[ Pobierz całość w formacie PDF ]
the average node degree of email users. The average node degree is greater, the (t)
is bigger. Because of the feature of cluster email virus likely transfers the email virus
copies to the infected users. The number of infected user increase sharply when it
infects a healthy group in the first time. If most of the users in a group have been
infected, email virus propagates mildly. Only the healthy users are favor of the
32 International Journal of Advanced Science and Technology
4 Cong Jin, Qing-Hua Deng, Jun Liu
spreading of email virus. Thus (t) is also related with the proportion of healthy
users. We design the definition of (t) based on the two factors analyzed above.
N It N It
(t) k , where k is the average node degree of email users, and is the
N N
N It
proportion of healthy users to total email users. Replace (t) with k , and we
N
N It
obtain It 1 It k It . Furthermore, the differential of It indicates the
N
increasing rate of email virus and we can obtain the differential of It described by
dIt k N N k
(It )2 . Where the infected users is 5 at the initial time,
dt N 2 4
N N 5 dIt N k
namely I0 5 . While It , i.e., t ln , takes maximum value .
2 k 5 dt 4
In other words, email virus propagates most quickly when half of the email users are
infected before the anti-virus program is available. In order to restrain the large-scale
outbreak of email virus we should try our best to run the anti-virus software before the
N 5
time t ln . That is to say, the bigger the value of t is, there are more time for
k 5
the anti-virus experts to research the anti-virus software. So email users should open
the email with long interval and small probability to delay the time t . To store as
small email addresses as possible in the email address book is also helpful to delay t .
2) The Latter Phase
After the anti-virus software is available, i.e., t T0 , the cleanup probability is not
zero anymore. The case of email virus propagation is It 1 ( 1 ) It
N It
k It . Furthermore,
N
dIt k ( k )N N( k )2
[It ]2 (3)
dt N 2 k 4 k
( k )t
1 1 k k
[ ]e (4)
It I
N( k ) N( k )
There are 5000 infected email users in the Internet when the anti-virus software
dIt
appears, i.e., I0 5000 , and is the increasing rate of email virus in unit time.
dt
dIt
While 0 , the number of infected users lessen and the email virus no longer
dt
( k )N dIt
spreads. From Equation (3), we know that when It , 0 .Thus,
k dt
International Journal of Advanced Science and Technology 33
Computer Virus Propagation Model Based on Variable Propagation Rate 5
I0 k
(1 ) . (5)
N
Inequality (5) points out the restriction among various factors. The users who have
large email address book should cleanup virus frequently to control virus propagation.
Some users are accustomed to check email with short interval. These users should
also cleanup virus with a high frequency. If users open email with low probability, a
low cleanup probability is also useful to control propagation. During the process of
email virus propagation, if the cleanup probability , the opening probability in unit
dIt
time and the average degree k satisfy the inequality (5), 0 , i.e., email virus
dt
will disappear gradually.
4. Discussion of Average Node Degree
The average node degree is a crucial factor of email virus propagation. To a great
extent, the speed of email virus spreading depends on the average node degree.
However, it is really difficult to decide the value of average node degree by statistic
data due to the hugeness of email network. Thus, we discuss the relativity of average
node degree and the power law exponent for ascertaining the value. The average node
degree can be expressed as k kp(k) , where p(k) is the probability of any given
node with degree k. The degree of email network satisfied the power law distribution,
k
thus p(k) , where is the power law exponent and ( ) is the Riemann zeta
( )
[2]
function, and ( ) k . Power law exponent of many actual complex
1
networks are different from each other and the range is 2 3 . So, we have
1
k .
(6)
2
Most users have a small-scale email address book, so the value of k is impossible
to be infinite and is not equal to 2, i.e., is greater than 2. When the value of
increases, the value of k decreases. The value of k gets the minimum 2 while
reaches the maximum 3. If we know the value of exponent power law exactly, the
value of average node degree k can be figured out from Equation (6). We established
the basis for selecting the value of k . It is helpful for designing the function of
propagation and then further developing the propagation model.
34 International Journal of Advanced Science and Technology
6 Cong Jin, Qing-Hua Deng, Jun Liu
5. Simulation Experiment
Let the unit of time be 24 hours. The parameters are set as, the size of email users is
N 10000 , the interval of checking email =1, and the average of contacts k 6 .
Figure 1 shows that email virus spread freely before anti-virus software appearing and
the speed is fast. Email virus would infect all the email users without anti-virus
software. The larger the opening probability is, the higher the speed of spreading is.
The time at which email virus propagates fastest is pointed out through the dashed
line. Figure 2 clearly shows that email virus propagation has two cases after anti-virus
software is used. Either it increase sharply and tend to a stable state or decrease and
tend to zero. is smaller and is greater, email virus propagation is slower. When
the inequality (5) is tenable, email virus propagation goes down and the number of
infected users reduce gradually. When the inverse case is tenable, email virus
propagation goes up and the number of infected users adds. Let | k | .
Fig. 1. Email virus propagation on different and Fig. 2. Different and
6. Conclusions
The terminative condition of email virus propagation plays a significant role on
control. Highly-connected users request large cleanup probability. Low opening
probability and large checking interval request a comparatively small cleanup
probability. Instead of a fixed value, is different for different users to stop
spreading. Average node degree is inversely proportional to power law exponent.
Considering the relation between k and bring the model to be self-adaptive. By
adjusting the power law exponent automatically, the model is suitable for different
topologies. The email network is less likely to be BA scale-free network. The
equation can be used to evaluate the email network model.
References
1 C.C.Zou, D.Towsley, and W.B.Gong. Email virus propagation modeling and analysis.
Technical Report: TR-CSE-03-04, University of Massachusetts, Amherst 2003
2 J.T.Xiong. ACT: attachment china tracing scheme for email virus detection and control.
Proc. of the 2004 ACM Workshop on Rapid Malcode, October 29-29, Washington DC,
USA, 2004, 11-22
[ Pobierz całość w formacie PDF ]