STATE FEEDBACK IMPULSIVE CONTROL OF COMPUTER WORM AND VIRUS WITH SATURATED INCIDENCE

. A state feedback impulsive model is set up to discuss the spreading and control of the computer worm and virus. Considering the transmission features, saturated infectious is adopted to describe the spreading in the model, and all the treatment measures, such as patching operating system and updat- ing antivirus software, are assumed to take eﬀect instantly. Then the model is analyzed with a novel method, and the existence and stability of order-1 limit cycle are discussed. Finally, the numerical simulation is listed to verify the result of the paper.


Introduction.
In the past decade, information technology has gotten a rapid development, and is playing an important role in industry, commerce and humans' daily life. Computers, the most primary carriers of the advanced technique, are the requisite hardware of the modern science. However, computers have to face the threaten of worm and virus which are the biggest menace to the normal operation [16,14]. Generally, the operators do not know the existence of the computer worm, least of all how and when their computers have been infected. Worm and virus are always attached to a junk mail, masqueraded as innocent files for downloading, even ensconced in a code spreading through the Internet [5]. The dissemination of the worm and virus only needs someone to open the host file, then the worm and virus can transmit automatically without any additional operation [30]. Up to now, computer worm and virus can averagely cause billions of economic damage every year. To the operators, the direct results caused by infectious, such as causing system collapse, occupying computer RAM and demolishing existence data etc, always make them pay a heavy price. In response, updating antivirus software and patching operating system are two primary protections.
Recently, some researchers described the transmission and prevention of computer worm and virus with the state feedback compulsive model, and they have got some interesting results [7,12,27]. In their models, when the number of infected computers reaches a certain level the impulsive control will be triggered. Then new antivirus software will be published and installed, operating system will be patched to the latest version. All those activities happened instantaneously, and they are depicted as an impulse in the model. However, the published researches all assume the diffusion of worm and virus is linear with the number of infected and susceptible computers which goes against the truth. In fact, at the initial period of a certain transmission, among the huge number of healthy computers connected with the Internet, only few of them have the opportunity to touch the virus [9,22,31]. And following the development, the infectious rate can not keep being linear with the infected and susceptible ones if the infected computers are numerically superior. So it is proper to describe the infectious with saturated transmission, and we will study the impulsive control of computer virus under this spreading fashion.
The remaining of this paper is arranged as follows: we set up the model and introduce some preliminaries in section 2; the existence, uniqueness and stability of order-1 limit cycle are analyzed in section 3; finally, some numerical simulation are showed to confirm the result and some deeper discussion is carried out in section 4.

2.
Modeling and preliminaries. Enlightened by the development in the field of impulsive control and the progress of infectious disease study [19,29,25,26], all the computers connected with the Internet are divided into two disjoint groups: S(t) and I(t), which also present the number of individuals in each group at time t. The computers in group S are healthy ones and can be infected by the computer worm and virus, and group I is made up of individuals that are infected and they can transform worm and virus to members of S. In the present research [12,27], the incidence form are assumed as the simple item βSI which is contravened with the truth. In fact, the incidence is not remarkably effected by the number of susceptible ones when S occupies a considerable large proportion of the population, especially during the first spreading stage of a certain computer worm or virus. According to these truth, saturated incidence coincides with the real situation more closely.
Considering objectively, we make the following assumptions: (1) all the new emerging computers are susceptible ones, and the rate is K; (2) rejection rate is not affected by the computer worm and virus, and both suceptibles and infectives are sifted out from the Internet at rate µ; (3) the transmission incidence is βSI 1+αS which means the incidence is approximately β α I when the number of susceptibles S is relatively large; (4)Ī is assumed as the threshold that the computer virus can be discovered. When infectives is less thanĪ, the computer virus spreads freely, and in case the number of infectives reachesĪ, the computer worm and virus can be detected. Then the super-version antivirus software and operating system patch program will be published and a percentage of computers (both suceptibles and infectives) will upgrade their antivirus softwares and patch their operating systems. After these operations, those computers are immune to the certain computer worm or virus and get away from the virus spreading system. We define the upgrading rate of suceptibles and infectives are σ 1 and σ 2 separately. Following these assumptions, the spreading and control process can be explicated with the state feedback impulsive model Considering the practical significance, all the parameters in this paper are positive, σ 1 ∈ (0, 1), σ 2 ∈ (0, 1) and system (1) is only considered in space R + 2 = {(S, I)|S ≥ 0, I ≥ 0}.
In the reminder part of this section, we introduce some definitions and lemmas to support the proof of the existence and stability of the order-1 limit cycle of system (1).
Definitions of successor function and order-1 periodic solution of state feedback impulsive dynamic system are also vitally important in the research. 21,15] Simply suppose the impulse set M and the phase set N of system (2) are two straight lines respectively(see Fig.1), and the intersection of phase set N and y axis is Q. To any point A ∈ N , the coordinate of A, denoted by a, can be defined as the distance between A and Q. The solution trajectory originating from A intersects impulse set M at point B, then the impulsive function ϕ maps B to point C in phase set N , then C is called the subsequent point of A, and its coordinate is c. The successor function of A is defined as a continuous function F (A) = c − a. If C locates in the same point of A, then the trajectory segment AB is an order-1 periodic solution, and the orbit AB ∪ BA is said to be an order-1 limit cycle.  3. Qualitative analysis of the uncontrolled system. Without counting the impulsive control measure, system (1) can be simplified as system (3) is called uncontrolled system of (1). Change the variables with linear transform t = (1 + αS)τ and still use t as the independent variable, then system 3.1. Equilibria. It is obvious that system (4) has two equilibria E 1 ( K µ , 0) and E 2 (S * , I * ), where In the following discussions, we assume condition (5) is satisfied consistently. The Jacobian matrix of E 1 is To positive equilibrium E 2 (S * , I * ), its Jacobian matrix is

IMPULSIVE CONTROL OF WORM AND VIRUS 1469
Assume λ 1 and λ 2 are two roots of the characteristic equation, then so E 2 is a locally stable node or focus (see Fig. 2). 3.2. Uniform boundedness. In this part, we will consider the uniform boundedness in the first quadrant. From system (4), we can find that is vertical isoclinic line, and are horizontal isoclinic lines. Following the succeeded statement, we select a piece of bounded region (see Fig.3). Designate a line l : It is obvious that ∂P1 ∂S + ∂Q1 ∂I = − µα I − K S 2 I < 0, then following Dulac Theorem system (4) has no limited cycle.
Basing on the above discussion, if condition (5) is satisfied, then there exists only one positive equilibrium E 2 (S * , I * ) and E 2 (S * , I * ) is globally asymptotically stable. 4. Order-1 limit cycle of System(1). In this section, we will certificate the existence and uniqueness of order-1 limit cycle of system (1). In reality, it is unreasonable that a single kind of computer virus lasts for long time without being detected. So we assumeĪ < I * without loss of generality, i.e. the impulsive set M : I =Ī is a horizontal line beneath the positive equilibrium E 2 . The existence, uniqueness and stability of the order-1 limit cycle will be proved progressively in this section. 4.1. Existence of order-1 limit cycle. The existence of order-1 limit cycle is studied in this subsection.
Assume the intersection of imagine set N : I = (1 − σ 2 )Ī and the horizontal isoclinic line dI dt = 0 is A, and the coordinate is A(S * , (1 − σ 2 )Ī). According to the fundamental theorem of ODE, there must exist a trajectory passing point A, denote it as L. After a period movement, trajectory L can reach the impulsive set M , and we assume the intersection is M A and its coordinate is M A (x M A ,Ī). Then the impulsive function ϕ maps M A to a point N A (x N A , (1 − σ 2 )Ī) in imagine set N . If x N A = S * , i.e. point A and point N A are the same point, then the trajectory L and the impulsive mapping ϕ form an order-1 periodic solution (see Fig.4). Let σ * 1 = x M A − S * , then we prove there exists order-1 periodic solution while 0 < σ 1 < σ * 1 and σ * 1 < σ 1 < 1. Case of σ * 1 < σ 1 < 1. When σ * 1 < σ 1 < 1, it means that the impulsive function ϕ controls the imagine point N A to fall on left side of A(see Fig 6), and the coordinate is Still following the continuous of successor function, there must exist a point C between A and N A satisfying F (C) = 0, that is to say the trajectory initiating from C and the corresponding impulsive mapping form the order-1 periodic solution.

4.2.
Uniqueness of order-1 limit cycle. In this part we prove the uniqueness of the order-1 limit cycle with the homogeneous of successor function.
Theorem 4.2. The order-1 limit cycle of system (1) is unique.
Proof. Select two points I and J in phase set N arbitrarily, and assume x I < x J (see Fig. 7). There must exist trajectories initiating from I and J, and we denote them as L I and L J respectively. These two trajectories can reach the impulse set M , and we denote the intersections as M I and M J respectively. It is obvious that M I must locate on the right side of M J , i.e. x M I > x M J . Then the impulse function ϕ maps them to N I and N J respectively.
is easy to obtain x N I > x N J . I and J have N I and N J as their subsequent points respectively, F (I) and F (J) are their successor functions. Then Basing on the previous discussion, we can draw the conclusion that the successor function F (·) of system (1) is monotonically decreasing. Thus to any σ 1 ∈ (0, 1) and σ 2 ∈ (0, 1), there exists only one point C in imagine set satisfying F (C) = 0. Therefore the order-1 limit cycle of system (1) is unique. 4.3. Stability of order-1 limit cycle. The above content has proved the existence and uniqueness of order-1 limit cycle. In this subsection, we discuss the stability of the order-1 limit cycle of system (1). Unlike the case of continuous dynamic system, the stability proof of impulsive dynamic system is quite complex. Some definition and lemma which are significant in the proof will be illustrated first.

Definition 4.3.
[24] The order-1 limit cycle Γ is stable, if it is the ω limit set for those trajectories initiating from any point of its small enough neighborhood U (Γ). Otherwise, Γ is unstable.
Basing on the theorem of subsection 4.1 and 4.2, to any σ 1 ∈ (0, 1) and σ 2 ∈ (0, 1), system (1) has a unique order-1 limit cycle, here we denote it as Γ. We also assume that Γ intersects the imagine set N at point A (see Fig.8). Then to any point S 0 that locates in the small neighborhood of A, define a point series where S i+1 is the subsequent point of S i , i = 0, 1, · · · , k, · · · , and their coordinates s 0 , s 1 , · · · , s k , s k+1 , · · · are defined as where d k is the distance between S k and A. Under this rule, it is obvious that the coordinate of A is 0. Figure 8. S 1 , S 2 , · · · , S k+1 , S k+2 , · · · are the subsequent points of S 0 , S 1 , · · · , S k , S k+1 , · · · respectively. Lemma 4.4. [24] Denote the mapping of the general impulsive dynamic system (2) as f , and suppose functions = f (s) is derivative at s = 0. Then s = 0 is stable (unstable), if ds ds s=0 < 1(> 1).
It is not easy to prove the stability of order-1 limit cycle of system (2) only with the previous lemma, so we set up an orthogonal coordinate (s, n) in the nearby area of Γ as an auxiliary tool.
Without loss of generality, we assume that functions P (x, y) and Q(x, y) of system (2) have arbitrary order partial derivatives. Since the impulse mapping is quick enough, the period of order-1 limit cycle is the same with the time interval between A and C on a certain trajectory of corresponding uncontrolled system, and we denote it as T .
To any point in that region, there exists a certain point in the closed orbit Γ and its normal line passes the certain point. The first coordinate s of the new coordinate is defined as the length of the trajectory from A to the certain point on Γ, while the second coordinate n is defined as the number of the normal vector(upside is the positive direction)(See Fig.9). Rewrite the rectangular equation of curve ABC into the parametric equation x = φ(s), y = ψ(s), where s is the parameter. Then the rectangular coordinate (x, y) can be expressed with the orthogonal coordinate (s, n) as Following (2) and (10), we have It is apparent that n = 0 is a solution of (11) . We also assume that F (s, n) is biased derivative, and the first-order partial derivative of F (s, n) is continuous with respect to n, then (11) can be expressed briefly as dn ds = F n (s, n) n=0 · n + o(n).
Following (11), we can calculate where P 0 and Q 0 are the values of P and Q at point A, P x0 , P y0 , Q x0 and Q y0 represent the partial derivatives of P and Q at n = 0 with respect to x, y respectively. It is obvious that P 0 φ + Q 0 ψ = 0. Then the order-1 linear approximate equation of (12) is and its solution is n = n 0 e T 0 H(s )ds , n 0 = n(0).
Theorem 4.5. Assume h is the length of curve ABC which is a segment of the order-1 periodic solution Γ to system (2), then Γ is stable (unstable) if integration of H(s) along ABC is negative (positive), i.e.
The proofs of Theorem 4.5 and Theorem 4.6 are similar with that in [27], and omitted here.
Then we can draw the corollary naturally.

5.
Simulation and discussion. In this section, we present and discuss a special example to check the theoretical results in section 3 and section 4. The uncontrolled part of system (1) is numerically calculated with fourth-order Runge-Kutta of Matlab software package. In the following, we discuss the solution of system (1), considering the parameters K = 0.06, β = 0.09, α = 8.2 and µ = 0.01. After a simple calculation, the corresponding uncontrolled system has a steady state (x * , y * ) = (1.25, 4.75). We also assume the threshold value that triggers patching operating system and updating the antivirus software is 3.8. Then the instantaneous impulse comes into force on 40% of susceptible ones and 60% of infected ones respectively. The trajectory of system (1) and time series of S and I are listed in Fig.(10).
From Fig.(10), it is obvious that system (1) has an order-1 limit cycle with the parameters mentioned above. We can also find that the limit cycle forms soon after the trajectory initiate from the original point which means that the impulsive patching and updating of antivirus software is quite effective. During the first period of the transmission, the worm or the virus spreads freely, the number represents susceptible computers decreases rapidly and the number stands for the infectious ones increased sharply. The developing trend of S and I(subplots (b) and (c) of Fig.(10)) indicates that the worm or virus erodes the computers ferociously, and most of the healthy computers will be infected without any intervention. After patching the system or updating the antivirus software, the infected computers will drop down instantly. Then it rises again according to the uncontrolled propagation. However, impulsive treatment triggered by the state of infected computers can prevent the deluge of worms and the collapse of the Internet. Enhancing the Internet monitor, publishing new version operating system patch, and developing efficient antivirus software can make the Internet operating normally.