Virus spread in complete bi partite graphs

Transcription

1 Viru pread in complete bi partite graph J.S. Omic 1, R. E. Kooij 1;2 and P. Van Mieghem 1 1 Faculty of Electrical Engineering, Mathematic, and Computer Science Delft Univerity of Technology, P.O. Box 5031, 2600 GA Delft 2 TNO Information and Communication Technology, P.O. Box 5050, 2600 GB Delft, The Netherland ABSTRACT In thi paper we tudy the pread of virue on the complete bi-partite graph K M;N. Uing mean eld theory we rt how that the epidemic threhold for thi type of graph ati e c = p 1 MN, hence, con rming previou reult from literature. Next, we nd an expreion for the average number of infected node in the teady tate. In addition, our model i improved by the introduction of infection delay. We validate our model by mean of imulation. Inpired by imulation reult, we analyze the probability ditribution of the number of infected node in the teady tate for the cae without infection delay. The mathematical model we obtain i able to predict the probability ditribution very well, in particular, for large value of the e ective preading rate. It i alo hown that the probabilitic analyi and the mean eld theory predict the ame average number of infected node in the teady tate. Finally, we preent a heuritic for the prediction of the extinction probability in the rt phae of the infection. Simulation how that, for the cae without infection delay, thi time dependent heuritic i quite accurate. Categorie and Subject Decriptor C.4 [Computer-Communication Network]: Performance of Sytem Meaurement technique, modeling technique General Term Performance, Security, Theory Keyword Computer Viru, Epidemiology, Modeling, Simulation j..omic@ewi.tudelft.nl, robert.kooij@tno.nl and p.vanmieghem@ewi.tudelft.nl Permiion to make digital or hard copie of all or part of thi work for peronal or claroom ue i granted without fee provided that copie are not made or ditributed for prot or commercial advantage and that copie bear thi notice and the full citation on the rt page. To copy otherwie, to republih, to pot on erver or to reditribute to lit, require prior pecic permiion and/or a fee. BIONETICS 2007, December 10 13, 2007, Budapet, Hungary Copyright 2007 ICST. 1. INTRODUCTION The theory of the pectra of graph contain many beautiful reult, that relate phyical propertie of a network, uch a for intance robutne, diameter and connectivity, to eigenvalue of matrice aociated with the graph, ee e.g. [2], [11]. Recently it ha been hown, ee [8], [4], that the pectral radiu of a graph (i.e. the larget eigenvalue of it correponding adjacency matrix) play an important role in modeling viru propagation in network. In fact, in [8] and [4] the Suceptible-Infected-Suceptible (SIS) infection model i conidered. The SIS model aume that a node in the network i in one of two tate: infected and therefore infectiou, or healthy and therefore uceptible to infection. The SIS model uually aume intantaneou tate tranition. Thu, a oon a a node become infected, it become infectiou and likewie, a oon a a node i cured it i uceptible to re-infection. There are many model that conider more apect like incubation period, variable infection rate, a curing proce that take a certain amount of time and o on [3], [6], [9]. In epidemiological theory, many author refer to an epidemic threhold c, ee for intance [3], [1], [6] and [10]. If it i aumed that the infection rate along each link i while the cure rate for each node i then the e ective preading rate of the viru can be de- ned a = =. The epidemic threhold can be de ned a follow: for e ective preading rate below c the viru contamination in the network die out - the mean epidemic lifetime i of order log n, while for e ective preading rate above c the viru i prevalent, i.e. a periting fraction of node remain infected with the mean epidemic lifetime of the order e n. In the cae of peritence we will refer to the prevailing tate a a metatable tate or teady tate. It wa hown in [8] and [4] that c = 1=(A) where (A) denote the pectral radiu of the adjacency matrix A of the graph. Recently, the epidemic threhold formula ha alo been veri ed by uing the N-intertwined model, which conit of a pair of interacting continuou Markov chain, ee [12]. Although thi main reult of [8] i very nice, we ought to mention that it wa derived under a number of implifying condition. For intance it wa aumed that for a xed time tep the probability that a node get cured after infection from neighbor i 1=2. In addition, [8] doe not provide an explicit expreion for the fraction of infected node in the epidemic teady tate. In thi paper we circumvent thee drawback by uing an alternative approach to derive an expreion for the epidemic threhold and the epidemic teady tate for complete bi-partite graph. In addition, we how that the N-intertwined model, introduced in [12], i analyt-

2 ically olvable for the complete bi-partite graph. Moreover, we how, in more detail than in [12], deviation from the N-interwined model for the complete bi-partite graph. The ret of the paper i organized a follow. In Section 2 we dicu the claical model by Kephart and White which decribe the pread of a viru on regular graph. In Section 3 we derive and analyze the pread of virue on complete bi-partite graph. In Section 4 we take the e ect of infection delay on viru pread on complete bi-partite graph into account. In Section 5 we validate our reult through imulation analyi. The model i reinforced with probabilitic analyi in Section 6. We ummarize our reult in Section VIRUS SPREAD ON REGULAR GRAPHS In order to explain our model for viru pread on complete bi-partite graph, it i ueful to rt dicu the pread of virue over a impler network, i.e. the connected regular graph. Thi model i baed on a claical reult by Kephart and White [6] for SIS model. We conider a connected graph on N node where every node ha degree k. We denote the number of infected node in the population at time t by I(t). If the population N i u ciently large, we can convert I(t) to i(t) I(t)=N, a continuou quantity repreenting the fraction of infected node. Now the rate at which the fraction of infected node change i due to two procee: uceptible node becoming infected and infected node being cured. Obviouly, the cure rate for a fraction i of infected node i i. The rate at which the fraction i grow i proportional the fraction of uceptible node, i.e. 1 i. For every uceptible node the rate of infection i the product of the infection rate per node (), the degree of the node (k) and the probability that on a given link the uceptible node connect to an infected node (i). Therefore we obtain the following di erential equation decribing the time evolution of i(t): The olution to Eq. (1) i i(t) = di = ki(1 i) i: (1) dt i 0(1 ) i 0 + (1 i 0)e with a teady tate olution (k )t ; (2) i 1 = 1 ; (3) where =, and i0 i the initial fraction of infected k node. Obviouly an epidemic teady tate only exit if i 1 > 0. Becaue we can rewrite Eq. (3) a i 1 = k k we can conclude that the epidemic threhold ati e (4) = 1 k : (5) Becaue for k-regular graph the pectral radiu of the adjacency matrix i equal to k, ee [2], Eq. (5) i in line with the reult by [8]. 3. VIRUS SPREAD ON COMPLETE BI PARTITE GRAPHS In thi ection we will conider complete bi-partite graph. A complete bi-partite graph K M;N conit of two dijoint et S 1 and S 2 containing repectively M and N node, uch that all node in S 1 are connected to all node in S 2, while within each et no connection occur. Figure 1 give an example of a complete bi-partite graph on 6 H H HH Figure 1: Complete bi-partite graph K 2;4 Notice that (core) telecommunication network often can be modeled a a complete bi-partite topology. For intance, the o-called double-tar topology (i.e. K M;N with M = 2) i quite commonly ued becaue it o er a high level of robutne againt link failure. For example, the Amterdam Internet Exchange (ee one of the larget public Internet exchange in the world, ue thi topology to connect it four location in Amterdam to two high-denity Ethernet witche. Senor network are alo often deigned a complete bi-partite graph. We will now derive a model for viru preading on the complete bi-partite graph K M;N. Without lo of generality we can aume M N. We denote the number of infected node belonging to S 2 at time t by I(t). Again, we ue the argument that for N u ciently large the continuou fraction i(t) I(t)=N repreent the fraction of infected node in S 2. The cure rate for the fraction i of infected node in S 2 i i. The rate at which the fraction i grow i proportional the fraction of uceptible node 1 i. For every uceptible node in S 2 the rate of infection i the product of the infection rate per node (), the degree of the node (M) and the fraction of node in S 1 that i infected at time t. Thi latter fraction will be denoted by j(t). Therefore we obtain the following di erential equation decribing the time evolution of i(t): di = Mj(1 i) i: (6) dt To derive the teady tate of j(t), which will be denoted a j 1, we treat the dynamic in each node of S 1 a a two-tate Markov proce, with a uceptible and an infectiou tate. Let u denote the teady tate of Eq. (6) a i 1. Then, becaue each node in S 1 i connected to N node of which a fraction i 1 i infectiou, the rate at which a node in S 1

3 goe from uceptible to infectiou i Ni 1. The rate at which a node in S 1 change from infectiou to uceptible i. Therefore the teady tate probability that a node in S 1 i infected ati e: j 1 = Ni1 Ni 1 + : (7) If we ubtitute Eq. (7) and i = i 1 into Eq. (6) and olve the right hand ide with repect to i 1 then we obtain the teady tate olution for the fraction of infected node in S 2: i 1 = MN2 2 N(M + ) Becaue an epidemic teady tate only exit if i 1 > 0, Eq. (8) yield the epidemic threhold: = (8) 1 p MN : (9) Thi complie with [8] becaue according to [2] the pectral radiu of the adjacency matrix of the graph K M;N i equal to p MN. Notice that for the cae M = N the graph K M;N i in fact regular and Eq. (9) reduce to Eq. (5) with k = N. For e ective preading rate above the epidemic threhold the epidemic teady tate 1 for the complete bi-partite graph K M;N ati e 1 = Mj1 + Ni1 M + N : (10) Subtitution of Eq. (8) and Eq. (7) into Eq. (10) yield 1 = (MN2 2 )(N + M + 2) (M + N)(M + )(N + ) : (11) It i eay to verify that for the cae M = N, Eq. (11) reduce to Eq. (4), with k = N. 4. THE IMPACT OF INFECTION DELAY So far we have aumed that once a node i infected, it intantaneouly become infectiou. In reality, there may be a time lag between the arrival of a viru at a node and the time thi node itelf tart to pread the viru. A viru could lie dormant on a hot due to uer inactivity or becaue the viru wa deigned in thi manner for tealth reaon. In [9] Wang and Wang have tudied the impact of infection delay on the epidemic threhold and the epidemic teady tate for regular graph. In [9] the infection delay i de ned a the length of time between the viru arrival at a node and the intant the node become infectiou. It i hown in [9] that the teady tate for the fraction of infectiou node ati e i 1 = k which yield for the epidemic threhold: e ; (12) k = e k : (13) Thu, the infection delay increae the epidemic threhold, which mean that infection delay make an epidemic die out more eaily. In thi ection we will tudy the impact of infection delay on viru pread on complete bi-partite graph. Analogou to Eq. (6) we can derive the following delaydi erential equation for the evolution of i(t), which a before, denote the fraction of infected node in S 2 at time t: di(t) dt = Mj(t )e (1 i(t)) i(t); (14) where j(t ) = 0 for t < and j(t) denote the fraction of node in S 1 that i infectiou at time t. For t, the probability that a node in S 1 i infectiou i the probability that the node wa already infected at time t, ince all node infected between t and t are till being delayed. Curing a node during the infection delay period reult in the e factor. Let u denote the teady tate of Eq. (14) a i 1. We olve for i 1 by etting the right hand ide of Eq. (14) equal to zero and j(t ) = j 1. Analogou to Eq. (7) we nd for j 1 j 1 = Ni1e Ni 1e + ; (15) where the e factor correpond with the probability that a node i cured during the infection delay period. Plugging Eq. (15) and i = i 1 into Eq. (14) and olving the right hand ide with repect to i 1 we obtain the teady tate olution for the fraction of infected node in S 2: i 1 = MN2 2 e 2 N(M + e ) ; (16) which yield for the epidemic threhold: = e p MN : (17) Analogou to the previou ection it can be hown that for e ective preading rate above the epidemic threhold the epidemic teady tate 1 for the complete bi-partite graph B M;N with infection delay ati e 1 = (MN2 2 e 2 )(N + M + 2e ) (M + N)(M + e )(N + e ) : (18)

4 Notice that for = 0 the reult obtained in thi ection (Eq. (16-18)) reduce to the correponding reult in Section SIMULATION ANALYSIS 5.1 Viru pread without infection delay In thi ection, we preent a et of imulation reult that will validate the mean eld model propoed in the previou ection. We have conducted 500 imulation for variou value of the e ective preading rate = on complete bipartite graph K M;N with fm = 10; N = 990g; fm = 500, N = 500g. Note that for K 10;990 and K 500;500 the epidemic threhold ati e c = 0:0101 and c = 0:002, repectively. The number of oberved time unit i Each imulation tart with 5 randomly choen infected node. The viru pread i a tochatic proce, and it can be expected that during evolution ome of the infection die out before reaching the teady tate even though the e ective preading rate i above the threhold. Thee evolution have been excluded from calculation of the expected number of infected node in the teady tate. Figure 3: Average number of infected node for K 500;500, excluding viru epidemic that died out. Figure 2: Average number of infected node for K 10;990, excluding viru epidemic that died out. Figure 4: Number of infected node in the teady tate for K 10;990 Figure 2 and 3 how the average number of infected node for 500 ytem evolution for di erent value of. The dahed line are imulation reult while full line denote theoretical prediction. A hown, our model predict the mean number of infected node in the teady tate very well. Figure 4 and 5 how theoretical and imulated value for the mean number of infected node in teady tate. Again, realization of the ytem in which the viru died out during evolution are excluded in calculating the average. Simulation reult alo howed that below the threhold the viru die out. Figure 6 and 7 how 500 evolution of the number of infected node during time unit. We can oberve that the number of infected node uctuate around the average teady tate predicted by our model. We will quantify the pread around the average teady tate by mean of the tandard deviation. Figure 8 how the the pread around the average teady tate, in term of, a a function of the e ective preading rate. Note that our model, which i baed upon mean eld theory, fail to explain the uctation oberved in Figure 6 and 7. Alo it cannot explain extinction of the viru before the teady tate i reached for e ective preading rate above the threhold. We will deal with thee iue in ubequent ection. 5.2 The impact of infection delay We have conducted 500 imulation for each value of the e ective preading rate = on a complete bipartite graph K M;N with fm = 250, N = 750g and for two value of the infection delay " 2 f10; 50g. The number of oberved time unit i Each imulation i tarted with 5 randomly choen infected node. Again the evolution that died out are excluded in calculating the average number of infected node. Figure 9 and 10, where dahed line repreent imulation reult while full line repreent theoretical prediction, how that our approximation Eq. (18) predict the teady tate well for the viru pread with infecton delay.

5 Figure 7: 500 imulation of the viru pread for K 10;990; = 0:45: Figure 5: Number of infected node in the teady tate for K 500;500 Figure 8: Spread around the teady tate for K 10;990 Figure 6: 500 imulation of the viru pread for K 10;990; = 0:15: 6. PROBABILISTIC ANALYSIS In the previou ection it wa hown that the mean eld model ha ome limitation. In thi ection we will model the teady tate of the number of infected node on a complete bi-partite graph K M;N a a tatitical proce uing a pair of interacting continuou Markov chain. The reulting N- intertwined model, wa introduced in [12], where it i applied to network with any given topology. The number of infected node belonging to S 2 at time t i denoted by I(t) and the number of infected node belonging to S 1 at time t by J(t). The probability of a S 2 node being infected i i(t) = I(t) and imilarly for S1 thi probability N equal j(t) = J(t). The arrival of infectiou packet on a M link and the curing proce are conidered to be independent Poion procee with rate and repectively. We will now ue the interactive continuou Markov chain with two tate for the node from S 1 and S 2, a depicted in Figure 11. Similar work ha been done on dicrete time-markov chain by Garetto et al. [5]. Every node i modeled by a continuou Markov chain with two tate X S1 = f0; 1g (X S2 = f0; 1g). We can now write the in niteimal generator Q, for the node of S 1 and S 2 repectively: Q S1 (t) = Q S2 (t) = I(t) J(t) I(t) J(t) The teady tate olution ati e, ee [11]: Q S1 S1 = 0 Q S2 S2 = 0 where the vector S1 and S2 denote the teady tate probabilitie of a node in S 1 or S 2 being in one of two tate:

6 βi(t) βj (t) S δ S2 δ Figure 11: Markov chain for node of S 1 and S 2: Figure 9: Average number of infected node for K 250;750 with infection delay " = 10, excluding viru epidemic that died out. 1 = (MN2 1)((M + N) + 2) (M + N)(M + 1)(N + 1) (21) Thi complie with Eq. ( 11). The epidemic preading i a tochatic proce, and in the teady tate, the ytem i taking a et of value around the mean epidemic teady tate 1, ee alo Figure 3-2. Becaue the teady tate probability of a node being infected doe not depend on other node the teady tate probability Pr[I; J] ati e: Pr[I = x; J = y] = N x! i x 1(1 i 1) N x M y! j y 1(1 j 1) M y (22) Figure 10: Average number of infected node for K 250;750 with infection delay " = 50, excluding viru epidemic that died out. 6.1 Simulation reult for teady tate probability ditribution We conducted imulation for the complete bi-partite graph K M;N with M = 10; N = 990 with the e ective preading rate atifying 2 f0:045; 0:15; 0:5g. Note that the epidemic threhold for thi cae ati e c = 0:0101. We have aumed that the ytem i in teady tate from t = 6000 onward, ee Figure 2. We will now compare the probability ditribution for the number of infected node in teady tate with the probability ditribution given by Eq. (22). In Figure 12 dahed line repreent imulation reult, full line repreent theoretical prediction. Figure 12 alo contain the probabilitie that the viru die out during ytem evolution. S1 = [ Pr[X S1 = 0] Pr[X S1 = 1] ] S2 = [ Pr[X S2 = 0] Pr[X S2 = 1] ] Solving thi ytem of equation, under the condition Pr[X S1 = 0] + Pr[X S1 = 1] = 1, we nd: j 1 = Pr[X S1 = 1] = 2 MN 1 M(N + 1) ; (19) i 1 = Pr[X S2 = 1] = 2 MN 1 N(M + 1) ; We can now nd the mean epidemic teady tate 1 a: 1 = Mj1 + Ni1 M + N Subtituting Eq. (19) in Eq. (20) yield: (20) Figure 12: Probability ditribution of the number of infected node in the teady tate for K 10;990

7 We conclude from the imulation that Eq. (22) predict the probability ditribution of the number of infected node in teady tate very well for large value of the e ective preading rate. For value of jut over the threhold our model i le accurate in predicting the probability ditribution. Thi con rm the tatement made in [12] that the N-intertwined model exhibit the larget deviation around = c. 6.2 Extinction probability In thi ection we etimate the probability p ext that the viru die out before it reache the teady tate. Note that, eventually, every epidemic on a nite population will die out. However, for e ective preading rate above the epidemic threhold, thi will take an extremly long time in general, ee alo [4]. We approximate p ext by the probability that all initially infected node are cured before they infect any other node. We initially infect N 0 node in the larger group of node S 2 (coniting of N node). Then p ext equal the probability that all N 0 node are cured before they infect any of the uceptible M node to which they are attached, ee Figure 13, where full and open circle denote infected and uceptible node, repectively. c H H Figure 13: Complete bi-partite graph K M;N0, with N 0 infected node Let u rt determine the probability p M that one peci c node will be cured before it ha infected any of the uceptible M node, before time T. It i aumed that the infection proce (over a link) and the node curing proce are independent Poion procee with rate and, repectively. Furthermore, let T be a tochat that denote the time it take for a uceptible node to become infected over a link and T denote the time it take for a node to cure. For the latter tochat, let f T (x) denote it correponding probability denity function. Suppoe the infected node i cured at time x, with 0 x T. Thi implie, that for all M uceptible node attached to the infected node, we require T > x. Applying the law of total probability we obtain: N0 p ext = + M (1 e (+M)T ) (23) In order to etimate how well Eq. (23) predict extinction of a viru pread in the rt phae, we have conducted 500 imulation on the complete bi-partite graph K M;N with parameter fm = 10; N = 990; = 0:045g. Figure 14 how the probability of extinction evolving in time for the cae of three initially infected node (N 0 = 3). We conclude that the imulation match the theoretical prediction quite well. Figure 14: Extinction of the viru a a function of time for K 10;990 with = 0:045 for 3 initially infected node. Figure 15 depict p ext for T = 6000 unit, where the number of initially infected node varie between 1 and 8. TR p M = [Pr[T > xjt = x]] M f T (x)dx 0 TR = (e x ) M e x dx = 0 + M (1 e (+M)T ): Becaue the curing procee of the N 0 infected node are independent, in order to obtain p ext, we have to multiply the probabilitie of each of them being cured before they infect other node, which lead to: Figure 15: Extinction of the viru after T = 6000 a a function of number of initially infected node, for K 10;990 with = 0:045.

8 7. CONCLUSION In thi paper we have tudied the pread of virue on the complete bi-partite graph K M;N. Uing element of mean eld theory and Markov chain we have calculated the average number of infected node in the teady tate (Eq. (11)) and con rmed thee reult by mean of imulation. We have alo con rmed previou reult of [4] and [8] about the relation between the epidemic threhold and the larget eigenvalue of the adjacency matrix of the graph over which the viru i preading. In addition the model wa improved by introduction of infection delay. Inpired by imulation reult we have analyzed the probability ditribution of the number of infected node in the teady tate for the cae without infection delay. For the complete bi-partite graph K M;N, our mathematical model (Eq. (22)) i able to predict the probability ditribution very well, in particular for large value of the e ective preading rate. It wa alo hown that the probabilitic analyi and the mean eld theory predict the ame average number of infected node in the teady tate, ee Eq. (21). Additionally we have preented a heuritic for the prediction of the extinction probability in the rt phae of the infection. Simulation how that for the cae without infection delay thi time dependent heuritic i quite accurate. [9] Y. Wang, C. Wang, Modeling the E ect of Timing Parameter on Viru Propagation. ACM Workhop on Rapid Malcode, Wahington, DC, Oct. 27, [10] R. Pator-Satorra and A. Vepignani, Epidemic Spreading in Scale-Free Network, Phyical Review Letter, Vol. 86, No. 14, April, [11] P. Van Mieghem, Performance Analyi of Communication Sytem and Network, Cambridge Univerity Pre, [12] P. Van Mieghem, J.S. Omic and R.E. Kooij, Viru Spread in Network, ubmitted to IEEE Tranaction on Networking. 8. ACKNOWLEDGEMENT Thi reearch wa upported by the Netherland Organization for Scienti c Reearch (NWO) under project number , and by the Next Generation Infratructure programme ( which i partially funded by the Dutch government. 9. REFERENCES [1] N. T. J. Bailey, The Mathematical Theory of Infectiou Dieae and it Application, Charlin Gri n & Company, London, 2nd ed., [2] D.M. Cvetkovic, M. Doob, H. Sach, Spectra of graph, Theory and Application. Johan Ambroiu Barth Verlag, Heidelberg, third edition, [3] D.J. Daley, J. Gani, Epidemic modelling: An Introduction, Cambridge Univerity Pre, [4] A. Ganeh, L. Maoulié and D. Towley, The E ect of Network Topology on the Spread of Epidemic, IEEE INFOCOM2005. [5] M. Garetto, W. Gong, D. Towley, Modeling Malware Spreading Dynamic, IEEE INFOCOM 03, San Francico, CA, April [6] J.O. Kephart, S.R. White, Direct-graph epidemiological model of computer virue, In Proceeding of the 1991 IEEE Computer Society Sympoium on Reearch in Security and Privacy, pp , May [7] A. Shwartz, A. Wei, Large Deviation for Performance Analyi, Chapmann & Hall, London, [8] Y. Wang, D. Chakrabarti, C. Wang, C. Falouto, Epidemic preading in real network: An eigenvalue viewpoint, 22nd Sympoium in Reliable Ditributed Computing, Florence Italy, Oct. 6-8, 2003.