Epidemiological Models Applied to Viruses in Computer Networks

: To investigate the use of classical epidemiological models for studying computer virus propagation we described analogies between computer and population disease propagation using SIR (Susceptible-Infected-Removed) epidemiological models. By modifying these models with the introduction of anti-viral individuals we analyzed the stability of the disease free equilibrium points. Consequently, the basal virus reproduction rate gives some theoretical hints about how to avoid infections in a computer network. Numerical simulations show the dynamics of the process for several parameter values giving the number of infected machines as a function of time.


INTRODUCTION
Nowadays, computer viruses are an important risk to computational systems endangering either corporation systems of all sizes or personal computers used for simple applications as accessing bank accounting or even consulting entertainment activities schedules. The viruses are being developed simultaneously with the computer systems and the use of INTERNET facilities increases the number of damaging virus incidents. Since the first trials on studying how to combat viruses, biological analogies were established because biological organisms and computer networks share many characteristics as, for example, large number of connections among large number of simple components creating complex system [1]. Local systems in a computer network can be attacked generating malfunctions that, spreading along the network, produce network-wide disorders following a similar qualitative model of disease spreading for a biological system. This is the main reason for designating attacks against networks by biological terms as worms and viruses. Using these ideas, it is important to consider that computer viruses have two different levels for being studied: microscopic and macroscopic [2]. The microscopic level has been the subject of several studies. For instance, [3,4] establishes theoretical principles about how to kill the new viruses created every day. Following the virus development, computer immunology is a new discipline capable of creating efficient anti-virus strategies as programs that are being sold all over the world guaranteeing protection to individual users of a global network [5,6].
However, the macroscopic approach has not been receiving the same attention in spite of epidemiology analogies being an important tool in order to establish the policies to preventing infections by giving figures about how to update the anti-virus programs. The interesting but simple model considering exponential variation in the number of computer viruses, proposed by [7], couldn't be considered realistic because the lack of limits for the growth, which is a natural phenomenon either in biological or in computer systems. There is vast catalog of Mathematical Biology models indicated for epidemiology [8]. One of them, called SIR (Susceptible-Infected-Removed) model, was originally proposed by [9]. Here, we employ a modified version of such a model in order to obtain parameter combinations representing situations with asymptotically stable disease-free solutions. The relations among network parameters can provide some hints about how to prevent infections in networks. An expression for the maximum infection rate of computers equipped with anti-virus to avoid the propagation of new infections is given. If this number is known, an updating plan for anti-virus programs in a computer network can be elaborated.
The Model: We proposed the model represented in Fig.  1 for the dynamics of the infection propagation in a computer network. The model contains a modification related to the traditional SIR model [8], with an antidotal population compartment (A) representing the nodes of the network equipped with fully effective antivirus programs.
The total population T is divided into four groups: S of non-infected computers subjected to possible infection; A of non-infected computers equipped with anti-virus; I of infected computers; and R of removed ones due to the infection or not. The model is called SAIR (Susceptible-Antidotal-Infected-Removed). Its dynamics is described by: The parameters of the model are defined as follows: For simplicity, the influx rate is considered to be N = 0, representing that there are no incorporation of new computers to the network during the propagation of a virus that is considered to be very fast. The same reason justifies the choice µ = 0.
Equilibrium Points: In order to investigate the properties of the dynamics of the model, we determine the equilibrium points by considering that all the derivatives of population compartments vanish when this kind of solution holds. There are disease free equilibrium points, which represent the situations where the infected population is null (I = 0). These points are given by: The expressions for the equilibrium points make possible to obtain the conditions for stability of disease free solutions that are useful to establish the minimum recovering rate that a network is supposed to have in order to avoid the propagation of infections.

Disease Free Stability and Basal Reproduction Rate:
The stability of the equilibrium points determines the viral evolution represented by our SAIR model: if there is asymptotically stable free-disease equilibrium point, then the disease can disappear; if there is not, it becomes endemic. We obtain the linear approximation of the model around the equilibrium points by calculating the corresponding Jacobian (4x4) matrix [10] as: Stability of P 1 * : Calculating this Jacobian matrix in P 1 * , we obtain: With eigenvalues given by: In spite of one of the eigenvalues being zero the analysis of the stability can be conclusive because the A-axis is a central manifold such that A remains constant for any initial condition [10]. Then, as 1 and 3 are real and negative the problem is reduced to analyze 2 . The condition 2 < 0 is necessary and sufficient for considering P 1 * asymptotically stable. Consequently, the condition for asymptotic stability of this point is: Stability of P 2 * : Calculating the Jacobian matrix in P 2 * , we obtain: With eigenvalues given by: As 4 is real and positive, P 2 * is unstable for any combination of parameters.

Basal Reproduction Rate:
In epidemiology literature it is well known the concept of basal reproduction rate (R 0 ). This is a bifurcation parameter meaning that, if R 0 > 1, all disease free equilibrium points are unstable and the epidemic process persists. If R 0 < 1, there is asymptotically stable disease free equilibrium point; thus, the disease can vanish. In our model, the basal reproduction rate can be determined by analyzing the stability of P 1 * .
From (15), we obtain: Considering these values, AI = 0.02 represents the limit of the basal reproduction rate. Then we simulate the SAIR model for AI < 0.02, and AI > 0.02. Figure 2 shows a simulation for AI = 0.01. Infected and removed populations vanish and the network, in the long term, is in a good operational state. Figure 3 exhibits a simulation for AI = 0.5. All the populations become composed by either infected or removed computer. In the long term, there is a "low"density of operational computers and, consequently, no network.

CONCLUSION
Viral attacks against computer networks are an important research area because the defense strategies need to be able to avoid infection propagation. In this work we presented the SAIR model based on epidemiological studies and conditions for the asymptotically stability of the disease free equilibrium were deduced. Some simulations were performed showing how a parameter, analogous to the epidemic basal reproduction rate, affects the dynamics of the infection propagation.