A Review of Mathematical Model Based in Clustered Computer Network

Abstract

The threats produced by viruses in computer networks have been frequent and the subject of many studies. Computer viruses share common characteristics with biological viruses, and therefore, one of the ways to study the dynamics of virus propagation has been through biological analogies. Inspired by macroscopic models, the susceptible-infected-removable (SIR) model allowed variations of compartmental models and suggested defenses considering antidotal (SIRA) and quarantined compartments (SIQRA), giving rise to models that evaluate the effectiveness and strategies to control the spread of viruses in networks. Recently, with the rapid popularization and access to networks, new studies have been taken into consideration the clusters of association of networks, indicating new control strategies and particularities of the dynamics. Toward this goal, this chapter presents a review of the mathematical model based in clustered computer network with the brief overview of the mathematical model reviews and providing an integrated framework to clustered model. In this essay, there is a discussion about the several ways of applying compartmental models to study the propagation of computer viruses and malwares through networks, emphasizing the effect of connections between geographically distributed machine clusters.

1. Introduction

Computer viruses emerged as programs capable of harming the functioning of a machine. Initially, the damage was minor as well as its proliferation capacity. With the increasing access to communication networks, the great development of hardware and software, and the inclusion of these services as an essential part of daily life, computer viruses have become a threat [1, 2].

Virus program codes are complex and easy to replicate, and detection and removal by antivirus programs are difficult [3]. Some feats of these viral programs are the ability to acquire bank passwords, personal data, and confidential information [4], which can cause immeasurable damage [5].

The increase in the use of mobile devices combined with the increasing access to wireless Internet facilitated the execution of many daily tasks such as accessing e-mail, electronic transactions of various natures and created opportunities for the advent of the Internet of Things (IoT), and connecting sensors and actuators to allow different types of objects to establish connections to the Internet, including home appliances, cars, and even industrial equipment. Therefore, these items are able to collect and transmit data from the cloud, contributing to a digital transformation in the world, and can provide several improvements in human life [6].

Consequently, understanding the spread of viruses in computer networks has become fundamental for the establishment of strategies to control and mitigate the spread of viruses. To improve the security and reliability of networks, a new branch of study, known as cybersecurity, has contributed to guide control strategies in order to minimize losses and one of its approaches is to build mathematical models.

One of the areas of cybersecurity is related to the study of the propagation of viruses in computer networks. Many ways of approaching the problem have been relevant to the understanding of the dissemination of malware, including the mathematical approach.

The mathematical study of computer viruses has an inspiration in biology and can be understood at two levels: microscopic and macroscopic [2, 7]. The tools used to develop antivirus programs, which are programs capable of detecting threats and preventing damage to machines, are concentrated at the microscopic level. In addition, the propagation of viruses in the network can be mitigated by the action of antivirus and quarantines proposed by the software when detecting some unexpected action [8].

The macroscopic level was developed from the classical model of disease propagation whose dynamics indicate the possibility of infection [9] and favor the orientation of strategies to control dissemination. The classic epidemiological model, proposed by Kermack and McKendrick, suggests the division of the population into compartments containing the group of susceptible (S), infected (I), and removed (R), giving rise to the SIR model, whose dynamics and parameters indicate strategies for control [9, 10].

Inspired by the above-mentioned works and based on the compartment level SIR model, this chapter considers the review of relationship between networks and the influence of the biolocical compartmental models for cybersecurity. Different from the conventional compartimental level models, this study shows the issue of how the association of two compartmental models occurs and indicates future prospects.

This work reviews the develop and analyze a model of virus propagation in two independent populations where those who ware infected from one population can come into contact with those who are susceptible from the other, to analyze the effects that one infected population can cause on the other. For this, two clusters were created and each cluster represents a population, both exposed to the same virus and represented by a model with antoidotal compartment. To represent the interaction between the two populations, a new connection between the sets was created and represents the capacity of an infected person come into contact with a susceptible one from the other, and this interaction will be modulated by a parameter.

The remaining chapter is ordered as follows: In the next section, a review of epidemiological models is presented with applications in computers, in section 3, hypothesis and equations are presented for the model with antidotal compartment, and the cluster model is presented, followed by the conclusion.

2. Epidemiological models

In 1927 was published for the first time a deterministic model to study the dynamics of virus spread in populations. This was a compartmental model consisting of three compartments (susceptible—infected—removed) [9]. In this work, a theory was developed relating the development of an epidemic to a critical value, later known as the basal reproduction number $R_0$.

The modeling of epidemics is associated with the dynamic behavior of processes where populations are studied according to their epidemiological status, these processes are described by differential equations, and the dynamics between their states is given by different parameters such as birth rate, mortality rate, infection, and recovery rate.

The modeling of the spread of epidemics has been the objective of many works [11, 12, 13, 14, 15]. These models allow a better understanding of the mechanisms of disease spread and can lead to more effective control strategies.

The scientific literature in epidemiology is quite diverse. Among the most cited models regarding this topic are the models: susceptible—infectious—susceptible (SIS) models [16, 17, 18, 19]; susceptible—infected—recovered (SIR) models [20, 21, 22, 23, 24, 25]; susceptible—exposed—infected—recovered (SEIR) models [26, 27, 28]; susceptible—exposed—infected—quarantined—recovered (SEIQR) models; susceptible—exposed—infected—quarantined—recovered—susceptible (SEIQRS) [29]; susceptible—exposed—infected—recovered—susceptible—vaccined (SEIRS-V) [30]; susceptible—exposed—infected—susceptible—vaccined (SEIS-V) [31] and others.

As for the way of treating chance, it can be classified into two levels: stocchastic and deterministic. In the first case, the model includes variables, giving a probabilistic distribution to the system, incorporating uncertainty, an intrinsic characteristic of epidemiological systems [32, 33, 34, 35]. On the other hand, deterministic models provide the same results every time they are simulated with the same initial conditions [36, 37], being suitable to verify system sensitivity to the variation of the parameters [20, 21, 38].

Adapting the SIR model to computers, a lot of research has contributed to the understanding of virus propagation [26, 28, 29, 30, 31, 39, 40] and one of the main goals is to establish effective security strategies [41].

The most explored strategies in cybersecurity are related to the use of antiviral compartments (A) and quarantine (Q). The adaptation of the SIR model gave rise to some robust models, including susceptible—infected—removed—antidotal (SIRA) [21] and susceptible—infected—removed—antidotal (SIQRA) [42].

Following this line, the first analysis of clustered computer networks using an epidemiological model studied the influence between two networks equipped with computers with antivirus and evaluated the dynamics of virus promotion and suggested viral dissemination control strategies.

3. Cluster SIRA model: Hypothesis and equations

There is a lot of compartimental models indicated for epidemiology [43] and their origin is Kermack and Mckendrick SIR (susceptible—infected—removed) models [9, 43, 44].

The population is considered constant and is divided into three compartments: Susceptible computers are uninfected and subject to infection (S); infected computers are represented by (I), those removed by infection or not (R), as shown in Figure 1.

Figure 1.

SIR model.

As reported by [21] the dynamic equation for the populations $S$, $I$ and $R$ are:

$$\left\{\begin{array}{ll}\dot{S}& =-\mathit{\alpha SI};\\ \dot{I}& =\mathit{\alpha SI}-\mathit{\beta I};\\ \dot{R}& =\mathit{\beta I}.\end{array}\right.$$E1

The susceptible population $S$ is infected with a rate, that is, related to the probability of susceptible individuals to establish effective communications with infected ones. Therefore, this rate is proportional to the product $\mathit{SI}$, with proportion factor represented by $\alpha$ and infected individual can become removed with a rate controlled by $\beta$.

Considering initial conditions $S\left(0\right)\ge 0$, $I\left(0\right)\ge 0$ and $R\left(0\right)\ge 0$, in model such as SIR the interest is to investigate the dynamics of virus propagation indicates whether the virus will remain in the network or if it will naturally be eradicated. One of the ways to evaluate this behavior is to study the basal reproduction rate $\left(R_0\right)$. This number indicates whether the virus will continue to be propagated and will be considered a situation analogous to the endemic one, or if it will become extinct in the network.

Based on a model described by (1), a model with a modification, including an antidotal population compartment (A) representing nodes of the network equipped with fully effective antivirus programs, is studied and considering constant population with four compartments: susceptible computers are uninfected and subject to infection (S); infected computers are represented by (I), and those removed by infection or not (R) and (A) are uninfected computers equipped with antivirus, as shown in Figure 2.

Figure 2.

SIRA model.

As reported by [21] the dynamic equation for the populations $S$, $I$, $R$ and $A$ are:

$$\left\{\begin{array}{ll}\dot{S}& =N-{\sigma }_{\mathit{SA}}\mathit{SA}-\mathit{\beta SI}-\mathit{\mu S}+\mathit{\sigma R};\\ \dot{I}& =\mathit{\beta SI}-{\alpha }_{\mathit{IA}}\mathit{AI}-\mathit{\delta I}-\mathit{\mu I};\\ \dot{R}& =\mathit{\delta I}-\mathit{\sigma R}-\mathit{\mu R};\\ \dot{A}& ={\sigma }_{\mathit{SA}}\mathit{SA}+{\alpha }_{\mathit{IA}}\mathit{AI}-\mathit{\mu A}.\end{array}\right.$$E2

The influx rate is considered to be $N=0$ because during the propagation of the considered virus, there is no incorporation of new computers in the network. The choice of $\mu =0$ is justified that the machines obsolescence time is larger than the time of the virus action.

The model represents the spread of a known virus and the conversion of the antidoto to the infected is not considered. In this model, a vaccination strategy can be defined implying a control strategy associated with the economic use of antivirus programs.

The analysis of the SIRA model shows that it is possible to reach an disease-free equilibrium, guaranteeing a good operational performance of the network and that even in a situation of endemic equilibrium, the introduction of at least one machine equipped with antivirus guarantees a good performance of the network, tending to a disease-free equilibrium.

Furthermore, considering a constant total number of machines, the main control parameters are associated with the infection rate and how quickly infected machines are removed for formatting procedure. The other network parameters are associated with the transient response of the network in some small disturbance.

The other variation of the SIRA model is improved by considering that, when the machines pass to the removed condition, a fraction of these machines is recovered and the complement is considered dead. The introduction of the mortality rate results in an increase of the robustness of the disease-free equilibrium point of a computer network [38].

The study of the SIRA model was complemented by considering another control strategy by adding a quarantined compartment. The new compartment can be evaluated for the presence or absence of saturation and both situations indicate robustness in control strategies.

Based on a model described by [20], the virus propagation in a cluster is studied [45]. The model proposed is an association of two networks constituted by the SIRA model that interacts as shown in Figure 3.

Figure 3.

SIRA cluster model.

Considering this hypothesis, adding another compartimental model, and associating a new infection rate, representing the infection capacity to the network, the cluster SIRA model for viruses propagation was proposed has the following dynamical eqs. (3):

$$\left\{\begin{array}{ll}{\dot{S}}_1& =-{\alpha }_{\mathit{SA}1}{S}_1{A}_1-{\beta }_1{S}_1{I}_1-{\rho }_2{I}_2{S}_1+\theta 1R_1;\\ {\dot{I}}_1& ={\beta }_1{S}_1{I}_1-{\delta }_1{I}_1-{\alpha }_{\mathit{IA}1}{I}_1{A}_1+{\rho }_2{I}_2{S}_1;\\ {\dot{R}}_1& ={\delta }_1{I}_1-{\theta }_1{R}_1;\\ {\dot{A}}_1& ={\alpha }_{\mathit{SA}1}{S}_1{A}_1+{\alpha }_{\mathit{IA}1}{I}_1{A}_1;\\ {\dot{S}}_2& ={\alpha }_{\mathit{SA}2}{S}_2{A}_2-{\beta }_2{S}_2{I}_2-{\rho }_1{I}_1{S}_2+\theta 2R_2;\\ {\dot{I}}_2& ={\beta }_2{S}_2{I}_2-{\delta }_2{I}_2-{\alpha }_{\mathit{IA}2}{I}_2{A}_2+{\rho }_1{I}_1{S}_2;\\ {\dot{R}}_2& ={\delta }_2{I}_2-{\theta }_2{R}_2;\\ {\dot{A}}_2& ={\alpha }_{\mathit{SA}2}{S}_2{A}_2+{\alpha }_{\mathit{IA}2}{I}_2{A}_2.\end{array}\right.$$E3

For the cluster SIRA model, the susceptible population $S$ is infected with a rate, that is, related to the probability of susceptible elements to establish effective communications with infected ones and this rate is proportional to the product $\mathit{SI}$, with proportion factor represented by $\alpha$ or if infectivity occurs between network, by rate $\rho$ that is related to the probability of infected elements to establish effective communications with susceptible computer in another network.

Clustered sets, represented by subscripts 1 and 2, are divided into four groups, as shown in Figure 3 and populations are considered constant in each cluster.

The SIRA cluster study, despite presenting a simple model composed of two connected grouped networks, points out the main control strategies associated with the control of parameters in order to avoid new forms of attacks.

Among the possibilities for adjustments, we consider infection rates in susceptible populations, due to contact with infected populations from the same cluster ($\beta$); conversion rates are removed by infected ($\delta$) and infection rates in susceptible populations due to contact with the infected population of the other cluster ($\rho$).

The choice of network topology and connection strategies is an effective strategy to reduce the spread of viruses, since infection rates are not known in advance.

Another way to prevent the spread of viruses is to maintain the removal rates of damaged machines, which plays an important role in controlling the spread of networks.

If the virus is known, the best strategy to prevent its spread is to introduce antidote nodes containing programs that can be propagated throughout the network, immunizing the other nodes.

4. Conclusions

This chapter reports a detailed survey of compartments model in computer viruses with antidotal machine. The review provided a wide application of epidemiological models in compartmental models applied to computer networks. The focus of the review was to show the infuence of machines equipped with antivirus and their control strategies on the spread of viruses. The study of clustered networks is recent and with the model presented, it is expected that the review provides tools for studies of virus propagation dynamics in more complex networks.

Acknowledgments

JRCP is supported by the Brazilian Research Council (CNPq), grant number: 302883/2018–5.

Conflict of interest

The author declares that there is no conflict of interests regarding the publication of this study.