ 1205792+ 1205791(1198886minus 1198882+ 1205741+ 1205792))

+ 1205751198885(11988821198883+ 11988831205791minus 12057921205793)

1199010= 120575120596 (120579

21198886minus 120579111988831198884+ 12057911198886(minus1198882+ 1205741+ 1205792))

+ 1205751198885(120579111988821198883+ 120579211988811198883+ 11988831205791(minus1198882+ 1205741+ 1205792)

minus11988831205792(1198881+ 1205791))

1199022= minus120575120579

1120596

1199021= minus120575120596 (120579

2+ 1205791(1198886minus 1198882+ 1205741+ 1205792)) minus 120575119888

5(11988831205791minus 11988831205792)

1199020= 120575120596 (120579

21198886minus 120579111988831198884+ 11988861205791(minus1198882+ 1205741+ 1205792))

+ 1205751198885(120579111988821198883+ 120579211988811198883+ 12057911198883(minus1198882+ 1205741+ 1205792)

minus11988831205792(1198881+ 1205791))

(9)The characteristic equation of system (8) can be obtained by

119875 (120582) + 119876 (120582) 119890minus120582120591

= 0 (10)where

119875 (120582) = 1205825+ 11990141205824+ 11990131205823+ 11990121205822+ 1199011120582 + 1199010

119876 (120582) = 11990221205822+ 1199021120582 + 1199020

(11)

Theorem 2 The positive equilibrium 119864lowast is locally asymptoti-

cally stable without time delay if condition (1198671) is satisfied

1198671 1199014gt 0 119889

1gt 0 119889

2gt 0

(1199012+ 1199022) 1198891minus 1199012

41198892gt 0

(12)

where1198891= 11990131199014minus (1199012+ 1199022) 119889

2= 1199011+ 1199021 (13)

Proof When 120591 = 0 (10) reduces to

1205825+ 11990141205824+ 11990131205823+ (1199012+ 1199022) 1205822

+ (1199011+ 1199021) 120582 + (119901

0+ 1199020) = 0

(14)

According to Routh-Hurwitz criterion all roots of (14)have negative real parts Therefore it can be concludedthat the positive equilibrium 119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) is

locally asymptotically stable without time delay The proof iscompleted

If 120582 = 119894120596 (120596 gt 0) is the root of (10) separating thereal and imaginary parts the following two equations can beobtained

11990141205964minus 11990121205962+ 1199010+ 1199021120596 sin (120596120591)

minus 11990221205962 cos (120596120591) + 119902

0cos (120596120591) = 0

1205965minus 11990131205963+ 1199011120596 + 1199021120596 cos (120596120591)

+ 11990221205962 sin (120596120591) minus 119902

0sin (120596120591) = 0

(15)

From (15) the following equation can be obtained

1199022

11205962+ (1199020minus 11990221205962)

2

= (11990141205964minus 11990121205962+ 1199010)

2

+ (1205965minus 11990131205963+ 1199011120596)

2

(16)

That is

1205968+ 11986331205966+ 11986321205964+ 11986311205962+ 1198630= 0 (17)

where

1198633= 1199012

4minus 21199013 119863

2= 1199012

3+ 21199011minus 211990121199014

1198631= 1199012

2minus 1199022

2+ 211990101199014minus 211990111199013

1198630= 1199012

1minus 1199022

1+ 211990201199022minus 211990101199012

(18)

Letting 119911 = 1205962 (17) can be written as

ℎ (119911) = 1199114+ 11986331199113+ 11986321199112+ 1198631119911 + 119863

0 (19)

Zhang et al [18] obtained the following results on thedistribution of roots of (19) Denote

119898 =

1

2

1198632minus

3

16

1198632

3 119899 =

1

32

1198633

3minus

1

8

11986331198632+ 1198631

Δ = (

119899

2

)

2

+ (

119898

3

)

3

120590 =

minus1 + radic3119894

2

1199101=3radicminus

119899

2

+ radicΔ +3radicminus

119899

2

minus radicΔ

1199102=3radicminus

119899

2

+ radicΔ120590 +3radicminus

119899

2

minus radicΔ1205902

6 Mathematical Problems in Engineering

1199103=3radicminus

119899

2

+ radicΔ1205902+3radicminus

119899

2

minus radicΔ120590

119911119894= 119910119894minus

31198633

4

(119894 = 1 2 3)

(20)

Lemma 3 For the polynomial equation (19)

(1) if1198630lt 0 then (19) has at least one positive root

(2) if 1198630ge 0 and Δ ge 0 then (19) has positive root if and

only if 1199111gt 0 and ℎ(119911

1) lt 0

(3) if 1198630ge 0 and Δ lt 0 then (19) has positive root if and

only if there exists at least one 119911lowast isin (1199111 1199112 1199113) such

that 119911lowast gt 0 and ℎ(119911lowast) le 0

Lemma 4 Suppose that condition1198671 1199014gt 0 119889

1gt 0 119889

2gt 0

(1199012+ 1199022)1198891minus 1199012

41198892gt 0 is satisfied

(1) If one of the followings holds (a) 1198630lt 0 (b) 119863

0ge

0 Δ ge 0 1199111gt 0 and ℎ(119911

1) lt 0 (c) 119863

0ge 0 and

Δ lt 0 and there exits at least a 119911lowastisin (1199111 1199112 1199113) such

that 119911lowast gt 0 and ℎ(119911lowast) le 0 then all roots of (10) have

negative real parts when 120591 isin [0 1205910) here 120591

0is a certain

positive constant

(2) If conditions (a)ndash(c) of (1) are not satisfied then all rootsof (10) have negative real parts for all 120591 ge 0

Proof When 120591 = 0 (10) can be reduced to

1205824+ 11990141205823+ 11990131205822+ (1199012+ 1199022) 120582 + (119901

1+ 1199021) = 0 (21)

According to the Routh-Hurwitz criterion all roots of(21) have negative real parts if and only if 119901

4gt 0 119889

1gt 0

1198892gt 0 and (119901

2+ 1199022)1198891minus 1199012

41198892gt 0

From Lemma 3 it can be known that if (a)ndash(c) are notsatisfied then (10) has no roots with zero real part for all 120591 ge

0 if one of (a)ndash(c) holds when 120591 = 120591(119895)

119896 119896 = 1 2 3 4 119895 gt 1

(10) has no roots with zero real part and 1205910is the minimum

value of 120591 so (10) has purely imaginary roots According to[18] one obtains the conclusion of the lemma

Let 120582(120591) = V(120591) + 119894120596(120591) be the root of (10) V(1205910) = 0 and

120596(1205910) = 1205960

From Lemmas 3 and 4 the following are obtained

When conditions (a)ndash(c) of Lemma 4(1) are not sat-isfied ℎ(119911) always has no positive root Therefore underthese conditions (10) has no purely imaginary roots forany 120591 gt 0 which implies that the positive equilibrium119864lowast

= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) of system (7) is absolutely stable

Therefore the following theorem on the stability of pos-itive equilibrium 119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) can be easily

obtained

0 50 100 150 200 250 3000

1

2

3

4

5

6

7

8times105

Time (s)

Hos

ts in

each

stat

e

S(t)

I(t)

Q(t)

D(t)

R(t)

Figure 2 Propagation trend of the five kinds of hosts when 120591 lt 1205910

0 500 1000 1500 20000

1

2

3

4

5

Rem

ovab

le d

evic

es in

each

stat

e

RS

R1

Time (s)

times104

Figure 3 Propagation trend of the two kinds of removable deviceswhen 120591 lt 120591

0

Theorem 5 Supposing that condition (1198671) is satisfied (a)

1198630ge 0 Δ ge 0 119911

1lt 0 and ℎ(119911

1) gt 0 (b) 119863

0ge 0 and Δ lt 0

and there is no 119911lowast isin (1199111 1199112 1199113) such that 119911lowast gt 0 and ℎ(119911

lowast) le

0 then the positive equilibrium 119864lowast

= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) of

system (7) is absolutely stableIn what follows it is assumed that the coefficients in ℎ(119911)

satisfy the condition(1198672) (a) 119863

0ge 0 Δ ge 0 119911

1lt 0 and ℎ(119911

1) gt 0 (b) 119863

0ge

0 Δ lt 0 and there is no 119911lowast isin (1199111 1199112 1199113) such that 119911lowast gt 0 and

ℎ(119911lowast) le 0According to [29] it is known that (19) has at least a positive

root 1205960 which implies that characteristic equation (10) has a

pair of purely imaginary roots plusmn1198941205960

Mathematical Problems in Engineering 7

0 500 1000 1500 2000 2500 3000 35000

1

2

3

4

5

6

7

8

Time (s)

Hos

ts in

each

stat

e

times105

S(t)

I(t)Q(t)

R(t)

Figure 4 Propagation trend of the four kinds of hosts when 120591 gt 1205910

0 500 1000 1500 2000 2500 3000 35000

1

2

3

4

5

Num

ber o

f rem

ovab

le d

evic

es

Time (s)

times104

RS

R1

Figure 5 Propagation trend of the two kinds of removable deviceswhen 120591 gt 120591

0

Since (10) has a pair of purely imaginary roots plusmn1198941205960 the

corresponding 120591119896gt 0 is given by (15) Consider

120591119896=

1

1205960

arccos [ ((1199020minus 11990221205962) (11990121205962

0minus 11990141205964

0minus 1199010)

+11990211205960(11990131205963

0minus 1205965

0minus 11990111205960))

times((1199020minus 11990221205962)

2

+ 1199022

11205962

0)

minus1

] +

2119896120587

1205960

(119896 = 0 1 2 3 )

(22)

0 100 200 300 400 500 6000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

120591 = 5120591 = 15

120591 = 45120591 = 90

Time (s)

times105

Figure 6 The number of infectious hosts when 120591 is changed in onecoordinate

Let 120582(120591) = V(120591) + 119894120596(120591) be the root of (10) V(120591119896) = 0 and

120596(120591119896) = 1205960are satisfied when 120591 = 120591

119896

Lemma 6 Suppose that ℎ1015840(1199110) = 0 If 120591 = 120591

0 then plusmn119894120596

0is

a pair of purely imaginary roots of (10) In addition if theconditions of Lemma 4(1) are satisfied then 119889Re 120582(120591

0)119889120591 gt 0

It is claimed that

sgn [119889Re 120582119889120591

]

120591=120591119896

= sgn ℎ1015840 (12059620) (23)

This signifies that there is at least one eigenvalue with positivereal part for 120591 gt 120591

119896

Differentiating two sides of (10) with respect to 120591 it can bewritten as

(

119889120582

119889120591

)

minus1

= ((51205824+ 411990141205823+ 311990131205822+ 21199012120582 + 1199011)

+ (21199022120582 + 1199021) 119890minus120582120591

minus (11990221205822+ 1199021120582 + 1199020) 120591119890minus120582120591

)

times ((11990221205822+ 1199021120582 + 1199020) 120582119890minus120582120591

)

minus1

=

(51205824+ 411990141205823+ 311990131205822+ 21199012120582 + 1199011) 119890120582120591

(11990221205822+ 1199021120582 + 1199020) 120582

+

21199022120582 + 1199021

(11990221205822+ 1199021120582 + 1199020) 120582

minus

120591

120582

(24)

8 Mathematical Problems in Engineering

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

120591 = 5

Time (s)

times105

(a)

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

Time (s)

times105 120591 = 15

(b)

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3120591 = 45

Num

ber o

f inf

ectio

us h

osts

Time (s)

times105

(c)

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3N

umbe

r of i

nfec

tious

hos

ts

Time (s)

times105 120591 = 90

(d)

Figure 7 The number of infectious hosts when 120591 is changed in four coordinates

0 05 1 15 2 25 30

1

2

3

4

5

6

7

8

I(t)

S(t)

times105

times105

120591 = 30

(a)

0 05 1 15 2 25 30

1

2

3

4

5

6

7

8

I(t)

S(t)

times105

times105

120591 = 60

(b)

Figure 8 The phase portrait of susceptible hosts 119878(119905) and infectious hosts 119868(119905)

Mathematical Problems in Engineering 9

0

12

1 23

0 0

2

4

6

8

I(t)

S(t)

times105

times105times105

R(t)

120591 = 30

(a)

0

12

12

3

0 0

2

4

6

8

I(t)

S(t)

times105

times105times105

R(t)

120591 = 60

(b)

Figure 9 The projection of the phase portrait of system (1) in (119878 119868 119877)-space

Therefore

sgn [119889Re 120582119889120591

]

120591=120591119896

= sgn[Re(119889120582

119889120591

)

minus1

]

120582=1198941205960

= sgn[Re((51205824+ 411990141205823+ 311990131205822+ 21199012120582 + 1199011) 119890120582120591

(11990221205822+ 1199021120582 + 1199020) 120582

+

21199022120582 + 1199021

(11990221205822+ 1199021120582 + 1199020) 120582

minus

120591

120582

)]

120582=1198941205960

= sgnRe ((51205964

0minus 411990141205963

0119894 minus 3119901

31205962

0+ 211990121205960119894 + 1199011)

times [cos (1205960120591119896) + 119894 sin (120596

0120591119896)] )

times ((11990211205960119894 + 1199020minus 11990221205962) 1205960119894)

minus1

+

211990221205960119894 + 1199021

(11990211205960119894 + 1199020minus 11990221205962) 1205960119894

= sgn1205962

0

119870

[41205966

0+ (3119901

2

4minus 61199013) 1205964

0

+ (21199012

3+ 41199011minus 411990121199014) 1205962

0

+ (1199012

2+ 211990101199014minus 211990111199013)]

= sgn1205962

0

Γ

= sgn1205962

0

Γ

ℎ1015840(1205962

0) = sgn ℎ1015840 (1205962

0)

(25)

where119870 = 1199022

11205964

0+(11990201205960minus11990221205963

0)2 It follows from the hypothesis

(1198672) that ℎ1015840(1205962

0) = 0 and therefore the transversality condition

holds It can be obtained that

119889(Re 120582)119889120591

10038161003816100381610038161003816100381610038161003816120591=120591119896

gt 0 (26)

0 10 20 30 40 50 60 70 80 900

2

4

6

8

10

12

14

16

Num

ber o

f inf

ectio

us h

osts

Hopf bifurcation

120591(S)

times104

Figure 10 Bifurcation diagram of system (1) with 120591 ranging from 1to 90

The root of characteristic equation (10) crosses from theleft to the right on the imaginary axis as 120591 continuously variesfrom a value less than 120591

119896to one greater than 120591

119896according

to Rouchersquos theorem [15] Therefore according to the Hopfbifurcation theorem [30] for functional differential equationsthe transversality condition holds and the conditions for Hopfbifurcation are satisfied at 120591 = 120591

119896 Then the following result can

be obtained

Theorem 7 Supposing that condition (1198671) is satisfied

(1) if 120591 isin [0 1205910) then the positive equilibrium 119864

lowast=

(119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) of system (7) is asymptotically

stable and unstable when 120591 gt 1205910

(2) if condition (1198672) is satisfied system (7) will undergo

a Hopf bifurcation at the positive equilibrium 119864lowast

=

(119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) when 120591 = 120591

119896(119896 = 0 1 2 )

where 120591119896is defined by (22)

This implies that when the time delay 120591 lt 1205910 the system

will stabilize at its infection equilibrium point which isbeneficial for us to implement a containment strategy whentime delay 120591 gt 120591

0 the system will be unstable and worms

cannot be effectively controlled

10 Mathematical Problems in Engineering

0 100 200 300 4000

2

4

6

8

Time (s)

Num

ber o

f sus

cept

ible

hos

tstimes105

Numerical curveSimulation curve

(a)

0 100 200 300 4000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

Time (s)

times105

Numerical curveSimulation curve

(b)

0 100 200 300 4000

1

2

3

4

5

Num

ber o

f qua

rant

ined

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(c)

0 100 200 300 4000

05

1

15

2N

umbe

r of r

emov

ed h

osts

Time (s)

times105

Numerical curveSimulation curve

(d)

Figure 11 Comparisons between numerical curves and simulation curves when 120591 lt 1205910

4 Numerical Analysis

In this section several numerical results are presented toprove the correctness of theoretical analysis above 750000hosts and 50000 removable devices are selected as thepopulation size the wormrsquos average scan rate is 120578 = 4000

per second The worm infection rate can be calculated as 120572 =

120578119873232

= 0698 which means that average 0698 hosts of allthe hosts can be scanned by one infectious hostThe infectionratio is 120573

1= 1205782

32= 000000093 The contact infection rate

between hosts and removable devices is 1205732= 00045 The

recovery rates of infectious hosts and removable devices are1205741= 002 and 120574

2= 0005 respectively The immunization

rate of quarantined hosts is 120575 = 005 and the reassembly rateof immunization hosts is 120596 = 008 At the beginning there

are 50 infectious hosts and 20 infectious removable deviceswhile the rest of hosts and removable devices are susceptible

In anomaly intrusion detection system the rate at whichinfected hosts are detected and quarantined is 120579

2= 02 per

second It means that an infected host can be detected andquarantined in about 5 s The rate at which susceptible hostsare detected and quarantined is 120579

1= 000002315 per second

that is about two false alarms are generated by the anomalyintrusion detection system per day

When 120591 = 5 lt 1205910 Figure 2 presents the changes

of the number of five kinds of hosts and Figure 3 showsthe curves of two kinds of removable devices According toTheorem 5 the positive equilibrium119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868)

is asymptotically stable when 120591 isin [0 1205910) which is illustrated

by the numerical simulations in Figures 2 and 3 Finally the

Mathematical Problems in Engineering 11

0 500 1000 1500 20000

2

4

6

8

Num

ber o

f sus

cept

ible

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(a)

0 500 1000 1500 20000

05

1

15

2

25

3

Time (s)

Num

ber o

f inf

ectio

us h

osts

times105

Numerical curveSimulation curve

(b)

0 500 1000 1500 20000

1

2

3

4

5

Num

ber o

f qua

rant

ined

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(c)

0 500 1000 1500 20000

05

1

15

2

Num

ber o

f rem

oved

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(d)

Figure 12 Comparisons between numerical curves and simulation curves when 120591 gt 1205910

number of every kind of host and removable device keepsstable

When 120591 gets increased and passes through the threshold1205910 the positive equilibrium 119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) will

lose its stability and a Hopf bifurcation will occur A familyof periodic solution bifurcates from the positive equilibrium119864lowast When 120591 = 45 gt 120591

0 Figure 4 shows the curves of

susceptible infectious quarantined and removed hosts andthe numerical simulation results of two kinds of removabledevices are depicted by Figure 5 FromFigures 4 and 5 we canclearly see that every state of hosts and removable devices isunstable Figure 4 shows that the number of infectious hostswill outburst after a short period of peace and repeat againand again

In order to state the influence of time delay the delay 120591

is set to a different value each time with other parameters

remaining unchanged Figure 6 shows four curves of thenumber of infectious hosts in the same coordinate with fourdelays 120591 = 5 120591 = 15 120591 = 45 and 120591 = 90 respectively Figures7(a)ndash7(c) show four curves of the number of infectious hostsin four coordinates Initially the four curves are overlappedwhich means that the time delay has little effect on the initialstate of worm spread With the increase of the time T thetime delay affects the number of infectious hosts With theincrease of time delay the curve begins to oscillate Thesystem becomes unstable as time delay passes through thecritical value 120591

0 At the same time it can be discovered that

the amplitude and period of the number of infectious hostsgradually increase

Figures 8(a) and 8(b) show the phase portraits of suscep-tible hosts 119878(119905) and infectious hosts 119868(119905) with 120591 = 30 lt 120591

0

and 120591 = 60 gt 1205910 respectively Figures 9(a) and 9(b) show

12 Mathematical Problems in Engineering

the projection of the phase portrait of system (1) in (119878 119868 119877)-space when 120591 = 30 lt 120591

0and 120591 = 60 gt 120591

0 respectively It is

clear that the curve converges to a fixed point when 120591 lt 1205910

whichmeans that the system is stableWhen 120591 gt 1205910 the curve

converges to a limit circle which implies that the system isunstable and the worm propagation is out of control

Figure 10 shows the bifurcation diagram with 120591 from 1 to90 It is clear that Hopf bifurcation will occur when 120591 = 120591

0=

35

5 Simulation Experiments

In our simulation experiments the discrete-time simulationis adopted because of its accuracy and is less time-consumingThe discrete-time simulation is an expanded version of Zoursquosprogram simulating Code Red worm propagation All of theparameters are consistent with the numerical experiments

Figures 11(a)ndash11(d) show the comparisons betweennumerical and simulation curves of susceptible infectiousquarantined and removed hosts when 120591 = 5 lt 120591

0

respectively It is clearly seen that the simulation curvesmatch the numerical ones very well Figures 12(a)ndash12(d)show the comparisons between numerical and simulationresults of four kinds of hosts when 120591 = 90 gt 120591

0 In this

figure two curves are still matched well It fully illustratesthe correctness of our theoretical analysis

6 Conclusions

In this paper considering the influence of removable devicesa delayed worm propagation dynamical system based onanomaly IDS has been constructed By regarding the timedelay caused by time window of anomaly IDS as the bifur-cation parameter the local asymptotic stability at the posi-tive equilibrium and local Hopf bifurcation were discussedThrough theoretical analysis and related experiments themain conclusions can be summarized as follows

(a) The critical time delay 1205910where Hopf bifurcation

appears is derived

1205910=

1

1205960

arccos [ ((1199020minus 11990221205962) (11990121205962

0minus 11990141205964

0minus 1199010)

+11990211205960(11990131205963

0minus 1205965

0minus 11990111205960))

times((1199020minus 11990221205962)

2

+ 1199022

11205962

0)

minus1

]

(27)

(b) When the time delay 120591 lt 1205910 worm propagation sys-

tem is stable and wormsrsquo behavior is easy to predictwhich is beneficial for us to implement containmentstrategy to control and eliminate the worm

(c) When time delay 120591 ge 1205910 Hopf bifurcation occurs

which implies that the system will be unstable andcontainment strategy does not work effectively

Thus in order to control and even eliminate the wormthe size of time window of anomaly IDS must be less than

1205910 In real network environment various factors can affect

worm propagationThis paper concentrates on analyzing theinfluence of time delay caused by anomaly IDS other factorshaving an impact on worm propagation will be the center ofour future study

Conflict of Interests

The authors declare that there is no conflict of interestsregarding the publication of this paper

Acknowledgments

This paper is supported by the Program for New CenturyExcellent Talents in University (NCET-13-0113) Natural Sci-ence Foundation of Liaoning Province of China under Grantno 201202059 Program for Liaoning Excellent Talents inUniversity under LR2013011 Fundamental Research Funds ofthe Central Universities under Grant nos N120504006 andN100704001 and MOE-Intel Special Fund of InformationTechnology (MOE-INTEL-2012-06)

References

[1] P Porras H Saidi and V Yegneswaran An Analysis of Con-fickerrsquos Logic and Rendezvous Point SRI International 2009

[2] Unruly USB ldquoDevices Expose Networks to Malwarerdquo httpwwwaspirantinfotechcomsgdownloadlumensionbrochureUnruly-USB-Devices-Expose-Networks-to-Malwarepdf

[3] E Byres A Ginter and J Langill ldquoHow stuxnet spreadsmdashastudy of infection paths in best practice systemsrdquo White Paper2011

[4] N Falliere L O Murchu and E Chien ldquoW32Stuxnet DossierrdquoSymantec Security Response 2011

[5] Win32Stuxnet httpwwwsymanteccomsecurity responsewriteupjspdocid=2010-071400-3123-99

[6] Flamer Highly Sophisticated and Discreet Threat Targets theMiddle East httpwwwsymanteccomconnectblogsflamer-highly-sophisticated-and-discreet-threat-targets-middle-east

[7] W32Flamer httpwwwsymanteccomsecurity responsewriteupjspdocid=2012-052811-0308-99

[8] W O Kermack and A G Mckendrick ldquoA contribution to themathematical theory of epidemicsrdquo Proceedings of the RoyalSociety A vol 115 no 772 pp 700ndash721 1927

[9] C C Zou W Gong and D Towsley ldquoCode red worm prop-agation modeling and analysisrdquo in Proceedings of the 9th ACMConference onComputer andCommunications Security pp 138ndash147 Washington DC USA November 2002

[10] C C Zou W B Gong and D Towsley ldquoWorm propagationmodeling and analysis under dynamic quarantine defenserdquo inProceedings of the ACM Workshop on Rapid Malcode (WORMrsquo03) pp 51ndash60 Washington DC USA October 2003

[11] F Wang Y Zhang C Wang J Ma and S Moon ldquoStabilityanalysis of a SEIQV epidemic model for rapid spreadingwormsrdquo Computers and Security vol 29 no 4 pp 410ndash4182010

[12] Y Yao W Xiang A Qu G Yu and F Gao ldquoHopf bifurcationin an SEIDQV worm propagation model with quarantinestrategyrdquo Discrete Dynamics in Nature and Society vol 2012Article ID 304868 18 pages 2012

Mathematical Problems in Engineering 13

[13] Y Yao L Guo H Guo G Yu F Gao and X Tong ldquoPulsequarantine strategy of internet worm propagation modelingand analysisrdquo Computers and Electrical Engineering vol 38 no5 pp 1047ndash1061 2012

[14] B KMishra andN Jha ldquoSEIQRSmodel for the transmission ofmalicious objects in computer networkrdquo Applied MathematicalModelling vol 34 no 3 pp 710ndash715 2010

[15] B D Hassard N D Kazarinoff and Y H Wan Theory andApplications of Hopf Bifurcation vol 41 of LondonMathematicalSociety Lecture Note Series Cambridge University Press Cam-bridge UK 1981

[16] Y Yao N Zhang W Xiang G Yu and F Gao ldquoModeling andanalysis of bifurcation in a delayed worm propagation modelrdquoJournal of Applied Mathematics vol 2013 Article ID 927369 11pages 2013

[17] W Yu and J Cao ldquoHopf bifurcation and stability of periodicsolutions for van der Pol equation with time delayrdquo NonlinearAnalysis Theory Methods and Applications vol 62 no 1 pp141ndash165 2005

[18] J Zhang W Li and X Yan ldquoHopf bifurcation and stabilityof periodic solutions in a delayed eco-epidemiological systemrdquoApplied Mathematics and Computation vol 198 no 2 pp 865ndash876 2008

[19] X Han and Q Tan ldquoDynamical behavior of computer virus onInternetrdquoAppliedMathematics and Computation vol 217 no 6pp 2520ndash2526 2010

[20] T Dong X Liao and H Li ldquoStability and Hopf bifurcation ina computer virus model with multistate antivirusrdquo Abstract andApplied Analysis vol 2012 Article ID 841987 16 pages 2012

[21] Y Yao X Xie H Guo G Yu F Gao and X Tong ldquoHopfbifurcation in an Internet worm propagation model with timedelay in quarantinerdquo Mathematical and Computer Modellingvol 57 no 11-12 pp 2635ndash2646 2013

[22] J Ren X Yang Q Zhu L Yang and C Zhang ldquoA novelcomputer virus model and its dynamicsrdquo Nonlinear AnalysisReal World Applications vol 13 no 1 pp 376ndash384 2012

[23] L Wu X Su and P Shi ldquoSliding mode control with bounded1198972gain performance of Markovian jump singular time-delay

systemsrdquo Automatica vol 48 no 8 pp 1929ndash1933 2012[24] F Li and X Zhang ldquoA delay-dependent bounded real lemma

for singular LPV systems with time-variant delayrdquo InternationalJournal of Robust and Nonlinear Control vol 22 no 5 pp 559ndash574 2012

[25] F Li P Shi L Wu and X Zhang ldquoFuzzy-model-based D-stability and non-fragile control for discrete-time descriptorsystems with multiple delaysrdquo IEEE Transaction on FuzzySystem vol 99 1 page 2013

[26] L Song J Zhen G Sun J Zhang and X Han ldquoInfluence ofremovable devices on computer worms dynamic analysis andcontrol strategiesrdquo Computers and Mathematics with Applica-tions vol 61 no 7 pp 1823ndash1829 2011

[27] Q Zhu X Yang and J Ren ldquoModeling and analysis ofthe spread of computer virusrdquo Communications in NonlinearScience and Numerical Simulation vol 17 no 12 pp 5117ndash51242012

[28] S Wang Q Liu X Yu and Y Ma ldquoBifurcation analysisof a model for network worm propagation with time delayrdquoMathematical and ComputerModelling vol 52 no 3-4 pp 435ndash447 2010

[29] LWang Y Fan andW Li ldquoMultiple bifurcations in a predator-prey system with monotonic functional responserdquo Applied

Mathematics and Computation vol 172 no 2 pp 1103ndash11202006

[30] J K Hale and S M Verduyn Lunel Introduction to FunctionalDifferential Equations vol 99 Springer New York NY USA1993

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

Mathematical Problems in Engineering 5

1198885=

1205742119877lowast

119868

119873

1198886=

1205732119868lowast+ 1205742119877lowast

119873

1199014= 1198886minus 1198882+ 1205741+ 1205792+ 120596 + 120575 + 119888

1+ 1205791

1199013= 1198886(minus1198882+ 1205741+ 1205792) + (120596 + 120575 + 119888

1+ 1205791) (1198886minus 1198882+ 1199031+ 1205792)

+ (1198881+ 1205791) (120596 + 120575) minus 119888

31198884+ 11988811198882+ 120575120596

1199012= 1198886(120596 + 120575 + 119888

1+ 1205791) (minus1198882+ 1205741+ 1205792)

+ ((1198881+ 1205791) (120596 + 120575) + 120575120596) (119888

6minus 1198882+ 1205741+ 1205792)

minus 11988831198884(1205791+ 120596 + 120575) + 119888

11198882(1198886+ 120596 + 120575)

+ (1198881120596 minus 11988831198885) (120575 minus 120574

1) + 120575 (119888

3+ 1205961205791)

1199011= (1198886(1198881+ 1205791) (120596 + 120575) + 119888

6120575120596 + 120575119888

3) (minus1198882+ 1205741+ 1205792)

+ (119888111988821198886minus 120579111988831198884) (120596 + 120575) + (119888

11198886120596 minus 120579111988831198885) (120575 minus 120574

1)

minus 120575120596 (11988831198884+ 1205792+ 1205791(1198886minus 1198882+ 1205741+ 1205792))

+ 1205751198885(11988821198883+ 11988831205791minus 12057921205793)

1199010= 120575120596 (120579

21198886minus 120579111988831198884+ 12057911198886(minus1198882+ 1205741+ 1205792))

+ 1205751198885(120579111988821198883+ 120579211988811198883+ 11988831205791(minus1198882+ 1205741+ 1205792)

minus11988831205792(1198881+ 1205791))

1199022= minus120575120579

1120596

1199021= minus120575120596 (120579

2+ 1205791(1198886minus 1198882+ 1205741+ 1205792)) minus 120575119888

5(11988831205791minus 11988831205792)

1199020= 120575120596 (120579

21198886minus 120579111988831198884+ 11988861205791(minus1198882+ 1205741+ 1205792))

+ 1205751198885(120579111988821198883+ 120579211988811198883+ 12057911198883(minus1198882+ 1205741+ 1205792)

minus11988831205792(1198881+ 1205791))

(9)The characteristic equation of system (8) can be obtained by

119875 (120582) + 119876 (120582) 119890minus120582120591

= 0 (10)where

119875 (120582) = 1205825+ 11990141205824+ 11990131205823+ 11990121205822+ 1199011120582 + 1199010

119876 (120582) = 11990221205822+ 1199021120582 + 1199020

(11)

Theorem 2 The positive equilibrium 119864lowast is locally asymptoti-

cally stable without time delay if condition (1198671) is satisfied

1198671 1199014gt 0 119889

1gt 0 119889

2gt 0

(1199012+ 1199022) 1198891minus 1199012

41198892gt 0

(12)

where1198891= 11990131199014minus (1199012+ 1199022) 119889

2= 1199011+ 1199021 (13)

Proof When 120591 = 0 (10) reduces to

1205825+ 11990141205824+ 11990131205823+ (1199012+ 1199022) 1205822

+ (1199011+ 1199021) 120582 + (119901

0+ 1199020) = 0

(14)

According to Routh-Hurwitz criterion all roots of (14)have negative real parts Therefore it can be concludedthat the positive equilibrium 119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) is

locally asymptotically stable without time delay The proof iscompleted

If 120582 = 119894120596 (120596 gt 0) is the root of (10) separating thereal and imaginary parts the following two equations can beobtained

11990141205964minus 11990121205962+ 1199010+ 1199021120596 sin (120596120591)

minus 11990221205962 cos (120596120591) + 119902

0cos (120596120591) = 0

1205965minus 11990131205963+ 1199011120596 + 1199021120596 cos (120596120591)

+ 11990221205962 sin (120596120591) minus 119902

0sin (120596120591) = 0

(15)

From (15) the following equation can be obtained

1199022

11205962+ (1199020minus 11990221205962)

2

= (11990141205964minus 11990121205962+ 1199010)

2

+ (1205965minus 11990131205963+ 1199011120596)

2

(16)

That is

1205968+ 11986331205966+ 11986321205964+ 11986311205962+ 1198630= 0 (17)

where

1198633= 1199012

4minus 21199013 119863

2= 1199012

3+ 21199011minus 211990121199014

1198631= 1199012

2minus 1199022

2+ 211990101199014minus 211990111199013

1198630= 1199012

1minus 1199022

1+ 211990201199022minus 211990101199012

(18)

Letting 119911 = 1205962 (17) can be written as

ℎ (119911) = 1199114+ 11986331199113+ 11986321199112+ 1198631119911 + 119863

0 (19)

Zhang et al [18] obtained the following results on thedistribution of roots of (19) Denote

119898 =

1

2

1198632minus

3

16

1198632

3 119899 =

1

32

1198633

3minus

1

8

11986331198632+ 1198631

Δ = (

119899

2

)

2

+ (

119898

3

)

3

120590 =

minus1 + radic3119894

2

1199101=3radicminus

119899

2

+ radicΔ +3radicminus

119899

2

minus radicΔ

1199102=3radicminus

119899

2

+ radicΔ120590 +3radicminus

119899

2

minus radicΔ1205902

6 Mathematical Problems in Engineering

1199103=3radicminus

119899

2

+ radicΔ1205902+3radicminus

119899

2

minus radicΔ120590

119911119894= 119910119894minus

31198633

4

(119894 = 1 2 3)

(20)

Lemma 3 For the polynomial equation (19)

(1) if1198630lt 0 then (19) has at least one positive root

(2) if 1198630ge 0 and Δ ge 0 then (19) has positive root if and

only if 1199111gt 0 and ℎ(119911

1) lt 0

(3) if 1198630ge 0 and Δ lt 0 then (19) has positive root if and

only if there exists at least one 119911lowast isin (1199111 1199112 1199113) such

that 119911lowast gt 0 and ℎ(119911lowast) le 0

Lemma 4 Suppose that condition1198671 1199014gt 0 119889

1gt 0 119889

2gt 0

(1199012+ 1199022)1198891minus 1199012

41198892gt 0 is satisfied

(1) If one of the followings holds (a) 1198630lt 0 (b) 119863

0ge

0 Δ ge 0 1199111gt 0 and ℎ(119911

1) lt 0 (c) 119863

0ge 0 and

Δ lt 0 and there exits at least a 119911lowastisin (1199111 1199112 1199113) such

that 119911lowast gt 0 and ℎ(119911lowast) le 0 then all roots of (10) have

negative real parts when 120591 isin [0 1205910) here 120591

0is a certain

positive constant

(2) If conditions (a)ndash(c) of (1) are not satisfied then all rootsof (10) have negative real parts for all 120591 ge 0

Proof When 120591 = 0 (10) can be reduced to

1205824+ 11990141205823+ 11990131205822+ (1199012+ 1199022) 120582 + (119901

1+ 1199021) = 0 (21)

According to the Routh-Hurwitz criterion all roots of(21) have negative real parts if and only if 119901

4gt 0 119889

1gt 0

1198892gt 0 and (119901

2+ 1199022)1198891minus 1199012

41198892gt 0

From Lemma 3 it can be known that if (a)ndash(c) are notsatisfied then (10) has no roots with zero real part for all 120591 ge

0 if one of (a)ndash(c) holds when 120591 = 120591(119895)

119896 119896 = 1 2 3 4 119895 gt 1

(10) has no roots with zero real part and 1205910is the minimum

value of 120591 so (10) has purely imaginary roots According to[18] one obtains the conclusion of the lemma

Let 120582(120591) = V(120591) + 119894120596(120591) be the root of (10) V(1205910) = 0 and

120596(1205910) = 1205960

From Lemmas 3 and 4 the following are obtained

When conditions (a)ndash(c) of Lemma 4(1) are not sat-isfied ℎ(119911) always has no positive root Therefore underthese conditions (10) has no purely imaginary roots forany 120591 gt 0 which implies that the positive equilibrium119864lowast

= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) of system (7) is absolutely stable

Therefore the following theorem on the stability of pos-itive equilibrium 119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) can be easily

obtained

0 50 100 150 200 250 3000

1

2

3

4

5

6

7

8times105

Time (s)

Hos

ts in

each

stat

e

S(t)

I(t)

Q(t)

D(t)

R(t)

Figure 2 Propagation trend of the five kinds of hosts when 120591 lt 1205910

0 500 1000 1500 20000

1

2

3

4

5

Rem

ovab

le d

evic

es in

each

stat

e

RS

R1

Time (s)

times104

Figure 3 Propagation trend of the two kinds of removable deviceswhen 120591 lt 120591

0

Theorem 5 Supposing that condition (1198671) is satisfied (a)

1198630ge 0 Δ ge 0 119911

1lt 0 and ℎ(119911

1) gt 0 (b) 119863

0ge 0 and Δ lt 0

and there is no 119911lowast isin (1199111 1199112 1199113) such that 119911lowast gt 0 and ℎ(119911

lowast) le

0 then the positive equilibrium 119864lowast

= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) of

system (7) is absolutely stableIn what follows it is assumed that the coefficients in ℎ(119911)

satisfy the condition(1198672) (a) 119863

0ge 0 Δ ge 0 119911

1lt 0 and ℎ(119911

1) gt 0 (b) 119863

0ge

0 Δ lt 0 and there is no 119911lowast isin (1199111 1199112 1199113) such that 119911lowast gt 0 and

ℎ(119911lowast) le 0According to [29] it is known that (19) has at least a positive

root 1205960 which implies that characteristic equation (10) has a

pair of purely imaginary roots plusmn1198941205960

Mathematical Problems in Engineering 7

0 500 1000 1500 2000 2500 3000 35000

1

2

3

4

5

6

7

8

Time (s)

Hos

ts in

each

stat

e

times105

S(t)

I(t)Q(t)

R(t)

Figure 4 Propagation trend of the four kinds of hosts when 120591 gt 1205910

0 500 1000 1500 2000 2500 3000 35000

1

2

3

4

5

Num

ber o

f rem

ovab

le d

evic

es

Time (s)

times104

RS

R1

Figure 5 Propagation trend of the two kinds of removable deviceswhen 120591 gt 120591

0

Since (10) has a pair of purely imaginary roots plusmn1198941205960 the

corresponding 120591119896gt 0 is given by (15) Consider

120591119896=

1

1205960

arccos [ ((1199020minus 11990221205962) (11990121205962

0minus 11990141205964

0minus 1199010)

+11990211205960(11990131205963

0minus 1205965

0minus 11990111205960))

times((1199020minus 11990221205962)

2

+ 1199022

11205962

0)

minus1

] +

2119896120587

1205960

(119896 = 0 1 2 3 )

(22)

0 100 200 300 400 500 6000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

120591 = 5120591 = 15

120591 = 45120591 = 90

Time (s)

times105

Figure 6 The number of infectious hosts when 120591 is changed in onecoordinate

Let 120582(120591) = V(120591) + 119894120596(120591) be the root of (10) V(120591119896) = 0 and

120596(120591119896) = 1205960are satisfied when 120591 = 120591

119896

Lemma 6 Suppose that ℎ1015840(1199110) = 0 If 120591 = 120591

0 then plusmn119894120596

0is

a pair of purely imaginary roots of (10) In addition if theconditions of Lemma 4(1) are satisfied then 119889Re 120582(120591

0)119889120591 gt 0

It is claimed that

sgn [119889Re 120582119889120591

]

120591=120591119896

= sgn ℎ1015840 (12059620) (23)

This signifies that there is at least one eigenvalue with positivereal part for 120591 gt 120591

119896

Differentiating two sides of (10) with respect to 120591 it can bewritten as

(

119889120582

119889120591

)

minus1

= ((51205824+ 411990141205823+ 311990131205822+ 21199012120582 + 1199011)

+ (21199022120582 + 1199021) 119890minus120582120591

minus (11990221205822+ 1199021120582 + 1199020) 120591119890minus120582120591

)

times ((11990221205822+ 1199021120582 + 1199020) 120582119890minus120582120591

)

minus1

=

(51205824+ 411990141205823+ 311990131205822+ 21199012120582 + 1199011) 119890120582120591

(11990221205822+ 1199021120582 + 1199020) 120582

+

21199022120582 + 1199021

(11990221205822+ 1199021120582 + 1199020) 120582

minus

120591

120582

(24)

8 Mathematical Problems in Engineering

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

120591 = 5

Time (s)

times105

(a)

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

Time (s)

times105 120591 = 15

(b)

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3120591 = 45

Num

ber o

f inf

ectio

us h

osts

Time (s)

times105

(c)

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3N

umbe

r of i

nfec

tious

hos

ts

Time (s)

times105 120591 = 90

(d)

Figure 7 The number of infectious hosts when 120591 is changed in four coordinates

0 05 1 15 2 25 30

1

2

3

4

5

6

7

8

I(t)

S(t)

times105

times105

120591 = 30

(a)

0 05 1 15 2 25 30

1

2

3

4

5

6

7

8

I(t)

S(t)

times105

times105

120591 = 60

(b)

Figure 8 The phase portrait of susceptible hosts 119878(119905) and infectious hosts 119868(119905)

Mathematical Problems in Engineering 9

0

12

1 23

0 0

2

4

6

8

I(t)

S(t)

times105

times105times105

R(t)

120591 = 30

(a)

0

12

12

3

0 0

2

4

6

8

I(t)

S(t)

times105

times105times105

R(t)

120591 = 60

(b)

Figure 9 The projection of the phase portrait of system (1) in (119878 119868 119877)-space

Therefore

sgn [119889Re 120582119889120591

]

120591=120591119896

= sgn[Re(119889120582

119889120591

)

minus1

]

120582=1198941205960

= sgn[Re((51205824+ 411990141205823+ 311990131205822+ 21199012120582 + 1199011) 119890120582120591

(11990221205822+ 1199021120582 + 1199020) 120582

+

21199022120582 + 1199021

(11990221205822+ 1199021120582 + 1199020) 120582

minus

120591

120582

)]

120582=1198941205960

= sgnRe ((51205964

0minus 411990141205963

0119894 minus 3119901

31205962

0+ 211990121205960119894 + 1199011)

times [cos (1205960120591119896) + 119894 sin (120596

0120591119896)] )

times ((11990211205960119894 + 1199020minus 11990221205962) 1205960119894)

minus1

+

211990221205960119894 + 1199021

(11990211205960119894 + 1199020minus 11990221205962) 1205960119894

= sgn1205962

0

119870

[41205966

0+ (3119901

2

4minus 61199013) 1205964

0

+ (21199012

3+ 41199011minus 411990121199014) 1205962

0

+ (1199012

2+ 211990101199014minus 211990111199013)]

= sgn1205962

0

Γ

= sgn1205962

0

Γ

ℎ1015840(1205962

0) = sgn ℎ1015840 (1205962

0)

(25)

where119870 = 1199022

11205964

0+(11990201205960minus11990221205963

0)2 It follows from the hypothesis

(1198672) that ℎ1015840(1205962

0) = 0 and therefore the transversality condition

holds It can be obtained that

119889(Re 120582)119889120591

10038161003816100381610038161003816100381610038161003816120591=120591119896

gt 0 (26)

0 10 20 30 40 50 60 70 80 900

2

4

6

8

10

12

14

16

Num

ber o

f inf

ectio

us h

osts

Hopf bifurcation

120591(S)

times104

Figure 10 Bifurcation diagram of system (1) with 120591 ranging from 1to 90

The root of characteristic equation (10) crosses from theleft to the right on the imaginary axis as 120591 continuously variesfrom a value less than 120591

119896to one greater than 120591

119896according

to Rouchersquos theorem [15] Therefore according to the Hopfbifurcation theorem [30] for functional differential equationsthe transversality condition holds and the conditions for Hopfbifurcation are satisfied at 120591 = 120591

119896 Then the following result can

be obtained

Theorem 7 Supposing that condition (1198671) is satisfied

(1) if 120591 isin [0 1205910) then the positive equilibrium 119864

lowast=

(119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) of system (7) is asymptotically

stable and unstable when 120591 gt 1205910

(2) if condition (1198672) is satisfied system (7) will undergo

a Hopf bifurcation at the positive equilibrium 119864lowast

=

(119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) when 120591 = 120591

119896(119896 = 0 1 2 )

where 120591119896is defined by (22)

This implies that when the time delay 120591 lt 1205910 the system

will stabilize at its infection equilibrium point which isbeneficial for us to implement a containment strategy whentime delay 120591 gt 120591

0 the system will be unstable and worms

cannot be effectively controlled

10 Mathematical Problems in Engineering

0 100 200 300 4000

2

4

6

8

Time (s)

Num

ber o

f sus

cept

ible

hos

tstimes105

Numerical curveSimulation curve

(a)

0 100 200 300 4000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

Time (s)

times105

Numerical curveSimulation curve

(b)

0 100 200 300 4000

1

2

3

4

5

Num

ber o

f qua

rant

ined

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(c)

0 100 200 300 4000

05

1

15

2N

umbe

r of r

emov

ed h

osts

Time (s)

times105

Numerical curveSimulation curve

(d)

Figure 11 Comparisons between numerical curves and simulation curves when 120591 lt 1205910

4 Numerical Analysis

In this section several numerical results are presented toprove the correctness of theoretical analysis above 750000hosts and 50000 removable devices are selected as thepopulation size the wormrsquos average scan rate is 120578 = 4000

per second The worm infection rate can be calculated as 120572 =

120578119873232

= 0698 which means that average 0698 hosts of allthe hosts can be scanned by one infectious hostThe infectionratio is 120573

1= 1205782

32= 000000093 The contact infection rate

between hosts and removable devices is 1205732= 00045 The

recovery rates of infectious hosts and removable devices are1205741= 002 and 120574

2= 0005 respectively The immunization

rate of quarantined hosts is 120575 = 005 and the reassembly rateof immunization hosts is 120596 = 008 At the beginning there

are 50 infectious hosts and 20 infectious removable deviceswhile the rest of hosts and removable devices are susceptible

In anomaly intrusion detection system the rate at whichinfected hosts are detected and quarantined is 120579

2= 02 per

second It means that an infected host can be detected andquarantined in about 5 s The rate at which susceptible hostsare detected and quarantined is 120579

1= 000002315 per second

that is about two false alarms are generated by the anomalyintrusion detection system per day

When 120591 = 5 lt 1205910 Figure 2 presents the changes

of the number of five kinds of hosts and Figure 3 showsthe curves of two kinds of removable devices According toTheorem 5 the positive equilibrium119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868)

is asymptotically stable when 120591 isin [0 1205910) which is illustrated

by the numerical simulations in Figures 2 and 3 Finally the

Mathematical Problems in Engineering 11

0 500 1000 1500 20000

2

4

6

8

Num

ber o

f sus

cept

ible

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(a)

0 500 1000 1500 20000

05

1

15

2

25

3

Time (s)

Num

ber o

f inf

ectio

us h

osts

times105

Numerical curveSimulation curve

(b)

0 500 1000 1500 20000

1

2

3

4

5

Num

ber o

f qua

rant

ined

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(c)

0 500 1000 1500 20000

05

1

15

2

Num

ber o

f rem

oved

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(d)

Figure 12 Comparisons between numerical curves and simulation curves when 120591 gt 1205910

number of every kind of host and removable device keepsstable

When 120591 gets increased and passes through the threshold1205910 the positive equilibrium 119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) will

lose its stability and a Hopf bifurcation will occur A familyof periodic solution bifurcates from the positive equilibrium119864lowast When 120591 = 45 gt 120591

0 Figure 4 shows the curves of

susceptible infectious quarantined and removed hosts andthe numerical simulation results of two kinds of removabledevices are depicted by Figure 5 FromFigures 4 and 5 we canclearly see that every state of hosts and removable devices isunstable Figure 4 shows that the number of infectious hostswill outburst after a short period of peace and repeat againand again

In order to state the influence of time delay the delay 120591

is set to a different value each time with other parameters

remaining unchanged Figure 6 shows four curves of thenumber of infectious hosts in the same coordinate with fourdelays 120591 = 5 120591 = 15 120591 = 45 and 120591 = 90 respectively Figures7(a)ndash7(c) show four curves of the number of infectious hostsin four coordinates Initially the four curves are overlappedwhich means that the time delay has little effect on the initialstate of worm spread With the increase of the time T thetime delay affects the number of infectious hosts With theincrease of time delay the curve begins to oscillate Thesystem becomes unstable as time delay passes through thecritical value 120591

0 At the same time it can be discovered that

the amplitude and period of the number of infectious hostsgradually increase

Figures 8(a) and 8(b) show the phase portraits of suscep-tible hosts 119878(119905) and infectious hosts 119868(119905) with 120591 = 30 lt 120591

0

and 120591 = 60 gt 1205910 respectively Figures 9(a) and 9(b) show

12 Mathematical Problems in Engineering

the projection of the phase portrait of system (1) in (119878 119868 119877)-space when 120591 = 30 lt 120591

0and 120591 = 60 gt 120591

0 respectively It is

clear that the curve converges to a fixed point when 120591 lt 1205910

whichmeans that the system is stableWhen 120591 gt 1205910 the curve

converges to a limit circle which implies that the system isunstable and the worm propagation is out of control

Figure 10 shows the bifurcation diagram with 120591 from 1 to90 It is clear that Hopf bifurcation will occur when 120591 = 120591

0=

35

5 Simulation Experiments

In our simulation experiments the discrete-time simulationis adopted because of its accuracy and is less time-consumingThe discrete-time simulation is an expanded version of Zoursquosprogram simulating Code Red worm propagation All of theparameters are consistent with the numerical experiments

Figures 11(a)ndash11(d) show the comparisons betweennumerical and simulation curves of susceptible infectiousquarantined and removed hosts when 120591 = 5 lt 120591

0

respectively It is clearly seen that the simulation curvesmatch the numerical ones very well Figures 12(a)ndash12(d)show the comparisons between numerical and simulationresults of four kinds of hosts when 120591 = 90 gt 120591

0 In this

figure two curves are still matched well It fully illustratesthe correctness of our theoretical analysis

6 Conclusions

In this paper considering the influence of removable devicesa delayed worm propagation dynamical system based onanomaly IDS has been constructed By regarding the timedelay caused by time window of anomaly IDS as the bifur-cation parameter the local asymptotic stability at the posi-tive equilibrium and local Hopf bifurcation were discussedThrough theoretical analysis and related experiments themain conclusions can be summarized as follows

(a) The critical time delay 1205910where Hopf bifurcation

appears is derived

1205910=

1

1205960

arccos [ ((1199020minus 11990221205962) (11990121205962

0minus 11990141205964

0minus 1199010)

+11990211205960(11990131205963

0minus 1205965

0minus 11990111205960))

times((1199020minus 11990221205962)

2

+ 1199022

11205962

0)

minus1

]

(27)

(b) When the time delay 120591 lt 1205910 worm propagation sys-

tem is stable and wormsrsquo behavior is easy to predictwhich is beneficial for us to implement containmentstrategy to control and eliminate the worm

(c) When time delay 120591 ge 1205910 Hopf bifurcation occurs

which implies that the system will be unstable andcontainment strategy does not work effectively

Thus in order to control and even eliminate the wormthe size of time window of anomaly IDS must be less than

1205910 In real network environment various factors can affect

worm propagationThis paper concentrates on analyzing theinfluence of time delay caused by anomaly IDS other factorshaving an impact on worm propagation will be the center ofour future study

Conflict of Interests

The authors declare that there is no conflict of interestsregarding the publication of this paper

Acknowledgments

This paper is supported by the Program for New CenturyExcellent Talents in University (NCET-13-0113) Natural Sci-ence Foundation of Liaoning Province of China under Grantno 201202059 Program for Liaoning Excellent Talents inUniversity under LR2013011 Fundamental Research Funds ofthe Central Universities under Grant nos N120504006 andN100704001 and MOE-Intel Special Fund of InformationTechnology (MOE-INTEL-2012-06)

References

[1] P Porras H Saidi and V Yegneswaran An Analysis of Con-fickerrsquos Logic and Rendezvous Point SRI International 2009

[2] Unruly USB ldquoDevices Expose Networks to Malwarerdquo httpwwwaspirantinfotechcomsgdownloadlumensionbrochureUnruly-USB-Devices-Expose-Networks-to-Malwarepdf

[3] E Byres A Ginter and J Langill ldquoHow stuxnet spreadsmdashastudy of infection paths in best practice systemsrdquo White Paper2011

[4] N Falliere L O Murchu and E Chien ldquoW32Stuxnet DossierrdquoSymantec Security Response 2011

[5] Win32Stuxnet httpwwwsymanteccomsecurity responsewriteupjspdocid=2010-071400-3123-99

[6] Flamer Highly Sophisticated and Discreet Threat Targets theMiddle East httpwwwsymanteccomconnectblogsflamer-highly-sophisticated-and-discreet-threat-targets-middle-east

[7] W32Flamer httpwwwsymanteccomsecurity responsewriteupjspdocid=2012-052811-0308-99

[8] W O Kermack and A G Mckendrick ldquoA contribution to themathematical theory of epidemicsrdquo Proceedings of the RoyalSociety A vol 115 no 772 pp 700ndash721 1927

[9] C C Zou W Gong and D Towsley ldquoCode red worm prop-agation modeling and analysisrdquo in Proceedings of the 9th ACMConference onComputer andCommunications Security pp 138ndash147 Washington DC USA November 2002

[10] C C Zou W B Gong and D Towsley ldquoWorm propagationmodeling and analysis under dynamic quarantine defenserdquo inProceedings of the ACM Workshop on Rapid Malcode (WORMrsquo03) pp 51ndash60 Washington DC USA October 2003

[11] F Wang Y Zhang C Wang J Ma and S Moon ldquoStabilityanalysis of a SEIQV epidemic model for rapid spreadingwormsrdquo Computers and Security vol 29 no 4 pp 410ndash4182010

[12] Y Yao W Xiang A Qu G Yu and F Gao ldquoHopf bifurcationin an SEIDQV worm propagation model with quarantinestrategyrdquo Discrete Dynamics in Nature and Society vol 2012Article ID 304868 18 pages 2012

Mathematical Problems in Engineering 13

[13] Y Yao L Guo H Guo G Yu F Gao and X Tong ldquoPulsequarantine strategy of internet worm propagation modelingand analysisrdquo Computers and Electrical Engineering vol 38 no5 pp 1047ndash1061 2012

[14] B KMishra andN Jha ldquoSEIQRSmodel for the transmission ofmalicious objects in computer networkrdquo Applied MathematicalModelling vol 34 no 3 pp 710ndash715 2010

[15] B D Hassard N D Kazarinoff and Y H Wan Theory andApplications of Hopf Bifurcation vol 41 of LondonMathematicalSociety Lecture Note Series Cambridge University Press Cam-bridge UK 1981

[16] Y Yao N Zhang W Xiang G Yu and F Gao ldquoModeling andanalysis of bifurcation in a delayed worm propagation modelrdquoJournal of Applied Mathematics vol 2013 Article ID 927369 11pages 2013

[17] W Yu and J Cao ldquoHopf bifurcation and stability of periodicsolutions for van der Pol equation with time delayrdquo NonlinearAnalysis Theory Methods and Applications vol 62 no 1 pp141ndash165 2005

[18] J Zhang W Li and X Yan ldquoHopf bifurcation and stabilityof periodic solutions in a delayed eco-epidemiological systemrdquoApplied Mathematics and Computation vol 198 no 2 pp 865ndash876 2008

[19] X Han and Q Tan ldquoDynamical behavior of computer virus onInternetrdquoAppliedMathematics and Computation vol 217 no 6pp 2520ndash2526 2010

[20] T Dong X Liao and H Li ldquoStability and Hopf bifurcation ina computer virus model with multistate antivirusrdquo Abstract andApplied Analysis vol 2012 Article ID 841987 16 pages 2012

[21] Y Yao X Xie H Guo G Yu F Gao and X Tong ldquoHopfbifurcation in an Internet worm propagation model with timedelay in quarantinerdquo Mathematical and Computer Modellingvol 57 no 11-12 pp 2635ndash2646 2013

[22] J Ren X Yang Q Zhu L Yang and C Zhang ldquoA novelcomputer virus model and its dynamicsrdquo Nonlinear AnalysisReal World Applications vol 13 no 1 pp 376ndash384 2012

[23] L Wu X Su and P Shi ldquoSliding mode control with bounded1198972gain performance of Markovian jump singular time-delay

systemsrdquo Automatica vol 48 no 8 pp 1929ndash1933 2012[24] F Li and X Zhang ldquoA delay-dependent bounded real lemma

for singular LPV systems with time-variant delayrdquo InternationalJournal of Robust and Nonlinear Control vol 22 no 5 pp 559ndash574 2012

[25] F Li P Shi L Wu and X Zhang ldquoFuzzy-model-based D-stability and non-fragile control for discrete-time descriptorsystems with multiple delaysrdquo IEEE Transaction on FuzzySystem vol 99 1 page 2013

[26] L Song J Zhen G Sun J Zhang and X Han ldquoInfluence ofremovable devices on computer worms dynamic analysis andcontrol strategiesrdquo Computers and Mathematics with Applica-tions vol 61 no 7 pp 1823ndash1829 2011

[27] Q Zhu X Yang and J Ren ldquoModeling and analysis ofthe spread of computer virusrdquo Communications in NonlinearScience and Numerical Simulation vol 17 no 12 pp 5117ndash51242012

[28] S Wang Q Liu X Yu and Y Ma ldquoBifurcation analysisof a model for network worm propagation with time delayrdquoMathematical and ComputerModelling vol 52 no 3-4 pp 435ndash447 2010

[29] LWang Y Fan andW Li ldquoMultiple bifurcations in a predator-prey system with monotonic functional responserdquo Applied

Mathematics and Computation vol 172 no 2 pp 1103ndash11202006

[30] J K Hale and S M Verduyn Lunel Introduction to FunctionalDifferential Equations vol 99 Springer New York NY USA1993

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

6 Mathematical Problems in Engineering

1199103=3radicminus

119899

2

+ radicΔ1205902+3radicminus

119899

2

minus radicΔ120590

119911119894= 119910119894minus

31198633

4

(119894 = 1 2 3)

(20)

Lemma 3 For the polynomial equation (19)

(1) if1198630lt 0 then (19) has at least one positive root

(2) if 1198630ge 0 and Δ ge 0 then (19) has positive root if and

only if 1199111gt 0 and ℎ(119911

1) lt 0

(3) if 1198630ge 0 and Δ lt 0 then (19) has positive root if and

only if there exists at least one 119911lowast isin (1199111 1199112 1199113) such

that 119911lowast gt 0 and ℎ(119911lowast) le 0

Lemma 4 Suppose that condition1198671 1199014gt 0 119889

1gt 0 119889

2gt 0

(1199012+ 1199022)1198891minus 1199012

41198892gt 0 is satisfied

(1) If one of the followings holds (a) 1198630lt 0 (b) 119863

0ge

0 Δ ge 0 1199111gt 0 and ℎ(119911

1) lt 0 (c) 119863

0ge 0 and

Δ lt 0 and there exits at least a 119911lowastisin (1199111 1199112 1199113) such

that 119911lowast gt 0 and ℎ(119911lowast) le 0 then all roots of (10) have

negative real parts when 120591 isin [0 1205910) here 120591

0is a certain

positive constant

(2) If conditions (a)ndash(c) of (1) are not satisfied then all rootsof (10) have negative real parts for all 120591 ge 0

Proof When 120591 = 0 (10) can be reduced to

1205824+ 11990141205823+ 11990131205822+ (1199012+ 1199022) 120582 + (119901

1+ 1199021) = 0 (21)

According to the Routh-Hurwitz criterion all roots of(21) have negative real parts if and only if 119901

4gt 0 119889

1gt 0

1198892gt 0 and (119901

2+ 1199022)1198891minus 1199012

41198892gt 0

From Lemma 3 it can be known that if (a)ndash(c) are notsatisfied then (10) has no roots with zero real part for all 120591 ge

0 if one of (a)ndash(c) holds when 120591 = 120591(119895)

119896 119896 = 1 2 3 4 119895 gt 1

(10) has no roots with zero real part and 1205910is the minimum

value of 120591 so (10) has purely imaginary roots According to[18] one obtains the conclusion of the lemma

Let 120582(120591) = V(120591) + 119894120596(120591) be the root of (10) V(1205910) = 0 and

120596(1205910) = 1205960

From Lemmas 3 and 4 the following are obtained

When conditions (a)ndash(c) of Lemma 4(1) are not sat-isfied ℎ(119911) always has no positive root Therefore underthese conditions (10) has no purely imaginary roots forany 120591 gt 0 which implies that the positive equilibrium119864lowast

= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) of system (7) is absolutely stable

Therefore the following theorem on the stability of pos-itive equilibrium 119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) can be easily

obtained

0 50 100 150 200 250 3000

1

2

3

4

5

6

7

8times105

Time (s)

Hos

ts in

each

stat

e

S(t)

I(t)

Q(t)

D(t)

R(t)

Figure 2 Propagation trend of the five kinds of hosts when 120591 lt 1205910

0 500 1000 1500 20000

1

2

3

4

5

Rem

ovab

le d

evic

es in

each

stat

e

RS

R1

Time (s)

times104

Figure 3 Propagation trend of the two kinds of removable deviceswhen 120591 lt 120591

0

Theorem 5 Supposing that condition (1198671) is satisfied (a)

1198630ge 0 Δ ge 0 119911

1lt 0 and ℎ(119911

1) gt 0 (b) 119863

0ge 0 and Δ lt 0

and there is no 119911lowast isin (1199111 1199112 1199113) such that 119911lowast gt 0 and ℎ(119911

lowast) le

0 then the positive equilibrium 119864lowast

= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) of

system (7) is absolutely stableIn what follows it is assumed that the coefficients in ℎ(119911)

satisfy the condition(1198672) (a) 119863

0ge 0 Δ ge 0 119911

1lt 0 and ℎ(119911

1) gt 0 (b) 119863

0ge

0 Δ lt 0 and there is no 119911lowast isin (1199111 1199112 1199113) such that 119911lowast gt 0 and

ℎ(119911lowast) le 0According to [29] it is known that (19) has at least a positive

root 1205960 which implies that characteristic equation (10) has a

pair of purely imaginary roots plusmn1198941205960

Mathematical Problems in Engineering 7

0 500 1000 1500 2000 2500 3000 35000

1

2

3

4

5

6

7

8

Time (s)

Hos

ts in

each

stat

e

times105

S(t)

I(t)Q(t)

R(t)

Figure 4 Propagation trend of the four kinds of hosts when 120591 gt 1205910

0 500 1000 1500 2000 2500 3000 35000

1

2

3

4

5

Num

ber o

f rem

ovab

le d

evic

es

Time (s)

times104

RS

R1

Figure 5 Propagation trend of the two kinds of removable deviceswhen 120591 gt 120591

0

Since (10) has a pair of purely imaginary roots plusmn1198941205960 the

corresponding 120591119896gt 0 is given by (15) Consider

120591119896=

1

1205960

arccos [ ((1199020minus 11990221205962) (11990121205962

0minus 11990141205964

0minus 1199010)

+11990211205960(11990131205963

0minus 1205965

0minus 11990111205960))

times((1199020minus 11990221205962)

2

+ 1199022

11205962

0)

minus1

] +

2119896120587

1205960

(119896 = 0 1 2 3 )

(22)

0 100 200 300 400 500 6000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

120591 = 5120591 = 15

120591 = 45120591 = 90

Time (s)

times105

Figure 6 The number of infectious hosts when 120591 is changed in onecoordinate

Let 120582(120591) = V(120591) + 119894120596(120591) be the root of (10) V(120591119896) = 0 and

120596(120591119896) = 1205960are satisfied when 120591 = 120591

119896

Lemma 6 Suppose that ℎ1015840(1199110) = 0 If 120591 = 120591

0 then plusmn119894120596

0is

a pair of purely imaginary roots of (10) In addition if theconditions of Lemma 4(1) are satisfied then 119889Re 120582(120591

0)119889120591 gt 0

It is claimed that

sgn [119889Re 120582119889120591

]

120591=120591119896

= sgn ℎ1015840 (12059620) (23)

This signifies that there is at least one eigenvalue with positivereal part for 120591 gt 120591

119896

Differentiating two sides of (10) with respect to 120591 it can bewritten as

(

119889120582

119889120591

)

minus1

= ((51205824+ 411990141205823+ 311990131205822+ 21199012120582 + 1199011)

+ (21199022120582 + 1199021) 119890minus120582120591

minus (11990221205822+ 1199021120582 + 1199020) 120591119890minus120582120591

)

times ((11990221205822+ 1199021120582 + 1199020) 120582119890minus120582120591

)

minus1

=

(51205824+ 411990141205823+ 311990131205822+ 21199012120582 + 1199011) 119890120582120591

(11990221205822+ 1199021120582 + 1199020) 120582

+

21199022120582 + 1199021

(11990221205822+ 1199021120582 + 1199020) 120582

minus

120591

120582

(24)

8 Mathematical Problems in Engineering

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

120591 = 5

Time (s)

times105

(a)

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

Time (s)

times105 120591 = 15

(b)

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3120591 = 45

Num

ber o

f inf

ectio

us h

osts

Time (s)

times105

(c)

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3N

umbe

r of i

nfec

tious

hos

ts

Time (s)

times105 120591 = 90

(d)

Figure 7 The number of infectious hosts when 120591 is changed in four coordinates

0 05 1 15 2 25 30

1

2

3

4

5

6

7

8

I(t)

S(t)

times105

times105

120591 = 30

(a)

0 05 1 15 2 25 30

1

2

3

4

5

6

7

8

I(t)

S(t)

times105

times105

120591 = 60

(b)

Figure 8 The phase portrait of susceptible hosts 119878(119905) and infectious hosts 119868(119905)

Mathematical Problems in Engineering 9

0

12

1 23

0 0

2

4

6

8

I(t)

S(t)

times105

times105times105

R(t)

120591 = 30

(a)

0

12

12

3

0 0

2

4

6

8

I(t)

S(t)

times105

times105times105

R(t)

120591 = 60

(b)

Figure 9 The projection of the phase portrait of system (1) in (119878 119868 119877)-space

Therefore

sgn [119889Re 120582119889120591

]

120591=120591119896

= sgn[Re(119889120582

119889120591

)

minus1

]

120582=1198941205960

= sgn[Re((51205824+ 411990141205823+ 311990131205822+ 21199012120582 + 1199011) 119890120582120591

(11990221205822+ 1199021120582 + 1199020) 120582

+

21199022120582 + 1199021

(11990221205822+ 1199021120582 + 1199020) 120582

minus

120591

120582

)]

120582=1198941205960

= sgnRe ((51205964

0minus 411990141205963

0119894 minus 3119901

31205962

0+ 211990121205960119894 + 1199011)

times [cos (1205960120591119896) + 119894 sin (120596

0120591119896)] )

times ((11990211205960119894 + 1199020minus 11990221205962) 1205960119894)

minus1

+

211990221205960119894 + 1199021

(11990211205960119894 + 1199020minus 11990221205962) 1205960119894

= sgn1205962

0

119870

[41205966

0+ (3119901

2

4minus 61199013) 1205964

0

+ (21199012

3+ 41199011minus 411990121199014) 1205962

0

+ (1199012

2+ 211990101199014minus 211990111199013)]

= sgn1205962

0

Γ

= sgn1205962

0

Γ

ℎ1015840(1205962

0) = sgn ℎ1015840 (1205962

0)

(25)

where119870 = 1199022

11205964

0+(11990201205960minus11990221205963

0)2 It follows from the hypothesis

(1198672) that ℎ1015840(1205962

0) = 0 and therefore the transversality condition

holds It can be obtained that

119889(Re 120582)119889120591

10038161003816100381610038161003816100381610038161003816120591=120591119896

gt 0 (26)

0 10 20 30 40 50 60 70 80 900

2

4

6

8

10

12

14

16

Num

ber o

f inf

ectio

us h

osts

Hopf bifurcation

120591(S)

times104

Figure 10 Bifurcation diagram of system (1) with 120591 ranging from 1to 90

The root of characteristic equation (10) crosses from theleft to the right on the imaginary axis as 120591 continuously variesfrom a value less than 120591

119896to one greater than 120591

119896according

to Rouchersquos theorem [15] Therefore according to the Hopfbifurcation theorem [30] for functional differential equationsthe transversality condition holds and the conditions for Hopfbifurcation are satisfied at 120591 = 120591

119896 Then the following result can

be obtained

Theorem 7 Supposing that condition (1198671) is satisfied

(1) if 120591 isin [0 1205910) then the positive equilibrium 119864

lowast=

(119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) of system (7) is asymptotically

stable and unstable when 120591 gt 1205910

(2) if condition (1198672) is satisfied system (7) will undergo

a Hopf bifurcation at the positive equilibrium 119864lowast

=

(119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) when 120591 = 120591

119896(119896 = 0 1 2 )

where 120591119896is defined by (22)

This implies that when the time delay 120591 lt 1205910 the system

will stabilize at its infection equilibrium point which isbeneficial for us to implement a containment strategy whentime delay 120591 gt 120591

0 the system will be unstable and worms

cannot be effectively controlled

10 Mathematical Problems in Engineering

0 100 200 300 4000

2

4

6

8

Time (s)

Num

ber o

f sus

cept

ible

hos

tstimes105

Numerical curveSimulation curve

(a)

0 100 200 300 4000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

Time (s)

times105

Numerical curveSimulation curve

(b)

0 100 200 300 4000

1

2

3

4

5

Num

ber o

f qua

rant

ined

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(c)

0 100 200 300 4000

05

1

15

2N

umbe

r of r

emov

ed h

osts

Time (s)

times105

Numerical curveSimulation curve

(d)

Figure 11 Comparisons between numerical curves and simulation curves when 120591 lt 1205910

4 Numerical Analysis

In this section several numerical results are presented toprove the correctness of theoretical analysis above 750000hosts and 50000 removable devices are selected as thepopulation size the wormrsquos average scan rate is 120578 = 4000

per second The worm infection rate can be calculated as 120572 =

120578119873232

= 0698 which means that average 0698 hosts of allthe hosts can be scanned by one infectious hostThe infectionratio is 120573

1= 1205782

32= 000000093 The contact infection rate

between hosts and removable devices is 1205732= 00045 The

recovery rates of infectious hosts and removable devices are1205741= 002 and 120574

2= 0005 respectively The immunization

rate of quarantined hosts is 120575 = 005 and the reassembly rateof immunization hosts is 120596 = 008 At the beginning there

are 50 infectious hosts and 20 infectious removable deviceswhile the rest of hosts and removable devices are susceptible

In anomaly intrusion detection system the rate at whichinfected hosts are detected and quarantined is 120579

2= 02 per

second It means that an infected host can be detected andquarantined in about 5 s The rate at which susceptible hostsare detected and quarantined is 120579

1= 000002315 per second

that is about two false alarms are generated by the anomalyintrusion detection system per day

When 120591 = 5 lt 1205910 Figure 2 presents the changes

of the number of five kinds of hosts and Figure 3 showsthe curves of two kinds of removable devices According toTheorem 5 the positive equilibrium119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868)

is asymptotically stable when 120591 isin [0 1205910) which is illustrated

by the numerical simulations in Figures 2 and 3 Finally the

Mathematical Problems in Engineering 11

0 500 1000 1500 20000

2

4

6

8

Num

ber o

f sus

cept

ible

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(a)

0 500 1000 1500 20000

05

1

15

2

25

3

Time (s)

Num

ber o

f inf

ectio

us h

osts

times105

Numerical curveSimulation curve

(b)

0 500 1000 1500 20000

1

2

3

4

5

Num

ber o

f qua

rant

ined

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(c)

0 500 1000 1500 20000

05

1

15

2

Num

ber o

f rem

oved

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(d)

Figure 12 Comparisons between numerical curves and simulation curves when 120591 gt 1205910

number of every kind of host and removable device keepsstable

When 120591 gets increased and passes through the threshold1205910 the positive equilibrium 119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) will

lose its stability and a Hopf bifurcation will occur A familyof periodic solution bifurcates from the positive equilibrium119864lowast When 120591 = 45 gt 120591

0 Figure 4 shows the curves of

susceptible infectious quarantined and removed hosts andthe numerical simulation results of two kinds of removabledevices are depicted by Figure 5 FromFigures 4 and 5 we canclearly see that every state of hosts and removable devices isunstable Figure 4 shows that the number of infectious hostswill outburst after a short period of peace and repeat againand again

In order to state the influence of time delay the delay 120591

is set to a different value each time with other parameters

remaining unchanged Figure 6 shows four curves of thenumber of infectious hosts in the same coordinate with fourdelays 120591 = 5 120591 = 15 120591 = 45 and 120591 = 90 respectively Figures7(a)ndash7(c) show four curves of the number of infectious hostsin four coordinates Initially the four curves are overlappedwhich means that the time delay has little effect on the initialstate of worm spread With the increase of the time T thetime delay affects the number of infectious hosts With theincrease of time delay the curve begins to oscillate Thesystem becomes unstable as time delay passes through thecritical value 120591

0 At the same time it can be discovered that

the amplitude and period of the number of infectious hostsgradually increase

Figures 8(a) and 8(b) show the phase portraits of suscep-tible hosts 119878(119905) and infectious hosts 119868(119905) with 120591 = 30 lt 120591

0

and 120591 = 60 gt 1205910 respectively Figures 9(a) and 9(b) show

12 Mathematical Problems in Engineering

the projection of the phase portrait of system (1) in (119878 119868 119877)-space when 120591 = 30 lt 120591

0and 120591 = 60 gt 120591

0 respectively It is

clear that the curve converges to a fixed point when 120591 lt 1205910

whichmeans that the system is stableWhen 120591 gt 1205910 the curve

converges to a limit circle which implies that the system isunstable and the worm propagation is out of control

Figure 10 shows the bifurcation diagram with 120591 from 1 to90 It is clear that Hopf bifurcation will occur when 120591 = 120591

0=

35

5 Simulation Experiments

In our simulation experiments the discrete-time simulationis adopted because of its accuracy and is less time-consumingThe discrete-time simulation is an expanded version of Zoursquosprogram simulating Code Red worm propagation All of theparameters are consistent with the numerical experiments

Figures 11(a)ndash11(d) show the comparisons betweennumerical and simulation curves of susceptible infectiousquarantined and removed hosts when 120591 = 5 lt 120591

0

respectively It is clearly seen that the simulation curvesmatch the numerical ones very well Figures 12(a)ndash12(d)show the comparisons between numerical and simulationresults of four kinds of hosts when 120591 = 90 gt 120591

0 In this

figure two curves are still matched well It fully illustratesthe correctness of our theoretical analysis

6 Conclusions

In this paper considering the influence of removable devicesa delayed worm propagation dynamical system based onanomaly IDS has been constructed By regarding the timedelay caused by time window of anomaly IDS as the bifur-cation parameter the local asymptotic stability at the posi-tive equilibrium and local Hopf bifurcation were discussedThrough theoretical analysis and related experiments themain conclusions can be summarized as follows

(a) The critical time delay 1205910where Hopf bifurcation

appears is derived

1205910=

1

1205960

arccos [ ((1199020minus 11990221205962) (11990121205962

0minus 11990141205964

0minus 1199010)

+11990211205960(11990131205963

0minus 1205965

0minus 11990111205960))

times((1199020minus 11990221205962)

2

+ 1199022

11205962

0)

minus1

]

(27)

(b) When the time delay 120591 lt 1205910 worm propagation sys-

tem is stable and wormsrsquo behavior is easy to predictwhich is beneficial for us to implement containmentstrategy to control and eliminate the worm

(c) When time delay 120591 ge 1205910 Hopf bifurcation occurs

which implies that the system will be unstable andcontainment strategy does not work effectively

Thus in order to control and even eliminate the wormthe size of time window of anomaly IDS must be less than

1205910 In real network environment various factors can affect

worm propagationThis paper concentrates on analyzing theinfluence of time delay caused by anomaly IDS other factorshaving an impact on worm propagation will be the center ofour future study

Conflict of Interests

The authors declare that there is no conflict of interestsregarding the publication of this paper

Acknowledgments

This paper is supported by the Program for New CenturyExcellent Talents in University (NCET-13-0113) Natural Sci-ence Foundation of Liaoning Province of China under Grantno 201202059 Program for Liaoning Excellent Talents inUniversity under LR2013011 Fundamental Research Funds ofthe Central Universities under Grant nos N120504006 andN100704001 and MOE-Intel Special Fund of InformationTechnology (MOE-INTEL-2012-06)

References

[1] P Porras H Saidi and V Yegneswaran An Analysis of Con-fickerrsquos Logic and Rendezvous Point SRI International 2009

[2] Unruly USB ldquoDevices Expose Networks to Malwarerdquo httpwwwaspirantinfotechcomsgdownloadlumensionbrochureUnruly-USB-Devices-Expose-Networks-to-Malwarepdf

[3] E Byres A Ginter and J Langill ldquoHow stuxnet spreadsmdashastudy of infection paths in best practice systemsrdquo White Paper2011

[4] N Falliere L O Murchu and E Chien ldquoW32Stuxnet DossierrdquoSymantec Security Response 2011

[5] Win32Stuxnet httpwwwsymanteccomsecurity responsewriteupjspdocid=2010-071400-3123-99

[6] Flamer Highly Sophisticated and Discreet Threat Targets theMiddle East httpwwwsymanteccomconnectblogsflamer-highly-sophisticated-and-discreet-threat-targets-middle-east

[7] W32Flamer httpwwwsymanteccomsecurity responsewriteupjspdocid=2012-052811-0308-99

[8] W O Kermack and A G Mckendrick ldquoA contribution to themathematical theory of epidemicsrdquo Proceedings of the RoyalSociety A vol 115 no 772 pp 700ndash721 1927

[9] C C Zou W Gong and D Towsley ldquoCode red worm prop-agation modeling and analysisrdquo in Proceedings of the 9th ACMConference onComputer andCommunications Security pp 138ndash147 Washington DC USA November 2002

[10] C C Zou W B Gong and D Towsley ldquoWorm propagationmodeling and analysis under dynamic quarantine defenserdquo inProceedings of the ACM Workshop on Rapid Malcode (WORMrsquo03) pp 51ndash60 Washington DC USA October 2003

[11] F Wang Y Zhang C Wang J Ma and S Moon ldquoStabilityanalysis of a SEIQV epidemic model for rapid spreadingwormsrdquo Computers and Security vol 29 no 4 pp 410ndash4182010

[12] Y Yao W Xiang A Qu G Yu and F Gao ldquoHopf bifurcationin an SEIDQV worm propagation model with quarantinestrategyrdquo Discrete Dynamics in Nature and Society vol 2012Article ID 304868 18 pages 2012

Mathematical Problems in Engineering 13

[13] Y Yao L Guo H Guo G Yu F Gao and X Tong ldquoPulsequarantine strategy of internet worm propagation modelingand analysisrdquo Computers and Electrical Engineering vol 38 no5 pp 1047ndash1061 2012

[14] B KMishra andN Jha ldquoSEIQRSmodel for the transmission ofmalicious objects in computer networkrdquo Applied MathematicalModelling vol 34 no 3 pp 710ndash715 2010

[15] B D Hassard N D Kazarinoff and Y H Wan Theory andApplications of Hopf Bifurcation vol 41 of LondonMathematicalSociety Lecture Note Series Cambridge University Press Cam-bridge UK 1981

[16] Y Yao N Zhang W Xiang G Yu and F Gao ldquoModeling andanalysis of bifurcation in a delayed worm propagation modelrdquoJournal of Applied Mathematics vol 2013 Article ID 927369 11pages 2013

[17] W Yu and J Cao ldquoHopf bifurcation and stability of periodicsolutions for van der Pol equation with time delayrdquo NonlinearAnalysis Theory Methods and Applications vol 62 no 1 pp141ndash165 2005

[18] J Zhang W Li and X Yan ldquoHopf bifurcation and stabilityof periodic solutions in a delayed eco-epidemiological systemrdquoApplied Mathematics and Computation vol 198 no 2 pp 865ndash876 2008

[19] X Han and Q Tan ldquoDynamical behavior of computer virus onInternetrdquoAppliedMathematics and Computation vol 217 no 6pp 2520ndash2526 2010

[20] T Dong X Liao and H Li ldquoStability and Hopf bifurcation ina computer virus model with multistate antivirusrdquo Abstract andApplied Analysis vol 2012 Article ID 841987 16 pages 2012

[21] Y Yao X Xie H Guo G Yu F Gao and X Tong ldquoHopfbifurcation in an Internet worm propagation model with timedelay in quarantinerdquo Mathematical and Computer Modellingvol 57 no 11-12 pp 2635ndash2646 2013

[22] J Ren X Yang Q Zhu L Yang and C Zhang ldquoA novelcomputer virus model and its dynamicsrdquo Nonlinear AnalysisReal World Applications vol 13 no 1 pp 376ndash384 2012

[23] L Wu X Su and P Shi ldquoSliding mode control with bounded1198972gain performance of Markovian jump singular time-delay

systemsrdquo Automatica vol 48 no 8 pp 1929ndash1933 2012[24] F Li and X Zhang ldquoA delay-dependent bounded real lemma

for singular LPV systems with time-variant delayrdquo InternationalJournal of Robust and Nonlinear Control vol 22 no 5 pp 559ndash574 2012

[25] F Li P Shi L Wu and X Zhang ldquoFuzzy-model-based D-stability and non-fragile control for discrete-time descriptorsystems with multiple delaysrdquo IEEE Transaction on FuzzySystem vol 99 1 page 2013

[26] L Song J Zhen G Sun J Zhang and X Han ldquoInfluence ofremovable devices on computer worms dynamic analysis andcontrol strategiesrdquo Computers and Mathematics with Applica-tions vol 61 no 7 pp 1823ndash1829 2011

[27] Q Zhu X Yang and J Ren ldquoModeling and analysis ofthe spread of computer virusrdquo Communications in NonlinearScience and Numerical Simulation vol 17 no 12 pp 5117ndash51242012

[28] S Wang Q Liu X Yu and Y Ma ldquoBifurcation analysisof a model for network worm propagation with time delayrdquoMathematical and ComputerModelling vol 52 no 3-4 pp 435ndash447 2010

[29] LWang Y Fan andW Li ldquoMultiple bifurcations in a predator-prey system with monotonic functional responserdquo Applied

Mathematics and Computation vol 172 no 2 pp 1103ndash11202006

[30] J K Hale and S M Verduyn Lunel Introduction to FunctionalDifferential Equations vol 99 Springer New York NY USA1993

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

Mathematical Problems in Engineering 7

0 500 1000 1500 2000 2500 3000 35000

1

2

3

4

5

6

7

8

Time (s)

Hos

ts in

each

stat

e

times105

S(t)

I(t)Q(t)

R(t)

Figure 4 Propagation trend of the four kinds of hosts when 120591 gt 1205910

0 500 1000 1500 2000 2500 3000 35000

1

2

3

4

5

Num

ber o

f rem

ovab

le d

evic

es

Time (s)

times104

RS

R1

Figure 5 Propagation trend of the two kinds of removable deviceswhen 120591 gt 120591

0

Since (10) has a pair of purely imaginary roots plusmn1198941205960 the

corresponding 120591119896gt 0 is given by (15) Consider

120591119896=

1

1205960

arccos [ ((1199020minus 11990221205962) (11990121205962

0minus 11990141205964

0minus 1199010)

+11990211205960(11990131205963

0minus 1205965

0minus 11990111205960))

times((1199020minus 11990221205962)

2

+ 1199022

11205962

0)

minus1

] +

2119896120587

1205960

(119896 = 0 1 2 3 )

(22)

0 100 200 300 400 500 6000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

120591 = 5120591 = 15

120591 = 45120591 = 90

Time (s)

times105

Figure 6 The number of infectious hosts when 120591 is changed in onecoordinate

Let 120582(120591) = V(120591) + 119894120596(120591) be the root of (10) V(120591119896) = 0 and

120596(120591119896) = 1205960are satisfied when 120591 = 120591

119896

Lemma 6 Suppose that ℎ1015840(1199110) = 0 If 120591 = 120591

0 then plusmn119894120596

0is

a pair of purely imaginary roots of (10) In addition if theconditions of Lemma 4(1) are satisfied then 119889Re 120582(120591

0)119889120591 gt 0

It is claimed that

sgn [119889Re 120582119889120591

]

120591=120591119896

= sgn ℎ1015840 (12059620) (23)

This signifies that there is at least one eigenvalue with positivereal part for 120591 gt 120591

119896

Differentiating two sides of (10) with respect to 120591 it can bewritten as

(

119889120582

119889120591

)

minus1

= ((51205824+ 411990141205823+ 311990131205822+ 21199012120582 + 1199011)

+ (21199022120582 + 1199021) 119890minus120582120591

minus (11990221205822+ 1199021120582 + 1199020) 120591119890minus120582120591

)

times ((11990221205822+ 1199021120582 + 1199020) 120582119890minus120582120591

)

minus1

=

(51205824+ 411990141205823+ 311990131205822+ 21199012120582 + 1199011) 119890120582120591

(11990221205822+ 1199021120582 + 1199020) 120582

+

21199022120582 + 1199021

(11990221205822+ 1199021120582 + 1199020) 120582

minus

120591

120582

(24)

8 Mathematical Problems in Engineering

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

120591 = 5

Time (s)

times105

(a)

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

Time (s)

times105 120591 = 15

(b)

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3120591 = 45

Num

ber o

f inf

ectio

us h

osts

Time (s)

times105

(c)

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3N

umbe

r of i

nfec

tious

hos

ts

Time (s)

times105 120591 = 90

(d)

Figure 7 The number of infectious hosts when 120591 is changed in four coordinates

0 05 1 15 2 25 30

1

2

3

4

5

6

7

8

I(t)

S(t)

times105

times105

120591 = 30

(a)

0 05 1 15 2 25 30

1

2

3

4

5

6

7

8

I(t)

S(t)

times105

times105

120591 = 60

(b)

Figure 8 The phase portrait of susceptible hosts 119878(119905) and infectious hosts 119868(119905)

Mathematical Problems in Engineering 9

0

12

1 23

0 0

2

4

6

8

I(t)

S(t)

times105

times105times105

R(t)

120591 = 30

(a)

0

12

12

3

0 0

2

4

6

8

I(t)

S(t)

times105

times105times105

R(t)

120591 = 60

(b)

Figure 9 The projection of the phase portrait of system (1) in (119878 119868 119877)-space

Therefore

sgn [119889Re 120582119889120591

]

120591=120591119896

= sgn[Re(119889120582

119889120591

)

minus1

]

120582=1198941205960

= sgn[Re((51205824+ 411990141205823+ 311990131205822+ 21199012120582 + 1199011) 119890120582120591

(11990221205822+ 1199021120582 + 1199020) 120582

+

21199022120582 + 1199021

(11990221205822+ 1199021120582 + 1199020) 120582

minus

120591

120582

)]

120582=1198941205960

= sgnRe ((51205964

0minus 411990141205963

0119894 minus 3119901

31205962

0+ 211990121205960119894 + 1199011)

times [cos (1205960120591119896) + 119894 sin (120596

0120591119896)] )

times ((11990211205960119894 + 1199020minus 11990221205962) 1205960119894)

minus1

+

211990221205960119894 + 1199021

(11990211205960119894 + 1199020minus 11990221205962) 1205960119894

= sgn1205962

0

119870

[41205966

0+ (3119901

2

4minus 61199013) 1205964

0

+ (21199012

3+ 41199011minus 411990121199014) 1205962

0

+ (1199012

2+ 211990101199014minus 211990111199013)]

= sgn1205962

0

Γ

= sgn1205962

0

Γ

ℎ1015840(1205962

0) = sgn ℎ1015840 (1205962

0)

(25)

where119870 = 1199022

11205964

0+(11990201205960minus11990221205963

0)2 It follows from the hypothesis

(1198672) that ℎ1015840(1205962

0) = 0 and therefore the transversality condition

holds It can be obtained that

119889(Re 120582)119889120591

10038161003816100381610038161003816100381610038161003816120591=120591119896

gt 0 (26)

0 10 20 30 40 50 60 70 80 900

2

4

6

8

10

12

14

16

Num

ber o

f inf

ectio

us h

osts

Hopf bifurcation

120591(S)

times104

Figure 10 Bifurcation diagram of system (1) with 120591 ranging from 1to 90

The root of characteristic equation (10) crosses from theleft to the right on the imaginary axis as 120591 continuously variesfrom a value less than 120591

119896to one greater than 120591

119896according

to Rouchersquos theorem [15] Therefore according to the Hopfbifurcation theorem [30] for functional differential equationsthe transversality condition holds and the conditions for Hopfbifurcation are satisfied at 120591 = 120591

119896 Then the following result can

be obtained

Theorem 7 Supposing that condition (1198671) is satisfied

(1) if 120591 isin [0 1205910) then the positive equilibrium 119864

lowast=

(119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) of system (7) is asymptotically

stable and unstable when 120591 gt 1205910

(2) if condition (1198672) is satisfied system (7) will undergo

a Hopf bifurcation at the positive equilibrium 119864lowast

=

(119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) when 120591 = 120591

119896(119896 = 0 1 2 )

where 120591119896is defined by (22)

This implies that when the time delay 120591 lt 1205910 the system

will stabilize at its infection equilibrium point which isbeneficial for us to implement a containment strategy whentime delay 120591 gt 120591

0 the system will be unstable and worms

cannot be effectively controlled

10 Mathematical Problems in Engineering

0 100 200 300 4000

2

4

6

8

Time (s)

Num

ber o

f sus

cept

ible

hos

tstimes105

Numerical curveSimulation curve

(a)

0 100 200 300 4000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

Time (s)

times105

Numerical curveSimulation curve

(b)

0 100 200 300 4000

1

2

3

4

5

Num

ber o

f qua

rant

ined

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(c)

0 100 200 300 4000

05

1

15

2N

umbe

r of r

emov

ed h

osts

Time (s)

times105

Numerical curveSimulation curve

(d)

Figure 11 Comparisons between numerical curves and simulation curves when 120591 lt 1205910

4 Numerical Analysis

In this section several numerical results are presented toprove the correctness of theoretical analysis above 750000hosts and 50000 removable devices are selected as thepopulation size the wormrsquos average scan rate is 120578 = 4000

per second The worm infection rate can be calculated as 120572 =

120578119873232

= 0698 which means that average 0698 hosts of allthe hosts can be scanned by one infectious hostThe infectionratio is 120573

1= 1205782

32= 000000093 The contact infection rate

between hosts and removable devices is 1205732= 00045 The

recovery rates of infectious hosts and removable devices are1205741= 002 and 120574

2= 0005 respectively The immunization

rate of quarantined hosts is 120575 = 005 and the reassembly rateof immunization hosts is 120596 = 008 At the beginning there

are 50 infectious hosts and 20 infectious removable deviceswhile the rest of hosts and removable devices are susceptible

In anomaly intrusion detection system the rate at whichinfected hosts are detected and quarantined is 120579

2= 02 per

second It means that an infected host can be detected andquarantined in about 5 s The rate at which susceptible hostsare detected and quarantined is 120579

1= 000002315 per second

that is about two false alarms are generated by the anomalyintrusion detection system per day

When 120591 = 5 lt 1205910 Figure 2 presents the changes

of the number of five kinds of hosts and Figure 3 showsthe curves of two kinds of removable devices According toTheorem 5 the positive equilibrium119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868)

is asymptotically stable when 120591 isin [0 1205910) which is illustrated

by the numerical simulations in Figures 2 and 3 Finally the

Mathematical Problems in Engineering 11

0 500 1000 1500 20000

2

4

6

8

Num

ber o

f sus

cept

ible

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(a)

0 500 1000 1500 20000

05

1

15

2

25

3

Time (s)

Num

ber o

f inf

ectio

us h

osts

times105

Numerical curveSimulation curve

(b)

0 500 1000 1500 20000

1

2

3

4

5

Num

ber o

f qua

rant

ined

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(c)

0 500 1000 1500 20000

05

1

15

2

Num

ber o

f rem

oved

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(d)

Figure 12 Comparisons between numerical curves and simulation curves when 120591 gt 1205910

number of every kind of host and removable device keepsstable

When 120591 gets increased and passes through the threshold1205910 the positive equilibrium 119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) will

lose its stability and a Hopf bifurcation will occur A familyof periodic solution bifurcates from the positive equilibrium119864lowast When 120591 = 45 gt 120591

0 Figure 4 shows the curves of

susceptible infectious quarantined and removed hosts andthe numerical simulation results of two kinds of removabledevices are depicted by Figure 5 FromFigures 4 and 5 we canclearly see that every state of hosts and removable devices isunstable Figure 4 shows that the number of infectious hostswill outburst after a short period of peace and repeat againand again

In order to state the influence of time delay the delay 120591

is set to a different value each time with other parameters

remaining unchanged Figure 6 shows four curves of thenumber of infectious hosts in the same coordinate with fourdelays 120591 = 5 120591 = 15 120591 = 45 and 120591 = 90 respectively Figures7(a)ndash7(c) show four curves of the number of infectious hostsin four coordinates Initially the four curves are overlappedwhich means that the time delay has little effect on the initialstate of worm spread With the increase of the time T thetime delay affects the number of infectious hosts With theincrease of time delay the curve begins to oscillate Thesystem becomes unstable as time delay passes through thecritical value 120591

0 At the same time it can be discovered that

the amplitude and period of the number of infectious hostsgradually increase

Figures 8(a) and 8(b) show the phase portraits of suscep-tible hosts 119878(119905) and infectious hosts 119868(119905) with 120591 = 30 lt 120591

0

and 120591 = 60 gt 1205910 respectively Figures 9(a) and 9(b) show

12 Mathematical Problems in Engineering

the projection of the phase portrait of system (1) in (119878 119868 119877)-space when 120591 = 30 lt 120591

0and 120591 = 60 gt 120591

0 respectively It is

clear that the curve converges to a fixed point when 120591 lt 1205910

whichmeans that the system is stableWhen 120591 gt 1205910 the curve

converges to a limit circle which implies that the system isunstable and the worm propagation is out of control

Figure 10 shows the bifurcation diagram with 120591 from 1 to90 It is clear that Hopf bifurcation will occur when 120591 = 120591

0=

35

5 Simulation Experiments

In our simulation experiments the discrete-time simulationis adopted because of its accuracy and is less time-consumingThe discrete-time simulation is an expanded version of Zoursquosprogram simulating Code Red worm propagation All of theparameters are consistent with the numerical experiments

Figures 11(a)ndash11(d) show the comparisons betweennumerical and simulation curves of susceptible infectiousquarantined and removed hosts when 120591 = 5 lt 120591

0

respectively It is clearly seen that the simulation curvesmatch the numerical ones very well Figures 12(a)ndash12(d)show the comparisons between numerical and simulationresults of four kinds of hosts when 120591 = 90 gt 120591

0 In this

figure two curves are still matched well It fully illustratesthe correctness of our theoretical analysis

6 Conclusions

In this paper considering the influence of removable devicesa delayed worm propagation dynamical system based onanomaly IDS has been constructed By regarding the timedelay caused by time window of anomaly IDS as the bifur-cation parameter the local asymptotic stability at the posi-tive equilibrium and local Hopf bifurcation were discussedThrough theoretical analysis and related experiments themain conclusions can be summarized as follows

(a) The critical time delay 1205910where Hopf bifurcation

appears is derived

1205910=

1

1205960

arccos [ ((1199020minus 11990221205962) (11990121205962

0minus 11990141205964

0minus 1199010)

+11990211205960(11990131205963

0minus 1205965

0minus 11990111205960))

times((1199020minus 11990221205962)

2

+ 1199022

11205962

0)

minus1

]

(27)

(b) When the time delay 120591 lt 1205910 worm propagation sys-

tem is stable and wormsrsquo behavior is easy to predictwhich is beneficial for us to implement containmentstrategy to control and eliminate the worm

(c) When time delay 120591 ge 1205910 Hopf bifurcation occurs

which implies that the system will be unstable andcontainment strategy does not work effectively

Thus in order to control and even eliminate the wormthe size of time window of anomaly IDS must be less than

1205910 In real network environment various factors can affect

worm propagationThis paper concentrates on analyzing theinfluence of time delay caused by anomaly IDS other factorshaving an impact on worm propagation will be the center ofour future study

Conflict of Interests

The authors declare that there is no conflict of interestsregarding the publication of this paper

Acknowledgments

This paper is supported by the Program for New CenturyExcellent Talents in University (NCET-13-0113) Natural Sci-ence Foundation of Liaoning Province of China under Grantno 201202059 Program for Liaoning Excellent Talents inUniversity under LR2013011 Fundamental Research Funds ofthe Central Universities under Grant nos N120504006 andN100704001 and MOE-Intel Special Fund of InformationTechnology (MOE-INTEL-2012-06)

References

[1] P Porras H Saidi and V Yegneswaran An Analysis of Con-fickerrsquos Logic and Rendezvous Point SRI International 2009

[2] Unruly USB ldquoDevices Expose Networks to Malwarerdquo httpwwwaspirantinfotechcomsgdownloadlumensionbrochureUnruly-USB-Devices-Expose-Networks-to-Malwarepdf

[3] E Byres A Ginter and J Langill ldquoHow stuxnet spreadsmdashastudy of infection paths in best practice systemsrdquo White Paper2011

[4] N Falliere L O Murchu and E Chien ldquoW32Stuxnet DossierrdquoSymantec Security Response 2011

[5] Win32Stuxnet httpwwwsymanteccomsecurity responsewriteupjspdocid=2010-071400-3123-99

[6] Flamer Highly Sophisticated and Discreet Threat Targets theMiddle East httpwwwsymanteccomconnectblogsflamer-highly-sophisticated-and-discreet-threat-targets-middle-east

[7] W32Flamer httpwwwsymanteccomsecurity responsewriteupjspdocid=2012-052811-0308-99

[8] W O Kermack and A G Mckendrick ldquoA contribution to themathematical theory of epidemicsrdquo Proceedings of the RoyalSociety A vol 115 no 772 pp 700ndash721 1927

[9] C C Zou W Gong and D Towsley ldquoCode red worm prop-agation modeling and analysisrdquo in Proceedings of the 9th ACMConference onComputer andCommunications Security pp 138ndash147 Washington DC USA November 2002

[10] C C Zou W B Gong and D Towsley ldquoWorm propagationmodeling and analysis under dynamic quarantine defenserdquo inProceedings of the ACM Workshop on Rapid Malcode (WORMrsquo03) pp 51ndash60 Washington DC USA October 2003

[11] F Wang Y Zhang C Wang J Ma and S Moon ldquoStabilityanalysis of a SEIQV epidemic model for rapid spreadingwormsrdquo Computers and Security vol 29 no 4 pp 410ndash4182010

[12] Y Yao W Xiang A Qu G Yu and F Gao ldquoHopf bifurcationin an SEIDQV worm propagation model with quarantinestrategyrdquo Discrete Dynamics in Nature and Society vol 2012Article ID 304868 18 pages 2012

Mathematical Problems in Engineering 13

[13] Y Yao L Guo H Guo G Yu F Gao and X Tong ldquoPulsequarantine strategy of internet worm propagation modelingand analysisrdquo Computers and Electrical Engineering vol 38 no5 pp 1047ndash1061 2012

[14] B KMishra andN Jha ldquoSEIQRSmodel for the transmission ofmalicious objects in computer networkrdquo Applied MathematicalModelling vol 34 no 3 pp 710ndash715 2010

[15] B D Hassard N D Kazarinoff and Y H Wan Theory andApplications of Hopf Bifurcation vol 41 of LondonMathematicalSociety Lecture Note Series Cambridge University Press Cam-bridge UK 1981

[16] Y Yao N Zhang W Xiang G Yu and F Gao ldquoModeling andanalysis of bifurcation in a delayed worm propagation modelrdquoJournal of Applied Mathematics vol 2013 Article ID 927369 11pages 2013

[17] W Yu and J Cao ldquoHopf bifurcation and stability of periodicsolutions for van der Pol equation with time delayrdquo NonlinearAnalysis Theory Methods and Applications vol 62 no 1 pp141ndash165 2005

[18] J Zhang W Li and X Yan ldquoHopf bifurcation and stabilityof periodic solutions in a delayed eco-epidemiological systemrdquoApplied Mathematics and Computation vol 198 no 2 pp 865ndash876 2008

[19] X Han and Q Tan ldquoDynamical behavior of computer virus onInternetrdquoAppliedMathematics and Computation vol 217 no 6pp 2520ndash2526 2010

[20] T Dong X Liao and H Li ldquoStability and Hopf bifurcation ina computer virus model with multistate antivirusrdquo Abstract andApplied Analysis vol 2012 Article ID 841987 16 pages 2012

[21] Y Yao X Xie H Guo G Yu F Gao and X Tong ldquoHopfbifurcation in an Internet worm propagation model with timedelay in quarantinerdquo Mathematical and Computer Modellingvol 57 no 11-12 pp 2635ndash2646 2013

[22] J Ren X Yang Q Zhu L Yang and C Zhang ldquoA novelcomputer virus model and its dynamicsrdquo Nonlinear AnalysisReal World Applications vol 13 no 1 pp 376ndash384 2012

[23] L Wu X Su and P Shi ldquoSliding mode control with bounded1198972gain performance of Markovian jump singular time-delay

systemsrdquo Automatica vol 48 no 8 pp 1929ndash1933 2012[24] F Li and X Zhang ldquoA delay-dependent bounded real lemma

for singular LPV systems with time-variant delayrdquo InternationalJournal of Robust and Nonlinear Control vol 22 no 5 pp 559ndash574 2012

[25] F Li P Shi L Wu and X Zhang ldquoFuzzy-model-based D-stability and non-fragile control for discrete-time descriptorsystems with multiple delaysrdquo IEEE Transaction on FuzzySystem vol 99 1 page 2013

[26] L Song J Zhen G Sun J Zhang and X Han ldquoInfluence ofremovable devices on computer worms dynamic analysis andcontrol strategiesrdquo Computers and Mathematics with Applica-tions vol 61 no 7 pp 1823ndash1829 2011

[27] Q Zhu X Yang and J Ren ldquoModeling and analysis ofthe spread of computer virusrdquo Communications in NonlinearScience and Numerical Simulation vol 17 no 12 pp 5117ndash51242012

[28] S Wang Q Liu X Yu and Y Ma ldquoBifurcation analysisof a model for network worm propagation with time delayrdquoMathematical and ComputerModelling vol 52 no 3-4 pp 435ndash447 2010

[29] LWang Y Fan andW Li ldquoMultiple bifurcations in a predator-prey system with monotonic functional responserdquo Applied

Mathematics and Computation vol 172 no 2 pp 1103ndash11202006

[30] J K Hale and S M Verduyn Lunel Introduction to FunctionalDifferential Equations vol 99 Springer New York NY USA1993

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

8 Mathematical Problems in Engineering

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

120591 = 5

Time (s)

times105

(a)

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

Time (s)

times105 120591 = 15

(b)

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3120591 = 45

Num

ber o

f inf

ectio

us h

osts

Time (s)

times105

(c)

0 200 400 600 800 1000 1200 1400 1600 18000

05

1

15

2

25

3N

umbe

r of i

nfec

tious

hos

ts

Time (s)

times105 120591 = 90

(d)

Figure 7 The number of infectious hosts when 120591 is changed in four coordinates

0 05 1 15 2 25 30

1

2

3

4

5

6

7

8

I(t)

S(t)

times105

times105

120591 = 30

(a)

0 05 1 15 2 25 30

1

2

3

4

5

6

7

8

I(t)

S(t)

times105

times105

120591 = 60

(b)

Figure 8 The phase portrait of susceptible hosts 119878(119905) and infectious hosts 119868(119905)

Mathematical Problems in Engineering 9

0

12

1 23

0 0

2

4

6

8

I(t)

S(t)

times105

times105times105

R(t)

120591 = 30

(a)

0

12

12

3

0 0

2

4

6

8

I(t)

S(t)

times105

times105times105

R(t)

120591 = 60

(b)

Figure 9 The projection of the phase portrait of system (1) in (119878 119868 119877)-space

Therefore

sgn [119889Re 120582119889120591

]

120591=120591119896

= sgn[Re(119889120582

119889120591

)

minus1

]

120582=1198941205960

= sgn[Re((51205824+ 411990141205823+ 311990131205822+ 21199012120582 + 1199011) 119890120582120591

(11990221205822+ 1199021120582 + 1199020) 120582

+

21199022120582 + 1199021

(11990221205822+ 1199021120582 + 1199020) 120582

minus

120591

120582

)]

120582=1198941205960

= sgnRe ((51205964

0minus 411990141205963

0119894 minus 3119901

31205962

0+ 211990121205960119894 + 1199011)

times [cos (1205960120591119896) + 119894 sin (120596

0120591119896)] )

times ((11990211205960119894 + 1199020minus 11990221205962) 1205960119894)

minus1

+

211990221205960119894 + 1199021

(11990211205960119894 + 1199020minus 11990221205962) 1205960119894

= sgn1205962

0

119870

[41205966

0+ (3119901

2

4minus 61199013) 1205964

0

+ (21199012

3+ 41199011minus 411990121199014) 1205962

0

+ (1199012

2+ 211990101199014minus 211990111199013)]

= sgn1205962

0

Γ

= sgn1205962

0

Γ

ℎ1015840(1205962

0) = sgn ℎ1015840 (1205962

0)

(25)

where119870 = 1199022

11205964

0+(11990201205960minus11990221205963

0)2 It follows from the hypothesis

(1198672) that ℎ1015840(1205962

0) = 0 and therefore the transversality condition

holds It can be obtained that

119889(Re 120582)119889120591

10038161003816100381610038161003816100381610038161003816120591=120591119896

gt 0 (26)

0 10 20 30 40 50 60 70 80 900

2

4

6

8

10

12

14

16

Num

ber o

f inf

ectio

us h

osts

Hopf bifurcation

120591(S)

times104

Figure 10 Bifurcation diagram of system (1) with 120591 ranging from 1to 90

The root of characteristic equation (10) crosses from theleft to the right on the imaginary axis as 120591 continuously variesfrom a value less than 120591

119896to one greater than 120591

119896according

to Rouchersquos theorem [15] Therefore according to the Hopfbifurcation theorem [30] for functional differential equationsthe transversality condition holds and the conditions for Hopfbifurcation are satisfied at 120591 = 120591

119896 Then the following result can

be obtained

Theorem 7 Supposing that condition (1198671) is satisfied

(1) if 120591 isin [0 1205910) then the positive equilibrium 119864

lowast=

(119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) of system (7) is asymptotically

stable and unstable when 120591 gt 1205910

(2) if condition (1198672) is satisfied system (7) will undergo

a Hopf bifurcation at the positive equilibrium 119864lowast

=

(119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) when 120591 = 120591

119896(119896 = 0 1 2 )

where 120591119896is defined by (22)

This implies that when the time delay 120591 lt 1205910 the system

will stabilize at its infection equilibrium point which isbeneficial for us to implement a containment strategy whentime delay 120591 gt 120591

0 the system will be unstable and worms

cannot be effectively controlled

10 Mathematical Problems in Engineering

0 100 200 300 4000

2

4

6

8

Time (s)

Num

ber o

f sus

cept

ible

hos

tstimes105

Numerical curveSimulation curve

(a)

0 100 200 300 4000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

Time (s)

times105

Numerical curveSimulation curve

(b)

0 100 200 300 4000

1

2

3

4

5

Num

ber o

f qua

rant

ined

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(c)

0 100 200 300 4000

05

1

15

2N

umbe

r of r

emov

ed h

osts

Time (s)

times105

Numerical curveSimulation curve

(d)

Figure 11 Comparisons between numerical curves and simulation curves when 120591 lt 1205910

4 Numerical Analysis

In this section several numerical results are presented toprove the correctness of theoretical analysis above 750000hosts and 50000 removable devices are selected as thepopulation size the wormrsquos average scan rate is 120578 = 4000

per second The worm infection rate can be calculated as 120572 =

120578119873232

= 0698 which means that average 0698 hosts of allthe hosts can be scanned by one infectious hostThe infectionratio is 120573

1= 1205782

32= 000000093 The contact infection rate

between hosts and removable devices is 1205732= 00045 The

recovery rates of infectious hosts and removable devices are1205741= 002 and 120574

2= 0005 respectively The immunization

rate of quarantined hosts is 120575 = 005 and the reassembly rateof immunization hosts is 120596 = 008 At the beginning there

are 50 infectious hosts and 20 infectious removable deviceswhile the rest of hosts and removable devices are susceptible

In anomaly intrusion detection system the rate at whichinfected hosts are detected and quarantined is 120579

2= 02 per

second It means that an infected host can be detected andquarantined in about 5 s The rate at which susceptible hostsare detected and quarantined is 120579

1= 000002315 per second

that is about two false alarms are generated by the anomalyintrusion detection system per day

When 120591 = 5 lt 1205910 Figure 2 presents the changes

of the number of five kinds of hosts and Figure 3 showsthe curves of two kinds of removable devices According toTheorem 5 the positive equilibrium119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868)

is asymptotically stable when 120591 isin [0 1205910) which is illustrated

by the numerical simulations in Figures 2 and 3 Finally the

Mathematical Problems in Engineering 11

0 500 1000 1500 20000

2

4

6

8

Num

ber o

f sus

cept

ible

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(a)

0 500 1000 1500 20000

05

1

15

2

25

3

Time (s)

Num

ber o

f inf

ectio

us h

osts

times105

Numerical curveSimulation curve

(b)

0 500 1000 1500 20000

1

2

3

4

5

Num

ber o

f qua

rant

ined

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(c)

0 500 1000 1500 20000

05

1

15

2

Num

ber o

f rem

oved

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(d)

Figure 12 Comparisons between numerical curves and simulation curves when 120591 gt 1205910

number of every kind of host and removable device keepsstable

When 120591 gets increased and passes through the threshold1205910 the positive equilibrium 119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) will

lose its stability and a Hopf bifurcation will occur A familyof periodic solution bifurcates from the positive equilibrium119864lowast When 120591 = 45 gt 120591

0 Figure 4 shows the curves of

susceptible infectious quarantined and removed hosts andthe numerical simulation results of two kinds of removabledevices are depicted by Figure 5 FromFigures 4 and 5 we canclearly see that every state of hosts and removable devices isunstable Figure 4 shows that the number of infectious hostswill outburst after a short period of peace and repeat againand again

In order to state the influence of time delay the delay 120591

is set to a different value each time with other parameters

remaining unchanged Figure 6 shows four curves of thenumber of infectious hosts in the same coordinate with fourdelays 120591 = 5 120591 = 15 120591 = 45 and 120591 = 90 respectively Figures7(a)ndash7(c) show four curves of the number of infectious hostsin four coordinates Initially the four curves are overlappedwhich means that the time delay has little effect on the initialstate of worm spread With the increase of the time T thetime delay affects the number of infectious hosts With theincrease of time delay the curve begins to oscillate Thesystem becomes unstable as time delay passes through thecritical value 120591

0 At the same time it can be discovered that

the amplitude and period of the number of infectious hostsgradually increase

Figures 8(a) and 8(b) show the phase portraits of suscep-tible hosts 119878(119905) and infectious hosts 119868(119905) with 120591 = 30 lt 120591

0

and 120591 = 60 gt 1205910 respectively Figures 9(a) and 9(b) show

12 Mathematical Problems in Engineering

the projection of the phase portrait of system (1) in (119878 119868 119877)-space when 120591 = 30 lt 120591

0and 120591 = 60 gt 120591

0 respectively It is

clear that the curve converges to a fixed point when 120591 lt 1205910

whichmeans that the system is stableWhen 120591 gt 1205910 the curve

converges to a limit circle which implies that the system isunstable and the worm propagation is out of control

Figure 10 shows the bifurcation diagram with 120591 from 1 to90 It is clear that Hopf bifurcation will occur when 120591 = 120591

0=

35

5 Simulation Experiments

In our simulation experiments the discrete-time simulationis adopted because of its accuracy and is less time-consumingThe discrete-time simulation is an expanded version of Zoursquosprogram simulating Code Red worm propagation All of theparameters are consistent with the numerical experiments

Figures 11(a)ndash11(d) show the comparisons betweennumerical and simulation curves of susceptible infectiousquarantined and removed hosts when 120591 = 5 lt 120591

0

respectively It is clearly seen that the simulation curvesmatch the numerical ones very well Figures 12(a)ndash12(d)show the comparisons between numerical and simulationresults of four kinds of hosts when 120591 = 90 gt 120591

0 In this

figure two curves are still matched well It fully illustratesthe correctness of our theoretical analysis

6 Conclusions

In this paper considering the influence of removable devicesa delayed worm propagation dynamical system based onanomaly IDS has been constructed By regarding the timedelay caused by time window of anomaly IDS as the bifur-cation parameter the local asymptotic stability at the posi-tive equilibrium and local Hopf bifurcation were discussedThrough theoretical analysis and related experiments themain conclusions can be summarized as follows

(a) The critical time delay 1205910where Hopf bifurcation

appears is derived

1205910=

1

1205960

arccos [ ((1199020minus 11990221205962) (11990121205962

0minus 11990141205964

0minus 1199010)

+11990211205960(11990131205963

0minus 1205965

0minus 11990111205960))

times((1199020minus 11990221205962)

2

+ 1199022

11205962

0)

minus1

]

(27)

(b) When the time delay 120591 lt 1205910 worm propagation sys-

tem is stable and wormsrsquo behavior is easy to predictwhich is beneficial for us to implement containmentstrategy to control and eliminate the worm

(c) When time delay 120591 ge 1205910 Hopf bifurcation occurs

which implies that the system will be unstable andcontainment strategy does not work effectively

Thus in order to control and even eliminate the wormthe size of time window of anomaly IDS must be less than

1205910 In real network environment various factors can affect

worm propagationThis paper concentrates on analyzing theinfluence of time delay caused by anomaly IDS other factorshaving an impact on worm propagation will be the center ofour future study

Conflict of Interests

The authors declare that there is no conflict of interestsregarding the publication of this paper

Acknowledgments

This paper is supported by the Program for New CenturyExcellent Talents in University (NCET-13-0113) Natural Sci-ence Foundation of Liaoning Province of China under Grantno 201202059 Program for Liaoning Excellent Talents inUniversity under LR2013011 Fundamental Research Funds ofthe Central Universities under Grant nos N120504006 andN100704001 and MOE-Intel Special Fund of InformationTechnology (MOE-INTEL-2012-06)

References

[1] P Porras H Saidi and V Yegneswaran An Analysis of Con-fickerrsquos Logic and Rendezvous Point SRI International 2009

[2] Unruly USB ldquoDevices Expose Networks to Malwarerdquo httpwwwaspirantinfotechcomsgdownloadlumensionbrochureUnruly-USB-Devices-Expose-Networks-to-Malwarepdf

[3] E Byres A Ginter and J Langill ldquoHow stuxnet spreadsmdashastudy of infection paths in best practice systemsrdquo White Paper2011

[4] N Falliere L O Murchu and E Chien ldquoW32Stuxnet DossierrdquoSymantec Security Response 2011

[5] Win32Stuxnet httpwwwsymanteccomsecurity responsewriteupjspdocid=2010-071400-3123-99

[6] Flamer Highly Sophisticated and Discreet Threat Targets theMiddle East httpwwwsymanteccomconnectblogsflamer-highly-sophisticated-and-discreet-threat-targets-middle-east

[7] W32Flamer httpwwwsymanteccomsecurity responsewriteupjspdocid=2012-052811-0308-99

[8] W O Kermack and A G Mckendrick ldquoA contribution to themathematical theory of epidemicsrdquo Proceedings of the RoyalSociety A vol 115 no 772 pp 700ndash721 1927

[9] C C Zou W Gong and D Towsley ldquoCode red worm prop-agation modeling and analysisrdquo in Proceedings of the 9th ACMConference onComputer andCommunications Security pp 138ndash147 Washington DC USA November 2002

[10] C C Zou W B Gong and D Towsley ldquoWorm propagationmodeling and analysis under dynamic quarantine defenserdquo inProceedings of the ACM Workshop on Rapid Malcode (WORMrsquo03) pp 51ndash60 Washington DC USA October 2003

[11] F Wang Y Zhang C Wang J Ma and S Moon ldquoStabilityanalysis of a SEIQV epidemic model for rapid spreadingwormsrdquo Computers and Security vol 29 no 4 pp 410ndash4182010

[12] Y Yao W Xiang A Qu G Yu and F Gao ldquoHopf bifurcationin an SEIDQV worm propagation model with quarantinestrategyrdquo Discrete Dynamics in Nature and Society vol 2012Article ID 304868 18 pages 2012

Mathematical Problems in Engineering 13

[13] Y Yao L Guo H Guo G Yu F Gao and X Tong ldquoPulsequarantine strategy of internet worm propagation modelingand analysisrdquo Computers and Electrical Engineering vol 38 no5 pp 1047ndash1061 2012

[14] B KMishra andN Jha ldquoSEIQRSmodel for the transmission ofmalicious objects in computer networkrdquo Applied MathematicalModelling vol 34 no 3 pp 710ndash715 2010

[15] B D Hassard N D Kazarinoff and Y H Wan Theory andApplications of Hopf Bifurcation vol 41 of LondonMathematicalSociety Lecture Note Series Cambridge University Press Cam-bridge UK 1981

[16] Y Yao N Zhang W Xiang G Yu and F Gao ldquoModeling andanalysis of bifurcation in a delayed worm propagation modelrdquoJournal of Applied Mathematics vol 2013 Article ID 927369 11pages 2013

[17] W Yu and J Cao ldquoHopf bifurcation and stability of periodicsolutions for van der Pol equation with time delayrdquo NonlinearAnalysis Theory Methods and Applications vol 62 no 1 pp141ndash165 2005

[18] J Zhang W Li and X Yan ldquoHopf bifurcation and stabilityof periodic solutions in a delayed eco-epidemiological systemrdquoApplied Mathematics and Computation vol 198 no 2 pp 865ndash876 2008

[19] X Han and Q Tan ldquoDynamical behavior of computer virus onInternetrdquoAppliedMathematics and Computation vol 217 no 6pp 2520ndash2526 2010

[20] T Dong X Liao and H Li ldquoStability and Hopf bifurcation ina computer virus model with multistate antivirusrdquo Abstract andApplied Analysis vol 2012 Article ID 841987 16 pages 2012

[21] Y Yao X Xie H Guo G Yu F Gao and X Tong ldquoHopfbifurcation in an Internet worm propagation model with timedelay in quarantinerdquo Mathematical and Computer Modellingvol 57 no 11-12 pp 2635ndash2646 2013

[22] J Ren X Yang Q Zhu L Yang and C Zhang ldquoA novelcomputer virus model and its dynamicsrdquo Nonlinear AnalysisReal World Applications vol 13 no 1 pp 376ndash384 2012

[23] L Wu X Su and P Shi ldquoSliding mode control with bounded1198972gain performance of Markovian jump singular time-delay

systemsrdquo Automatica vol 48 no 8 pp 1929ndash1933 2012[24] F Li and X Zhang ldquoA delay-dependent bounded real lemma

for singular LPV systems with time-variant delayrdquo InternationalJournal of Robust and Nonlinear Control vol 22 no 5 pp 559ndash574 2012

[25] F Li P Shi L Wu and X Zhang ldquoFuzzy-model-based D-stability and non-fragile control for discrete-time descriptorsystems with multiple delaysrdquo IEEE Transaction on FuzzySystem vol 99 1 page 2013

[26] L Song J Zhen G Sun J Zhang and X Han ldquoInfluence ofremovable devices on computer worms dynamic analysis andcontrol strategiesrdquo Computers and Mathematics with Applica-tions vol 61 no 7 pp 1823ndash1829 2011

[27] Q Zhu X Yang and J Ren ldquoModeling and analysis ofthe spread of computer virusrdquo Communications in NonlinearScience and Numerical Simulation vol 17 no 12 pp 5117ndash51242012

[28] S Wang Q Liu X Yu and Y Ma ldquoBifurcation analysisof a model for network worm propagation with time delayrdquoMathematical and ComputerModelling vol 52 no 3-4 pp 435ndash447 2010

[29] LWang Y Fan andW Li ldquoMultiple bifurcations in a predator-prey system with monotonic functional responserdquo Applied

Mathematics and Computation vol 172 no 2 pp 1103ndash11202006

[30] J K Hale and S M Verduyn Lunel Introduction to FunctionalDifferential Equations vol 99 Springer New York NY USA1993

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

Mathematical Problems in Engineering 9

0

12

1 23

0 0

2

4

6

8

I(t)

S(t)

times105

times105times105

R(t)

120591 = 30

(a)

0

12

12

3

0 0

2

4

6

8

I(t)

S(t)

times105

times105times105

R(t)

120591 = 60

(b)

Figure 9 The projection of the phase portrait of system (1) in (119878 119868 119877)-space

Therefore

sgn [119889Re 120582119889120591

]

120591=120591119896

= sgn[Re(119889120582

119889120591

)

minus1

]

120582=1198941205960

= sgn[Re((51205824+ 411990141205823+ 311990131205822+ 21199012120582 + 1199011) 119890120582120591

(11990221205822+ 1199021120582 + 1199020) 120582

+

21199022120582 + 1199021

(11990221205822+ 1199021120582 + 1199020) 120582

minus

120591

120582

)]

120582=1198941205960

= sgnRe ((51205964

0minus 411990141205963

0119894 minus 3119901

31205962

0+ 211990121205960119894 + 1199011)

times [cos (1205960120591119896) + 119894 sin (120596

0120591119896)] )

times ((11990211205960119894 + 1199020minus 11990221205962) 1205960119894)

minus1

+

211990221205960119894 + 1199021

(11990211205960119894 + 1199020minus 11990221205962) 1205960119894

= sgn1205962

0

119870

[41205966

0+ (3119901

2

4minus 61199013) 1205964

0

+ (21199012

3+ 41199011minus 411990121199014) 1205962

0

+ (1199012

2+ 211990101199014minus 211990111199013)]

= sgn1205962

0

Γ

= sgn1205962

0

Γ

ℎ1015840(1205962

0) = sgn ℎ1015840 (1205962

0)

(25)

where119870 = 1199022

11205964

0+(11990201205960minus11990221205963

0)2 It follows from the hypothesis

(1198672) that ℎ1015840(1205962

0) = 0 and therefore the transversality condition

holds It can be obtained that

119889(Re 120582)119889120591

10038161003816100381610038161003816100381610038161003816120591=120591119896

gt 0 (26)

0 10 20 30 40 50 60 70 80 900

2

4

6

8

10

12

14

16

Num

ber o

f inf

ectio

us h

osts

Hopf bifurcation

120591(S)

times104

Figure 10 Bifurcation diagram of system (1) with 120591 ranging from 1to 90

The root of characteristic equation (10) crosses from theleft to the right on the imaginary axis as 120591 continuously variesfrom a value less than 120591

119896to one greater than 120591

119896according

to Rouchersquos theorem [15] Therefore according to the Hopfbifurcation theorem [30] for functional differential equationsthe transversality condition holds and the conditions for Hopfbifurcation are satisfied at 120591 = 120591

119896 Then the following result can

be obtained

Theorem 7 Supposing that condition (1198671) is satisfied

(1) if 120591 isin [0 1205910) then the positive equilibrium 119864

lowast=

(119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) of system (7) is asymptotically

stable and unstable when 120591 gt 1205910

(2) if condition (1198672) is satisfied system (7) will undergo

a Hopf bifurcation at the positive equilibrium 119864lowast

=

(119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) when 120591 = 120591

119896(119896 = 0 1 2 )

where 120591119896is defined by (22)

This implies that when the time delay 120591 lt 1205910 the system

will stabilize at its infection equilibrium point which isbeneficial for us to implement a containment strategy whentime delay 120591 gt 120591

0 the system will be unstable and worms

cannot be effectively controlled

10 Mathematical Problems in Engineering

0 100 200 300 4000

2

4

6

8

Time (s)

Num

ber o

f sus

cept

ible

hos

tstimes105

Numerical curveSimulation curve

(a)

0 100 200 300 4000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

Time (s)

times105

Numerical curveSimulation curve

(b)

0 100 200 300 4000

1

2

3

4

5

Num

ber o

f qua

rant

ined

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(c)

0 100 200 300 4000

05

1

15

2N

umbe

r of r

emov

ed h

osts

Time (s)

times105

Numerical curveSimulation curve

(d)

Figure 11 Comparisons between numerical curves and simulation curves when 120591 lt 1205910

4 Numerical Analysis

In this section several numerical results are presented toprove the correctness of theoretical analysis above 750000hosts and 50000 removable devices are selected as thepopulation size the wormrsquos average scan rate is 120578 = 4000

per second The worm infection rate can be calculated as 120572 =

120578119873232

= 0698 which means that average 0698 hosts of allthe hosts can be scanned by one infectious hostThe infectionratio is 120573

1= 1205782

32= 000000093 The contact infection rate

between hosts and removable devices is 1205732= 00045 The

recovery rates of infectious hosts and removable devices are1205741= 002 and 120574

2= 0005 respectively The immunization

rate of quarantined hosts is 120575 = 005 and the reassembly rateof immunization hosts is 120596 = 008 At the beginning there

are 50 infectious hosts and 20 infectious removable deviceswhile the rest of hosts and removable devices are susceptible

In anomaly intrusion detection system the rate at whichinfected hosts are detected and quarantined is 120579

2= 02 per

second It means that an infected host can be detected andquarantined in about 5 s The rate at which susceptible hostsare detected and quarantined is 120579

1= 000002315 per second

that is about two false alarms are generated by the anomalyintrusion detection system per day

When 120591 = 5 lt 1205910 Figure 2 presents the changes

of the number of five kinds of hosts and Figure 3 showsthe curves of two kinds of removable devices According toTheorem 5 the positive equilibrium119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868)

is asymptotically stable when 120591 isin [0 1205910) which is illustrated

by the numerical simulations in Figures 2 and 3 Finally the

Mathematical Problems in Engineering 11

0 500 1000 1500 20000

2

4

6

8

Num

ber o

f sus

cept

ible

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(a)

0 500 1000 1500 20000

05

1

15

2

25

3

Time (s)

Num

ber o

f inf

ectio

us h

osts

times105

Numerical curveSimulation curve

(b)

0 500 1000 1500 20000

1

2

3

4

5

Num

ber o

f qua

rant

ined

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(c)

0 500 1000 1500 20000

05

1

15

2

Num

ber o

f rem

oved

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(d)

Figure 12 Comparisons between numerical curves and simulation curves when 120591 gt 1205910

number of every kind of host and removable device keepsstable

When 120591 gets increased and passes through the threshold1205910 the positive equilibrium 119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) will

lose its stability and a Hopf bifurcation will occur A familyof periodic solution bifurcates from the positive equilibrium119864lowast When 120591 = 45 gt 120591

0 Figure 4 shows the curves of

susceptible infectious quarantined and removed hosts andthe numerical simulation results of two kinds of removabledevices are depicted by Figure 5 FromFigures 4 and 5 we canclearly see that every state of hosts and removable devices isunstable Figure 4 shows that the number of infectious hostswill outburst after a short period of peace and repeat againand again

In order to state the influence of time delay the delay 120591

is set to a different value each time with other parameters

remaining unchanged Figure 6 shows four curves of thenumber of infectious hosts in the same coordinate with fourdelays 120591 = 5 120591 = 15 120591 = 45 and 120591 = 90 respectively Figures7(a)ndash7(c) show four curves of the number of infectious hostsin four coordinates Initially the four curves are overlappedwhich means that the time delay has little effect on the initialstate of worm spread With the increase of the time T thetime delay affects the number of infectious hosts With theincrease of time delay the curve begins to oscillate Thesystem becomes unstable as time delay passes through thecritical value 120591

0 At the same time it can be discovered that

the amplitude and period of the number of infectious hostsgradually increase

Figures 8(a) and 8(b) show the phase portraits of suscep-tible hosts 119878(119905) and infectious hosts 119868(119905) with 120591 = 30 lt 120591

0

and 120591 = 60 gt 1205910 respectively Figures 9(a) and 9(b) show

12 Mathematical Problems in Engineering

the projection of the phase portrait of system (1) in (119878 119868 119877)-space when 120591 = 30 lt 120591

0and 120591 = 60 gt 120591

0 respectively It is

clear that the curve converges to a fixed point when 120591 lt 1205910

whichmeans that the system is stableWhen 120591 gt 1205910 the curve

converges to a limit circle which implies that the system isunstable and the worm propagation is out of control

Figure 10 shows the bifurcation diagram with 120591 from 1 to90 It is clear that Hopf bifurcation will occur when 120591 = 120591

0=

35

5 Simulation Experiments

In our simulation experiments the discrete-time simulationis adopted because of its accuracy and is less time-consumingThe discrete-time simulation is an expanded version of Zoursquosprogram simulating Code Red worm propagation All of theparameters are consistent with the numerical experiments

Figures 11(a)ndash11(d) show the comparisons betweennumerical and simulation curves of susceptible infectiousquarantined and removed hosts when 120591 = 5 lt 120591

0

respectively It is clearly seen that the simulation curvesmatch the numerical ones very well Figures 12(a)ndash12(d)show the comparisons between numerical and simulationresults of four kinds of hosts when 120591 = 90 gt 120591

0 In this

figure two curves are still matched well It fully illustratesthe correctness of our theoretical analysis

6 Conclusions

In this paper considering the influence of removable devicesa delayed worm propagation dynamical system based onanomaly IDS has been constructed By regarding the timedelay caused by time window of anomaly IDS as the bifur-cation parameter the local asymptotic stability at the posi-tive equilibrium and local Hopf bifurcation were discussedThrough theoretical analysis and related experiments themain conclusions can be summarized as follows

(a) The critical time delay 1205910where Hopf bifurcation

appears is derived

1205910=

1

1205960

arccos [ ((1199020minus 11990221205962) (11990121205962

0minus 11990141205964

0minus 1199010)

+11990211205960(11990131205963

0minus 1205965

0minus 11990111205960))

times((1199020minus 11990221205962)

2

+ 1199022

11205962

0)

minus1

]

(27)

(b) When the time delay 120591 lt 1205910 worm propagation sys-

tem is stable and wormsrsquo behavior is easy to predictwhich is beneficial for us to implement containmentstrategy to control and eliminate the worm

(c) When time delay 120591 ge 1205910 Hopf bifurcation occurs

which implies that the system will be unstable andcontainment strategy does not work effectively

Thus in order to control and even eliminate the wormthe size of time window of anomaly IDS must be less than

1205910 In real network environment various factors can affect

worm propagationThis paper concentrates on analyzing theinfluence of time delay caused by anomaly IDS other factorshaving an impact on worm propagation will be the center ofour future study

Conflict of Interests

The authors declare that there is no conflict of interestsregarding the publication of this paper

Acknowledgments

This paper is supported by the Program for New CenturyExcellent Talents in University (NCET-13-0113) Natural Sci-ence Foundation of Liaoning Province of China under Grantno 201202059 Program for Liaoning Excellent Talents inUniversity under LR2013011 Fundamental Research Funds ofthe Central Universities under Grant nos N120504006 andN100704001 and MOE-Intel Special Fund of InformationTechnology (MOE-INTEL-2012-06)

References

[1] P Porras H Saidi and V Yegneswaran An Analysis of Con-fickerrsquos Logic and Rendezvous Point SRI International 2009

[2] Unruly USB ldquoDevices Expose Networks to Malwarerdquo httpwwwaspirantinfotechcomsgdownloadlumensionbrochureUnruly-USB-Devices-Expose-Networks-to-Malwarepdf

[3] E Byres A Ginter and J Langill ldquoHow stuxnet spreadsmdashastudy of infection paths in best practice systemsrdquo White Paper2011

[4] N Falliere L O Murchu and E Chien ldquoW32Stuxnet DossierrdquoSymantec Security Response 2011

[5] Win32Stuxnet httpwwwsymanteccomsecurity responsewriteupjspdocid=2010-071400-3123-99

[6] Flamer Highly Sophisticated and Discreet Threat Targets theMiddle East httpwwwsymanteccomconnectblogsflamer-highly-sophisticated-and-discreet-threat-targets-middle-east

[7] W32Flamer httpwwwsymanteccomsecurity responsewriteupjspdocid=2012-052811-0308-99

[8] W O Kermack and A G Mckendrick ldquoA contribution to themathematical theory of epidemicsrdquo Proceedings of the RoyalSociety A vol 115 no 772 pp 700ndash721 1927

[9] C C Zou W Gong and D Towsley ldquoCode red worm prop-agation modeling and analysisrdquo in Proceedings of the 9th ACMConference onComputer andCommunications Security pp 138ndash147 Washington DC USA November 2002

[10] C C Zou W B Gong and D Towsley ldquoWorm propagationmodeling and analysis under dynamic quarantine defenserdquo inProceedings of the ACM Workshop on Rapid Malcode (WORMrsquo03) pp 51ndash60 Washington DC USA October 2003

[11] F Wang Y Zhang C Wang J Ma and S Moon ldquoStabilityanalysis of a SEIQV epidemic model for rapid spreadingwormsrdquo Computers and Security vol 29 no 4 pp 410ndash4182010

[12] Y Yao W Xiang A Qu G Yu and F Gao ldquoHopf bifurcationin an SEIDQV worm propagation model with quarantinestrategyrdquo Discrete Dynamics in Nature and Society vol 2012Article ID 304868 18 pages 2012

Mathematical Problems in Engineering 13

[13] Y Yao L Guo H Guo G Yu F Gao and X Tong ldquoPulsequarantine strategy of internet worm propagation modelingand analysisrdquo Computers and Electrical Engineering vol 38 no5 pp 1047ndash1061 2012

[14] B KMishra andN Jha ldquoSEIQRSmodel for the transmission ofmalicious objects in computer networkrdquo Applied MathematicalModelling vol 34 no 3 pp 710ndash715 2010

[15] B D Hassard N D Kazarinoff and Y H Wan Theory andApplications of Hopf Bifurcation vol 41 of LondonMathematicalSociety Lecture Note Series Cambridge University Press Cam-bridge UK 1981

[16] Y Yao N Zhang W Xiang G Yu and F Gao ldquoModeling andanalysis of bifurcation in a delayed worm propagation modelrdquoJournal of Applied Mathematics vol 2013 Article ID 927369 11pages 2013

[17] W Yu and J Cao ldquoHopf bifurcation and stability of periodicsolutions for van der Pol equation with time delayrdquo NonlinearAnalysis Theory Methods and Applications vol 62 no 1 pp141ndash165 2005

[18] J Zhang W Li and X Yan ldquoHopf bifurcation and stabilityof periodic solutions in a delayed eco-epidemiological systemrdquoApplied Mathematics and Computation vol 198 no 2 pp 865ndash876 2008

[19] X Han and Q Tan ldquoDynamical behavior of computer virus onInternetrdquoAppliedMathematics and Computation vol 217 no 6pp 2520ndash2526 2010

[20] T Dong X Liao and H Li ldquoStability and Hopf bifurcation ina computer virus model with multistate antivirusrdquo Abstract andApplied Analysis vol 2012 Article ID 841987 16 pages 2012

[21] Y Yao X Xie H Guo G Yu F Gao and X Tong ldquoHopfbifurcation in an Internet worm propagation model with timedelay in quarantinerdquo Mathematical and Computer Modellingvol 57 no 11-12 pp 2635ndash2646 2013

[22] J Ren X Yang Q Zhu L Yang and C Zhang ldquoA novelcomputer virus model and its dynamicsrdquo Nonlinear AnalysisReal World Applications vol 13 no 1 pp 376ndash384 2012

[23] L Wu X Su and P Shi ldquoSliding mode control with bounded1198972gain performance of Markovian jump singular time-delay

systemsrdquo Automatica vol 48 no 8 pp 1929ndash1933 2012[24] F Li and X Zhang ldquoA delay-dependent bounded real lemma

for singular LPV systems with time-variant delayrdquo InternationalJournal of Robust and Nonlinear Control vol 22 no 5 pp 559ndash574 2012

[25] F Li P Shi L Wu and X Zhang ldquoFuzzy-model-based D-stability and non-fragile control for discrete-time descriptorsystems with multiple delaysrdquo IEEE Transaction on FuzzySystem vol 99 1 page 2013

[26] L Song J Zhen G Sun J Zhang and X Han ldquoInfluence ofremovable devices on computer worms dynamic analysis andcontrol strategiesrdquo Computers and Mathematics with Applica-tions vol 61 no 7 pp 1823ndash1829 2011

[27] Q Zhu X Yang and J Ren ldquoModeling and analysis ofthe spread of computer virusrdquo Communications in NonlinearScience and Numerical Simulation vol 17 no 12 pp 5117ndash51242012

[28] S Wang Q Liu X Yu and Y Ma ldquoBifurcation analysisof a model for network worm propagation with time delayrdquoMathematical and ComputerModelling vol 52 no 3-4 pp 435ndash447 2010

[29] LWang Y Fan andW Li ldquoMultiple bifurcations in a predator-prey system with monotonic functional responserdquo Applied

Mathematics and Computation vol 172 no 2 pp 1103ndash11202006

[30] J K Hale and S M Verduyn Lunel Introduction to FunctionalDifferential Equations vol 99 Springer New York NY USA1993

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

10 Mathematical Problems in Engineering

0 100 200 300 4000

2

4

6

8

Time (s)

Num

ber o

f sus

cept

ible

hos

tstimes105

Numerical curveSimulation curve

(a)

0 100 200 300 4000

05

1

15

2

25

3

Num

ber o

f inf

ectio

us h

osts

Time (s)

times105

Numerical curveSimulation curve

(b)

0 100 200 300 4000

1

2

3

4

5

Num

ber o

f qua

rant

ined

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(c)

0 100 200 300 4000

05

1

15

2N

umbe

r of r

emov

ed h

osts

Time (s)

times105

Numerical curveSimulation curve

(d)

Figure 11 Comparisons between numerical curves and simulation curves when 120591 lt 1205910

4 Numerical Analysis

In this section several numerical results are presented toprove the correctness of theoretical analysis above 750000hosts and 50000 removable devices are selected as thepopulation size the wormrsquos average scan rate is 120578 = 4000

per second The worm infection rate can be calculated as 120572 =

120578119873232

= 0698 which means that average 0698 hosts of allthe hosts can be scanned by one infectious hostThe infectionratio is 120573

1= 1205782

32= 000000093 The contact infection rate

between hosts and removable devices is 1205732= 00045 The

recovery rates of infectious hosts and removable devices are1205741= 002 and 120574

2= 0005 respectively The immunization

rate of quarantined hosts is 120575 = 005 and the reassembly rateof immunization hosts is 120596 = 008 At the beginning there

are 50 infectious hosts and 20 infectious removable deviceswhile the rest of hosts and removable devices are susceptible

In anomaly intrusion detection system the rate at whichinfected hosts are detected and quarantined is 120579

2= 02 per

second It means that an infected host can be detected andquarantined in about 5 s The rate at which susceptible hostsare detected and quarantined is 120579

1= 000002315 per second

that is about two false alarms are generated by the anomalyintrusion detection system per day

When 120591 = 5 lt 1205910 Figure 2 presents the changes

of the number of five kinds of hosts and Figure 3 showsthe curves of two kinds of removable devices According toTheorem 5 the positive equilibrium119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868)

is asymptotically stable when 120591 isin [0 1205910) which is illustrated

by the numerical simulations in Figures 2 and 3 Finally the

Mathematical Problems in Engineering 11

0 500 1000 1500 20000

2

4

6

8

Num

ber o

f sus

cept

ible

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(a)

0 500 1000 1500 20000

05

1

15

2

25

3

Time (s)

Num

ber o

f inf

ectio

us h

osts

times105

Numerical curveSimulation curve

(b)

0 500 1000 1500 20000

1

2

3

4

5

Num

ber o

f qua

rant

ined

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(c)

0 500 1000 1500 20000

05

1

15

2

Num

ber o

f rem

oved

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(d)

Figure 12 Comparisons between numerical curves and simulation curves when 120591 gt 1205910

number of every kind of host and removable device keepsstable

When 120591 gets increased and passes through the threshold1205910 the positive equilibrium 119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) will

lose its stability and a Hopf bifurcation will occur A familyof periodic solution bifurcates from the positive equilibrium119864lowast When 120591 = 45 gt 120591

0 Figure 4 shows the curves of

susceptible infectious quarantined and removed hosts andthe numerical simulation results of two kinds of removabledevices are depicted by Figure 5 FromFigures 4 and 5 we canclearly see that every state of hosts and removable devices isunstable Figure 4 shows that the number of infectious hostswill outburst after a short period of peace and repeat againand again

In order to state the influence of time delay the delay 120591

is set to a different value each time with other parameters

remaining unchanged Figure 6 shows four curves of thenumber of infectious hosts in the same coordinate with fourdelays 120591 = 5 120591 = 15 120591 = 45 and 120591 = 90 respectively Figures7(a)ndash7(c) show four curves of the number of infectious hostsin four coordinates Initially the four curves are overlappedwhich means that the time delay has little effect on the initialstate of worm spread With the increase of the time T thetime delay affects the number of infectious hosts With theincrease of time delay the curve begins to oscillate Thesystem becomes unstable as time delay passes through thecritical value 120591

0 At the same time it can be discovered that

the amplitude and period of the number of infectious hostsgradually increase

Figures 8(a) and 8(b) show the phase portraits of suscep-tible hosts 119878(119905) and infectious hosts 119868(119905) with 120591 = 30 lt 120591

0

and 120591 = 60 gt 1205910 respectively Figures 9(a) and 9(b) show

12 Mathematical Problems in Engineering

the projection of the phase portrait of system (1) in (119878 119868 119877)-space when 120591 = 30 lt 120591

0and 120591 = 60 gt 120591

0 respectively It is

clear that the curve converges to a fixed point when 120591 lt 1205910

whichmeans that the system is stableWhen 120591 gt 1205910 the curve

converges to a limit circle which implies that the system isunstable and the worm propagation is out of control

Figure 10 shows the bifurcation diagram with 120591 from 1 to90 It is clear that Hopf bifurcation will occur when 120591 = 120591

0=

35

5 Simulation Experiments

In our simulation experiments the discrete-time simulationis adopted because of its accuracy and is less time-consumingThe discrete-time simulation is an expanded version of Zoursquosprogram simulating Code Red worm propagation All of theparameters are consistent with the numerical experiments

Figures 11(a)ndash11(d) show the comparisons betweennumerical and simulation curves of susceptible infectiousquarantined and removed hosts when 120591 = 5 lt 120591

0

respectively It is clearly seen that the simulation curvesmatch the numerical ones very well Figures 12(a)ndash12(d)show the comparisons between numerical and simulationresults of four kinds of hosts when 120591 = 90 gt 120591

0 In this

figure two curves are still matched well It fully illustratesthe correctness of our theoretical analysis

6 Conclusions

In this paper considering the influence of removable devicesa delayed worm propagation dynamical system based onanomaly IDS has been constructed By regarding the timedelay caused by time window of anomaly IDS as the bifur-cation parameter the local asymptotic stability at the posi-tive equilibrium and local Hopf bifurcation were discussedThrough theoretical analysis and related experiments themain conclusions can be summarized as follows

(a) The critical time delay 1205910where Hopf bifurcation

appears is derived

1205910=

1

1205960

arccos [ ((1199020minus 11990221205962) (11990121205962

0minus 11990141205964

0minus 1199010)

+11990211205960(11990131205963

0minus 1205965

0minus 11990111205960))

times((1199020minus 11990221205962)

2

+ 1199022

11205962

0)

minus1

]

(27)

(b) When the time delay 120591 lt 1205910 worm propagation sys-

tem is stable and wormsrsquo behavior is easy to predictwhich is beneficial for us to implement containmentstrategy to control and eliminate the worm

(c) When time delay 120591 ge 1205910 Hopf bifurcation occurs

which implies that the system will be unstable andcontainment strategy does not work effectively

Thus in order to control and even eliminate the wormthe size of time window of anomaly IDS must be less than

1205910 In real network environment various factors can affect

worm propagationThis paper concentrates on analyzing theinfluence of time delay caused by anomaly IDS other factorshaving an impact on worm propagation will be the center ofour future study

Conflict of Interests

The authors declare that there is no conflict of interestsregarding the publication of this paper

Acknowledgments

This paper is supported by the Program for New CenturyExcellent Talents in University (NCET-13-0113) Natural Sci-ence Foundation of Liaoning Province of China under Grantno 201202059 Program for Liaoning Excellent Talents inUniversity under LR2013011 Fundamental Research Funds ofthe Central Universities under Grant nos N120504006 andN100704001 and MOE-Intel Special Fund of InformationTechnology (MOE-INTEL-2012-06)

References

[1] P Porras H Saidi and V Yegneswaran An Analysis of Con-fickerrsquos Logic and Rendezvous Point SRI International 2009

[2] Unruly USB ldquoDevices Expose Networks to Malwarerdquo httpwwwaspirantinfotechcomsgdownloadlumensionbrochureUnruly-USB-Devices-Expose-Networks-to-Malwarepdf

[3] E Byres A Ginter and J Langill ldquoHow stuxnet spreadsmdashastudy of infection paths in best practice systemsrdquo White Paper2011

[4] N Falliere L O Murchu and E Chien ldquoW32Stuxnet DossierrdquoSymantec Security Response 2011

[5] Win32Stuxnet httpwwwsymanteccomsecurity responsewriteupjspdocid=2010-071400-3123-99

[6] Flamer Highly Sophisticated and Discreet Threat Targets theMiddle East httpwwwsymanteccomconnectblogsflamer-highly-sophisticated-and-discreet-threat-targets-middle-east

[7] W32Flamer httpwwwsymanteccomsecurity responsewriteupjspdocid=2012-052811-0308-99

[8] W O Kermack and A G Mckendrick ldquoA contribution to themathematical theory of epidemicsrdquo Proceedings of the RoyalSociety A vol 115 no 772 pp 700ndash721 1927

[9] C C Zou W Gong and D Towsley ldquoCode red worm prop-agation modeling and analysisrdquo in Proceedings of the 9th ACMConference onComputer andCommunications Security pp 138ndash147 Washington DC USA November 2002

[10] C C Zou W B Gong and D Towsley ldquoWorm propagationmodeling and analysis under dynamic quarantine defenserdquo inProceedings of the ACM Workshop on Rapid Malcode (WORMrsquo03) pp 51ndash60 Washington DC USA October 2003

[11] F Wang Y Zhang C Wang J Ma and S Moon ldquoStabilityanalysis of a SEIQV epidemic model for rapid spreadingwormsrdquo Computers and Security vol 29 no 4 pp 410ndash4182010

[12] Y Yao W Xiang A Qu G Yu and F Gao ldquoHopf bifurcationin an SEIDQV worm propagation model with quarantinestrategyrdquo Discrete Dynamics in Nature and Society vol 2012Article ID 304868 18 pages 2012

Mathematical Problems in Engineering 13

[13] Y Yao L Guo H Guo G Yu F Gao and X Tong ldquoPulsequarantine strategy of internet worm propagation modelingand analysisrdquo Computers and Electrical Engineering vol 38 no5 pp 1047ndash1061 2012

[14] B KMishra andN Jha ldquoSEIQRSmodel for the transmission ofmalicious objects in computer networkrdquo Applied MathematicalModelling vol 34 no 3 pp 710ndash715 2010

[15] B D Hassard N D Kazarinoff and Y H Wan Theory andApplications of Hopf Bifurcation vol 41 of LondonMathematicalSociety Lecture Note Series Cambridge University Press Cam-bridge UK 1981

[16] Y Yao N Zhang W Xiang G Yu and F Gao ldquoModeling andanalysis of bifurcation in a delayed worm propagation modelrdquoJournal of Applied Mathematics vol 2013 Article ID 927369 11pages 2013

[17] W Yu and J Cao ldquoHopf bifurcation and stability of periodicsolutions for van der Pol equation with time delayrdquo NonlinearAnalysis Theory Methods and Applications vol 62 no 1 pp141ndash165 2005

[18] J Zhang W Li and X Yan ldquoHopf bifurcation and stabilityof periodic solutions in a delayed eco-epidemiological systemrdquoApplied Mathematics and Computation vol 198 no 2 pp 865ndash876 2008

[19] X Han and Q Tan ldquoDynamical behavior of computer virus onInternetrdquoAppliedMathematics and Computation vol 217 no 6pp 2520ndash2526 2010

[20] T Dong X Liao and H Li ldquoStability and Hopf bifurcation ina computer virus model with multistate antivirusrdquo Abstract andApplied Analysis vol 2012 Article ID 841987 16 pages 2012

[21] Y Yao X Xie H Guo G Yu F Gao and X Tong ldquoHopfbifurcation in an Internet worm propagation model with timedelay in quarantinerdquo Mathematical and Computer Modellingvol 57 no 11-12 pp 2635ndash2646 2013

[22] J Ren X Yang Q Zhu L Yang and C Zhang ldquoA novelcomputer virus model and its dynamicsrdquo Nonlinear AnalysisReal World Applications vol 13 no 1 pp 376ndash384 2012

[23] L Wu X Su and P Shi ldquoSliding mode control with bounded1198972gain performance of Markovian jump singular time-delay

systemsrdquo Automatica vol 48 no 8 pp 1929ndash1933 2012[24] F Li and X Zhang ldquoA delay-dependent bounded real lemma

for singular LPV systems with time-variant delayrdquo InternationalJournal of Robust and Nonlinear Control vol 22 no 5 pp 559ndash574 2012

[25] F Li P Shi L Wu and X Zhang ldquoFuzzy-model-based D-stability and non-fragile control for discrete-time descriptorsystems with multiple delaysrdquo IEEE Transaction on FuzzySystem vol 99 1 page 2013

[26] L Song J Zhen G Sun J Zhang and X Han ldquoInfluence ofremovable devices on computer worms dynamic analysis andcontrol strategiesrdquo Computers and Mathematics with Applica-tions vol 61 no 7 pp 1823ndash1829 2011

[27] Q Zhu X Yang and J Ren ldquoModeling and analysis ofthe spread of computer virusrdquo Communications in NonlinearScience and Numerical Simulation vol 17 no 12 pp 5117ndash51242012

[28] S Wang Q Liu X Yu and Y Ma ldquoBifurcation analysisof a model for network worm propagation with time delayrdquoMathematical and ComputerModelling vol 52 no 3-4 pp 435ndash447 2010

[29] LWang Y Fan andW Li ldquoMultiple bifurcations in a predator-prey system with monotonic functional responserdquo Applied

Mathematics and Computation vol 172 no 2 pp 1103ndash11202006

[30] J K Hale and S M Verduyn Lunel Introduction to FunctionalDifferential Equations vol 99 Springer New York NY USA1993

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

Mathematical Problems in Engineering 11

0 500 1000 1500 20000

2

4

6

8

Num

ber o

f sus

cept

ible

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(a)

0 500 1000 1500 20000

05

1

15

2

25

3

Time (s)

Num

ber o

f inf

ectio

us h

osts

times105

Numerical curveSimulation curve

(b)

0 500 1000 1500 20000

1

2

3

4

5

Num

ber o

f qua

rant

ined

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(c)

0 500 1000 1500 20000

05

1

15

2

Num

ber o

f rem

oved

hos

ts

Time (s)

times105

Numerical curveSimulation curve

(d)

Figure 12 Comparisons between numerical curves and simulation curves when 120591 gt 1205910

number of every kind of host and removable device keepsstable

When 120591 gets increased and passes through the threshold1205910 the positive equilibrium 119864

lowast= (119878lowast 119868lowast 119863lowast 119877lowast 119877lowast

119868) will

lose its stability and a Hopf bifurcation will occur A familyof periodic solution bifurcates from the positive equilibrium119864lowast When 120591 = 45 gt 120591

0 Figure 4 shows the curves of

susceptible infectious quarantined and removed hosts andthe numerical simulation results of two kinds of removabledevices are depicted by Figure 5 FromFigures 4 and 5 we canclearly see that every state of hosts and removable devices isunstable Figure 4 shows that the number of infectious hostswill outburst after a short period of peace and repeat againand again

In order to state the influence of time delay the delay 120591

is set to a different value each time with other parameters

remaining unchanged Figure 6 shows four curves of thenumber of infectious hosts in the same coordinate with fourdelays 120591 = 5 120591 = 15 120591 = 45 and 120591 = 90 respectively Figures7(a)ndash7(c) show four curves of the number of infectious hostsin four coordinates Initially the four curves are overlappedwhich means that the time delay has little effect on the initialstate of worm spread With the increase of the time T thetime delay affects the number of infectious hosts With theincrease of time delay the curve begins to oscillate Thesystem becomes unstable as time delay passes through thecritical value 120591

0 At the same time it can be discovered that

the amplitude and period of the number of infectious hostsgradually increase

Figures 8(a) and 8(b) show the phase portraits of suscep-tible hosts 119878(119905) and infectious hosts 119868(119905) with 120591 = 30 lt 120591

0

and 120591 = 60 gt 1205910 respectively Figures 9(a) and 9(b) show

12 Mathematical Problems in Engineering

the projection of the phase portrait of system (1) in (119878 119868 119877)-space when 120591 = 30 lt 120591

0and 120591 = 60 gt 120591

0 respectively It is

clear that the curve converges to a fixed point when 120591 lt 1205910

whichmeans that the system is stableWhen 120591 gt 1205910 the curve

converges to a limit circle which implies that the system isunstable and the worm propagation is out of control

Figure 10 shows the bifurcation diagram with 120591 from 1 to90 It is clear that Hopf bifurcation will occur when 120591 = 120591

0=

35

5 Simulation Experiments

In our simulation experiments the discrete-time simulationis adopted because of its accuracy and is less time-consumingThe discrete-time simulation is an expanded version of Zoursquosprogram simulating Code Red worm propagation All of theparameters are consistent with the numerical experiments

Figures 11(a)ndash11(d) show the comparisons betweennumerical and simulation curves of susceptible infectiousquarantined and removed hosts when 120591 = 5 lt 120591

0

respectively It is clearly seen that the simulation curvesmatch the numerical ones very well Figures 12(a)ndash12(d)show the comparisons between numerical and simulationresults of four kinds of hosts when 120591 = 90 gt 120591

0 In this

figure two curves are still matched well It fully illustratesthe correctness of our theoretical analysis

6 Conclusions

In this paper considering the influence of removable devicesa delayed worm propagation dynamical system based onanomaly IDS has been constructed By regarding the timedelay caused by time window of anomaly IDS as the bifur-cation parameter the local asymptotic stability at the posi-tive equilibrium and local Hopf bifurcation were discussedThrough theoretical analysis and related experiments themain conclusions can be summarized as follows

(a) The critical time delay 1205910where Hopf bifurcation

appears is derived

1205910=

1

1205960

arccos [ ((1199020minus 11990221205962) (11990121205962

0minus 11990141205964

0minus 1199010)

+11990211205960(11990131205963

0minus 1205965

0minus 11990111205960))

times((1199020minus 11990221205962)

2

+ 1199022

11205962

0)

minus1

]

(27)

(b) When the time delay 120591 lt 1205910 worm propagation sys-

tem is stable and wormsrsquo behavior is easy to predictwhich is beneficial for us to implement containmentstrategy to control and eliminate the worm

(c) When time delay 120591 ge 1205910 Hopf bifurcation occurs

which implies that the system will be unstable andcontainment strategy does not work effectively

Thus in order to control and even eliminate the wormthe size of time window of anomaly IDS must be less than

1205910 In real network environment various factors can affect

worm propagationThis paper concentrates on analyzing theinfluence of time delay caused by anomaly IDS other factorshaving an impact on worm propagation will be the center ofour future study

Conflict of Interests

The authors declare that there is no conflict of interestsregarding the publication of this paper

Acknowledgments

This paper is supported by the Program for New CenturyExcellent Talents in University (NCET-13-0113) Natural Sci-ence Foundation of Liaoning Province of China under Grantno 201202059 Program for Liaoning Excellent Talents inUniversity under LR2013011 Fundamental Research Funds ofthe Central Universities under Grant nos N120504006 andN100704001 and MOE-Intel Special Fund of InformationTechnology (MOE-INTEL-2012-06)

References

[1] P Porras H Saidi and V Yegneswaran An Analysis of Con-fickerrsquos Logic and Rendezvous Point SRI International 2009

[2] Unruly USB ldquoDevices Expose Networks to Malwarerdquo httpwwwaspirantinfotechcomsgdownloadlumensionbrochureUnruly-USB-Devices-Expose-Networks-to-Malwarepdf

[3] E Byres A Ginter and J Langill ldquoHow stuxnet spreadsmdashastudy of infection paths in best practice systemsrdquo White Paper2011

[4] N Falliere L O Murchu and E Chien ldquoW32Stuxnet DossierrdquoSymantec Security Response 2011

[5] Win32Stuxnet httpwwwsymanteccomsecurity responsewriteupjspdocid=2010-071400-3123-99

[6] Flamer Highly Sophisticated and Discreet Threat Targets theMiddle East httpwwwsymanteccomconnectblogsflamer-highly-sophisticated-and-discreet-threat-targets-middle-east

[7] W32Flamer httpwwwsymanteccomsecurity responsewriteupjspdocid=2012-052811-0308-99

[8] W O Kermack and A G Mckendrick ldquoA contribution to themathematical theory of epidemicsrdquo Proceedings of the RoyalSociety A vol 115 no 772 pp 700ndash721 1927

[9] C C Zou W Gong and D Towsley ldquoCode red worm prop-agation modeling and analysisrdquo in Proceedings of the 9th ACMConference onComputer andCommunications Security pp 138ndash147 Washington DC USA November 2002

[10] C C Zou W B Gong and D Towsley ldquoWorm propagationmodeling and analysis under dynamic quarantine defenserdquo inProceedings of the ACM Workshop on Rapid Malcode (WORMrsquo03) pp 51ndash60 Washington DC USA October 2003

[11] F Wang Y Zhang C Wang J Ma and S Moon ldquoStabilityanalysis of a SEIQV epidemic model for rapid spreadingwormsrdquo Computers and Security vol 29 no 4 pp 410ndash4182010

[12] Y Yao W Xiang A Qu G Yu and F Gao ldquoHopf bifurcationin an SEIDQV worm propagation model with quarantinestrategyrdquo Discrete Dynamics in Nature and Society vol 2012Article ID 304868 18 pages 2012

Mathematical Problems in Engineering 13

[13] Y Yao L Guo H Guo G Yu F Gao and X Tong ldquoPulsequarantine strategy of internet worm propagation modelingand analysisrdquo Computers and Electrical Engineering vol 38 no5 pp 1047ndash1061 2012

[14] B KMishra andN Jha ldquoSEIQRSmodel for the transmission ofmalicious objects in computer networkrdquo Applied MathematicalModelling vol 34 no 3 pp 710ndash715 2010

[15] B D Hassard N D Kazarinoff and Y H Wan Theory andApplications of Hopf Bifurcation vol 41 of LondonMathematicalSociety Lecture Note Series Cambridge University Press Cam-bridge UK 1981

[16] Y Yao N Zhang W Xiang G Yu and F Gao ldquoModeling andanalysis of bifurcation in a delayed worm propagation modelrdquoJournal of Applied Mathematics vol 2013 Article ID 927369 11pages 2013

[17] W Yu and J Cao ldquoHopf bifurcation and stability of periodicsolutions for van der Pol equation with time delayrdquo NonlinearAnalysis Theory Methods and Applications vol 62 no 1 pp141ndash165 2005

[18] J Zhang W Li and X Yan ldquoHopf bifurcation and stabilityof periodic solutions in a delayed eco-epidemiological systemrdquoApplied Mathematics and Computation vol 198 no 2 pp 865ndash876 2008

[19] X Han and Q Tan ldquoDynamical behavior of computer virus onInternetrdquoAppliedMathematics and Computation vol 217 no 6pp 2520ndash2526 2010

[20] T Dong X Liao and H Li ldquoStability and Hopf bifurcation ina computer virus model with multistate antivirusrdquo Abstract andApplied Analysis vol 2012 Article ID 841987 16 pages 2012

[21] Y Yao X Xie H Guo G Yu F Gao and X Tong ldquoHopfbifurcation in an Internet worm propagation model with timedelay in quarantinerdquo Mathematical and Computer Modellingvol 57 no 11-12 pp 2635ndash2646 2013

[22] J Ren X Yang Q Zhu L Yang and C Zhang ldquoA novelcomputer virus model and its dynamicsrdquo Nonlinear AnalysisReal World Applications vol 13 no 1 pp 376ndash384 2012

[23] L Wu X Su and P Shi ldquoSliding mode control with bounded1198972gain performance of Markovian jump singular time-delay

systemsrdquo Automatica vol 48 no 8 pp 1929ndash1933 2012[24] F Li and X Zhang ldquoA delay-dependent bounded real lemma

for singular LPV systems with time-variant delayrdquo InternationalJournal of Robust and Nonlinear Control vol 22 no 5 pp 559ndash574 2012

[25] F Li P Shi L Wu and X Zhang ldquoFuzzy-model-based D-stability and non-fragile control for discrete-time descriptorsystems with multiple delaysrdquo IEEE Transaction on FuzzySystem vol 99 1 page 2013

[26] L Song J Zhen G Sun J Zhang and X Han ldquoInfluence ofremovable devices on computer worms dynamic analysis andcontrol strategiesrdquo Computers and Mathematics with Applica-tions vol 61 no 7 pp 1823ndash1829 2011

[27] Q Zhu X Yang and J Ren ldquoModeling and analysis ofthe spread of computer virusrdquo Communications in NonlinearScience and Numerical Simulation vol 17 no 12 pp 5117ndash51242012

[28] S Wang Q Liu X Yu and Y Ma ldquoBifurcation analysisof a model for network worm propagation with time delayrdquoMathematical and ComputerModelling vol 52 no 3-4 pp 435ndash447 2010

[29] LWang Y Fan andW Li ldquoMultiple bifurcations in a predator-prey system with monotonic functional responserdquo Applied

Mathematics and Computation vol 172 no 2 pp 1103ndash11202006

[30] J K Hale and S M Verduyn Lunel Introduction to FunctionalDifferential Equations vol 99 Springer New York NY USA1993

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

12 Mathematical Problems in Engineering

the projection of the phase portrait of system (1) in (119878 119868 119877)-space when 120591 = 30 lt 120591

0and 120591 = 60 gt 120591

0 respectively It is

clear that the curve converges to a fixed point when 120591 lt 1205910

whichmeans that the system is stableWhen 120591 gt 1205910 the curve

converges to a limit circle which implies that the system isunstable and the worm propagation is out of control

Figure 10 shows the bifurcation diagram with 120591 from 1 to90 It is clear that Hopf bifurcation will occur when 120591 = 120591

0=

35

5 Simulation Experiments

In our simulation experiments the discrete-time simulationis adopted because of its accuracy and is less time-consumingThe discrete-time simulation is an expanded version of Zoursquosprogram simulating Code Red worm propagation All of theparameters are consistent with the numerical experiments

Figures 11(a)ndash11(d) show the comparisons betweennumerical and simulation curves of susceptible infectiousquarantined and removed hosts when 120591 = 5 lt 120591

0

respectively It is clearly seen that the simulation curvesmatch the numerical ones very well Figures 12(a)ndash12(d)show the comparisons between numerical and simulationresults of four kinds of hosts when 120591 = 90 gt 120591

0 In this

figure two curves are still matched well It fully illustratesthe correctness of our theoretical analysis

6 Conclusions

In this paper considering the influence of removable devicesa delayed worm propagation dynamical system based onanomaly IDS has been constructed By regarding the timedelay caused by time window of anomaly IDS as the bifur-cation parameter the local asymptotic stability at the posi-tive equilibrium and local Hopf bifurcation were discussedThrough theoretical analysis and related experiments themain conclusions can be summarized as follows

(a) The critical time delay 1205910where Hopf bifurcation

appears is derived

1205910=

1

1205960

arccos [ ((1199020minus 11990221205962) (11990121205962

0minus 11990141205964

0minus 1199010)

+11990211205960(11990131205963

0minus 1205965

0minus 11990111205960))

times((1199020minus 11990221205962)

2

+ 1199022

11205962

0)

minus1

]

(27)

(b) When the time delay 120591 lt 1205910 worm propagation sys-

tem is stable and wormsrsquo behavior is easy to predictwhich is beneficial for us to implement containmentstrategy to control and eliminate the worm

(c) When time delay 120591 ge 1205910 Hopf bifurcation occurs

which implies that the system will be unstable andcontainment strategy does not work effectively

Thus in order to control and even eliminate the wormthe size of time window of anomaly IDS must be less than

1205910 In real network environment various factors can affect

worm propagationThis paper concentrates on analyzing theinfluence of time delay caused by anomaly IDS other factorshaving an impact on worm propagation will be the center ofour future study

Conflict of Interests

The authors declare that there is no conflict of interestsregarding the publication of this paper

Acknowledgments

This paper is supported by the Program for New CenturyExcellent Talents in University (NCET-13-0113) Natural Sci-ence Foundation of Liaoning Province of China under Grantno 201202059 Program for Liaoning Excellent Talents inUniversity under LR2013011 Fundamental Research Funds ofthe Central Universities under Grant nos N120504006 andN100704001 and MOE-Intel Special Fund of InformationTechnology (MOE-INTEL-2012-06)

References

[1] P Porras H Saidi and V Yegneswaran An Analysis of Con-fickerrsquos Logic and Rendezvous Point SRI International 2009

[2] Unruly USB ldquoDevices Expose Networks to Malwarerdquo httpwwwaspirantinfotechcomsgdownloadlumensionbrochureUnruly-USB-Devices-Expose-Networks-to-Malwarepdf

[3] E Byres A Ginter and J Langill ldquoHow stuxnet spreadsmdashastudy of infection paths in best practice systemsrdquo White Paper2011

[4] N Falliere L O Murchu and E Chien ldquoW32Stuxnet DossierrdquoSymantec Security Response 2011

[5] Win32Stuxnet httpwwwsymanteccomsecurity responsewriteupjspdocid=2010-071400-3123-99

[6] Flamer Highly Sophisticated and Discreet Threat Targets theMiddle East httpwwwsymanteccomconnectblogsflamer-highly-sophisticated-and-discreet-threat-targets-middle-east

[7] W32Flamer httpwwwsymanteccomsecurity responsewriteupjspdocid=2012-052811-0308-99

[8] W O Kermack and A G Mckendrick ldquoA contribution to themathematical theory of epidemicsrdquo Proceedings of the RoyalSociety A vol 115 no 772 pp 700ndash721 1927

[9] C C Zou W Gong and D Towsley ldquoCode red worm prop-agation modeling and analysisrdquo in Proceedings of the 9th ACMConference onComputer andCommunications Security pp 138ndash147 Washington DC USA November 2002

[10] C C Zou W B Gong and D Towsley ldquoWorm propagationmodeling and analysis under dynamic quarantine defenserdquo inProceedings of the ACM Workshop on Rapid Malcode (WORMrsquo03) pp 51ndash60 Washington DC USA October 2003

[11] F Wang Y Zhang C Wang J Ma and S Moon ldquoStabilityanalysis of a SEIQV epidemic model for rapid spreadingwormsrdquo Computers and Security vol 29 no 4 pp 410ndash4182010

[12] Y Yao W Xiang A Qu G Yu and F Gao ldquoHopf bifurcationin an SEIDQV worm propagation model with quarantinestrategyrdquo Discrete Dynamics in Nature and Society vol 2012Article ID 304868 18 pages 2012

Mathematical Problems in Engineering 13

[13] Y Yao L Guo H Guo G Yu F Gao and X Tong ldquoPulsequarantine strategy of internet worm propagation modelingand analysisrdquo Computers and Electrical Engineering vol 38 no5 pp 1047ndash1061 2012

[14] B KMishra andN Jha ldquoSEIQRSmodel for the transmission ofmalicious objects in computer networkrdquo Applied MathematicalModelling vol 34 no 3 pp 710ndash715 2010

[15] B D Hassard N D Kazarinoff and Y H Wan Theory andApplications of Hopf Bifurcation vol 41 of LondonMathematicalSociety Lecture Note Series Cambridge University Press Cam-bridge UK 1981

[16] Y Yao N Zhang W Xiang G Yu and F Gao ldquoModeling andanalysis of bifurcation in a delayed worm propagation modelrdquoJournal of Applied Mathematics vol 2013 Article ID 927369 11pages 2013

[17] W Yu and J Cao ldquoHopf bifurcation and stability of periodicsolutions for van der Pol equation with time delayrdquo NonlinearAnalysis Theory Methods and Applications vol 62 no 1 pp141ndash165 2005

[18] J Zhang W Li and X Yan ldquoHopf bifurcation and stabilityof periodic solutions in a delayed eco-epidemiological systemrdquoApplied Mathematics and Computation vol 198 no 2 pp 865ndash876 2008

[19] X Han and Q Tan ldquoDynamical behavior of computer virus onInternetrdquoAppliedMathematics and Computation vol 217 no 6pp 2520ndash2526 2010

[20] T Dong X Liao and H Li ldquoStability and Hopf bifurcation ina computer virus model with multistate antivirusrdquo Abstract andApplied Analysis vol 2012 Article ID 841987 16 pages 2012

[21] Y Yao X Xie H Guo G Yu F Gao and X Tong ldquoHopfbifurcation in an Internet worm propagation model with timedelay in quarantinerdquo Mathematical and Computer Modellingvol 57 no 11-12 pp 2635ndash2646 2013

[22] J Ren X Yang Q Zhu L Yang and C Zhang ldquoA novelcomputer virus model and its dynamicsrdquo Nonlinear AnalysisReal World Applications vol 13 no 1 pp 376ndash384 2012

[23] L Wu X Su and P Shi ldquoSliding mode control with bounded1198972gain performance of Markovian jump singular time-delay

systemsrdquo Automatica vol 48 no 8 pp 1929ndash1933 2012[24] F Li and X Zhang ldquoA delay-dependent bounded real lemma

for singular LPV systems with time-variant delayrdquo InternationalJournal of Robust and Nonlinear Control vol 22 no 5 pp 559ndash574 2012

[25] F Li P Shi L Wu and X Zhang ldquoFuzzy-model-based D-stability and non-fragile control for discrete-time descriptorsystems with multiple delaysrdquo IEEE Transaction on FuzzySystem vol 99 1 page 2013

[26] L Song J Zhen G Sun J Zhang and X Han ldquoInfluence ofremovable devices on computer worms dynamic analysis andcontrol strategiesrdquo Computers and Mathematics with Applica-tions vol 61 no 7 pp 1823ndash1829 2011

[27] Q Zhu X Yang and J Ren ldquoModeling and analysis ofthe spread of computer virusrdquo Communications in NonlinearScience and Numerical Simulation vol 17 no 12 pp 5117ndash51242012

[28] S Wang Q Liu X Yu and Y Ma ldquoBifurcation analysisof a model for network worm propagation with time delayrdquoMathematical and ComputerModelling vol 52 no 3-4 pp 435ndash447 2010

[29] LWang Y Fan andW Li ldquoMultiple bifurcations in a predator-prey system with monotonic functional responserdquo Applied

Mathematics and Computation vol 172 no 2 pp 1103ndash11202006

[30] J K Hale and S M Verduyn Lunel Introduction to FunctionalDifferential Equations vol 99 Springer New York NY USA1993

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

Mathematical Problems in Engineering 13

[13] Y Yao L Guo H Guo G Yu F Gao and X Tong ldquoPulsequarantine strategy of internet worm propagation modelingand analysisrdquo Computers and Electrical Engineering vol 38 no5 pp 1047ndash1061 2012

[14] B KMishra andN Jha ldquoSEIQRSmodel for the transmission ofmalicious objects in computer networkrdquo Applied MathematicalModelling vol 34 no 3 pp 710ndash715 2010

[15] B D Hassard N D Kazarinoff and Y H Wan Theory andApplications of Hopf Bifurcation vol 41 of LondonMathematicalSociety Lecture Note Series Cambridge University Press Cam-bridge UK 1981

[16] Y Yao N Zhang W Xiang G Yu and F Gao ldquoModeling andanalysis of bifurcation in a delayed worm propagation modelrdquoJournal of Applied Mathematics vol 2013 Article ID 927369 11pages 2013

[17] W Yu and J Cao ldquoHopf bifurcation and stability of periodicsolutions for van der Pol equation with time delayrdquo NonlinearAnalysis Theory Methods and Applications vol 62 no 1 pp141ndash165 2005

[18] J Zhang W Li and X Yan ldquoHopf bifurcation and stabilityof periodic solutions in a delayed eco-epidemiological systemrdquoApplied Mathematics and Computation vol 198 no 2 pp 865ndash876 2008

[19] X Han and Q Tan ldquoDynamical behavior of computer virus onInternetrdquoAppliedMathematics and Computation vol 217 no 6pp 2520ndash2526 2010

[20] T Dong X Liao and H Li ldquoStability and Hopf bifurcation ina computer virus model with multistate antivirusrdquo Abstract andApplied Analysis vol 2012 Article ID 841987 16 pages 2012

[21] Y Yao X Xie H Guo G Yu F Gao and X Tong ldquoHopfbifurcation in an Internet worm propagation model with timedelay in quarantinerdquo Mathematical and Computer Modellingvol 57 no 11-12 pp 2635ndash2646 2013

[22] J Ren X Yang Q Zhu L Yang and C Zhang ldquoA novelcomputer virus model and its dynamicsrdquo Nonlinear AnalysisReal World Applications vol 13 no 1 pp 376ndash384 2012

[23] L Wu X Su and P Shi ldquoSliding mode control with bounded1198972gain performance of Markovian jump singular time-delay

systemsrdquo Automatica vol 48 no 8 pp 1929ndash1933 2012[24] F Li and X Zhang ldquoA delay-dependent bounded real lemma

for singular LPV systems with time-variant delayrdquo InternationalJournal of Robust and Nonlinear Control vol 22 no 5 pp 559ndash574 2012

[25] F Li P Shi L Wu and X Zhang ldquoFuzzy-model-based D-stability and non-fragile control for discrete-time descriptorsystems with multiple delaysrdquo IEEE Transaction on FuzzySystem vol 99 1 page 2013

[26] L Song J Zhen G Sun J Zhang and X Han ldquoInfluence ofremovable devices on computer worms dynamic analysis andcontrol strategiesrdquo Computers and Mathematics with Applica-tions vol 61 no 7 pp 1823ndash1829 2011

[27] Q Zhu X Yang and J Ren ldquoModeling and analysis ofthe spread of computer virusrdquo Communications in NonlinearScience and Numerical Simulation vol 17 no 12 pp 5117ndash51242012

[28] S Wang Q Liu X Yu and Y Ma ldquoBifurcation analysisof a model for network worm propagation with time delayrdquoMathematical and ComputerModelling vol 52 no 3-4 pp 435ndash447 2010

[29] LWang Y Fan andW Li ldquoMultiple bifurcations in a predator-prey system with monotonic functional responserdquo Applied

Mathematics and Computation vol 172 no 2 pp 1103ndash11202006

[30] J K Hale and S M Verduyn Lunel Introduction to FunctionalDifferential Equations vol 99 Springer New York NY USA1993

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of