Research ArticleDynamics on Hybrid Complex Network Botnet Modeling andAnalysis of Medical IoT

MingyongYin 12XingshuChen 34QixuWang 34WeiWang 4 andYulongWang23

1College of Computer Science and Technology Sichuan University Chengdu 610065 China2Institute of Computer Application Mianyang 621900 China3College of Cybersecurity Sichuan University Chengdu 610065 China4Cybersecurity Research Institute Sichuan University Chengdu 610065 China

Correspondence should be addressed to Qixu Wang qixuwangscueducn

Received 22 May 2019 Accepted 28 July 2019 Published 18 August 2019

Guest Editor Kuan Zhang

Copyright copy 2019Mingyong Yin et alshyis is an open access article distributed under the Creative Commons Attribution Licensewhich permits unrestricted use distribution and reproduction in any medium provided the original work is properly cited

With the rapid development of Internet of things technology the application of intelligent devices in themedical industry has becomeubiquitous Connected devices have revolutionized clinicians and patient care but also made modern hospitals vulnerable to cyberattacks Among the security risks botnets are of particular concern which can be used to control thousands of devices for remote datatheft and equipment destruction In this paper we propose a non-Markovian spread dynamics model to understand the eects ofbotnet propagation which can characterize the hybrid contagion situation in reality Based on the Susceptible-Adopted-Recoveredmodel we introduce nonredundantmemory spreadmechanism for global propagation as a tuner to adjust spreading rate dierenceFor describing the proposed model we extend a heterogeneous edge-based compartmental theory shyrough extensive numericalsimulations we reveal that the growth pattern of the nal adoption size versus the information transmission probability is dis-continuous and how the nal adoption size is aected by hybrid ratio α global scope control factor ϵ accumulated receivedinformation thresholdT and other parameters on ER network Furthermore we give the theory and simulation result on BAnetworkand also compare the two hybrid methodsmdashsingle infection in one time slice and double infections in one time slicemdashto evaluate theinuence on nal adoption size We found in SIOT hybrid contagion scenario the nal adoption size shows the phenomenon of adecline followed by an increase versus dierent hybrid ratio and it is both veried in theory and numerical simulation shyroughvalidation by thousands of experiments our developed theory agrees well with the numerical simulations

1 Introduction

With the wide application of Internet of things (IoT) devicesin the medical industry security threats caused by limitedcomputing power of devices less security protection mea-sures and insucient attention are also increasing amongwhich botnet is one of the biggest security threats As is wellknown most medical equipments have following securitycharacters always online weak security protection low costof botnet attacks and diculty in clarifying the attributionof security responsibilities With the control of medical IoTdevices botnet can be used to steal information and destroydevices according to hacker instructions shye securityweaknesses of medical device can be manipulated to ap-propriate control over personal devices hospital diagnostic

machines and other medical appliances shye work con-ducted by Jay Radclie in 2011 on weaknesses found ininsulin pumps had aroused a lot of attention he gave a livedemonstration showing that it was possible to remotelydeliver lethal doses of insulin to patients [1 2]

Botnet as a general bearing platform has become the sourceof all kinds of network attacks Botnet is evolved from tradi-tional malicious code which combines various attack methodsand has gradually become a highly ecient attack platformshyrough botnet the attacker implants botnet programs into thehost in the network controls the infected host and establishescommand and control channelsshye biggest dierence betweenbotnet and traditional attacks is the one-to-many controlstructure which enables attackers to control a large number ofresources to serve them at a very low cost which poses a huge

HindawiSecurity and Communication NetworksVolume 2019 Article ID 6803801 14 pageshttpsdoiorg10115520196803801

challenge to the security confidentiality and integrity of themedical industry network environment

With the increasing threats of botnet from antiviruscompanies to research institutions have conducted a largenumber of in-depth analysis and research on botnet in-cluding botnet detection tracking defense and counter-measures and also different defending mechanisms areintroduced into IoT network [3ndash6] e establishment ofbotnet propagation model is an effective tool to analyze andstudy the propagation characteristics of botnet which is anecessary condition to understand the dynamics of the threatthey pose e recent frequent extortion of ransomware suchasWannacry Petya etc has caused great losses to individualsand enterprisesis kind of virus based on botnet can spreadboth on WAN and on LAN and their propagation law alsopresents some new characteristics It is a challenging problemto evaluate the influence of different information trans-mission channels on user adoption the possibility of virusemail sent by friends or strangers to be clicked and opened

A mixture of local propagation and global propagation istypical in hybrid propagation mechanism as depicted inFigure 1 For local propagation where the infected node onlyinfects a subset of the limited propagation target nodes theinfected node typically infects neighboring nodes [7] for globalpropagation the nodes are fully mixed and the infected nodescan infect any other node [8 9] In fact many epidemics usemixed transmission which involves two or more combinedtransmission mechanisms Also the ransomware can scan atarget computer on a local network or any computer randomlyselected on the internet through a port scan Among them thelocal area network node is in the internal network environmentwhich means the communication between internal nodes willnot pass through firewall also to the node homogeneity theprobability of successful infection is higher in local spreadingBecause the WAN node is not aware of the network envi-ronment of the target node its success probability will be lowerthan the local success probability

Another phenomenon we are interested in is when a hostreceives a number of disguised emails with viruses theprobability of computer infection will also increase becauseit is more likely to be misclicked this memory effect makesthe dynamics of social contagion non-Markovian

In a word in order to effectively depict the dissemination ofbotnet we need to be able to describe the heterogeneouscredibility of information from different sources the impactrange of different masters in the dissemination model and themixture way of different propagation method in single timeslice is characteristic also exists widely in other informationand behavior dissemination erefore it is necessary to studythis dissemination scenario in order to provide a theoreticalbasis for the prediction and control of bot dissemination

is paper proposes a hybrid propagation dynamicstheoretical model based on the SAR model and the edgecompartmental theory that includes local and globalpropagation and can capture differences in its propagationcapabilities which contributes in the following areas

(1) In order to describe the phenomenon of botnetmixed propagation through LAN and WAN we

propose a hybrid propagation model that supportsthe global spreading participation node range con-trol which can better reflect the reality that a targetnode is infected by a limited range of attack nodesbecause of the impact of time space and random-ness It is different from previous work regardingglobal spreading as the infected node will infect everynode in the network

(2) We introduce nonredundant memory features inglobal propagation process by setting the parameterof cumulative information that needs to be receivedfor triggering state change the propagation rate canbe modified flexibly

(3) eoretical analysis and simulation experimentsverify the effects of different mixing ratios on thefinal propagation range and find that under a certainspreading rate the final propagation range willpresent a wavy curve phenomenon versus hybridratio α

is paper is organized as follows Section 2 gives a briefsummary about related work on botnet propagation modelIn Section 3 we abstract the scenes of different types ofmixed propagation and present themodel description Basedon the definition in Section 3 we give the theoretical der-ivation in Section 4 In Section 5 the correctness of thetheory is verified by numerical simulation and programsimulation and the influence of different parameters on thefinal propagation range in the mixed propagation process isanalyzed

2 Related Work

21 Botnet Propagation Model With the widespread use ofIoT technology in the medical industry ubiquitous smart

`

Susceptible node

Infected node

Target node

Master node

Local

Global

Local

Global

Figure 1 Illustration of hybrid propagation

2 Security and Communication Networks

devices have greatly increased the attack surface whileproviding convenience for doctors and patients [10] Amongthem the malware infects the sensor and the terminal and iscommanded and controlled by the external botnet masternode so the attacker initiates the attack to achieve purposewhen the attacker needs it ese botnets composed ofbotnet devices have become the main threat to the networksecurity and life safety in the medical industry and they canbreakthrough defense under heterogeneous networkstructure and different layers [11ndash14] We need to perceiveand understand the propagation process as early as possibleto provide theoretical support for better control in differentscenarios

Botnet can generally be divided into infection commandand control and attack phases is article focuses on theinfection phase of botnet At this stage attackers can spreadbots in various ways such as trojans malicious emails activescanning passively inducing users to download and installbots or proactively exploiting remote service vulnerabilitiesAfter the attacker infects the target host the hidden moduleis loaded and the botnet program is hidden in the controlledhost by techniques such as deformation and polymorphismOne of the most influential botnets is the Mirai botnet Miraiuses worm-based propagation which includes Internet ofthings cameras routers printers and video recorders [1]

Modeling the botnet propagation based on the biologicaldisease propagation model is a common method adopted byresearchers e propagation dynamics is used to model thepropagation behavior and derive botnet spreading differ-ential equations and then verify the worm propagation lawwith numerical simulation ey also try to solve theproblem of how the network defender can prevent theformation of botnet by enhancing the security defense ca-pability of the device under the condition that the networkoperation overhead is minimal [15ndash17]

Researchers have conducted extensive research on thepropagation behavior of worms in wireless sensor networksRepresentative work includes the Susceptible-Exposure-Infection-Recovery-Sensitivity Vaccination (SEIRS-V)model and the Susceptible-Exposure-Infection-Recovery-Vaccination (SEIRV) model By capturing the spatiotem-poral dynamics of the wormrsquos propagation process thesemodels define equilibrium points using the basic re-productive number R0 and then assess the stability of thesystem at these points [18 19]

Dagon et al [20] discovered the law of botnet propa-gation affected by time and region based on the continuousmonitoring of botnet and constructed a diurnal propagationmodel to characterize botnet infection Todd Gardner et al[21] researched botnet from the perspective of user behaviorand found that we can mitigate the frequency of IoT botnetattacks with improved user information which may posi-tively affect user behavior this can be used to predict userbehavior after the botnet attack

22 Dynamics on Complex Network With the developmentof complex networks and communication dynamics manyphenomena in the fields of computer science biology

sociology and economics are characterized by ldquopropagationdynamics on complex networksrdquo and the methods to revealtheir propagation laws are widely used [22ndash24]

In the field of Internet the recent frequent extortion ofransomware such as Wannacry Petya Scarab etc hascaused great losses to individuals and enterprises [25ndash27]For rumor spreading ordinary users often receive opinionsfrom opinion leaders and people they are familiar with it is achallenging problem to evaluate the influence of differentinformation spreading ways on user adoption erefore itis necessary to conduct research on this hybrid propagationphenomenon and understand its law of transmission so as tofurther take effective countermeasures

Research on social contagion mechanism and corre-sponding control strategies is one of the hotspots of currentresearch At present scholars have carried out a lot of researchon the impact of the heterogeneity of individual adoptionbehavior heterogeneity of network structure memory ofindividual adoption behavior nonredundant contagion andincomplete neighborhood spreading on social propagation Inreality memory usually plays an important role on adoptionenhancement for social contagion For instance whensomeone hears amessage frommany people it is believed thatthe credibility of information will be greatly improved Whenreceiving a number of disguised emails with viruses theprobability of computer infection will also increase because itis more likely to be misclicked is memory effect makes thedynamics of social contagion non-Markovian Consideringthe memory effect a modeling method based on non-Markovmodel is proposed in [28ndash30] Generally speaking a node canreceive the cumulative information about specific social be-havior either in a redundant or nonredundant manner [31]where the former allows a pair of individuals to successfullytransmit information many times but for the latter repetitivetransmission is prohibited Previous studies on nonredundantinformation transmission characteristics of society have beenrelatively few [30 32 33] It is of great significance to un-derstand the dynamics of transmission with nonredundantinformation memory effect in hybrid spreading situation

3 Model Descriptions

In this section we give the model of botnet propagation inhybrid spreading scenario to characterize the comprehen-sive effect on target node It can reflect the fact that medicaldevices can be infected by local area nodes or internetterminals with different impacts For the network G com-posed ofN nodes the average degree is langkrang and the degree ofnode i is ki e nodes participate in one of the propagationswith a certain probability in each time slice For node iduring each round of propagation it will involve in localpropagation or global propagation with probability α wenote this kind of propagation as single in one time slice(SIOT) Correspondingly for the situation that node i canreceive messages from both local and global propagation wename it as double in one time slice (DIOT)

In order to describe the heterogeneous credibility ofinformation received from the local and the global sources inthe case of mixed propagation we assume that the local

Security and Communication Networks 3

propagation threshold and the global propagation thresholdare different and the global propagation information isreceived as a nonredundant memory process each nodeinformation can only be passed once to the target node Asshown in Figure 1 the target node (black) can receive in-formation from the local neighbor infected nodes (green)and global infected nodes

In the case of local propagation nodes are more likely toadopt corresponding ideas or infect similar viruses so we setthe threshold of local contagion to 1 e infected neighbornode j infects node i with probability lambda that is theprobability of accepting information from local propagationper round is λL αλ Similarly node i participates in globalpropagation with probability 1 minus α and the rate isλG (1 minus α)λ Due to the large number of nodes in thewhole network we introduce the global parameter ϵ tocontrol the node scale in propagation the global nodeparticipating in the propagation of i is Nϵ and the numberof participating global nodes can be adjusted by the pa-rameter ϵ In the global propagation situation the Internetattack node randomly scans the target user for botnetpropagation and randomly sends the message forpropagation

Compared with local propagation the informationcredibility from global channel is less trustworthyereforewe set the threshold as T and it is satisfied that each nodereceives broadcast information of other nodes no more thanonce In addition since the number of global nodes is muchlarger than that of local nodes in the modeling process tosimplify processing the global propagation node includesneighbor nodes of node i

For the dynamic modeling of network propagationprocess this paper references the SAR (Susceptible-Adopted-Recovered) model At any time any node in thenetwork is in one of these three states as shown inFigure 2 S represents susceptible state indicating that anode in the network can be infected A represents in-fected state indicating that a node in the network hasbeen infected and R represents recovery state indicatingthat the infected node in the network has changed to arecovery state and can no longer participate in the follow-up process

In each propagation round we assume that one nodecan participate in either global or local contagion one timeif the node state is S for nodes in A state it can try once forrecovering to R state by sampling c For the mixedpropagation of different intensity propagation sources weare concerned about the outbreak threshold characteris-tics especially the first-order phase transition We furtherinvestigate the impact on the final adoption size underdifferent hybrid ratios of mixed propagation varioustransmission rates and initial seed ratio during thepropagation process

4 Theory

41 SIOT In this section we make use of generalizedheterogeneous edge-based compartmental theory based onthe previous work in [34ndash36] to describe our model and

characterize the hybrid propagation process based on edge-based compartmental theory for the analysis Although thesystem in [35] was proposed to analyze single-mechanism-based spreading for the continuous time case it can bemodified to be suitable for our model with hybrid propa-gation for discrete time and nonredundant informationmemory characteristic We calculate the probability that arandom test node u is in each state susceptible S(t) infectedA(t) and recovered R(t)

We define the probability that a node has degree k isp(k) it means the number of neighbors of node u for localspreading is k e generating function of degree distribu-tion p(k) is defined as g(x) 1113936kp(k)xk where pn(k)

means the probability that for a random neighbor of u it hask edges We assume the degrees of the two end nodes of eachedge are independent

In an uncorrelated network pn(k) kp(k)langkrang wherelangkrang is the average degree of the network we denote θt as theprobability that a random neighbor v has not infected uthrough local path Let ϑt be the probability that global nodew has not infected u through global path

Suppose u has k neighbors the probability that it issusceptible is decided by local and global spreading resultFor local propagation we assume the infection threshold is1 ie whenever node u receives one message from neigh-bors it will be infected so we can get SL( k

rarr t) θ k

t for nodeswhich have degree k For global propagation influenced bythe factors like low trust and environment heterogeneity weassume the infection threshold is T and T is greater than orequal to 1 at time t the probability of node u not infectedthrough global spreading is

SG( krarr

t) N minus 1

m1113888 1113889ϑNminus 1minus m

t 1 minus ϑt( 1113857m

(1)

where n is the number of nodes attending in the propa-gation So at time t the probability that node u is in thesusceptible state can be written as

S( krarr

t) θkt 1113944

Tminus 1

m0

N minus 1

m1113888 1113889ϑNminus 1minus m

t 1 minus ϑt( 1113857m

(2)

en by averaging S( krarr

t) over all degrees the initialratio of nodes in adopted state is ρ0 and we have

S(t) 1 minus ρ0( 1113857 1113944k

p(k)θ kt 1113944

Tminus 1

m0

N minus 1

m1113888 1113889ϑNminus 1minus m

t 1 minus ϑt( 1113857m

(3)

A neighbor of individual u may be in one of susceptibleadopted or recovered states We can thus further express θt

as

θt ϕS(t) + ϕA(t) + ϕR(t) (4)

where ϕS(t) ϕA(t) ϕR(t) is the probability that a neighborof the individual u is in the state of susceptible adopted orrecovered and has not transmitted the information to

4 Security and Communication Networks

individual u by time t We need to seek the solution of threepossibilities Assume a neighboring individual v of u is in thesusceptible state at start point it cannot transmit the in-formation to u Individual v can get the information from itsother neighbors since u is in a cavity state Neighbor v

cannot be infected by u and itself then

ϕS(t) 1 minus ρ0( 1113857 1113944k

kp(k)θkminus 1t

N minus 2m

1113888 1113889 1113944

Tminus 1

m0ϑNminus 2minus m

t

1 minus ϑt( 1113857m

langkrang

(5)

We further investigate ϕR(t) it should satisfy the defi-nition that an adopted neighbor has not transmitted theinformation to u via its connection and with probability c

the adopted neighbor to be recovered According to theanalysis above we get

dϕR(t)

dt c 1 minus λL( 1113857ϕA(t) (6)

At time t the rate of change in the probability that arandom edge has not transmitted the information is equal tothe rate at which the adopted neighbors transmit the in-formation to their susceptible neighboring individualsthrough edges us we get

dθ(t)

dt minus λLϕA(t) (7)

Combining equations (6) and (7) we obtain

ϕR(t) c(1 minus θ(t)) 1 minus λL( 1113857

λL

(8)

dθ(t)

dt minus λL θ(t) minus ϕS(t) minus ϕR(t)( 1113857 (9)

Substitute equations (8) and (5) into equation (7) Doingso we can rewrite equation (6) as

dθ(t)

dt λL 1113944

k

kp(k)

langkrangθkminus 1

t

N minus 2

m

⎛⎝ ⎞⎠ 1113944

Tminus 1

m0ϑNminus 2minus m

t 1 minus ϑt( 1113857m

+ c(1 minus θ(t)) 1 minus λL( 1113857 minus λLθ(t)

(10)

We can write ϑt as

ϑt φS(t) + φA(t) + φR(t) (11)

In the same way with local spreading for globalpropagation we take into account the weak relationshipwith global nodes the threshold for state change from

Node u gets into adopted state

Receive message from adopted neighbor

rate is λL T = 1

Receive message from global nodes

rate is λG T = 3

Sample hybrid ratio

Node u gets into recovery state

Node u is in susceptible stateat the beginning

If infected

Sample recovery

No

Yes

ltα geα

ltγ

geγ

Figure 2e flow chart of node state transferring in each spread phase a node will act in either local or global propagation according to thesample result

Security and Communication Networks 5

susceptible state to adopted state is T that is a nodeshould at least receive T messages from global spreadingand then it can trigger state change en φS(t) can bewritten as

φS(t) 1 minus ρ0( 1113857 1113944K

p(k)θkt

N minus 2

m

⎛⎝ ⎞⎠ 1113944

Tminus 1

m0ϑNminus 2minus m

t 1 minus ϑt( 1113857m

(12)

So φR(t) is

φR(t) c(1 minus ϑ(t)) 1 minus λG( 1113857

λG

(13)

en we can get

dϑ(t)

dt λG 1113944

K

p(k)θkt

N minus 2

m

⎛⎝ ⎞⎠ 1113944

Tminus 1

m0ϑNminus 2minus m

t 1 minus ϑt( 1113857m

+ c(1 minus ϑ(t)) 1 minus λG( 1113857 minus λGϑ(t)

(14)

We know S(t) + A(t) + R(t) 1 at time t note that therate dA(t)dt is equal to the rate at which S(t) decreasesbecause all the individuals moving out of the susceptiblestate must move into the adopted state minus therate at which adopted individuals become recovered Wehave

dA(t)

dt minus

dS(t)

dtminus cA(t) (15)

dR(t)

dt cA(t) (16)

According to the deduction above we can have thegeneral description of social contagion dynamics so that wecan calculate the probability that node u has not receivedenough messages for state changing

θ(infin) 1113944k

kp(k)

langkrangθkminus 1

(infin)

N minus 2

m

⎛⎜⎜⎝ ⎞⎟⎟⎠ 1113944

Tminus 1

m0ϑNminus 2minus m

(infin) 1 minus ϑinfin( 1113857m

+c(1 minus θ(infin)) 1 minus λL( 1113857

λL

(17)

ϑ(infin) 1113944k

p(k)θkinfin

N minus 2m

1113888 1113889 1113944

Tminus 1

m0ϑNminus 2minus minfin 1 minus ϑinfin( 1113857

m

+c(1 minus ϑ(infin)) 1 minus λG( 1113857

λG

(18)

Now we analyze the critical information transmissionprobability Since we have already assumed that Tgt 1 tostudy the memory reinforcement a vanishingly smallfraction of seeds cannot trigger a global behavior adoptionIn this situation θx(infin) 1 is not a solution of the followingequation

zfL(θ(infin) ϑ(infin))

zθ(infin)

zfG(θ(infin) ϑ(infin))

zϑ(infin) 1 (19)

From theory analysis we can capture first-order phasetransition at the critical point where the condition is ful-filled We assume A(infin) 0 then R(infin) 1 minus S(infin) wecan calculate R(infin) as final adoption size

42 DIOT For the theory introduced above it assumes thata node can participate in only one type of spreading in eachtime slice either local or global propagation In realitydifferent propagation may act on nodes at the same time sowe also carry out research on this scenario

In alternative hybrid contagion the spreading rate forlocal and global propagation is λL αλ and λG (1 minus α)λrespectively while λL + λG λ Different from alternativehybrid contagion the spreading rate of parallel hybridcontagion does not have such constraints and λL and λG areisolated

To further explore the contribution of two spreadingmethods in hybrid propagation we introduce globespreading rate control factor ζ let λG λLζ by doing thiswe can get the variety of final adoption size versus differentglobal transmission rate So equations (17) and (18) can bewritten as

θ(infin) 1113944k

kp(k)

langkrangθ kminus 1

(infin)

N minus 2

m

⎛⎜⎜⎜⎜⎝ ⎞⎟⎟⎟⎟⎠ 1113944

Tminus 1

m0ϑNminus 2minus m

(infin) 1 minus ϑinfin( 1113857m

+c(1 minus θ(infin))(1 minus λ)

λ

(20)

ϑ(infin) 1113944k

p(k)θkinfin

N minus 2m

1113888 1113889 1113944

Tminus 1

m0ϑNminus 2minus minfin 1 minus ϑinfin( 1113857

m

+c(1 minus ϑ(infin))(1 minus λζ)

λζ

(21)

5 Simulation

51 SimulationMethod Based on the theory analysis of thebotnet spreading progress we perform numerical simu-lations to study our proposed hybrid contagion modelusing ErdosndashRenyi (ER) network model [37] andBarabasindashAlbert (BA) network with power-law degreedistribution for our simulations [8] For medical IoT themedical equipment or sensors are always deployed indiagnosis and treatment room or datacenter in general itis hard to infect them by email attachments as commonlyseen in computer e most possible attack vector is wiredor wireless network intrusion and hardware addition byhuman intervention which can be categorized as localpropagation we can model these possible propagationchannels with hybrid spreading model An overview of theproposed numerical simulation program is shown in

6 Security and Communication Networks

Algorithm 1 In initiation phase ER network generationand parameter settings need to be handled first We usethe open-source package NetworkX [38] to producenetwork ER network G the network size is 10000 networknodes and the average degree is langkrang 10

We randomly set 5 nodes in adopted state ρ0 5104 Ateach experiment according to the variable that needs to beinvestigated parameters like local propagation probabilityλL global propagation probability λG threshold T recoveryrate c hybrid ratio α and globe scope controller ϵ are setrespectively In most cases we set the scope parameterϵ 0004 that is in each transmission node u will receivemessages from 40 global nodes For each experiment werepeat a thousand times and take the average value assimulation result

52 SIOT in ER Network We first study the effects ofhybrid ratio α on social contagions in ER networks Asshown in Figure 3 the hybrid ratio changes the growthpattern of the final behavior adoption size R(infin) versusthe information transmission probability λ From thefigure we can see that when λ 01 the final adoptionsize R(infin) is varied with α increments When α value issmall the local propagation contributes less and it ishard to outbreak when initial seeds are few Nonethelesswhen α gets higher more chances are there for the nodeto receive message from neighbors as we aforemen-tioned the threshold is 1 so it will promote the proba-bility of nodes in susceptible state to get into adoptedstate When more nodes are in adopted state for globalpropagation it is much easier to receive more messagesthan threshold for state changing Furthermore when αkeeps on augmenting larger than the outbreak value thefinal adoption size will gradually decline and ascendafterwards Our theoretical predictions agree well withthe numerical results e differences between the the-oretical and numerical predictions are caused by thestrong dynamical correlations among the states ofneighbors

We further identify the outbreak threshold by thevariability measure which is a standard measure to de-termine the critical point in equilibrium phase onmagnetic system to reflect the fluctuation of the outbreaksize for different α

δ

R2 minus langRrang21113969

langRrang (22)

When we fix the hybrid ratio α the growth patternof R(infin) versus transmission rate λ can be observedFigure 4

We further investigate the relation between hybridratio α and final adoption size R(infin)rsquos variation law bycalculating the relative change rate of R(infin) we canderive the variation pattern It can be seen from Figure 5that with the increase of α the burst threshold decreasesindicating that local propagation still plays a dominantrole in the mixed propagation process e variability

exhibits a peak over a wide range of λ In our model weintroduce parameter ϵ to control the size of nodes joiningin global propagation the reason behind this is althoughnode u can receive message from any node in the global

λ = 05λ = 07

λ = 03λ = 015 λ = 01

0

02

04

06

08

1

12

R (infin

)

01 06 070 050302 08 09 104α

Figure 3 Propagation with fixed λ e final behavior adoptionsize R(infin) versus the hybrid ratio α with fixed informationtransmission probability λ 01 015 03 05 07 respectivelye lines are the theoretical predictions and the dots are thesimulation results

Initialization(1) Network generation(2) Parameters initialization

begin(1) newState[]lt- hisState[](2) for any node ni in N(3) if node state is susceptiblesample propagation

method with α(4) if local(5) get neighbor nodes list from G and node state

from hisState[](6) for any node in neighbor[](7) if node state is infected then(8) infect node ni with λL(9) if count gt 1 update newState[](10) else if global(11) get Nϵ global nodes global[] from G and

node state from hisState[](12) for any node in global[](13) if node state is infected(14) infect node ni with λG and update count of

received messages(15) if count gt T update newState[](16) else if node state is infected(17) to recover with probability c(18) update newState[](19) hisState[]lt- newState[]

calculate R and refresh loop parameters(20) end

Output final adoption size R

ALGORITHM 1 Numerical simulation pseudocode

Security and Communication Networks 7

method in each round it can be affected by only a few ofthem

As shown in Figure 6 as ϵ increases it is faster to reachthe outbreak threshold value In the same way we furtherstudy the effects of c on the spreading behavior By settingα 05 and ϵ 0004 we can investigate how the recoveryrate c influences final adoption size R as shown in Figure 7It visually demonstrated the change of outbreak threshold ofλ larger c means slower outbreaks Finally we focus on theimpact of the different memory threshold T on the propa-gation range In our model we use parameter T to adjust theinformation credibility which means for large T value moreinformation needs to be received to change its status asshown in Figure 8

53 SIOT in BA Network e BA network is one of theclassical scale-free networks whose degree distribution

follows a power law e first scale-free model theBA model has a linear preferential attachment 1113937 (ki)

ki1113936jkj and adds one new node at every time step us ingeneral 1113937 (k) has the form 1113937 (k) A + kα where A is theinitial attractiveness of the node We also set the networkscale as 10000 nodes langkrang 10 and ρ 5104 Otherparameters are set as follows threshold T 3 for global con-tagion recovery rate is c 05 and globe scope controller isϵ 0004

Firstly we can find in Figure 9 that nodes propagate fasterin the BA network than in the ER network in the case of sameaverage degree Because BA network has unbiased degreedistribution large degree nodes havemore neighbors to fosterinformation propagation We also find the phenomenon thatfinal adoption size changes from decline to rise as α increasesCompared with the ER network the BA network has 30decrease when it reached the peak value when λ 01 greateramplitude of oscillation was caused by difference in degree

0

01

02

03

04

05

06

07

08

09

1

R (infin

)

01 02 03 04 05 06 07 08 09 100λ

α = 06α = 05α = 04

α = 03α = 02

Figure 5 e variation of final adoption size R(infin) versus different λ with different hybrid ratio α

α = 09

α = 07

α = 05α = 03 α = 01

λ

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 05 06 07 08 09 10

Figure 4 e final behavior adoption size R(infin) versus the information transmission probability λ with fixed hybrid ratioα 01 03 05 07 09 respectively e lines are the theoretical predictions and the dots are the simulation results

8 Security and Communication Networks

distribution Generally the BA network can reach the burstthreshold much faster than the ER network under the samelambda condition as shown in Figure 10 In the same way wefixed hybrid ratio α and observed the change of final adoption

size with spreading rate from Figure 11 it can be seen thatwhen global propagation dominates it spreads faster than theER network but when the local propagation ratio increasesthe difference between these two network gets smaller

γ = 01γ = 03γ = 05

γ = 08γ = 10

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 050λ

Figure 7 Final adoption size varied with c while keeping other parameters unchanged

02

04

06

08

1

α

00102030405060708091

01λ

02 03 04

(a)

00102030405060708091

02

04

06

08

1

α

01λ

02 03 04

(b)

02

01λ

02 03 04

04

06

08

1

α

00102030405060708091

(c)

λ01 02 03 04

00102030405060708091

02

04

06

08

1

α

(d)

Figure 6 Final adoption size varied with ϵ ϵ value is 00035 0004 00045 and 0005 respectively from (a) to (d)

Security and Communication Networks 9

54 DIOT For the model introduced above it assumes that anode can participate in only one type of spreading in each timeslice either local or global propagation In reality differentpropagationsmay act on nodes at the same time sowe also carryout research on this scenario

In SIOT hybrid contagion the spreading rate for localand global propagation is λL αλ and λG (1 minus α)λ re-spectively while λL + λG λ the parameter α is used to

adjust contagion attendance for different propagationsCompared with SIOT hybrid contagion the spreading rateof DIOT does not have such constraints λL and λG areisolated this also means that a node can receive messagesfrom local or global nodes in same time slice e in-formation transmission flow can be seen in Figure 12 Be-sides this trivial difference other transmission parametersand contagion process are the same with SIOT hybrid

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(a)

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(b)

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(c)

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(d)

Figure 8 Final adoption size varied with T (a) to (d) illustrate the result of T1 T 2 T 3 and T 4 respectively

01

005 01 015 02 025 03 035 04 045 05

02

03

04

05

06

07

08

09

1 1

09

08

07

06

05

04

03

02

01

0

λ

α

Figure 9 Final adoption size varied with ϵ in BA network ϵ value is00035 0004 00045 and 0005 respectively

λ = 03

λ = 05

λ = 07

λ = 01λ = 015

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 05 06 07 08 09 100α

Figure 10 Final adoption size varied with α in SIOT

10 Security and Communication Networks

transmission For illustration convenience we set λL λ andintroduced global transmission rate scale parameter ζ tochange transmission rate of λG that is λG λζ the value ofζ is from 1 to 100 As illustrated in Figure 13 we can find thatnodes spread in the DIOT mode can reach outbreakthreshold at lower λ than in the SIOTmodeWhen λ is largerthan 012 it may reach the outbreak threshold but if thevalue of λ is smaller than 0005 it can never outbreak e

final adoption size R(infin) changes with ζ as shown inFigure 14 we can find the multiple factor ζ can play a majorrole when its value is small and as it increases the globaltransmission rate will be too small to affect the adoptionresult We can find from Figure 15 that changing the globalspreading rate can vary the approach speed to full outbreakbut the critical point is the same which means the dis-continuous growth is controlled by local propagation

α = 01α = 03α = 05

α = 07α = 09

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 05 06 07 08 09 10λ

Figure 11 Final adoption size varied with λ in SIOT

Node u gets into adopted state

No

Yes

ltγ

geγ

No

Yes

Node u gets into recovery state

Sample recovery

If infected

If infected

Receive message from global nodes

rate is λG T = 3

Receive message from adopted neighbor

rate is λL T = 1

Node u is in susceptible state atthe beginning

Figure 12 e flow chart of node state transferring in each spread phase a node will act in both local and global propagation

Security and Communication Networks 11

6 Conclusion

In this paper we studied the effects of hybrid propagationwith different spreading rates and memory reinforcementson botnet contagions We first proposed an informationcontagion model to describe the botnet spreading dynamicson complex networks We then developed a generalizedheterogeneous edge-based compartmental theory to de-scribe the proposed model

rough extensive numerical simulations on the ERnetwork and BA network we found that the growth patternof the final behavior size R(infin) versus the hybrid ratio αexhibits discontinuous pattern when fixed transmission rateλ is large But when λ is small R(infin) shows the phenomenonof fluctuation and at critical point it reaches peak value firstfollowed with small amplitude declining and gradually risingIn addition we also fixed the hybrid ratio α to analyze the finaladoption size R(infin) changing with transmission rate λ andthe growth pattern of R(infin) changing from continuous todiscontinuous is observed

For comparing the effect of different hybrid methodsSIOT and DIOT are proposed and the simulation result ispresented obviously DIOT can spread faster especiallywhen global transmission rate is high We finally studied theeffect of other parameters and found that memory thresholdT recovery rate c and global propagation range controller ϵcan affect R(infin) growing pattern respectively when T issmall it grows much faster because more seeds can begenerated and global spreading can contribute more Withincreasing c it gets slower to reach the burst value Alsoglobal range controller ϵ can change the pattern when ϵ getslarger it reaches critical value much faster By introducinghybrid propagation mechanism and spreading scope con-troller with memory character the method can supportmodeling different spreading scenarios flexibly but itsimplifies the life states of bot and the immune charac-teristics of nodes are not taken into account so our futurework will focus on these points

Our proposed theory agrees well with the numericalsimulations on ER and BA networksemodel proposed inthis paper can provide theoretical reference for hybridpropagation modeling of botnet in complex networks andalso provide guidance for medical industry to deal withbotnet threats

Data Availability

We conducted our experiment with the numerical simu-lation method without using any open dataset

Conflicts of Interest

e authors declare that there are no conflicts of interestregarding the publication of this paper

Acknowledgments

is study was financially supported in part by a program ofNational Natural Science Foundation of China (NSFC)

1090807060504030201

α

005 01 015 02 025 03 035 04λ

0908070605040302010

Figure 13 DIOT propagation e final behavior adoption sizeR(infin) versus the global transmission rate scale and localtransmission rate other parameters are N 10000 ϵ 0004T 3 and c 05 respectively e lines are the theoreticalpredictions

λ = 006

λ = 007

λ = 015

λ = 009λ = 01

λ = 03

λ = 008

λ = 0050

02

04

06

08

1

12

R (infin

)

10 20 30 40 50 60 70 80 90 1000ζ

Figure 14 Final adoption size R(infin) varied with ζ in DIOT

14 λ15 λ110 λ

12 λ13 λ

λ

0

02

04

06

08

1

12

R (infin

)

01 02 03 040λ

Figure 15 Final adoption size R(infin) varied with λ in DIOT

12 Security and Communication Networks

(grant nos 61272447 and 61802271) and in part by theFundamental Research Funds for the Central Universities(grant nos SCU2018D018 and SCU2018D022) is supportis gratefully acknowledged

References

[1] M Antonakakis T April M Bailey et al ldquoUnderstanding themirai botnetrdquo in Proceedings of the 26th USENIX SecuritySymposium pp 1093ndash1110 USENIX Security 17 VancouverBC Canada August 2017

[2] C Kolias G Kambourakis A Stavrou and J Voas ldquoDdos inthe IoT mirai and other botnetsrdquo Computer vol 50 no 7pp 80ndash84 2017

[3] D Chen N Zhang R Lu N Cheng K Zhang and Z QinldquoChannel precoding based message authentication in wirelessnetworks challenges and solutionsrdquo IEEE Network vol 33no 1 pp 99ndash105 2019

[4] D Chen N Zhang Z Qin et al ldquoS2M a lightweight acousticfingerprints-based wireless device authentication protocolrdquoIEEE Internet of ltings Journal vol 4 no 1 pp 88ndash100 2016

[5] Q Wang D Chen N Zhang Z Qin and Z Qin ldquoLACS alightweight label-based access control scheme in IoT-based5G caching contextrdquo IEEE Access vol 5 pp 4018ndash4027 2017

[6] K Zhang X Liang J Ni K Yang and X S Shen ldquoExploitingsocial network to enhance human-to-human infection anal-ysis without privacy leakagerdquo IEEE Transactions on De-pendable and Secure Computing vol 15 no 4 pp 607ndash6202016

[7] C Zhang S Zhou J C Miller I J Cox and B M ChainldquoOptimizing hybrid spreading in metapopulationsrdquo ScientificReports vol 5 no 1 p 9924 2015

[8] R M Anderson ldquoDiscussion the Kermack-McKendrickepidemic threshold theoremrdquo Bulletin of Mathematical Bi-ology vol 53 no 1-2 pp 3ndash32 1991

[9] M Newman Networks An Introduction Oxford UniversityPress Oxford UK 2010

[10] M Feily A Shahrestani and S Ramadass ldquoA survey of botnetand botnet detectionrdquo in Proceedings of the 2009 ltird In-ternational Conference on Emerging Security InformationSystems and Technologies pp 268ndash273 IEEE Athens GreeceJune 2009

[11] A Laha N Zhang H Wu D Chen and T Han ldquoOnlineproactive caching in mobile edge computing using bi-directional deep recurrent neural networkrdquo IEEE Internet ofltings Journal vol 6 no 3 pp 5520ndash5530 2019

[12] E Bertino and N Islam ldquoBotnets and internet of things se-curityrdquo Computer vol 50 no 2 pp 76ndash79 2017

[13] D Chen N Zhang N Cheng K Zhang Z Qin andX S Shen ldquoPhysical layer based message authentication withsecure channel codesrdquo IEEE Transactions on Dependable andSecure Computing p 1 2018

[14] Q Wang D Chen N Zhang Z Ding and Z Qin ldquoPCP aprivacy-preserving content-based publish-subscribe schemewith differential privacy in fog computingrdquo IEEE Accessvol 5 pp 17962ndash17974 2017

[15] D Acarali M Rajarajan N Komninos and B B ZarpelatildeoldquoModelling the spread of botnet malware in IoT-basedwireless sensor networksrdquo Security and CommunicationNetworks vol 2019 Article ID 3745619 13 pages 2019

[16] M Ajelli R Lo Cigno and A Montresor ldquoModeling botnetsand epidemic malwarerdquo in Proceedings of the 2010 IEEEInternational Conference on Communications pp 1ndash5 IEEECape Town South Africa May 2010

[17] M J Farooq and Q Zhu ldquoModeling analysis and mitigationof dynamic botnet formation in wireless IoT networksrdquo IEEETransactions on Information Forensics and Security vol 14no 9 pp 2412ndash2426 2019

[18] B K Mishra and D K Saini ldquoSEIRS epidemic model withdelay for transmission of malicious objects in computernetworkrdquo Applied Mathematics and Computation vol 188no 2 pp 1476ndash1482 2007

[19] A Singh A K Awasthi K Singh and P K SrivastavaldquoModeling and analysis of worm propagation in wirelesssensor networksrdquoWireless Personal Communications vol 98no 3 pp 2535ndash2551 2018

[20] D Dagon C C Zou andW Lee ldquoModeling botnet propagationusing time zonesrdquo in Proceedings of the NDSS Symposium 2006vol 6 pp 2ndash13 San Diego CA USA February 2006

[21] M Todd Gardner C C Beard and M Deep ldquoUsing seirsepidemicmodels for IoT botnets attacksrdquo in Proceedings of theDRCN 2017mdashDesign of Reliable Communication Networkspp 1ndash8 Munich Germany March 2017

[22] C Castellano S Fortunato and V Loreto ldquoStatistical physicsof social dynamicsrdquo Reviews of Modern Physics vol 81 no 2pp 591ndash646 2009

[23] J C Flack and R M DrsquoSouza ldquoe digital age and the futureof social network science and engineeringrdquo Proceedings of theIEEE vol 102 no 12 pp 1873ndash1877 2014

[24] R Pastor-Satorras C Castellano P Van Mieghem andA Vespignani ldquoEpidemic processes in complex networksrdquoReviews of Modern Physics vol 87 no 3 pp 925ndash979 2015

[25] V Constantin Craciun A Mogage and E Simion ldquoTrends indesign of ransomware virusesrdquo in International Conference onSecurity for Information Technology and Communicationspp 259ndash272 Springer Berlin Germany 2018

[26] S Mohurle and M Patil ldquoA brief study of wannacry threatransomware attack 2017rdquo International Journal of AdvancedResearch in Computer Science vol 8 no 5 2017

[27] A Zimba L Simukonda and M Chishimba ldquoDemystifyingransomware attacks reverse engineering and dynamic mal-ware analysis of wannacry for network and information se-curityrdquo Zambia ICT Journal vol 1 no 1 pp 35ndash40 2017

[28] S Aral and DWalker ldquoIdentifying influential and susceptiblemembers of social networksrdquo Science vol 337 no 6092pp 337ndash341 2012

[29] A Banerjee A G Chandrasekhar E Duflo and M O Jacksonldquoe diffusion ofmicrofinancerdquo Science vol 341 no 6144 article1236498 2013

[30] P S Dodds and D J Watts ldquoUniversal behavior in a gen-eralized model of contagionrdquo Physical Review Letters vol 92no 21 article 218701 2004

[31] D J Watts ldquoA simple model of global cascades on randomnetworksrdquo Proceedings of the National Academy of Sciencesvol 99 no 9 pp 5766ndash5771 2002

[32] P S Dodds and D J Watts ldquoA generalized model of socialand biological contagionrdquo Journal of lteoretical Biologyvol 232 no 4 pp 587ndash604 2005

[33] W Wang X-L Chen and L-F Zhong ldquoSocial contagionswith heterogeneous credibilityrdquo Physica A Statistical Me-chanics and Its Applications vol 503 pp 604ndash610 2018

[34] J C Miller ldquoA note on a paper by Erik Volz sir dynamics inrandom networksrdquo Journal of Mathematical Biology vol 62no 3 pp 349ndash358 2011

[35] W Wang M Tang P Shu and Z Wang ldquoDynamics of socialcontagions with heterogeneous adoption thresholds cross-over phenomena in phase transitionrdquo New Journal of Physicsvol 18 no 1 article 013029 2016

Security and Communication Networks 13

[36] W Wang M Tang H-F Zhang H Gao Y Do andZ-H Liu ldquoEpidemic spreading on complex networks withgeneral degree and weight distributionsrdquo Physical Review Evol 90 no 4 article 042803 2014

[37] P Erdos and A Renyi ldquoOn random graphs Irdquo PublicationesMathematicae Debrecen vol 6 pp 290ndash297 1959

[38] A Hagberg D Schult P Swart et al Networkx High pro-ductivity software for complex networks Webova Stra Nka2013 httpsnetworkxlanlgovwiki

14 Security and Communication Networks

devices have greatly increased the attack surface whileproviding convenience for doctors and patients [10] Amongthem the malware infects the sensor and the terminal and iscommanded and controlled by the external botnet masternode so the attacker initiates the attack to achieve purposewhen the attacker needs it ese botnets composed ofbotnet devices have become the main threat to the networksecurity and life safety in the medical industry and they canbreakthrough defense under heterogeneous networkstructure and different layers [11ndash14] We need to perceiveand understand the propagation process as early as possibleto provide theoretical support for better control in differentscenarios

Botnet can generally be divided into infection commandand control and attack phases is article focuses on theinfection phase of botnet At this stage attackers can spreadbots in various ways such as trojans malicious emails activescanning passively inducing users to download and installbots or proactively exploiting remote service vulnerabilitiesAfter the attacker infects the target host the hidden moduleis loaded and the botnet program is hidden in the controlledhost by techniques such as deformation and polymorphismOne of the most influential botnets is the Mirai botnet Miraiuses worm-based propagation which includes Internet ofthings cameras routers printers and video recorders [1]

Modeling the botnet propagation based on the biologicaldisease propagation model is a common method adopted byresearchers e propagation dynamics is used to model thepropagation behavior and derive botnet spreading differ-ential equations and then verify the worm propagation lawwith numerical simulation ey also try to solve theproblem of how the network defender can prevent theformation of botnet by enhancing the security defense ca-pability of the device under the condition that the networkoperation overhead is minimal [15ndash17]

Researchers have conducted extensive research on thepropagation behavior of worms in wireless sensor networksRepresentative work includes the Susceptible-Exposure-Infection-Recovery-Sensitivity Vaccination (SEIRS-V)model and the Susceptible-Exposure-Infection-Recovery-Vaccination (SEIRV) model By capturing the spatiotem-poral dynamics of the wormrsquos propagation process thesemodels define equilibrium points using the basic re-productive number R0 and then assess the stability of thesystem at these points [18 19]

Dagon et al [20] discovered the law of botnet propa-gation affected by time and region based on the continuousmonitoring of botnet and constructed a diurnal propagationmodel to characterize botnet infection Todd Gardner et al[21] researched botnet from the perspective of user behaviorand found that we can mitigate the frequency of IoT botnetattacks with improved user information which may posi-tively affect user behavior this can be used to predict userbehavior after the botnet attack

22 Dynamics on Complex Network With the developmentof complex networks and communication dynamics manyphenomena in the fields of computer science biology

sociology and economics are characterized by ldquopropagationdynamics on complex networksrdquo and the methods to revealtheir propagation laws are widely used [22ndash24]

In the field of Internet the recent frequent extortion ofransomware such as Wannacry Petya Scarab etc hascaused great losses to individuals and enterprises [25ndash27]For rumor spreading ordinary users often receive opinionsfrom opinion leaders and people they are familiar with it is achallenging problem to evaluate the influence of differentinformation spreading ways on user adoption erefore itis necessary to conduct research on this hybrid propagationphenomenon and understand its law of transmission so as tofurther take effective countermeasures

Research on social contagion mechanism and corre-sponding control strategies is one of the hotspots of currentresearch At present scholars have carried out a lot of researchon the impact of the heterogeneity of individual adoptionbehavior heterogeneity of network structure memory ofindividual adoption behavior nonredundant contagion andincomplete neighborhood spreading on social propagation Inreality memory usually plays an important role on adoptionenhancement for social contagion For instance whensomeone hears amessage frommany people it is believed thatthe credibility of information will be greatly improved Whenreceiving a number of disguised emails with viruses theprobability of computer infection will also increase because itis more likely to be misclicked is memory effect makes thedynamics of social contagion non-Markovian Consideringthe memory effect a modeling method based on non-Markovmodel is proposed in [28ndash30] Generally speaking a node canreceive the cumulative information about specific social be-havior either in a redundant or nonredundant manner [31]where the former allows a pair of individuals to successfullytransmit information many times but for the latter repetitivetransmission is prohibited Previous studies on nonredundantinformation transmission characteristics of society have beenrelatively few [30 32 33] It is of great significance to un-derstand the dynamics of transmission with nonredundantinformation memory effect in hybrid spreading situation

3 Model Descriptions

In this section we give the model of botnet propagation inhybrid spreading scenario to characterize the comprehen-sive effect on target node It can reflect the fact that medicaldevices can be infected by local area nodes or internetterminals with different impacts For the network G com-posed ofN nodes the average degree is langkrang and the degree ofnode i is ki e nodes participate in one of the propagationswith a certain probability in each time slice For node iduring each round of propagation it will involve in localpropagation or global propagation with probability α wenote this kind of propagation as single in one time slice(SIOT) Correspondingly for the situation that node i canreceive messages from both local and global propagation wename it as double in one time slice (DIOT)

In order to describe the heterogeneous credibility ofinformation received from the local and the global sources inthe case of mixed propagation we assume that the local

Security and Communication Networks 3

propagation threshold and the global propagation thresholdare different and the global propagation information isreceived as a nonredundant memory process each nodeinformation can only be passed once to the target node Asshown in Figure 1 the target node (black) can receive in-formation from the local neighbor infected nodes (green)and global infected nodes

In the case of local propagation nodes are more likely toadopt corresponding ideas or infect similar viruses so we setthe threshold of local contagion to 1 e infected neighbornode j infects node i with probability lambda that is theprobability of accepting information from local propagationper round is λL αλ Similarly node i participates in globalpropagation with probability 1 minus α and the rate isλG (1 minus α)λ Due to the large number of nodes in thewhole network we introduce the global parameter ϵ tocontrol the node scale in propagation the global nodeparticipating in the propagation of i is Nϵ and the numberof participating global nodes can be adjusted by the pa-rameter ϵ In the global propagation situation the Internetattack node randomly scans the target user for botnetpropagation and randomly sends the message forpropagation

Compared with local propagation the informationcredibility from global channel is less trustworthyereforewe set the threshold as T and it is satisfied that each nodereceives broadcast information of other nodes no more thanonce In addition since the number of global nodes is muchlarger than that of local nodes in the modeling process tosimplify processing the global propagation node includesneighbor nodes of node i

For the dynamic modeling of network propagationprocess this paper references the SAR (Susceptible-Adopted-Recovered) model At any time any node in thenetwork is in one of these three states as shown inFigure 2 S represents susceptible state indicating that anode in the network can be infected A represents in-fected state indicating that a node in the network hasbeen infected and R represents recovery state indicatingthat the infected node in the network has changed to arecovery state and can no longer participate in the follow-up process

In each propagation round we assume that one nodecan participate in either global or local contagion one timeif the node state is S for nodes in A state it can try once forrecovering to R state by sampling c For the mixedpropagation of different intensity propagation sources weare concerned about the outbreak threshold characteris-tics especially the first-order phase transition We furtherinvestigate the impact on the final adoption size underdifferent hybrid ratios of mixed propagation varioustransmission rates and initial seed ratio during thepropagation process

4 Theory

41 SIOT In this section we make use of generalizedheterogeneous edge-based compartmental theory based onthe previous work in [34ndash36] to describe our model and

characterize the hybrid propagation process based on edge-based compartmental theory for the analysis Although thesystem in [35] was proposed to analyze single-mechanism-based spreading for the continuous time case it can bemodified to be suitable for our model with hybrid propa-gation for discrete time and nonredundant informationmemory characteristic We calculate the probability that arandom test node u is in each state susceptible S(t) infectedA(t) and recovered R(t)

We define the probability that a node has degree k isp(k) it means the number of neighbors of node u for localspreading is k e generating function of degree distribu-tion p(k) is defined as g(x) 1113936kp(k)xk where pn(k)

means the probability that for a random neighbor of u it hask edges We assume the degrees of the two end nodes of eachedge are independent

In an uncorrelated network pn(k) kp(k)langkrang wherelangkrang is the average degree of the network we denote θt as theprobability that a random neighbor v has not infected uthrough local path Let ϑt be the probability that global nodew has not infected u through global path

Suppose u has k neighbors the probability that it issusceptible is decided by local and global spreading resultFor local propagation we assume the infection threshold is1 ie whenever node u receives one message from neigh-bors it will be infected so we can get SL( k

rarr t) θ k

t for nodeswhich have degree k For global propagation influenced bythe factors like low trust and environment heterogeneity weassume the infection threshold is T and T is greater than orequal to 1 at time t the probability of node u not infectedthrough global spreading is

SG( krarr

t) N minus 1

m1113888 1113889ϑNminus 1minus m

t 1 minus ϑt( 1113857m

(1)

where n is the number of nodes attending in the propa-gation So at time t the probability that node u is in thesusceptible state can be written as

S( krarr

t) θkt 1113944

Tminus 1

m0

N minus 1

m1113888 1113889ϑNminus 1minus m

t 1 minus ϑt( 1113857m

(2)

en by averaging S( krarr

t) over all degrees the initialratio of nodes in adopted state is ρ0 and we have

S(t) 1 minus ρ0( 1113857 1113944k

p(k)θ kt 1113944

Tminus 1

m0

N minus 1

m1113888 1113889ϑNminus 1minus m

t 1 minus ϑt( 1113857m

(3)

A neighbor of individual u may be in one of susceptibleadopted or recovered states We can thus further express θt

as

θt ϕS(t) + ϕA(t) + ϕR(t) (4)

where ϕS(t) ϕA(t) ϕR(t) is the probability that a neighborof the individual u is in the state of susceptible adopted orrecovered and has not transmitted the information to

4 Security and Communication Networks

individual u by time t We need to seek the solution of threepossibilities Assume a neighboring individual v of u is in thesusceptible state at start point it cannot transmit the in-formation to u Individual v can get the information from itsother neighbors since u is in a cavity state Neighbor v

cannot be infected by u and itself then

ϕS(t) 1 minus ρ0( 1113857 1113944k

kp(k)θkminus 1t

N minus 2m

1113888 1113889 1113944

Tminus 1

m0ϑNminus 2minus m

t

1 minus ϑt( 1113857m

langkrang

(5)

We further investigate ϕR(t) it should satisfy the defi-nition that an adopted neighbor has not transmitted theinformation to u via its connection and with probability c

the adopted neighbor to be recovered According to theanalysis above we get

dϕR(t)

dt c 1 minus λL( 1113857ϕA(t) (6)

At time t the rate of change in the probability that arandom edge has not transmitted the information is equal tothe rate at which the adopted neighbors transmit the in-formation to their susceptible neighboring individualsthrough edges us we get

dθ(t)

dt minus λLϕA(t) (7)

Combining equations (6) and (7) we obtain

ϕR(t) c(1 minus θ(t)) 1 minus λL( 1113857

λL

(8)

dθ(t)

dt minus λL θ(t) minus ϕS(t) minus ϕR(t)( 1113857 (9)

Substitute equations (8) and (5) into equation (7) Doingso we can rewrite equation (6) as

dθ(t)

dt λL 1113944

k

kp(k)

langkrangθkminus 1

t

N minus 2

m

⎛⎝ ⎞⎠ 1113944

Tminus 1

m0ϑNminus 2minus m

t 1 minus ϑt( 1113857m

+ c(1 minus θ(t)) 1 minus λL( 1113857 minus λLθ(t)

(10)

We can write ϑt as

ϑt φS(t) + φA(t) + φR(t) (11)

In the same way with local spreading for globalpropagation we take into account the weak relationshipwith global nodes the threshold for state change from

Node u gets into adopted state

Receive message from adopted neighbor

rate is λL T = 1

Receive message from global nodes

rate is λG T = 3

Sample hybrid ratio

Node u gets into recovery state

Node u is in susceptible stateat the beginning

If infected

Sample recovery

No

Yes

ltα geα

ltγ

geγ

Figure 2e flow chart of node state transferring in each spread phase a node will act in either local or global propagation according to thesample result

Security and Communication Networks 5

susceptible state to adopted state is T that is a nodeshould at least receive T messages from global spreadingand then it can trigger state change en φS(t) can bewritten as

φS(t) 1 minus ρ0( 1113857 1113944K

p(k)θkt

N minus 2

m

⎛⎝ ⎞⎠ 1113944

Tminus 1

m0ϑNminus 2minus m

t 1 minus ϑt( 1113857m

(12)

So φR(t) is

φR(t) c(1 minus ϑ(t)) 1 minus λG( 1113857

λG

(13)

en we can get

dϑ(t)

dt λG 1113944

K

p(k)θkt

N minus 2

m

⎛⎝ ⎞⎠ 1113944

Tminus 1

m0ϑNminus 2minus m

t 1 minus ϑt( 1113857m

+ c(1 minus ϑ(t)) 1 minus λG( 1113857 minus λGϑ(t)

(14)

We know S(t) + A(t) + R(t) 1 at time t note that therate dA(t)dt is equal to the rate at which S(t) decreasesbecause all the individuals moving out of the susceptiblestate must move into the adopted state minus therate at which adopted individuals become recovered Wehave

dA(t)

dt minus

dS(t)

dtminus cA(t) (15)

dR(t)

dt cA(t) (16)

According to the deduction above we can have thegeneral description of social contagion dynamics so that wecan calculate the probability that node u has not receivedenough messages for state changing

θ(infin) 1113944k

kp(k)

langkrangθkminus 1

(infin)

N minus 2

m

⎛⎜⎜⎝ ⎞⎟⎟⎠ 1113944

Tminus 1

m0ϑNminus 2minus m

(infin) 1 minus ϑinfin( 1113857m

+c(1 minus θ(infin)) 1 minus λL( 1113857

λL

(17)

ϑ(infin) 1113944k

p(k)θkinfin

N minus 2m

1113888 1113889 1113944

Tminus 1

m0ϑNminus 2minus minfin 1 minus ϑinfin( 1113857

m

+c(1 minus ϑ(infin)) 1 minus λG( 1113857

λG

(18)

Now we analyze the critical information transmissionprobability Since we have already assumed that Tgt 1 tostudy the memory reinforcement a vanishingly smallfraction of seeds cannot trigger a global behavior adoptionIn this situation θx(infin) 1 is not a solution of the followingequation

zfL(θ(infin) ϑ(infin))

zθ(infin)

zfG(θ(infin) ϑ(infin))

zϑ(infin) 1 (19)

From theory analysis we can capture first-order phasetransition at the critical point where the condition is ful-filled We assume A(infin) 0 then R(infin) 1 minus S(infin) wecan calculate R(infin) as final adoption size

42 DIOT For the theory introduced above it assumes thata node can participate in only one type of spreading in eachtime slice either local or global propagation In realitydifferent propagation may act on nodes at the same time sowe also carry out research on this scenario

In alternative hybrid contagion the spreading rate forlocal and global propagation is λL αλ and λG (1 minus α)λrespectively while λL + λG λ Different from alternativehybrid contagion the spreading rate of parallel hybridcontagion does not have such constraints and λL and λG areisolated

To further explore the contribution of two spreadingmethods in hybrid propagation we introduce globespreading rate control factor ζ let λG λLζ by doing thiswe can get the variety of final adoption size versus differentglobal transmission rate So equations (17) and (18) can bewritten as

θ(infin) 1113944k

kp(k)

langkrangθ kminus 1

(infin)

N minus 2

m

⎛⎜⎜⎜⎜⎝ ⎞⎟⎟⎟⎟⎠ 1113944

Tminus 1

m0ϑNminus 2minus m

(infin) 1 minus ϑinfin( 1113857m

+c(1 minus θ(infin))(1 minus λ)

λ

(20)

ϑ(infin) 1113944k

p(k)θkinfin

N minus 2m

1113888 1113889 1113944

Tminus 1

m0ϑNminus 2minus minfin 1 minus ϑinfin( 1113857

m

+c(1 minus ϑ(infin))(1 minus λζ)

λζ

(21)

5 Simulation

51 SimulationMethod Based on the theory analysis of thebotnet spreading progress we perform numerical simu-lations to study our proposed hybrid contagion modelusing ErdosndashRenyi (ER) network model [37] andBarabasindashAlbert (BA) network with power-law degreedistribution for our simulations [8] For medical IoT themedical equipment or sensors are always deployed indiagnosis and treatment room or datacenter in general itis hard to infect them by email attachments as commonlyseen in computer e most possible attack vector is wiredor wireless network intrusion and hardware addition byhuman intervention which can be categorized as localpropagation we can model these possible propagationchannels with hybrid spreading model An overview of theproposed numerical simulation program is shown in

6 Security and Communication Networks

Algorithm 1 In initiation phase ER network generationand parameter settings need to be handled first We usethe open-source package NetworkX [38] to producenetwork ER network G the network size is 10000 networknodes and the average degree is langkrang 10

We randomly set 5 nodes in adopted state ρ0 5104 Ateach experiment according to the variable that needs to beinvestigated parameters like local propagation probabilityλL global propagation probability λG threshold T recoveryrate c hybrid ratio α and globe scope controller ϵ are setrespectively In most cases we set the scope parameterϵ 0004 that is in each transmission node u will receivemessages from 40 global nodes For each experiment werepeat a thousand times and take the average value assimulation result

52 SIOT in ER Network We first study the effects ofhybrid ratio α on social contagions in ER networks Asshown in Figure 3 the hybrid ratio changes the growthpattern of the final behavior adoption size R(infin) versusthe information transmission probability λ From thefigure we can see that when λ 01 the final adoptionsize R(infin) is varied with α increments When α value issmall the local propagation contributes less and it ishard to outbreak when initial seeds are few Nonethelesswhen α gets higher more chances are there for the nodeto receive message from neighbors as we aforemen-tioned the threshold is 1 so it will promote the proba-bility of nodes in susceptible state to get into adoptedstate When more nodes are in adopted state for globalpropagation it is much easier to receive more messagesthan threshold for state changing Furthermore when αkeeps on augmenting larger than the outbreak value thefinal adoption size will gradually decline and ascendafterwards Our theoretical predictions agree well withthe numerical results e differences between the the-oretical and numerical predictions are caused by thestrong dynamical correlations among the states ofneighbors

We further identify the outbreak threshold by thevariability measure which is a standard measure to de-termine the critical point in equilibrium phase onmagnetic system to reflect the fluctuation of the outbreaksize for different α

δ

R2 minus langRrang21113969

langRrang (22)

When we fix the hybrid ratio α the growth patternof R(infin) versus transmission rate λ can be observedFigure 4

We further investigate the relation between hybridratio α and final adoption size R(infin)rsquos variation law bycalculating the relative change rate of R(infin) we canderive the variation pattern It can be seen from Figure 5that with the increase of α the burst threshold decreasesindicating that local propagation still plays a dominantrole in the mixed propagation process e variability

exhibits a peak over a wide range of λ In our model weintroduce parameter ϵ to control the size of nodes joiningin global propagation the reason behind this is althoughnode u can receive message from any node in the global

λ = 05λ = 07

λ = 03λ = 015 λ = 01

0

02

04

06

08

1

12

R (infin

)

01 06 070 050302 08 09 104α

Figure 3 Propagation with fixed λ e final behavior adoptionsize R(infin) versus the hybrid ratio α with fixed informationtransmission probability λ 01 015 03 05 07 respectivelye lines are the theoretical predictions and the dots are thesimulation results

Initialization(1) Network generation(2) Parameters initialization

begin(1) newState[]lt- hisState[](2) for any node ni in N(3) if node state is susceptiblesample propagation

method with α(4) if local(5) get neighbor nodes list from G and node state

from hisState[](6) for any node in neighbor[](7) if node state is infected then(8) infect node ni with λL(9) if count gt 1 update newState[](10) else if global(11) get Nϵ global nodes global[] from G and

node state from hisState[](12) for any node in global[](13) if node state is infected(14) infect node ni with λG and update count of

received messages(15) if count gt T update newState[](16) else if node state is infected(17) to recover with probability c(18) update newState[](19) hisState[]lt- newState[]

calculate R and refresh loop parameters(20) end

Output final adoption size R

ALGORITHM 1 Numerical simulation pseudocode

Security and Communication Networks 7

method in each round it can be affected by only a few ofthem

As shown in Figure 6 as ϵ increases it is faster to reachthe outbreak threshold value In the same way we furtherstudy the effects of c on the spreading behavior By settingα 05 and ϵ 0004 we can investigate how the recoveryrate c influences final adoption size R as shown in Figure 7It visually demonstrated the change of outbreak threshold ofλ larger c means slower outbreaks Finally we focus on theimpact of the different memory threshold T on the propa-gation range In our model we use parameter T to adjust theinformation credibility which means for large T value moreinformation needs to be received to change its status asshown in Figure 8

53 SIOT in BA Network e BA network is one of theclassical scale-free networks whose degree distribution

follows a power law e first scale-free model theBA model has a linear preferential attachment 1113937 (ki)

ki1113936jkj and adds one new node at every time step us ingeneral 1113937 (k) has the form 1113937 (k) A + kα where A is theinitial attractiveness of the node We also set the networkscale as 10000 nodes langkrang 10 and ρ 5104 Otherparameters are set as follows threshold T 3 for global con-tagion recovery rate is c 05 and globe scope controller isϵ 0004

Firstly we can find in Figure 9 that nodes propagate fasterin the BA network than in the ER network in the case of sameaverage degree Because BA network has unbiased degreedistribution large degree nodes havemore neighbors to fosterinformation propagation We also find the phenomenon thatfinal adoption size changes from decline to rise as α increasesCompared with the ER network the BA network has 30decrease when it reached the peak value when λ 01 greateramplitude of oscillation was caused by difference in degree

0

01

02

03

04

05

06

07

08

09

1

R (infin

)

01 02 03 04 05 06 07 08 09 100λ

α = 06α = 05α = 04

α = 03α = 02

Figure 5 e variation of final adoption size R(infin) versus different λ with different hybrid ratio α

α = 09

α = 07

α = 05α = 03 α = 01

λ

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 05 06 07 08 09 10

Figure 4 e final behavior adoption size R(infin) versus the information transmission probability λ with fixed hybrid ratioα 01 03 05 07 09 respectively e lines are the theoretical predictions and the dots are the simulation results

8 Security and Communication Networks

distribution Generally the BA network can reach the burstthreshold much faster than the ER network under the samelambda condition as shown in Figure 10 In the same way wefixed hybrid ratio α and observed the change of final adoption

size with spreading rate from Figure 11 it can be seen thatwhen global propagation dominates it spreads faster than theER network but when the local propagation ratio increasesthe difference between these two network gets smaller

γ = 01γ = 03γ = 05

γ = 08γ = 10

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 050λ

Figure 7 Final adoption size varied with c while keeping other parameters unchanged

02

04

06

08

1

α

00102030405060708091

01λ

02 03 04

(a)

00102030405060708091

02

04

06

08

1

α

01λ

02 03 04

(b)

02

01λ

02 03 04

04

06

08

1

α

00102030405060708091

(c)

λ01 02 03 04

00102030405060708091

02

04

06

08

1

α

(d)

Figure 6 Final adoption size varied with ϵ ϵ value is 00035 0004 00045 and 0005 respectively from (a) to (d)

Security and Communication Networks 9

54 DIOT For the model introduced above it assumes that anode can participate in only one type of spreading in each timeslice either local or global propagation In reality differentpropagationsmay act on nodes at the same time sowe also carryout research on this scenario

In SIOT hybrid contagion the spreading rate for localand global propagation is λL αλ and λG (1 minus α)λ re-spectively while λL + λG λ the parameter α is used to

adjust contagion attendance for different propagationsCompared with SIOT hybrid contagion the spreading rateof DIOT does not have such constraints λL and λG areisolated this also means that a node can receive messagesfrom local or global nodes in same time slice e in-formation transmission flow can be seen in Figure 12 Be-sides this trivial difference other transmission parametersand contagion process are the same with SIOT hybrid

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(a)

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(b)

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(c)

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(d)

Figure 8 Final adoption size varied with T (a) to (d) illustrate the result of T1 T 2 T 3 and T 4 respectively

01

005 01 015 02 025 03 035 04 045 05

02

03

04

05

06

07

08

09

1 1

09

08

07

06

05

04

03

02

01

0

λ

α

Figure 9 Final adoption size varied with ϵ in BA network ϵ value is00035 0004 00045 and 0005 respectively

λ = 03

λ = 05

λ = 07

λ = 01λ = 015

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 05 06 07 08 09 100α

Figure 10 Final adoption size varied with α in SIOT

10 Security and Communication Networks

transmission For illustration convenience we set λL λ andintroduced global transmission rate scale parameter ζ tochange transmission rate of λG that is λG λζ the value ofζ is from 1 to 100 As illustrated in Figure 13 we can find thatnodes spread in the DIOT mode can reach outbreakthreshold at lower λ than in the SIOTmodeWhen λ is largerthan 012 it may reach the outbreak threshold but if thevalue of λ is smaller than 0005 it can never outbreak e

final adoption size R(infin) changes with ζ as shown inFigure 14 we can find the multiple factor ζ can play a majorrole when its value is small and as it increases the globaltransmission rate will be too small to affect the adoptionresult We can find from Figure 15 that changing the globalspreading rate can vary the approach speed to full outbreakbut the critical point is the same which means the dis-continuous growth is controlled by local propagation

α = 01α = 03α = 05

α = 07α = 09

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 05 06 07 08 09 10λ

Figure 11 Final adoption size varied with λ in SIOT

Node u gets into adopted state

No

Yes

ltγ

geγ

No

Yes

Node u gets into recovery state

Sample recovery

If infected

If infected

Receive message from global nodes

rate is λG T = 3

Receive message from adopted neighbor

rate is λL T = 1

Node u is in susceptible state atthe beginning

Figure 12 e flow chart of node state transferring in each spread phase a node will act in both local and global propagation

Security and Communication Networks 11

6 Conclusion

In this paper we studied the effects of hybrid propagationwith different spreading rates and memory reinforcementson botnet contagions We first proposed an informationcontagion model to describe the botnet spreading dynamicson complex networks We then developed a generalizedheterogeneous edge-based compartmental theory to de-scribe the proposed model

rough extensive numerical simulations on the ERnetwork and BA network we found that the growth patternof the final behavior size R(infin) versus the hybrid ratio αexhibits discontinuous pattern when fixed transmission rateλ is large But when λ is small R(infin) shows the phenomenonof fluctuation and at critical point it reaches peak value firstfollowed with small amplitude declining and gradually risingIn addition we also fixed the hybrid ratio α to analyze the finaladoption size R(infin) changing with transmission rate λ andthe growth pattern of R(infin) changing from continuous todiscontinuous is observed

For comparing the effect of different hybrid methodsSIOT and DIOT are proposed and the simulation result ispresented obviously DIOT can spread faster especiallywhen global transmission rate is high We finally studied theeffect of other parameters and found that memory thresholdT recovery rate c and global propagation range controller ϵcan affect R(infin) growing pattern respectively when T issmall it grows much faster because more seeds can begenerated and global spreading can contribute more Withincreasing c it gets slower to reach the burst value Alsoglobal range controller ϵ can change the pattern when ϵ getslarger it reaches critical value much faster By introducinghybrid propagation mechanism and spreading scope con-troller with memory character the method can supportmodeling different spreading scenarios flexibly but itsimplifies the life states of bot and the immune charac-teristics of nodes are not taken into account so our futurework will focus on these points

Our proposed theory agrees well with the numericalsimulations on ER and BA networksemodel proposed inthis paper can provide theoretical reference for hybridpropagation modeling of botnet in complex networks andalso provide guidance for medical industry to deal withbotnet threats

Data Availability

We conducted our experiment with the numerical simu-lation method without using any open dataset

Conflicts of Interest

e authors declare that there are no conflicts of interestregarding the publication of this paper

Acknowledgments

is study was financially supported in part by a program ofNational Natural Science Foundation of China (NSFC)

1090807060504030201

α

005 01 015 02 025 03 035 04λ

0908070605040302010

Figure 13 DIOT propagation e final behavior adoption sizeR(infin) versus the global transmission rate scale and localtransmission rate other parameters are N 10000 ϵ 0004T 3 and c 05 respectively e lines are the theoreticalpredictions

λ = 006

λ = 007

λ = 015

λ = 009λ = 01

λ = 03

λ = 008

λ = 0050

02

04

06

08

1

12

R (infin

)

10 20 30 40 50 60 70 80 90 1000ζ

Figure 14 Final adoption size R(infin) varied with ζ in DIOT

14 λ15 λ110 λ

12 λ13 λ

λ

0

02

04

06

08

1

12

R (infin

)

01 02 03 040λ

Figure 15 Final adoption size R(infin) varied with λ in DIOT

12 Security and Communication Networks

(grant nos 61272447 and 61802271) and in part by theFundamental Research Funds for the Central Universities(grant nos SCU2018D018 and SCU2018D022) is supportis gratefully acknowledged

References

[1] M Antonakakis T April M Bailey et al ldquoUnderstanding themirai botnetrdquo in Proceedings of the 26th USENIX SecuritySymposium pp 1093ndash1110 USENIX Security 17 VancouverBC Canada August 2017

[2] C Kolias G Kambourakis A Stavrou and J Voas ldquoDdos inthe IoT mirai and other botnetsrdquo Computer vol 50 no 7pp 80ndash84 2017

[3] D Chen N Zhang R Lu N Cheng K Zhang and Z QinldquoChannel precoding based message authentication in wirelessnetworks challenges and solutionsrdquo IEEE Network vol 33no 1 pp 99ndash105 2019

[4] D Chen N Zhang Z Qin et al ldquoS2M a lightweight acousticfingerprints-based wireless device authentication protocolrdquoIEEE Internet of ltings Journal vol 4 no 1 pp 88ndash100 2016

[5] Q Wang D Chen N Zhang Z Qin and Z Qin ldquoLACS alightweight label-based access control scheme in IoT-based5G caching contextrdquo IEEE Access vol 5 pp 4018ndash4027 2017

[6] K Zhang X Liang J Ni K Yang and X S Shen ldquoExploitingsocial network to enhance human-to-human infection anal-ysis without privacy leakagerdquo IEEE Transactions on De-pendable and Secure Computing vol 15 no 4 pp 607ndash6202016

[7] C Zhang S Zhou J C Miller I J Cox and B M ChainldquoOptimizing hybrid spreading in metapopulationsrdquo ScientificReports vol 5 no 1 p 9924 2015

[8] R M Anderson ldquoDiscussion the Kermack-McKendrickepidemic threshold theoremrdquo Bulletin of Mathematical Bi-ology vol 53 no 1-2 pp 3ndash32 1991

[9] M Newman Networks An Introduction Oxford UniversityPress Oxford UK 2010

[10] M Feily A Shahrestani and S Ramadass ldquoA survey of botnetand botnet detectionrdquo in Proceedings of the 2009 ltird In-ternational Conference on Emerging Security InformationSystems and Technologies pp 268ndash273 IEEE Athens GreeceJune 2009

[11] A Laha N Zhang H Wu D Chen and T Han ldquoOnlineproactive caching in mobile edge computing using bi-directional deep recurrent neural networkrdquo IEEE Internet ofltings Journal vol 6 no 3 pp 5520ndash5530 2019

[12] E Bertino and N Islam ldquoBotnets and internet of things se-curityrdquo Computer vol 50 no 2 pp 76ndash79 2017

[13] D Chen N Zhang N Cheng K Zhang Z Qin andX S Shen ldquoPhysical layer based message authentication withsecure channel codesrdquo IEEE Transactions on Dependable andSecure Computing p 1 2018

[14] Q Wang D Chen N Zhang Z Ding and Z Qin ldquoPCP aprivacy-preserving content-based publish-subscribe schemewith differential privacy in fog computingrdquo IEEE Accessvol 5 pp 17962ndash17974 2017

[15] D Acarali M Rajarajan N Komninos and B B ZarpelatildeoldquoModelling the spread of botnet malware in IoT-basedwireless sensor networksrdquo Security and CommunicationNetworks vol 2019 Article ID 3745619 13 pages 2019

[16] M Ajelli R Lo Cigno and A Montresor ldquoModeling botnetsand epidemic malwarerdquo in Proceedings of the 2010 IEEEInternational Conference on Communications pp 1ndash5 IEEECape Town South Africa May 2010

[17] M J Farooq and Q Zhu ldquoModeling analysis and mitigationof dynamic botnet formation in wireless IoT networksrdquo IEEETransactions on Information Forensics and Security vol 14no 9 pp 2412ndash2426 2019

[18] B K Mishra and D K Saini ldquoSEIRS epidemic model withdelay for transmission of malicious objects in computernetworkrdquo Applied Mathematics and Computation vol 188no 2 pp 1476ndash1482 2007

[19] A Singh A K Awasthi K Singh and P K SrivastavaldquoModeling and analysis of worm propagation in wirelesssensor networksrdquoWireless Personal Communications vol 98no 3 pp 2535ndash2551 2018

[20] D Dagon C C Zou andW Lee ldquoModeling botnet propagationusing time zonesrdquo in Proceedings of the NDSS Symposium 2006vol 6 pp 2ndash13 San Diego CA USA February 2006

[21] M Todd Gardner C C Beard and M Deep ldquoUsing seirsepidemicmodels for IoT botnets attacksrdquo in Proceedings of theDRCN 2017mdashDesign of Reliable Communication Networkspp 1ndash8 Munich Germany March 2017

[22] C Castellano S Fortunato and V Loreto ldquoStatistical physicsof social dynamicsrdquo Reviews of Modern Physics vol 81 no 2pp 591ndash646 2009

[23] J C Flack and R M DrsquoSouza ldquoe digital age and the futureof social network science and engineeringrdquo Proceedings of theIEEE vol 102 no 12 pp 1873ndash1877 2014

[24] R Pastor-Satorras C Castellano P Van Mieghem andA Vespignani ldquoEpidemic processes in complex networksrdquoReviews of Modern Physics vol 87 no 3 pp 925ndash979 2015

[25] V Constantin Craciun A Mogage and E Simion ldquoTrends indesign of ransomware virusesrdquo in International Conference onSecurity for Information Technology and Communicationspp 259ndash272 Springer Berlin Germany 2018

[26] S Mohurle and M Patil ldquoA brief study of wannacry threatransomware attack 2017rdquo International Journal of AdvancedResearch in Computer Science vol 8 no 5 2017

[27] A Zimba L Simukonda and M Chishimba ldquoDemystifyingransomware attacks reverse engineering and dynamic mal-ware analysis of wannacry for network and information se-curityrdquo Zambia ICT Journal vol 1 no 1 pp 35ndash40 2017

[28] S Aral and DWalker ldquoIdentifying influential and susceptiblemembers of social networksrdquo Science vol 337 no 6092pp 337ndash341 2012

[29] A Banerjee A G Chandrasekhar E Duflo and M O Jacksonldquoe diffusion ofmicrofinancerdquo Science vol 341 no 6144 article1236498 2013

[30] P S Dodds and D J Watts ldquoUniversal behavior in a gen-eralized model of contagionrdquo Physical Review Letters vol 92no 21 article 218701 2004

[31] D J Watts ldquoA simple model of global cascades on randomnetworksrdquo Proceedings of the National Academy of Sciencesvol 99 no 9 pp 5766ndash5771 2002

[32] P S Dodds and D J Watts ldquoA generalized model of socialand biological contagionrdquo Journal of lteoretical Biologyvol 232 no 4 pp 587ndash604 2005

[33] W Wang X-L Chen and L-F Zhong ldquoSocial contagionswith heterogeneous credibilityrdquo Physica A Statistical Me-chanics and Its Applications vol 503 pp 604ndash610 2018

[34] J C Miller ldquoA note on a paper by Erik Volz sir dynamics inrandom networksrdquo Journal of Mathematical Biology vol 62no 3 pp 349ndash358 2011

[35] W Wang M Tang P Shu and Z Wang ldquoDynamics of socialcontagions with heterogeneous adoption thresholds cross-over phenomena in phase transitionrdquo New Journal of Physicsvol 18 no 1 article 013029 2016

Security and Communication Networks 13

[36] W Wang M Tang H-F Zhang H Gao Y Do andZ-H Liu ldquoEpidemic spreading on complex networks withgeneral degree and weight distributionsrdquo Physical Review Evol 90 no 4 article 042803 2014

[37] P Erdos and A Renyi ldquoOn random graphs Irdquo PublicationesMathematicae Debrecen vol 6 pp 290ndash297 1959

[38] A Hagberg D Schult P Swart et al Networkx High pro-ductivity software for complex networks Webova Stra Nka2013 httpsnetworkxlanlgovwiki

14 Security and Communication Networks

propagation threshold and the global propagation thresholdare different and the global propagation information isreceived as a nonredundant memory process each nodeinformation can only be passed once to the target node Asshown in Figure 1 the target node (black) can receive in-formation from the local neighbor infected nodes (green)and global infected nodes

In the case of local propagation nodes are more likely toadopt corresponding ideas or infect similar viruses so we setthe threshold of local contagion to 1 e infected neighbornode j infects node i with probability lambda that is theprobability of accepting information from local propagationper round is λL αλ Similarly node i participates in globalpropagation with probability 1 minus α and the rate isλG (1 minus α)λ Due to the large number of nodes in thewhole network we introduce the global parameter ϵ tocontrol the node scale in propagation the global nodeparticipating in the propagation of i is Nϵ and the numberof participating global nodes can be adjusted by the pa-rameter ϵ In the global propagation situation the Internetattack node randomly scans the target user for botnetpropagation and randomly sends the message forpropagation

Compared with local propagation the informationcredibility from global channel is less trustworthyereforewe set the threshold as T and it is satisfied that each nodereceives broadcast information of other nodes no more thanonce In addition since the number of global nodes is muchlarger than that of local nodes in the modeling process tosimplify processing the global propagation node includesneighbor nodes of node i

For the dynamic modeling of network propagationprocess this paper references the SAR (Susceptible-Adopted-Recovered) model At any time any node in thenetwork is in one of these three states as shown inFigure 2 S represents susceptible state indicating that anode in the network can be infected A represents in-fected state indicating that a node in the network hasbeen infected and R represents recovery state indicatingthat the infected node in the network has changed to arecovery state and can no longer participate in the follow-up process

In each propagation round we assume that one nodecan participate in either global or local contagion one timeif the node state is S for nodes in A state it can try once forrecovering to R state by sampling c For the mixedpropagation of different intensity propagation sources weare concerned about the outbreak threshold characteris-tics especially the first-order phase transition We furtherinvestigate the impact on the final adoption size underdifferent hybrid ratios of mixed propagation varioustransmission rates and initial seed ratio during thepropagation process

4 Theory

41 SIOT In this section we make use of generalizedheterogeneous edge-based compartmental theory based onthe previous work in [34ndash36] to describe our model and

characterize the hybrid propagation process based on edge-based compartmental theory for the analysis Although thesystem in [35] was proposed to analyze single-mechanism-based spreading for the continuous time case it can bemodified to be suitable for our model with hybrid propa-gation for discrete time and nonredundant informationmemory characteristic We calculate the probability that arandom test node u is in each state susceptible S(t) infectedA(t) and recovered R(t)

We define the probability that a node has degree k isp(k) it means the number of neighbors of node u for localspreading is k e generating function of degree distribu-tion p(k) is defined as g(x) 1113936kp(k)xk where pn(k)

means the probability that for a random neighbor of u it hask edges We assume the degrees of the two end nodes of eachedge are independent

In an uncorrelated network pn(k) kp(k)langkrang wherelangkrang is the average degree of the network we denote θt as theprobability that a random neighbor v has not infected uthrough local path Let ϑt be the probability that global nodew has not infected u through global path

Suppose u has k neighbors the probability that it issusceptible is decided by local and global spreading resultFor local propagation we assume the infection threshold is1 ie whenever node u receives one message from neigh-bors it will be infected so we can get SL( k

rarr t) θ k

t for nodeswhich have degree k For global propagation influenced bythe factors like low trust and environment heterogeneity weassume the infection threshold is T and T is greater than orequal to 1 at time t the probability of node u not infectedthrough global spreading is

SG( krarr

t) N minus 1

m1113888 1113889ϑNminus 1minus m

t 1 minus ϑt( 1113857m

(1)

where n is the number of nodes attending in the propa-gation So at time t the probability that node u is in thesusceptible state can be written as

S( krarr

t) θkt 1113944

Tminus 1

m0

N minus 1

m1113888 1113889ϑNminus 1minus m

t 1 minus ϑt( 1113857m

(2)

en by averaging S( krarr

t) over all degrees the initialratio of nodes in adopted state is ρ0 and we have

S(t) 1 minus ρ0( 1113857 1113944k

p(k)θ kt 1113944

Tminus 1

m0

N minus 1

m1113888 1113889ϑNminus 1minus m

t 1 minus ϑt( 1113857m

(3)

A neighbor of individual u may be in one of susceptibleadopted or recovered states We can thus further express θt

as

θt ϕS(t) + ϕA(t) + ϕR(t) (4)

where ϕS(t) ϕA(t) ϕR(t) is the probability that a neighborof the individual u is in the state of susceptible adopted orrecovered and has not transmitted the information to

4 Security and Communication Networks

individual u by time t We need to seek the solution of threepossibilities Assume a neighboring individual v of u is in thesusceptible state at start point it cannot transmit the in-formation to u Individual v can get the information from itsother neighbors since u is in a cavity state Neighbor v

cannot be infected by u and itself then

ϕS(t) 1 minus ρ0( 1113857 1113944k

kp(k)θkminus 1t

N minus 2m

1113888 1113889 1113944

Tminus 1

m0ϑNminus 2minus m

t

1 minus ϑt( 1113857m

langkrang

(5)

We further investigate ϕR(t) it should satisfy the defi-nition that an adopted neighbor has not transmitted theinformation to u via its connection and with probability c

the adopted neighbor to be recovered According to theanalysis above we get

dϕR(t)

dt c 1 minus λL( 1113857ϕA(t) (6)

At time t the rate of change in the probability that arandom edge has not transmitted the information is equal tothe rate at which the adopted neighbors transmit the in-formation to their susceptible neighboring individualsthrough edges us we get

dθ(t)

dt minus λLϕA(t) (7)

Combining equations (6) and (7) we obtain

ϕR(t) c(1 minus θ(t)) 1 minus λL( 1113857

λL

(8)

dθ(t)

dt minus λL θ(t) minus ϕS(t) minus ϕR(t)( 1113857 (9)

Substitute equations (8) and (5) into equation (7) Doingso we can rewrite equation (6) as

dθ(t)

dt λL 1113944

k

kp(k)

langkrangθkminus 1

t

N minus 2

m

⎛⎝ ⎞⎠ 1113944

Tminus 1

m0ϑNminus 2minus m

t 1 minus ϑt( 1113857m

+ c(1 minus θ(t)) 1 minus λL( 1113857 minus λLθ(t)

(10)

We can write ϑt as

ϑt φS(t) + φA(t) + φR(t) (11)

In the same way with local spreading for globalpropagation we take into account the weak relationshipwith global nodes the threshold for state change from

Node u gets into adopted state

Receive message from adopted neighbor

rate is λL T = 1

Receive message from global nodes

rate is λG T = 3

Sample hybrid ratio

Node u gets into recovery state

Node u is in susceptible stateat the beginning

If infected

Sample recovery

No

Yes

ltα geα

ltγ

geγ

Figure 2e flow chart of node state transferring in each spread phase a node will act in either local or global propagation according to thesample result

Security and Communication Networks 5

susceptible state to adopted state is T that is a nodeshould at least receive T messages from global spreadingand then it can trigger state change en φS(t) can bewritten as

φS(t) 1 minus ρ0( 1113857 1113944K

p(k)θkt

N minus 2

m

⎛⎝ ⎞⎠ 1113944

Tminus 1

m0ϑNminus 2minus m

t 1 minus ϑt( 1113857m

(12)

So φR(t) is

φR(t) c(1 minus ϑ(t)) 1 minus λG( 1113857

λG

(13)

en we can get

dϑ(t)

dt λG 1113944

K

p(k)θkt

N minus 2

m

⎛⎝ ⎞⎠ 1113944

Tminus 1

m0ϑNminus 2minus m

t 1 minus ϑt( 1113857m

+ c(1 minus ϑ(t)) 1 minus λG( 1113857 minus λGϑ(t)

(14)

We know S(t) + A(t) + R(t) 1 at time t note that therate dA(t)dt is equal to the rate at which S(t) decreasesbecause all the individuals moving out of the susceptiblestate must move into the adopted state minus therate at which adopted individuals become recovered Wehave

dA(t)

dt minus

dS(t)

dtminus cA(t) (15)

dR(t)

dt cA(t) (16)

According to the deduction above we can have thegeneral description of social contagion dynamics so that wecan calculate the probability that node u has not receivedenough messages for state changing

θ(infin) 1113944k

kp(k)

langkrangθkminus 1

(infin)

N minus 2

m

⎛⎜⎜⎝ ⎞⎟⎟⎠ 1113944

Tminus 1

m0ϑNminus 2minus m

(infin) 1 minus ϑinfin( 1113857m

+c(1 minus θ(infin)) 1 minus λL( 1113857

λL

(17)

ϑ(infin) 1113944k

p(k)θkinfin

N minus 2m

1113888 1113889 1113944

Tminus 1

m0ϑNminus 2minus minfin 1 minus ϑinfin( 1113857

m

+c(1 minus ϑ(infin)) 1 minus λG( 1113857

λG

(18)

Now we analyze the critical information transmissionprobability Since we have already assumed that Tgt 1 tostudy the memory reinforcement a vanishingly smallfraction of seeds cannot trigger a global behavior adoptionIn this situation θx(infin) 1 is not a solution of the followingequation

zfL(θ(infin) ϑ(infin))

zθ(infin)

zfG(θ(infin) ϑ(infin))

zϑ(infin) 1 (19)

From theory analysis we can capture first-order phasetransition at the critical point where the condition is ful-filled We assume A(infin) 0 then R(infin) 1 minus S(infin) wecan calculate R(infin) as final adoption size

42 DIOT For the theory introduced above it assumes thata node can participate in only one type of spreading in eachtime slice either local or global propagation In realitydifferent propagation may act on nodes at the same time sowe also carry out research on this scenario

In alternative hybrid contagion the spreading rate forlocal and global propagation is λL αλ and λG (1 minus α)λrespectively while λL + λG λ Different from alternativehybrid contagion the spreading rate of parallel hybridcontagion does not have such constraints and λL and λG areisolated

To further explore the contribution of two spreadingmethods in hybrid propagation we introduce globespreading rate control factor ζ let λG λLζ by doing thiswe can get the variety of final adoption size versus differentglobal transmission rate So equations (17) and (18) can bewritten as

θ(infin) 1113944k

kp(k)

langkrangθ kminus 1

(infin)

N minus 2

m

⎛⎜⎜⎜⎜⎝ ⎞⎟⎟⎟⎟⎠ 1113944

Tminus 1

m0ϑNminus 2minus m

(infin) 1 minus ϑinfin( 1113857m

+c(1 minus θ(infin))(1 minus λ)

λ

(20)

ϑ(infin) 1113944k

p(k)θkinfin

N minus 2m

1113888 1113889 1113944

Tminus 1

m0ϑNminus 2minus minfin 1 minus ϑinfin( 1113857

m

+c(1 minus ϑ(infin))(1 minus λζ)

λζ

(21)

5 Simulation

51 SimulationMethod Based on the theory analysis of thebotnet spreading progress we perform numerical simu-lations to study our proposed hybrid contagion modelusing ErdosndashRenyi (ER) network model [37] andBarabasindashAlbert (BA) network with power-law degreedistribution for our simulations [8] For medical IoT themedical equipment or sensors are always deployed indiagnosis and treatment room or datacenter in general itis hard to infect them by email attachments as commonlyseen in computer e most possible attack vector is wiredor wireless network intrusion and hardware addition byhuman intervention which can be categorized as localpropagation we can model these possible propagationchannels with hybrid spreading model An overview of theproposed numerical simulation program is shown in

6 Security and Communication Networks

Algorithm 1 In initiation phase ER network generationand parameter settings need to be handled first We usethe open-source package NetworkX [38] to producenetwork ER network G the network size is 10000 networknodes and the average degree is langkrang 10

We randomly set 5 nodes in adopted state ρ0 5104 Ateach experiment according to the variable that needs to beinvestigated parameters like local propagation probabilityλL global propagation probability λG threshold T recoveryrate c hybrid ratio α and globe scope controller ϵ are setrespectively In most cases we set the scope parameterϵ 0004 that is in each transmission node u will receivemessages from 40 global nodes For each experiment werepeat a thousand times and take the average value assimulation result

52 SIOT in ER Network We first study the effects ofhybrid ratio α on social contagions in ER networks Asshown in Figure 3 the hybrid ratio changes the growthpattern of the final behavior adoption size R(infin) versusthe information transmission probability λ From thefigure we can see that when λ 01 the final adoptionsize R(infin) is varied with α increments When α value issmall the local propagation contributes less and it ishard to outbreak when initial seeds are few Nonethelesswhen α gets higher more chances are there for the nodeto receive message from neighbors as we aforemen-tioned the threshold is 1 so it will promote the proba-bility of nodes in susceptible state to get into adoptedstate When more nodes are in adopted state for globalpropagation it is much easier to receive more messagesthan threshold for state changing Furthermore when αkeeps on augmenting larger than the outbreak value thefinal adoption size will gradually decline and ascendafterwards Our theoretical predictions agree well withthe numerical results e differences between the the-oretical and numerical predictions are caused by thestrong dynamical correlations among the states ofneighbors

We further identify the outbreak threshold by thevariability measure which is a standard measure to de-termine the critical point in equilibrium phase onmagnetic system to reflect the fluctuation of the outbreaksize for different α

δ

R2 minus langRrang21113969

langRrang (22)

When we fix the hybrid ratio α the growth patternof R(infin) versus transmission rate λ can be observedFigure 4

We further investigate the relation between hybridratio α and final adoption size R(infin)rsquos variation law bycalculating the relative change rate of R(infin) we canderive the variation pattern It can be seen from Figure 5that with the increase of α the burst threshold decreasesindicating that local propagation still plays a dominantrole in the mixed propagation process e variability

exhibits a peak over a wide range of λ In our model weintroduce parameter ϵ to control the size of nodes joiningin global propagation the reason behind this is althoughnode u can receive message from any node in the global

λ = 05λ = 07

λ = 03λ = 015 λ = 01

0

02

04

06

08

1

12

R (infin

)

01 06 070 050302 08 09 104α

Figure 3 Propagation with fixed λ e final behavior adoptionsize R(infin) versus the hybrid ratio α with fixed informationtransmission probability λ 01 015 03 05 07 respectivelye lines are the theoretical predictions and the dots are thesimulation results

Initialization(1) Network generation(2) Parameters initialization

begin(1) newState[]lt- hisState[](2) for any node ni in N(3) if node state is susceptiblesample propagation

method with α(4) if local(5) get neighbor nodes list from G and node state

from hisState[](6) for any node in neighbor[](7) if node state is infected then(8) infect node ni with λL(9) if count gt 1 update newState[](10) else if global(11) get Nϵ global nodes global[] from G and

node state from hisState[](12) for any node in global[](13) if node state is infected(14) infect node ni with λG and update count of

received messages(15) if count gt T update newState[](16) else if node state is infected(17) to recover with probability c(18) update newState[](19) hisState[]lt- newState[]

calculate R and refresh loop parameters(20) end

Output final adoption size R

ALGORITHM 1 Numerical simulation pseudocode

Security and Communication Networks 7

method in each round it can be affected by only a few ofthem

As shown in Figure 6 as ϵ increases it is faster to reachthe outbreak threshold value In the same way we furtherstudy the effects of c on the spreading behavior By settingα 05 and ϵ 0004 we can investigate how the recoveryrate c influences final adoption size R as shown in Figure 7It visually demonstrated the change of outbreak threshold ofλ larger c means slower outbreaks Finally we focus on theimpact of the different memory threshold T on the propa-gation range In our model we use parameter T to adjust theinformation credibility which means for large T value moreinformation needs to be received to change its status asshown in Figure 8

53 SIOT in BA Network e BA network is one of theclassical scale-free networks whose degree distribution

follows a power law e first scale-free model theBA model has a linear preferential attachment 1113937 (ki)

ki1113936jkj and adds one new node at every time step us ingeneral 1113937 (k) has the form 1113937 (k) A + kα where A is theinitial attractiveness of the node We also set the networkscale as 10000 nodes langkrang 10 and ρ 5104 Otherparameters are set as follows threshold T 3 for global con-tagion recovery rate is c 05 and globe scope controller isϵ 0004

Firstly we can find in Figure 9 that nodes propagate fasterin the BA network than in the ER network in the case of sameaverage degree Because BA network has unbiased degreedistribution large degree nodes havemore neighbors to fosterinformation propagation We also find the phenomenon thatfinal adoption size changes from decline to rise as α increasesCompared with the ER network the BA network has 30decrease when it reached the peak value when λ 01 greateramplitude of oscillation was caused by difference in degree

0

01

02

03

04

05

06

07

08

09

1

R (infin

)

01 02 03 04 05 06 07 08 09 100λ

α = 06α = 05α = 04

α = 03α = 02

Figure 5 e variation of final adoption size R(infin) versus different λ with different hybrid ratio α

α = 09

α = 07

α = 05α = 03 α = 01

λ

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 05 06 07 08 09 10

Figure 4 e final behavior adoption size R(infin) versus the information transmission probability λ with fixed hybrid ratioα 01 03 05 07 09 respectively e lines are the theoretical predictions and the dots are the simulation results

8 Security and Communication Networks

distribution Generally the BA network can reach the burstthreshold much faster than the ER network under the samelambda condition as shown in Figure 10 In the same way wefixed hybrid ratio α and observed the change of final adoption

size with spreading rate from Figure 11 it can be seen thatwhen global propagation dominates it spreads faster than theER network but when the local propagation ratio increasesthe difference between these two network gets smaller

γ = 01γ = 03γ = 05

γ = 08γ = 10

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 050λ

Figure 7 Final adoption size varied with c while keeping other parameters unchanged

02

04

06

08

1

α

00102030405060708091

01λ

02 03 04

(a)

00102030405060708091

02

04

06

08

1

α

01λ

02 03 04

(b)

02

01λ

02 03 04

04

06

08

1

α

00102030405060708091

(c)

λ01 02 03 04

00102030405060708091

02

04

06

08

1

α

(d)

Figure 6 Final adoption size varied with ϵ ϵ value is 00035 0004 00045 and 0005 respectively from (a) to (d)

Security and Communication Networks 9

54 DIOT For the model introduced above it assumes that anode can participate in only one type of spreading in each timeslice either local or global propagation In reality differentpropagationsmay act on nodes at the same time sowe also carryout research on this scenario

In SIOT hybrid contagion the spreading rate for localand global propagation is λL αλ and λG (1 minus α)λ re-spectively while λL + λG λ the parameter α is used to

adjust contagion attendance for different propagationsCompared with SIOT hybrid contagion the spreading rateof DIOT does not have such constraints λL and λG areisolated this also means that a node can receive messagesfrom local or global nodes in same time slice e in-formation transmission flow can be seen in Figure 12 Be-sides this trivial difference other transmission parametersand contagion process are the same with SIOT hybrid

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(a)

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(b)

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(c)

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(d)

Figure 8 Final adoption size varied with T (a) to (d) illustrate the result of T1 T 2 T 3 and T 4 respectively

01

005 01 015 02 025 03 035 04 045 05

02

03

04

05

06

07

08

09

1 1

09

08

07

06

05

04

03

02

01

0

λ

α

Figure 9 Final adoption size varied with ϵ in BA network ϵ value is00035 0004 00045 and 0005 respectively

λ = 03

λ = 05

λ = 07

λ = 01λ = 015

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 05 06 07 08 09 100α

Figure 10 Final adoption size varied with α in SIOT

10 Security and Communication Networks

transmission For illustration convenience we set λL λ andintroduced global transmission rate scale parameter ζ tochange transmission rate of λG that is λG λζ the value ofζ is from 1 to 100 As illustrated in Figure 13 we can find thatnodes spread in the DIOT mode can reach outbreakthreshold at lower λ than in the SIOTmodeWhen λ is largerthan 012 it may reach the outbreak threshold but if thevalue of λ is smaller than 0005 it can never outbreak e

final adoption size R(infin) changes with ζ as shown inFigure 14 we can find the multiple factor ζ can play a majorrole when its value is small and as it increases the globaltransmission rate will be too small to affect the adoptionresult We can find from Figure 15 that changing the globalspreading rate can vary the approach speed to full outbreakbut the critical point is the same which means the dis-continuous growth is controlled by local propagation

α = 01α = 03α = 05

α = 07α = 09

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 05 06 07 08 09 10λ

Figure 11 Final adoption size varied with λ in SIOT

Node u gets into adopted state

No

Yes

ltγ

geγ

No

Yes

Node u gets into recovery state

Sample recovery

If infected

If infected

Receive message from global nodes

rate is λG T = 3

Receive message from adopted neighbor

rate is λL T = 1

Node u is in susceptible state atthe beginning

Figure 12 e flow chart of node state transferring in each spread phase a node will act in both local and global propagation

Security and Communication Networks 11

6 Conclusion

In this paper we studied the effects of hybrid propagationwith different spreading rates and memory reinforcementson botnet contagions We first proposed an informationcontagion model to describe the botnet spreading dynamicson complex networks We then developed a generalizedheterogeneous edge-based compartmental theory to de-scribe the proposed model

rough extensive numerical simulations on the ERnetwork and BA network we found that the growth patternof the final behavior size R(infin) versus the hybrid ratio αexhibits discontinuous pattern when fixed transmission rateλ is large But when λ is small R(infin) shows the phenomenonof fluctuation and at critical point it reaches peak value firstfollowed with small amplitude declining and gradually risingIn addition we also fixed the hybrid ratio α to analyze the finaladoption size R(infin) changing with transmission rate λ andthe growth pattern of R(infin) changing from continuous todiscontinuous is observed

For comparing the effect of different hybrid methodsSIOT and DIOT are proposed and the simulation result ispresented obviously DIOT can spread faster especiallywhen global transmission rate is high We finally studied theeffect of other parameters and found that memory thresholdT recovery rate c and global propagation range controller ϵcan affect R(infin) growing pattern respectively when T issmall it grows much faster because more seeds can begenerated and global spreading can contribute more Withincreasing c it gets slower to reach the burst value Alsoglobal range controller ϵ can change the pattern when ϵ getslarger it reaches critical value much faster By introducinghybrid propagation mechanism and spreading scope con-troller with memory character the method can supportmodeling different spreading scenarios flexibly but itsimplifies the life states of bot and the immune charac-teristics of nodes are not taken into account so our futurework will focus on these points

Our proposed theory agrees well with the numericalsimulations on ER and BA networksemodel proposed inthis paper can provide theoretical reference for hybridpropagation modeling of botnet in complex networks andalso provide guidance for medical industry to deal withbotnet threats

Data Availability

We conducted our experiment with the numerical simu-lation method without using any open dataset

Conflicts of Interest

e authors declare that there are no conflicts of interestregarding the publication of this paper

Acknowledgments

is study was financially supported in part by a program ofNational Natural Science Foundation of China (NSFC)

1090807060504030201

α

005 01 015 02 025 03 035 04λ

0908070605040302010

Figure 13 DIOT propagation e final behavior adoption sizeR(infin) versus the global transmission rate scale and localtransmission rate other parameters are N 10000 ϵ 0004T 3 and c 05 respectively e lines are the theoreticalpredictions

λ = 006

λ = 007

λ = 015

λ = 009λ = 01

λ = 03

λ = 008

λ = 0050

02

04

06

08

1

12

R (infin

)

10 20 30 40 50 60 70 80 90 1000ζ

Figure 14 Final adoption size R(infin) varied with ζ in DIOT

14 λ15 λ110 λ

12 λ13 λ

λ

0

02

04

06

08

1

12

R (infin

)

01 02 03 040λ

Figure 15 Final adoption size R(infin) varied with λ in DIOT

12 Security and Communication Networks

(grant nos 61272447 and 61802271) and in part by theFundamental Research Funds for the Central Universities(grant nos SCU2018D018 and SCU2018D022) is supportis gratefully acknowledged

References

[1] M Antonakakis T April M Bailey et al ldquoUnderstanding themirai botnetrdquo in Proceedings of the 26th USENIX SecuritySymposium pp 1093ndash1110 USENIX Security 17 VancouverBC Canada August 2017

[2] C Kolias G Kambourakis A Stavrou and J Voas ldquoDdos inthe IoT mirai and other botnetsrdquo Computer vol 50 no 7pp 80ndash84 2017

[3] D Chen N Zhang R Lu N Cheng K Zhang and Z QinldquoChannel precoding based message authentication in wirelessnetworks challenges and solutionsrdquo IEEE Network vol 33no 1 pp 99ndash105 2019

[4] D Chen N Zhang Z Qin et al ldquoS2M a lightweight acousticfingerprints-based wireless device authentication protocolrdquoIEEE Internet of ltings Journal vol 4 no 1 pp 88ndash100 2016

[5] Q Wang D Chen N Zhang Z Qin and Z Qin ldquoLACS alightweight label-based access control scheme in IoT-based5G caching contextrdquo IEEE Access vol 5 pp 4018ndash4027 2017

[6] K Zhang X Liang J Ni K Yang and X S Shen ldquoExploitingsocial network to enhance human-to-human infection anal-ysis without privacy leakagerdquo IEEE Transactions on De-pendable and Secure Computing vol 15 no 4 pp 607ndash6202016

[7] C Zhang S Zhou J C Miller I J Cox and B M ChainldquoOptimizing hybrid spreading in metapopulationsrdquo ScientificReports vol 5 no 1 p 9924 2015

[8] R M Anderson ldquoDiscussion the Kermack-McKendrickepidemic threshold theoremrdquo Bulletin of Mathematical Bi-ology vol 53 no 1-2 pp 3ndash32 1991

[9] M Newman Networks An Introduction Oxford UniversityPress Oxford UK 2010

[10] M Feily A Shahrestani and S Ramadass ldquoA survey of botnetand botnet detectionrdquo in Proceedings of the 2009 ltird In-ternational Conference on Emerging Security InformationSystems and Technologies pp 268ndash273 IEEE Athens GreeceJune 2009

[11] A Laha N Zhang H Wu D Chen and T Han ldquoOnlineproactive caching in mobile edge computing using bi-directional deep recurrent neural networkrdquo IEEE Internet ofltings Journal vol 6 no 3 pp 5520ndash5530 2019

[12] E Bertino and N Islam ldquoBotnets and internet of things se-curityrdquo Computer vol 50 no 2 pp 76ndash79 2017

[13] D Chen N Zhang N Cheng K Zhang Z Qin andX S Shen ldquoPhysical layer based message authentication withsecure channel codesrdquo IEEE Transactions on Dependable andSecure Computing p 1 2018

[14] Q Wang D Chen N Zhang Z Ding and Z Qin ldquoPCP aprivacy-preserving content-based publish-subscribe schemewith differential privacy in fog computingrdquo IEEE Accessvol 5 pp 17962ndash17974 2017

[15] D Acarali M Rajarajan N Komninos and B B ZarpelatildeoldquoModelling the spread of botnet malware in IoT-basedwireless sensor networksrdquo Security and CommunicationNetworks vol 2019 Article ID 3745619 13 pages 2019

[16] M Ajelli R Lo Cigno and A Montresor ldquoModeling botnetsand epidemic malwarerdquo in Proceedings of the 2010 IEEEInternational Conference on Communications pp 1ndash5 IEEECape Town South Africa May 2010

[17] M J Farooq and Q Zhu ldquoModeling analysis and mitigationof dynamic botnet formation in wireless IoT networksrdquo IEEETransactions on Information Forensics and Security vol 14no 9 pp 2412ndash2426 2019

[18] B K Mishra and D K Saini ldquoSEIRS epidemic model withdelay for transmission of malicious objects in computernetworkrdquo Applied Mathematics and Computation vol 188no 2 pp 1476ndash1482 2007

[19] A Singh A K Awasthi K Singh and P K SrivastavaldquoModeling and analysis of worm propagation in wirelesssensor networksrdquoWireless Personal Communications vol 98no 3 pp 2535ndash2551 2018

[20] D Dagon C C Zou andW Lee ldquoModeling botnet propagationusing time zonesrdquo in Proceedings of the NDSS Symposium 2006vol 6 pp 2ndash13 San Diego CA USA February 2006

[21] M Todd Gardner C C Beard and M Deep ldquoUsing seirsepidemicmodels for IoT botnets attacksrdquo in Proceedings of theDRCN 2017mdashDesign of Reliable Communication Networkspp 1ndash8 Munich Germany March 2017

[22] C Castellano S Fortunato and V Loreto ldquoStatistical physicsof social dynamicsrdquo Reviews of Modern Physics vol 81 no 2pp 591ndash646 2009

[23] J C Flack and R M DrsquoSouza ldquoe digital age and the futureof social network science and engineeringrdquo Proceedings of theIEEE vol 102 no 12 pp 1873ndash1877 2014

[24] R Pastor-Satorras C Castellano P Van Mieghem andA Vespignani ldquoEpidemic processes in complex networksrdquoReviews of Modern Physics vol 87 no 3 pp 925ndash979 2015

[25] V Constantin Craciun A Mogage and E Simion ldquoTrends indesign of ransomware virusesrdquo in International Conference onSecurity for Information Technology and Communicationspp 259ndash272 Springer Berlin Germany 2018

[26] S Mohurle and M Patil ldquoA brief study of wannacry threatransomware attack 2017rdquo International Journal of AdvancedResearch in Computer Science vol 8 no 5 2017

[27] A Zimba L Simukonda and M Chishimba ldquoDemystifyingransomware attacks reverse engineering and dynamic mal-ware analysis of wannacry for network and information se-curityrdquo Zambia ICT Journal vol 1 no 1 pp 35ndash40 2017

[28] S Aral and DWalker ldquoIdentifying influential and susceptiblemembers of social networksrdquo Science vol 337 no 6092pp 337ndash341 2012

[29] A Banerjee A G Chandrasekhar E Duflo and M O Jacksonldquoe diffusion ofmicrofinancerdquo Science vol 341 no 6144 article1236498 2013

[30] P S Dodds and D J Watts ldquoUniversal behavior in a gen-eralized model of contagionrdquo Physical Review Letters vol 92no 21 article 218701 2004

[31] D J Watts ldquoA simple model of global cascades on randomnetworksrdquo Proceedings of the National Academy of Sciencesvol 99 no 9 pp 5766ndash5771 2002

[32] P S Dodds and D J Watts ldquoA generalized model of socialand biological contagionrdquo Journal of lteoretical Biologyvol 232 no 4 pp 587ndash604 2005

[33] W Wang X-L Chen and L-F Zhong ldquoSocial contagionswith heterogeneous credibilityrdquo Physica A Statistical Me-chanics and Its Applications vol 503 pp 604ndash610 2018

[34] J C Miller ldquoA note on a paper by Erik Volz sir dynamics inrandom networksrdquo Journal of Mathematical Biology vol 62no 3 pp 349ndash358 2011

[35] W Wang M Tang P Shu and Z Wang ldquoDynamics of socialcontagions with heterogeneous adoption thresholds cross-over phenomena in phase transitionrdquo New Journal of Physicsvol 18 no 1 article 013029 2016

Security and Communication Networks 13

[36] W Wang M Tang H-F Zhang H Gao Y Do andZ-H Liu ldquoEpidemic spreading on complex networks withgeneral degree and weight distributionsrdquo Physical Review Evol 90 no 4 article 042803 2014

[37] P Erdos and A Renyi ldquoOn random graphs Irdquo PublicationesMathematicae Debrecen vol 6 pp 290ndash297 1959

[38] A Hagberg D Schult P Swart et al Networkx High pro-ductivity software for complex networks Webova Stra Nka2013 httpsnetworkxlanlgovwiki

14 Security and Communication Networks

individual u by time t We need to seek the solution of threepossibilities Assume a neighboring individual v of u is in thesusceptible state at start point it cannot transmit the in-formation to u Individual v can get the information from itsother neighbors since u is in a cavity state Neighbor v

cannot be infected by u and itself then

ϕS(t) 1 minus ρ0( 1113857 1113944k

kp(k)θkminus 1t

N minus 2m

1113888 1113889 1113944

Tminus 1

m0ϑNminus 2minus m

t

1 minus ϑt( 1113857m

langkrang

(5)

We further investigate ϕR(t) it should satisfy the defi-nition that an adopted neighbor has not transmitted theinformation to u via its connection and with probability c

the adopted neighbor to be recovered According to theanalysis above we get

dϕR(t)

dt c 1 minus λL( 1113857ϕA(t) (6)

At time t the rate of change in the probability that arandom edge has not transmitted the information is equal tothe rate at which the adopted neighbors transmit the in-formation to their susceptible neighboring individualsthrough edges us we get

dθ(t)

dt minus λLϕA(t) (7)

Combining equations (6) and (7) we obtain

ϕR(t) c(1 minus θ(t)) 1 minus λL( 1113857

λL

(8)

dθ(t)

dt minus λL θ(t) minus ϕS(t) minus ϕR(t)( 1113857 (9)

Substitute equations (8) and (5) into equation (7) Doingso we can rewrite equation (6) as

dθ(t)

dt λL 1113944

k

kp(k)

langkrangθkminus 1

t

N minus 2

m

⎛⎝ ⎞⎠ 1113944

Tminus 1

m0ϑNminus 2minus m

t 1 minus ϑt( 1113857m

+ c(1 minus θ(t)) 1 minus λL( 1113857 minus λLθ(t)

(10)

We can write ϑt as

ϑt φS(t) + φA(t) + φR(t) (11)

In the same way with local spreading for globalpropagation we take into account the weak relationshipwith global nodes the threshold for state change from

Node u gets into adopted state

Receive message from adopted neighbor

rate is λL T = 1

Receive message from global nodes

rate is λG T = 3

Sample hybrid ratio

Node u gets into recovery state

Node u is in susceptible stateat the beginning

If infected

Sample recovery

No

Yes

ltα geα

ltγ

geγ

Figure 2e flow chart of node state transferring in each spread phase a node will act in either local or global propagation according to thesample result

Security and Communication Networks 5

susceptible state to adopted state is T that is a nodeshould at least receive T messages from global spreadingand then it can trigger state change en φS(t) can bewritten as

φS(t) 1 minus ρ0( 1113857 1113944K

p(k)θkt

N minus 2

m

⎛⎝ ⎞⎠ 1113944

Tminus 1

m0ϑNminus 2minus m

t 1 minus ϑt( 1113857m

(12)

So φR(t) is

φR(t) c(1 minus ϑ(t)) 1 minus λG( 1113857

λG

(13)

en we can get

dϑ(t)

dt λG 1113944

K

p(k)θkt

N minus 2

m

⎛⎝ ⎞⎠ 1113944

Tminus 1

m0ϑNminus 2minus m

t 1 minus ϑt( 1113857m

+ c(1 minus ϑ(t)) 1 minus λG( 1113857 minus λGϑ(t)

(14)

We know S(t) + A(t) + R(t) 1 at time t note that therate dA(t)dt is equal to the rate at which S(t) decreasesbecause all the individuals moving out of the susceptiblestate must move into the adopted state minus therate at which adopted individuals become recovered Wehave

dA(t)

dt minus

dS(t)

dtminus cA(t) (15)

dR(t)

dt cA(t) (16)

According to the deduction above we can have thegeneral description of social contagion dynamics so that wecan calculate the probability that node u has not receivedenough messages for state changing

θ(infin) 1113944k

kp(k)

langkrangθkminus 1

(infin)

N minus 2

m

⎛⎜⎜⎝ ⎞⎟⎟⎠ 1113944

Tminus 1

m0ϑNminus 2minus m

(infin) 1 minus ϑinfin( 1113857m

+c(1 minus θ(infin)) 1 minus λL( 1113857

λL

(17)

ϑ(infin) 1113944k

p(k)θkinfin

N minus 2m

1113888 1113889 1113944

Tminus 1

m0ϑNminus 2minus minfin 1 minus ϑinfin( 1113857

m

+c(1 minus ϑ(infin)) 1 minus λG( 1113857

λG

(18)

Now we analyze the critical information transmissionprobability Since we have already assumed that Tgt 1 tostudy the memory reinforcement a vanishingly smallfraction of seeds cannot trigger a global behavior adoptionIn this situation θx(infin) 1 is not a solution of the followingequation

zfL(θ(infin) ϑ(infin))

zθ(infin)

zfG(θ(infin) ϑ(infin))

zϑ(infin) 1 (19)

From theory analysis we can capture first-order phasetransition at the critical point where the condition is ful-filled We assume A(infin) 0 then R(infin) 1 minus S(infin) wecan calculate R(infin) as final adoption size

42 DIOT For the theory introduced above it assumes thata node can participate in only one type of spreading in eachtime slice either local or global propagation In realitydifferent propagation may act on nodes at the same time sowe also carry out research on this scenario

In alternative hybrid contagion the spreading rate forlocal and global propagation is λL αλ and λG (1 minus α)λrespectively while λL + λG λ Different from alternativehybrid contagion the spreading rate of parallel hybridcontagion does not have such constraints and λL and λG areisolated

To further explore the contribution of two spreadingmethods in hybrid propagation we introduce globespreading rate control factor ζ let λG λLζ by doing thiswe can get the variety of final adoption size versus differentglobal transmission rate So equations (17) and (18) can bewritten as

θ(infin) 1113944k

kp(k)

langkrangθ kminus 1

(infin)

N minus 2

m

⎛⎜⎜⎜⎜⎝ ⎞⎟⎟⎟⎟⎠ 1113944

Tminus 1

m0ϑNminus 2minus m

(infin) 1 minus ϑinfin( 1113857m

+c(1 minus θ(infin))(1 minus λ)

λ

(20)

ϑ(infin) 1113944k

p(k)θkinfin

N minus 2m

1113888 1113889 1113944

Tminus 1

m0ϑNminus 2minus minfin 1 minus ϑinfin( 1113857

m

+c(1 minus ϑ(infin))(1 minus λζ)

λζ

(21)

5 Simulation

51 SimulationMethod Based on the theory analysis of thebotnet spreading progress we perform numerical simu-lations to study our proposed hybrid contagion modelusing ErdosndashRenyi (ER) network model [37] andBarabasindashAlbert (BA) network with power-law degreedistribution for our simulations [8] For medical IoT themedical equipment or sensors are always deployed indiagnosis and treatment room or datacenter in general itis hard to infect them by email attachments as commonlyseen in computer e most possible attack vector is wiredor wireless network intrusion and hardware addition byhuman intervention which can be categorized as localpropagation we can model these possible propagationchannels with hybrid spreading model An overview of theproposed numerical simulation program is shown in

6 Security and Communication Networks

Algorithm 1 In initiation phase ER network generationand parameter settings need to be handled first We usethe open-source package NetworkX [38] to producenetwork ER network G the network size is 10000 networknodes and the average degree is langkrang 10

We randomly set 5 nodes in adopted state ρ0 5104 Ateach experiment according to the variable that needs to beinvestigated parameters like local propagation probabilityλL global propagation probability λG threshold T recoveryrate c hybrid ratio α and globe scope controller ϵ are setrespectively In most cases we set the scope parameterϵ 0004 that is in each transmission node u will receivemessages from 40 global nodes For each experiment werepeat a thousand times and take the average value assimulation result

52 SIOT in ER Network We first study the effects ofhybrid ratio α on social contagions in ER networks Asshown in Figure 3 the hybrid ratio changes the growthpattern of the final behavior adoption size R(infin) versusthe information transmission probability λ From thefigure we can see that when λ 01 the final adoptionsize R(infin) is varied with α increments When α value issmall the local propagation contributes less and it ishard to outbreak when initial seeds are few Nonethelesswhen α gets higher more chances are there for the nodeto receive message from neighbors as we aforemen-tioned the threshold is 1 so it will promote the proba-bility of nodes in susceptible state to get into adoptedstate When more nodes are in adopted state for globalpropagation it is much easier to receive more messagesthan threshold for state changing Furthermore when αkeeps on augmenting larger than the outbreak value thefinal adoption size will gradually decline and ascendafterwards Our theoretical predictions agree well withthe numerical results e differences between the the-oretical and numerical predictions are caused by thestrong dynamical correlations among the states ofneighbors

We further identify the outbreak threshold by thevariability measure which is a standard measure to de-termine the critical point in equilibrium phase onmagnetic system to reflect the fluctuation of the outbreaksize for different α

δ

R2 minus langRrang21113969

langRrang (22)

When we fix the hybrid ratio α the growth patternof R(infin) versus transmission rate λ can be observedFigure 4

We further investigate the relation between hybridratio α and final adoption size R(infin)rsquos variation law bycalculating the relative change rate of R(infin) we canderive the variation pattern It can be seen from Figure 5that with the increase of α the burst threshold decreasesindicating that local propagation still plays a dominantrole in the mixed propagation process e variability

exhibits a peak over a wide range of λ In our model weintroduce parameter ϵ to control the size of nodes joiningin global propagation the reason behind this is althoughnode u can receive message from any node in the global

λ = 05λ = 07

λ = 03λ = 015 λ = 01

0

02

04

06

08

1

12

R (infin

)

01 06 070 050302 08 09 104α

Figure 3 Propagation with fixed λ e final behavior adoptionsize R(infin) versus the hybrid ratio α with fixed informationtransmission probability λ 01 015 03 05 07 respectivelye lines are the theoretical predictions and the dots are thesimulation results

Initialization(1) Network generation(2) Parameters initialization

begin(1) newState[]lt- hisState[](2) for any node ni in N(3) if node state is susceptiblesample propagation

method with α(4) if local(5) get neighbor nodes list from G and node state

from hisState[](6) for any node in neighbor[](7) if node state is infected then(8) infect node ni with λL(9) if count gt 1 update newState[](10) else if global(11) get Nϵ global nodes global[] from G and

node state from hisState[](12) for any node in global[](13) if node state is infected(14) infect node ni with λG and update count of

received messages(15) if count gt T update newState[](16) else if node state is infected(17) to recover with probability c(18) update newState[](19) hisState[]lt- newState[]

calculate R and refresh loop parameters(20) end

Output final adoption size R

ALGORITHM 1 Numerical simulation pseudocode

Security and Communication Networks 7

method in each round it can be affected by only a few ofthem

As shown in Figure 6 as ϵ increases it is faster to reachthe outbreak threshold value In the same way we furtherstudy the effects of c on the spreading behavior By settingα 05 and ϵ 0004 we can investigate how the recoveryrate c influences final adoption size R as shown in Figure 7It visually demonstrated the change of outbreak threshold ofλ larger c means slower outbreaks Finally we focus on theimpact of the different memory threshold T on the propa-gation range In our model we use parameter T to adjust theinformation credibility which means for large T value moreinformation needs to be received to change its status asshown in Figure 8

53 SIOT in BA Network e BA network is one of theclassical scale-free networks whose degree distribution

follows a power law e first scale-free model theBA model has a linear preferential attachment 1113937 (ki)

ki1113936jkj and adds one new node at every time step us ingeneral 1113937 (k) has the form 1113937 (k) A + kα where A is theinitial attractiveness of the node We also set the networkscale as 10000 nodes langkrang 10 and ρ 5104 Otherparameters are set as follows threshold T 3 for global con-tagion recovery rate is c 05 and globe scope controller isϵ 0004

Firstly we can find in Figure 9 that nodes propagate fasterin the BA network than in the ER network in the case of sameaverage degree Because BA network has unbiased degreedistribution large degree nodes havemore neighbors to fosterinformation propagation We also find the phenomenon thatfinal adoption size changes from decline to rise as α increasesCompared with the ER network the BA network has 30decrease when it reached the peak value when λ 01 greateramplitude of oscillation was caused by difference in degree

0

01

02

03

04

05

06

07

08

09

1

R (infin

)

01 02 03 04 05 06 07 08 09 100λ

α = 06α = 05α = 04

α = 03α = 02

Figure 5 e variation of final adoption size R(infin) versus different λ with different hybrid ratio α

α = 09

α = 07

α = 05α = 03 α = 01

λ

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 05 06 07 08 09 10

Figure 4 e final behavior adoption size R(infin) versus the information transmission probability λ with fixed hybrid ratioα 01 03 05 07 09 respectively e lines are the theoretical predictions and the dots are the simulation results

8 Security and Communication Networks

distribution Generally the BA network can reach the burstthreshold much faster than the ER network under the samelambda condition as shown in Figure 10 In the same way wefixed hybrid ratio α and observed the change of final adoption

size with spreading rate from Figure 11 it can be seen thatwhen global propagation dominates it spreads faster than theER network but when the local propagation ratio increasesthe difference between these two network gets smaller

γ = 01γ = 03γ = 05

γ = 08γ = 10

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 050λ

Figure 7 Final adoption size varied with c while keeping other parameters unchanged

02

04

06

08

1

α

00102030405060708091

01λ

02 03 04

(a)

00102030405060708091

02

04

06

08

1

α

01λ

02 03 04

(b)

02

01λ

02 03 04

04

06

08

1

α

00102030405060708091

(c)

λ01 02 03 04

00102030405060708091

02

04

06

08

1

α

(d)

Figure 6 Final adoption size varied with ϵ ϵ value is 00035 0004 00045 and 0005 respectively from (a) to (d)

Security and Communication Networks 9

54 DIOT For the model introduced above it assumes that anode can participate in only one type of spreading in each timeslice either local or global propagation In reality differentpropagationsmay act on nodes at the same time sowe also carryout research on this scenario

In SIOT hybrid contagion the spreading rate for localand global propagation is λL αλ and λG (1 minus α)λ re-spectively while λL + λG λ the parameter α is used to

adjust contagion attendance for different propagationsCompared with SIOT hybrid contagion the spreading rateof DIOT does not have such constraints λL and λG areisolated this also means that a node can receive messagesfrom local or global nodes in same time slice e in-formation transmission flow can be seen in Figure 12 Be-sides this trivial difference other transmission parametersand contagion process are the same with SIOT hybrid

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(a)

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(b)

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(c)

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(d)

Figure 8 Final adoption size varied with T (a) to (d) illustrate the result of T1 T 2 T 3 and T 4 respectively

01

005 01 015 02 025 03 035 04 045 05

02

03

04

05

06

07

08

09

1 1

09

08

07

06

05

04

03

02

01

0

λ

α

Figure 9 Final adoption size varied with ϵ in BA network ϵ value is00035 0004 00045 and 0005 respectively

λ = 03

λ = 05

λ = 07

λ = 01λ = 015

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 05 06 07 08 09 100α

Figure 10 Final adoption size varied with α in SIOT

10 Security and Communication Networks

transmission For illustration convenience we set λL λ andintroduced global transmission rate scale parameter ζ tochange transmission rate of λG that is λG λζ the value ofζ is from 1 to 100 As illustrated in Figure 13 we can find thatnodes spread in the DIOT mode can reach outbreakthreshold at lower λ than in the SIOTmodeWhen λ is largerthan 012 it may reach the outbreak threshold but if thevalue of λ is smaller than 0005 it can never outbreak e

final adoption size R(infin) changes with ζ as shown inFigure 14 we can find the multiple factor ζ can play a majorrole when its value is small and as it increases the globaltransmission rate will be too small to affect the adoptionresult We can find from Figure 15 that changing the globalspreading rate can vary the approach speed to full outbreakbut the critical point is the same which means the dis-continuous growth is controlled by local propagation

α = 01α = 03α = 05

α = 07α = 09

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 05 06 07 08 09 10λ

Figure 11 Final adoption size varied with λ in SIOT

Node u gets into adopted state

No

Yes

ltγ

geγ

No

Yes

Node u gets into recovery state

Sample recovery

If infected

If infected

Receive message from global nodes

rate is λG T = 3

Receive message from adopted neighbor

rate is λL T = 1

Node u is in susceptible state atthe beginning

Figure 12 e flow chart of node state transferring in each spread phase a node will act in both local and global propagation

Security and Communication Networks 11

6 Conclusion

In this paper we studied the effects of hybrid propagationwith different spreading rates and memory reinforcementson botnet contagions We first proposed an informationcontagion model to describe the botnet spreading dynamicson complex networks We then developed a generalizedheterogeneous edge-based compartmental theory to de-scribe the proposed model

rough extensive numerical simulations on the ERnetwork and BA network we found that the growth patternof the final behavior size R(infin) versus the hybrid ratio αexhibits discontinuous pattern when fixed transmission rateλ is large But when λ is small R(infin) shows the phenomenonof fluctuation and at critical point it reaches peak value firstfollowed with small amplitude declining and gradually risingIn addition we also fixed the hybrid ratio α to analyze the finaladoption size R(infin) changing with transmission rate λ andthe growth pattern of R(infin) changing from continuous todiscontinuous is observed

For comparing the effect of different hybrid methodsSIOT and DIOT are proposed and the simulation result ispresented obviously DIOT can spread faster especiallywhen global transmission rate is high We finally studied theeffect of other parameters and found that memory thresholdT recovery rate c and global propagation range controller ϵcan affect R(infin) growing pattern respectively when T issmall it grows much faster because more seeds can begenerated and global spreading can contribute more Withincreasing c it gets slower to reach the burst value Alsoglobal range controller ϵ can change the pattern when ϵ getslarger it reaches critical value much faster By introducinghybrid propagation mechanism and spreading scope con-troller with memory character the method can supportmodeling different spreading scenarios flexibly but itsimplifies the life states of bot and the immune charac-teristics of nodes are not taken into account so our futurework will focus on these points

Our proposed theory agrees well with the numericalsimulations on ER and BA networksemodel proposed inthis paper can provide theoretical reference for hybridpropagation modeling of botnet in complex networks andalso provide guidance for medical industry to deal withbotnet threats

Data Availability

We conducted our experiment with the numerical simu-lation method without using any open dataset

Conflicts of Interest

e authors declare that there are no conflicts of interestregarding the publication of this paper

Acknowledgments

is study was financially supported in part by a program ofNational Natural Science Foundation of China (NSFC)

1090807060504030201

α

005 01 015 02 025 03 035 04λ

0908070605040302010

Figure 13 DIOT propagation e final behavior adoption sizeR(infin) versus the global transmission rate scale and localtransmission rate other parameters are N 10000 ϵ 0004T 3 and c 05 respectively e lines are the theoreticalpredictions

λ = 006

λ = 007

λ = 015

λ = 009λ = 01

λ = 03

λ = 008

λ = 0050

02

04

06

08

1

12

R (infin

)

10 20 30 40 50 60 70 80 90 1000ζ

Figure 14 Final adoption size R(infin) varied with ζ in DIOT

14 λ15 λ110 λ

12 λ13 λ

λ

0

02

04

06

08

1

12

R (infin

)

01 02 03 040λ

Figure 15 Final adoption size R(infin) varied with λ in DIOT

12 Security and Communication Networks

(grant nos 61272447 and 61802271) and in part by theFundamental Research Funds for the Central Universities(grant nos SCU2018D018 and SCU2018D022) is supportis gratefully acknowledged

References

[1] M Antonakakis T April M Bailey et al ldquoUnderstanding themirai botnetrdquo in Proceedings of the 26th USENIX SecuritySymposium pp 1093ndash1110 USENIX Security 17 VancouverBC Canada August 2017

[2] C Kolias G Kambourakis A Stavrou and J Voas ldquoDdos inthe IoT mirai and other botnetsrdquo Computer vol 50 no 7pp 80ndash84 2017

[3] D Chen N Zhang R Lu N Cheng K Zhang and Z QinldquoChannel precoding based message authentication in wirelessnetworks challenges and solutionsrdquo IEEE Network vol 33no 1 pp 99ndash105 2019

[4] D Chen N Zhang Z Qin et al ldquoS2M a lightweight acousticfingerprints-based wireless device authentication protocolrdquoIEEE Internet of ltings Journal vol 4 no 1 pp 88ndash100 2016

[5] Q Wang D Chen N Zhang Z Qin and Z Qin ldquoLACS alightweight label-based access control scheme in IoT-based5G caching contextrdquo IEEE Access vol 5 pp 4018ndash4027 2017

[6] K Zhang X Liang J Ni K Yang and X S Shen ldquoExploitingsocial network to enhance human-to-human infection anal-ysis without privacy leakagerdquo IEEE Transactions on De-pendable and Secure Computing vol 15 no 4 pp 607ndash6202016

[7] C Zhang S Zhou J C Miller I J Cox and B M ChainldquoOptimizing hybrid spreading in metapopulationsrdquo ScientificReports vol 5 no 1 p 9924 2015

[8] R M Anderson ldquoDiscussion the Kermack-McKendrickepidemic threshold theoremrdquo Bulletin of Mathematical Bi-ology vol 53 no 1-2 pp 3ndash32 1991

[9] M Newman Networks An Introduction Oxford UniversityPress Oxford UK 2010

[10] M Feily A Shahrestani and S Ramadass ldquoA survey of botnetand botnet detectionrdquo in Proceedings of the 2009 ltird In-ternational Conference on Emerging Security InformationSystems and Technologies pp 268ndash273 IEEE Athens GreeceJune 2009

[11] A Laha N Zhang H Wu D Chen and T Han ldquoOnlineproactive caching in mobile edge computing using bi-directional deep recurrent neural networkrdquo IEEE Internet ofltings Journal vol 6 no 3 pp 5520ndash5530 2019

[12] E Bertino and N Islam ldquoBotnets and internet of things se-curityrdquo Computer vol 50 no 2 pp 76ndash79 2017

[13] D Chen N Zhang N Cheng K Zhang Z Qin andX S Shen ldquoPhysical layer based message authentication withsecure channel codesrdquo IEEE Transactions on Dependable andSecure Computing p 1 2018

[14] Q Wang D Chen N Zhang Z Ding and Z Qin ldquoPCP aprivacy-preserving content-based publish-subscribe schemewith differential privacy in fog computingrdquo IEEE Accessvol 5 pp 17962ndash17974 2017

[15] D Acarali M Rajarajan N Komninos and B B ZarpelatildeoldquoModelling the spread of botnet malware in IoT-basedwireless sensor networksrdquo Security and CommunicationNetworks vol 2019 Article ID 3745619 13 pages 2019

[16] M Ajelli R Lo Cigno and A Montresor ldquoModeling botnetsand epidemic malwarerdquo in Proceedings of the 2010 IEEEInternational Conference on Communications pp 1ndash5 IEEECape Town South Africa May 2010

[17] M J Farooq and Q Zhu ldquoModeling analysis and mitigationof dynamic botnet formation in wireless IoT networksrdquo IEEETransactions on Information Forensics and Security vol 14no 9 pp 2412ndash2426 2019

[18] B K Mishra and D K Saini ldquoSEIRS epidemic model withdelay for transmission of malicious objects in computernetworkrdquo Applied Mathematics and Computation vol 188no 2 pp 1476ndash1482 2007

[19] A Singh A K Awasthi K Singh and P K SrivastavaldquoModeling and analysis of worm propagation in wirelesssensor networksrdquoWireless Personal Communications vol 98no 3 pp 2535ndash2551 2018

[20] D Dagon C C Zou andW Lee ldquoModeling botnet propagationusing time zonesrdquo in Proceedings of the NDSS Symposium 2006vol 6 pp 2ndash13 San Diego CA USA February 2006

[21] M Todd Gardner C C Beard and M Deep ldquoUsing seirsepidemicmodels for IoT botnets attacksrdquo in Proceedings of theDRCN 2017mdashDesign of Reliable Communication Networkspp 1ndash8 Munich Germany March 2017

[22] C Castellano S Fortunato and V Loreto ldquoStatistical physicsof social dynamicsrdquo Reviews of Modern Physics vol 81 no 2pp 591ndash646 2009

[23] J C Flack and R M DrsquoSouza ldquoe digital age and the futureof social network science and engineeringrdquo Proceedings of theIEEE vol 102 no 12 pp 1873ndash1877 2014

[24] R Pastor-Satorras C Castellano P Van Mieghem andA Vespignani ldquoEpidemic processes in complex networksrdquoReviews of Modern Physics vol 87 no 3 pp 925ndash979 2015

[25] V Constantin Craciun A Mogage and E Simion ldquoTrends indesign of ransomware virusesrdquo in International Conference onSecurity for Information Technology and Communicationspp 259ndash272 Springer Berlin Germany 2018

[26] S Mohurle and M Patil ldquoA brief study of wannacry threatransomware attack 2017rdquo International Journal of AdvancedResearch in Computer Science vol 8 no 5 2017

[27] A Zimba L Simukonda and M Chishimba ldquoDemystifyingransomware attacks reverse engineering and dynamic mal-ware analysis of wannacry for network and information se-curityrdquo Zambia ICT Journal vol 1 no 1 pp 35ndash40 2017

[28] S Aral and DWalker ldquoIdentifying influential and susceptiblemembers of social networksrdquo Science vol 337 no 6092pp 337ndash341 2012

[29] A Banerjee A G Chandrasekhar E Duflo and M O Jacksonldquoe diffusion ofmicrofinancerdquo Science vol 341 no 6144 article1236498 2013

[30] P S Dodds and D J Watts ldquoUniversal behavior in a gen-eralized model of contagionrdquo Physical Review Letters vol 92no 21 article 218701 2004

[31] D J Watts ldquoA simple model of global cascades on randomnetworksrdquo Proceedings of the National Academy of Sciencesvol 99 no 9 pp 5766ndash5771 2002

[32] P S Dodds and D J Watts ldquoA generalized model of socialand biological contagionrdquo Journal of lteoretical Biologyvol 232 no 4 pp 587ndash604 2005

[33] W Wang X-L Chen and L-F Zhong ldquoSocial contagionswith heterogeneous credibilityrdquo Physica A Statistical Me-chanics and Its Applications vol 503 pp 604ndash610 2018

[34] J C Miller ldquoA note on a paper by Erik Volz sir dynamics inrandom networksrdquo Journal of Mathematical Biology vol 62no 3 pp 349ndash358 2011

[35] W Wang M Tang P Shu and Z Wang ldquoDynamics of socialcontagions with heterogeneous adoption thresholds cross-over phenomena in phase transitionrdquo New Journal of Physicsvol 18 no 1 article 013029 2016

Security and Communication Networks 13

[36] W Wang M Tang H-F Zhang H Gao Y Do andZ-H Liu ldquoEpidemic spreading on complex networks withgeneral degree and weight distributionsrdquo Physical Review Evol 90 no 4 article 042803 2014

[37] P Erdos and A Renyi ldquoOn random graphs Irdquo PublicationesMathematicae Debrecen vol 6 pp 290ndash297 1959

[38] A Hagberg D Schult P Swart et al Networkx High pro-ductivity software for complex networks Webova Stra Nka2013 httpsnetworkxlanlgovwiki

14 Security and Communication Networks

susceptible state to adopted state is T that is a nodeshould at least receive T messages from global spreadingand then it can trigger state change en φS(t) can bewritten as

φS(t) 1 minus ρ0( 1113857 1113944K

p(k)θkt

N minus 2

m

⎛⎝ ⎞⎠ 1113944

Tminus 1

m0ϑNminus 2minus m

t 1 minus ϑt( 1113857m

(12)

So φR(t) is

φR(t) c(1 minus ϑ(t)) 1 minus λG( 1113857

λG

(13)

en we can get

dϑ(t)

dt λG 1113944

K

p(k)θkt

N minus 2

m

⎛⎝ ⎞⎠ 1113944

Tminus 1

m0ϑNminus 2minus m

t 1 minus ϑt( 1113857m

+ c(1 minus ϑ(t)) 1 minus λG( 1113857 minus λGϑ(t)

(14)

We know S(t) + A(t) + R(t) 1 at time t note that therate dA(t)dt is equal to the rate at which S(t) decreasesbecause all the individuals moving out of the susceptiblestate must move into the adopted state minus therate at which adopted individuals become recovered Wehave

dA(t)

dt minus

dS(t)

dtminus cA(t) (15)

dR(t)

dt cA(t) (16)

According to the deduction above we can have thegeneral description of social contagion dynamics so that wecan calculate the probability that node u has not receivedenough messages for state changing

θ(infin) 1113944k

kp(k)

langkrangθkminus 1

(infin)

N minus 2

m

⎛⎜⎜⎝ ⎞⎟⎟⎠ 1113944

Tminus 1

m0ϑNminus 2minus m

(infin) 1 minus ϑinfin( 1113857m

+c(1 minus θ(infin)) 1 minus λL( 1113857

λL

(17)

ϑ(infin) 1113944k

p(k)θkinfin

N minus 2m

1113888 1113889 1113944

Tminus 1

m0ϑNminus 2minus minfin 1 minus ϑinfin( 1113857

m

+c(1 minus ϑ(infin)) 1 minus λG( 1113857

λG

(18)

Now we analyze the critical information transmissionprobability Since we have already assumed that Tgt 1 tostudy the memory reinforcement a vanishingly smallfraction of seeds cannot trigger a global behavior adoptionIn this situation θx(infin) 1 is not a solution of the followingequation

zfL(θ(infin) ϑ(infin))

zθ(infin)

zfG(θ(infin) ϑ(infin))

zϑ(infin) 1 (19)

From theory analysis we can capture first-order phasetransition at the critical point where the condition is ful-filled We assume A(infin) 0 then R(infin) 1 minus S(infin) wecan calculate R(infin) as final adoption size

42 DIOT For the theory introduced above it assumes thata node can participate in only one type of spreading in eachtime slice either local or global propagation In realitydifferent propagation may act on nodes at the same time sowe also carry out research on this scenario

In alternative hybrid contagion the spreading rate forlocal and global propagation is λL αλ and λG (1 minus α)λrespectively while λL + λG λ Different from alternativehybrid contagion the spreading rate of parallel hybridcontagion does not have such constraints and λL and λG areisolated

To further explore the contribution of two spreadingmethods in hybrid propagation we introduce globespreading rate control factor ζ let λG λLζ by doing thiswe can get the variety of final adoption size versus differentglobal transmission rate So equations (17) and (18) can bewritten as

θ(infin) 1113944k

kp(k)

langkrangθ kminus 1

(infin)

N minus 2

m

⎛⎜⎜⎜⎜⎝ ⎞⎟⎟⎟⎟⎠ 1113944

Tminus 1

m0ϑNminus 2minus m

(infin) 1 minus ϑinfin( 1113857m

+c(1 minus θ(infin))(1 minus λ)

λ

(20)

ϑ(infin) 1113944k

p(k)θkinfin

N minus 2m

1113888 1113889 1113944

Tminus 1

m0ϑNminus 2minus minfin 1 minus ϑinfin( 1113857

m

+c(1 minus ϑ(infin))(1 minus λζ)

λζ

(21)

5 Simulation

51 SimulationMethod Based on the theory analysis of thebotnet spreading progress we perform numerical simu-lations to study our proposed hybrid contagion modelusing ErdosndashRenyi (ER) network model [37] andBarabasindashAlbert (BA) network with power-law degreedistribution for our simulations [8] For medical IoT themedical equipment or sensors are always deployed indiagnosis and treatment room or datacenter in general itis hard to infect them by email attachments as commonlyseen in computer e most possible attack vector is wiredor wireless network intrusion and hardware addition byhuman intervention which can be categorized as localpropagation we can model these possible propagationchannels with hybrid spreading model An overview of theproposed numerical simulation program is shown in

6 Security and Communication Networks

Algorithm 1 In initiation phase ER network generationand parameter settings need to be handled first We usethe open-source package NetworkX [38] to producenetwork ER network G the network size is 10000 networknodes and the average degree is langkrang 10

We randomly set 5 nodes in adopted state ρ0 5104 Ateach experiment according to the variable that needs to beinvestigated parameters like local propagation probabilityλL global propagation probability λG threshold T recoveryrate c hybrid ratio α and globe scope controller ϵ are setrespectively In most cases we set the scope parameterϵ 0004 that is in each transmission node u will receivemessages from 40 global nodes For each experiment werepeat a thousand times and take the average value assimulation result

52 SIOT in ER Network We first study the effects ofhybrid ratio α on social contagions in ER networks Asshown in Figure 3 the hybrid ratio changes the growthpattern of the final behavior adoption size R(infin) versusthe information transmission probability λ From thefigure we can see that when λ 01 the final adoptionsize R(infin) is varied with α increments When α value issmall the local propagation contributes less and it ishard to outbreak when initial seeds are few Nonethelesswhen α gets higher more chances are there for the nodeto receive message from neighbors as we aforemen-tioned the threshold is 1 so it will promote the proba-bility of nodes in susceptible state to get into adoptedstate When more nodes are in adopted state for globalpropagation it is much easier to receive more messagesthan threshold for state changing Furthermore when αkeeps on augmenting larger than the outbreak value thefinal adoption size will gradually decline and ascendafterwards Our theoretical predictions agree well withthe numerical results e differences between the the-oretical and numerical predictions are caused by thestrong dynamical correlations among the states ofneighbors

We further identify the outbreak threshold by thevariability measure which is a standard measure to de-termine the critical point in equilibrium phase onmagnetic system to reflect the fluctuation of the outbreaksize for different α

δ

R2 minus langRrang21113969

langRrang (22)

When we fix the hybrid ratio α the growth patternof R(infin) versus transmission rate λ can be observedFigure 4

We further investigate the relation between hybridratio α and final adoption size R(infin)rsquos variation law bycalculating the relative change rate of R(infin) we canderive the variation pattern It can be seen from Figure 5that with the increase of α the burst threshold decreasesindicating that local propagation still plays a dominantrole in the mixed propagation process e variability

exhibits a peak over a wide range of λ In our model weintroduce parameter ϵ to control the size of nodes joiningin global propagation the reason behind this is althoughnode u can receive message from any node in the global

λ = 05λ = 07

λ = 03λ = 015 λ = 01

0

02

04

06

08

1

12

R (infin

)

01 06 070 050302 08 09 104α

Figure 3 Propagation with fixed λ e final behavior adoptionsize R(infin) versus the hybrid ratio α with fixed informationtransmission probability λ 01 015 03 05 07 respectivelye lines are the theoretical predictions and the dots are thesimulation results

Initialization(1) Network generation(2) Parameters initialization

begin(1) newState[]lt- hisState[](2) for any node ni in N(3) if node state is susceptiblesample propagation

method with α(4) if local(5) get neighbor nodes list from G and node state

from hisState[](6) for any node in neighbor[](7) if node state is infected then(8) infect node ni with λL(9) if count gt 1 update newState[](10) else if global(11) get Nϵ global nodes global[] from G and

node state from hisState[](12) for any node in global[](13) if node state is infected(14) infect node ni with λG and update count of

received messages(15) if count gt T update newState[](16) else if node state is infected(17) to recover with probability c(18) update newState[](19) hisState[]lt- newState[]

calculate R and refresh loop parameters(20) end

Output final adoption size R

ALGORITHM 1 Numerical simulation pseudocode

Security and Communication Networks 7

method in each round it can be affected by only a few ofthem

As shown in Figure 6 as ϵ increases it is faster to reachthe outbreak threshold value In the same way we furtherstudy the effects of c on the spreading behavior By settingα 05 and ϵ 0004 we can investigate how the recoveryrate c influences final adoption size R as shown in Figure 7It visually demonstrated the change of outbreak threshold ofλ larger c means slower outbreaks Finally we focus on theimpact of the different memory threshold T on the propa-gation range In our model we use parameter T to adjust theinformation credibility which means for large T value moreinformation needs to be received to change its status asshown in Figure 8

53 SIOT in BA Network e BA network is one of theclassical scale-free networks whose degree distribution

follows a power law e first scale-free model theBA model has a linear preferential attachment 1113937 (ki)

ki1113936jkj and adds one new node at every time step us ingeneral 1113937 (k) has the form 1113937 (k) A + kα where A is theinitial attractiveness of the node We also set the networkscale as 10000 nodes langkrang 10 and ρ 5104 Otherparameters are set as follows threshold T 3 for global con-tagion recovery rate is c 05 and globe scope controller isϵ 0004

Firstly we can find in Figure 9 that nodes propagate fasterin the BA network than in the ER network in the case of sameaverage degree Because BA network has unbiased degreedistribution large degree nodes havemore neighbors to fosterinformation propagation We also find the phenomenon thatfinal adoption size changes from decline to rise as α increasesCompared with the ER network the BA network has 30decrease when it reached the peak value when λ 01 greateramplitude of oscillation was caused by difference in degree

0

01

02

03

04

05

06

07

08

09

1

R (infin

)

01 02 03 04 05 06 07 08 09 100λ

α = 06α = 05α = 04

α = 03α = 02

Figure 5 e variation of final adoption size R(infin) versus different λ with different hybrid ratio α

α = 09

α = 07

α = 05α = 03 α = 01

λ

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 05 06 07 08 09 10

Figure 4 e final behavior adoption size R(infin) versus the information transmission probability λ with fixed hybrid ratioα 01 03 05 07 09 respectively e lines are the theoretical predictions and the dots are the simulation results

8 Security and Communication Networks

distribution Generally the BA network can reach the burstthreshold much faster than the ER network under the samelambda condition as shown in Figure 10 In the same way wefixed hybrid ratio α and observed the change of final adoption

size with spreading rate from Figure 11 it can be seen thatwhen global propagation dominates it spreads faster than theER network but when the local propagation ratio increasesthe difference between these two network gets smaller

γ = 01γ = 03γ = 05

γ = 08γ = 10

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 050λ

Figure 7 Final adoption size varied with c while keeping other parameters unchanged

02

04

06

08

1

α

00102030405060708091

01λ

02 03 04

(a)

00102030405060708091

02

04

06

08

1

α

01λ

02 03 04

(b)

02

01λ

02 03 04

04

06

08

1

α

00102030405060708091

(c)

λ01 02 03 04

00102030405060708091

02

04

06

08

1

α

(d)

Figure 6 Final adoption size varied with ϵ ϵ value is 00035 0004 00045 and 0005 respectively from (a) to (d)

Security and Communication Networks 9

54 DIOT For the model introduced above it assumes that anode can participate in only one type of spreading in each timeslice either local or global propagation In reality differentpropagationsmay act on nodes at the same time sowe also carryout research on this scenario

In SIOT hybrid contagion the spreading rate for localand global propagation is λL αλ and λG (1 minus α)λ re-spectively while λL + λG λ the parameter α is used to

adjust contagion attendance for different propagationsCompared with SIOT hybrid contagion the spreading rateof DIOT does not have such constraints λL and λG areisolated this also means that a node can receive messagesfrom local or global nodes in same time slice e in-formation transmission flow can be seen in Figure 12 Be-sides this trivial difference other transmission parametersand contagion process are the same with SIOT hybrid

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(a)

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(b)

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(c)

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(d)

Figure 8 Final adoption size varied with T (a) to (d) illustrate the result of T1 T 2 T 3 and T 4 respectively

01

005 01 015 02 025 03 035 04 045 05

02

03

04

05

06

07

08

09

1 1

09

08

07

06

05

04

03

02

01

0

λ

α

Figure 9 Final adoption size varied with ϵ in BA network ϵ value is00035 0004 00045 and 0005 respectively

λ = 03

λ = 05

λ = 07

λ = 01λ = 015

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 05 06 07 08 09 100α

Figure 10 Final adoption size varied with α in SIOT

10 Security and Communication Networks

transmission For illustration convenience we set λL λ andintroduced global transmission rate scale parameter ζ tochange transmission rate of λG that is λG λζ the value ofζ is from 1 to 100 As illustrated in Figure 13 we can find thatnodes spread in the DIOT mode can reach outbreakthreshold at lower λ than in the SIOTmodeWhen λ is largerthan 012 it may reach the outbreak threshold but if thevalue of λ is smaller than 0005 it can never outbreak e

final adoption size R(infin) changes with ζ as shown inFigure 14 we can find the multiple factor ζ can play a majorrole when its value is small and as it increases the globaltransmission rate will be too small to affect the adoptionresult We can find from Figure 15 that changing the globalspreading rate can vary the approach speed to full outbreakbut the critical point is the same which means the dis-continuous growth is controlled by local propagation

α = 01α = 03α = 05

α = 07α = 09

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 05 06 07 08 09 10λ

Figure 11 Final adoption size varied with λ in SIOT

Node u gets into adopted state

No

Yes

ltγ

geγ

No

Yes

Node u gets into recovery state

Sample recovery

If infected

If infected

Receive message from global nodes

rate is λG T = 3

Receive message from adopted neighbor

rate is λL T = 1

Node u is in susceptible state atthe beginning

Figure 12 e flow chart of node state transferring in each spread phase a node will act in both local and global propagation

Security and Communication Networks 11

6 Conclusion

In this paper we studied the effects of hybrid propagationwith different spreading rates and memory reinforcementson botnet contagions We first proposed an informationcontagion model to describe the botnet spreading dynamicson complex networks We then developed a generalizedheterogeneous edge-based compartmental theory to de-scribe the proposed model

rough extensive numerical simulations on the ERnetwork and BA network we found that the growth patternof the final behavior size R(infin) versus the hybrid ratio αexhibits discontinuous pattern when fixed transmission rateλ is large But when λ is small R(infin) shows the phenomenonof fluctuation and at critical point it reaches peak value firstfollowed with small amplitude declining and gradually risingIn addition we also fixed the hybrid ratio α to analyze the finaladoption size R(infin) changing with transmission rate λ andthe growth pattern of R(infin) changing from continuous todiscontinuous is observed

For comparing the effect of different hybrid methodsSIOT and DIOT are proposed and the simulation result ispresented obviously DIOT can spread faster especiallywhen global transmission rate is high We finally studied theeffect of other parameters and found that memory thresholdT recovery rate c and global propagation range controller ϵcan affect R(infin) growing pattern respectively when T issmall it grows much faster because more seeds can begenerated and global spreading can contribute more Withincreasing c it gets slower to reach the burst value Alsoglobal range controller ϵ can change the pattern when ϵ getslarger it reaches critical value much faster By introducinghybrid propagation mechanism and spreading scope con-troller with memory character the method can supportmodeling different spreading scenarios flexibly but itsimplifies the life states of bot and the immune charac-teristics of nodes are not taken into account so our futurework will focus on these points

Our proposed theory agrees well with the numericalsimulations on ER and BA networksemodel proposed inthis paper can provide theoretical reference for hybridpropagation modeling of botnet in complex networks andalso provide guidance for medical industry to deal withbotnet threats

Data Availability

We conducted our experiment with the numerical simu-lation method without using any open dataset

Conflicts of Interest

e authors declare that there are no conflicts of interestregarding the publication of this paper

Acknowledgments

is study was financially supported in part by a program ofNational Natural Science Foundation of China (NSFC)

1090807060504030201

α

005 01 015 02 025 03 035 04λ

0908070605040302010

Figure 13 DIOT propagation e final behavior adoption sizeR(infin) versus the global transmission rate scale and localtransmission rate other parameters are N 10000 ϵ 0004T 3 and c 05 respectively e lines are the theoreticalpredictions

λ = 006

λ = 007

λ = 015

λ = 009λ = 01

λ = 03

λ = 008

λ = 0050

02

04

06

08

1

12

R (infin

)

10 20 30 40 50 60 70 80 90 1000ζ

Figure 14 Final adoption size R(infin) varied with ζ in DIOT

14 λ15 λ110 λ

12 λ13 λ

λ

0

02

04

06

08

1

12

R (infin

)

01 02 03 040λ

Figure 15 Final adoption size R(infin) varied with λ in DIOT

12 Security and Communication Networks

(grant nos 61272447 and 61802271) and in part by theFundamental Research Funds for the Central Universities(grant nos SCU2018D018 and SCU2018D022) is supportis gratefully acknowledged

References

[1] M Antonakakis T April M Bailey et al ldquoUnderstanding themirai botnetrdquo in Proceedings of the 26th USENIX SecuritySymposium pp 1093ndash1110 USENIX Security 17 VancouverBC Canada August 2017

[2] C Kolias G Kambourakis A Stavrou and J Voas ldquoDdos inthe IoT mirai and other botnetsrdquo Computer vol 50 no 7pp 80ndash84 2017

[3] D Chen N Zhang R Lu N Cheng K Zhang and Z QinldquoChannel precoding based message authentication in wirelessnetworks challenges and solutionsrdquo IEEE Network vol 33no 1 pp 99ndash105 2019

[4] D Chen N Zhang Z Qin et al ldquoS2M a lightweight acousticfingerprints-based wireless device authentication protocolrdquoIEEE Internet of ltings Journal vol 4 no 1 pp 88ndash100 2016

[5] Q Wang D Chen N Zhang Z Qin and Z Qin ldquoLACS alightweight label-based access control scheme in IoT-based5G caching contextrdquo IEEE Access vol 5 pp 4018ndash4027 2017

[6] K Zhang X Liang J Ni K Yang and X S Shen ldquoExploitingsocial network to enhance human-to-human infection anal-ysis without privacy leakagerdquo IEEE Transactions on De-pendable and Secure Computing vol 15 no 4 pp 607ndash6202016

[7] C Zhang S Zhou J C Miller I J Cox and B M ChainldquoOptimizing hybrid spreading in metapopulationsrdquo ScientificReports vol 5 no 1 p 9924 2015

[8] R M Anderson ldquoDiscussion the Kermack-McKendrickepidemic threshold theoremrdquo Bulletin of Mathematical Bi-ology vol 53 no 1-2 pp 3ndash32 1991

[9] M Newman Networks An Introduction Oxford UniversityPress Oxford UK 2010

[10] M Feily A Shahrestani and S Ramadass ldquoA survey of botnetand botnet detectionrdquo in Proceedings of the 2009 ltird In-ternational Conference on Emerging Security InformationSystems and Technologies pp 268ndash273 IEEE Athens GreeceJune 2009

[11] A Laha N Zhang H Wu D Chen and T Han ldquoOnlineproactive caching in mobile edge computing using bi-directional deep recurrent neural networkrdquo IEEE Internet ofltings Journal vol 6 no 3 pp 5520ndash5530 2019

[12] E Bertino and N Islam ldquoBotnets and internet of things se-curityrdquo Computer vol 50 no 2 pp 76ndash79 2017

[13] D Chen N Zhang N Cheng K Zhang Z Qin andX S Shen ldquoPhysical layer based message authentication withsecure channel codesrdquo IEEE Transactions on Dependable andSecure Computing p 1 2018

[14] Q Wang D Chen N Zhang Z Ding and Z Qin ldquoPCP aprivacy-preserving content-based publish-subscribe schemewith differential privacy in fog computingrdquo IEEE Accessvol 5 pp 17962ndash17974 2017

[15] D Acarali M Rajarajan N Komninos and B B ZarpelatildeoldquoModelling the spread of botnet malware in IoT-basedwireless sensor networksrdquo Security and CommunicationNetworks vol 2019 Article ID 3745619 13 pages 2019

[16] M Ajelli R Lo Cigno and A Montresor ldquoModeling botnetsand epidemic malwarerdquo in Proceedings of the 2010 IEEEInternational Conference on Communications pp 1ndash5 IEEECape Town South Africa May 2010

[17] M J Farooq and Q Zhu ldquoModeling analysis and mitigationof dynamic botnet formation in wireless IoT networksrdquo IEEETransactions on Information Forensics and Security vol 14no 9 pp 2412ndash2426 2019

[18] B K Mishra and D K Saini ldquoSEIRS epidemic model withdelay for transmission of malicious objects in computernetworkrdquo Applied Mathematics and Computation vol 188no 2 pp 1476ndash1482 2007

[19] A Singh A K Awasthi K Singh and P K SrivastavaldquoModeling and analysis of worm propagation in wirelesssensor networksrdquoWireless Personal Communications vol 98no 3 pp 2535ndash2551 2018

[20] D Dagon C C Zou andW Lee ldquoModeling botnet propagationusing time zonesrdquo in Proceedings of the NDSS Symposium 2006vol 6 pp 2ndash13 San Diego CA USA February 2006

[21] M Todd Gardner C C Beard and M Deep ldquoUsing seirsepidemicmodels for IoT botnets attacksrdquo in Proceedings of theDRCN 2017mdashDesign of Reliable Communication Networkspp 1ndash8 Munich Germany March 2017

[22] C Castellano S Fortunato and V Loreto ldquoStatistical physicsof social dynamicsrdquo Reviews of Modern Physics vol 81 no 2pp 591ndash646 2009

[23] J C Flack and R M DrsquoSouza ldquoe digital age and the futureof social network science and engineeringrdquo Proceedings of theIEEE vol 102 no 12 pp 1873ndash1877 2014

[24] R Pastor-Satorras C Castellano P Van Mieghem andA Vespignani ldquoEpidemic processes in complex networksrdquoReviews of Modern Physics vol 87 no 3 pp 925ndash979 2015

[25] V Constantin Craciun A Mogage and E Simion ldquoTrends indesign of ransomware virusesrdquo in International Conference onSecurity for Information Technology and Communicationspp 259ndash272 Springer Berlin Germany 2018

[26] S Mohurle and M Patil ldquoA brief study of wannacry threatransomware attack 2017rdquo International Journal of AdvancedResearch in Computer Science vol 8 no 5 2017

[27] A Zimba L Simukonda and M Chishimba ldquoDemystifyingransomware attacks reverse engineering and dynamic mal-ware analysis of wannacry for network and information se-curityrdquo Zambia ICT Journal vol 1 no 1 pp 35ndash40 2017

[28] S Aral and DWalker ldquoIdentifying influential and susceptiblemembers of social networksrdquo Science vol 337 no 6092pp 337ndash341 2012

[29] A Banerjee A G Chandrasekhar E Duflo and M O Jacksonldquoe diffusion ofmicrofinancerdquo Science vol 341 no 6144 article1236498 2013

[30] P S Dodds and D J Watts ldquoUniversal behavior in a gen-eralized model of contagionrdquo Physical Review Letters vol 92no 21 article 218701 2004

[31] D J Watts ldquoA simple model of global cascades on randomnetworksrdquo Proceedings of the National Academy of Sciencesvol 99 no 9 pp 5766ndash5771 2002

[32] P S Dodds and D J Watts ldquoA generalized model of socialand biological contagionrdquo Journal of lteoretical Biologyvol 232 no 4 pp 587ndash604 2005

[33] W Wang X-L Chen and L-F Zhong ldquoSocial contagionswith heterogeneous credibilityrdquo Physica A Statistical Me-chanics and Its Applications vol 503 pp 604ndash610 2018

[34] J C Miller ldquoA note on a paper by Erik Volz sir dynamics inrandom networksrdquo Journal of Mathematical Biology vol 62no 3 pp 349ndash358 2011

[35] W Wang M Tang P Shu and Z Wang ldquoDynamics of socialcontagions with heterogeneous adoption thresholds cross-over phenomena in phase transitionrdquo New Journal of Physicsvol 18 no 1 article 013029 2016

Security and Communication Networks 13

[36] W Wang M Tang H-F Zhang H Gao Y Do andZ-H Liu ldquoEpidemic spreading on complex networks withgeneral degree and weight distributionsrdquo Physical Review Evol 90 no 4 article 042803 2014

[37] P Erdos and A Renyi ldquoOn random graphs Irdquo PublicationesMathematicae Debrecen vol 6 pp 290ndash297 1959

[38] A Hagberg D Schult P Swart et al Networkx High pro-ductivity software for complex networks Webova Stra Nka2013 httpsnetworkxlanlgovwiki

14 Security and Communication Networks

Algorithm 1 In initiation phase ER network generationand parameter settings need to be handled first We usethe open-source package NetworkX [38] to producenetwork ER network G the network size is 10000 networknodes and the average degree is langkrang 10

We randomly set 5 nodes in adopted state ρ0 5104 Ateach experiment according to the variable that needs to beinvestigated parameters like local propagation probabilityλL global propagation probability λG threshold T recoveryrate c hybrid ratio α and globe scope controller ϵ are setrespectively In most cases we set the scope parameterϵ 0004 that is in each transmission node u will receivemessages from 40 global nodes For each experiment werepeat a thousand times and take the average value assimulation result

52 SIOT in ER Network We first study the effects ofhybrid ratio α on social contagions in ER networks Asshown in Figure 3 the hybrid ratio changes the growthpattern of the final behavior adoption size R(infin) versusthe information transmission probability λ From thefigure we can see that when λ 01 the final adoptionsize R(infin) is varied with α increments When α value issmall the local propagation contributes less and it ishard to outbreak when initial seeds are few Nonethelesswhen α gets higher more chances are there for the nodeto receive message from neighbors as we aforemen-tioned the threshold is 1 so it will promote the proba-bility of nodes in susceptible state to get into adoptedstate When more nodes are in adopted state for globalpropagation it is much easier to receive more messagesthan threshold for state changing Furthermore when αkeeps on augmenting larger than the outbreak value thefinal adoption size will gradually decline and ascendafterwards Our theoretical predictions agree well withthe numerical results e differences between the the-oretical and numerical predictions are caused by thestrong dynamical correlations among the states ofneighbors

We further identify the outbreak threshold by thevariability measure which is a standard measure to de-termine the critical point in equilibrium phase onmagnetic system to reflect the fluctuation of the outbreaksize for different α

δ

R2 minus langRrang21113969

langRrang (22)

When we fix the hybrid ratio α the growth patternof R(infin) versus transmission rate λ can be observedFigure 4

We further investigate the relation between hybridratio α and final adoption size R(infin)rsquos variation law bycalculating the relative change rate of R(infin) we canderive the variation pattern It can be seen from Figure 5that with the increase of α the burst threshold decreasesindicating that local propagation still plays a dominantrole in the mixed propagation process e variability

exhibits a peak over a wide range of λ In our model weintroduce parameter ϵ to control the size of nodes joiningin global propagation the reason behind this is althoughnode u can receive message from any node in the global

λ = 05λ = 07

λ = 03λ = 015 λ = 01

0

02

04

06

08

1

12

R (infin

)

01 06 070 050302 08 09 104α

Figure 3 Propagation with fixed λ e final behavior adoptionsize R(infin) versus the hybrid ratio α with fixed informationtransmission probability λ 01 015 03 05 07 respectivelye lines are the theoretical predictions and the dots are thesimulation results

Initialization(1) Network generation(2) Parameters initialization

begin(1) newState[]lt- hisState[](2) for any node ni in N(3) if node state is susceptiblesample propagation

method with α(4) if local(5) get neighbor nodes list from G and node state

from hisState[](6) for any node in neighbor[](7) if node state is infected then(8) infect node ni with λL(9) if count gt 1 update newState[](10) else if global(11) get Nϵ global nodes global[] from G and

node state from hisState[](12) for any node in global[](13) if node state is infected(14) infect node ni with λG and update count of

received messages(15) if count gt T update newState[](16) else if node state is infected(17) to recover with probability c(18) update newState[](19) hisState[]lt- newState[]

calculate R and refresh loop parameters(20) end

Output final adoption size R

ALGORITHM 1 Numerical simulation pseudocode

Security and Communication Networks 7

method in each round it can be affected by only a few ofthem

As shown in Figure 6 as ϵ increases it is faster to reachthe outbreak threshold value In the same way we furtherstudy the effects of c on the spreading behavior By settingα 05 and ϵ 0004 we can investigate how the recoveryrate c influences final adoption size R as shown in Figure 7It visually demonstrated the change of outbreak threshold ofλ larger c means slower outbreaks Finally we focus on theimpact of the different memory threshold T on the propa-gation range In our model we use parameter T to adjust theinformation credibility which means for large T value moreinformation needs to be received to change its status asshown in Figure 8

53 SIOT in BA Network e BA network is one of theclassical scale-free networks whose degree distribution

follows a power law e first scale-free model theBA model has a linear preferential attachment 1113937 (ki)

ki1113936jkj and adds one new node at every time step us ingeneral 1113937 (k) has the form 1113937 (k) A + kα where A is theinitial attractiveness of the node We also set the networkscale as 10000 nodes langkrang 10 and ρ 5104 Otherparameters are set as follows threshold T 3 for global con-tagion recovery rate is c 05 and globe scope controller isϵ 0004

Firstly we can find in Figure 9 that nodes propagate fasterin the BA network than in the ER network in the case of sameaverage degree Because BA network has unbiased degreedistribution large degree nodes havemore neighbors to fosterinformation propagation We also find the phenomenon thatfinal adoption size changes from decline to rise as α increasesCompared with the ER network the BA network has 30decrease when it reached the peak value when λ 01 greateramplitude of oscillation was caused by difference in degree

0

01

02

03

04

05

06

07

08

09

1

R (infin

)

01 02 03 04 05 06 07 08 09 100λ

α = 06α = 05α = 04

α = 03α = 02

Figure 5 e variation of final adoption size R(infin) versus different λ with different hybrid ratio α

α = 09

α = 07

α = 05α = 03 α = 01

λ

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 05 06 07 08 09 10

Figure 4 e final behavior adoption size R(infin) versus the information transmission probability λ with fixed hybrid ratioα 01 03 05 07 09 respectively e lines are the theoretical predictions and the dots are the simulation results

8 Security and Communication Networks

distribution Generally the BA network can reach the burstthreshold much faster than the ER network under the samelambda condition as shown in Figure 10 In the same way wefixed hybrid ratio α and observed the change of final adoption

size with spreading rate from Figure 11 it can be seen thatwhen global propagation dominates it spreads faster than theER network but when the local propagation ratio increasesthe difference between these two network gets smaller

γ = 01γ = 03γ = 05

γ = 08γ = 10

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 050λ

Figure 7 Final adoption size varied with c while keeping other parameters unchanged

02

04

06

08

1

α

00102030405060708091

01λ

02 03 04

(a)

00102030405060708091

02

04

06

08

1

α

01λ

02 03 04

(b)

02

01λ

02 03 04

04

06

08

1

α

00102030405060708091

(c)

λ01 02 03 04

00102030405060708091

02

04

06

08

1

α

(d)

Figure 6 Final adoption size varied with ϵ ϵ value is 00035 0004 00045 and 0005 respectively from (a) to (d)

Security and Communication Networks 9

54 DIOT For the model introduced above it assumes that anode can participate in only one type of spreading in each timeslice either local or global propagation In reality differentpropagationsmay act on nodes at the same time sowe also carryout research on this scenario

In SIOT hybrid contagion the spreading rate for localand global propagation is λL αλ and λG (1 minus α)λ re-spectively while λL + λG λ the parameter α is used to

adjust contagion attendance for different propagationsCompared with SIOT hybrid contagion the spreading rateof DIOT does not have such constraints λL and λG areisolated this also means that a node can receive messagesfrom local or global nodes in same time slice e in-formation transmission flow can be seen in Figure 12 Be-sides this trivial difference other transmission parametersand contagion process are the same with SIOT hybrid

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(a)

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(b)

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(c)

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(d)

Figure 8 Final adoption size varied with T (a) to (d) illustrate the result of T1 T 2 T 3 and T 4 respectively

01

005 01 015 02 025 03 035 04 045 05

02

03

04

05

06

07

08

09

1 1

09

08

07

06

05

04

03

02

01

0

λ

α

Figure 9 Final adoption size varied with ϵ in BA network ϵ value is00035 0004 00045 and 0005 respectively

λ = 03

λ = 05

λ = 07

λ = 01λ = 015

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 05 06 07 08 09 100α

Figure 10 Final adoption size varied with α in SIOT

10 Security and Communication Networks

transmission For illustration convenience we set λL λ andintroduced global transmission rate scale parameter ζ tochange transmission rate of λG that is λG λζ the value ofζ is from 1 to 100 As illustrated in Figure 13 we can find thatnodes spread in the DIOT mode can reach outbreakthreshold at lower λ than in the SIOTmodeWhen λ is largerthan 012 it may reach the outbreak threshold but if thevalue of λ is smaller than 0005 it can never outbreak e

final adoption size R(infin) changes with ζ as shown inFigure 14 we can find the multiple factor ζ can play a majorrole when its value is small and as it increases the globaltransmission rate will be too small to affect the adoptionresult We can find from Figure 15 that changing the globalspreading rate can vary the approach speed to full outbreakbut the critical point is the same which means the dis-continuous growth is controlled by local propagation

α = 01α = 03α = 05

α = 07α = 09

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 05 06 07 08 09 10λ

Figure 11 Final adoption size varied with λ in SIOT

Node u gets into adopted state

No

Yes

ltγ

geγ

No

Yes

Node u gets into recovery state

Sample recovery

If infected

If infected

Receive message from global nodes

rate is λG T = 3

Receive message from adopted neighbor

rate is λL T = 1

Node u is in susceptible state atthe beginning

Figure 12 e flow chart of node state transferring in each spread phase a node will act in both local and global propagation

Security and Communication Networks 11

6 Conclusion

In this paper we studied the effects of hybrid propagationwith different spreading rates and memory reinforcementson botnet contagions We first proposed an informationcontagion model to describe the botnet spreading dynamicson complex networks We then developed a generalizedheterogeneous edge-based compartmental theory to de-scribe the proposed model

rough extensive numerical simulations on the ERnetwork and BA network we found that the growth patternof the final behavior size R(infin) versus the hybrid ratio αexhibits discontinuous pattern when fixed transmission rateλ is large But when λ is small R(infin) shows the phenomenonof fluctuation and at critical point it reaches peak value firstfollowed with small amplitude declining and gradually risingIn addition we also fixed the hybrid ratio α to analyze the finaladoption size R(infin) changing with transmission rate λ andthe growth pattern of R(infin) changing from continuous todiscontinuous is observed

For comparing the effect of different hybrid methodsSIOT and DIOT are proposed and the simulation result ispresented obviously DIOT can spread faster especiallywhen global transmission rate is high We finally studied theeffect of other parameters and found that memory thresholdT recovery rate c and global propagation range controller ϵcan affect R(infin) growing pattern respectively when T issmall it grows much faster because more seeds can begenerated and global spreading can contribute more Withincreasing c it gets slower to reach the burst value Alsoglobal range controller ϵ can change the pattern when ϵ getslarger it reaches critical value much faster By introducinghybrid propagation mechanism and spreading scope con-troller with memory character the method can supportmodeling different spreading scenarios flexibly but itsimplifies the life states of bot and the immune charac-teristics of nodes are not taken into account so our futurework will focus on these points

Our proposed theory agrees well with the numericalsimulations on ER and BA networksemodel proposed inthis paper can provide theoretical reference for hybridpropagation modeling of botnet in complex networks andalso provide guidance for medical industry to deal withbotnet threats

Data Availability

We conducted our experiment with the numerical simu-lation method without using any open dataset

Conflicts of Interest

e authors declare that there are no conflicts of interestregarding the publication of this paper

Acknowledgments

is study was financially supported in part by a program ofNational Natural Science Foundation of China (NSFC)

1090807060504030201

α

005 01 015 02 025 03 035 04λ

0908070605040302010

Figure 13 DIOT propagation e final behavior adoption sizeR(infin) versus the global transmission rate scale and localtransmission rate other parameters are N 10000 ϵ 0004T 3 and c 05 respectively e lines are the theoreticalpredictions

λ = 006

λ = 007

λ = 015

λ = 009λ = 01

λ = 03

λ = 008

λ = 0050

02

04

06

08

1

12

R (infin

)

10 20 30 40 50 60 70 80 90 1000ζ

Figure 14 Final adoption size R(infin) varied with ζ in DIOT

14 λ15 λ110 λ

12 λ13 λ

λ

0

02

04

06

08

1

12

R (infin

)

01 02 03 040λ

Figure 15 Final adoption size R(infin) varied with λ in DIOT

12 Security and Communication Networks

(grant nos 61272447 and 61802271) and in part by theFundamental Research Funds for the Central Universities(grant nos SCU2018D018 and SCU2018D022) is supportis gratefully acknowledged

References

[1] M Antonakakis T April M Bailey et al ldquoUnderstanding themirai botnetrdquo in Proceedings of the 26th USENIX SecuritySymposium pp 1093ndash1110 USENIX Security 17 VancouverBC Canada August 2017

[2] C Kolias G Kambourakis A Stavrou and J Voas ldquoDdos inthe IoT mirai and other botnetsrdquo Computer vol 50 no 7pp 80ndash84 2017

[3] D Chen N Zhang R Lu N Cheng K Zhang and Z QinldquoChannel precoding based message authentication in wirelessnetworks challenges and solutionsrdquo IEEE Network vol 33no 1 pp 99ndash105 2019

[4] D Chen N Zhang Z Qin et al ldquoS2M a lightweight acousticfingerprints-based wireless device authentication protocolrdquoIEEE Internet of ltings Journal vol 4 no 1 pp 88ndash100 2016

[5] Q Wang D Chen N Zhang Z Qin and Z Qin ldquoLACS alightweight label-based access control scheme in IoT-based5G caching contextrdquo IEEE Access vol 5 pp 4018ndash4027 2017

[6] K Zhang X Liang J Ni K Yang and X S Shen ldquoExploitingsocial network to enhance human-to-human infection anal-ysis without privacy leakagerdquo IEEE Transactions on De-pendable and Secure Computing vol 15 no 4 pp 607ndash6202016

[7] C Zhang S Zhou J C Miller I J Cox and B M ChainldquoOptimizing hybrid spreading in metapopulationsrdquo ScientificReports vol 5 no 1 p 9924 2015

[8] R M Anderson ldquoDiscussion the Kermack-McKendrickepidemic threshold theoremrdquo Bulletin of Mathematical Bi-ology vol 53 no 1-2 pp 3ndash32 1991

[9] M Newman Networks An Introduction Oxford UniversityPress Oxford UK 2010

[10] M Feily A Shahrestani and S Ramadass ldquoA survey of botnetand botnet detectionrdquo in Proceedings of the 2009 ltird In-ternational Conference on Emerging Security InformationSystems and Technologies pp 268ndash273 IEEE Athens GreeceJune 2009

[11] A Laha N Zhang H Wu D Chen and T Han ldquoOnlineproactive caching in mobile edge computing using bi-directional deep recurrent neural networkrdquo IEEE Internet ofltings Journal vol 6 no 3 pp 5520ndash5530 2019

[12] E Bertino and N Islam ldquoBotnets and internet of things se-curityrdquo Computer vol 50 no 2 pp 76ndash79 2017

[13] D Chen N Zhang N Cheng K Zhang Z Qin andX S Shen ldquoPhysical layer based message authentication withsecure channel codesrdquo IEEE Transactions on Dependable andSecure Computing p 1 2018

[14] Q Wang D Chen N Zhang Z Ding and Z Qin ldquoPCP aprivacy-preserving content-based publish-subscribe schemewith differential privacy in fog computingrdquo IEEE Accessvol 5 pp 17962ndash17974 2017

[15] D Acarali M Rajarajan N Komninos and B B ZarpelatildeoldquoModelling the spread of botnet malware in IoT-basedwireless sensor networksrdquo Security and CommunicationNetworks vol 2019 Article ID 3745619 13 pages 2019

[16] M Ajelli R Lo Cigno and A Montresor ldquoModeling botnetsand epidemic malwarerdquo in Proceedings of the 2010 IEEEInternational Conference on Communications pp 1ndash5 IEEECape Town South Africa May 2010

[17] M J Farooq and Q Zhu ldquoModeling analysis and mitigationof dynamic botnet formation in wireless IoT networksrdquo IEEETransactions on Information Forensics and Security vol 14no 9 pp 2412ndash2426 2019

[18] B K Mishra and D K Saini ldquoSEIRS epidemic model withdelay for transmission of malicious objects in computernetworkrdquo Applied Mathematics and Computation vol 188no 2 pp 1476ndash1482 2007

[19] A Singh A K Awasthi K Singh and P K SrivastavaldquoModeling and analysis of worm propagation in wirelesssensor networksrdquoWireless Personal Communications vol 98no 3 pp 2535ndash2551 2018

[20] D Dagon C C Zou andW Lee ldquoModeling botnet propagationusing time zonesrdquo in Proceedings of the NDSS Symposium 2006vol 6 pp 2ndash13 San Diego CA USA February 2006

[21] M Todd Gardner C C Beard and M Deep ldquoUsing seirsepidemicmodels for IoT botnets attacksrdquo in Proceedings of theDRCN 2017mdashDesign of Reliable Communication Networkspp 1ndash8 Munich Germany March 2017

[22] C Castellano S Fortunato and V Loreto ldquoStatistical physicsof social dynamicsrdquo Reviews of Modern Physics vol 81 no 2pp 591ndash646 2009

[23] J C Flack and R M DrsquoSouza ldquoe digital age and the futureof social network science and engineeringrdquo Proceedings of theIEEE vol 102 no 12 pp 1873ndash1877 2014

[24] R Pastor-Satorras C Castellano P Van Mieghem andA Vespignani ldquoEpidemic processes in complex networksrdquoReviews of Modern Physics vol 87 no 3 pp 925ndash979 2015

[25] V Constantin Craciun A Mogage and E Simion ldquoTrends indesign of ransomware virusesrdquo in International Conference onSecurity for Information Technology and Communicationspp 259ndash272 Springer Berlin Germany 2018

[26] S Mohurle and M Patil ldquoA brief study of wannacry threatransomware attack 2017rdquo International Journal of AdvancedResearch in Computer Science vol 8 no 5 2017

[27] A Zimba L Simukonda and M Chishimba ldquoDemystifyingransomware attacks reverse engineering and dynamic mal-ware analysis of wannacry for network and information se-curityrdquo Zambia ICT Journal vol 1 no 1 pp 35ndash40 2017

[28] S Aral and DWalker ldquoIdentifying influential and susceptiblemembers of social networksrdquo Science vol 337 no 6092pp 337ndash341 2012

[29] A Banerjee A G Chandrasekhar E Duflo and M O Jacksonldquoe diffusion ofmicrofinancerdquo Science vol 341 no 6144 article1236498 2013

[30] P S Dodds and D J Watts ldquoUniversal behavior in a gen-eralized model of contagionrdquo Physical Review Letters vol 92no 21 article 218701 2004

[31] D J Watts ldquoA simple model of global cascades on randomnetworksrdquo Proceedings of the National Academy of Sciencesvol 99 no 9 pp 5766ndash5771 2002

[32] P S Dodds and D J Watts ldquoA generalized model of socialand biological contagionrdquo Journal of lteoretical Biologyvol 232 no 4 pp 587ndash604 2005

[33] W Wang X-L Chen and L-F Zhong ldquoSocial contagionswith heterogeneous credibilityrdquo Physica A Statistical Me-chanics and Its Applications vol 503 pp 604ndash610 2018

[34] J C Miller ldquoA note on a paper by Erik Volz sir dynamics inrandom networksrdquo Journal of Mathematical Biology vol 62no 3 pp 349ndash358 2011

[35] W Wang M Tang P Shu and Z Wang ldquoDynamics of socialcontagions with heterogeneous adoption thresholds cross-over phenomena in phase transitionrdquo New Journal of Physicsvol 18 no 1 article 013029 2016

Security and Communication Networks 13

[36] W Wang M Tang H-F Zhang H Gao Y Do andZ-H Liu ldquoEpidemic spreading on complex networks withgeneral degree and weight distributionsrdquo Physical Review Evol 90 no 4 article 042803 2014

[37] P Erdos and A Renyi ldquoOn random graphs Irdquo PublicationesMathematicae Debrecen vol 6 pp 290ndash297 1959

[38] A Hagberg D Schult P Swart et al Networkx High pro-ductivity software for complex networks Webova Stra Nka2013 httpsnetworkxlanlgovwiki

14 Security and Communication Networks

method in each round it can be affected by only a few ofthem

As shown in Figure 6 as ϵ increases it is faster to reachthe outbreak threshold value In the same way we furtherstudy the effects of c on the spreading behavior By settingα 05 and ϵ 0004 we can investigate how the recoveryrate c influences final adoption size R as shown in Figure 7It visually demonstrated the change of outbreak threshold ofλ larger c means slower outbreaks Finally we focus on theimpact of the different memory threshold T on the propa-gation range In our model we use parameter T to adjust theinformation credibility which means for large T value moreinformation needs to be received to change its status asshown in Figure 8

53 SIOT in BA Network e BA network is one of theclassical scale-free networks whose degree distribution

follows a power law e first scale-free model theBA model has a linear preferential attachment 1113937 (ki)

ki1113936jkj and adds one new node at every time step us ingeneral 1113937 (k) has the form 1113937 (k) A + kα where A is theinitial attractiveness of the node We also set the networkscale as 10000 nodes langkrang 10 and ρ 5104 Otherparameters are set as follows threshold T 3 for global con-tagion recovery rate is c 05 and globe scope controller isϵ 0004

Firstly we can find in Figure 9 that nodes propagate fasterin the BA network than in the ER network in the case of sameaverage degree Because BA network has unbiased degreedistribution large degree nodes havemore neighbors to fosterinformation propagation We also find the phenomenon thatfinal adoption size changes from decline to rise as α increasesCompared with the ER network the BA network has 30decrease when it reached the peak value when λ 01 greateramplitude of oscillation was caused by difference in degree

0

01

02

03

04

05

06

07

08

09

1

R (infin

)

01 02 03 04 05 06 07 08 09 100λ

α = 06α = 05α = 04

α = 03α = 02

Figure 5 e variation of final adoption size R(infin) versus different λ with different hybrid ratio α

α = 09

α = 07

α = 05α = 03 α = 01

λ

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 05 06 07 08 09 10

Figure 4 e final behavior adoption size R(infin) versus the information transmission probability λ with fixed hybrid ratioα 01 03 05 07 09 respectively e lines are the theoretical predictions and the dots are the simulation results

8 Security and Communication Networks

distribution Generally the BA network can reach the burstthreshold much faster than the ER network under the samelambda condition as shown in Figure 10 In the same way wefixed hybrid ratio α and observed the change of final adoption

size with spreading rate from Figure 11 it can be seen thatwhen global propagation dominates it spreads faster than theER network but when the local propagation ratio increasesthe difference between these two network gets smaller

γ = 01γ = 03γ = 05

γ = 08γ = 10

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 050λ

Figure 7 Final adoption size varied with c while keeping other parameters unchanged

02

04

06

08

1

α

00102030405060708091

01λ

02 03 04

(a)

00102030405060708091

02

04

06

08

1

α

01λ

02 03 04

(b)

02

01λ

02 03 04

04

06

08

1

α

00102030405060708091

(c)

λ01 02 03 04

00102030405060708091

02

04

06

08

1

α

(d)

Figure 6 Final adoption size varied with ϵ ϵ value is 00035 0004 00045 and 0005 respectively from (a) to (d)

Security and Communication Networks 9

54 DIOT For the model introduced above it assumes that anode can participate in only one type of spreading in each timeslice either local or global propagation In reality differentpropagationsmay act on nodes at the same time sowe also carryout research on this scenario

In SIOT hybrid contagion the spreading rate for localand global propagation is λL αλ and λG (1 minus α)λ re-spectively while λL + λG λ the parameter α is used to

adjust contagion attendance for different propagationsCompared with SIOT hybrid contagion the spreading rateof DIOT does not have such constraints λL and λG areisolated this also means that a node can receive messagesfrom local or global nodes in same time slice e in-formation transmission flow can be seen in Figure 12 Be-sides this trivial difference other transmission parametersand contagion process are the same with SIOT hybrid

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(a)

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(b)

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(c)

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(d)

Figure 8 Final adoption size varied with T (a) to (d) illustrate the result of T1 T 2 T 3 and T 4 respectively

01

005 01 015 02 025 03 035 04 045 05

02

03

04

05

06

07

08

09

1 1

09

08

07

06

05

04

03

02

01

0

λ

α

Figure 9 Final adoption size varied with ϵ in BA network ϵ value is00035 0004 00045 and 0005 respectively

λ = 03

λ = 05

λ = 07

λ = 01λ = 015

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 05 06 07 08 09 100α

Figure 10 Final adoption size varied with α in SIOT

10 Security and Communication Networks

transmission For illustration convenience we set λL λ andintroduced global transmission rate scale parameter ζ tochange transmission rate of λG that is λG λζ the value ofζ is from 1 to 100 As illustrated in Figure 13 we can find thatnodes spread in the DIOT mode can reach outbreakthreshold at lower λ than in the SIOTmodeWhen λ is largerthan 012 it may reach the outbreak threshold but if thevalue of λ is smaller than 0005 it can never outbreak e

final adoption size R(infin) changes with ζ as shown inFigure 14 we can find the multiple factor ζ can play a majorrole when its value is small and as it increases the globaltransmission rate will be too small to affect the adoptionresult We can find from Figure 15 that changing the globalspreading rate can vary the approach speed to full outbreakbut the critical point is the same which means the dis-continuous growth is controlled by local propagation

α = 01α = 03α = 05

α = 07α = 09

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 05 06 07 08 09 10λ

Figure 11 Final adoption size varied with λ in SIOT

Node u gets into adopted state

No

Yes

ltγ

geγ

No

Yes

Node u gets into recovery state

Sample recovery

If infected

If infected

Receive message from global nodes

rate is λG T = 3

Receive message from adopted neighbor

rate is λL T = 1

Node u is in susceptible state atthe beginning

Figure 12 e flow chart of node state transferring in each spread phase a node will act in both local and global propagation

Security and Communication Networks 11

6 Conclusion

In this paper we studied the effects of hybrid propagationwith different spreading rates and memory reinforcementson botnet contagions We first proposed an informationcontagion model to describe the botnet spreading dynamicson complex networks We then developed a generalizedheterogeneous edge-based compartmental theory to de-scribe the proposed model

rough extensive numerical simulations on the ERnetwork and BA network we found that the growth patternof the final behavior size R(infin) versus the hybrid ratio αexhibits discontinuous pattern when fixed transmission rateλ is large But when λ is small R(infin) shows the phenomenonof fluctuation and at critical point it reaches peak value firstfollowed with small amplitude declining and gradually risingIn addition we also fixed the hybrid ratio α to analyze the finaladoption size R(infin) changing with transmission rate λ andthe growth pattern of R(infin) changing from continuous todiscontinuous is observed

For comparing the effect of different hybrid methodsSIOT and DIOT are proposed and the simulation result ispresented obviously DIOT can spread faster especiallywhen global transmission rate is high We finally studied theeffect of other parameters and found that memory thresholdT recovery rate c and global propagation range controller ϵcan affect R(infin) growing pattern respectively when T issmall it grows much faster because more seeds can begenerated and global spreading can contribute more Withincreasing c it gets slower to reach the burst value Alsoglobal range controller ϵ can change the pattern when ϵ getslarger it reaches critical value much faster By introducinghybrid propagation mechanism and spreading scope con-troller with memory character the method can supportmodeling different spreading scenarios flexibly but itsimplifies the life states of bot and the immune charac-teristics of nodes are not taken into account so our futurework will focus on these points

Our proposed theory agrees well with the numericalsimulations on ER and BA networksemodel proposed inthis paper can provide theoretical reference for hybridpropagation modeling of botnet in complex networks andalso provide guidance for medical industry to deal withbotnet threats

Data Availability

We conducted our experiment with the numerical simu-lation method without using any open dataset

Conflicts of Interest

e authors declare that there are no conflicts of interestregarding the publication of this paper

Acknowledgments

is study was financially supported in part by a program ofNational Natural Science Foundation of China (NSFC)

1090807060504030201

α

005 01 015 02 025 03 035 04λ

0908070605040302010

Figure 13 DIOT propagation e final behavior adoption sizeR(infin) versus the global transmission rate scale and localtransmission rate other parameters are N 10000 ϵ 0004T 3 and c 05 respectively e lines are the theoreticalpredictions

λ = 006

λ = 007

λ = 015

λ = 009λ = 01

λ = 03

λ = 008

λ = 0050

02

04

06

08

1

12

R (infin

)

10 20 30 40 50 60 70 80 90 1000ζ

Figure 14 Final adoption size R(infin) varied with ζ in DIOT

14 λ15 λ110 λ

12 λ13 λ

λ

0

02

04

06

08

1

12

R (infin

)

01 02 03 040λ

Figure 15 Final adoption size R(infin) varied with λ in DIOT

12 Security and Communication Networks

(grant nos 61272447 and 61802271) and in part by theFundamental Research Funds for the Central Universities(grant nos SCU2018D018 and SCU2018D022) is supportis gratefully acknowledged

References

[1] M Antonakakis T April M Bailey et al ldquoUnderstanding themirai botnetrdquo in Proceedings of the 26th USENIX SecuritySymposium pp 1093ndash1110 USENIX Security 17 VancouverBC Canada August 2017

[2] C Kolias G Kambourakis A Stavrou and J Voas ldquoDdos inthe IoT mirai and other botnetsrdquo Computer vol 50 no 7pp 80ndash84 2017

[3] D Chen N Zhang R Lu N Cheng K Zhang and Z QinldquoChannel precoding based message authentication in wirelessnetworks challenges and solutionsrdquo IEEE Network vol 33no 1 pp 99ndash105 2019

[4] D Chen N Zhang Z Qin et al ldquoS2M a lightweight acousticfingerprints-based wireless device authentication protocolrdquoIEEE Internet of ltings Journal vol 4 no 1 pp 88ndash100 2016

[5] Q Wang D Chen N Zhang Z Qin and Z Qin ldquoLACS alightweight label-based access control scheme in IoT-based5G caching contextrdquo IEEE Access vol 5 pp 4018ndash4027 2017

[6] K Zhang X Liang J Ni K Yang and X S Shen ldquoExploitingsocial network to enhance human-to-human infection anal-ysis without privacy leakagerdquo IEEE Transactions on De-pendable and Secure Computing vol 15 no 4 pp 607ndash6202016

[7] C Zhang S Zhou J C Miller I J Cox and B M ChainldquoOptimizing hybrid spreading in metapopulationsrdquo ScientificReports vol 5 no 1 p 9924 2015

[8] R M Anderson ldquoDiscussion the Kermack-McKendrickepidemic threshold theoremrdquo Bulletin of Mathematical Bi-ology vol 53 no 1-2 pp 3ndash32 1991

[9] M Newman Networks An Introduction Oxford UniversityPress Oxford UK 2010

[10] M Feily A Shahrestani and S Ramadass ldquoA survey of botnetand botnet detectionrdquo in Proceedings of the 2009 ltird In-ternational Conference on Emerging Security InformationSystems and Technologies pp 268ndash273 IEEE Athens GreeceJune 2009

[11] A Laha N Zhang H Wu D Chen and T Han ldquoOnlineproactive caching in mobile edge computing using bi-directional deep recurrent neural networkrdquo IEEE Internet ofltings Journal vol 6 no 3 pp 5520ndash5530 2019

[12] E Bertino and N Islam ldquoBotnets and internet of things se-curityrdquo Computer vol 50 no 2 pp 76ndash79 2017

[13] D Chen N Zhang N Cheng K Zhang Z Qin andX S Shen ldquoPhysical layer based message authentication withsecure channel codesrdquo IEEE Transactions on Dependable andSecure Computing p 1 2018

[14] Q Wang D Chen N Zhang Z Ding and Z Qin ldquoPCP aprivacy-preserving content-based publish-subscribe schemewith differential privacy in fog computingrdquo IEEE Accessvol 5 pp 17962ndash17974 2017

[15] D Acarali M Rajarajan N Komninos and B B ZarpelatildeoldquoModelling the spread of botnet malware in IoT-basedwireless sensor networksrdquo Security and CommunicationNetworks vol 2019 Article ID 3745619 13 pages 2019

[16] M Ajelli R Lo Cigno and A Montresor ldquoModeling botnetsand epidemic malwarerdquo in Proceedings of the 2010 IEEEInternational Conference on Communications pp 1ndash5 IEEECape Town South Africa May 2010

[17] M J Farooq and Q Zhu ldquoModeling analysis and mitigationof dynamic botnet formation in wireless IoT networksrdquo IEEETransactions on Information Forensics and Security vol 14no 9 pp 2412ndash2426 2019

[18] B K Mishra and D K Saini ldquoSEIRS epidemic model withdelay for transmission of malicious objects in computernetworkrdquo Applied Mathematics and Computation vol 188no 2 pp 1476ndash1482 2007

[19] A Singh A K Awasthi K Singh and P K SrivastavaldquoModeling and analysis of worm propagation in wirelesssensor networksrdquoWireless Personal Communications vol 98no 3 pp 2535ndash2551 2018

[20] D Dagon C C Zou andW Lee ldquoModeling botnet propagationusing time zonesrdquo in Proceedings of the NDSS Symposium 2006vol 6 pp 2ndash13 San Diego CA USA February 2006

[21] M Todd Gardner C C Beard and M Deep ldquoUsing seirsepidemicmodels for IoT botnets attacksrdquo in Proceedings of theDRCN 2017mdashDesign of Reliable Communication Networkspp 1ndash8 Munich Germany March 2017

[22] C Castellano S Fortunato and V Loreto ldquoStatistical physicsof social dynamicsrdquo Reviews of Modern Physics vol 81 no 2pp 591ndash646 2009

[23] J C Flack and R M DrsquoSouza ldquoe digital age and the futureof social network science and engineeringrdquo Proceedings of theIEEE vol 102 no 12 pp 1873ndash1877 2014

[24] R Pastor-Satorras C Castellano P Van Mieghem andA Vespignani ldquoEpidemic processes in complex networksrdquoReviews of Modern Physics vol 87 no 3 pp 925ndash979 2015

[25] V Constantin Craciun A Mogage and E Simion ldquoTrends indesign of ransomware virusesrdquo in International Conference onSecurity for Information Technology and Communicationspp 259ndash272 Springer Berlin Germany 2018

[26] S Mohurle and M Patil ldquoA brief study of wannacry threatransomware attack 2017rdquo International Journal of AdvancedResearch in Computer Science vol 8 no 5 2017

[27] A Zimba L Simukonda and M Chishimba ldquoDemystifyingransomware attacks reverse engineering and dynamic mal-ware analysis of wannacry for network and information se-curityrdquo Zambia ICT Journal vol 1 no 1 pp 35ndash40 2017

[28] S Aral and DWalker ldquoIdentifying influential and susceptiblemembers of social networksrdquo Science vol 337 no 6092pp 337ndash341 2012

[29] A Banerjee A G Chandrasekhar E Duflo and M O Jacksonldquoe diffusion ofmicrofinancerdquo Science vol 341 no 6144 article1236498 2013

[30] P S Dodds and D J Watts ldquoUniversal behavior in a gen-eralized model of contagionrdquo Physical Review Letters vol 92no 21 article 218701 2004

[31] D J Watts ldquoA simple model of global cascades on randomnetworksrdquo Proceedings of the National Academy of Sciencesvol 99 no 9 pp 5766ndash5771 2002

[32] P S Dodds and D J Watts ldquoA generalized model of socialand biological contagionrdquo Journal of lteoretical Biologyvol 232 no 4 pp 587ndash604 2005

[33] W Wang X-L Chen and L-F Zhong ldquoSocial contagionswith heterogeneous credibilityrdquo Physica A Statistical Me-chanics and Its Applications vol 503 pp 604ndash610 2018

[34] J C Miller ldquoA note on a paper by Erik Volz sir dynamics inrandom networksrdquo Journal of Mathematical Biology vol 62no 3 pp 349ndash358 2011

[35] W Wang M Tang P Shu and Z Wang ldquoDynamics of socialcontagions with heterogeneous adoption thresholds cross-over phenomena in phase transitionrdquo New Journal of Physicsvol 18 no 1 article 013029 2016

Security and Communication Networks 13

[36] W Wang M Tang H-F Zhang H Gao Y Do andZ-H Liu ldquoEpidemic spreading on complex networks withgeneral degree and weight distributionsrdquo Physical Review Evol 90 no 4 article 042803 2014

[37] P Erdos and A Renyi ldquoOn random graphs Irdquo PublicationesMathematicae Debrecen vol 6 pp 290ndash297 1959

[38] A Hagberg D Schult P Swart et al Networkx High pro-ductivity software for complex networks Webova Stra Nka2013 httpsnetworkxlanlgovwiki

14 Security and Communication Networks

distribution Generally the BA network can reach the burstthreshold much faster than the ER network under the samelambda condition as shown in Figure 10 In the same way wefixed hybrid ratio α and observed the change of final adoption

size with spreading rate from Figure 11 it can be seen thatwhen global propagation dominates it spreads faster than theER network but when the local propagation ratio increasesthe difference between these two network gets smaller

γ = 01γ = 03γ = 05

γ = 08γ = 10

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 050λ

Figure 7 Final adoption size varied with c while keeping other parameters unchanged

02

04

06

08

1

α

00102030405060708091

01λ

02 03 04

(a)

00102030405060708091

02

04

06

08

1

α

01λ

02 03 04

(b)

02

01λ

02 03 04

04

06

08

1

α

00102030405060708091

(c)

λ01 02 03 04

00102030405060708091

02

04

06

08

1

α

(d)

Figure 6 Final adoption size varied with ϵ ϵ value is 00035 0004 00045 and 0005 respectively from (a) to (d)

Security and Communication Networks 9

54 DIOT For the model introduced above it assumes that anode can participate in only one type of spreading in each timeslice either local or global propagation In reality differentpropagationsmay act on nodes at the same time sowe also carryout research on this scenario

In SIOT hybrid contagion the spreading rate for localand global propagation is λL αλ and λG (1 minus α)λ re-spectively while λL + λG λ the parameter α is used to

adjust contagion attendance for different propagationsCompared with SIOT hybrid contagion the spreading rateof DIOT does not have such constraints λL and λG areisolated this also means that a node can receive messagesfrom local or global nodes in same time slice e in-formation transmission flow can be seen in Figure 12 Be-sides this trivial difference other transmission parametersand contagion process are the same with SIOT hybrid

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(a)

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(b)

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(c)

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(d)

Figure 8 Final adoption size varied with T (a) to (d) illustrate the result of T1 T 2 T 3 and T 4 respectively

01

005 01 015 02 025 03 035 04 045 05

02

03

04

05

06

07

08

09

1 1

09

08

07

06

05

04

03

02

01

0

λ

α

Figure 9 Final adoption size varied with ϵ in BA network ϵ value is00035 0004 00045 and 0005 respectively

λ = 03

λ = 05

λ = 07

λ = 01λ = 015

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 05 06 07 08 09 100α

Figure 10 Final adoption size varied with α in SIOT

10 Security and Communication Networks

transmission For illustration convenience we set λL λ andintroduced global transmission rate scale parameter ζ tochange transmission rate of λG that is λG λζ the value ofζ is from 1 to 100 As illustrated in Figure 13 we can find thatnodes spread in the DIOT mode can reach outbreakthreshold at lower λ than in the SIOTmodeWhen λ is largerthan 012 it may reach the outbreak threshold but if thevalue of λ is smaller than 0005 it can never outbreak e

final adoption size R(infin) changes with ζ as shown inFigure 14 we can find the multiple factor ζ can play a majorrole when its value is small and as it increases the globaltransmission rate will be too small to affect the adoptionresult We can find from Figure 15 that changing the globalspreading rate can vary the approach speed to full outbreakbut the critical point is the same which means the dis-continuous growth is controlled by local propagation

α = 01α = 03α = 05

α = 07α = 09

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 05 06 07 08 09 10λ

Figure 11 Final adoption size varied with λ in SIOT

Node u gets into adopted state

No

Yes

ltγ

geγ

No

Yes

Node u gets into recovery state

Sample recovery

If infected

If infected

Receive message from global nodes

rate is λG T = 3

Receive message from adopted neighbor

rate is λL T = 1

Node u is in susceptible state atthe beginning

Figure 12 e flow chart of node state transferring in each spread phase a node will act in both local and global propagation

Security and Communication Networks 11

6 Conclusion

In this paper we studied the effects of hybrid propagationwith different spreading rates and memory reinforcementson botnet contagions We first proposed an informationcontagion model to describe the botnet spreading dynamicson complex networks We then developed a generalizedheterogeneous edge-based compartmental theory to de-scribe the proposed model

rough extensive numerical simulations on the ERnetwork and BA network we found that the growth patternof the final behavior size R(infin) versus the hybrid ratio αexhibits discontinuous pattern when fixed transmission rateλ is large But when λ is small R(infin) shows the phenomenonof fluctuation and at critical point it reaches peak value firstfollowed with small amplitude declining and gradually risingIn addition we also fixed the hybrid ratio α to analyze the finaladoption size R(infin) changing with transmission rate λ andthe growth pattern of R(infin) changing from continuous todiscontinuous is observed

For comparing the effect of different hybrid methodsSIOT and DIOT are proposed and the simulation result ispresented obviously DIOT can spread faster especiallywhen global transmission rate is high We finally studied theeffect of other parameters and found that memory thresholdT recovery rate c and global propagation range controller ϵcan affect R(infin) growing pattern respectively when T issmall it grows much faster because more seeds can begenerated and global spreading can contribute more Withincreasing c it gets slower to reach the burst value Alsoglobal range controller ϵ can change the pattern when ϵ getslarger it reaches critical value much faster By introducinghybrid propagation mechanism and spreading scope con-troller with memory character the method can supportmodeling different spreading scenarios flexibly but itsimplifies the life states of bot and the immune charac-teristics of nodes are not taken into account so our futurework will focus on these points

Our proposed theory agrees well with the numericalsimulations on ER and BA networksemodel proposed inthis paper can provide theoretical reference for hybridpropagation modeling of botnet in complex networks andalso provide guidance for medical industry to deal withbotnet threats

Data Availability

We conducted our experiment with the numerical simu-lation method without using any open dataset

Conflicts of Interest

e authors declare that there are no conflicts of interestregarding the publication of this paper

Acknowledgments

is study was financially supported in part by a program ofNational Natural Science Foundation of China (NSFC)

1090807060504030201

α

005 01 015 02 025 03 035 04λ

0908070605040302010

Figure 13 DIOT propagation e final behavior adoption sizeR(infin) versus the global transmission rate scale and localtransmission rate other parameters are N 10000 ϵ 0004T 3 and c 05 respectively e lines are the theoreticalpredictions

λ = 006

λ = 007

λ = 015

λ = 009λ = 01

λ = 03

λ = 008

λ = 0050

02

04

06

08

1

12

R (infin

)

10 20 30 40 50 60 70 80 90 1000ζ

Figure 14 Final adoption size R(infin) varied with ζ in DIOT

14 λ15 λ110 λ

12 λ13 λ

λ

0

02

04

06

08

1

12

R (infin

)

01 02 03 040λ

Figure 15 Final adoption size R(infin) varied with λ in DIOT

12 Security and Communication Networks

(grant nos 61272447 and 61802271) and in part by theFundamental Research Funds for the Central Universities(grant nos SCU2018D018 and SCU2018D022) is supportis gratefully acknowledged

References

[1] M Antonakakis T April M Bailey et al ldquoUnderstanding themirai botnetrdquo in Proceedings of the 26th USENIX SecuritySymposium pp 1093ndash1110 USENIX Security 17 VancouverBC Canada August 2017

[2] C Kolias G Kambourakis A Stavrou and J Voas ldquoDdos inthe IoT mirai and other botnetsrdquo Computer vol 50 no 7pp 80ndash84 2017

[3] D Chen N Zhang R Lu N Cheng K Zhang and Z QinldquoChannel precoding based message authentication in wirelessnetworks challenges and solutionsrdquo IEEE Network vol 33no 1 pp 99ndash105 2019

[4] D Chen N Zhang Z Qin et al ldquoS2M a lightweight acousticfingerprints-based wireless device authentication protocolrdquoIEEE Internet of ltings Journal vol 4 no 1 pp 88ndash100 2016

[5] Q Wang D Chen N Zhang Z Qin and Z Qin ldquoLACS alightweight label-based access control scheme in IoT-based5G caching contextrdquo IEEE Access vol 5 pp 4018ndash4027 2017

[6] K Zhang X Liang J Ni K Yang and X S Shen ldquoExploitingsocial network to enhance human-to-human infection anal-ysis without privacy leakagerdquo IEEE Transactions on De-pendable and Secure Computing vol 15 no 4 pp 607ndash6202016

[7] C Zhang S Zhou J C Miller I J Cox and B M ChainldquoOptimizing hybrid spreading in metapopulationsrdquo ScientificReports vol 5 no 1 p 9924 2015

[8] R M Anderson ldquoDiscussion the Kermack-McKendrickepidemic threshold theoremrdquo Bulletin of Mathematical Bi-ology vol 53 no 1-2 pp 3ndash32 1991

[9] M Newman Networks An Introduction Oxford UniversityPress Oxford UK 2010

[10] M Feily A Shahrestani and S Ramadass ldquoA survey of botnetand botnet detectionrdquo in Proceedings of the 2009 ltird In-ternational Conference on Emerging Security InformationSystems and Technologies pp 268ndash273 IEEE Athens GreeceJune 2009

[11] A Laha N Zhang H Wu D Chen and T Han ldquoOnlineproactive caching in mobile edge computing using bi-directional deep recurrent neural networkrdquo IEEE Internet ofltings Journal vol 6 no 3 pp 5520ndash5530 2019

[12] E Bertino and N Islam ldquoBotnets and internet of things se-curityrdquo Computer vol 50 no 2 pp 76ndash79 2017

[13] D Chen N Zhang N Cheng K Zhang Z Qin andX S Shen ldquoPhysical layer based message authentication withsecure channel codesrdquo IEEE Transactions on Dependable andSecure Computing p 1 2018

[14] Q Wang D Chen N Zhang Z Ding and Z Qin ldquoPCP aprivacy-preserving content-based publish-subscribe schemewith differential privacy in fog computingrdquo IEEE Accessvol 5 pp 17962ndash17974 2017

[15] D Acarali M Rajarajan N Komninos and B B ZarpelatildeoldquoModelling the spread of botnet malware in IoT-basedwireless sensor networksrdquo Security and CommunicationNetworks vol 2019 Article ID 3745619 13 pages 2019

[16] M Ajelli R Lo Cigno and A Montresor ldquoModeling botnetsand epidemic malwarerdquo in Proceedings of the 2010 IEEEInternational Conference on Communications pp 1ndash5 IEEECape Town South Africa May 2010

[17] M J Farooq and Q Zhu ldquoModeling analysis and mitigationof dynamic botnet formation in wireless IoT networksrdquo IEEETransactions on Information Forensics and Security vol 14no 9 pp 2412ndash2426 2019

[18] B K Mishra and D K Saini ldquoSEIRS epidemic model withdelay for transmission of malicious objects in computernetworkrdquo Applied Mathematics and Computation vol 188no 2 pp 1476ndash1482 2007

[19] A Singh A K Awasthi K Singh and P K SrivastavaldquoModeling and analysis of worm propagation in wirelesssensor networksrdquoWireless Personal Communications vol 98no 3 pp 2535ndash2551 2018

[20] D Dagon C C Zou andW Lee ldquoModeling botnet propagationusing time zonesrdquo in Proceedings of the NDSS Symposium 2006vol 6 pp 2ndash13 San Diego CA USA February 2006

[21] M Todd Gardner C C Beard and M Deep ldquoUsing seirsepidemicmodels for IoT botnets attacksrdquo in Proceedings of theDRCN 2017mdashDesign of Reliable Communication Networkspp 1ndash8 Munich Germany March 2017

[22] C Castellano S Fortunato and V Loreto ldquoStatistical physicsof social dynamicsrdquo Reviews of Modern Physics vol 81 no 2pp 591ndash646 2009

[23] J C Flack and R M DrsquoSouza ldquoe digital age and the futureof social network science and engineeringrdquo Proceedings of theIEEE vol 102 no 12 pp 1873ndash1877 2014

[24] R Pastor-Satorras C Castellano P Van Mieghem andA Vespignani ldquoEpidemic processes in complex networksrdquoReviews of Modern Physics vol 87 no 3 pp 925ndash979 2015

[25] V Constantin Craciun A Mogage and E Simion ldquoTrends indesign of ransomware virusesrdquo in International Conference onSecurity for Information Technology and Communicationspp 259ndash272 Springer Berlin Germany 2018

[26] S Mohurle and M Patil ldquoA brief study of wannacry threatransomware attack 2017rdquo International Journal of AdvancedResearch in Computer Science vol 8 no 5 2017

[27] A Zimba L Simukonda and M Chishimba ldquoDemystifyingransomware attacks reverse engineering and dynamic mal-ware analysis of wannacry for network and information se-curityrdquo Zambia ICT Journal vol 1 no 1 pp 35ndash40 2017

[28] S Aral and DWalker ldquoIdentifying influential and susceptiblemembers of social networksrdquo Science vol 337 no 6092pp 337ndash341 2012

[29] A Banerjee A G Chandrasekhar E Duflo and M O Jacksonldquoe diffusion ofmicrofinancerdquo Science vol 341 no 6144 article1236498 2013

[30] P S Dodds and D J Watts ldquoUniversal behavior in a gen-eralized model of contagionrdquo Physical Review Letters vol 92no 21 article 218701 2004

[31] D J Watts ldquoA simple model of global cascades on randomnetworksrdquo Proceedings of the National Academy of Sciencesvol 99 no 9 pp 5766ndash5771 2002

[32] P S Dodds and D J Watts ldquoA generalized model of socialand biological contagionrdquo Journal of lteoretical Biologyvol 232 no 4 pp 587ndash604 2005

[33] W Wang X-L Chen and L-F Zhong ldquoSocial contagionswith heterogeneous credibilityrdquo Physica A Statistical Me-chanics and Its Applications vol 503 pp 604ndash610 2018

[34] J C Miller ldquoA note on a paper by Erik Volz sir dynamics inrandom networksrdquo Journal of Mathematical Biology vol 62no 3 pp 349ndash358 2011

[35] W Wang M Tang P Shu and Z Wang ldquoDynamics of socialcontagions with heterogeneous adoption thresholds cross-over phenomena in phase transitionrdquo New Journal of Physicsvol 18 no 1 article 013029 2016

Security and Communication Networks 13

[36] W Wang M Tang H-F Zhang H Gao Y Do andZ-H Liu ldquoEpidemic spreading on complex networks withgeneral degree and weight distributionsrdquo Physical Review Evol 90 no 4 article 042803 2014

[37] P Erdos and A Renyi ldquoOn random graphs Irdquo PublicationesMathematicae Debrecen vol 6 pp 290ndash297 1959

[38] A Hagberg D Schult P Swart et al Networkx High pro-ductivity software for complex networks Webova Stra Nka2013 httpsnetworkxlanlgovwiki

14 Security and Communication Networks

54 DIOT For the model introduced above it assumes that anode can participate in only one type of spreading in each timeslice either local or global propagation In reality differentpropagationsmay act on nodes at the same time sowe also carryout research on this scenario

In SIOT hybrid contagion the spreading rate for localand global propagation is λL αλ and λG (1 minus α)λ re-spectively while λL + λG λ the parameter α is used to

adjust contagion attendance for different propagationsCompared with SIOT hybrid contagion the spreading rateof DIOT does not have such constraints λL and λG areisolated this also means that a node can receive messagesfrom local or global nodes in same time slice e in-formation transmission flow can be seen in Figure 12 Be-sides this trivial difference other transmission parametersand contagion process are the same with SIOT hybrid

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(a)

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(b)

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(c)

02

04

06

08

1

α

01λ

02 03 0400102030405060708091

(d)

Figure 8 Final adoption size varied with T (a) to (d) illustrate the result of T1 T 2 T 3 and T 4 respectively

01

005 01 015 02 025 03 035 04 045 05

02

03

04

05

06

07

08

09

1 1

09

08

07

06

05

04

03

02

01

0

λ

α

Figure 9 Final adoption size varied with ϵ in BA network ϵ value is00035 0004 00045 and 0005 respectively

λ = 03

λ = 05

λ = 07

λ = 01λ = 015

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 05 06 07 08 09 100α

Figure 10 Final adoption size varied with α in SIOT

10 Security and Communication Networks

transmission For illustration convenience we set λL λ andintroduced global transmission rate scale parameter ζ tochange transmission rate of λG that is λG λζ the value ofζ is from 1 to 100 As illustrated in Figure 13 we can find thatnodes spread in the DIOT mode can reach outbreakthreshold at lower λ than in the SIOTmodeWhen λ is largerthan 012 it may reach the outbreak threshold but if thevalue of λ is smaller than 0005 it can never outbreak e

final adoption size R(infin) changes with ζ as shown inFigure 14 we can find the multiple factor ζ can play a majorrole when its value is small and as it increases the globaltransmission rate will be too small to affect the adoptionresult We can find from Figure 15 that changing the globalspreading rate can vary the approach speed to full outbreakbut the critical point is the same which means the dis-continuous growth is controlled by local propagation

α = 01α = 03α = 05

α = 07α = 09

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 05 06 07 08 09 10λ

Figure 11 Final adoption size varied with λ in SIOT

Node u gets into adopted state

No

Yes

ltγ

geγ

No

Yes

Node u gets into recovery state

Sample recovery

If infected

If infected

Receive message from global nodes

rate is λG T = 3

Receive message from adopted neighbor

rate is λL T = 1

Node u is in susceptible state atthe beginning

Figure 12 e flow chart of node state transferring in each spread phase a node will act in both local and global propagation

Security and Communication Networks 11

6 Conclusion

In this paper we studied the effects of hybrid propagationwith different spreading rates and memory reinforcementson botnet contagions We first proposed an informationcontagion model to describe the botnet spreading dynamicson complex networks We then developed a generalizedheterogeneous edge-based compartmental theory to de-scribe the proposed model

rough extensive numerical simulations on the ERnetwork and BA network we found that the growth patternof the final behavior size R(infin) versus the hybrid ratio αexhibits discontinuous pattern when fixed transmission rateλ is large But when λ is small R(infin) shows the phenomenonof fluctuation and at critical point it reaches peak value firstfollowed with small amplitude declining and gradually risingIn addition we also fixed the hybrid ratio α to analyze the finaladoption size R(infin) changing with transmission rate λ andthe growth pattern of R(infin) changing from continuous todiscontinuous is observed

For comparing the effect of different hybrid methodsSIOT and DIOT are proposed and the simulation result ispresented obviously DIOT can spread faster especiallywhen global transmission rate is high We finally studied theeffect of other parameters and found that memory thresholdT recovery rate c and global propagation range controller ϵcan affect R(infin) growing pattern respectively when T issmall it grows much faster because more seeds can begenerated and global spreading can contribute more Withincreasing c it gets slower to reach the burst value Alsoglobal range controller ϵ can change the pattern when ϵ getslarger it reaches critical value much faster By introducinghybrid propagation mechanism and spreading scope con-troller with memory character the method can supportmodeling different spreading scenarios flexibly but itsimplifies the life states of bot and the immune charac-teristics of nodes are not taken into account so our futurework will focus on these points

Our proposed theory agrees well with the numericalsimulations on ER and BA networksemodel proposed inthis paper can provide theoretical reference for hybridpropagation modeling of botnet in complex networks andalso provide guidance for medical industry to deal withbotnet threats

Data Availability

We conducted our experiment with the numerical simu-lation method without using any open dataset

Conflicts of Interest

e authors declare that there are no conflicts of interestregarding the publication of this paper

Acknowledgments

is study was financially supported in part by a program ofNational Natural Science Foundation of China (NSFC)

1090807060504030201

α

005 01 015 02 025 03 035 04λ

0908070605040302010

Figure 13 DIOT propagation e final behavior adoption sizeR(infin) versus the global transmission rate scale and localtransmission rate other parameters are N 10000 ϵ 0004T 3 and c 05 respectively e lines are the theoreticalpredictions

λ = 006

λ = 007

λ = 015

λ = 009λ = 01

λ = 03

λ = 008

λ = 0050

02

04

06

08

1

12

R (infin

)

10 20 30 40 50 60 70 80 90 1000ζ

Figure 14 Final adoption size R(infin) varied with ζ in DIOT

14 λ15 λ110 λ

12 λ13 λ

λ

0

02

04

06

08

1

12

R (infin

)

01 02 03 040λ

Figure 15 Final adoption size R(infin) varied with λ in DIOT

12 Security and Communication Networks

(grant nos 61272447 and 61802271) and in part by theFundamental Research Funds for the Central Universities(grant nos SCU2018D018 and SCU2018D022) is supportis gratefully acknowledged

References

[1] M Antonakakis T April M Bailey et al ldquoUnderstanding themirai botnetrdquo in Proceedings of the 26th USENIX SecuritySymposium pp 1093ndash1110 USENIX Security 17 VancouverBC Canada August 2017

[2] C Kolias G Kambourakis A Stavrou and J Voas ldquoDdos inthe IoT mirai and other botnetsrdquo Computer vol 50 no 7pp 80ndash84 2017

[3] D Chen N Zhang R Lu N Cheng K Zhang and Z QinldquoChannel precoding based message authentication in wirelessnetworks challenges and solutionsrdquo IEEE Network vol 33no 1 pp 99ndash105 2019

[4] D Chen N Zhang Z Qin et al ldquoS2M a lightweight acousticfingerprints-based wireless device authentication protocolrdquoIEEE Internet of ltings Journal vol 4 no 1 pp 88ndash100 2016

[5] Q Wang D Chen N Zhang Z Qin and Z Qin ldquoLACS alightweight label-based access control scheme in IoT-based5G caching contextrdquo IEEE Access vol 5 pp 4018ndash4027 2017

[6] K Zhang X Liang J Ni K Yang and X S Shen ldquoExploitingsocial network to enhance human-to-human infection anal-ysis without privacy leakagerdquo IEEE Transactions on De-pendable and Secure Computing vol 15 no 4 pp 607ndash6202016

[7] C Zhang S Zhou J C Miller I J Cox and B M ChainldquoOptimizing hybrid spreading in metapopulationsrdquo ScientificReports vol 5 no 1 p 9924 2015

[8] R M Anderson ldquoDiscussion the Kermack-McKendrickepidemic threshold theoremrdquo Bulletin of Mathematical Bi-ology vol 53 no 1-2 pp 3ndash32 1991

[9] M Newman Networks An Introduction Oxford UniversityPress Oxford UK 2010

[10] M Feily A Shahrestani and S Ramadass ldquoA survey of botnetand botnet detectionrdquo in Proceedings of the 2009 ltird In-ternational Conference on Emerging Security InformationSystems and Technologies pp 268ndash273 IEEE Athens GreeceJune 2009

[11] A Laha N Zhang H Wu D Chen and T Han ldquoOnlineproactive caching in mobile edge computing using bi-directional deep recurrent neural networkrdquo IEEE Internet ofltings Journal vol 6 no 3 pp 5520ndash5530 2019

[12] E Bertino and N Islam ldquoBotnets and internet of things se-curityrdquo Computer vol 50 no 2 pp 76ndash79 2017

[13] D Chen N Zhang N Cheng K Zhang Z Qin andX S Shen ldquoPhysical layer based message authentication withsecure channel codesrdquo IEEE Transactions on Dependable andSecure Computing p 1 2018

[14] Q Wang D Chen N Zhang Z Ding and Z Qin ldquoPCP aprivacy-preserving content-based publish-subscribe schemewith differential privacy in fog computingrdquo IEEE Accessvol 5 pp 17962ndash17974 2017

[15] D Acarali M Rajarajan N Komninos and B B ZarpelatildeoldquoModelling the spread of botnet malware in IoT-basedwireless sensor networksrdquo Security and CommunicationNetworks vol 2019 Article ID 3745619 13 pages 2019

[16] M Ajelli R Lo Cigno and A Montresor ldquoModeling botnetsand epidemic malwarerdquo in Proceedings of the 2010 IEEEInternational Conference on Communications pp 1ndash5 IEEECape Town South Africa May 2010

[17] M J Farooq and Q Zhu ldquoModeling analysis and mitigationof dynamic botnet formation in wireless IoT networksrdquo IEEETransactions on Information Forensics and Security vol 14no 9 pp 2412ndash2426 2019

[18] B K Mishra and D K Saini ldquoSEIRS epidemic model withdelay for transmission of malicious objects in computernetworkrdquo Applied Mathematics and Computation vol 188no 2 pp 1476ndash1482 2007

[19] A Singh A K Awasthi K Singh and P K SrivastavaldquoModeling and analysis of worm propagation in wirelesssensor networksrdquoWireless Personal Communications vol 98no 3 pp 2535ndash2551 2018

[20] D Dagon C C Zou andW Lee ldquoModeling botnet propagationusing time zonesrdquo in Proceedings of the NDSS Symposium 2006vol 6 pp 2ndash13 San Diego CA USA February 2006

[21] M Todd Gardner C C Beard and M Deep ldquoUsing seirsepidemicmodels for IoT botnets attacksrdquo in Proceedings of theDRCN 2017mdashDesign of Reliable Communication Networkspp 1ndash8 Munich Germany March 2017

[22] C Castellano S Fortunato and V Loreto ldquoStatistical physicsof social dynamicsrdquo Reviews of Modern Physics vol 81 no 2pp 591ndash646 2009

[23] J C Flack and R M DrsquoSouza ldquoe digital age and the futureof social network science and engineeringrdquo Proceedings of theIEEE vol 102 no 12 pp 1873ndash1877 2014

[24] R Pastor-Satorras C Castellano P Van Mieghem andA Vespignani ldquoEpidemic processes in complex networksrdquoReviews of Modern Physics vol 87 no 3 pp 925ndash979 2015

[25] V Constantin Craciun A Mogage and E Simion ldquoTrends indesign of ransomware virusesrdquo in International Conference onSecurity for Information Technology and Communicationspp 259ndash272 Springer Berlin Germany 2018

[26] S Mohurle and M Patil ldquoA brief study of wannacry threatransomware attack 2017rdquo International Journal of AdvancedResearch in Computer Science vol 8 no 5 2017

[27] A Zimba L Simukonda and M Chishimba ldquoDemystifyingransomware attacks reverse engineering and dynamic mal-ware analysis of wannacry for network and information se-curityrdquo Zambia ICT Journal vol 1 no 1 pp 35ndash40 2017

[28] S Aral and DWalker ldquoIdentifying influential and susceptiblemembers of social networksrdquo Science vol 337 no 6092pp 337ndash341 2012

[29] A Banerjee A G Chandrasekhar E Duflo and M O Jacksonldquoe diffusion ofmicrofinancerdquo Science vol 341 no 6144 article1236498 2013

[30] P S Dodds and D J Watts ldquoUniversal behavior in a gen-eralized model of contagionrdquo Physical Review Letters vol 92no 21 article 218701 2004

[31] D J Watts ldquoA simple model of global cascades on randomnetworksrdquo Proceedings of the National Academy of Sciencesvol 99 no 9 pp 5766ndash5771 2002

[32] P S Dodds and D J Watts ldquoA generalized model of socialand biological contagionrdquo Journal of lteoretical Biologyvol 232 no 4 pp 587ndash604 2005

[33] W Wang X-L Chen and L-F Zhong ldquoSocial contagionswith heterogeneous credibilityrdquo Physica A Statistical Me-chanics and Its Applications vol 503 pp 604ndash610 2018

[34] J C Miller ldquoA note on a paper by Erik Volz sir dynamics inrandom networksrdquo Journal of Mathematical Biology vol 62no 3 pp 349ndash358 2011

[35] W Wang M Tang P Shu and Z Wang ldquoDynamics of socialcontagions with heterogeneous adoption thresholds cross-over phenomena in phase transitionrdquo New Journal of Physicsvol 18 no 1 article 013029 2016

Security and Communication Networks 13

[36] W Wang M Tang H-F Zhang H Gao Y Do andZ-H Liu ldquoEpidemic spreading on complex networks withgeneral degree and weight distributionsrdquo Physical Review Evol 90 no 4 article 042803 2014

[37] P Erdos and A Renyi ldquoOn random graphs Irdquo PublicationesMathematicae Debrecen vol 6 pp 290ndash297 1959

[38] A Hagberg D Schult P Swart et al Networkx High pro-ductivity software for complex networks Webova Stra Nka2013 httpsnetworkxlanlgovwiki

14 Security and Communication Networks

transmission For illustration convenience we set λL λ andintroduced global transmission rate scale parameter ζ tochange transmission rate of λG that is λG λζ the value ofζ is from 1 to 100 As illustrated in Figure 13 we can find thatnodes spread in the DIOT mode can reach outbreakthreshold at lower λ than in the SIOTmodeWhen λ is largerthan 012 it may reach the outbreak threshold but if thevalue of λ is smaller than 0005 it can never outbreak e

final adoption size R(infin) changes with ζ as shown inFigure 14 we can find the multiple factor ζ can play a majorrole when its value is small and as it increases the globaltransmission rate will be too small to affect the adoptionresult We can find from Figure 15 that changing the globalspreading rate can vary the approach speed to full outbreakbut the critical point is the same which means the dis-continuous growth is controlled by local propagation

α = 01α = 03α = 05

α = 07α = 09

0

02

04

06

08

1

12

R (infin

)

01 02 03 04 05 06 07 08 09 10λ

Figure 11 Final adoption size varied with λ in SIOT

Node u gets into adopted state

No

Yes

ltγ

geγ

No

Yes

Node u gets into recovery state

Sample recovery

If infected

If infected

Receive message from global nodes

rate is λG T = 3

Receive message from adopted neighbor

rate is λL T = 1

Node u is in susceptible state atthe beginning

Figure 12 e flow chart of node state transferring in each spread phase a node will act in both local and global propagation

Security and Communication Networks 11

6 Conclusion

In this paper we studied the effects of hybrid propagationwith different spreading rates and memory reinforcementson botnet contagions We first proposed an informationcontagion model to describe the botnet spreading dynamicson complex networks We then developed a generalizedheterogeneous edge-based compartmental theory to de-scribe the proposed model

rough extensive numerical simulations on the ERnetwork and BA network we found that the growth patternof the final behavior size R(infin) versus the hybrid ratio αexhibits discontinuous pattern when fixed transmission rateλ is large But when λ is small R(infin) shows the phenomenonof fluctuation and at critical point it reaches peak value firstfollowed with small amplitude declining and gradually risingIn addition we also fixed the hybrid ratio α to analyze the finaladoption size R(infin) changing with transmission rate λ andthe growth pattern of R(infin) changing from continuous todiscontinuous is observed

For comparing the effect of different hybrid methodsSIOT and DIOT are proposed and the simulation result ispresented obviously DIOT can spread faster especiallywhen global transmission rate is high We finally studied theeffect of other parameters and found that memory thresholdT recovery rate c and global propagation range controller ϵcan affect R(infin) growing pattern respectively when T issmall it grows much faster because more seeds can begenerated and global spreading can contribute more Withincreasing c it gets slower to reach the burst value Alsoglobal range controller ϵ can change the pattern when ϵ getslarger it reaches critical value much faster By introducinghybrid propagation mechanism and spreading scope con-troller with memory character the method can supportmodeling different spreading scenarios flexibly but itsimplifies the life states of bot and the immune charac-teristics of nodes are not taken into account so our futurework will focus on these points

Our proposed theory agrees well with the numericalsimulations on ER and BA networksemodel proposed inthis paper can provide theoretical reference for hybridpropagation modeling of botnet in complex networks andalso provide guidance for medical industry to deal withbotnet threats

Data Availability

We conducted our experiment with the numerical simu-lation method without using any open dataset

Conflicts of Interest

e authors declare that there are no conflicts of interestregarding the publication of this paper

Acknowledgments

is study was financially supported in part by a program ofNational Natural Science Foundation of China (NSFC)

1090807060504030201

α

005 01 015 02 025 03 035 04λ

0908070605040302010

Figure 13 DIOT propagation e final behavior adoption sizeR(infin) versus the global transmission rate scale and localtransmission rate other parameters are N 10000 ϵ 0004T 3 and c 05 respectively e lines are the theoreticalpredictions

λ = 006

λ = 007

λ = 015

λ = 009λ = 01

λ = 03

λ = 008

λ = 0050

02

04

06

08

1

12

R (infin

)

10 20 30 40 50 60 70 80 90 1000ζ

Figure 14 Final adoption size R(infin) varied with ζ in DIOT

14 λ15 λ110 λ

12 λ13 λ

λ

0

02

04

06

08

1

12

R (infin

)

01 02 03 040λ

Figure 15 Final adoption size R(infin) varied with λ in DIOT

12 Security and Communication Networks

(grant nos 61272447 and 61802271) and in part by theFundamental Research Funds for the Central Universities(grant nos SCU2018D018 and SCU2018D022) is supportis gratefully acknowledged

References

[1] M Antonakakis T April M Bailey et al ldquoUnderstanding themirai botnetrdquo in Proceedings of the 26th USENIX SecuritySymposium pp 1093ndash1110 USENIX Security 17 VancouverBC Canada August 2017

[2] C Kolias G Kambourakis A Stavrou and J Voas ldquoDdos inthe IoT mirai and other botnetsrdquo Computer vol 50 no 7pp 80ndash84 2017

[3] D Chen N Zhang R Lu N Cheng K Zhang and Z QinldquoChannel precoding based message authentication in wirelessnetworks challenges and solutionsrdquo IEEE Network vol 33no 1 pp 99ndash105 2019

[4] D Chen N Zhang Z Qin et al ldquoS2M a lightweight acousticfingerprints-based wireless device authentication protocolrdquoIEEE Internet of ltings Journal vol 4 no 1 pp 88ndash100 2016

[5] Q Wang D Chen N Zhang Z Qin and Z Qin ldquoLACS alightweight label-based access control scheme in IoT-based5G caching contextrdquo IEEE Access vol 5 pp 4018ndash4027 2017

[6] K Zhang X Liang J Ni K Yang and X S Shen ldquoExploitingsocial network to enhance human-to-human infection anal-ysis without privacy leakagerdquo IEEE Transactions on De-pendable and Secure Computing vol 15 no 4 pp 607ndash6202016

[7] C Zhang S Zhou J C Miller I J Cox and B M ChainldquoOptimizing hybrid spreading in metapopulationsrdquo ScientificReports vol 5 no 1 p 9924 2015

[8] R M Anderson ldquoDiscussion the Kermack-McKendrickepidemic threshold theoremrdquo Bulletin of Mathematical Bi-ology vol 53 no 1-2 pp 3ndash32 1991

[9] M Newman Networks An Introduction Oxford UniversityPress Oxford UK 2010

[10] M Feily A Shahrestani and S Ramadass ldquoA survey of botnetand botnet detectionrdquo in Proceedings of the 2009 ltird In-ternational Conference on Emerging Security InformationSystems and Technologies pp 268ndash273 IEEE Athens GreeceJune 2009

[11] A Laha N Zhang H Wu D Chen and T Han ldquoOnlineproactive caching in mobile edge computing using bi-directional deep recurrent neural networkrdquo IEEE Internet ofltings Journal vol 6 no 3 pp 5520ndash5530 2019

[12] E Bertino and N Islam ldquoBotnets and internet of things se-curityrdquo Computer vol 50 no 2 pp 76ndash79 2017

[13] D Chen N Zhang N Cheng K Zhang Z Qin andX S Shen ldquoPhysical layer based message authentication withsecure channel codesrdquo IEEE Transactions on Dependable andSecure Computing p 1 2018

[14] Q Wang D Chen N Zhang Z Ding and Z Qin ldquoPCP aprivacy-preserving content-based publish-subscribe schemewith differential privacy in fog computingrdquo IEEE Accessvol 5 pp 17962ndash17974 2017

[15] D Acarali M Rajarajan N Komninos and B B ZarpelatildeoldquoModelling the spread of botnet malware in IoT-basedwireless sensor networksrdquo Security and CommunicationNetworks vol 2019 Article ID 3745619 13 pages 2019

[16] M Ajelli R Lo Cigno and A Montresor ldquoModeling botnetsand epidemic malwarerdquo in Proceedings of the 2010 IEEEInternational Conference on Communications pp 1ndash5 IEEECape Town South Africa May 2010

[17] M J Farooq and Q Zhu ldquoModeling analysis and mitigationof dynamic botnet formation in wireless IoT networksrdquo IEEETransactions on Information Forensics and Security vol 14no 9 pp 2412ndash2426 2019

[18] B K Mishra and D K Saini ldquoSEIRS epidemic model withdelay for transmission of malicious objects in computernetworkrdquo Applied Mathematics and Computation vol 188no 2 pp 1476ndash1482 2007

[19] A Singh A K Awasthi K Singh and P K SrivastavaldquoModeling and analysis of worm propagation in wirelesssensor networksrdquoWireless Personal Communications vol 98no 3 pp 2535ndash2551 2018

[20] D Dagon C C Zou andW Lee ldquoModeling botnet propagationusing time zonesrdquo in Proceedings of the NDSS Symposium 2006vol 6 pp 2ndash13 San Diego CA USA February 2006

[21] M Todd Gardner C C Beard and M Deep ldquoUsing seirsepidemicmodels for IoT botnets attacksrdquo in Proceedings of theDRCN 2017mdashDesign of Reliable Communication Networkspp 1ndash8 Munich Germany March 2017

[22] C Castellano S Fortunato and V Loreto ldquoStatistical physicsof social dynamicsrdquo Reviews of Modern Physics vol 81 no 2pp 591ndash646 2009

[23] J C Flack and R M DrsquoSouza ldquoe digital age and the futureof social network science and engineeringrdquo Proceedings of theIEEE vol 102 no 12 pp 1873ndash1877 2014

[24] R Pastor-Satorras C Castellano P Van Mieghem andA Vespignani ldquoEpidemic processes in complex networksrdquoReviews of Modern Physics vol 87 no 3 pp 925ndash979 2015

[25] V Constantin Craciun A Mogage and E Simion ldquoTrends indesign of ransomware virusesrdquo in International Conference onSecurity for Information Technology and Communicationspp 259ndash272 Springer Berlin Germany 2018

[26] S Mohurle and M Patil ldquoA brief study of wannacry threatransomware attack 2017rdquo International Journal of AdvancedResearch in Computer Science vol 8 no 5 2017

[27] A Zimba L Simukonda and M Chishimba ldquoDemystifyingransomware attacks reverse engineering and dynamic mal-ware analysis of wannacry for network and information se-curityrdquo Zambia ICT Journal vol 1 no 1 pp 35ndash40 2017

[28] S Aral and DWalker ldquoIdentifying influential and susceptiblemembers of social networksrdquo Science vol 337 no 6092pp 337ndash341 2012

[29] A Banerjee A G Chandrasekhar E Duflo and M O Jacksonldquoe diffusion ofmicrofinancerdquo Science vol 341 no 6144 article1236498 2013

[30] P S Dodds and D J Watts ldquoUniversal behavior in a gen-eralized model of contagionrdquo Physical Review Letters vol 92no 21 article 218701 2004

[31] D J Watts ldquoA simple model of global cascades on randomnetworksrdquo Proceedings of the National Academy of Sciencesvol 99 no 9 pp 5766ndash5771 2002

[32] P S Dodds and D J Watts ldquoA generalized model of socialand biological contagionrdquo Journal of lteoretical Biologyvol 232 no 4 pp 587ndash604 2005

[33] W Wang X-L Chen and L-F Zhong ldquoSocial contagionswith heterogeneous credibilityrdquo Physica A Statistical Me-chanics and Its Applications vol 503 pp 604ndash610 2018

[34] J C Miller ldquoA note on a paper by Erik Volz sir dynamics inrandom networksrdquo Journal of Mathematical Biology vol 62no 3 pp 349ndash358 2011

[35] W Wang M Tang P Shu and Z Wang ldquoDynamics of socialcontagions with heterogeneous adoption thresholds cross-over phenomena in phase transitionrdquo New Journal of Physicsvol 18 no 1 article 013029 2016

Security and Communication Networks 13

[36] W Wang M Tang H-F Zhang H Gao Y Do andZ-H Liu ldquoEpidemic spreading on complex networks withgeneral degree and weight distributionsrdquo Physical Review Evol 90 no 4 article 042803 2014

[37] P Erdos and A Renyi ldquoOn random graphs Irdquo PublicationesMathematicae Debrecen vol 6 pp 290ndash297 1959

[38] A Hagberg D Schult P Swart et al Networkx High pro-ductivity software for complex networks Webova Stra Nka2013 httpsnetworkxlanlgovwiki

14 Security and Communication Networks

6 Conclusion

In this paper we studied the effects of hybrid propagationwith different spreading rates and memory reinforcementson botnet contagions We first proposed an informationcontagion model to describe the botnet spreading dynamicson complex networks We then developed a generalizedheterogeneous edge-based compartmental theory to de-scribe the proposed model

rough extensive numerical simulations on the ERnetwork and BA network we found that the growth patternof the final behavior size R(infin) versus the hybrid ratio αexhibits discontinuous pattern when fixed transmission rateλ is large But when λ is small R(infin) shows the phenomenonof fluctuation and at critical point it reaches peak value firstfollowed with small amplitude declining and gradually risingIn addition we also fixed the hybrid ratio α to analyze the finaladoption size R(infin) changing with transmission rate λ andthe growth pattern of R(infin) changing from continuous todiscontinuous is observed

For comparing the effect of different hybrid methodsSIOT and DIOT are proposed and the simulation result ispresented obviously DIOT can spread faster especiallywhen global transmission rate is high We finally studied theeffect of other parameters and found that memory thresholdT recovery rate c and global propagation range controller ϵcan affect R(infin) growing pattern respectively when T issmall it grows much faster because more seeds can begenerated and global spreading can contribute more Withincreasing c it gets slower to reach the burst value Alsoglobal range controller ϵ can change the pattern when ϵ getslarger it reaches critical value much faster By introducinghybrid propagation mechanism and spreading scope con-troller with memory character the method can supportmodeling different spreading scenarios flexibly but itsimplifies the life states of bot and the immune charac-teristics of nodes are not taken into account so our futurework will focus on these points

Our proposed theory agrees well with the numericalsimulations on ER and BA networksemodel proposed inthis paper can provide theoretical reference for hybridpropagation modeling of botnet in complex networks andalso provide guidance for medical industry to deal withbotnet threats

Data Availability

We conducted our experiment with the numerical simu-lation method without using any open dataset

Conflicts of Interest

e authors declare that there are no conflicts of interestregarding the publication of this paper

Acknowledgments

is study was financially supported in part by a program ofNational Natural Science Foundation of China (NSFC)

1090807060504030201

α

005 01 015 02 025 03 035 04λ

0908070605040302010

Figure 13 DIOT propagation e final behavior adoption sizeR(infin) versus the global transmission rate scale and localtransmission rate other parameters are N 10000 ϵ 0004T 3 and c 05 respectively e lines are the theoreticalpredictions

λ = 006

λ = 007

λ = 015

λ = 009λ = 01

λ = 03

λ = 008

λ = 0050

02

04

06

08

1

12

R (infin

)

10 20 30 40 50 60 70 80 90 1000ζ

Figure 14 Final adoption size R(infin) varied with ζ in DIOT

14 λ15 λ110 λ

12 λ13 λ

λ

0

02

04

06

08

1

12

R (infin

)

01 02 03 040λ

Figure 15 Final adoption size R(infin) varied with λ in DIOT

12 Security and Communication Networks

(grant nos 61272447 and 61802271) and in part by theFundamental Research Funds for the Central Universities(grant nos SCU2018D018 and SCU2018D022) is supportis gratefully acknowledged

References

[1] M Antonakakis T April M Bailey et al ldquoUnderstanding themirai botnetrdquo in Proceedings of the 26th USENIX SecuritySymposium pp 1093ndash1110 USENIX Security 17 VancouverBC Canada August 2017

[2] C Kolias G Kambourakis A Stavrou and J Voas ldquoDdos inthe IoT mirai and other botnetsrdquo Computer vol 50 no 7pp 80ndash84 2017

[3] D Chen N Zhang R Lu N Cheng K Zhang and Z QinldquoChannel precoding based message authentication in wirelessnetworks challenges and solutionsrdquo IEEE Network vol 33no 1 pp 99ndash105 2019

[4] D Chen N Zhang Z Qin et al ldquoS2M a lightweight acousticfingerprints-based wireless device authentication protocolrdquoIEEE Internet of ltings Journal vol 4 no 1 pp 88ndash100 2016

[5] Q Wang D Chen N Zhang Z Qin and Z Qin ldquoLACS alightweight label-based access control scheme in IoT-based5G caching contextrdquo IEEE Access vol 5 pp 4018ndash4027 2017

[6] K Zhang X Liang J Ni K Yang and X S Shen ldquoExploitingsocial network to enhance human-to-human infection anal-ysis without privacy leakagerdquo IEEE Transactions on De-pendable and Secure Computing vol 15 no 4 pp 607ndash6202016

[7] C Zhang S Zhou J C Miller I J Cox and B M ChainldquoOptimizing hybrid spreading in metapopulationsrdquo ScientificReports vol 5 no 1 p 9924 2015

[8] R M Anderson ldquoDiscussion the Kermack-McKendrickepidemic threshold theoremrdquo Bulletin of Mathematical Bi-ology vol 53 no 1-2 pp 3ndash32 1991

[9] M Newman Networks An Introduction Oxford UniversityPress Oxford UK 2010

[10] M Feily A Shahrestani and S Ramadass ldquoA survey of botnetand botnet detectionrdquo in Proceedings of the 2009 ltird In-ternational Conference on Emerging Security InformationSystems and Technologies pp 268ndash273 IEEE Athens GreeceJune 2009

[11] A Laha N Zhang H Wu D Chen and T Han ldquoOnlineproactive caching in mobile edge computing using bi-directional deep recurrent neural networkrdquo IEEE Internet ofltings Journal vol 6 no 3 pp 5520ndash5530 2019

[12] E Bertino and N Islam ldquoBotnets and internet of things se-curityrdquo Computer vol 50 no 2 pp 76ndash79 2017

[13] D Chen N Zhang N Cheng K Zhang Z Qin andX S Shen ldquoPhysical layer based message authentication withsecure channel codesrdquo IEEE Transactions on Dependable andSecure Computing p 1 2018

[14] Q Wang D Chen N Zhang Z Ding and Z Qin ldquoPCP aprivacy-preserving content-based publish-subscribe schemewith differential privacy in fog computingrdquo IEEE Accessvol 5 pp 17962ndash17974 2017

[15] D Acarali M Rajarajan N Komninos and B B ZarpelatildeoldquoModelling the spread of botnet malware in IoT-basedwireless sensor networksrdquo Security and CommunicationNetworks vol 2019 Article ID 3745619 13 pages 2019

[16] M Ajelli R Lo Cigno and A Montresor ldquoModeling botnetsand epidemic malwarerdquo in Proceedings of the 2010 IEEEInternational Conference on Communications pp 1ndash5 IEEECape Town South Africa May 2010

[17] M J Farooq and Q Zhu ldquoModeling analysis and mitigationof dynamic botnet formation in wireless IoT networksrdquo IEEETransactions on Information Forensics and Security vol 14no 9 pp 2412ndash2426 2019

[18] B K Mishra and D K Saini ldquoSEIRS epidemic model withdelay for transmission of malicious objects in computernetworkrdquo Applied Mathematics and Computation vol 188no 2 pp 1476ndash1482 2007

[19] A Singh A K Awasthi K Singh and P K SrivastavaldquoModeling and analysis of worm propagation in wirelesssensor networksrdquoWireless Personal Communications vol 98no 3 pp 2535ndash2551 2018

[20] D Dagon C C Zou andW Lee ldquoModeling botnet propagationusing time zonesrdquo in Proceedings of the NDSS Symposium 2006vol 6 pp 2ndash13 San Diego CA USA February 2006

[21] M Todd Gardner C C Beard and M Deep ldquoUsing seirsepidemicmodels for IoT botnets attacksrdquo in Proceedings of theDRCN 2017mdashDesign of Reliable Communication Networkspp 1ndash8 Munich Germany March 2017

[22] C Castellano S Fortunato and V Loreto ldquoStatistical physicsof social dynamicsrdquo Reviews of Modern Physics vol 81 no 2pp 591ndash646 2009

[23] J C Flack and R M DrsquoSouza ldquoe digital age and the futureof social network science and engineeringrdquo Proceedings of theIEEE vol 102 no 12 pp 1873ndash1877 2014

[24] R Pastor-Satorras C Castellano P Van Mieghem andA Vespignani ldquoEpidemic processes in complex networksrdquoReviews of Modern Physics vol 87 no 3 pp 925ndash979 2015

[25] V Constantin Craciun A Mogage and E Simion ldquoTrends indesign of ransomware virusesrdquo in International Conference onSecurity for Information Technology and Communicationspp 259ndash272 Springer Berlin Germany 2018

[26] S Mohurle and M Patil ldquoA brief study of wannacry threatransomware attack 2017rdquo International Journal of AdvancedResearch in Computer Science vol 8 no 5 2017

[27] A Zimba L Simukonda and M Chishimba ldquoDemystifyingransomware attacks reverse engineering and dynamic mal-ware analysis of wannacry for network and information se-curityrdquo Zambia ICT Journal vol 1 no 1 pp 35ndash40 2017

[28] S Aral and DWalker ldquoIdentifying influential and susceptiblemembers of social networksrdquo Science vol 337 no 6092pp 337ndash341 2012

[29] A Banerjee A G Chandrasekhar E Duflo and M O Jacksonldquoe diffusion ofmicrofinancerdquo Science vol 341 no 6144 article1236498 2013

[30] P S Dodds and D J Watts ldquoUniversal behavior in a gen-eralized model of contagionrdquo Physical Review Letters vol 92no 21 article 218701 2004

[31] D J Watts ldquoA simple model of global cascades on randomnetworksrdquo Proceedings of the National Academy of Sciencesvol 99 no 9 pp 5766ndash5771 2002

[32] P S Dodds and D J Watts ldquoA generalized model of socialand biological contagionrdquo Journal of lteoretical Biologyvol 232 no 4 pp 587ndash604 2005

[33] W Wang X-L Chen and L-F Zhong ldquoSocial contagionswith heterogeneous credibilityrdquo Physica A Statistical Me-chanics and Its Applications vol 503 pp 604ndash610 2018

[34] J C Miller ldquoA note on a paper by Erik Volz sir dynamics inrandom networksrdquo Journal of Mathematical Biology vol 62no 3 pp 349ndash358 2011

[35] W Wang M Tang P Shu and Z Wang ldquoDynamics of socialcontagions with heterogeneous adoption thresholds cross-over phenomena in phase transitionrdquo New Journal of Physicsvol 18 no 1 article 013029 2016

Security and Communication Networks 13

[36] W Wang M Tang H-F Zhang H Gao Y Do andZ-H Liu ldquoEpidemic spreading on complex networks withgeneral degree and weight distributionsrdquo Physical Review Evol 90 no 4 article 042803 2014

[37] P Erdos and A Renyi ldquoOn random graphs Irdquo PublicationesMathematicae Debrecen vol 6 pp 290ndash297 1959

[38] A Hagberg D Schult P Swart et al Networkx High pro-ductivity software for complex networks Webova Stra Nka2013 httpsnetworkxlanlgovwiki

14 Security and Communication Networks

(grant nos 61272447 and 61802271) and in part by theFundamental Research Funds for the Central Universities(grant nos SCU2018D018 and SCU2018D022) is supportis gratefully acknowledged

References

[1] M Antonakakis T April M Bailey et al ldquoUnderstanding themirai botnetrdquo in Proceedings of the 26th USENIX SecuritySymposium pp 1093ndash1110 USENIX Security 17 VancouverBC Canada August 2017

[2] C Kolias G Kambourakis A Stavrou and J Voas ldquoDdos inthe IoT mirai and other botnetsrdquo Computer vol 50 no 7pp 80ndash84 2017

[3] D Chen N Zhang R Lu N Cheng K Zhang and Z QinldquoChannel precoding based message authentication in wirelessnetworks challenges and solutionsrdquo IEEE Network vol 33no 1 pp 99ndash105 2019

[4] D Chen N Zhang Z Qin et al ldquoS2M a lightweight acousticfingerprints-based wireless device authentication protocolrdquoIEEE Internet of ltings Journal vol 4 no 1 pp 88ndash100 2016

[5] Q Wang D Chen N Zhang Z Qin and Z Qin ldquoLACS alightweight label-based access control scheme in IoT-based5G caching contextrdquo IEEE Access vol 5 pp 4018ndash4027 2017

[6] K Zhang X Liang J Ni K Yang and X S Shen ldquoExploitingsocial network to enhance human-to-human infection anal-ysis without privacy leakagerdquo IEEE Transactions on De-pendable and Secure Computing vol 15 no 4 pp 607ndash6202016

[7] C Zhang S Zhou J C Miller I J Cox and B M ChainldquoOptimizing hybrid spreading in metapopulationsrdquo ScientificReports vol 5 no 1 p 9924 2015

[8] R M Anderson ldquoDiscussion the Kermack-McKendrickepidemic threshold theoremrdquo Bulletin of Mathematical Bi-ology vol 53 no 1-2 pp 3ndash32 1991

[9] M Newman Networks An Introduction Oxford UniversityPress Oxford UK 2010

[10] M Feily A Shahrestani and S Ramadass ldquoA survey of botnetand botnet detectionrdquo in Proceedings of the 2009 ltird In-ternational Conference on Emerging Security InformationSystems and Technologies pp 268ndash273 IEEE Athens GreeceJune 2009

[11] A Laha N Zhang H Wu D Chen and T Han ldquoOnlineproactive caching in mobile edge computing using bi-directional deep recurrent neural networkrdquo IEEE Internet ofltings Journal vol 6 no 3 pp 5520ndash5530 2019

[12] E Bertino and N Islam ldquoBotnets and internet of things se-curityrdquo Computer vol 50 no 2 pp 76ndash79 2017

[13] D Chen N Zhang N Cheng K Zhang Z Qin andX S Shen ldquoPhysical layer based message authentication withsecure channel codesrdquo IEEE Transactions on Dependable andSecure Computing p 1 2018

[14] Q Wang D Chen N Zhang Z Ding and Z Qin ldquoPCP aprivacy-preserving content-based publish-subscribe schemewith differential privacy in fog computingrdquo IEEE Accessvol 5 pp 17962ndash17974 2017

[15] D Acarali M Rajarajan N Komninos and B B ZarpelatildeoldquoModelling the spread of botnet malware in IoT-basedwireless sensor networksrdquo Security and CommunicationNetworks vol 2019 Article ID 3745619 13 pages 2019

[16] M Ajelli R Lo Cigno and A Montresor ldquoModeling botnetsand epidemic malwarerdquo in Proceedings of the 2010 IEEEInternational Conference on Communications pp 1ndash5 IEEECape Town South Africa May 2010

[17] M J Farooq and Q Zhu ldquoModeling analysis and mitigationof dynamic botnet formation in wireless IoT networksrdquo IEEETransactions on Information Forensics and Security vol 14no 9 pp 2412ndash2426 2019

[18] B K Mishra and D K Saini ldquoSEIRS epidemic model withdelay for transmission of malicious objects in computernetworkrdquo Applied Mathematics and Computation vol 188no 2 pp 1476ndash1482 2007

[19] A Singh A K Awasthi K Singh and P K SrivastavaldquoModeling and analysis of worm propagation in wirelesssensor networksrdquoWireless Personal Communications vol 98no 3 pp 2535ndash2551 2018

[20] D Dagon C C Zou andW Lee ldquoModeling botnet propagationusing time zonesrdquo in Proceedings of the NDSS Symposium 2006vol 6 pp 2ndash13 San Diego CA USA February 2006

[21] M Todd Gardner C C Beard and M Deep ldquoUsing seirsepidemicmodels for IoT botnets attacksrdquo in Proceedings of theDRCN 2017mdashDesign of Reliable Communication Networkspp 1ndash8 Munich Germany March 2017

[22] C Castellano S Fortunato and V Loreto ldquoStatistical physicsof social dynamicsrdquo Reviews of Modern Physics vol 81 no 2pp 591ndash646 2009

[23] J C Flack and R M DrsquoSouza ldquoe digital age and the futureof social network science and engineeringrdquo Proceedings of theIEEE vol 102 no 12 pp 1873ndash1877 2014

[24] R Pastor-Satorras C Castellano P Van Mieghem andA Vespignani ldquoEpidemic processes in complex networksrdquoReviews of Modern Physics vol 87 no 3 pp 925ndash979 2015

[25] V Constantin Craciun A Mogage and E Simion ldquoTrends indesign of ransomware virusesrdquo in International Conference onSecurity for Information Technology and Communicationspp 259ndash272 Springer Berlin Germany 2018

[26] S Mohurle and M Patil ldquoA brief study of wannacry threatransomware attack 2017rdquo International Journal of AdvancedResearch in Computer Science vol 8 no 5 2017

[27] A Zimba L Simukonda and M Chishimba ldquoDemystifyingransomware attacks reverse engineering and dynamic mal-ware analysis of wannacry for network and information se-curityrdquo Zambia ICT Journal vol 1 no 1 pp 35ndash40 2017

[28] S Aral and DWalker ldquoIdentifying influential and susceptiblemembers of social networksrdquo Science vol 337 no 6092pp 337ndash341 2012

[29] A Banerjee A G Chandrasekhar E Duflo and M O Jacksonldquoe diffusion ofmicrofinancerdquo Science vol 341 no 6144 article1236498 2013

[30] P S Dodds and D J Watts ldquoUniversal behavior in a gen-eralized model of contagionrdquo Physical Review Letters vol 92no 21 article 218701 2004

[31] D J Watts ldquoA simple model of global cascades on randomnetworksrdquo Proceedings of the National Academy of Sciencesvol 99 no 9 pp 5766ndash5771 2002

[32] P S Dodds and D J Watts ldquoA generalized model of socialand biological contagionrdquo Journal of lteoretical Biologyvol 232 no 4 pp 587ndash604 2005

[33] W Wang X-L Chen and L-F Zhong ldquoSocial contagionswith heterogeneous credibilityrdquo Physica A Statistical Me-chanics and Its Applications vol 503 pp 604ndash610 2018

[34] J C Miller ldquoA note on a paper by Erik Volz sir dynamics inrandom networksrdquo Journal of Mathematical Biology vol 62no 3 pp 349ndash358 2011

[35] W Wang M Tang P Shu and Z Wang ldquoDynamics of socialcontagions with heterogeneous adoption thresholds cross-over phenomena in phase transitionrdquo New Journal of Physicsvol 18 no 1 article 013029 2016

Security and Communication Networks 13

[36] W Wang M Tang H-F Zhang H Gao Y Do andZ-H Liu ldquoEpidemic spreading on complex networks withgeneral degree and weight distributionsrdquo Physical Review Evol 90 no 4 article 042803 2014

[37] P Erdos and A Renyi ldquoOn random graphs Irdquo PublicationesMathematicae Debrecen vol 6 pp 290ndash297 1959

[38] A Hagberg D Schult P Swart et al Networkx High pro-ductivity software for complex networks Webova Stra Nka2013 httpsnetworkxlanlgovwiki

14 Security and Communication Networks

[36] W Wang M Tang H-F Zhang H Gao Y Do andZ-H Liu ldquoEpidemic spreading on complex networks withgeneral degree and weight distributionsrdquo Physical Review Evol 90 no 4 article 042803 2014

[37] P Erdos and A Renyi ldquoOn random graphs Irdquo PublicationesMathematicae Debrecen vol 6 pp 290ndash297 1959

[38] A Hagberg D Schult P Swart et al Networkx High pro-ductivity software for complex networks Webova Stra Nka2013 httpsnetworkxlanlgovwiki

14 Security and Communication Networks

International Journal of

AerospaceEngineeringHindawiwwwhindawicom Volume 2018

RoboticsJournal of

Hindawiwwwhindawicom Volume 2018

Hindawiwwwhindawicom Volume 2018

Active and Passive Electronic Components

VLSI Design

Hindawiwwwhindawicom Volume 2018

Hindawiwwwhindawicom Volume 2018

Shock and Vibration

Hindawiwwwhindawicom Volume 2018

Civil EngineeringAdvances in

Acoustics and VibrationAdvances in

Hindawiwwwhindawicom Volume 2018

Hindawiwwwhindawicom Volume 2018

Electrical and Computer Engineering

Journal of

Advances inOptoElectronics

Hindawiwwwhindawicom

Volume 2018

Hindawi Publishing Corporation httpwwwhindawicom Volume 2013Hindawiwwwhindawicom

The Scientific World Journal

Volume 2018

Control Scienceand Engineering

Journal of

Hindawiwwwhindawicom Volume 2018

Hindawiwwwhindawicom

Journal ofEngineeringVolume 2018

SensorsJournal of

Hindawiwwwhindawicom Volume 2018

International Journal of

RotatingMachinery

Hindawiwwwhindawicom Volume 2018

Modelling ampSimulationin EngineeringHindawiwwwhindawicom Volume 2018

Hindawiwwwhindawicom Volume 2018

Chemical EngineeringInternational Journal of Antennas and

Propagation

International Journal of

Hindawiwwwhindawicom Volume 2018

Hindawiwwwhindawicom Volume 2018

Navigation and Observation

International Journal of

Hindawi

wwwhindawicom Volume 2018

Advances in

Multimedia

Submit your manuscripts atwwwhindawicom