Wednesday, December 15, 2010

The SI Model of a Freely Propagating Computer Virus

Note. The text below is part 7 of the paper titled "Epidemiological Modeling of Computer Virus Propagation."

         In epidemiological models, the infection spreads via contact between members of a population. In computer terms, contact between computers happen whenever one sends a file to another. A computer virus infection can therefore be expected from every file sharing activity between members of a computer population.

       If the rate of growth of the infected computers is proportional to the number of contacts per unit of time between members of susceptible S group and infected I group, then rate at which S is changing is expressed as 

                                 ds/dt= -λ • s(t)• i(t)       Equation 1

       The negative sign indicates decay (a decreasing S) which is logically correct because they are migrating to I. Here, λ is a nonnegative constant determined by the physical parameters. The obvious generalization is to admit the possibility that λ is actually dependent on time and is better expressed as λ(t). In this study, it shall be assumed that λ is not time dependent.

       It takes only one infected computer to spread the virus into n numbers of computers. This notion is expressed mathematically as

                                    i(t)= n+1- s(t)      Equation 2

Substituting Equation 2 to Equation 1, the equation below is obtained.

                        ds/dt= -λ • s(t)•( n+1- s(t))     Equation 3

       This last equation results from the basic assumption of the SI model. That is, the entire population (of n +1 members) is contained only in the two groups S and I.
        With the assumption that at time t = 0, there is exactly one infected computer, then the condition to be satisfied by the solution s = s(t) of Equation 2 at time t = 0 is

                             s(0)=n.     Equation 4

These equations are now evaluated using mathematical tools to see what information can be obtained. First, Equation 3 was re-written as

                          (ds/dt)/(s (n+1-s))= -λ.


The left hand side was expanded using partial fractions to obtain

                 (ds/dt)/( (n+1)s)+(ds/dt)/((n+1)(n+1-s)) = -λ.

Integration was used to obtain

               1/( (n+1) ) [log⁡〖s-log⁡(n+1-s) 〗 ]=-λt+c

Working further into the equation, the equation below is obtained.

                   s/( (n+1-s) )= c1 e^(-λ(n+1)t)

By algebraic manipulations, the equation below is obtained.

                   s(t)= (n+1)/(1+c2e^k(n+1)t )

        This is now a useful form of a solution for Equation 1. Using the condition in Equation 2 (i.e. s(0)=n), the  c2 is found as c_2=n^(-1).  Thus the unique solution of Equation 1 for t > 0 which satisfies the condition s(0)=n for t > 0 is

                s(t)= (n(n+1))/(n+e^λ(n+1)t )       t>0 Equation 5
       Substituting this equation for s(t) into Equation 2 (i.e. i(t)= n+1- s(t)) and manipulating the resulting equation, the equation below is obtained.

              i(t)= ((n+1))/(1+ne^(-λ(n+1)t) )   t>0  Equation 6

These Equations 5 and 6 give precise and total information on the behavior of the functions s and i.  To see how these functions behave over time, the analytic behavior of these functions needs to be plotted. Unfortunately, the graph cannot be imported into the blog at the moment.  Anyway, the such graph would show that over time, the number of the susceptible S computers is decreasing as they are becoming members of infected I computers. Unless an antivirus is launched in time, all susceptible computers will eventually become infected.

No comments:

Post a Comment