A Delayed Malware Propagation Model Under a Distributed Patching Mechanism: Stability Analysis

Abstract

Antivirus (patch) is one of the most powerful tools for defending against malware spread. Distributed patching is superior to its centralized counterpart in terms of significantly lower bandwidth requirement. Under the distributed patching mechanism, a novel malware propagation model with double delays and double saturation effects is proposed. The basic properties of the model are discussed. A pair of thresholds, i.e., the first threshold $R_0$ and the second threshold $R_1$, are determined. It is shown that (a) the model admits no malware-endemic equilibrium if $R_0\le 1$, (b) the model admits a unique patch-free malware-endemic equilibrium and admits no patch-endemic malware-endemic equilibrium if $1<R_0\le R_1$, and (c) the model admits a unique patch-free malware-endemic equilibrium and a unique patch-endemic malware-endemic equilibrium if $R_0>R_1$. A criterion for the global asymptotic stability of the malware-free equilibrium is given. A pair of criteria for the local asymptotic stability of the patch-free malware-endemic equilibrium are presented. A pair of criteria for the local asymptotic stability of the patch-endemic malware-endemic equilibrium are derived. Using cybersecurity terms, these theoretical outcomes have the following explanations: (a) In the case where the first threshold can be kept below unity, the malware can be eradicated through distributed patching. (b) In the case where the first threshold can only be kept between unity and the second threshold, the patches may fail completely, and the malware cannot be eradicated through distributed patching. (c) In the case where the first threshold cannot be kept below the second threshold, the patches may work permanently, but the malware cannot be eradicated through distributed patching. The influence of the delays and the saturation effects on malware propagation is examined experimentally. The relevant conclusions reveal the way the delays and saturation effects modulate these outcomes.

1. Introduction

Malware, short for malicious software, refers to all types of computer programs performing vicious operations [1]. Digital viruses, worms, Trojan horses, and ransomware are all typical malware. In general, the goal of developing malware is to extort money from computer users. With the rapid increase in the number and variety of malware, the total amount of financial losses suffered across the globe is increasing rapidly every year. For instance, it was reported that, in 2020 alone, the overall ransom paid by the victims of ransomware was over USD 412 million [2]. Consequently, it is crucial to take effective measures to mitigate the negative impact and potential consequence of malware [3].

Antivirus software, short for antivirus, refers to programs designed to detect, prevent, and remove malware [4]. For the purpose of restraining malware spread, a wide spectrum of antiviruses have been developed [4]. In practice, antiviruses must be updated in a timely manner to cope with the constantly changing virus threats [5]. For brevity, antivirus is referred to as patch. There are two types of patching mechanisms: centralized, where a small subset of nodes in a large-sized computer network is responsible for disseminating all patches directly to all other nodes in the network, and distributed, where each patched node is responsible for forwarding the patch to a set of its neighboring nodes according to a well-designed protocol [6,7,8]. Due to the limited bandwidth of the network, the time cost under the centralized mechanism is commonly prohibitive. In contrast, the time cost under the distributed mechanism is acceptable. Consequently, the distributed patching mechanism is preferred in practice.

Inspired by the similarity between malware propagation and epidemic spread [9], Kephart and White [10,11] introduced the earliest malware propagation models. From then on, the modeling and analysis of malware propagation have become a hotspot in research [12,13,14,15,16,17,18,19,20,21]. In particular, under the distributed patch dissemination mechanism, a pair of different malware propagation models, which are referred to as the susceptible-infected-patched (SIPS) models, have been suggested [22,23]. The model given in [22] is population-based, whereas the model presented in [23] is individual-based.

Time delay is a universal phenomenon that exists in various aspects of life such as signal transmission, physical processes, and physiological responses. In the process of malware spreading, there exists a time delay. First, malware needs time to scan and identify vulnerable targets. Second, after finding a target, it takes time to establish a connection and initiate the infection process. Thirdly, the propagation speed is affected by the network conditions. Additionally, the patch may detect and resist the malware, which causes a delay in the successful spread of the malware. For the purpose of understanding the delay mechanism of malware propagation and thereby developing an effective malware-containing scheme, many delayed malware propagation models have been proposed. Among these models, some have single delay [24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44], some have double delay [45,46,47,48,49,50,51,52,53,54,55,56], and the remainder have triple delay [57].

All existing delayed malware propagation models contain a malware infection rate. In most of these models, the infection rate is assumed to be bilinear [24,25,26,27,28,29,30,31,33,35,36,37,38,41,43,44,45,46,47,48,49,50,51,52,54,55,56,57]. In practice, the bilinear malware infection rate significantly overestimates the true infection rate for three main reasons: (1) The bilinear infection rate assumes the infection risk rises linearly with the numbers of susceptible and infected nodes. However, real-world users commonly deploy antivirus software, firewalls, or security patches, disrupting this linearity. (2) The bilinear infection rate assumes uniform network connectivity, implying all nodes interact freely. In reality, networks are segmented or isolated, which limits malware spread. (3) The bilinear infection rate oversimplifies infection pathways, resulting in inflated estimates of actual malware spread. For the purpose of accurately estimating the infection rate, some delayed malware propagation models with a lower infection rate have been proposed. To name a few examples, refs. [32,39,53] proposed Beddington–DeAngelis-type infection rates [58,59], refs. [40,42] suggested Monod–Haldane-type infection rates [60,61], and ref. [34] suggested a more general infection rate. The Holling type II infection rate [62,63,64], which captures the saturation effect of infection, has gained wide recognition in some areas, such as delayed rumor spreading [65]. To our knowledge, the Holling type II infection rate has not been applied to the modeling of delayed malware spreading. In practice, this type of infection rate may be used to model some saturation phenomena occurring in malware spread, such as the saturation effect of network scanning capabilities.

Under the distributed patching mechanism, there are a pair of known (delay-free) SIPS models [22,23]. In these models, the recovery rate is assumed to be bilinear. In practice, the bilinear malware recovery rate significantly overestimates the real recovery rate for two reasons: (1) The bilinear recovery rate assumes the likelihood of recovery rises linearly with the number of infected and patched nodes. However, the assumption does not account for some factors like the appearance of new malware variants or the resistance of some malware to removal tools, which makes actual recovery more difficult than the bilinear recovery rate predicts. (2) The bilinear recovery rate does not fully consider the risk of reinfection or hidden malware components that evade detection. These real-world challenges imply the actual recovery rate is lower than the estimation of the bilinear recovery rate, leading to overestimation of effectiveness. In practice, the Holling type II recovery rate may be used to model some saturation phenomena occurring in malware recovery, such as the saturation effect of the limited bandwidth or the forwarding capacity of patches.

Based on the previous discussions, a novel SIPS malware propagation model is proposed. In this model, a pair of time delays are taken into account, where the infection delay accounts for the latency for susceptible nodes to become infected, while the recovery delay accounts for the latency for infected nodes to be patched. Furthermore, in this model, a pair of Holling type II rates are taken into consideration, where the malware infection rate accounts for the saturation effect of malware spread, while the malware recovery rate accounts for the saturation effect of malware recovery. In our opinion, this specific combination of double delay and double Holling II is particularly relevant for modeling modern, complex computer networks because both the delays and the Holling II type saturation functions have clear physical explanations and may be used as basic components of a more complex network defense mechanism. In practice, the Holling II type is not necessarily the optimal choice over others for modeling distributed patch dissemination. Furthermore, the optimality itself is vague. Nevertheless, the Holling II type is superior to the bilinear assumption.

The subsequent materials are organized in this fashion: Section 2 formulates the delayed malware propagation model and reveals its basic properties. Section 3 determines a pair of thresholds, i.e., the first threshold $R_0$ and the second threshold $R_1$, and shows that (a) the model admits no malware-endemic equilibrium if $R_0\le 1$, (b) the model admits a unique patch-free malware-endemic equilibrium and admits no patch-endemic malware-endemic equilibrium if $1<R_0\le R_1$, and (c) the model admits a unique patch-free malware-endemic equilibrium and a unique patch-endemic malware-endemic equilibrium if $R_0>R_1$. Section 4 reports a criterion for the global asymptotic stability of the malware-free equilibrium. Section 5 provides a pair of criteria for the local asymptotic stability of the patch-free malware-endemic equilibrium. Section 6 presents a pair of criteria for the local asymptotic stability of the patch-endemic malware-endemic equilibrium. Section 7 validates these results. Using cybersecurity terms, the theoretical findings can be explained as follows. (a) In the case where the first threshold can be kept below unity, the malware can be eradicated through distributed patching. (b) In the case where the first threshold can only be kept between unity and the second threshold, the patches may fail completely, and the malware cannot be eradicated through distributed patching. (c) In the case where the first threshold cannot be kept below the second threshold, the patches may work permanently, but the malware cannot be eradicated through distributed patching. The influence of the delays and the saturation effects on malware propagation are inspected through simulation experiments. The relevant conclusions reveal how the delays and saturation effects modulate these outcomes. This work is summarized in Section 9.

2. Delayed Malware Propagation Model

This section is devoted to establishing a delayed malware propagation model. First, a 3D model is introduced. Second, the model is reduced to a 2D model. Finally, the basic properties of the reduced model are presented.

2.1. A 3D Model

Consider a fully interconnected computer network. All nodes in the world are divided into two classes: the internal nodes, i.e., the nodes inside the network, and external nodes, i.e., the nodes outside the network. Suppose the network is open to the world, i.e., all nodes in the world can freely enter or leave the network.

Suppose each internal node is either susceptible, i.e., not infected with malware and not updated with the newest patch, or infected, i.e., infected with malware, and patched, i.e., not infected with malware and updated with the newest patch. Additionally, assume all external nodes are susceptible. The following notions, terminologies, and assumptions are introduced:

($A_1$)

Let $S\left(t\right)$, $I\left(t\right)$, and $P\left(t\right)$ denote the number of susceptible, infected, and patched internal nodes at time t, respectively.

($A_2$)

External nodes enter the network at a constant rate $\mu >0$. In what follows, $\mu$ is referred to as the inflow rate.

($A_3$)

Each internal node leaves the network at a constant rate $\delta >0$. In what follows, $\delta$ is referred to as the outflow rate.

($A_4$)

Due to contact with infected nodes, susceptible internal nodes become infected at time t at rate ${\displaystyle \frac{\beta S(t-{\tau }_1)I(t-{\tau }_1)}{1+{\sigma }_{1}I(t-{\tau }_1)}}$, where $\beta >0$, ${\sigma }_1>0$, and ${\tau }_1\ge 0$ are constants. In what follows, $\beta$ is referred to as the infection force, ${\sigma }_1$ as the infection coefficient, and ${\tau }_1$ as the infection delay.

($A_5$)

Due to contact with patched nodes, infected nodes get patched at time t at rate ${\displaystyle \frac{\gamma I(t-{\tau }_2)P(t-{\tau }_2)}{1+{\sigma }_{2}P(t-{\tau }_2)}}$, where $\gamma >0$, ${\sigma }_2>0$, and ${\tau }_2\ge 0$ are constants. In what follows, $\gamma$ is referred to as the recovery force, ${\sigma }_2$ as the recovery coefficient, and ${\tau }_2$ as the recovery delay.

($A_6$)

Due to patch failure, each patched node becomes susceptible at a constant rate $\alpha >0$. In what follows, and $\alpha$ is referred to as the failure rate.

($A_7$)

Let $\tau =\max ({\tau }_1,{\tau }_2)$. In what follows $\tau$ is referred to as the maximum delay.

($A_8$)

Let $S\left(\theta \right)={\varphi }_0\left(\theta \right),I\left(\theta \right)={\varphi }_1\left(\theta \right),P\left(\theta \right)={\varphi }_2\left(\theta \right),-\tau \le \theta \le 0$, denote the initial condition. Here, ${\varphi }_0$, ${\varphi }_1$, and ${\varphi }_2$ are non-negative continuous functions.

($A_9$)

Due to malware propagation, assume $S\left(0\right)>0$, $I\left(0\right)>0$, $P\left(0\right)>0$.

On this basis, a 3D delayed malware propagation model takes shape, which is formulated below.

$$\left\{\begin{array}{cc}\hfill {\displaystyle \frac{dS\left(t\right)}{dt}}& =\mu -{\displaystyle \frac{\beta S(t-{\tau }_1)I(t-{\tau }_1)}{1+{\sigma }_{1}I(t-{\tau }_1)}}+\alpha P\left(t\right)-\delta S\left(t\right),\hfill \\ \hfill {\displaystyle \frac{dI\left(t\right)}{dt}}& ={\displaystyle \frac{\beta S(t-{\tau }_1)I(t-{\tau }_1)}{1+{\sigma }_{1}I(t-{\tau }_1)}}-{\displaystyle \frac{\gamma I(t-{\tau }_2)P(t-{\tau }_2)}{1+{\sigma }_{2}P(t-{\tau }_2)}}-\delta I\left(t\right),\hfill \\ \hfill {\displaystyle \frac{dP\left(t\right)}{dt}}& ={\displaystyle \frac{\gamma I(t-{\tau }_2)P(t-{\tau }_2)}{1+{\sigma }_{2}P(t-{\tau }_2)}}-\alpha P\left(t\right)-\delta P\left(t\right),\hfill \\ \hfill & t\ge 0,\hfill \\ \hfill S\left(\theta \right)& ={\varphi }_0\left(\theta \right),I\left(\theta \right)={\varphi }_1\left(\theta \right),P\left(\theta \right)={\varphi }_2\left(\theta \right),-\tau \le \theta \le 0.\hfill \end{array}\right.$$

(1)

2.2. The Reduced 2D Model

Let $N\left(t\right)=S\left(t\right)+I\left(t\right)+R\left(t\right)$. Then, ${\lim }_{t\to +\infty }N\left(t\right)={\displaystyle \frac{\mu }{\delta }}$. Hence, the plane $S+I+R={\displaystyle \frac{\mu }{\delta }}$ is an invariant manifold of model (1) that is attracting in the first octant. It follows by [66,67] that model (1) can be reduced to a 2D delayed malware propagation model, which is formulated below.

$$\left\{\begin{array}{cc}\hfill {\displaystyle \frac{dI\left(t\right)}{dt}}& =f_1(I\left(t\right),I(t-{\tau }_1),I(t-{\tau }_2),P(t-{\tau }_1),P(t-{\tau }_2))\hfill \\ \hfill & ={\displaystyle \frac{\beta \left[\frac{\mu }{\delta }-I(t-{\tau }_1)-P(t-{\tau }_1)\right]I(t-{\tau }_1)}{1+{\sigma }_{1}I(t-{\tau }_1)}}\hfill \\ \hfill & -{\displaystyle \frac{\gamma I(t-{\tau }_2)P(t-{\tau }_2)}{1+{\sigma }_{2}P(t-{\tau }_2)}}-\delta I\left(t\right),t\ge 0,\hfill \\ \hfill {\displaystyle \frac{dP\left(t\right)}{dt}}& =f_2(I(t-{\tau }_2),P\left(t\right),P(t-{\tau }_2))\hfill \\ \hfill & ={\displaystyle \frac{\gamma I(t-{\tau }_2)P(t-{\tau }_2)}{1+{\sigma }_{2}P(t-{\tau }_2)}}-\alpha P\left(t\right)-\delta P\left(t\right),t\ge 0,\hfill \\ \hfill I\left(\theta \right)& ={\varphi }_1\left(\theta \right),P\left(\theta \right)={\varphi }_2\left(\theta \right),-\tau \le \theta \le 0.\hfill \end{array}\right.$$

(2)

In what follows, model (2) is referred to as the delayed SIPS model.

Remark 1.

As the total node population $N\left(t\right)=S\left(t\right)+I\left(t\right)+R\left(t\right)$ approaches a stable equilibrium at $\mu /\delta$, the dynamics can be studied on this attracting manifold, allowing the system to be reduced from three to two independent variables.

2.3. Basic Properties of the Delayed SIPS Model

In this subsection, the basic properties of the solution to model (2), including the existence, uniqueness, positivity, boundedness, and extendability, are examined.

First, the existence and uniqueness are examined. It is easily verified that functions $f_1$ and $f_2$ are continuous and locally Lipschitz. By the existence and uniqueness theorem for the solution to the retarded functional differential equation [68], there exists $T>0$ such that model (2) admits a unique solution on the time interval $[0,T]$.

Second, the positivity is considered.

Lemma 1.

Let $\left(I\right(t),P(t\left)\right)$, $t\ge 0$, be a solution to model (2). Then,

$$I\left(t\right)>0,P\left(t\right)>0,t\ge 0.$$

(3)

Proof of Lemma 1.

On the contrary, suppose the assertion does not hold. Then, there is $t^{\ast }>0$ such that (a) either $I\left(t^{\ast }\right)=0$ or $P\left(t^{\ast }\right)=0$, (b) $I\left(t\right)>0$, $P\left(t\right)>0$, $0\le t<t^{\ast }$. Without loss of generality, assume $I\left(t^{\ast }\right)=0$. Let

$$\begin{array}{cc}\hfill & g(I\left(t\right),I(t-{\tau }_1),I(t-{\tau }_2),P(t-{\tau }_1),P(t-{\tau }_2)))\hfill \\ \hfill & ={\displaystyle \frac{f_1(I\left(t\right),I(t-{\tau }_1),I(t-{\tau }_2),P(t-{\tau }_1),P(t-{\tau }_2))}{I\left(t\right)}},0\le t<t_1.\hfill \end{array}$$

(4)

It follows from model (2) that

$${\displaystyle \frac{dI\left(t\right)}{dt}}=I\left(t\right)g(I\left(t\right),I(t-{\tau }_1),I(t-{\tau }_2),P(t-{\tau }_1),P(t-{\tau }_2))),0\le t<t^{\ast }.$$

(5)

Thus,

$$\begin{array}{cc}\hfill I\left(t\right)& =I\left(0\right)\exp \left({\int }_0^{t}g(I\left(s\right),I(s-{\tau }_1),I(s-{\tau }_2),P(s-{\tau }_1),P(s-{\tau }_2)))ds\right),\hfill \\ \hfill & 0\le t<t^{\ast }.\hfill \end{array}$$

(6)

The continuity of $I\left(t\right)$ on $[0,t^{\ast })$ implies there exists $ϵ>0$ such that

$$I\left(t\right)\ge I\left(0\right)\exp (-ϵ),0\le t<t^{\ast }.$$

(7)

So,

$$I\left(t^{\ast }\right)=\underset{t\to t^{\ast }-0}{\lim }I\left(t\right)\ge I\left(0\right)\exp (-ϵ).$$

(8)

The condition of $I\left(0\right)>0$ leads to $I\left(t^{\ast }\right)>0$. A contradiction occurs. Hence, $I\left(t\right)>0$, $t>0$. The argument for $R\left(t\right)>0$ is analogous. □

Next, consider the boundedness. It is easily verified that

$$S\left(t\right)+I\left(t\right)+R\left(t\right)\le \max \left({\displaystyle \frac{\mu }{\delta }},S\left(0\right)+I\left(0\right)+R\left(0\right)\right),t\ge 0.$$

(9)

This plus Lemma 1 leads to the boundedness of the solution to model (2).

Finally, consider the extendability. It follows by [68] and the boundedness of the solution to model (2) that the solution is extendable to $[0,+\infty )$.

2.4. Basic Reproduction Number for the Delayed SIPS Model

Now, consider the basic reproduction number for the SIPS model.

Theorem 1.

The basic reproduction number for model (2) equals

$$R_0={\displaystyle \frac{\beta \mu }{{\delta }^2}}.$$

(10)

Proof of Theorem 1.

Let

$$F(I(t-{\tau }_1),P(t-{\tau }_1))={\displaystyle \frac{\beta \left[\frac{\mu }{\delta }-I(t-{\tau }_1)-P(t-{\tau }_1)\right]I(t-{\tau }_1)}{1+{\sigma }_{1}I(t-{\tau }_1)}},$$

(11)

$$V(I\left(t\right),I(t-{\tau }_2),P(t-{\tau }_2))={\displaystyle \frac{\gamma I(t-{\tau }_2)P(t-{\tau }_2)}{1+{\sigma }_{2}P(t-{\tau }_2)}}+\delta I\left(t\right).$$

(12)

Then,

$${\displaystyle \frac{\partial F(I(t-{\tau }_1),P(t-{\tau }_1))}{\partial I(t-{\tau }_1)}}{|}_{(0,0)}={\displaystyle \frac{\beta \mu }{\delta }},$$

(13)

$${\displaystyle \frac{\partial V(I\left(t\right),I(t-{\tau }_2),P(t-{\tau }_2))}{\partial I\left(t\right)}}{|}_{(0,0,0)}=\delta ,$$

(14)

$${\displaystyle \frac{\partial V(I\left(t\right),I(t-{\tau }_2),P(t-{\tau }_2))}{\partial I(t-{\tau }_2)}}{|}_{(0,0,0)}=0,$$

(15)

It follows by applying the next-generation matrix method [69,70] that the basic reproduction number for model (2) equals $R_0={\displaystyle \frac{\beta \mu }{{\delta }^2}}$. □

In what follows, $R_0$ is referred to as the first threshold for model (2).

3. Malware-Endemic Equilibrium

It is easily verified that, in all cases, model (2) admits a unique malware-free equilibrium, $E_0=(0,0)$. Now, consider two types of malware-endemic equilibria: the patch-free malware-endemic equilibria, i.e., the malware-endemic equilibria with zero P component, and the patch-endemic malware-endemic equilibria, i.e., the malware-endemic equilibrium with positive P component.

First, consider the patch-free malware-endemic equilibrium.

Theorem 2.

Model (2) admits a patch-free malware-endemic equilibrium, $E_1=(I_1^{\ast },0)$, if, and only if, the following two conditions are met:

(C1) 

$R_0>1$.

(C2) 

$I_1^{\ast }={\displaystyle \frac{\delta (R_0-1)}{\beta +\delta {\sigma }_1}}$.

Proof of Theorem 2.

Necessity. Suppose model (2) admits a patch-free malware-endemic equilibrium, $E_1=(I_1^{\ast },0)$. It follows from the definition of a patch-free malware-endemic equilibrium that $I_1^{\ast }>0$ and

$${\displaystyle \frac{\beta (\frac{\mu }{\delta }-I_1^{\ast })}{1+{\sigma }_1{I}_1^{\ast }}}-\delta =0.$$

(16)

So,

$$I_1^{\ast }={\displaystyle \frac{\frac{\beta \mu }{\delta }-\delta }{\beta +\delta {\sigma }_1}}={\displaystyle \frac{\delta (R_0-1)}{\beta +\delta {\sigma }_1}}.$$

(17)

Hence, $R_0>1$.

Sufficiency. Suppose $R_0>1$, $I_1^{\ast }={\displaystyle \frac{\delta (R_0-1)}{\beta +\delta {\sigma }_1}}$. Then, $I_1^{\ast }>0$, Equation (17) holds. It is easily verified that $E_1=(I_1^{\ast },0)$ is a patch-free malware-endemic equilibrium of model (2). □

Second, consider the patch-endemic malware-endemic equilibrium. For this purpose, let

$$a_1={\displaystyle \frac{-(\alpha +\delta )\left(\beta +\alpha {\sigma }_1+\delta {\sigma }_1+\frac{\beta \mu {\sigma }_2}{\delta }-\delta {\sigma }_2-\gamma \right)}{(\beta {\sigma }_2+\gamma {\sigma }_1+\delta {\sigma }_1{\sigma }_2)(\alpha +\delta )+\beta \gamma }},$$

(18)

$$a_2={\displaystyle \frac{-{(\alpha +\delta )}^2}{(\beta {\sigma }_2+\gamma {\sigma }_1+\delta {\sigma }_1{\sigma }_2)(\alpha +\delta )+\beta \gamma }}<0.$$

(19)

Theorem 3.

Model (2) admits a patch-endemic malware-endemic equilibrium, $E_2=(I_2^{\ast },P_2^{\ast })$, if, and only if, the following two conditions are met:

(C1) 

$I_2^{\ast }={\displaystyle \frac{\sqrt{a_1^2-4a_2}-a_1}{2}}>{\displaystyle \frac{\alpha +\delta }{\gamma }}$.

(C2) 

$P_2^{\ast }={\displaystyle \frac{\gamma I_2^{\ast }-(\alpha +\delta )}{(\alpha +\delta ){\sigma }_2}}$.

Proof of Theorem 3.

Necessity. Suppose model (2) admits a patch-endemic malware-endemic equilibrium, $E_2=(I_2^{\ast },P_2^{\ast })$. It follows by the definition of the patch-endemic malware-endemic equilibrium that $I_2^{\ast }>0$, $P_2^{\ast }>0$,

$${\displaystyle \frac{\beta (\frac{\mu }{\delta }-I_2^{\ast }-P_2^{\ast })}{1+{\sigma }_1{I}_2^{\ast }}}-{\displaystyle \frac{\gamma P_2^{\ast }}{1+{\sigma }_2{P}_2^{\ast }}}-\delta =0,$$

(20)

and

$${\displaystyle \frac{\gamma I_2^{\ast }}{1+{\sigma }_2{P}_2^{\ast }}}-\alpha -\delta =0.$$

(21)

Equation (20) is reduced to

$$\begin{array}{cc}\hfill & \left({\displaystyle \frac{\beta \mu }{\delta }}-\delta \right)-(\beta +\delta {\sigma }_1)I_2^{\ast }-\left(\beta +\gamma +\delta {\sigma }_2-{\displaystyle \frac{\beta \mu {\sigma }_2}{\delta }}\right)P_2^{\ast }-(\beta {\sigma }_2+\gamma {\sigma }_1+\delta {\sigma }_1{\sigma }_2)I_2^{\ast }{P}_2^{\ast }\hfill \\ \hfill & -\beta {\sigma }_2{P}_2^{\ast 2}=0.\hfill \end{array}$$

(22)

Solving Equation (21) for $P_2^{\ast }$ leads to

$$P_2^{\ast }={\displaystyle \frac{\gamma I_2^{\ast }-(\alpha +\delta )}{(\alpha +\delta ){\sigma }_2}}.$$

(23)

Hence, $I_2^{\ast }>{\displaystyle \frac{\alpha +\delta }{\gamma }}$.

Substituting Equation (23) into Equation (22) yields

$$\begin{array}{cc}\hfill & \left({\displaystyle \frac{\beta \mu }{\delta }}-\delta \right)-(\beta +\delta {\sigma }_1)I_2^{\ast }-\left(\beta +\gamma +\delta {\sigma }_2-{\displaystyle \frac{\beta \mu {\sigma }_2}{\delta }}\right)\times {\displaystyle \frac{\gamma I_2^{\ast }-(\alpha +\delta )}{(\alpha +\delta ){\sigma }_2}}\hfill \\ \hfill & -(\beta {\sigma }_2+\gamma {\sigma }_1+\delta {\sigma }_1{\sigma }_2)I_2^{\ast }\times {\displaystyle \frac{\gamma I_2^{\ast }-(\alpha +\delta )}{(\alpha +\delta ){\sigma }_2}}-\beta {\sigma }_2\times {\left[{\displaystyle \frac{\gamma I_2^{\ast }-(\alpha +\delta )}{(\alpha +\delta ){\sigma }_2}}\right]}^2=0.\hfill \end{array}$$

(24)

So,

$$\begin{array}{cc}\hfill & \left({\displaystyle \frac{\beta \mu }{\delta }}-\delta \right){(\alpha +\delta )}^2{\sigma }_2^2-(\beta +\delta {\sigma }_1){(\alpha +\delta )}^2{\sigma }_2^2{I}_2^{\ast }\hfill \\ \hfill & -\left(\beta +\gamma +\delta {\sigma }_2-{\displaystyle \frac{\beta \mu {\sigma }_2}{\delta }}\right)(\alpha +\delta ){\sigma }_2[\gamma I_2^{\ast }-(\alpha +\delta )]\hfill \\ \hfill & -(\beta {\sigma }_2+\gamma {\sigma }_1+\delta {\sigma }_1{\sigma }_2)(\alpha +\delta ){\sigma }_2{I}_2^{\ast }[\gamma I_2^{\ast }-(\alpha +\delta )]\hfill \\ \hfill & -\beta {\sigma }_2[{\gamma }^2{I}_2^{\ast 2}-2\gamma (\alpha +\delta )I_2^{\ast }+{(\alpha +\delta )}^2]=0.\hfill \end{array}$$

(25)

Treating Equation (25) as an equation in $I_2^{\ast }$ and combining like terms lead to

$$\begin{array}{cc}\hfill & {(\alpha +\delta )}^2\gamma {\sigma }_2+(\alpha +\delta )\gamma {\sigma }_2\left[\beta +\alpha {\sigma }_1+\delta {\sigma }_1+{\displaystyle \frac{\beta \mu {\sigma }_2}{\delta }}-\delta {\sigma }_2-\gamma \right]I_2^{\ast }\hfill \\ \hfill & -\gamma {\sigma }_2\left[(\beta {\sigma }_2+\gamma {\sigma }_1+\delta {\sigma }_1{\sigma }_2)(\alpha +\delta )+\beta \gamma \right]I_2^{\ast 2}=0.\hfill \end{array}$$

(26)

Hence,

$$I_2^{\ast 2}+a_1{I}_2^{\ast }+a_2=0.$$

(27)

In view of $a_2<0$, it follows that

$$I_2^{\ast }={\displaystyle \frac{\sqrt{a_1^2-4a_2}-a_1}{2}}.$$

(28)

The necessity is proved.

Sufficiency. Suppose conditions (C1)–(C2) hold. First, it is easily verified that $I^{\ast }>0$, $P^{\ast }>0$. Second, Equation (21) follows from condition (C2). Finally, Equations (27), (26), (25), (24), (22), and (20) follow from conditions (C1)–(C2). Hence, $(I_2^{\ast },P_2^{\ast })$ is a patch-endemic malware-endemic equilibrium of model (2). The sufficiency is proved. □

For our purpose, let

$$M_1={\displaystyle \frac{\delta (2\alpha \beta {\sigma }_2+\alpha \gamma {\sigma }_1+2\alpha \delta {\sigma }_1{\sigma }_2+2\beta \delta {\sigma }_2+\gamma \delta {\sigma }_1+2{\delta }^2{\sigma }_1{\sigma }_2+\beta \gamma +\gamma \delta {\sigma }_2+{\gamma }^2)}{\beta \gamma {\sigma }_2}}>0,$$

(29)

$$M_2={\displaystyle \frac{\delta (\gamma \delta +\alpha \beta +\alpha \delta {\sigma }_1+\beta \delta +{\delta }^2{\sigma }_1)}{\beta \gamma }}>0.$$

(30)

Lemma 2.

Suppose $\mu \ge M_1$. Then, model (2) admits a unique patch-endemic malware-endemic equilibrium, $E_2=(I_2^{\ast },P_2^{\ast })$, $I_2^{\ast }={\displaystyle \frac{\sqrt{a_1^2-4a_2}-a_1}{2}}$, $P_2^{\ast }={\displaystyle \frac{\gamma I_2^{\ast }-(\alpha +\delta )}{(\alpha +\delta ){\sigma }_2}}$.

Proof of Lemma 2.

It follows by straightforward calculations that $\mu \ge M_1$ is equivalent to

$$a_1+{\displaystyle \frac{2(\alpha +\delta )}{\gamma }}\le 0.$$

(31)

So,

$$\sqrt{a_1^2-4a_2}>0\ge a_1+{\displaystyle \frac{2(\alpha +\delta )}{\gamma }}.$$

(32)

Hence,

$${\displaystyle \frac{\sqrt{a_1^2-4a_2}-a_1}{2}}>{\displaystyle \frac{\alpha +\delta }{\gamma }}.$$

(33)

The assertion follows from Theorem 3. □

Lemma 3.

Suppose $M_2<\mu <M_1$. Then, model (2) admits a unique patch-endemic malware-endemic equilibrium, $E_2=(I_2^{\ast },P_2^{\ast })$, $I_2^{\ast }={\displaystyle \frac{\sqrt{a_1^2-4a_2}-a_1}{2}}$, $P_2^{\ast }={\displaystyle \frac{\gamma I^{\ast }-(\alpha +\delta )}{(\alpha +\delta ){\sigma }_2}}$.

Proof of Lemma 3.

It follows by straightforward calculations that (a) $\mu <M_1$ is equivalent to

$$a_1+{\displaystyle \frac{2(\alpha +\delta )}{\gamma }}>0$$

(34)

and that (b) $\mu >M_2$ is equivalent to

$$a_1^2-4a_2>{\left[a_1+{\displaystyle \frac{2(\alpha +\delta )}{\gamma }}\right]}^2.$$

(35)

Hence,

$${\displaystyle \frac{\sqrt{a_1^2-4a_2}-a_1}{2}}>{\displaystyle \frac{\alpha +\delta }{\gamma }}.$$

(36)

The assertion follows from Theorem 3. □

Lemma 4.

Suppose $\mu \le M_2$. Then, model (2) admits no patch-endemic malware-endemic equilibrium.

Proof of Lemma 4.

It follows by straightforward calculations that $\mu \le M_2$ is equivalent to

$$a_1^2-4a_2\le {\left[a_1+{\displaystyle \frac{2(\alpha +\delta )}{\gamma }}\right]}^2.$$

(37)

Hence,

$${\displaystyle \frac{\sqrt{a_1^2-4a_2}-a_1}{2}}\le {\displaystyle \frac{\alpha +\delta }{\gamma }}.$$

(38)

The assertion follows from Theorem 3. □

Let

$$R_1=1+{\displaystyle \frac{(\alpha +\delta )(\beta +\delta {\sigma }_1)}{\gamma \delta }}>1.$$

(39)

In what follows, $R_1$ is referred to as the second threshold for model (2).

Theorem 4.

The following assertions hold.

(A1) 

Suppose $R_0\le R_1$. Then, model (2) admits no patch-endemic malware-endemic equilibrium.

(A2) 

Suppose $R_0>R_1$. Then, model (2) admits a unique patch-endemic malware-endemic equilibrium, $E_2=(I_2^{\ast },P_2^{\ast })$, $I_2^{\ast }={\displaystyle \frac{\sqrt{a_1^2-4a_2}-a_1}{2}}$, $P_2^{\ast }={\displaystyle \frac{\gamma I_2^{\ast }-(\alpha +\delta )}{(\alpha +\delta ){\sigma }_2}}$.

Proof of Theorem 4.

The assertions follow by combining Theorem 3 with Lemmas 2–4. □

By combining Theorem 2 with Theorem 4, the following interesting conclusions are drawn.

(a)

In the case where $R_0\le 1$, model (2) admits no malware-endemic equilibrium.

(b)

In the case where $1<R_0\le R_1$, model (2) admits a unique patch-free malware-endemic equilibrium and admits no patch-endemic malware-endemic equilibrium. This result reveals that if network parameters result in $1<R_0\le R_1$, the distributed patching process is unsustainable.

(c)

In the case where $R_0>R_1$, model (2) admits a unique patch-free malware-endemic equilibrium and admits a unique patch-endemic malware-endemic equilibrium. This result reveals that if network parameters result in $R_0>R_1$, the distributed patching process is sustainable.

Example 1.

Consider model (2) with $\mu =100$, $\delta =2$, $\alpha =1$, $\beta =0.01$, $\gamma =1$, ${\sigma }_1=0.1$, and ${\sigma }_2=0.1$. Then, $R_0=0.25$. So, $R_0<1$. It follows from Theorems 2 and 4 that model (2) admits no malware-endemic equilibrium.

Example 2.

Consider model (2) with $\mu =300$, $\delta =2$, $\alpha =2$, $\beta =0.05$, $\gamma =1$, ${\sigma }_1=1$, and ${\sigma }_2=0.1$. Then, $R_0=3.75$, $R_1=5.10$. So, $1<R_0<R_1$. It follows from Theorems 2 and 4 that model (2) admits a unique patch-free malware-endemic equilibrium, $(2.68,0)$ and admits no patch-endemic malware-endemic equilibrium.

Example 3.

Consider model (2) with $\mu =100$, $\delta =2$, $\alpha =1$, $\beta =1$, $\gamma =1$, ${\sigma }_1=0.1$, and ${\sigma }_2=0.1$. Then, $R_0=25$, $R_1=2.80$. So, $R_0>R_1$. It follows from Theorems 2 and 4 that model (2) admits a unique patch-free malware-endemic equilibrium, $(40,0)$, and admits a unique patch-endemic malware-endemic equilibrium, $(9.77,22.57)$.

4. Dynamics of the Malware-Free Equilibrium

This section examines the asymptotic stability of the malware-free equilibrium of model (2).

4.1. Local Asymptotic Stability

It follows by [68] that the linearized system of model (2) at $E_0=(0,0)$ is

$$\left\{\begin{array}{cc}\hfill {\displaystyle \frac{dx\left(t\right)}{dt}}& =-\delta x\left(t\right)+{\displaystyle \frac{\beta \mu }{\delta }}x(t-{\tau }_1),t\ge 0,\hfill \\ \hfill {\displaystyle \frac{dy\left(t\right)}{dt}}& =-(\alpha +\delta )y\left(t\right),t\ge 0,\hfill \\ \hfill x\left(\theta \right)& ={\varphi }_1\left(\theta \right),y\left(\theta \right)={\varphi }_2\left(\theta \right),-\tau \le \theta \le 0.\hfill \end{array}\right.$$

(40)

The associated characteristic equation is

$$(\lambda +\alpha +\delta )\left(\lambda +\delta -{\displaystyle \frac{\beta \mu }{\delta }}{e}^{-\lambda {\tau }_1}\right)=0.$$

(41)

Let

$$P\left(\lambda \right)=\lambda +\delta -{\displaystyle \frac{\beta \mu }{\delta }}{e}^{-\lambda {\tau }_1}.$$

(42)

Theorem 5.

The following assertions hold.

(A1) 

Suppose $R_0<1$. Then, $E_0$ is locally asymptotically stable.

(A2) 

Suppose $R_0>1$. Then, $E_0$ is unstable.

Proof of Theorem 5.

Equation (41) admits the negative root ${\lambda }_1=-(\alpha +\delta )$.

In the case where $R_0<1$, it follows that $P\left(0\right)=\delta -{\displaystyle \frac{\beta \mu }{\delta }}>0$ and $P(+\infty )=+\infty$. For $\lambda >0$, it follows that

$$P^{\prime }\left(\lambda \right)=\delta +{\displaystyle \frac{\beta \mu {\tau }_1}{\delta }}{e}^{-\lambda {\tau }_1}>0.$$

(43)

So, $P\left(\lambda \right)$ admits no non-negative zero. Now, suppose $P\left(\lambda \right)$ admits a complex zero with a non-negative real part. Then, $P\left(\lambda \right)$ must admit a pair of conjugate purely imaginary zeros, $\pm i\omega$ ($\omega >0$) [71]. This implies

$$P\left(i\omega \right)=i\omega +\delta -{\displaystyle \frac{\beta \mu }{\delta }}{e}^{-i\omega {\tau }_1}=0.$$

(44)

Now, let us utilize the technique developed in [72]. By separating the real and imaginary parts, it follows that

$$\left\{\begin{array}{cc}\hfill {\displaystyle \frac{\beta \mu }{\delta }}\cos \left(\omega {\tau }_1\right)& =\delta ,\hfill \\ \hfill {\displaystyle \frac{\beta \mu }{\delta }}\sin \left(\omega {\tau }_1\right)& =-\omega .\hfill \end{array}\right.$$

(45)

Taking the square on the two equations and summing up, it follows that

$${\displaystyle \frac{{\beta }^2{\mu }^2}{{\delta }^2}}={\delta }^2+{\omega }^2.$$

(46)

So,

$${\omega }^2={\displaystyle \frac{{\beta }^2{\mu }^2}{{\delta }^2}}-{\delta }^2={\displaystyle \frac{1}{{\delta }^4}}(R_0^2-1)>0.$$

(47)

Hence, $R_0>1$. This is a contradiction. Hence, $P\left(\lambda \right)$ admits no complex zero with a non-negative real part. It follows from the Lyapunov stability theorem [73] that $E_0$ is locally asymptotically stable.

In the case where $R_0>1$, it follows that $P\left(0\right)=({\gamma }_1+\delta )(1-R_0)<0$ and $P(+\infty )=+\infty$. In view of the continuity of $P\left(\lambda \right)$, it follows that $P\left(\lambda \right)$ admits a positive zero. Hence, $E_0$ is unstable [73]. □

4.2. Global Asymptotic Stability

Now, consider the global asymptotic stability of the rumor-free equilibrium. First, the global attractivity is examined.

Lemma 5.

Suppose $R_0<1$. Then, the malware-free equilibrium is globally attracting.

Proof of Lemma 5.

Let

$$U\left(t\right)=I\left(t\right)+P\left(t\right)+\delta {\int }_{t-{\tau }_1}^{t}I\left(s\right)ds.$$

(48)

Then, $U\left(t\right)$ is positive definite. It follows that

$$\begin{array}{cc}\hfill & {\displaystyle \frac{dU\left(t\right)}{dt}}={\displaystyle \frac{dI\left(t\right)}{dt}}+{\displaystyle \frac{dP\left(t\right)}{dt}}+\delta I\left(t\right)-\delta I(t-{\tau }_1)\hfill \\ \hfill & ={\displaystyle \frac{\beta \left[\frac{\mu }{\delta }-I(t-{\tau }_1)-P(t-{\tau }_1)\right]I(t-{\tau }_1)}{1+{\sigma }_{1}I(t-{\tau }_1)}}-{\displaystyle \frac{\gamma I(t-{\tau }_2)P(t-{\tau }_2)}{1+{\sigma }_{2}R(t-{\tau }_3)}}-\delta I\left(t\right)\hfill \\ \hfill & +{\displaystyle \frac{\gamma I(t-{\tau }_2)R(t-{\tau }_2)}{1+{\sigma }_{2}R(t-{\tau }_3)}}-\alpha R\left(t\right)-\delta R\left(t\right)+\delta I\left(t\right)-\delta I(t-{\tau }_1)\hfill \\ \hfill & ={\displaystyle \frac{\beta \left[\frac{\mu }{\delta }-I(t-{\tau }_1)-R(t-{\tau }_1)\right]I(t-{\tau }_1)}{1+{\sigma }_{1}I(t-{\tau }_1)}}-\delta I(t-{\tau }_1)-\alpha R\left(t\right)-\delta R\left(t\right)\hfill \\ \hfill & \le {\displaystyle \frac{\beta \left[\frac{\mu }{\delta }-I(t-{\tau }_1)-R(t-{\tau }_1)\right]I(t-{\tau }_1)}{1+{\sigma }_{1}I(t-{\tau }_1)}}-\delta I(t-{\tau }_1)\hfill \\ \hfill & ={\displaystyle \frac{\beta \left\{\frac{\mu }{\delta }-I(t-{\tau }_1)-R(t-{\tau }_1)-\delta [1+{\sigma }_{1}I(t-{\tau }_1)]\right\}I(t-{\tau }_1)}{1+{\sigma }_{1}I(t-{\tau }_1)}}\hfill \\ \hfill & \le {\displaystyle \frac{\left(\frac{\beta \mu }{\delta }-\delta \right)I\left(t\right)}{1+{\sigma }_{1}I(t-{\tau }_1)}}={\displaystyle \frac{(R_0-1)I\left(t\right)}{\delta [1+{\sigma }_{1}I(t-{\tau }_1)]}}\le 0.\hfill \end{array}$$

(49)

Moreover, ${\displaystyle \frac{dU\left(t\right)}{dt}}=0$ if, and only if, $I\left(t\right)=R\left(t\right)=0$. It follows from LaSalle’s invariance principle [73] that $E_0$ is globally attracting. □

Now, inspect the global asymptotic stability.

Theorem 6.

Suppose $R_0<1$. Then, the malware-free equilibrium is globally asymptotically stable.

Proof of Theorem 6.

The claim follows by combining Theorem 5 with Lemma 5. □

5. Dynamics of the Patch-Free Malware-Endemic Equilibrium

It follows from Theorem 2 that model (2) admits a unique patch-free malware-endemic equilibrium if, and only if, $R_0>1$. In this case, it follows from Theorem 2 that the patch-free malware-endemic equilibrium is $E_1=(I_1^{\ast },0)$, $I_1^{\ast }={\displaystyle \frac{\beta \mu -{\delta }^2}{\delta (\beta +\delta {\sigma }_1)}}={\displaystyle \frac{\delta (R_0-1)}{\beta +\delta {\sigma }_1}}$.

Through straightforward calculations, the linearized system of model (2) at $E_1$ is derived, which is given below.

$$\left\{\begin{array}{cc}\hfill {\displaystyle \frac{dx\left(t\right)}{dt}}& =-\delta x\left(t\right)+{\displaystyle \frac{\beta (\frac{\mu }{\delta }-2I_1^{\ast }-{\sigma }_1{I}_1^{\ast 2})}{{(1+{\sigma }_1{I}_1^{\ast })}^2}}x(t-{\tau }_1)-{\displaystyle \frac{\beta I_1^{\ast }}{1+{\sigma }_1{I}_1^{\ast }}}y(t-{\tau }_1)\hfill \\ \hfill & -\gamma I_1^{\ast }y(t-{\tau }_2),\hfill \\ \hfill {\displaystyle \frac{dy\left(t\right)}{dt}}& =-(\alpha +\delta )y\left(t\right)+\gamma I_1^{\ast }y(t-{\tau }_2),\hfill \\ \hfill & t\ge 0.\hfill \end{array}\right.$$

(50)

The associated characteristic equation is

$$\begin{array}{cc}\hfill Q_1\left(\lambda \right)& =\left[\lambda +\delta -{\displaystyle \frac{\beta (\frac{\mu }{\delta }-2I_1^{\ast }-{\sigma }_1{I}_1^{\ast 2})}{{(1+{\sigma }_1{I}_1^{\ast })}^2}}{e}^{-\lambda {\tau }_1}\right]\times \left(\lambda +\alpha +\delta -\gamma I_1^{\ast }{e}^{-\lambda {\tau }_2}\right)\hfill \\ \hfill & ={\lambda }^2+b_1\lambda +b_2+(b_3\lambda +b_4)e^{-\lambda {\tau }_1}+(b_5\lambda +b_6)e^{-\lambda {\tau }_2}+b_7{e}^{-\lambda ({\tau }_1+{\tau }_2)}=0.\hfill \end{array}$$

(51)

where

$$b_1=\alpha +2\delta >0,b_2=\delta (\alpha +\delta )>0,$$

(52)

$$b_3={\displaystyle \frac{-\beta (\frac{\mu }{\delta }-2I_1^{\ast }-{\sigma }_1{I}_1^{\ast 2})}{{(1+{\sigma }_1{I}_1^{\ast })}^2}},$$

(53)

$$b_4={\displaystyle \frac{-\beta (\alpha +\delta )(\frac{\mu }{\delta }-2I_1^{\ast }-{\sigma }_1{I}_1^{\ast 2})}{{(1+{\sigma }_1{I}_1^{\ast })}^2}},$$

(54)

$$b_5=-\gamma I_1^{\ast }={\displaystyle \frac{-\gamma (\beta \mu -{\delta }^2)}{\delta (\beta +\delta {\sigma }_1)}}={\displaystyle \frac{-\gamma \delta (R_0-1)}{\beta +\delta {\sigma }_1}}<0,$$

(55)

$$b_6=-\gamma \delta I_1^{\ast }={\displaystyle \frac{-\gamma (\beta \mu -{\delta }^2)}{\beta +\delta {\sigma }_1}}={\displaystyle \frac{-\gamma {\delta }^2(R_0-1)}{\beta +\delta {\sigma }_1}}<0,$$

(56)

$$b_7={\displaystyle \frac{\beta \gamma I_1^{\ast }(\frac{\mu }{\delta }-2I_1^{\ast }-{\sigma }_1{I}_1^{\ast 2})}{{(1+{\sigma }_1{I}_1^{\ast })}^2}}.$$

(57)

Theorem 7.

Consider model (2) with ${\tau }_1={\tau }_2=0$. The following assertions hold:

(A1) 

Suppose $1<R_0<R_1$. Then, $E_1$ is locally asymptotically stable.

(A2) 

Suppose $R_0>R_1$. Then, $E_1$ is unstable.

Proof of Theorem 7.

Suppose $R_0>1$. Then, the characteristic Equation (51) degenerates to

$$Q_1\left(\lambda \right)=(\lambda +{\lambda }_1)(\lambda +{\lambda }_2),$$

(58)

where

$${\lambda }_1=\delta -{\displaystyle \frac{\beta (\frac{\mu }{\delta }-2I_1^{\ast }-{\sigma }_1{I}_1^{\ast 2})}{{(1+{\sigma }_1{I}_1^{\ast })}^2}},{\lambda }_2=\alpha +\delta -\gamma I_1^{\ast }.$$

(59)

First,

$$\begin{array}{cc}\hfill {\lambda }_1& ={\displaystyle \frac{\delta {(1+{\sigma }_1{I}_1^{\ast })}^2-\beta (\frac{\mu }{\delta }-2I_1^{\ast }-{\sigma }_1{I}_1^{\ast 2})}{{(1+{\sigma }_1{I}_1^{\ast })}^2}}\hfill \\ \hfill & ={\displaystyle \frac{(\delta -\frac{\beta \mu }{\delta })+2(\beta +\delta {\sigma }_1)I_1^{\ast }+(\beta +\delta {\sigma }_1){\sigma }_1{I}_1^{\ast 2}}{{(1+{\sigma }_1{I}_1^{\ast })}^2}}\hfill \\ \hfill & ={\displaystyle \frac{(\delta -\frac{\beta \mu }{\delta })+2\times \frac{\beta \mu -{\delta }^2}{\delta }+(\beta +\delta {\sigma }_1){\sigma }_1{I}_1^{\ast 2}}{{(1+{\sigma }_1{I}_1^{\ast })}^2}}\hfill \\ \hfill & ={\displaystyle \frac{(\frac{\beta \mu }{\delta }-\delta )+(\beta +\delta {\sigma }_1){\sigma }_1{I}_1^{\ast 2}}{{(1+{\sigma }_1{I}_1^{\ast })}^2}}\hfill \\ \hfill & ={\displaystyle \frac{\delta (R_0-1)+(\beta +\delta {\sigma }_1){\sigma }_1{I}_1^{\ast 2}}{{(1+{\sigma }_1{I}_1^{\ast })}^2}}>0.\hfill \end{array}$$

(60)

So, Equation (58) admits the negative root $-{\lambda }_1$.

Second,

$$\begin{array}{cc}\hfill {\lambda }_2& =\alpha +\delta -\gamma \times {\displaystyle \frac{\beta \mu -{\delta }^2}{\delta (\beta +\delta {\sigma }_1)}}\hfill \\ \hfill & ={\displaystyle \frac{\delta (\alpha +\delta )(\beta +\delta {\sigma }_1)-\gamma (\beta \mu -{\delta }^2)}{\delta (\beta +\delta {\sigma }_1)}}\hfill \\ \hfill & ={\displaystyle \frac{\delta (\alpha +\delta )(\beta +\delta {\sigma }_1)-\gamma {\delta }^2(R_0-1)}{\delta (\beta +\delta {\sigma }_1)}}\hfill \\ \hfill & ={\displaystyle \frac{(\alpha +\delta )(\beta +\delta {\sigma }_1)-\gamma \delta (R_0-1)}{\beta +\delta {\sigma }_1}}\hfill \\ \hfill & ={\displaystyle \frac{\gamma \delta (R_1-R_0)}{\beta +\delta {\sigma }_1}}.\hfill \end{array}$$

(61)

In the case where $R_0<R_1$, it follows that Equation (58) admits the negative root $-{\lambda }_2$. By the Lyapunov stability theorem [73], $E_1$ is locally asymptotically stable. In the case where $R_0>R_1$, it follows that Equation (59) admits the positive root $-{\lambda }_2$. By the Lyapunov stability theorem [73], $E_1$ is unstable. □

Theorem 8.

Consider model (2). Suppose $R_0>1$. Let

$$d_1=b_1^2-2b_2-b_3^2-b_5^2-2|b_5{b}_7|{\tau }_1-2|b_3{b}_7|{\tau }_2-2|(b_3{b}_6-b_4{b}_5)({\tau }_1-{\tau }_2)|-2|b_3{b}_5|,$$

(62)

$$e_1=b_2^2-b_4^2-b_6^2-b_7^2-2|b_6{b}_7|{\tau }_1-2|b_4{b}_7|{\tau }_2-2\left|b_4{b}_6\right|.$$

(63)

Suppose the following conditions are met.

(C1) 

$b_1+\min (b_3,0)+b_5\ge 0$.

(C2) 

$b_2+\min (b_4,0)+b_6+\min (b_7,0)>0$.

(C3) 

$d_1^2<4e_1$.

Then, $E_1^{\ast }$ is locally asymptotically stable.

Proof of Theorem 8.

For $\lambda \ge 0$, it follows that

$$\begin{array}{cc}\hfill Q_1\left(\lambda \right)& \ge {\lambda }^2+(b_1+\min (b_3,0)+b_5)\lambda +b_2+\min (b_4,0)+b_6+\min (b_7,0)>0.\hfill \end{array}$$

(64)

So, $Q_1\left(\lambda \right)$ admits no non-negative zero. Suppose $Q_1\left(\lambda \right)$ admits a complex zero with a non-negative real part. Then, $Q_1\left(\lambda \right)$ admits a pair of complex purely imaginary zeros, $\pm i\omega$, $\omega >0$. Hence,

$$\begin{array}{cc}\hfill & Q_1\left(i\omega \right)={\left(i\omega \right)}^2+i{b}_1\omega +b_2+(i{b}_3\omega +b_4)e^{-i\omega {\tau }_1}+(i{b}_5\omega +b_6)e^{-i\omega {\tau }_2}+b_7{e}^{-i\omega ({\tau }_1+{\tau }_2)}\hfill \\ \hfill & =-{\omega }^2+i{b}_1\omega +b_2+(i{b}_3\omega +b_4)(\cos \left(\omega {\tau }_1\right)-i\sin \left(\omega {\tau }_1\right))\hfill \\ \hfill & +(i{b}_5\omega +b_6)(\cos \left(\omega {\tau }_2\right)-i\sin \left(\omega {\tau }_2\right))+b_7(\cos \left(\omega ({\tau }_1+{\tau }_2)\right)-i\sin \left(\omega ({\tau }_1+{\tau }_2)\right))\hfill \\ \hfill & =[-{\omega }^2+b_2+b_3\omega \sin \left(\omega {\tau }_1\right)+b_4\cos \left(\omega {\tau }_1\right)+b_5\omega \sin \left(\omega {\tau }_2\right)+b_6\cos \left(\omega {\tau }_2\right)\hfill \\ \hfill & +b_7\cos \left(\omega ({\tau }_1+{\tau }_2)\right)]\hfill \\ \hfill & +i[b_1\omega +b_3\omega \cos \left(\omega {\tau }_1\right)-b_4\sin \left(\omega {\tau }_1\right)+b_5\omega \cos \left(\omega {\tau }_2\right)-b_6\sin \left(\omega {\tau }_2\right)\hfill \\ \hfill & -b_7\sin \left(\omega ({\tau }_1+{\tau }_2)\right)]\hfill \\ \hfill & =0.\hfill \end{array}$$

(65)

Separating the real part and the imaginary part yields

$$\left\{\begin{array}{c}{b}_3\omega \sin \left(\omega {\tau }_1\right)+b_4\cos \left(\omega {\tau }_1\right)+b_5\omega \sin \left(\omega {\tau }_2\right)+b_6\cos \left(\omega {\tau }_2\right)+b_7\cos \left(\omega ({\tau }_1+{\tau }_2)\right)\hfill \\ ={\omega }^2-b_2,\hfill \\ b_3\omega \cos \left(\omega {\tau }_1\right)-b_4\sin \left(\omega {\tau }_1\right)+b_5\omega \cos \left(\omega {\tau }_2\right)-b_6\sin \left(\omega {\tau }_2\right)-b_7\sin \left(\omega ({\tau }_1+{\tau }_2)\right)\hfill \\ =-b_1\omega .\hfill \end{array}\right.$$

(66)

Squaring both sides of the two equations and summing up lead to

$$\begin{array}{cc}\hfill & {({\omega }^2-b_2)}^2+b_1^2{\omega }^2\hfill \\ \hfill & =b_3^2{\omega }^2+b_4^2+b_5^2{\omega }^2+b_6^2+b_7^2-2b_5{b}_7\omega \sin \left(\omega {\tau }_1\right)+2b_6{b}_7\cos \left(\omega {\tau }_1\right)\hfill \\ \hfill & -2b_3{b}_7\omega \sin \left(\omega {\tau }_2\right)+2b_4{b}_7\cos \left(\omega {\tau }_2\right)+2(b_3{b}_6-b_4{b}_5)\omega \sin \left(\omega ({\tau }_1-{\tau }_2)\right)\hfill \\ \hfill & +2(b_3{b}_5{\omega }^2+b_4{b}_6)\cos \left(\omega ({\tau }_1-{\tau }_2)\right).\hfill \end{array}$$

(67)

It is well known that $\sin \left(x\right)\le x$, $x\ge 0$. It follows from Equation (67) that

$$\begin{array}{cc}\hfill & {({\omega }^2-b_2)}^2+b_1^2{\omega }^2\hfill \\ \hfill & \le b_3^2{\omega }^2+b_4^2+b_5^2{\omega }^2+b_6^2+b_7^2+2|b_5{b}_7|{\tau }_1{\omega }^2+2|b_6{b}_7|+2|b_3{b}_7|{\tau }_2{\omega }^2\hfill \\ \hfill & +2|b_4{b}_7|+2|(b_3{b}_6-b_4{b}_5)({\tau }_1-{\tau }_2)|{\omega }^2+2|b_3{b}_5|{\omega }^2+2\left|b_4{b}_6\right|\hfill \end{array}$$

(68)

Let $\zeta ={\omega }^2$. Then,

$${\zeta }^2+d_1\zeta +e_1\le 0.$$

(69)

This contradicts condition (C3). Therefore, $Q_1\left(\lambda \right)$ admits no complex zero with a non-negative real part.

The assertion follows from the Lyapunov stability theorem [73]. □

6. Dynamics of the Patch-Endemic Malware-Endemic Equilibrium

It follows from Theorem 4 that model (2) admits a unique patch-endemic malware-endemic equilibrium if, and only if, $R_0>R_1$. In this case, it follows from Theorem 4 that the patch-endemic malware-endemic equilibrium is $E_2=(I_2^{\ast },P_2^{\ast })$, $I_2^{\ast }={\displaystyle \frac{\sqrt{a_1^2-4a_2}-a_1}{2}}$, $P_2^{\ast }={\displaystyle \frac{\gamma I_1^{\ast }-(\alpha +\delta )}{(\alpha +\delta ){\sigma }_2}}$.

Through straightforward calculations, the linearized system of model (2) at $E_2$ is derived, which is given below.

$$\left\{\begin{array}{cc}\hfill {\displaystyle \frac{dx\left(t\right)}{dt}}& =-\delta x\left(t\right)+{\displaystyle \frac{\beta (\frac{\mu }{\delta }-2I_2^{\ast }-P_2^{\ast }-{\sigma }_1{I}_2^{\ast 2})}{{(1+{\sigma }_1{I}_2^{\ast })}^2}}x(t-{\tau }_1)-{\displaystyle \frac{\gamma P_2^{\ast }}{1+{\sigma }_2{P}_2^{\ast }}}x(t-{\tau }_2)\hfill \\ \hfill & -{\displaystyle \frac{\beta I_2^{\ast }}{1+{\sigma }_1{I}_2^{\ast }}}y(t-{\tau }_1)-{\displaystyle \frac{\gamma I_2^{\ast }}{{(1+{\sigma }_2{P}_2^{\ast })}^2}}y(t-{\tau }_2),\hfill \\ \hfill {\displaystyle \frac{dy\left(t\right)}{dt}}& ={\displaystyle \frac{\gamma P_2^{\ast }}{1+{\sigma }_2{P}_2^{\ast }}}x(t-{\tau }_2)-(\alpha +\delta )y\left(t\right)+{\displaystyle \frac{\gamma I_2^{\ast }}{{(1+{\sigma }_2{P}_2^{\ast })}^2}}y(t-{\tau }_2),\hfill \\ \hfill & t\ge 0.\hfill \end{array}\right.$$

(70)

The associated characteristic equation is

$$\begin{array}{cc}\hfill Q_2\left(\lambda \right)& =\left[\lambda +\delta -{\displaystyle \frac{\beta (\frac{\mu }{\delta }-2I_2^{\ast }-P_2^{\ast }-{\sigma }_1{I}_2^{\ast 2})}{{(1+{\sigma }_1{I}_2^{\ast })}^2}}{e}^{-\lambda {\tau }_1}+{\displaystyle \frac{\gamma P_2^{\ast }}{1+{\sigma }_2{P}_2^{\ast }}}{e}^{-\lambda {\tau }_2}\right]\hfill \\ \hfill & \times \left[\lambda +\alpha +\delta -{\displaystyle \frac{\gamma I_2^{\ast }}{{(1+{\sigma }_2{P}_2^{\ast })}^2}}{e}^{-\lambda {\tau }_2}\right]\hfill \\ \hfill & +\left[{\displaystyle \frac{\beta I_2^{\ast }}{1+{\sigma }_1{I}_2^{\ast }}}{e}^{-\lambda {\tau }_1}+{\displaystyle \frac{\gamma I_2^{\ast }}{{(1+{\sigma }_2{P}_2^{\ast })}^2}}{e}^{-\lambda {\tau }_2}\right]\times \left({\displaystyle \frac{\gamma P_2^{\ast }}{1+{\sigma }_2{P}_2^{\ast }}}{e}^{-\lambda {\tau }_2}\right)\hfill \\ \hfill & ={\lambda }^2+c_1\lambda +c_2+(c_3\lambda +c_4)e^{-\lambda {\tau }_1}+(c_5\lambda +c_6)e^{-\lambda {\tau }_2}+c_7{e}^{-\lambda ({\tau }_1+{\tau }_2)}=0.\hfill \end{array}$$

(71)

where

$$c_1=\alpha +2\delta >0,c_2=\delta (\alpha +\delta )>0,$$

(72)

$$c_3={\displaystyle \frac{-\beta (\frac{\mu }{\delta }-2I_2^{\ast }-P_2^{\ast }-{\sigma }_1{I}_2^{\ast 2})}{{(1+{\sigma }_1{I}_2^{\ast })}^2}},$$

(73)

$$c_4={\displaystyle \frac{-\beta (\alpha +\delta )(\frac{\mu }{\delta }-2I_2^{\ast }-P_2^{\ast }-{\sigma }_1{I}_2^{\ast 2})}{{(1+{\sigma }_1{I}_2^{\ast })}^2}},$$

(74)

$$c_5={\displaystyle \frac{\gamma P_2^{\ast }}{1+{\sigma }_2{P}_2^{\ast }}}-{\displaystyle \frac{\gamma I_2^{\ast }}{{(1+{\sigma }_2{P}_2^{\ast })}^2}},c_6={\displaystyle \frac{(\alpha +\delta )\gamma P_2^{\ast }}{1+{\sigma }_2{P}_2^{\ast }}}-{\displaystyle \frac{\gamma \delta I_2^{\ast }}{{(1+\sigma P_2^{\ast })}^2}},$$

(75)

$$c_7={\displaystyle \frac{\beta \gamma I_2^{\ast }(\frac{\mu }{\delta }-2I_2^{\ast }-P_2^{\ast }-{\sigma }_1{I}_2^{\ast 2})}{{(1+{\sigma }_1{I}_2^{\ast })}^2{(1+{\sigma }_2{P}_2^{\ast })}^2}}+{\displaystyle \frac{\beta \gamma I_2^{\ast }{P}_2^{\ast }}{(1+{\sigma }_1{I}_2^{\ast })(1+{\sigma }_2{P}_2^{\ast })}}.$$

(76)

Theorem 9.

Consider model (2) with ${\tau }_1={\tau }_2=0$. Suppose $R_0>R_1$. Suppose

(C1) 

$c_1+c_3+c_5>0$.

(C2) 

$c_2+c_4+c_6+c_7>0$.

Then, $E_2$ is locally asymptotically stable.

Proof of Theorem 9.

In this case, the characteristic Equation (74) degenerates to

$$Q_2\left(\lambda \right)={\lambda }^2+(c_1+c_3+c_5)\lambda +(c_2+c_4+c_6+c_7)=0.$$

(77)

It follows from conditions (C1)–(C2) that $Q_2\left(\lambda \right)=0$ admits a pair of negative roots. Hence, the assertion follows from the Lyapunov stability theorem [73]. □

Theorem 10.

Consider model (2). Suppose $R_0>R_1$. Let

$$d_2=c_1^2-2c_2-c_3^2-c_5^2-2|c_5{c}_7|{\tau }_1-2|c_3{c}_7|{\tau }_2-2|(c_3{c}_6-c_4{c}_5)({\tau }_1-{\tau }_2)|-2|c_3{c}_5|,$$

(78)

$$e_2=c_2^2-c_4^2-c_6^2-c_7^2-2|c_6{c}_7|{\tau }_1-2|c_4{c}_7|{\tau }_2-2\left|c_4{c}_6\right|.$$

(79)

Suppose the following conditions are met.

(C1) 

$c_1+\min (c_3,0)+\min (c_5,0)\ge 0$.

(C2) 

$c_2+\min (c_4,0)+\min (c_6,0)+\min (c_7,0)>0$.

(C3) 

$d_2^2<4e_2$.

Then, $E_2^{\ast }$ is locally asymptotically stable.

Proof of Theorem 10.

For $\lambda \ge 0$, it follows that

$$\begin{array}{cc}\hfill Q_2\left(\lambda \right)& \ge {\lambda }^2+(c_1+\min (c_3,0)+\min (c_5,0))\lambda +c_2+\min (c_4,0)+\min (c_6,0)\hfill \\ \hfill & +\min (c_7,0)>0.\hfill \end{array}$$

(80)

So, $Q_2\left(\lambda \right)$ admits no non-negative zero. Suppose $Q_2\left(\lambda \right)$ admits a complex zero with a non-negative real part. Then, $Q_2\left(\lambda \right)$ admits a pair of conjugate purely imaginary zeros, $\pm i\omega$, $\omega >0$. Hence,

$$\begin{array}{cc}\hfill & Q_2\left(i\omega \right)={\left(i\omega \right)}^2+i{c}_1\omega +c_2+(i{c}_3\omega +c_4)e^{-i\omega {\tau }_1}+(i{c}_5\omega +c_6)e^{-i\omega {\tau }_2}+c_7{e}^{-i\omega ({\tau }_1+{\tau }_2)}\hfill \\ \hfill & =-{\omega }^2+i{c}_1\omega +c_2+(i{c}_3\omega +c_4)(\cos \left(\omega {\tau }_1\right)-i\sin \left(\omega {\tau }_1\right))\hfill \\ \hfill & +(i{c}_5\omega +c_6)(\cos \left(\omega {\tau }_2\right)-i\sin \left(\omega {\tau }_2\right))+c_7(\cos \left(\omega ({\tau }_1+{\tau }_2)\right)-i\sin \left(\omega ({\tau }_1+{\tau }_2)\right))\hfill \\ \hfill & =[-{\omega }^2+c_2+c_3\omega \sin \left(\omega {\tau }_1\right)+c_4\cos \left(\omega {\tau }_1\right)+c_5\omega \sin \left(\omega {\tau }_2\right)+c_6\cos \left(\omega {\tau }_2\right)\hfill \\ \hfill & +c_7\cos \left(\omega ({\tau }_1+{\tau }_2)\right)]\hfill \\ \hfill & +i[c_1\omega +c_3\omega \cos \left(\omega {\tau }_1\right)-c_4\sin \left(\omega {\tau }_1\right)+c_5\omega \cos \left(\omega {\tau }_2\right)-c_6\sin \left(\omega {\tau }_2\right)\hfill \\ \hfill & -c_7\sin \left(\omega ({\tau }_1+{\tau }_2)\right)]\hfill \\ \hfill & =0.\hfill \end{array}$$

(81)

Separating the real part and the imaginary part yields

$$\left\{\begin{array}{c}{c}_3\omega \sin \left(\omega {\tau }_1\right)+c_4\cos \left(\omega {\tau }_1\right)+c_5\omega \sin \left(\omega {\tau }_2\right)+c_6\cos \left(\omega {\tau }_2\right)+c_7\cos \left(\omega ({\tau }_1+{\tau }_2)\right)\hfill \\ ={\omega }^2-c_2,\hfill \\ c_3\omega \cos \left(\omega {\tau }_1\right)-c_4\sin \left(\omega {\tau }_1\right)+c_5\omega \cos \left(\omega {\tau }_2\right)-c_6\sin \left(\omega {\tau }_2\right)-c_7\sin \left(\omega ({\tau }_1+{\tau }_2)\right)\hfill \\ =-c_1\omega .\hfill \end{array}\right.$$

(82)

Squaring both sides of the two equations and summing up lead to

$$\begin{array}{cc}\hfill & {({\omega }^2-c_2)}^2+c_1^2{\omega }^2\hfill \\ \hfill & =c_3^2{\omega }^2+c_4^2+c_5^2{\omega }^2+c_6^2+c_7^2-2c_5{c}_7\omega \sin \left(\omega {\tau }_1\right)+2c_6{c}_7\cos \left(\omega {\tau }_1\right)\hfill \\ \hfill & -2c_3{c}_7\omega \sin \left(\omega {\tau }_2\right)+2c_4{c}_7\cos \left(\omega {\tau }_2\right)+2(c_3{c}_6-c_4{c}_5)\omega \sin \left(\omega ({\tau }_1-{\tau }_2)\right)\hfill \\ \hfill & +2(c_3{c}_5{\omega }^2+c_4{c}_6)\cos \left(\omega ({\tau }_1-{\tau }_2)\right).\hfill \end{array}$$

(83)

Similarly, it follows from Equation (83) that

$$\begin{array}{cc}\hfill & {({\omega }^2-c_2)}^2+c_1^2{\omega }^2\hfill \\ \hfill & \le c_3^2{\omega }^2+c_4^2+c_5^2{\omega }^2+c_6^2+c_7^2+2|c_5{c}_7|{\tau }_1{\omega }^2+2|c_6{c}_7|+2|c_3{c}_7|{\tau }_2{\omega }^2\hfill \\ \hfill & +2|c_4{c}_7|+2|(c_3{c}_6-c_4{c}_5)({\tau }_1-{\tau }_2)|{\omega }^2+2|c_3{c}_5|{\omega }^2+2\left|c_4{c}_6\right|\hfill \end{array}$$

(84)

Let $\eta ={\omega }^2$. Then,

$${\eta }^2+d_2\eta +e_2\le 0.$$

(85)

This contradicts condition (C3). Therefore, $Q_2\left(\lambda \right)$ admits no complex zero with a non-negative real part.

The assertion follows from the Lyapunov stability theorem [73]. □

7. Simulation Experiments

In the preceding sections, some theoretical findings were reported. This section is devoted to examining the dynamics of model (2) through simulation experiments.

7.1. Asymptotic Stability of the Malware-Free Equilibrium

In this subsection, the asymptotic stability of the malware-free equilibrium is examined.

Experiment 1.

Consider model (2) with $\mu =100$, $\delta =2$, $\alpha =1$, $\beta =0.01$, $\gamma =1$, ${\sigma }_1=0.1$, ${\sigma }_2=0.1$, ${\tau }_1=0$, and ${\tau }_2=0$. Then, $R_0=0.25$. So, $R_0<1$. It follows from Theorem 5 that $E_0$ is locally asymptotically stable.

(a) 

Let $I\left(0\right)=40$, $P\left(0\right)=10$. Figure 1a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the red lines.

(b) 

Let $I\left(0\right)=30$, $P\left(0\right)=20$. Figure 1a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the brown line.

(c) 

Let $I\left(0\right)=20$, $P\left(0\right)=30$. Figure 1a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the green line.

(d) 

Let $I\left(0\right)=10$, $P\left(0\right)=40$. Figure 1a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the blue line.

(e) 

Figure 1c plots the corresponding phase portrait, from which the local asymptotic stability of $E_0$ is observed.

Experiment 2.

Consider model (2) with $\mu =100$, $\delta =2$, $\alpha =1$, $\beta =0.5$, $\gamma =1$, ${\sigma }_1=0.1$, ${\sigma }_2=0.1$, ${\tau }_1=0$, and ${\tau }_2=0$. Then, $R_0=12.5$. So, $R_0>1$. It follows from Theorem 5 that $E_0$ is unstable.

(a) 

Let $I\left(0\right)=40$, $P\left(0\right)=10$. Figure 2a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the red lines.

(b) 

Let $I\left(0\right)=30$, $P\left(0\right)=20$. Figure 2a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the brown line.

(c) 

Let $I\left(0\right)=20$, $P\left(0\right)=30$. Figure 2a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the green line.

(d) 

Let $I\left(0\right)=10$, $P\left(0\right)=40$. Figure 2a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the blue line.

(e) 

Figure 2c plots the corresponding phase portrait, from which the unstability of $E_0$ is observed.

Figure 1. Results of Experiment 1: (a) the time plot for the number of infected nodes, (b) the time plot for the number of patched nodes, (c) the phase portrait, where the arrows indicate the direction of state evolution, the colored lines are consistent with those in (a) and (b).

Figure 1. Results of Experiment 1: (a) the time plot for the number of infected nodes, (b) the time plot for the number of patched nodes, (c) the phase portrait, where the arrows indicate the direction of state evolution, the colored lines are consistent with those in (a) and (b).

Figure 2. Results of Experiment 2: (a) the time plot for the number of infected nodes, (b) the time plot for the number of patched nodes, (c) the phase portrait, where the arrows indicate the direction of state evolution, the colored lines are consistent with those in (a) and (b).

Figure 2. Results of Experiment 2: (a) the time plot for the number of infected nodes, (b) the time plot for the number of patched nodes, (c) the phase portrait, where the arrows indicate the direction of state evolution, the colored lines are consistent with those in (a) and (b).

Experiment 3.

Consider model (2) with $\mu =50$, $\delta =1$, $\alpha =0.1$, $\beta =0.01$, $\gamma =0.1$, ${\sigma }_1=0.1$, ${\sigma }_2=0.1$, ${\tau }_1=0.2$, and ${\tau }_2=0.2$. Then, $R_0=0.5$, So, $R_0<1$. It follows from Theorem 6 that $E_0$ is globally asymptotically stable.

(a) 

For $-\tau \le \theta \le 0$, let $I\left(\theta \right)\equiv 40$, $P\left(\theta \right)\equiv 10$. Figure 3a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the red line.

(b) 

For $-\tau \le \theta \le 0$, let $I\left(\theta \right)\equiv 30$, $P\left(\theta \right)\equiv 20$. Figure 3a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the brown line.

(c) 

For $-\tau \le \theta \le 0$, let $I\left(\theta \right)\equiv 20$, $P\left(\theta \right)\equiv 30$. Figure 3a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the green line.

(d) 

For $-\tau \le \theta \le 0$, let $I\left(\theta \right)\equiv 20$, $P\left(\theta \right)\equiv 30$. Figure 3a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the blue line.

(e) 

Figure 3c plots the corresponding phase portrait, from which the global asymptotic stability of $E_0$ is observed.

Figure 3. Results of Experiment 3: (a) the time plot for the number of infected nodes, (b) the time plot for the number of patched nodes, (c) the phase portrait, where the arrows indicate the direction of state evolution, the colored lines are consistent with those in (a) and (b).

Figure 3. Results of Experiment 3: (a) the time plot for the number of infected nodes, (b) the time plot for the number of patched nodes, (c) the phase portrait, where the arrows indicate the direction of state evolution, the colored lines are consistent with those in (a) and (b).

7.2. Asymptotic Stability of the Patch-Free Malware-Endemic Equilibrium

In this subsection, the asymptotic stability of the patch-free malware-endemic equilibrium is inspected.

Experiment 4.

Consider model (2) with $\mu =300$, $\delta =2$, $\alpha =2$, $\beta =0.05$, $\gamma =1$, ${\sigma }_1=1$, ${\sigma }_2=0.1$, ${\tau }_1=0$, and ${\tau }_2=0$. Then, $R_0=3.75$, $R_1=5.10$. So, $1<R_0<R_1$. It follows from Theorem 7 that $E_1$ is locally asymptotically stable.

(a) 

Let $I\left(0\right)=40$, $P\left(0\right)=10$. Figure 4a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the red lines.

(b) 

Let $I\left(0\right)=30$, $P\left(0\right)=20$. Figure 4a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the brown line.

(c) 

Let $I\left(0\right)=20$, $P\left(0\right)=30$. Figure 4a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the green line.

(d) 

Let $I\left(0\right)=10$, $P\left(0\right)=40$. Figure 4a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the blue line.

(e) 

Figure 4c plots the corresponding phase portrait, from which the local asymptotic stability of $E_1$ is observed.

Experiment 5.

Consider model (2) with $\mu =300$, $\delta =2$, $\alpha =2$, $\beta =0.5$, $\gamma =1$, ${\sigma }_1=1$, ${\sigma }_2=0.1$, ${\tau }_1=0$, and ${\tau }_2=0$. Then, $R_0=37.5$, $R_1=6$. So, $R_0>R_1$. It follows from Theorem 7 that $E_1$ is unstable.

(a) 

Let $I\left(0\right)=40$, $P\left(0\right)=10$. Figure 5a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the red lines.

(b) 

Let $I\left(0\right)=30$, $P\left(0\right)=20$. Figure 5a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the brown line.

(c) 

Let $I\left(0\right)=20$, $P\left(0\right)=30$. Figure 5a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the green line.

(d) 

Let $I\left(0\right)=10$, $P\left(0\right)=40$. Figure 5a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the blue line.

(e) 

Figure 5c plots the corresponding phase portrait, from which the unstability of $E_1$ is observed.

Figure 4. Results of Experiment 4. (a) the time plot for the number of infected nodes, (b) the time plot for the number of patched nodes, (c) the phase portrait, where the arrows indicate the direction of state evolution, the colored lines are consistent with those in (a) and (b).

Figure 4. Results of Experiment 4. (a) the time plot for the number of infected nodes, (b) the time plot for the number of patched nodes, (c) the phase portrait, where the arrows indicate the direction of state evolution, the colored lines are consistent with those in (a) and (b).

Figure 5. Results of Experiment 5. (a) the time plot for the number of infected nodes, (b) the time plot for the number of patched nodes, (c) the phase portrait, where the arrows indicate the direction of state evolution, the colored lines are consistent with those in (a) and (b).

Figure 5. Results of Experiment 5. (a) the time plot for the number of infected nodes, (b) the time plot for the number of patched nodes, (c) the phase portrait, where the arrows indicate the direction of state evolution, the colored lines are consistent with those in (a) and (b).

Experiment 6.

Consider model (2) with $\mu =400$, $\delta =2$, $\alpha =2$, $\beta =0.03$, $\gamma =1$, ${\sigma }_1=1$, ${\sigma }_2=0.1$, ${\tau }_1=0.8$, and ${\tau }_2=0.05$. Then, $R_0=3$, So, $R_0>1$. It is easily verified that the conditions (C1)–(C3) of Theorem 8 hold. It follows from Theorem 8 that $E_1$ is locally asymptotically stable.

(a) 

For $-\tau \le \theta \le 0$, let $I\left(\theta \right)\equiv 40$, $P\left(\theta \right)\equiv 10$. Figure 6a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the red line.

(b) 

For $-\tau \le \theta \le 0$, let $I\left(\theta \right)\equiv 30$, $P\left(\theta \right)\equiv 20$. Figure 6a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the brown line.

(c) 

For $-\tau \le \theta \le 0$, let $I\left(\theta \right)\equiv 20$, $P\left(\theta \right)\equiv 30$. Figure 6a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the green line.

(d) 

For $-\tau \le \theta \le 0$, let $I\left(\theta \right)\equiv 20$, $P\left(\theta \right)\equiv 30$. Figure 6a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the blue line.

(e) 

Figure 6c plots the corresponding phase portrait, from which the local asymptotic stability of $E_0$ is observed.

Figure 6. Results of Experiment 6: (a) the time plot for the number of infected nodes, (b) the time plot for the number of patched nodes, (c) the phase portrait, where the arrows indicate the direction of state evolution, the colored lines are consistent with those in (a) and (b).

Figure 6. Results of Experiment 6: (a) the time plot for the number of infected nodes, (b) the time plot for the number of patched nodes, (c) the phase portrait, where the arrows indicate the direction of state evolution, the colored lines are consistent with those in (a) and (b).

7.3. Asymptotic Stability of the Patch-Endemic Malware-Endemic Equilibrium

In this subsection, the asymptotic stability of the patch-endemic malware-endemic equilibrium is inspected.

Experiment 7.

Consider model (2) with $\mu =100$, $\delta =2$, $\alpha =1$, $\beta =1$, $\gamma =1$, ${\sigma }_1=0.1$, ${\sigma }_2=0.1$, ${\tau }_1=0$, and ${\tau }_2=0$. Then, $R_0=25$, $R_1=2.8$. So, $R_0>R_1$. It is easily verified that the conditions (C1)–(C2) of Theorem 9 hold. It follows from Theorem 9 that $E_2$ is locally asymptotically stable.

(a) 

Let $I\left(0\right)=40$, $P\left(0\right)=10$. Figure 7a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the red lines.

(b) 

Let $I\left(0\right)=30$, $P\left(0\right)=20$. Figure 7a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the brown line.

(c) 

Let $I\left(0\right)=20$, $P\left(0\right)=30$. Figure 7a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the green line.

(d) 

Let $I\left(0\right)=10$, $P\left(0\right)=40$. Figure 7a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the blue line.

(e) 

Figure 7c plots the corresponding phase portrait, from which the local asymptotic stability of $E_2$ is observed.

Experiment 8.

Consider model (2) with $\mu =100$, $\delta =2$, $\alpha =0.1$, $\beta =1$, $\gamma =1$, ${\sigma }_1=0.05$, ${\sigma }_2=0.05$, ${\tau }_1=0.1$, and ${\tau }_2=0.02$. Then, $R_0=25$, $R_1=2.16$. So, $R_0>R_1$. It is easily verified that the conditions (C1)–(C3) of Theorem 10 hold. It follows from Theorem 10 that $E_2$ is locally asymptotically stable.

(a) 

For $-\tau \le \theta \le 0$, let $I\left(\theta \right)\equiv 40$, $P\left(\theta \right)\equiv 10$. Figure 8a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the red line.

(b) 

For $-\tau \le \theta \le 0$, let $I\left(\theta \right)\equiv 30$, $P\left(\theta \right)\equiv 20$. Figure 8a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the brown line.

(c) 

For $-\tau \le \theta \le 0$, let $I\left(\theta \right)\equiv 20$, $P\left(\theta \right)\equiv 30$. Figure 8a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the green line.

(d) 

For $-\tau \le \theta \le 0$, let $I\left(\theta \right)\equiv 20$, $P\left(\theta \right)\equiv 30$. Figure 8a,b display $I\left(t\right)$ and $P\left(t\right)$, $t\ge 0$, respectively. See the blue line.

(e) 

Figure 8c plots the corresponding phase portrait, from which the local asymptotic stability of $E_0$ is observed.

Figure 7. Results of Experiment 7: (a) the time plot for the number of infected nodes, (b) the time plot for the number of patched nodes, (c) the phase portrait, where the arrows indicate the direction of state evolution, the colored lines are consistent with those in (a) and (b).

Figure 7. Results of Experiment 7: (a) the time plot for the number of infected nodes, (b) the time plot for the number of patched nodes, (c) the phase portrait, where the arrows indicate the direction of state evolution, the colored lines are consistent with those in (a) and (b).

Figure 8. Results of Experiment 8: (a) the time plot for the number of infected nodes, (b) the time plot for the number of patched nodes, (c) the phase portrait, where the arrows indicate the direction of state evolution, the colored lines are consistent with those in (a) and (b).

Figure 8. Results of Experiment 8: (a) the time plot for the number of infected nodes, (b) the time plot for the number of patched nodes, (c) the phase portrait, where the arrows indicate the direction of state evolution, the colored lines are consistent with those in (a) and (b).

8. Further Discussions

This section examines the influence of the two delays and the two saturation functions on the dynamics of the model (2).

8.1. Influence of the Delays

In this subsection, the influence of the two delays is inspected.

Experiment 9.

Let ${\Gamma }_1=\{0,0.2,\dots ,0.8\}$. Consider five models (2) with $\mu =500$, $\delta =10$, $\alpha =0.1$, $\beta =0.2$, $\gamma =0.25$, ${\sigma }_1=0.1$, ${\sigma }_2=0.1$, ${\tau }_1\in {\Gamma }_1$, and ${\tau }_2=0.3$.

For $-\tau \le \theta \le 0$, let $I\left(\theta \right)\equiv 6$, $P\left(\theta \right))\equiv 6$. For ${\tau }_1\in {\Gamma }_1$, Figure 9 displays the time plot for $I\left(t\right)$, $t\ge 0$. It is observed that $I\left(t\right)$ is decreasing. Moreover, it is observed that, with increase in ${\tau }_1$, $I\left(t\right)$ decreases more slowly and oscillates more violently.

Experiment 10.

Let ${\Gamma }_1=\{0,0.2,\dots ,0.8\}$. Consider five models (2) with $\mu =500$, $\delta =10$, $\alpha =0.1$, $\beta =0.6$, $\gamma =0.25$, ${\sigma }_1=0.1$, ${\sigma }_2=0.1$, ${\tau }_1\in {\Gamma }_1$, and ${\tau }_2=0.3$.

For $-\tau \le \theta \le 0$, let $I\left(\theta \right)\equiv 6$, $P\left(\theta \right))\equiv 6$. For ${\tau }_1\in {\Gamma }_1$, Figure 10 displays the time plot for $I\left(t\right)$, $t\ge 0$. It is observed that $I\left(t\right)$ is increasing. Moreover, it is observed that, with increase in ${\tau }_1$, $I\left(t\right)$ increases more slowly and oscillates more violently.

Based on 100 experiments, the following conclusions are drawn and explained.

(a)

With the extension of the infection delay, the number of infected nodes varies more slowly. This is because the extension leads to a longer time for a susceptible node to become infected and hence slower change in the number of infected nodes.

(b)

With the extension of the infection delay, the number of infected nodes oscillates more violently. The delay-induced oscillations suggest that network latency could lead to recurring malware outbreaks even as the system appears to stabilize, posing a challenge for administrators who might prematurely declare an incident is resolved.

Experiment 11.

Let ${\Gamma }_2=\{0,0.4,\dots ,1.6\}$. Consider five models (2) with $\mu =500$, $\delta =1$, $\alpha =1$, $\beta =0.2$, $\gamma =0.3$, ${\sigma }_1=0.2$, ${\sigma }_2=0.3$, ${\tau }_1=0$, and ${\tau }_2\in {\Gamma }_2$.

For $-\tau \le \theta \le 0$, let $I\left(\theta \right)\equiv 200$, $P\left(\theta \right))\equiv 300$. For ${\tau }_2\in {\Gamma }_2$, Figure 11 displays the time plot for $P\left(t\right)$, $t\ge 0$. It is observed that $R\left(t\right)$ is decreasing. Moreover, it is observed that, with increase in ${\tau }_2$, $P\left(t\right)$ decreases more slowly and oscillates more violently.

Experiment 12.

Let ${\Gamma }_2=\{0,0.4,\dots ,1.6\}$. Consider five models (2) with $\mu =500$, $\delta =1$, $\alpha =0.2$, $\beta =0.2$, $\gamma =0.3$, ${\sigma }_1=0.2$, ${\sigma }_2=0.3$, ${\tau }_1=0$, and ${\tau }_2\in {\Gamma }_2$.

For $-\tau \le \theta \le 0$, let $I\left(\theta \right)\equiv 1$, $P\left(\theta \right))\equiv 1$. For ${\tau }_2\in {\Gamma }_2$, Figure 12 displays the time plot for $P\left(t\right)$, $t\ge 0$. It is observed that $R\left(t\right)$ is increasing. Moreover, it is observed that, with increase in ${\tau }_2$, $P\left(t\right)$ increases more slowly and oscillates more violently.

Based on 100 experiments, the following conclusions are drawn and explained.

(a)

With the extension of the recovery delay, the number of patched nodes varies more slowly. This is because the extension leads to a longer time for an infected node to be patched and hence slower change in the number of patched nodes.

(b)

With the extension of the recovery delay, the number of patched nodes oscillates more violently. The delay-induced oscillations suggest that network latency could lead to recurring patch failure even as the system appears to stabilize, posing a challenge for administrators who might prematurely declare a patch dissemination is successful.

8.2. Influence of the Saturation Coefficients

Experiment 13.

Let ${\Sigma }_1=\{0,0.2,\dots ,0.8\}$. Consider five models (2) with $\mu =500$, $\delta =10$, $\alpha =0.1$, $\beta =0.16$, $\gamma =0.25$, ${\sigma }_1\in {\Sigma }_1$, ${\sigma }_2=0.5$, ${\tau }_1=0.1$, and ${\tau }_2=0.1$.

For $-\tau \le \theta \le 0$, let $I\left(\theta \right)\equiv 6$, $P\left(\theta \right))\equiv 6$. For ${\sigma }_1\in {\Sigma }_1$, Figure 13 displays the time plot for $I\left(t\right)$, $t\ge 0$. It is observed that $I\left(t\right)$ is decreasing. Moreover, It is observed that, with increase in ${\sigma }_1$, $I\left(t\right)$ decreases more rapidly.

It is concluded from 100 experiments that, in the case where the number of infected nodes is decreasing, with increase in the infection coefficient, the number of infected nodes decreases more rapidly. This is because the increased infection coefficient leads to a longer time for a susceptible node to bercome infected.

Experiment 14.

Let ${\Sigma }_1=\{0,0.2,\dots ,0.8\}$. Consider five models (2) with $\mu =500$, $\delta =16$, $\alpha =0.2$, $\beta =1.2$, $\gamma =0.3$, ${\sigma }_1\in {\Sigma }_1$, ${\sigma }_2=0.5$, ${\tau }_1=0.01$, and ${\tau }_2=0.01$.

For $-\tau \le \theta \le 0$, let $I\left(\theta \right)\equiv 1$, $P\left(\theta \right))\equiv 5$. For ${\sigma }_1\in {\Sigma }_1$, Figure 14 displays the time plot for $I\left(t\right)$, $t\ge 0$. It is observed that $I\left(t\right)$ is increasing. Moreover, It is observed that, with increase in ${\sigma }_1$, $I\left(t\right)$ increases more slowly.

It is concluded from 100 experiments that, in the case where the number of infected nodes is increasing, with increase in the infection coefficient, the number of infected nodes increases more slowly. This is because the increased infection coefficient leads to a longer time for a susceptible node to become infected.

In practice, an increase in the infection coefficient leads to a more self-limiting infection. This, in turn, results in a reduced infection size, modeling a scenario where network defenses become more effective or available targets become scarcer as an attack intensifies.

Experiment 15.

Let ${\Sigma }_2\in \{0.2,0.4,\dots ,1.0\}$. Consider five models (2) with $\mu =500$, $\delta =1$, $\alpha =0.1$, $\beta =0.2$, $\gamma =0.05$, ${\sigma }_1=0.5$, ${\sigma }_2\in {\Sigma }_2$, ${\tau }_1=0.001$, and ${\tau }_2=0.001$.

For $-\tau \le \theta \le 0$, let $I\left(\theta \right)\equiv 200$, $P\left(\theta \right))\equiv 200$. For ${\sigma }_2\in {\Sigma }_2$, Figure 15 displays the time plot for $P\left(t\right)$, $t\ge 0$. It is observed that $P\left(t\right)$ is decreasing. Moreover, with increase in ${\sigma }_2$, $P\left(t\right)$ decreases more rapidly.

Based on 100 experiments, it is concluded that, in the case where the number of patched nodes is decreasing, with increase in the recovery coefficient, the number of infected nodes decreases more rapidly. This is because the increased recovery coefficient leads to a longer time for an infected node to be patched.

Experiment 16.

Let ${\Sigma }_2\in \{0.2,0.4,\dots ,1.0\}$. Consider five models (2) with $\mu =500$, $\delta =1$, $\alpha =0.1$, $\beta =0.2$, $\gamma =0.05$, ${\sigma }_1=0.5$, ${\sigma }_2\in {\Sigma }_2$, ${\tau }_1=0.001$, and ${\tau }_2=0.001$.

For $-\tau \le \theta \le 0$, let $I\left(\theta \right)\equiv 5$, $P\left(\theta \right))\equiv 1$. For ${\sigma }_2\in {\Sigma }_2$, Figure 16 displays the time plot for $P\left(t\right)$, $t\ge 0$. It is observed that $P\left(t\right)$ is increasing. Moreover, with increase in ${\sigma }_2$, $P\left(t\right)$ increases more slowly.

Based on 100 experiments, it is concluded that, in the case where the number of patched nodes is increasing, with increase in the recovery coefficient, the number of infected nodes increases more slowly. This is because the increased recovery coefficient leads to a longer time for an infected node to be patched.

In practice, an increase in the recovery coefficient leads to a more self-limiting recovery rate. This, in turn, results in a reduced recovery size, modeling a scenario where network defenses become less effective or available patched nodes become scarcer as patching intensifies.

9. Conclusions

In this article, a malware propagation model with double delays and double saturation effects is suggested. A complete picture for the distribution of the malware-endemic equilibria is drawn. Furthermore, a partial picture for the asymptotic stability of the equilibria is presented. From these outcomes, it is concluded that the distributed patching process is unsustainable if the network parameters make the first threshold exceed unity. The influence of the delays and saturation effects on malware propagation is examined, from which the way these factors modulate the outcomes is understood.

The crucial insight from our model is the role of the second threshold, $R_1$. Our analysis demonstrates that a rapid response $\left(R_0\right)$ is insufficient if the system parameters keep it below $R_1$, as the distributed patching mechanism will be unsustainable. This highlights that effective defense policies must focus not only on the patching speed but also on ensuring the network architecture can support a sufficiently high recovery force $\left(\gamma \right)$ to surpass this critical secondary threshold (see Equation (39)). From a practical cybersecurity policy perspective, a network operating in the $1<R_0\le R_1$ regime could reduce the possibility of network infection, whereas a network operating in the $R_0>R_1$ regime is expected to generate a high risk of infections.

Some relevant issues are yet to be addressed. First, in this article, the delay effect and the saturation effect are treated separately. It is interesting to consider the interaction of the two factors and to gain insight into them. Second, network segmentation and isolation are often performed to enhance network security. This implies that there exists a space–time effect in real-world malware propagation. Hence, delayed malware propagation models based on partial differential system are worth investigation [74,75,76]. Third, fractional differential equations are especially suitable for modeling systems where past behavior influences present behavior [77]. Hence, it is appropriate to explore delayed fractional-order malware propagation models [78,79,80,81]. Fourth, the optimal control of delayed malware spreading is an interesting subject in the domain of cybersecurity [5,82]. Next, due to the similarty between malware propagation and rumor spreading, it is worth investigating delayed rumor spreading models [65,83]. Finally, it is crucial to develop an AI-enabling approach to the understanding of malware propagation [84].