Research ArticleGroup-Based Susceptible-Infectious-Susceptible Model inLarge-Scale Directed Networks

Xu Wang 12 Bo Song23 Wei Ni4 Ren Ping Liu2 Y Jay Guo2

Xinxin Niu15 and Kangfeng Zheng1

1School of Cyberspace Security Beijing University of Posts and Telecommunications Beijing 100876 China2Global Big Data Technologies Centre University of Technology Sydney 2007 Australia3School of Telecommunication and Information Engineering Nanjing University of Posts and Telecommunications 210003 China4Data 61 CSIRO Sydney NSW 2122 Australia5State Key Laboratory of Public Big Data Guizhou 550025 China

Correspondence should be addressed to Xu Wang xuwang-3studentutseduau

Received 17 October 2018 Accepted 8 January 2019 Published 16 January 2019

Academic Editor Angel M Del Rey

Copyright copy 2019 XuWang et alThis is an open access article distributed under the Creative Commons Attribution License whichpermits unrestricted use distribution and reproduction in any medium provided the original work is properly cited

Epidemic models trade the modeling accuracy for complexity reduction This paper proposes to group vertices in directed graphsbased on connectivity and carries out epidemic spread analysis on the group basis thereby substantially reducing the modelingcomplexitywhile preserving themodeling accuracy A group-based continuous-timeMarkov SISmodel is developedThe adjacencymatrix of the network is also collapsed according to the grouping to evaluate the Jacobian matrix of the group-based continuous-time Markov model By adopting the mean-field approximation on the groups of nodes and links the model complexity issignificantly reduced as compared with previous topological epidemic models An epidemic threshold is deduced based on thespectral radius of the collapsed adjacency matrix The epidemic threshold is proved to be dependent on network structure andinterdependent of the network scale Simulation results validate the analytical epidemic threshold and confirm the asymptoticalaccuracy of the proposed epidemic model

1 Introduction

Epidemic models have been widely used to analyze sophis-ticated interactions in networks eg virus attack and prop-agation in computer networks [1 2] rumor spreading insocial networks [3] and cascading failures [4] As a basicepidemic model the susceptible-infected-susceptible (SIS)model defines two node states (susceptible and infected) andcaptures two state transition processes namely the infectionfrom infected nodes to susceptible nodes and the self-healingof infected nodes Earlier epidemic models omit topologiesby assuming a network topology of a complete graph [5]Network topologies playing a key role in cyber security [6]are later considered and proved to have a strong impact onthe epidemic propagation process [7]

Epidemic models trade the modeling accuracy for com-plexity reduction Markov-chain based epidemic models are

able to precisely analyze the epidemic propagation processbut require 2119873 Markov states to capture the SI states of119873 nodes and therefore can hardly be applied to large-scalenetworks [7 8] A number of topological epidemic models[8ndash12] decompose the 2119873-state Markov process into119873 smallMarkov processes This is achieved by using the expectedinfection probability of every node instead of the actual nodestate A significant result from themodels is that the epidemicthreshold under which the epidemic will eventually die outis given by 11205821(A) where 1205821(A) is the largest eigenvalue ofthe adjacency matrix of the network topology [9]

Network features eg the degree distribution of scale-free networks [13] can be employed to simplify epidemicmodels by adopting the degree-based mean-field approach[14] Specifically nodes with the same degree are assumedto be infected with the same probabilities An interestingresult of the epidemic in scale-free networks is the absence

HindawiSecurity and Communication NetworksVolume 2019 Article ID 1657164 9 pageshttpsdoiorg10115520191657164

2 Security and Communication Networks

of an epidemic threshold [15] The degree-based mean-fieldapproach has extended the SIS process eg the epidemicpropagation with incubation and the epidemic with a recov-ery state [16 17] However the degree-based epidemic modelcannot capture epidemic propagations in specific networks

This paper presents a group-based continuous-timeMarkov model to quantitatively analyze the SIS process inlarge-scale directed networks We start with the networkmodeling where nodes are categorized into groups accord-ing to their connectivity A collapsed adjacency matrix isproposed to describe the network topology Based on thenode groups a continuous-time Markov model is proposedto capture the SIS-type propagation where the state of agroup is estimated by taking the mean-field approximationFocusing on the problemof epidemic threshold the proposednonlinear model is linearized via omitting high-order termsaround the disease-free point The epidemic threshold isderived by performingmatrix analysis on the Jacobianmatrixof the linearized model and then validated by simulationsThe key contributions of this paper can be summarized asfollows

(i) We propose a new modeling method which groupsnodes with the same connectivity in directed net-works and models the epidemic propagation of thegroups by using continuous-timeMarkov SISmodels

(ii) By taking the mean-field approximation the pro-posed SIS model is asymptotically accurate withthe decrease of effective spreading rate andor theincrease of node groups

(iii) Linearization and stability analysis are carried outon the proposed SIS model to deduce the epidemicthreshold under which the epidemic eventuallybecomes extinct

(iv) The epidemic threshold is proved to be dependent onnetwork structure and interdependent of the networkscale

Comprehensive simulations confirm the validity of theproposed mean-field epidemic model and the deduced epi-demic threshold in large-scale networks

The rest of this paper is organized as follows In Section 2related works are reviewed In Section 3 the directed networkmodel is presented followed by the proposed mean-field SISmodel in Section 4 In Section 5 numerical and simulationresults are provided followed by conclusions in Section 6

2 Related Work

The SIS model was firstly developed for biological infectiousdiseases which defines two states for a node ie susceptibleor infected [5] A susceptible node can be infected withprobability 120573 by an infected neighbor An infected nodecan be cured with probability 120574 Recently various stateswere introduced into the SIS model Kephart et al [18] andVojnovic et al [19] proposed a new ldquowarningrdquo state at everynode in addition to the ldquoinfectedrdquo and ldquosusceptiblerdquo statesThe probability of a node switching to the ldquowarningrdquo statedepends on the population of nodes in the warning state

and is independent of the network topology The SIS modelwas extended with ldquoquarantinedrdquo ldquovaccinatedrdquo and ldquodelayrdquostates to capture the time-delayedwormpropagation in com-puter networks [20] These models significantly simplifiedthe dynamic process by omitting the impact of networktopologies

The network topologies can have a strong impact onepidemic propagations [11] In [8] the continuous-timeMarkov processwas adopted tomodel epidemic propagationsin specific topologies where every Markov state collectsthe states of all nodes in the network The second largesteigenvalue of the Markov transition matrix determines theconvergence rate to the absorbing virus-free state Witha discrete-time Markov model the convergence rate wasproved to be asymptotically bounded [7]TheMarkovmodelscan be decomposed into 119873 small Markov processes in 119873-node networks by applying the mean-field theory to achievetractability [8 10ndash12] The decomposed 119873 Markov processesdeduced a widely approved result that a virus dies out quicklyif 120573120574 lt 11205821(A) where A is the adjacency matrix ofthe network and 1205821(A) is the largest eigenvalue of A Thenetwork can also be dynamic where nodes can transferamong communities [21]The simulation results on two com-munities revealed that the node mobility can accelerate themalware propagation and improve the epidemic threshold

Some network features can be employed to simplifyepidemic models and improve tractability Pastor-Satorras etal [15] derived the probability of a node being infected as afunction of the expected number of its infected neighborsin scale-free networks The number of infected nodes atthe equilibrium state was given by 120588 asymp 2119890minus1119898120591 where119898 is a network generation parameter and 120591 is the effectivespreading rate Zou et al [22] simulated the propagation ofInternet email worms in scale-free graphs and showed thatthe aforementioned result can be overestimated due to theimplicit homogeneous mixing assumption Meanwhile Li etal showed the analysis on scale-free graphs is inaccurate forspecific topologies [23]

The statistic topology models are generally based onundirected networks However there is an intrinsic direc-tionality in the propagation in specific types of dynam-ics eg infectious disease spreading [24] and informationtransmission [25] Directed networks sets of vertices anda collection of directed edges that connect pairs of orderedvertices are useful to represent specific transmissions withintrinsic directionality in the propagation [14] Meyers etal [26] employed the percolation theory to predict diseasetransmission through semidirected contact networks whereedges may be directed or undirected and found that theprobability of an epidemic and the expected fraction of apopulation infected during an epidemic can be different insemidirected networks in contrast to the routine assumptionthat these two quantities are equal Li et al [27] definedthe directionality 120585 as the percentage of unidirectional linksand found that the lower bound of the epidemic thresholdincreases with a growing 120585 implying that the directionalityhinders the propagation of epidemic processes In [28]Khanafer et al studied the stability of an SIS N-intertwinedMarkov model over arbitrary directed network topologies

Security and Communication Networks 3

1 2 3

Figure 1 An example of networks we considered where 7 nodes arecategorized into three groups according to the connection betweenthem

and showed that when the basic reproduction number isgreater than one the epidemic state is locally exponentiallystable and when the network is not initialized at the disease-free state the epidemic state is globally asymptotically stable

3 The Directed Network Model

We consider the SIS epidemic process in a strongly connectednetwork with 119873 nodes connected by directed edges Eachnode in the network can be in either a susceptible (119878) or aninfected (119868) state An infected node can infect its susceptibleneighbors along the directed edges at the rate of 120573 per edgeInfected nodes can independently recover to be susceptible atthe rate of 120574

We suppose that the 119873 nodes in a network G can becategorized into 119899 groups denoted by 1198661 1198662 sdot sdot sdot 119866119899 wherethe nodes in the same group have the same out-degreesand the same number of edges to the nodes in the samedestination group The number of 119866119894-nodes can be denotedby 119873119894 (here sum119894119873119894 = 119873) Given the node groups we definea collapsed adjacency matrix denoted by A to describe thetopology of G The (119894 119895)-th entry of the matrix denoted by119886119894119895 describes the number of edges from a 119866119894-node pointingto 119866119895-nodes As a result G can be described by the nodenumber vector N = [1198731 1198732 119873119899] and the collapsedadjacency matrix A Figure 1 provides an example of nodecategorization where119873 = 7 nodes are categorized into 119899 = 3groups ieN = [2 3 2] Its collapsed adjacencymatrix canbe given by

A = [[[11988611 11988612 1198861311988621 11988622 1198862311988631 11988632 11988633

]]]

= [[[0 3 00 1 21 0 0

]]]

(1)

Other notations are defined as follows [119860]119894 (119860 isin 119878 119868)denotes the number of 119866119894-nodes in state 119860 119860119861119894119895 denotesan edge starting from a 119866119894-node and ending at a 119866119895-nodewhere the 119866119894-node and the 119866119895-node are in states 119860 and119861 respectively [119860119861]119894119895 denotes the number of 119860119861119894119895 edgesLet [119860119861119862]119894119895119896 ([119860119861119862]1015840119894119895119896) denote the number of edge pairsconsisting of 119860119861119894119895 and 119861119862119895119896 (119860119861119894119895 and 119862119861119896119895) as illustrated

S I S

S I S

Ｃ Ｄ Ｅ

Ｃ Ｄ Ｅ

[SIS]ijk

[SIS]ijk

Figure 2 An example of [119860119861119862]119894119895119896 and [119860119861119862]1015840119894119895119896

by Figure 2 Numerical relationships between states of nodesand states of edges satisfy

119873119894 = [119878]119894 + [119868]119894 (2a)

119886119894119895119873119894 = [119878119878]119894119895 + [119878119868]119894119895 + [119868119878]119894119895 + [119868119868]119894119895 (2b)

119886119894119895 [119878]119894 = [119878119878]119894119895 + [119878119868]119894119895 (2c)

119886119894119895 [119868]119894 = [119868119878]119894119895 + [119868119868]119894119895 (2d)

[119878]119894 = 119873119894 minus [119868]119894 = 119873119894 minus 1119886119894119895 ([119868119878]119894119895 + [119868119868]119894119895) (2e)

Here (2a) is because any node is in either an 119878or 119868 state (2b) isbecause any edge is in one of the four states given in the right-hand side (RHS) of (2b) Meanwhile edges can be classifiedaccording to the state of the starting point as given by (2c)and (2d) (2e) is deduced from (2a) (2b) and (2d)

4 Group-Based Mean-Field SIS Model

We propose to analyze the SIS process in directed networksby employing the mean-field approximation which uses asingle average effect to approximate the effect of all the otherindividuals on any given individual Thus the same groupof nodes in our model are evaluated by the same averageestimationThe state transitions of nodes and edges in the SISprocess can be given by

d [119878]119894d119905 = 120574 [119868]119894 minus sum

119895

120573 [119868119878]119895119894 (3a)

d [119868]119894d119905 = minus120574 [119868]119894 + sum

119895

120573 [119868119878]119895119894 (3b)

d [119878119878]119894119895d119905 = 120574 [119878119868]119894119895 + 120574 [119868119878]119894119895 minus sum

119896

120573 [119868119878119878]119896119894119895minus sum119896

120573 [119878119878119868]1015840119894119895119896 (3c)

d [119878119868]119894119895d119905 = minus120574 [119878119868]119894119895 + 120574 [119868119868]119894119895 + sum

119896

120573 [119878119878119868]1015840119894119895119896minus sum119896

120573 [119868119878119868]119896119894119895 (3d)

4 Security and Communication Networks

d [119868119878]119894119895d119905 = minus120574 [119868119878]119894119895 + 120574 [119868119868]119894119895 minus 120573 [119868119878]119894119895 + sum

119896

120573 [119868119878119878]119896119894119895minus sum119896

120573 [119868119878119868]1015840119894119895119896 (3e)

d [119868119868]119894119895d119905 = minus2120574 [119868119868]119894119895 + 120573 [119868119878]119894119895 + sum

119896

120573 [119868119878119868]119896119894119895+ sum119896

120573 [119868119878119868]1015840119894119895119896 (3f)

Here (3a) and (3b) give the changing rate of susceptibleand infected 119866119894-nodes The RHS is because an infected 119866119894-node can be cured with the rate 120574 a susceptible 119866119894-nodecan be infected with the rate 120573 per edge by an infected 119866119895neighbor In the continuous-time model the time slot isinfinitesimal that the infection rate can be summed togetherie sum119895 120573[119868119878]119895119894

Equations (3c)-(3f) capture the time-varying number oflinks The first two terms on the RHS of (3c) are becausean 119878119878119894119895 edge can transfer from an 119878119868119894119895 or 119868119878119894119895 edge when theinfected node is cured The last two terms on the RHS of (3c)capture the cases where the starting 119866119894-node or the ending119866119895-node is infected by its infected neighbors (3d) is becausean 119878119868119894119895 edge can transfer to an 119878119878119894119895 edge in the case that theinfected 119866119895-node is cured at the rate 120574 and to 119868119868119894119895 in thecase that the susceptible 119866119894-node is infected by its infectedneighbors 119878119868119894119895 can transfer from 119868119868119894119895 in the case that theinfected 119866119894-node is cured with the rate 120574 or from 119878119878119894119895 in thecase that the susceptible 119866119895-node is infected by its infectedneighbors Different from previous SIS models in undirectednetworks eg [15] 119878119868119894119895 cannot transfer to 119868119868119894119895 as the epidemiccan only propagate along directed edges Equation (3e) canbe similarly obtained attaching the infection process ieminus120573[119868119878]119894119895 Equation (3f) is self-explanatory

Known as the disease-free equilibrium point the equi-librium point of interest is ([119878119868]119894119895 [119868119878]119894119895 [119868119868]119894119895) = (0 0 0)ie all nodes are susceptible The condition of the disease-free equilibrium point can be deduced by linearizing theSIS model given by (3a)ndash(3f) This is because the stabilityof the original nonlinear system can be determined by theeigenvalues of the linearized model as stated in LyapunovrsquosFirst Method [29]

To linearize the SIS model the number of edge pairs[119860119861119862]119894119895119896 and [119860119861119862]1015840119894119895119896 is first estimated by using the numberof unpaired edges This is achieved by applying the momentclosure approximation as evaluated in [30 31] As a result wehave

[119868119878119878]119896119894119895 = [119868119878]119896119894 [119878119878]119894119895[119878]119894 = [119868119878]119896119894 [119878119878]119894119895119873119894 minus ([119868119878]119894119901 + [119868119868]119894119901) 119886119894119901 (4a)

[119878119878119868]1015840119894119895119896 = [119868119878]119896119895 [119878119878]119894119895[119878]119895 = [119868119878]119896119895 [119878119878]119894119895119873119895 minus ([119868119878]119895119902 + [119868119868]119895119902) 119886119895119902 (4b)

[119868119878119868]119896119894119895 = [119868119878]119896119894 [119878119868]119894119895[119878]119894 = [119868119878]119896119894 [119878119868]119894119895119873119894 minus ([119868119878]119894119901 + [119868119868]119894119901) 119886119894119901 (4c)

[119868119878119868]1015840119894119895119896 = [119868119878]119894119895 [119868119878]119896119895[119878]119895 = [119868119878]119894119895 [119868119878]119896119895119873119895 minus ([119868119878]119895119902 + [119868119868]119895119902) 119886119895119902 (4d)

In (4a) every susceptible 119866119894-node on average has [119878119878]119894119895[119878]119894edges pointing to119866119895-nodes [119878]119894 is then estimated by employ-ing (2e) where 119901 and 119902 are introduced to solve the equationHere 119901 satisfies [119868119878]119894119901 + [119868119868]119894119901 gt 0 and 119886119894119901 gt 0 119902 satisfies[119868119878]119895119902 + [119868119868]119895119902 gt 0 and 119886119895119902 gt 0 (4b)-(4d) can be similarlyobtained

By substituting (4a)ndash(4d) into (3a)ndash(3f) (3c)-(3f) can berewritten as

d [119878119878]119894119895d119905 = 120574 [119878119868]119894119895 + 120574 [119868119878]119894119895

minus sum119896

120573 [119868119878]119896119894 [119878119878]119894119895119873119894 minus ([119868119878]119894119901 + [119868119868]119894119901) 119886119894119901

minus sum119896

120573[119868119878]119896119895 [119878119878]119894119895[119878]119895 (5a)

d [119878119868]119894119895d119905 = minus120574 [119878119868]119894119895 + 120574 [119868119868]119894119895

+ sum119896

120573 [119868119878]119896119895 [119878119878]119894119895119873119895 minus ([119868119878]119895119902 + [119868119868]119895119902) 119886119895119902

minus sum119896

120573 [119868119878]119896119894 [119878119868]119894119895119873119894 minus ([119868119878]119894119901 + [119868119868]119894119901) 119886119894119901

(5b)

d [119868119878]119894119895d119905 = minus120574 [119868119878]119894119895 + 120574 [119868119868]119894119895 minus 120573 [119868119878]119894119895

+ sum119896

120573 [119868119878]119896119894 [119878119878]119894119895119873119894 minus ([119868119878]119894119901 + [119868119868]119894119901) 119886119894119901

minus sum119896

120573 [119868119878]119894119895 [119868119878]119896119895119873119895 minus ([119868119878]119895119902 + [119868119868]119895119902) 119886119895119902

(5c)

d [119868119868]119894119895d119905 = minus2120574 [119868119868]119894119895 + 120573 [119868119878]119894119895

+ sum119896

120573 [119868119878]119896119894 [119878119868]119894119895119873119894 minus ([119868119878]119894119901 + [119868119868]119894119901) 119886119894119901

+ sum119896

120573 [119868119878]119894119895 [119868119878]119896119895119873119895 minus ([119868119878]119895119902 + [119868119868]119895119902) 119886119895119902

(5d)

The terms of [119878119878]119894119895 can be suppressed by substituting (2b) into(5a)ndash(5d) As a result we have

d [119878119868]119894119895d119905= minus120574 [119878119868]119894119895 + 120574 [119868119868]119894119895

+ sum119896

120573[119868119878]119896119895 (119886119894119895119873119894 minus [119878119868]119894119895 minus [119868119878]119894119895 minus [119868119868]119894119895)119873119895 minus (1119886119895119902) ([119868119878]119895119902 + [119868119868]119895119902)

minus sum119896

120573 [119868119878]119896119894 [119878119868]119894119895119873119894 minus (1119886119894119901) ([119868119878]119894119901 + [119868119868]119894119901)

(6a)

Security and Communication Networks 5

d [119868119878]119894119895d119905= minus120574 [119868119878]119894119895 + 120574 [119868119868]119894119895 minus 120573119894119895 [119868119878]119894119895

+ sum119896

120573[119868119878]119896119894 (119886119894119895119873119894 minus [119878119868]119894119895 minus [119868119878]119894119895 minus [119868119868]119894119895)119873119894 minus (1119886119894119901) ([119868119878]119894119901 + [119868119868]119894119901)

minus sum119896

120573 [119868119878]119894119895 [119868119878]119896119895119873119895 minus (1119886119895119902) ([119868119878]119895119902 + [119868119868]119895119902)

(6b)

d [119868119868]119894119895d119905= minus2120574 [119868119868]119894119895 + 120573 [119868119878]119894119895

+ sum119896

120573 [119868119878]119896119894 [119878119868]119894119895119873119894 minus (1119886119894119901) ([119868119878]119894119901 + [119868119868]119894119901)

+ sum119896

120573 [119868119878]119894119895 [119868119878]119896119895119873119895 minus (1119886119895119902) ([119868119878]119895119902 + [119868119868]119895119902)

(6c)

Near the disease-free equilibrium point (6a)ndash(6c) can belinearized by suppressing all higher order terms As a resultwe have

d [119878119868]119894119895d119905 asymp minus120574 [119878119868]119894119895 + 120574 [119868119868]119894119895 + sum

119896

120573119886119894119895119873119894 [119868119878]119896119895119873119895 (7a)

d [119868119878]119894119895d119905 asymp minus (120574 + 120573) [119868119878]119894119895 + 120574 [119868119868]119894119895 + sum

119896

120573119886119894119895 [119868119878]119896119894 (7b)

d [119868119868]119894119895d119905 asymp minus2120574 [119868119868]119894119895 + 120573 [119868119878]119894119895 (7c)

After the model has been linearized the condition of thedisease-free equilibriumpoint can be obtained by performingeigenvalue analysis on the Jacobian matrix of the lineariza-tionThe Jacobianmatrix is a 31198992times31198992matrix and denoted byJ The nonlinear dynamic system is stable at the equilibriumpoint if and only if all the eigenvalues of the Jacobian matrixare negative as stated by the Hartman-Grobman Theorem[32] In other words the epidemic is certainly extinct if

1205821 (J) lt 0 (8)

where 1205821(sdot) is the largest eigenvalue of the operator J is theJacobian matrix of (7a)ndash(7c) and can be given by

J = [[[J11 J12 J13

J21 J22 J23

J31 J32 J33]]]

= [ J11 J12 J130 Jlowast ] (9)

where J11 is an 1198992times1198992 diagonal matrix whose diagonal entriesare minus120574 We note that J21 and J31 are zero matrices As a resultJ is an upper block triangular matrix and

120582 (J) = 120582 (J11) cup 120582 (Jlowast) (10)

where 120582(sdot) is the set of eigenvalues of the operator

Here J23 J32 and J33 are 1198992 times 1198992 diagonal matrices Theirdiagonal entries are 120574 120573 and minus2120574 respectively The entry inthe (119899(119894minus1)+119895)-th row (119899(119896minus1)+119897)-th column of J22 denotedby 11986922119894119895119896119897 is given by

11986922119894119895119896119897 =

119886119894119895120573 minus (120574 + 120573) if 119894119895 = 119896119897 119894 = 119897minus (120574 + 120573) if 119894119895 = 119896119897 119894 = 119897119886119894119895120573 if 119894119895 = 119896119897 119894 = 1198970 if 119894119895 = 119896119897 119894 = 119897

(11)

By employing the Schur complement ie

[J22 J23

J32 J33][[

I 0

minus (J33)minus1 J32 I]]

= [H J23

0 J33] (12)

we have 120582(Jlowast) = 120582(J33) cup 120582(H) where H = J22 minus J23J33minus1

J32The entry in the (119899(119894 minus 1) + 119895)-th row (119899(119896 minus 1) + 119897)-th columnofH denoted by119867119894119895119896119897 is given by

119867119894119895119896119897 =

119886119894119895120573 minus (120574 + 1205732) if 119894119895 = 119896119897 119894 = 119897minus (120574 + 1205732) if 119894119895 = 119896119897 119894 = 119897119886119894119895120573 if 119894119895 = 119896119897 119894 = 1198970 if 119894119895 = 119896119897 119894 = 119897

(13)

We conclude that 120582(J) = 120582(J11) cup 120582(J33) cup 120582(H) Note thatJ11 and J33 are diagonal matrices and all the diagonal entriesof them are negative ie all the eigenvalues of J11 and J33 arenegative As a result we have

1205821 (J) lt 0 lArrrArr 1205821 (H) lt 0 (14)

The matrixH can be written as

H = P +Q (15)

where Q is a diagonal matrix and can be given by Q =diag[minus(120574 + 1205732)] The entry in the (119899(119894 minus 1) + 119895)-th row(119899(119896 minus 1) + 119897)-th column of P denoted by 119875119894119895119896119897 is given by

119875119894119895119896119897 = 119886119894119895120573 if 119894 = 1198970 otherwise (16)

We have that all the eigenvalues ofQ are minus(120574 + 1205732) and120582 (H) = 120582 (P) minus (120574 + 1205732) (17)

Note that P is a 1198992 times 1198992 sparse matrix and similar with ablock matrix consisting of 120573A and zero matrices as given by

P = Xminus1 [ 120573A 00 0 ]X (18)

6 Security and Communication Networks

This is achieved by performing matrix operations on P Thusthe eigenvalues of P can be given by

120582 (P) = 120573 times 120582 (A) cup 0 (19)

Combining (8) (14) (17) and (19) the epidemic willbecome extinct if 1205731205821(A) minus (120574 + 1205732) lt 0 In other wordsthe epidemic threshold denoted by 120591lowast is given by

120591lowast = 11205821 (A) minus 12 (20)

The epidemic dies out if 120591 = 120573120574 lt 120591lowast5 Simulation and Numerical Results

In this section numerical and simulation results are pre-sented to validate the proposed group-based SIS modeland the deduced epidemic threshold In every run of thesimulations the groups and the network topology ie thescale and structure are first set up according to the rulesspecified in Section 3 ie 119886119894119895 number of directed edges areadded from a 119866119894-node to 119886119894119895 number of randomly selected119866119895-nodes The nodes do not connect themselves despite119886119894119894 ge 0 Then the infection rate 120573 and the curing rate 120574 areconfigured based on the analytical epidemic threshold 120591lowastThe simulations are carried out on theNepidemiX [33] whichis a Python library implementing simulations of epidemicsFor initialization randomly selected 10 of the nodes areinfected During a simulation run the infected nodes canbe cured at the rate of 120574 Every infected node can infect itsneighbors connected by edges at the rate of 120573 Every dotin the figures is the average of 100 independent runs underthe same configurations including the network topology thepercentage of initially infected nodes 120573 and 120574

We first validate our model on a 1000-node networkwhere nodes connect each other and form a complete graphThe infection and curing rates are set to be 120573 = 00005 and120574 = 01 per time slot 120591 = 120573120574 = 0005 is set to be larger than120591lowast = 0001 to evaluate the proposed model Ten percent ofnodes are randomly chosen to be infected at 119905 = 0 Figure 3plots the infection density given bysum[119868]119894119873 from 119905 = 0 to 30The analytical results are numerically evaluated by employing(6a)ndash(6c) with the nodes evenly divided into 1 2 5 10 25 and50 groups respectively

From Figure 3 we can see that the analytical resultscan asymptotically approach the simulation results with theincreasing number of groups eg from 119899 = 1 to 119899 = 50 Thesimulation results can outgrow the analytical results whenthe number of node groups is small The analytical resultsunder a single group of nodes ie 119899 = 1 can substantiallyunderestimate the infection density The analytical result isonly 838 (06708) of the simulation result when 119905 = 30 Incontrast the analytical results under 50 groups of nodes iewhen 119899 = 50 match the simulation results indistinguishablyThis is because the proposed model is designed to decouplethe state transitions of edges connecting nodes from differentgroups and estimate the number of edges connecting infectednodes and subsequently the population of infected nodesThe

Simulation resultsAnalytical results

Analytical results with

from bottom to topn=1 2 5 10 25 50

5 10 15 20 25 300t

01

02

03

04

05

06

07

08

09

Infe

ctio

n de

nsity

Figure 3 The growth of infection density where a complete graphwith 1000 nodes is considered 120573 = 00005 and 120574 = 01 Theanalytical results are obtained based on (6a)ndash(6c) by evenly dividingthe nodes into 1 2 5 10 25 and 50 groups

mean-field approximation is applied to model the interplaybetween the averaged ratios of infectious edges connectingdifferent pairs of node groups With an increasing number ofnode groups the averaged ratio of infectious edges connect-ing a specific pair of node groups can become increasinglyrepresentative with a reducing deviation In other words theaveraged ratio becomes increasingly precise for a reducing setof edges In the special case where every node forms a group(ie the number of groups is 119899 = 1000) the ratio is exactlythe probability at which an edge is infectious The proposedmodel is able to capture the state transition of an edge underthe averaged effect of all other individual edges and can befairly accurate given the large number of edges Note that thenumber of groups eg 119899 = 50 is far less than the networksize ie 1000 This finding allows us to model the epidemicpropagation with a small number of differential equationsFigure 3 also shows that the analytical results can be accurateat the initial stage (or low infection densities) even with fewnode groups This is because the state transitions of differentedges are loosely coupled if only very few nodes are infected

We proceed to evaluate the model accuracy with differentinfection densities This is done by adjusting the infectionrate A 1000-node network is considered where nodes con-nect each other and form a complete graph The epidemicpropagationwith four effective spreading rates ie 120591 = 120573120574 =0002 00015 00011 and 0001 are simulated and analyzedThe values of 120591 are larger than and close to the analyticalthreshold The infection rates are obtained by adjusting 120573while setting 120574 to 01 The analysis is based on (6a)ndash(6c)by evenly dividing the nodes into 5 groups to explore theapplicability of the model to a small number of groups

Security and Communication Networks 7

Analytical resultsSimulation results

=0001

=0002

=00015

=00011

5 10 15 20 25 30 35 400t

005

01

015

02

025

03

035

04

045

05

Infe

ctio

n de

nsity

Figure 4 The infection density with the growth of time wherea complete graph with 1000 nodes is considered The analyticalresults are obtained based on (6a)ndash(6c) by evenly dividing the nodesinto 5 groups where 120591 = 120573120574 = 0002 00015 00011 and 0001respectively

From Figure 4 we can see that the simulation results stillovertake the analytical results when 120591 = 00015 and 0002For example the simulation result is 0459 in the case of119905 = 40 and 120591 = 0002 while the analytical result is only 0418However the gap between simulation results and analyticalresults decreases with dropping 120591 ie from 120591 = 0002 to00015When 120591 further declines ie 120591 = 00011 and 0001 theanalytical results are able tomatch the simulation results fromthe beginning to the end According to (20) the epidemicthreshold is given by 120591lowast = 0001 This figure reveals that theproposed mean-field model is asymptotically accurate witha decreasing 120591 and is able to precisely describe the epidemicpropagation when the effective spreading rate is around theepidemic threshold

We evaluate the epidemic threshold 120591lowast given by (20) inFigure 5 Three networks with 500 nodes are consideredwhere nodes are divided into three groups (ie N =[100 200 200]) The impact of the network topology on thethreshold is evaluated by varying the number of edges in thenetworkWithout loss of generality their collapsed adjacencymatrixA is set to

A = 120572[[[10 20 2010 20 2010 20 20

]]] (21)

where 120572 = 4 6 or 8 The curing rate 120574 is set to be 01 Tenpercent of nodes are randomly selected to be infected at theinitial state The infection density at 119905 = 1000 is used as thestable infection density as indicated by the 119910-axis Evaluatedwith (20) the epidemic threshold is 120591lowast= 0005 00033 and00025 when 120572= 4 6 and 8 respectively We can see from

times10 -3

= 8

= 6

= 4

2 3 4 5 6 7 8 9 101

0

01

02

03

04

05

06

07

08

Infe

ctio

n de

nsity

Simulation resultslowast

Figure 5The validation of epidemic threshold given by (20) wherethe 119910-axis is the infection density at 119905 = 1000 Three networks with500 nodes are considered 120574 is set to be 01 120572 = 4 6 8 is used toadjust the number of edges

Figure 5 that 120591lowast (the solid vertical lines) can precisely specifythe epidemic thresholds When 120591 lt 120591lowast the epidemic can besuppressed eventually When 120591 gt 120591lowast the infection densitygrows with 120591 and also exhibits convexity We can see thatthe network topology has a strong impact on the epidemicthreshold and the infection density Specifically the thresholddecreases with the growth of 120572 For example 120591 halves from0005 to 00025 when 120572 doubles from 4 to 8 (the number ofedges doubles as well) The infection density increases withthe growth of120572 especially around the threshold For examplein the case of 120572 = 8 and 120591 = 0005 the infection density is 05as compared to the infection density of 120572 = 4

We note that the epidemic threshold given by (20) isdetermined by the network structure A rather than thenumber of nodes given by N To illustrate this we comparethe number of infected populations in different scales ofnetworks illustrated by Figure 6 To be specific N = 120575 times[10 20 20] where 120575 = 2 4 and 6 respectively Theircollapsed adjacencymatrices are obtained with (21) by letting120572 = 1 As a result 120591lowast = 002 Figure 6 firstly confirmsthe accuracy of 120591lowast illustrated by the solid vertical line Theobservation that the three networks with the same structurebut different scales share the same epidemic threshold val-idates that the epidemic threshold depends on the networkstructure rather than the scale This finding can significantlyreduce the complexity to deduce the epidemic thresholdie from decomposing an 119873-dimensional matrix by using11205821(A) given by [12] to decomposing an 119899 dimensionalmatrix (119899 ≪ 119873) For example 119873 = 1000 and 119899 = 5in Figure 4 and 119873 = 500 and 119899 = 3 in Figure 5 It isinteresting to notice that the infection densities are the sameeg 796100 asymp 1588200 asymp 240300 in the case of 120591 = 01

8 Security and Communication Networks

Simulation results

= 6

= 4

= 2

lowast

002 004 006 008 010

0

50

100

150

200

250

[I] infin

Figure 6 The validation of epidemic threshold where the 119910-axisis the infected population at 119905 = 1000 Different scales of networks(119873=100 200 and 300 respectively) are considered 120574 is set to be 01

although the infected population varies in different scalesof networks This can be the reason of that the epidemicthreshold depends on the network structure rather than thenetwork scale

6 Conclusion

In this paper we designed a continuous-time SIS model inlarge-scale networks By categorizing nodes into groups themodel complexity was significantly reduced The proposedepidemic model was validated to be asymptotically accuratewith the decrease of the effective spreading rate andorthe increase of node groups The epidemic threshold canbe deduced with the largest eigenvalue of the collapsedadjacency matrix whose dimension is much smaller than thenetwork scale Simulation results corroborated the effective-ness of the model as well as the analytical accuracy of thethreshold in large-scale networks

Data Availability

The simulations are built on the epidemic simulation plat-form NepidemiX

Conflicts of Interest

The authors declare that they have no conflicts of interest

Acknowledgments

This work was supported by the National Key RampD ProgramofChina (no 2017YFB0802703) theNationalNatural Science

Foundation of China (no 61121061) and UTS DVC-R Fund-ing Initiative for Research Strengths

References

[1] J O Kephart and S R White ldquoDirected-graph epidemiologicalmodels of computer virusesrdquo in Proceedings of the IEEE Com-puter Society Symposium on Research in Security and Privacypp 343ndash359 IEEE Oakland CA USA May 1991

[2] X Wang K Zheng X Niu B Wu and C Wu ldquoDetection ofcommand and control in advanced persistent threat based onindependent accessrdquo in Proceedings of the 2016 IEEE Interna-tional Conference on Communications ICC 2016 pp 1ndash6 IEEEKuala Lumpur Malaysia May 2016

[3] WYang YQin andY Yang ldquoAnalysis ofmalicious flows via SISepidemicmodel in CCNrdquo in Proceedings of the IEEE INFOCOM2018 - IEEE Conference on Computer Communications Work-shops (INFOCOMWKSHPS) pp 748ndash753 IEEE Honolulu HIUSA April 2018

[4] Z Kong and E M Yeh ldquoResilience to degree-dependentand cascading node failures in random geometric networksrdquoInstitute of Electrical and Electronics Engineers Transactions onInformation Theory vol 56 no 11 pp 5533ndash5546 2010

[5] R M Anderson Infectious Diseases of Humans Dynamics AndControl vol 28 Wiley Online Library 1992

[6] X Wang X Zha G Yu et al ldquoAttack and defence of ethereumremote apisrdquo in Proceedings of the IEEE Globecom Workshops(GCWkshpsrsquo18) IEEE Abu Dhabi UAE 2018

[7] X Wang W Ni K Zheng R P Liu and X Niu ldquoVirusPropagation Modeling and Convergence Analysis in Large-Scale Networksrdquo IEEE Transactions on Information Forensicsand Security vol 11 no 10 pp 2241ndash2254 2016

[8] P Van Mieghem J Omic and R Kooij ldquoVirus spread innetworksrdquo IEEEACM Transactions on Networking vol 17 no1 pp 1ndash14 2009

[9] Y Wang D Chakrabarti C Wang and C Faloutsos ldquoEpi-demic spreading in real networks an eigenvalue viewpointrdquoin Proceedings of the 22nd International Symposium on ReliableDistributed Systems (SRDS rsquo03) pp 25ndash34 IEEE Florence ItalyOctober 2003

[10] L P Kadanoff ldquoMore is the same phase transitions and meanfield theoriesrdquo Journal of Statistical Physics vol 137 no 5 pp777ndash797 2009

[11] A Ganesh L Massoulie and D Towsley ldquoThe effect of networktopology on the spread of epidemicsrdquo in Proceedings of theProceedings IEEE 24th Annual Joint Conference of the IEEEComputer and Communications Societies vol 2 pp 1455ndash1466IEEE Miami FL USA 2005

[12] P Van Mieghem and R Van De Bovenkamp ldquoNon-Markovianinfection spread dramatically alters the susceptible-infected-susceptible epidemic threshold in networksrdquo Physical ReviewLetters vol 110 no 10 Article ID 108701 2013

[13] A Barabasi and E Bonabeau ldquoScale-Free Networksrdquo ScientificAmerican vol 288 no 5 pp 60ndash69 2003

[14] R Pastor-Satorras C Castellano P Van Mieghem andA Vespignani ldquoEpidemic processes in complex networksrdquoReviews of Modern Physics vol 87 no 3 pp 925ndash979 2015

[15] R Pastor-Satorras and A Vespignani ldquoEpidemic spreading inscale-free networksrdquo Physical Review Letters vol 86 no 14 pp3200ndash3203 2001

Security and Communication Networks 9

[16] H Kang and X Fu ldquoEpidemic spreading and global stability ofan SIS model with an infective vector on complex networksrdquoCommunications in Nonlinear Science amp Numerical Simulationvol 27 no 1ndash3 pp 30ndash39 2015

[17] T Li X Liu J Wu C Wan Z-H Guan and Y Wang ldquoAnepidemic spreadingmodel on adaptive scale-free networks withfeedback mechanismrdquo Physica A Statistical Mechanics and itsApplications vol 450 pp 649ndash656 2016

[18] J O Kephart and S R White ldquoMeasuring and modeling com-puter virus prevalencerdquo in Proceedings of the IEEE ComputerSociety Symposium onResearch in Security and Privacy pp 2ndash15IEEE Oakland Calif USA May 1993

[19] MVojnovic andA J Ganesh ldquoOn the race ofworms alerts andpatchesrdquo IEEEACM Transactions on Networking vol 16 no 5pp 1066ndash1079 2008

[20] Y Yao Q Fu W Yang Y Wang and C Sheng ldquoAn epidemicmodel of computer worms with time delay and variable infec-tion raterdquo Security and Communication Networks vol 2018Article ID 9756982 11 pages 2018

[21] L Liu R K L Ko G Ren and X Xu ldquoMalware propagationand prevention model for time-varying community networkswithin software defined networksrdquo Security and Communica-tion Networks vol 2017 Article ID 2910310 8 pages 2017

[22] C C Zou D Towsley and W B Gong ldquoModeling andsimulation study of the propagation and defense of internete-mail wormsrdquo IEEE Transactions on Dependable and SecureComputing vol 4 no 2 pp 105ndash118 2007

[23] C Li R van de Bovenkamp and P VanMieghem ldquoSusceptible-infected-susceptiblemodel A comparison of n-intertwined andheterogeneous mean-field approximationsrdquo Physical Review Evol 86 no 3 p 026116 2012

[24] W K Chai and G Pavlou ldquoPath-Based Epidemic Spreading inNetworksrdquo IEEEACM Transactions on Networking vol 25 no1 pp 565ndash578 2017

[25] J Kim andM Hastak ldquoSocial network analysis Characteristicsof online social networks after a disasterrdquo International Journalof Information Management vol 38 no 1 pp 86ndash96 2018

[26] L A Meyers M E Newman and B Pourbohloul ldquoPredictingepidemics on directed contact networksrdquo Journal of TheoreticalBiology vol 240 no 3 pp 400ndash418 2006

[27] C Li H Wang and P Van Mieghem ldquoEpidemic threshold indirected networksrdquoPhysical Review E Statistical Nonlinear andSoft Matter Physics vol 88 no 6 p 062802 2013

[28] A Khanafer T Basar and B Gharesifard ldquoStability of epidemicmodels over directed graphs a positive systems approachrdquoAutomatica vol 74 pp 126ndash134 2016

[29] A Lyapunov ldquoThe general problem of the stability of motionrdquoInternational Journal of Control vol 55 no 3 pp 531ndash534 1992English Translation

[30] M J Keeling ldquoThe effects of local spatial structure on epidemi-ological invasionsrdquo Proceedings of the Royal Society of London BBiological Sciences vol 266 no 1421 pp 859ndash867 1999

[31] K J Sharkey C Fernandez K L Morgan et al ldquoPair-levelapproximations to the spatio-temporal dynamics of epidemicson asymmetric contact networksrdquo Journal of MathematicalBiology vol 53 no 1 pp 61ndash85 2006

[32] D K Arrowsmith and C M Place Dynamical Systems Dif-ferential Equations Maps and Chaotic Behaviour Chapman ampHall London UK 1992

[33] L Ahrenberg ldquoNepidemixrdquo httpnepidemixirmacssfuca

Security and Communication Networks 3

1 2 3

Figure 1 An example of networks we considered where 7 nodes arecategorized into three groups according to the connection betweenthem

and showed that when the basic reproduction number isgreater than one the epidemic state is locally exponentiallystable and when the network is not initialized at the disease-free state the epidemic state is globally asymptotically stable

3 The Directed Network Model

We consider the SIS epidemic process in a strongly connectednetwork with 119873 nodes connected by directed edges Eachnode in the network can be in either a susceptible (119878) or aninfected (119868) state An infected node can infect its susceptibleneighbors along the directed edges at the rate of 120573 per edgeInfected nodes can independently recover to be susceptible atthe rate of 120574

We suppose that the 119873 nodes in a network G can becategorized into 119899 groups denoted by 1198661 1198662 sdot sdot sdot 119866119899 wherethe nodes in the same group have the same out-degreesand the same number of edges to the nodes in the samedestination group The number of 119866119894-nodes can be denotedby 119873119894 (here sum119894119873119894 = 119873) Given the node groups we definea collapsed adjacency matrix denoted by A to describe thetopology of G The (119894 119895)-th entry of the matrix denoted by119886119894119895 describes the number of edges from a 119866119894-node pointingto 119866119895-nodes As a result G can be described by the nodenumber vector N = [1198731 1198732 119873119899] and the collapsedadjacency matrix A Figure 1 provides an example of nodecategorization where119873 = 7 nodes are categorized into 119899 = 3groups ieN = [2 3 2] Its collapsed adjacencymatrix canbe given by

A = [[[11988611 11988612 1198861311988621 11988622 1198862311988631 11988632 11988633

]]]

= [[[0 3 00 1 21 0 0

]]]

(1)

Other notations are defined as follows [119860]119894 (119860 isin 119878 119868)denotes the number of 119866119894-nodes in state 119860 119860119861119894119895 denotesan edge starting from a 119866119894-node and ending at a 119866119895-nodewhere the 119866119894-node and the 119866119895-node are in states 119860 and119861 respectively [119860119861]119894119895 denotes the number of 119860119861119894119895 edgesLet [119860119861119862]119894119895119896 ([119860119861119862]1015840119894119895119896) denote the number of edge pairsconsisting of 119860119861119894119895 and 119861119862119895119896 (119860119861119894119895 and 119862119861119896119895) as illustrated

S I S

S I S

Ｃ Ｄ Ｅ

Ｃ Ｄ Ｅ

[SIS]ijk

[SIS]ijk

Figure 2 An example of [119860119861119862]119894119895119896 and [119860119861119862]1015840119894119895119896

by Figure 2 Numerical relationships between states of nodesand states of edges satisfy

119873119894 = [119878]119894 + [119868]119894 (2a)

119886119894119895119873119894 = [119878119878]119894119895 + [119878119868]119894119895 + [119868119878]119894119895 + [119868119868]119894119895 (2b)

119886119894119895 [119878]119894 = [119878119878]119894119895 + [119878119868]119894119895 (2c)

119886119894119895 [119868]119894 = [119868119878]119894119895 + [119868119868]119894119895 (2d)

[119878]119894 = 119873119894 minus [119868]119894 = 119873119894 minus 1119886119894119895 ([119868119878]119894119895 + [119868119868]119894119895) (2e)

Here (2a) is because any node is in either an 119878or 119868 state (2b) isbecause any edge is in one of the four states given in the right-hand side (RHS) of (2b) Meanwhile edges can be classifiedaccording to the state of the starting point as given by (2c)and (2d) (2e) is deduced from (2a) (2b) and (2d)

4 Group-Based Mean-Field SIS Model

We propose to analyze the SIS process in directed networksby employing the mean-field approximation which uses asingle average effect to approximate the effect of all the otherindividuals on any given individual Thus the same groupof nodes in our model are evaluated by the same averageestimationThe state transitions of nodes and edges in the SISprocess can be given by

d [119878]119894d119905 = 120574 [119868]119894 minus sum

119895

120573 [119868119878]119895119894 (3a)

d [119868]119894d119905 = minus120574 [119868]119894 + sum

119895

120573 [119868119878]119895119894 (3b)

d [119878119878]119894119895d119905 = 120574 [119878119868]119894119895 + 120574 [119868119878]119894119895 minus sum

119896

120573 [119868119878119878]119896119894119895minus sum119896

120573 [119878119878119868]1015840119894119895119896 (3c)

d [119878119868]119894119895d119905 = minus120574 [119878119868]119894119895 + 120574 [119868119868]119894119895 + sum

119896

120573 [119878119878119868]1015840119894119895119896minus sum119896

120573 [119868119878119868]119896119894119895 (3d)

4 Security and Communication Networks

d [119868119878]119894119895d119905 = minus120574 [119868119878]119894119895 + 120574 [119868119868]119894119895 minus 120573 [119868119878]119894119895 + sum

119896

120573 [119868119878119878]119896119894119895minus sum119896

120573 [119868119878119868]1015840119894119895119896 (3e)

d [119868119868]119894119895d119905 = minus2120574 [119868119868]119894119895 + 120573 [119868119878]119894119895 + sum

119896

120573 [119868119878119868]119896119894119895+ sum119896

120573 [119868119878119868]1015840119894119895119896 (3f)

Here (3a) and (3b) give the changing rate of susceptibleand infected 119866119894-nodes The RHS is because an infected 119866119894-node can be cured with the rate 120574 a susceptible 119866119894-nodecan be infected with the rate 120573 per edge by an infected 119866119895neighbor In the continuous-time model the time slot isinfinitesimal that the infection rate can be summed togetherie sum119895 120573[119868119878]119895119894

Equations (3c)-(3f) capture the time-varying number oflinks The first two terms on the RHS of (3c) are becausean 119878119878119894119895 edge can transfer from an 119878119868119894119895 or 119868119878119894119895 edge when theinfected node is cured The last two terms on the RHS of (3c)capture the cases where the starting 119866119894-node or the ending119866119895-node is infected by its infected neighbors (3d) is becausean 119878119868119894119895 edge can transfer to an 119878119878119894119895 edge in the case that theinfected 119866119895-node is cured at the rate 120574 and to 119868119868119894119895 in thecase that the susceptible 119866119894-node is infected by its infectedneighbors 119878119868119894119895 can transfer from 119868119868119894119895 in the case that theinfected 119866119894-node is cured with the rate 120574 or from 119878119878119894119895 in thecase that the susceptible 119866119895-node is infected by its infectedneighbors Different from previous SIS models in undirectednetworks eg [15] 119878119868119894119895 cannot transfer to 119868119868119894119895 as the epidemiccan only propagate along directed edges Equation (3e) canbe similarly obtained attaching the infection process ieminus120573[119868119878]119894119895 Equation (3f) is self-explanatory

Known as the disease-free equilibrium point the equi-librium point of interest is ([119878119868]119894119895 [119868119878]119894119895 [119868119868]119894119895) = (0 0 0)ie all nodes are susceptible The condition of the disease-free equilibrium point can be deduced by linearizing theSIS model given by (3a)ndash(3f) This is because the stabilityof the original nonlinear system can be determined by theeigenvalues of the linearized model as stated in LyapunovrsquosFirst Method [29]

To linearize the SIS model the number of edge pairs[119860119861119862]119894119895119896 and [119860119861119862]1015840119894119895119896 is first estimated by using the numberof unpaired edges This is achieved by applying the momentclosure approximation as evaluated in [30 31] As a result wehave

[119868119878119878]119896119894119895 = [119868119878]119896119894 [119878119878]119894119895[119878]119894 = [119868119878]119896119894 [119878119878]119894119895119873119894 minus ([119868119878]119894119901 + [119868119868]119894119901) 119886119894119901 (4a)

[119878119878119868]1015840119894119895119896 = [119868119878]119896119895 [119878119878]119894119895[119878]119895 = [119868119878]119896119895 [119878119878]119894119895119873119895 minus ([119868119878]119895119902 + [119868119868]119895119902) 119886119895119902 (4b)

[119868119878119868]119896119894119895 = [119868119878]119896119894 [119878119868]119894119895[119878]119894 = [119868119878]119896119894 [119878119868]119894119895119873119894 minus ([119868119878]119894119901 + [119868119868]119894119901) 119886119894119901 (4c)

[119868119878119868]1015840119894119895119896 = [119868119878]119894119895 [119868119878]119896119895[119878]119895 = [119868119878]119894119895 [119868119878]119896119895119873119895 minus ([119868119878]119895119902 + [119868119868]119895119902) 119886119895119902 (4d)

In (4a) every susceptible 119866119894-node on average has [119878119878]119894119895[119878]119894edges pointing to119866119895-nodes [119878]119894 is then estimated by employ-ing (2e) where 119901 and 119902 are introduced to solve the equationHere 119901 satisfies [119868119878]119894119901 + [119868119868]119894119901 gt 0 and 119886119894119901 gt 0 119902 satisfies[119868119878]119895119902 + [119868119868]119895119902 gt 0 and 119886119895119902 gt 0 (4b)-(4d) can be similarlyobtained

By substituting (4a)ndash(4d) into (3a)ndash(3f) (3c)-(3f) can berewritten as

d [119878119878]119894119895d119905 = 120574 [119878119868]119894119895 + 120574 [119868119878]119894119895

minus sum119896

120573 [119868119878]119896119894 [119878119878]119894119895119873119894 minus ([119868119878]119894119901 + [119868119868]119894119901) 119886119894119901

minus sum119896

120573[119868119878]119896119895 [119878119878]119894119895[119878]119895 (5a)

d [119878119868]119894119895d119905 = minus120574 [119878119868]119894119895 + 120574 [119868119868]119894119895

+ sum119896

120573 [119868119878]119896119895 [119878119878]119894119895119873119895 minus ([119868119878]119895119902 + [119868119868]119895119902) 119886119895119902

minus sum119896

120573 [119868119878]119896119894 [119878119868]119894119895119873119894 minus ([119868119878]119894119901 + [119868119868]119894119901) 119886119894119901

(5b)

d [119868119878]119894119895d119905 = minus120574 [119868119878]119894119895 + 120574 [119868119868]119894119895 minus 120573 [119868119878]119894119895

+ sum119896

120573 [119868119878]119896119894 [119878119878]119894119895119873119894 minus ([119868119878]119894119901 + [119868119868]119894119901) 119886119894119901

minus sum119896

120573 [119868119878]119894119895 [119868119878]119896119895119873119895 minus ([119868119878]119895119902 + [119868119868]119895119902) 119886119895119902

(5c)

d [119868119868]119894119895d119905 = minus2120574 [119868119868]119894119895 + 120573 [119868119878]119894119895

+ sum119896

120573 [119868119878]119896119894 [119878119868]119894119895119873119894 minus ([119868119878]119894119901 + [119868119868]119894119901) 119886119894119901

+ sum119896

120573 [119868119878]119894119895 [119868119878]119896119895119873119895 minus ([119868119878]119895119902 + [119868119868]119895119902) 119886119895119902

(5d)

The terms of [119878119878]119894119895 can be suppressed by substituting (2b) into(5a)ndash(5d) As a result we have

d [119878119868]119894119895d119905= minus120574 [119878119868]119894119895 + 120574 [119868119868]119894119895

+ sum119896

120573[119868119878]119896119895 (119886119894119895119873119894 minus [119878119868]119894119895 minus [119868119878]119894119895 minus [119868119868]119894119895)119873119895 minus (1119886119895119902) ([119868119878]119895119902 + [119868119868]119895119902)

minus sum119896

120573 [119868119878]119896119894 [119878119868]119894119895119873119894 minus (1119886119894119901) ([119868119878]119894119901 + [119868119868]119894119901)

(6a)

Security and Communication Networks 5

d [119868119878]119894119895d119905= minus120574 [119868119878]119894119895 + 120574 [119868119868]119894119895 minus 120573119894119895 [119868119878]119894119895

+ sum119896

120573[119868119878]119896119894 (119886119894119895119873119894 minus [119878119868]119894119895 minus [119868119878]119894119895 minus [119868119868]119894119895)119873119894 minus (1119886119894119901) ([119868119878]119894119901 + [119868119868]119894119901)

minus sum119896

120573 [119868119878]119894119895 [119868119878]119896119895119873119895 minus (1119886119895119902) ([119868119878]119895119902 + [119868119868]119895119902)

(6b)

d [119868119868]119894119895d119905= minus2120574 [119868119868]119894119895 + 120573 [119868119878]119894119895

+ sum119896

120573 [119868119878]119896119894 [119878119868]119894119895119873119894 minus (1119886119894119901) ([119868119878]119894119901 + [119868119868]119894119901)

+ sum119896

120573 [119868119878]119894119895 [119868119878]119896119895119873119895 minus (1119886119895119902) ([119868119878]119895119902 + [119868119868]119895119902)

(6c)

Near the disease-free equilibrium point (6a)ndash(6c) can belinearized by suppressing all higher order terms As a resultwe have

d [119878119868]119894119895d119905 asymp minus120574 [119878119868]119894119895 + 120574 [119868119868]119894119895 + sum

119896

120573119886119894119895119873119894 [119868119878]119896119895119873119895 (7a)

d [119868119878]119894119895d119905 asymp minus (120574 + 120573) [119868119878]119894119895 + 120574 [119868119868]119894119895 + sum

119896

120573119886119894119895 [119868119878]119896119894 (7b)

d [119868119868]119894119895d119905 asymp minus2120574 [119868119868]119894119895 + 120573 [119868119878]119894119895 (7c)

After the model has been linearized the condition of thedisease-free equilibriumpoint can be obtained by performingeigenvalue analysis on the Jacobian matrix of the lineariza-tionThe Jacobianmatrix is a 31198992times31198992matrix and denoted byJ The nonlinear dynamic system is stable at the equilibriumpoint if and only if all the eigenvalues of the Jacobian matrixare negative as stated by the Hartman-Grobman Theorem[32] In other words the epidemic is certainly extinct if

1205821 (J) lt 0 (8)

where 1205821(sdot) is the largest eigenvalue of the operator J is theJacobian matrix of (7a)ndash(7c) and can be given by

J = [[[J11 J12 J13

J21 J22 J23

J31 J32 J33]]]

= [ J11 J12 J130 Jlowast ] (9)

where J11 is an 1198992times1198992 diagonal matrix whose diagonal entriesare minus120574 We note that J21 and J31 are zero matrices As a resultJ is an upper block triangular matrix and

120582 (J) = 120582 (J11) cup 120582 (Jlowast) (10)

where 120582(sdot) is the set of eigenvalues of the operator

Here J23 J32 and J33 are 1198992 times 1198992 diagonal matrices Theirdiagonal entries are 120574 120573 and minus2120574 respectively The entry inthe (119899(119894minus1)+119895)-th row (119899(119896minus1)+119897)-th column of J22 denotedby 11986922119894119895119896119897 is given by

11986922119894119895119896119897 =

119886119894119895120573 minus (120574 + 120573) if 119894119895 = 119896119897 119894 = 119897minus (120574 + 120573) if 119894119895 = 119896119897 119894 = 119897119886119894119895120573 if 119894119895 = 119896119897 119894 = 1198970 if 119894119895 = 119896119897 119894 = 119897

(11)

By employing the Schur complement ie

[J22 J23

J32 J33][[

I 0

minus (J33)minus1 J32 I]]

= [H J23

0 J33] (12)

we have 120582(Jlowast) = 120582(J33) cup 120582(H) where H = J22 minus J23J33minus1

J32The entry in the (119899(119894 minus 1) + 119895)-th row (119899(119896 minus 1) + 119897)-th columnofH denoted by119867119894119895119896119897 is given by

119867119894119895119896119897 =

119886119894119895120573 minus (120574 + 1205732) if 119894119895 = 119896119897 119894 = 119897minus (120574 + 1205732) if 119894119895 = 119896119897 119894 = 119897119886119894119895120573 if 119894119895 = 119896119897 119894 = 1198970 if 119894119895 = 119896119897 119894 = 119897

(13)

We conclude that 120582(J) = 120582(J11) cup 120582(J33) cup 120582(H) Note thatJ11 and J33 are diagonal matrices and all the diagonal entriesof them are negative ie all the eigenvalues of J11 and J33 arenegative As a result we have

1205821 (J) lt 0 lArrrArr 1205821 (H) lt 0 (14)

The matrixH can be written as

H = P +Q (15)

where Q is a diagonal matrix and can be given by Q =diag[minus(120574 + 1205732)] The entry in the (119899(119894 minus 1) + 119895)-th row(119899(119896 minus 1) + 119897)-th column of P denoted by 119875119894119895119896119897 is given by

119875119894119895119896119897 = 119886119894119895120573 if 119894 = 1198970 otherwise (16)

We have that all the eigenvalues ofQ are minus(120574 + 1205732) and120582 (H) = 120582 (P) minus (120574 + 1205732) (17)

Note that P is a 1198992 times 1198992 sparse matrix and similar with ablock matrix consisting of 120573A and zero matrices as given by

P = Xminus1 [ 120573A 00 0 ]X (18)

6 Security and Communication Networks

This is achieved by performing matrix operations on P Thusthe eigenvalues of P can be given by

120582 (P) = 120573 times 120582 (A) cup 0 (19)

Combining (8) (14) (17) and (19) the epidemic willbecome extinct if 1205731205821(A) minus (120574 + 1205732) lt 0 In other wordsthe epidemic threshold denoted by 120591lowast is given by

120591lowast = 11205821 (A) minus 12 (20)

The epidemic dies out if 120591 = 120573120574 lt 120591lowast5 Simulation and Numerical Results

In this section numerical and simulation results are pre-sented to validate the proposed group-based SIS modeland the deduced epidemic threshold In every run of thesimulations the groups and the network topology ie thescale and structure are first set up according to the rulesspecified in Section 3 ie 119886119894119895 number of directed edges areadded from a 119866119894-node to 119886119894119895 number of randomly selected119866119895-nodes The nodes do not connect themselves despite119886119894119894 ge 0 Then the infection rate 120573 and the curing rate 120574 areconfigured based on the analytical epidemic threshold 120591lowastThe simulations are carried out on theNepidemiX [33] whichis a Python library implementing simulations of epidemicsFor initialization randomly selected 10 of the nodes areinfected During a simulation run the infected nodes canbe cured at the rate of 120574 Every infected node can infect itsneighbors connected by edges at the rate of 120573 Every dotin the figures is the average of 100 independent runs underthe same configurations including the network topology thepercentage of initially infected nodes 120573 and 120574

We first validate our model on a 1000-node networkwhere nodes connect each other and form a complete graphThe infection and curing rates are set to be 120573 = 00005 and120574 = 01 per time slot 120591 = 120573120574 = 0005 is set to be larger than120591lowast = 0001 to evaluate the proposed model Ten percent ofnodes are randomly chosen to be infected at 119905 = 0 Figure 3plots the infection density given bysum[119868]119894119873 from 119905 = 0 to 30The analytical results are numerically evaluated by employing(6a)ndash(6c) with the nodes evenly divided into 1 2 5 10 25 and50 groups respectively

From Figure 3 we can see that the analytical resultscan asymptotically approach the simulation results with theincreasing number of groups eg from 119899 = 1 to 119899 = 50 Thesimulation results can outgrow the analytical results whenthe number of node groups is small The analytical resultsunder a single group of nodes ie 119899 = 1 can substantiallyunderestimate the infection density The analytical result isonly 838 (06708) of the simulation result when 119905 = 30 Incontrast the analytical results under 50 groups of nodes iewhen 119899 = 50 match the simulation results indistinguishablyThis is because the proposed model is designed to decouplethe state transitions of edges connecting nodes from differentgroups and estimate the number of edges connecting infectednodes and subsequently the population of infected nodesThe

Simulation resultsAnalytical results

Analytical results with

from bottom to topn=1 2 5 10 25 50

5 10 15 20 25 300t

01

02

03

04

05

06

07

08

09

Infe

ctio

n de

nsity

Figure 3 The growth of infection density where a complete graphwith 1000 nodes is considered 120573 = 00005 and 120574 = 01 Theanalytical results are obtained based on (6a)ndash(6c) by evenly dividingthe nodes into 1 2 5 10 25 and 50 groups

mean-field approximation is applied to model the interplaybetween the averaged ratios of infectious edges connectingdifferent pairs of node groups With an increasing number ofnode groups the averaged ratio of infectious edges connect-ing a specific pair of node groups can become increasinglyrepresentative with a reducing deviation In other words theaveraged ratio becomes increasingly precise for a reducing setof edges In the special case where every node forms a group(ie the number of groups is 119899 = 1000) the ratio is exactlythe probability at which an edge is infectious The proposedmodel is able to capture the state transition of an edge underthe averaged effect of all other individual edges and can befairly accurate given the large number of edges Note that thenumber of groups eg 119899 = 50 is far less than the networksize ie 1000 This finding allows us to model the epidemicpropagation with a small number of differential equationsFigure 3 also shows that the analytical results can be accurateat the initial stage (or low infection densities) even with fewnode groups This is because the state transitions of differentedges are loosely coupled if only very few nodes are infected

We proceed to evaluate the model accuracy with differentinfection densities This is done by adjusting the infectionrate A 1000-node network is considered where nodes con-nect each other and form a complete graph The epidemicpropagationwith four effective spreading rates ie 120591 = 120573120574 =0002 00015 00011 and 0001 are simulated and analyzedThe values of 120591 are larger than and close to the analyticalthreshold The infection rates are obtained by adjusting 120573while setting 120574 to 01 The analysis is based on (6a)ndash(6c)by evenly dividing the nodes into 5 groups to explore theapplicability of the model to a small number of groups

Security and Communication Networks 7

Analytical resultsSimulation results

=0001

=0002

=00015

=00011

5 10 15 20 25 30 35 400t

005

01

015

02

025

03

035

04

045

05

Infe

ctio

n de

nsity

Figure 4 The infection density with the growth of time wherea complete graph with 1000 nodes is considered The analyticalresults are obtained based on (6a)ndash(6c) by evenly dividing the nodesinto 5 groups where 120591 = 120573120574 = 0002 00015 00011 and 0001respectively

From Figure 4 we can see that the simulation results stillovertake the analytical results when 120591 = 00015 and 0002For example the simulation result is 0459 in the case of119905 = 40 and 120591 = 0002 while the analytical result is only 0418However the gap between simulation results and analyticalresults decreases with dropping 120591 ie from 120591 = 0002 to00015When 120591 further declines ie 120591 = 00011 and 0001 theanalytical results are able tomatch the simulation results fromthe beginning to the end According to (20) the epidemicthreshold is given by 120591lowast = 0001 This figure reveals that theproposed mean-field model is asymptotically accurate witha decreasing 120591 and is able to precisely describe the epidemicpropagation when the effective spreading rate is around theepidemic threshold

We evaluate the epidemic threshold 120591lowast given by (20) inFigure 5 Three networks with 500 nodes are consideredwhere nodes are divided into three groups (ie N =[100 200 200]) The impact of the network topology on thethreshold is evaluated by varying the number of edges in thenetworkWithout loss of generality their collapsed adjacencymatrixA is set to

A = 120572[[[10 20 2010 20 2010 20 20

]]] (21)

where 120572 = 4 6 or 8 The curing rate 120574 is set to be 01 Tenpercent of nodes are randomly selected to be infected at theinitial state The infection density at 119905 = 1000 is used as thestable infection density as indicated by the 119910-axis Evaluatedwith (20) the epidemic threshold is 120591lowast= 0005 00033 and00025 when 120572= 4 6 and 8 respectively We can see from

times10 -3

= 8

= 6

= 4

2 3 4 5 6 7 8 9 101

0

01

02

03

04

05

06

07

08

Infe

ctio

n de

nsity

Simulation resultslowast

Figure 5The validation of epidemic threshold given by (20) wherethe 119910-axis is the infection density at 119905 = 1000 Three networks with500 nodes are considered 120574 is set to be 01 120572 = 4 6 8 is used toadjust the number of edges

Figure 5 that 120591lowast (the solid vertical lines) can precisely specifythe epidemic thresholds When 120591 lt 120591lowast the epidemic can besuppressed eventually When 120591 gt 120591lowast the infection densitygrows with 120591 and also exhibits convexity We can see thatthe network topology has a strong impact on the epidemicthreshold and the infection density Specifically the thresholddecreases with the growth of 120572 For example 120591 halves from0005 to 00025 when 120572 doubles from 4 to 8 (the number ofedges doubles as well) The infection density increases withthe growth of120572 especially around the threshold For examplein the case of 120572 = 8 and 120591 = 0005 the infection density is 05as compared to the infection density of 120572 = 4

We note that the epidemic threshold given by (20) isdetermined by the network structure A rather than thenumber of nodes given by N To illustrate this we comparethe number of infected populations in different scales ofnetworks illustrated by Figure 6 To be specific N = 120575 times[10 20 20] where 120575 = 2 4 and 6 respectively Theircollapsed adjacencymatrices are obtained with (21) by letting120572 = 1 As a result 120591lowast = 002 Figure 6 firstly confirmsthe accuracy of 120591lowast illustrated by the solid vertical line Theobservation that the three networks with the same structurebut different scales share the same epidemic threshold val-idates that the epidemic threshold depends on the networkstructure rather than the scale This finding can significantlyreduce the complexity to deduce the epidemic thresholdie from decomposing an 119873-dimensional matrix by using11205821(A) given by [12] to decomposing an 119899 dimensionalmatrix (119899 ≪ 119873) For example 119873 = 1000 and 119899 = 5in Figure 4 and 119873 = 500 and 119899 = 3 in Figure 5 It isinteresting to notice that the infection densities are the sameeg 796100 asymp 1588200 asymp 240300 in the case of 120591 = 01

8 Security and Communication Networks

Simulation results

= 6

= 4

= 2

lowast

002 004 006 008 010

0

50

100

150

200

250

[I] infin

Figure 6 The validation of epidemic threshold where the 119910-axisis the infected population at 119905 = 1000 Different scales of networks(119873=100 200 and 300 respectively) are considered 120574 is set to be 01

although the infected population varies in different scalesof networks This can be the reason of that the epidemicthreshold depends on the network structure rather than thenetwork scale

6 Conclusion

In this paper we designed a continuous-time SIS model inlarge-scale networks By categorizing nodes into groups themodel complexity was significantly reduced The proposedepidemic model was validated to be asymptotically accuratewith the decrease of the effective spreading rate andorthe increase of node groups The epidemic threshold canbe deduced with the largest eigenvalue of the collapsedadjacency matrix whose dimension is much smaller than thenetwork scale Simulation results corroborated the effective-ness of the model as well as the analytical accuracy of thethreshold in large-scale networks

Data Availability

The simulations are built on the epidemic simulation plat-form NepidemiX

Conflicts of Interest

The authors declare that they have no conflicts of interest

Acknowledgments

This work was supported by the National Key RampD ProgramofChina (no 2017YFB0802703) theNationalNatural Science

Foundation of China (no 61121061) and UTS DVC-R Fund-ing Initiative for Research Strengths

References

[1] J O Kephart and S R White ldquoDirected-graph epidemiologicalmodels of computer virusesrdquo in Proceedings of the IEEE Com-puter Society Symposium on Research in Security and Privacypp 343ndash359 IEEE Oakland CA USA May 1991

[2] X Wang K Zheng X Niu B Wu and C Wu ldquoDetection ofcommand and control in advanced persistent threat based onindependent accessrdquo in Proceedings of the 2016 IEEE Interna-tional Conference on Communications ICC 2016 pp 1ndash6 IEEEKuala Lumpur Malaysia May 2016

[3] WYang YQin andY Yang ldquoAnalysis ofmalicious flows via SISepidemicmodel in CCNrdquo in Proceedings of the IEEE INFOCOM2018 - IEEE Conference on Computer Communications Work-shops (INFOCOMWKSHPS) pp 748ndash753 IEEE Honolulu HIUSA April 2018

[4] Z Kong and E M Yeh ldquoResilience to degree-dependentand cascading node failures in random geometric networksrdquoInstitute of Electrical and Electronics Engineers Transactions onInformation Theory vol 56 no 11 pp 5533ndash5546 2010

[5] R M Anderson Infectious Diseases of Humans Dynamics AndControl vol 28 Wiley Online Library 1992

[6] X Wang X Zha G Yu et al ldquoAttack and defence of ethereumremote apisrdquo in Proceedings of the IEEE Globecom Workshops(GCWkshpsrsquo18) IEEE Abu Dhabi UAE 2018

[7] X Wang W Ni K Zheng R P Liu and X Niu ldquoVirusPropagation Modeling and Convergence Analysis in Large-Scale Networksrdquo IEEE Transactions on Information Forensicsand Security vol 11 no 10 pp 2241ndash2254 2016

[8] P Van Mieghem J Omic and R Kooij ldquoVirus spread innetworksrdquo IEEEACM Transactions on Networking vol 17 no1 pp 1ndash14 2009

[9] Y Wang D Chakrabarti C Wang and C Faloutsos ldquoEpi-demic spreading in real networks an eigenvalue viewpointrdquoin Proceedings of the 22nd International Symposium on ReliableDistributed Systems (SRDS rsquo03) pp 25ndash34 IEEE Florence ItalyOctober 2003

[10] L P Kadanoff ldquoMore is the same phase transitions and meanfield theoriesrdquo Journal of Statistical Physics vol 137 no 5 pp777ndash797 2009

[11] A Ganesh L Massoulie and D Towsley ldquoThe effect of networktopology on the spread of epidemicsrdquo in Proceedings of theProceedings IEEE 24th Annual Joint Conference of the IEEEComputer and Communications Societies vol 2 pp 1455ndash1466IEEE Miami FL USA 2005

[12] P Van Mieghem and R Van De Bovenkamp ldquoNon-Markovianinfection spread dramatically alters the susceptible-infected-susceptible epidemic threshold in networksrdquo Physical ReviewLetters vol 110 no 10 Article ID 108701 2013

[13] A Barabasi and E Bonabeau ldquoScale-Free Networksrdquo ScientificAmerican vol 288 no 5 pp 60ndash69 2003

[14] R Pastor-Satorras C Castellano P Van Mieghem andA Vespignani ldquoEpidemic processes in complex networksrdquoReviews of Modern Physics vol 87 no 3 pp 925ndash979 2015

[15] R Pastor-Satorras and A Vespignani ldquoEpidemic spreading inscale-free networksrdquo Physical Review Letters vol 86 no 14 pp3200ndash3203 2001

Security and Communication Networks 9

[16] H Kang and X Fu ldquoEpidemic spreading and global stability ofan SIS model with an infective vector on complex networksrdquoCommunications in Nonlinear Science amp Numerical Simulationvol 27 no 1ndash3 pp 30ndash39 2015

[17] T Li X Liu J Wu C Wan Z-H Guan and Y Wang ldquoAnepidemic spreadingmodel on adaptive scale-free networks withfeedback mechanismrdquo Physica A Statistical Mechanics and itsApplications vol 450 pp 649ndash656 2016

[18] J O Kephart and S R White ldquoMeasuring and modeling com-puter virus prevalencerdquo in Proceedings of the IEEE ComputerSociety Symposium onResearch in Security and Privacy pp 2ndash15IEEE Oakland Calif USA May 1993

[19] MVojnovic andA J Ganesh ldquoOn the race ofworms alerts andpatchesrdquo IEEEACM Transactions on Networking vol 16 no 5pp 1066ndash1079 2008

[20] Y Yao Q Fu W Yang Y Wang and C Sheng ldquoAn epidemicmodel of computer worms with time delay and variable infec-tion raterdquo Security and Communication Networks vol 2018Article ID 9756982 11 pages 2018

[21] L Liu R K L Ko G Ren and X Xu ldquoMalware propagationand prevention model for time-varying community networkswithin software defined networksrdquo Security and Communica-tion Networks vol 2017 Article ID 2910310 8 pages 2017

[22] C C Zou D Towsley and W B Gong ldquoModeling andsimulation study of the propagation and defense of internete-mail wormsrdquo IEEE Transactions on Dependable and SecureComputing vol 4 no 2 pp 105ndash118 2007

[23] C Li R van de Bovenkamp and P VanMieghem ldquoSusceptible-infected-susceptiblemodel A comparison of n-intertwined andheterogeneous mean-field approximationsrdquo Physical Review Evol 86 no 3 p 026116 2012

[24] W K Chai and G Pavlou ldquoPath-Based Epidemic Spreading inNetworksrdquo IEEEACM Transactions on Networking vol 25 no1 pp 565ndash578 2017

[25] J Kim andM Hastak ldquoSocial network analysis Characteristicsof online social networks after a disasterrdquo International Journalof Information Management vol 38 no 1 pp 86ndash96 2018

[26] L A Meyers M E Newman and B Pourbohloul ldquoPredictingepidemics on directed contact networksrdquo Journal of TheoreticalBiology vol 240 no 3 pp 400ndash418 2006

[27] C Li H Wang and P Van Mieghem ldquoEpidemic threshold indirected networksrdquoPhysical Review E Statistical Nonlinear andSoft Matter Physics vol 88 no 6 p 062802 2013

[28] A Khanafer T Basar and B Gharesifard ldquoStability of epidemicmodels over directed graphs a positive systems approachrdquoAutomatica vol 74 pp 126ndash134 2016

[29] A Lyapunov ldquoThe general problem of the stability of motionrdquoInternational Journal of Control vol 55 no 3 pp 531ndash534 1992English Translation

[30] M J Keeling ldquoThe effects of local spatial structure on epidemi-ological invasionsrdquo Proceedings of the Royal Society of London BBiological Sciences vol 266 no 1421 pp 859ndash867 1999

[31] K J Sharkey C Fernandez K L Morgan et al ldquoPair-levelapproximations to the spatio-temporal dynamics of epidemicson asymmetric contact networksrdquo Journal of MathematicalBiology vol 53 no 1 pp 61ndash85 2006

[32] D K Arrowsmith and C M Place Dynamical Systems Dif-ferential Equations Maps and Chaotic Behaviour Chapman ampHall London UK 1992

[33] L Ahrenberg ldquoNepidemixrdquo httpnepidemixirmacssfuca

4 Security and Communication Networks

d [119868119878]119894119895d119905 = minus120574 [119868119878]119894119895 + 120574 [119868119868]119894119895 minus 120573 [119868119878]119894119895 + sum

119896

120573 [119868119878119878]119896119894119895minus sum119896

120573 [119868119878119868]1015840119894119895119896 (3e)

d [119868119868]119894119895d119905 = minus2120574 [119868119868]119894119895 + 120573 [119868119878]119894119895 + sum

119896

120573 [119868119878119868]119896119894119895+ sum119896

120573 [119868119878119868]1015840119894119895119896 (3f)

Here (3a) and (3b) give the changing rate of susceptibleand infected 119866119894-nodes The RHS is because an infected 119866119894-node can be cured with the rate 120574 a susceptible 119866119894-nodecan be infected with the rate 120573 per edge by an infected 119866119895neighbor In the continuous-time model the time slot isinfinitesimal that the infection rate can be summed togetherie sum119895 120573[119868119878]119895119894

Equations (3c)-(3f) capture the time-varying number oflinks The first two terms on the RHS of (3c) are becausean 119878119878119894119895 edge can transfer from an 119878119868119894119895 or 119868119878119894119895 edge when theinfected node is cured The last two terms on the RHS of (3c)capture the cases where the starting 119866119894-node or the ending119866119895-node is infected by its infected neighbors (3d) is becausean 119878119868119894119895 edge can transfer to an 119878119878119894119895 edge in the case that theinfected 119866119895-node is cured at the rate 120574 and to 119868119868119894119895 in thecase that the susceptible 119866119894-node is infected by its infectedneighbors 119878119868119894119895 can transfer from 119868119868119894119895 in the case that theinfected 119866119894-node is cured with the rate 120574 or from 119878119878119894119895 in thecase that the susceptible 119866119895-node is infected by its infectedneighbors Different from previous SIS models in undirectednetworks eg [15] 119878119868119894119895 cannot transfer to 119868119868119894119895 as the epidemiccan only propagate along directed edges Equation (3e) canbe similarly obtained attaching the infection process ieminus120573[119868119878]119894119895 Equation (3f) is self-explanatory

Known as the disease-free equilibrium point the equi-librium point of interest is ([119878119868]119894119895 [119868119878]119894119895 [119868119868]119894119895) = (0 0 0)ie all nodes are susceptible The condition of the disease-free equilibrium point can be deduced by linearizing theSIS model given by (3a)ndash(3f) This is because the stabilityof the original nonlinear system can be determined by theeigenvalues of the linearized model as stated in LyapunovrsquosFirst Method [29]

To linearize the SIS model the number of edge pairs[119860119861119862]119894119895119896 and [119860119861119862]1015840119894119895119896 is first estimated by using the numberof unpaired edges This is achieved by applying the momentclosure approximation as evaluated in [30 31] As a result wehave

[119868119878119878]119896119894119895 = [119868119878]119896119894 [119878119878]119894119895[119878]119894 = [119868119878]119896119894 [119878119878]119894119895119873119894 minus ([119868119878]119894119901 + [119868119868]119894119901) 119886119894119901 (4a)

[119878119878119868]1015840119894119895119896 = [119868119878]119896119895 [119878119878]119894119895[119878]119895 = [119868119878]119896119895 [119878119878]119894119895119873119895 minus ([119868119878]119895119902 + [119868119868]119895119902) 119886119895119902 (4b)

[119868119878119868]119896119894119895 = [119868119878]119896119894 [119878119868]119894119895[119878]119894 = [119868119878]119896119894 [119878119868]119894119895119873119894 minus ([119868119878]119894119901 + [119868119868]119894119901) 119886119894119901 (4c)

[119868119878119868]1015840119894119895119896 = [119868119878]119894119895 [119868119878]119896119895[119878]119895 = [119868119878]119894119895 [119868119878]119896119895119873119895 minus ([119868119878]119895119902 + [119868119868]119895119902) 119886119895119902 (4d)

In (4a) every susceptible 119866119894-node on average has [119878119878]119894119895[119878]119894edges pointing to119866119895-nodes [119878]119894 is then estimated by employ-ing (2e) where 119901 and 119902 are introduced to solve the equationHere 119901 satisfies [119868119878]119894119901 + [119868119868]119894119901 gt 0 and 119886119894119901 gt 0 119902 satisfies[119868119878]119895119902 + [119868119868]119895119902 gt 0 and 119886119895119902 gt 0 (4b)-(4d) can be similarlyobtained

By substituting (4a)ndash(4d) into (3a)ndash(3f) (3c)-(3f) can berewritten as

d [119878119878]119894119895d119905 = 120574 [119878119868]119894119895 + 120574 [119868119878]119894119895

minus sum119896

120573 [119868119878]119896119894 [119878119878]119894119895119873119894 minus ([119868119878]119894119901 + [119868119868]119894119901) 119886119894119901

minus sum119896

120573[119868119878]119896119895 [119878119878]119894119895[119878]119895 (5a)

d [119878119868]119894119895d119905 = minus120574 [119878119868]119894119895 + 120574 [119868119868]119894119895

+ sum119896

120573 [119868119878]119896119895 [119878119878]119894119895119873119895 minus ([119868119878]119895119902 + [119868119868]119895119902) 119886119895119902

minus sum119896

120573 [119868119878]119896119894 [119878119868]119894119895119873119894 minus ([119868119878]119894119901 + [119868119868]119894119901) 119886119894119901

(5b)

d [119868119878]119894119895d119905 = minus120574 [119868119878]119894119895 + 120574 [119868119868]119894119895 minus 120573 [119868119878]119894119895

+ sum119896

120573 [119868119878]119896119894 [119878119878]119894119895119873119894 minus ([119868119878]119894119901 + [119868119868]119894119901) 119886119894119901

minus sum119896

120573 [119868119878]119894119895 [119868119878]119896119895119873119895 minus ([119868119878]119895119902 + [119868119868]119895119902) 119886119895119902

(5c)

d [119868119868]119894119895d119905 = minus2120574 [119868119868]119894119895 + 120573 [119868119878]119894119895

+ sum119896

120573 [119868119878]119896119894 [119878119868]119894119895119873119894 minus ([119868119878]119894119901 + [119868119868]119894119901) 119886119894119901

+ sum119896

120573 [119868119878]119894119895 [119868119878]119896119895119873119895 minus ([119868119878]119895119902 + [119868119868]119895119902) 119886119895119902

(5d)

The terms of [119878119878]119894119895 can be suppressed by substituting (2b) into(5a)ndash(5d) As a result we have

d [119878119868]119894119895d119905= minus120574 [119878119868]119894119895 + 120574 [119868119868]119894119895

+ sum119896

120573[119868119878]119896119895 (119886119894119895119873119894 minus [119878119868]119894119895 minus [119868119878]119894119895 minus [119868119868]119894119895)119873119895 minus (1119886119895119902) ([119868119878]119895119902 + [119868119868]119895119902)

minus sum119896

120573 [119868119878]119896119894 [119878119868]119894119895119873119894 minus (1119886119894119901) ([119868119878]119894119901 + [119868119868]119894119901)

(6a)

Security and Communication Networks 5

d [119868119878]119894119895d119905= minus120574 [119868119878]119894119895 + 120574 [119868119868]119894119895 minus 120573119894119895 [119868119878]119894119895

+ sum119896

120573[119868119878]119896119894 (119886119894119895119873119894 minus [119878119868]119894119895 minus [119868119878]119894119895 minus [119868119868]119894119895)119873119894 minus (1119886119894119901) ([119868119878]119894119901 + [119868119868]119894119901)

minus sum119896

120573 [119868119878]119894119895 [119868119878]119896119895119873119895 minus (1119886119895119902) ([119868119878]119895119902 + [119868119868]119895119902)

(6b)

d [119868119868]119894119895d119905= minus2120574 [119868119868]119894119895 + 120573 [119868119878]119894119895

+ sum119896

120573 [119868119878]119896119894 [119878119868]119894119895119873119894 minus (1119886119894119901) ([119868119878]119894119901 + [119868119868]119894119901)

+ sum119896

120573 [119868119878]119894119895 [119868119878]119896119895119873119895 minus (1119886119895119902) ([119868119878]119895119902 + [119868119868]119895119902)

(6c)

Near the disease-free equilibrium point (6a)ndash(6c) can belinearized by suppressing all higher order terms As a resultwe have

d [119878119868]119894119895d119905 asymp minus120574 [119878119868]119894119895 + 120574 [119868119868]119894119895 + sum

119896

120573119886119894119895119873119894 [119868119878]119896119895119873119895 (7a)

d [119868119878]119894119895d119905 asymp minus (120574 + 120573) [119868119878]119894119895 + 120574 [119868119868]119894119895 + sum

119896

120573119886119894119895 [119868119878]119896119894 (7b)

d [119868119868]119894119895d119905 asymp minus2120574 [119868119868]119894119895 + 120573 [119868119878]119894119895 (7c)

After the model has been linearized the condition of thedisease-free equilibriumpoint can be obtained by performingeigenvalue analysis on the Jacobian matrix of the lineariza-tionThe Jacobianmatrix is a 31198992times31198992matrix and denoted byJ The nonlinear dynamic system is stable at the equilibriumpoint if and only if all the eigenvalues of the Jacobian matrixare negative as stated by the Hartman-Grobman Theorem[32] In other words the epidemic is certainly extinct if

1205821 (J) lt 0 (8)

where 1205821(sdot) is the largest eigenvalue of the operator J is theJacobian matrix of (7a)ndash(7c) and can be given by

J = [[[J11 J12 J13

J21 J22 J23

J31 J32 J33]]]

= [ J11 J12 J130 Jlowast ] (9)

where J11 is an 1198992times1198992 diagonal matrix whose diagonal entriesare minus120574 We note that J21 and J31 are zero matrices As a resultJ is an upper block triangular matrix and

120582 (J) = 120582 (J11) cup 120582 (Jlowast) (10)

where 120582(sdot) is the set of eigenvalues of the operator

Here J23 J32 and J33 are 1198992 times 1198992 diagonal matrices Theirdiagonal entries are 120574 120573 and minus2120574 respectively The entry inthe (119899(119894minus1)+119895)-th row (119899(119896minus1)+119897)-th column of J22 denotedby 11986922119894119895119896119897 is given by

11986922119894119895119896119897 =

119886119894119895120573 minus (120574 + 120573) if 119894119895 = 119896119897 119894 = 119897minus (120574 + 120573) if 119894119895 = 119896119897 119894 = 119897119886119894119895120573 if 119894119895 = 119896119897 119894 = 1198970 if 119894119895 = 119896119897 119894 = 119897

(11)

By employing the Schur complement ie

[J22 J23

J32 J33][[

I 0

minus (J33)minus1 J32 I]]

= [H J23

0 J33] (12)

we have 120582(Jlowast) = 120582(J33) cup 120582(H) where H = J22 minus J23J33minus1

J32The entry in the (119899(119894 minus 1) + 119895)-th row (119899(119896 minus 1) + 119897)-th columnofH denoted by119867119894119895119896119897 is given by

119867119894119895119896119897 =

119886119894119895120573 minus (120574 + 1205732) if 119894119895 = 119896119897 119894 = 119897minus (120574 + 1205732) if 119894119895 = 119896119897 119894 = 119897119886119894119895120573 if 119894119895 = 119896119897 119894 = 1198970 if 119894119895 = 119896119897 119894 = 119897

(13)

We conclude that 120582(J) = 120582(J11) cup 120582(J33) cup 120582(H) Note thatJ11 and J33 are diagonal matrices and all the diagonal entriesof them are negative ie all the eigenvalues of J11 and J33 arenegative As a result we have

1205821 (J) lt 0 lArrrArr 1205821 (H) lt 0 (14)

The matrixH can be written as

H = P +Q (15)

where Q is a diagonal matrix and can be given by Q =diag[minus(120574 + 1205732)] The entry in the (119899(119894 minus 1) + 119895)-th row(119899(119896 minus 1) + 119897)-th column of P denoted by 119875119894119895119896119897 is given by

119875119894119895119896119897 = 119886119894119895120573 if 119894 = 1198970 otherwise (16)

We have that all the eigenvalues ofQ are minus(120574 + 1205732) and120582 (H) = 120582 (P) minus (120574 + 1205732) (17)

Note that P is a 1198992 times 1198992 sparse matrix and similar with ablock matrix consisting of 120573A and zero matrices as given by

P = Xminus1 [ 120573A 00 0 ]X (18)

6 Security and Communication Networks

This is achieved by performing matrix operations on P Thusthe eigenvalues of P can be given by

120582 (P) = 120573 times 120582 (A) cup 0 (19)

Combining (8) (14) (17) and (19) the epidemic willbecome extinct if 1205731205821(A) minus (120574 + 1205732) lt 0 In other wordsthe epidemic threshold denoted by 120591lowast is given by

120591lowast = 11205821 (A) minus 12 (20)

The epidemic dies out if 120591 = 120573120574 lt 120591lowast5 Simulation and Numerical Results

In this section numerical and simulation results are pre-sented to validate the proposed group-based SIS modeland the deduced epidemic threshold In every run of thesimulations the groups and the network topology ie thescale and structure are first set up according to the rulesspecified in Section 3 ie 119886119894119895 number of directed edges areadded from a 119866119894-node to 119886119894119895 number of randomly selected119866119895-nodes The nodes do not connect themselves despite119886119894119894 ge 0 Then the infection rate 120573 and the curing rate 120574 areconfigured based on the analytical epidemic threshold 120591lowastThe simulations are carried out on theNepidemiX [33] whichis a Python library implementing simulations of epidemicsFor initialization randomly selected 10 of the nodes areinfected During a simulation run the infected nodes canbe cured at the rate of 120574 Every infected node can infect itsneighbors connected by edges at the rate of 120573 Every dotin the figures is the average of 100 independent runs underthe same configurations including the network topology thepercentage of initially infected nodes 120573 and 120574

We first validate our model on a 1000-node networkwhere nodes connect each other and form a complete graphThe infection and curing rates are set to be 120573 = 00005 and120574 = 01 per time slot 120591 = 120573120574 = 0005 is set to be larger than120591lowast = 0001 to evaluate the proposed model Ten percent ofnodes are randomly chosen to be infected at 119905 = 0 Figure 3plots the infection density given bysum[119868]119894119873 from 119905 = 0 to 30The analytical results are numerically evaluated by employing(6a)ndash(6c) with the nodes evenly divided into 1 2 5 10 25 and50 groups respectively

From Figure 3 we can see that the analytical resultscan asymptotically approach the simulation results with theincreasing number of groups eg from 119899 = 1 to 119899 = 50 Thesimulation results can outgrow the analytical results whenthe number of node groups is small The analytical resultsunder a single group of nodes ie 119899 = 1 can substantiallyunderestimate the infection density The analytical result isonly 838 (06708) of the simulation result when 119905 = 30 Incontrast the analytical results under 50 groups of nodes iewhen 119899 = 50 match the simulation results indistinguishablyThis is because the proposed model is designed to decouplethe state transitions of edges connecting nodes from differentgroups and estimate the number of edges connecting infectednodes and subsequently the population of infected nodesThe

Simulation resultsAnalytical results

Analytical results with

from bottom to topn=1 2 5 10 25 50

5 10 15 20 25 300t

01

02

03

04

05

06

07

08

09

Infe

ctio

n de

nsity

Figure 3 The growth of infection density where a complete graphwith 1000 nodes is considered 120573 = 00005 and 120574 = 01 Theanalytical results are obtained based on (6a)ndash(6c) by evenly dividingthe nodes into 1 2 5 10 25 and 50 groups

mean-field approximation is applied to model the interplaybetween the averaged ratios of infectious edges connectingdifferent pairs of node groups With an increasing number ofnode groups the averaged ratio of infectious edges connect-ing a specific pair of node groups can become increasinglyrepresentative with a reducing deviation In other words theaveraged ratio becomes increasingly precise for a reducing setof edges In the special case where every node forms a group(ie the number of groups is 119899 = 1000) the ratio is exactlythe probability at which an edge is infectious The proposedmodel is able to capture the state transition of an edge underthe averaged effect of all other individual edges and can befairly accurate given the large number of edges Note that thenumber of groups eg 119899 = 50 is far less than the networksize ie 1000 This finding allows us to model the epidemicpropagation with a small number of differential equationsFigure 3 also shows that the analytical results can be accurateat the initial stage (or low infection densities) even with fewnode groups This is because the state transitions of differentedges are loosely coupled if only very few nodes are infected

We proceed to evaluate the model accuracy with differentinfection densities This is done by adjusting the infectionrate A 1000-node network is considered where nodes con-nect each other and form a complete graph The epidemicpropagationwith four effective spreading rates ie 120591 = 120573120574 =0002 00015 00011 and 0001 are simulated and analyzedThe values of 120591 are larger than and close to the analyticalthreshold The infection rates are obtained by adjusting 120573while setting 120574 to 01 The analysis is based on (6a)ndash(6c)by evenly dividing the nodes into 5 groups to explore theapplicability of the model to a small number of groups

Security and Communication Networks 7

Analytical resultsSimulation results

=0001

=0002

=00015

=00011

5 10 15 20 25 30 35 400t

005

01

015

02

025

03

035

04

045

05

Infe

ctio

n de

nsity

Figure 4 The infection density with the growth of time wherea complete graph with 1000 nodes is considered The analyticalresults are obtained based on (6a)ndash(6c) by evenly dividing the nodesinto 5 groups where 120591 = 120573120574 = 0002 00015 00011 and 0001respectively

From Figure 4 we can see that the simulation results stillovertake the analytical results when 120591 = 00015 and 0002For example the simulation result is 0459 in the case of119905 = 40 and 120591 = 0002 while the analytical result is only 0418However the gap between simulation results and analyticalresults decreases with dropping 120591 ie from 120591 = 0002 to00015When 120591 further declines ie 120591 = 00011 and 0001 theanalytical results are able tomatch the simulation results fromthe beginning to the end According to (20) the epidemicthreshold is given by 120591lowast = 0001 This figure reveals that theproposed mean-field model is asymptotically accurate witha decreasing 120591 and is able to precisely describe the epidemicpropagation when the effective spreading rate is around theepidemic threshold

We evaluate the epidemic threshold 120591lowast given by (20) inFigure 5 Three networks with 500 nodes are consideredwhere nodes are divided into three groups (ie N =[100 200 200]) The impact of the network topology on thethreshold is evaluated by varying the number of edges in thenetworkWithout loss of generality their collapsed adjacencymatrixA is set to

A = 120572[[[10 20 2010 20 2010 20 20

]]] (21)

where 120572 = 4 6 or 8 The curing rate 120574 is set to be 01 Tenpercent of nodes are randomly selected to be infected at theinitial state The infection density at 119905 = 1000 is used as thestable infection density as indicated by the 119910-axis Evaluatedwith (20) the epidemic threshold is 120591lowast= 0005 00033 and00025 when 120572= 4 6 and 8 respectively We can see from

times10 -3

= 8

= 6

= 4

2 3 4 5 6 7 8 9 101

0

01

02

03

04

05

06

07

08

Infe

ctio

n de

nsity

Simulation resultslowast

Figure 5The validation of epidemic threshold given by (20) wherethe 119910-axis is the infection density at 119905 = 1000 Three networks with500 nodes are considered 120574 is set to be 01 120572 = 4 6 8 is used toadjust the number of edges

Figure 5 that 120591lowast (the solid vertical lines) can precisely specifythe epidemic thresholds When 120591 lt 120591lowast the epidemic can besuppressed eventually When 120591 gt 120591lowast the infection densitygrows with 120591 and also exhibits convexity We can see thatthe network topology has a strong impact on the epidemicthreshold and the infection density Specifically the thresholddecreases with the growth of 120572 For example 120591 halves from0005 to 00025 when 120572 doubles from 4 to 8 (the number ofedges doubles as well) The infection density increases withthe growth of120572 especially around the threshold For examplein the case of 120572 = 8 and 120591 = 0005 the infection density is 05as compared to the infection density of 120572 = 4

We note that the epidemic threshold given by (20) isdetermined by the network structure A rather than thenumber of nodes given by N To illustrate this we comparethe number of infected populations in different scales ofnetworks illustrated by Figure 6 To be specific N = 120575 times[10 20 20] where 120575 = 2 4 and 6 respectively Theircollapsed adjacencymatrices are obtained with (21) by letting120572 = 1 As a result 120591lowast = 002 Figure 6 firstly confirmsthe accuracy of 120591lowast illustrated by the solid vertical line Theobservation that the three networks with the same structurebut different scales share the same epidemic threshold val-idates that the epidemic threshold depends on the networkstructure rather than the scale This finding can significantlyreduce the complexity to deduce the epidemic thresholdie from decomposing an 119873-dimensional matrix by using11205821(A) given by [12] to decomposing an 119899 dimensionalmatrix (119899 ≪ 119873) For example 119873 = 1000 and 119899 = 5in Figure 4 and 119873 = 500 and 119899 = 3 in Figure 5 It isinteresting to notice that the infection densities are the sameeg 796100 asymp 1588200 asymp 240300 in the case of 120591 = 01

8 Security and Communication Networks

Simulation results

= 6

= 4

= 2

lowast

002 004 006 008 010

0

50

100

150

200

250

[I] infin

Figure 6 The validation of epidemic threshold where the 119910-axisis the infected population at 119905 = 1000 Different scales of networks(119873=100 200 and 300 respectively) are considered 120574 is set to be 01

although the infected population varies in different scalesof networks This can be the reason of that the epidemicthreshold depends on the network structure rather than thenetwork scale

6 Conclusion

In this paper we designed a continuous-time SIS model inlarge-scale networks By categorizing nodes into groups themodel complexity was significantly reduced The proposedepidemic model was validated to be asymptotically accuratewith the decrease of the effective spreading rate andorthe increase of node groups The epidemic threshold canbe deduced with the largest eigenvalue of the collapsedadjacency matrix whose dimension is much smaller than thenetwork scale Simulation results corroborated the effective-ness of the model as well as the analytical accuracy of thethreshold in large-scale networks

Data Availability

The simulations are built on the epidemic simulation plat-form NepidemiX

Conflicts of Interest

The authors declare that they have no conflicts of interest

Acknowledgments

This work was supported by the National Key RampD ProgramofChina (no 2017YFB0802703) theNationalNatural Science

Foundation of China (no 61121061) and UTS DVC-R Fund-ing Initiative for Research Strengths

References

[1] J O Kephart and S R White ldquoDirected-graph epidemiologicalmodels of computer virusesrdquo in Proceedings of the IEEE Com-puter Society Symposium on Research in Security and Privacypp 343ndash359 IEEE Oakland CA USA May 1991

[2] X Wang K Zheng X Niu B Wu and C Wu ldquoDetection ofcommand and control in advanced persistent threat based onindependent accessrdquo in Proceedings of the 2016 IEEE Interna-tional Conference on Communications ICC 2016 pp 1ndash6 IEEEKuala Lumpur Malaysia May 2016

[3] WYang YQin andY Yang ldquoAnalysis ofmalicious flows via SISepidemicmodel in CCNrdquo in Proceedings of the IEEE INFOCOM2018 - IEEE Conference on Computer Communications Work-shops (INFOCOMWKSHPS) pp 748ndash753 IEEE Honolulu HIUSA April 2018

[4] Z Kong and E M Yeh ldquoResilience to degree-dependentand cascading node failures in random geometric networksrdquoInstitute of Electrical and Electronics Engineers Transactions onInformation Theory vol 56 no 11 pp 5533ndash5546 2010

[5] R M Anderson Infectious Diseases of Humans Dynamics AndControl vol 28 Wiley Online Library 1992

[6] X Wang X Zha G Yu et al ldquoAttack and defence of ethereumremote apisrdquo in Proceedings of the IEEE Globecom Workshops(GCWkshpsrsquo18) IEEE Abu Dhabi UAE 2018

[7] X Wang W Ni K Zheng R P Liu and X Niu ldquoVirusPropagation Modeling and Convergence Analysis in Large-Scale Networksrdquo IEEE Transactions on Information Forensicsand Security vol 11 no 10 pp 2241ndash2254 2016

[8] P Van Mieghem J Omic and R Kooij ldquoVirus spread innetworksrdquo IEEEACM Transactions on Networking vol 17 no1 pp 1ndash14 2009

[9] Y Wang D Chakrabarti C Wang and C Faloutsos ldquoEpi-demic spreading in real networks an eigenvalue viewpointrdquoin Proceedings of the 22nd International Symposium on ReliableDistributed Systems (SRDS rsquo03) pp 25ndash34 IEEE Florence ItalyOctober 2003

[10] L P Kadanoff ldquoMore is the same phase transitions and meanfield theoriesrdquo Journal of Statistical Physics vol 137 no 5 pp777ndash797 2009

[11] A Ganesh L Massoulie and D Towsley ldquoThe effect of networktopology on the spread of epidemicsrdquo in Proceedings of theProceedings IEEE 24th Annual Joint Conference of the IEEEComputer and Communications Societies vol 2 pp 1455ndash1466IEEE Miami FL USA 2005

[12] P Van Mieghem and R Van De Bovenkamp ldquoNon-Markovianinfection spread dramatically alters the susceptible-infected-susceptible epidemic threshold in networksrdquo Physical ReviewLetters vol 110 no 10 Article ID 108701 2013

[13] A Barabasi and E Bonabeau ldquoScale-Free Networksrdquo ScientificAmerican vol 288 no 5 pp 60ndash69 2003

[14] R Pastor-Satorras C Castellano P Van Mieghem andA Vespignani ldquoEpidemic processes in complex networksrdquoReviews of Modern Physics vol 87 no 3 pp 925ndash979 2015

[15] R Pastor-Satorras and A Vespignani ldquoEpidemic spreading inscale-free networksrdquo Physical Review Letters vol 86 no 14 pp3200ndash3203 2001

Security and Communication Networks 9

[16] H Kang and X Fu ldquoEpidemic spreading and global stability ofan SIS model with an infective vector on complex networksrdquoCommunications in Nonlinear Science amp Numerical Simulationvol 27 no 1ndash3 pp 30ndash39 2015

[17] T Li X Liu J Wu C Wan Z-H Guan and Y Wang ldquoAnepidemic spreadingmodel on adaptive scale-free networks withfeedback mechanismrdquo Physica A Statistical Mechanics and itsApplications vol 450 pp 649ndash656 2016

[18] J O Kephart and S R White ldquoMeasuring and modeling com-puter virus prevalencerdquo in Proceedings of the IEEE ComputerSociety Symposium onResearch in Security and Privacy pp 2ndash15IEEE Oakland Calif USA May 1993

[19] MVojnovic andA J Ganesh ldquoOn the race ofworms alerts andpatchesrdquo IEEEACM Transactions on Networking vol 16 no 5pp 1066ndash1079 2008

[20] Y Yao Q Fu W Yang Y Wang and C Sheng ldquoAn epidemicmodel of computer worms with time delay and variable infec-tion raterdquo Security and Communication Networks vol 2018Article ID 9756982 11 pages 2018

[21] L Liu R K L Ko G Ren and X Xu ldquoMalware propagationand prevention model for time-varying community networkswithin software defined networksrdquo Security and Communica-tion Networks vol 2017 Article ID 2910310 8 pages 2017

[22] C C Zou D Towsley and W B Gong ldquoModeling andsimulation study of the propagation and defense of internete-mail wormsrdquo IEEE Transactions on Dependable and SecureComputing vol 4 no 2 pp 105ndash118 2007

[23] C Li R van de Bovenkamp and P VanMieghem ldquoSusceptible-infected-susceptiblemodel A comparison of n-intertwined andheterogeneous mean-field approximationsrdquo Physical Review Evol 86 no 3 p 026116 2012

[24] W K Chai and G Pavlou ldquoPath-Based Epidemic Spreading inNetworksrdquo IEEEACM Transactions on Networking vol 25 no1 pp 565ndash578 2017

[25] J Kim andM Hastak ldquoSocial network analysis Characteristicsof online social networks after a disasterrdquo International Journalof Information Management vol 38 no 1 pp 86ndash96 2018

[26] L A Meyers M E Newman and B Pourbohloul ldquoPredictingepidemics on directed contact networksrdquo Journal of TheoreticalBiology vol 240 no 3 pp 400ndash418 2006

[27] C Li H Wang and P Van Mieghem ldquoEpidemic threshold indirected networksrdquoPhysical Review E Statistical Nonlinear andSoft Matter Physics vol 88 no 6 p 062802 2013

[28] A Khanafer T Basar and B Gharesifard ldquoStability of epidemicmodels over directed graphs a positive systems approachrdquoAutomatica vol 74 pp 126ndash134 2016

[29] A Lyapunov ldquoThe general problem of the stability of motionrdquoInternational Journal of Control vol 55 no 3 pp 531ndash534 1992English Translation

[30] M J Keeling ldquoThe effects of local spatial structure on epidemi-ological invasionsrdquo Proceedings of the Royal Society of London BBiological Sciences vol 266 no 1421 pp 859ndash867 1999

[31] K J Sharkey C Fernandez K L Morgan et al ldquoPair-levelapproximations to the spatio-temporal dynamics of epidemicson asymmetric contact networksrdquo Journal of MathematicalBiology vol 53 no 1 pp 61ndash85 2006

[32] D K Arrowsmith and C M Place Dynamical Systems Dif-ferential Equations Maps and Chaotic Behaviour Chapman ampHall London UK 1992

[33] L Ahrenberg ldquoNepidemixrdquo httpnepidemixirmacssfuca

Security and Communication Networks 5

d [119868119878]119894119895d119905= minus120574 [119868119878]119894119895 + 120574 [119868119868]119894119895 minus 120573119894119895 [119868119878]119894119895

+ sum119896

120573[119868119878]119896119894 (119886119894119895119873119894 minus [119878119868]119894119895 minus [119868119878]119894119895 minus [119868119868]119894119895)119873119894 minus (1119886119894119901) ([119868119878]119894119901 + [119868119868]119894119901)

minus sum119896

120573 [119868119878]119894119895 [119868119878]119896119895119873119895 minus (1119886119895119902) ([119868119878]119895119902 + [119868119868]119895119902)

(6b)

d [119868119868]119894119895d119905= minus2120574 [119868119868]119894119895 + 120573 [119868119878]119894119895

+ sum119896

120573 [119868119878]119896119894 [119878119868]119894119895119873119894 minus (1119886119894119901) ([119868119878]119894119901 + [119868119868]119894119901)

+ sum119896

120573 [119868119878]119894119895 [119868119878]119896119895119873119895 minus (1119886119895119902) ([119868119878]119895119902 + [119868119868]119895119902)

(6c)

Near the disease-free equilibrium point (6a)ndash(6c) can belinearized by suppressing all higher order terms As a resultwe have

d [119878119868]119894119895d119905 asymp minus120574 [119878119868]119894119895 + 120574 [119868119868]119894119895 + sum

119896

120573119886119894119895119873119894 [119868119878]119896119895119873119895 (7a)

d [119868119878]119894119895d119905 asymp minus (120574 + 120573) [119868119878]119894119895 + 120574 [119868119868]119894119895 + sum

119896

120573119886119894119895 [119868119878]119896119894 (7b)

d [119868119868]119894119895d119905 asymp minus2120574 [119868119868]119894119895 + 120573 [119868119878]119894119895 (7c)

After the model has been linearized the condition of thedisease-free equilibriumpoint can be obtained by performingeigenvalue analysis on the Jacobian matrix of the lineariza-tionThe Jacobianmatrix is a 31198992times31198992matrix and denoted byJ The nonlinear dynamic system is stable at the equilibriumpoint if and only if all the eigenvalues of the Jacobian matrixare negative as stated by the Hartman-Grobman Theorem[32] In other words the epidemic is certainly extinct if

1205821 (J) lt 0 (8)

where 1205821(sdot) is the largest eigenvalue of the operator J is theJacobian matrix of (7a)ndash(7c) and can be given by

J = [[[J11 J12 J13

J21 J22 J23

J31 J32 J33]]]

= [ J11 J12 J130 Jlowast ] (9)

where J11 is an 1198992times1198992 diagonal matrix whose diagonal entriesare minus120574 We note that J21 and J31 are zero matrices As a resultJ is an upper block triangular matrix and

120582 (J) = 120582 (J11) cup 120582 (Jlowast) (10)

where 120582(sdot) is the set of eigenvalues of the operator

Here J23 J32 and J33 are 1198992 times 1198992 diagonal matrices Theirdiagonal entries are 120574 120573 and minus2120574 respectively The entry inthe (119899(119894minus1)+119895)-th row (119899(119896minus1)+119897)-th column of J22 denotedby 11986922119894119895119896119897 is given by

11986922119894119895119896119897 =

119886119894119895120573 minus (120574 + 120573) if 119894119895 = 119896119897 119894 = 119897minus (120574 + 120573) if 119894119895 = 119896119897 119894 = 119897119886119894119895120573 if 119894119895 = 119896119897 119894 = 1198970 if 119894119895 = 119896119897 119894 = 119897

(11)

By employing the Schur complement ie

[J22 J23

J32 J33][[

I 0

minus (J33)minus1 J32 I]]

= [H J23

0 J33] (12)

we have 120582(Jlowast) = 120582(J33) cup 120582(H) where H = J22 minus J23J33minus1

J32The entry in the (119899(119894 minus 1) + 119895)-th row (119899(119896 minus 1) + 119897)-th columnofH denoted by119867119894119895119896119897 is given by

119867119894119895119896119897 =

119886119894119895120573 minus (120574 + 1205732) if 119894119895 = 119896119897 119894 = 119897minus (120574 + 1205732) if 119894119895 = 119896119897 119894 = 119897119886119894119895120573 if 119894119895 = 119896119897 119894 = 1198970 if 119894119895 = 119896119897 119894 = 119897

(13)

We conclude that 120582(J) = 120582(J11) cup 120582(J33) cup 120582(H) Note thatJ11 and J33 are diagonal matrices and all the diagonal entriesof them are negative ie all the eigenvalues of J11 and J33 arenegative As a result we have

1205821 (J) lt 0 lArrrArr 1205821 (H) lt 0 (14)

The matrixH can be written as

H = P +Q (15)

where Q is a diagonal matrix and can be given by Q =diag[minus(120574 + 1205732)] The entry in the (119899(119894 minus 1) + 119895)-th row(119899(119896 minus 1) + 119897)-th column of P denoted by 119875119894119895119896119897 is given by

119875119894119895119896119897 = 119886119894119895120573 if 119894 = 1198970 otherwise (16)

We have that all the eigenvalues ofQ are minus(120574 + 1205732) and120582 (H) = 120582 (P) minus (120574 + 1205732) (17)

Note that P is a 1198992 times 1198992 sparse matrix and similar with ablock matrix consisting of 120573A and zero matrices as given by

P = Xminus1 [ 120573A 00 0 ]X (18)

6 Security and Communication Networks

This is achieved by performing matrix operations on P Thusthe eigenvalues of P can be given by

120582 (P) = 120573 times 120582 (A) cup 0 (19)

Combining (8) (14) (17) and (19) the epidemic willbecome extinct if 1205731205821(A) minus (120574 + 1205732) lt 0 In other wordsthe epidemic threshold denoted by 120591lowast is given by

120591lowast = 11205821 (A) minus 12 (20)

The epidemic dies out if 120591 = 120573120574 lt 120591lowast5 Simulation and Numerical Results

In this section numerical and simulation results are pre-sented to validate the proposed group-based SIS modeland the deduced epidemic threshold In every run of thesimulations the groups and the network topology ie thescale and structure are first set up according to the rulesspecified in Section 3 ie 119886119894119895 number of directed edges areadded from a 119866119894-node to 119886119894119895 number of randomly selected119866119895-nodes The nodes do not connect themselves despite119886119894119894 ge 0 Then the infection rate 120573 and the curing rate 120574 areconfigured based on the analytical epidemic threshold 120591lowastThe simulations are carried out on theNepidemiX [33] whichis a Python library implementing simulations of epidemicsFor initialization randomly selected 10 of the nodes areinfected During a simulation run the infected nodes canbe cured at the rate of 120574 Every infected node can infect itsneighbors connected by edges at the rate of 120573 Every dotin the figures is the average of 100 independent runs underthe same configurations including the network topology thepercentage of initially infected nodes 120573 and 120574

We first validate our model on a 1000-node networkwhere nodes connect each other and form a complete graphThe infection and curing rates are set to be 120573 = 00005 and120574 = 01 per time slot 120591 = 120573120574 = 0005 is set to be larger than120591lowast = 0001 to evaluate the proposed model Ten percent ofnodes are randomly chosen to be infected at 119905 = 0 Figure 3plots the infection density given bysum[119868]119894119873 from 119905 = 0 to 30The analytical results are numerically evaluated by employing(6a)ndash(6c) with the nodes evenly divided into 1 2 5 10 25 and50 groups respectively

From Figure 3 we can see that the analytical resultscan asymptotically approach the simulation results with theincreasing number of groups eg from 119899 = 1 to 119899 = 50 Thesimulation results can outgrow the analytical results whenthe number of node groups is small The analytical resultsunder a single group of nodes ie 119899 = 1 can substantiallyunderestimate the infection density The analytical result isonly 838 (06708) of the simulation result when 119905 = 30 Incontrast the analytical results under 50 groups of nodes iewhen 119899 = 50 match the simulation results indistinguishablyThis is because the proposed model is designed to decouplethe state transitions of edges connecting nodes from differentgroups and estimate the number of edges connecting infectednodes and subsequently the population of infected nodesThe

Simulation resultsAnalytical results

Analytical results with

from bottom to topn=1 2 5 10 25 50

5 10 15 20 25 300t

01

02

03

04

05

06

07

08

09

Infe

ctio

n de

nsity

Figure 3 The growth of infection density where a complete graphwith 1000 nodes is considered 120573 = 00005 and 120574 = 01 Theanalytical results are obtained based on (6a)ndash(6c) by evenly dividingthe nodes into 1 2 5 10 25 and 50 groups

mean-field approximation is applied to model the interplaybetween the averaged ratios of infectious edges connectingdifferent pairs of node groups With an increasing number ofnode groups the averaged ratio of infectious edges connect-ing a specific pair of node groups can become increasinglyrepresentative with a reducing deviation In other words theaveraged ratio becomes increasingly precise for a reducing setof edges In the special case where every node forms a group(ie the number of groups is 119899 = 1000) the ratio is exactlythe probability at which an edge is infectious The proposedmodel is able to capture the state transition of an edge underthe averaged effect of all other individual edges and can befairly accurate given the large number of edges Note that thenumber of groups eg 119899 = 50 is far less than the networksize ie 1000 This finding allows us to model the epidemicpropagation with a small number of differential equationsFigure 3 also shows that the analytical results can be accurateat the initial stage (or low infection densities) even with fewnode groups This is because the state transitions of differentedges are loosely coupled if only very few nodes are infected

We proceed to evaluate the model accuracy with differentinfection densities This is done by adjusting the infectionrate A 1000-node network is considered where nodes con-nect each other and form a complete graph The epidemicpropagationwith four effective spreading rates ie 120591 = 120573120574 =0002 00015 00011 and 0001 are simulated and analyzedThe values of 120591 are larger than and close to the analyticalthreshold The infection rates are obtained by adjusting 120573while setting 120574 to 01 The analysis is based on (6a)ndash(6c)by evenly dividing the nodes into 5 groups to explore theapplicability of the model to a small number of groups

Security and Communication Networks 7

Analytical resultsSimulation results

=0001

=0002

=00015

=00011

5 10 15 20 25 30 35 400t

005

01

015

02

025

03

035

04

045

05

Infe

ctio

n de

nsity

Figure 4 The infection density with the growth of time wherea complete graph with 1000 nodes is considered The analyticalresults are obtained based on (6a)ndash(6c) by evenly dividing the nodesinto 5 groups where 120591 = 120573120574 = 0002 00015 00011 and 0001respectively

From Figure 4 we can see that the simulation results stillovertake the analytical results when 120591 = 00015 and 0002For example the simulation result is 0459 in the case of119905 = 40 and 120591 = 0002 while the analytical result is only 0418However the gap between simulation results and analyticalresults decreases with dropping 120591 ie from 120591 = 0002 to00015When 120591 further declines ie 120591 = 00011 and 0001 theanalytical results are able tomatch the simulation results fromthe beginning to the end According to (20) the epidemicthreshold is given by 120591lowast = 0001 This figure reveals that theproposed mean-field model is asymptotically accurate witha decreasing 120591 and is able to precisely describe the epidemicpropagation when the effective spreading rate is around theepidemic threshold

We evaluate the epidemic threshold 120591lowast given by (20) inFigure 5 Three networks with 500 nodes are consideredwhere nodes are divided into three groups (ie N =[100 200 200]) The impact of the network topology on thethreshold is evaluated by varying the number of edges in thenetworkWithout loss of generality their collapsed adjacencymatrixA is set to

A = 120572[[[10 20 2010 20 2010 20 20

]]] (21)

where 120572 = 4 6 or 8 The curing rate 120574 is set to be 01 Tenpercent of nodes are randomly selected to be infected at theinitial state The infection density at 119905 = 1000 is used as thestable infection density as indicated by the 119910-axis Evaluatedwith (20) the epidemic threshold is 120591lowast= 0005 00033 and00025 when 120572= 4 6 and 8 respectively We can see from

times10 -3

= 8

= 6

= 4

2 3 4 5 6 7 8 9 101

0

01

02

03

04

05

06

07

08

Infe

ctio

n de

nsity

Simulation resultslowast

Figure 5The validation of epidemic threshold given by (20) wherethe 119910-axis is the infection density at 119905 = 1000 Three networks with500 nodes are considered 120574 is set to be 01 120572 = 4 6 8 is used toadjust the number of edges

Figure 5 that 120591lowast (the solid vertical lines) can precisely specifythe epidemic thresholds When 120591 lt 120591lowast the epidemic can besuppressed eventually When 120591 gt 120591lowast the infection densitygrows with 120591 and also exhibits convexity We can see thatthe network topology has a strong impact on the epidemicthreshold and the infection density Specifically the thresholddecreases with the growth of 120572 For example 120591 halves from0005 to 00025 when 120572 doubles from 4 to 8 (the number ofedges doubles as well) The infection density increases withthe growth of120572 especially around the threshold For examplein the case of 120572 = 8 and 120591 = 0005 the infection density is 05as compared to the infection density of 120572 = 4

We note that the epidemic threshold given by (20) isdetermined by the network structure A rather than thenumber of nodes given by N To illustrate this we comparethe number of infected populations in different scales ofnetworks illustrated by Figure 6 To be specific N = 120575 times[10 20 20] where 120575 = 2 4 and 6 respectively Theircollapsed adjacencymatrices are obtained with (21) by letting120572 = 1 As a result 120591lowast = 002 Figure 6 firstly confirmsthe accuracy of 120591lowast illustrated by the solid vertical line Theobservation that the three networks with the same structurebut different scales share the same epidemic threshold val-idates that the epidemic threshold depends on the networkstructure rather than the scale This finding can significantlyreduce the complexity to deduce the epidemic thresholdie from decomposing an 119873-dimensional matrix by using11205821(A) given by [12] to decomposing an 119899 dimensionalmatrix (119899 ≪ 119873) For example 119873 = 1000 and 119899 = 5in Figure 4 and 119873 = 500 and 119899 = 3 in Figure 5 It isinteresting to notice that the infection densities are the sameeg 796100 asymp 1588200 asymp 240300 in the case of 120591 = 01

8 Security and Communication Networks

Simulation results

= 6

= 4

= 2

lowast

002 004 006 008 010

0

50

100

150

200

250

[I] infin

Figure 6 The validation of epidemic threshold where the 119910-axisis the infected population at 119905 = 1000 Different scales of networks(119873=100 200 and 300 respectively) are considered 120574 is set to be 01

although the infected population varies in different scalesof networks This can be the reason of that the epidemicthreshold depends on the network structure rather than thenetwork scale

6 Conclusion

In this paper we designed a continuous-time SIS model inlarge-scale networks By categorizing nodes into groups themodel complexity was significantly reduced The proposedepidemic model was validated to be asymptotically accuratewith the decrease of the effective spreading rate andorthe increase of node groups The epidemic threshold canbe deduced with the largest eigenvalue of the collapsedadjacency matrix whose dimension is much smaller than thenetwork scale Simulation results corroborated the effective-ness of the model as well as the analytical accuracy of thethreshold in large-scale networks

Data Availability

The simulations are built on the epidemic simulation plat-form NepidemiX

Conflicts of Interest

The authors declare that they have no conflicts of interest

Acknowledgments

This work was supported by the National Key RampD ProgramofChina (no 2017YFB0802703) theNationalNatural Science

Foundation of China (no 61121061) and UTS DVC-R Fund-ing Initiative for Research Strengths

References

[1] J O Kephart and S R White ldquoDirected-graph epidemiologicalmodels of computer virusesrdquo in Proceedings of the IEEE Com-puter Society Symposium on Research in Security and Privacypp 343ndash359 IEEE Oakland CA USA May 1991

[2] X Wang K Zheng X Niu B Wu and C Wu ldquoDetection ofcommand and control in advanced persistent threat based onindependent accessrdquo in Proceedings of the 2016 IEEE Interna-tional Conference on Communications ICC 2016 pp 1ndash6 IEEEKuala Lumpur Malaysia May 2016

[3] WYang YQin andY Yang ldquoAnalysis ofmalicious flows via SISepidemicmodel in CCNrdquo in Proceedings of the IEEE INFOCOM2018 - IEEE Conference on Computer Communications Work-shops (INFOCOMWKSHPS) pp 748ndash753 IEEE Honolulu HIUSA April 2018

[4] Z Kong and E M Yeh ldquoResilience to degree-dependentand cascading node failures in random geometric networksrdquoInstitute of Electrical and Electronics Engineers Transactions onInformation Theory vol 56 no 11 pp 5533ndash5546 2010

[5] R M Anderson Infectious Diseases of Humans Dynamics AndControl vol 28 Wiley Online Library 1992

[6] X Wang X Zha G Yu et al ldquoAttack and defence of ethereumremote apisrdquo in Proceedings of the IEEE Globecom Workshops(GCWkshpsrsquo18) IEEE Abu Dhabi UAE 2018

[7] X Wang W Ni K Zheng R P Liu and X Niu ldquoVirusPropagation Modeling and Convergence Analysis in Large-Scale Networksrdquo IEEE Transactions on Information Forensicsand Security vol 11 no 10 pp 2241ndash2254 2016

[8] P Van Mieghem J Omic and R Kooij ldquoVirus spread innetworksrdquo IEEEACM Transactions on Networking vol 17 no1 pp 1ndash14 2009

[9] Y Wang D Chakrabarti C Wang and C Faloutsos ldquoEpi-demic spreading in real networks an eigenvalue viewpointrdquoin Proceedings of the 22nd International Symposium on ReliableDistributed Systems (SRDS rsquo03) pp 25ndash34 IEEE Florence ItalyOctober 2003

[10] L P Kadanoff ldquoMore is the same phase transitions and meanfield theoriesrdquo Journal of Statistical Physics vol 137 no 5 pp777ndash797 2009

[11] A Ganesh L Massoulie and D Towsley ldquoThe effect of networktopology on the spread of epidemicsrdquo in Proceedings of theProceedings IEEE 24th Annual Joint Conference of the IEEEComputer and Communications Societies vol 2 pp 1455ndash1466IEEE Miami FL USA 2005

[12] P Van Mieghem and R Van De Bovenkamp ldquoNon-Markovianinfection spread dramatically alters the susceptible-infected-susceptible epidemic threshold in networksrdquo Physical ReviewLetters vol 110 no 10 Article ID 108701 2013

[13] A Barabasi and E Bonabeau ldquoScale-Free Networksrdquo ScientificAmerican vol 288 no 5 pp 60ndash69 2003

[14] R Pastor-Satorras C Castellano P Van Mieghem andA Vespignani ldquoEpidemic processes in complex networksrdquoReviews of Modern Physics vol 87 no 3 pp 925ndash979 2015

[15] R Pastor-Satorras and A Vespignani ldquoEpidemic spreading inscale-free networksrdquo Physical Review Letters vol 86 no 14 pp3200ndash3203 2001

Security and Communication Networks 9

[16] H Kang and X Fu ldquoEpidemic spreading and global stability ofan SIS model with an infective vector on complex networksrdquoCommunications in Nonlinear Science amp Numerical Simulationvol 27 no 1ndash3 pp 30ndash39 2015

[17] T Li X Liu J Wu C Wan Z-H Guan and Y Wang ldquoAnepidemic spreadingmodel on adaptive scale-free networks withfeedback mechanismrdquo Physica A Statistical Mechanics and itsApplications vol 450 pp 649ndash656 2016

[18] J O Kephart and S R White ldquoMeasuring and modeling com-puter virus prevalencerdquo in Proceedings of the IEEE ComputerSociety Symposium onResearch in Security and Privacy pp 2ndash15IEEE Oakland Calif USA May 1993

[19] MVojnovic andA J Ganesh ldquoOn the race ofworms alerts andpatchesrdquo IEEEACM Transactions on Networking vol 16 no 5pp 1066ndash1079 2008

[20] Y Yao Q Fu W Yang Y Wang and C Sheng ldquoAn epidemicmodel of computer worms with time delay and variable infec-tion raterdquo Security and Communication Networks vol 2018Article ID 9756982 11 pages 2018

[21] L Liu R K L Ko G Ren and X Xu ldquoMalware propagationand prevention model for time-varying community networkswithin software defined networksrdquo Security and Communica-tion Networks vol 2017 Article ID 2910310 8 pages 2017

[22] C C Zou D Towsley and W B Gong ldquoModeling andsimulation study of the propagation and defense of internete-mail wormsrdquo IEEE Transactions on Dependable and SecureComputing vol 4 no 2 pp 105ndash118 2007

[23] C Li R van de Bovenkamp and P VanMieghem ldquoSusceptible-infected-susceptiblemodel A comparison of n-intertwined andheterogeneous mean-field approximationsrdquo Physical Review Evol 86 no 3 p 026116 2012

[24] W K Chai and G Pavlou ldquoPath-Based Epidemic Spreading inNetworksrdquo IEEEACM Transactions on Networking vol 25 no1 pp 565ndash578 2017

[25] J Kim andM Hastak ldquoSocial network analysis Characteristicsof online social networks after a disasterrdquo International Journalof Information Management vol 38 no 1 pp 86ndash96 2018

[26] L A Meyers M E Newman and B Pourbohloul ldquoPredictingepidemics on directed contact networksrdquo Journal of TheoreticalBiology vol 240 no 3 pp 400ndash418 2006

[27] C Li H Wang and P Van Mieghem ldquoEpidemic threshold indirected networksrdquoPhysical Review E Statistical Nonlinear andSoft Matter Physics vol 88 no 6 p 062802 2013

[28] A Khanafer T Basar and B Gharesifard ldquoStability of epidemicmodels over directed graphs a positive systems approachrdquoAutomatica vol 74 pp 126ndash134 2016

[29] A Lyapunov ldquoThe general problem of the stability of motionrdquoInternational Journal of Control vol 55 no 3 pp 531ndash534 1992English Translation

[30] M J Keeling ldquoThe effects of local spatial structure on epidemi-ological invasionsrdquo Proceedings of the Royal Society of London BBiological Sciences vol 266 no 1421 pp 859ndash867 1999

[31] K J Sharkey C Fernandez K L Morgan et al ldquoPair-levelapproximations to the spatio-temporal dynamics of epidemicson asymmetric contact networksrdquo Journal of MathematicalBiology vol 53 no 1 pp 61ndash85 2006

[32] D K Arrowsmith and C M Place Dynamical Systems Dif-ferential Equations Maps and Chaotic Behaviour Chapman ampHall London UK 1992

[33] L Ahrenberg ldquoNepidemixrdquo httpnepidemixirmacssfuca

6 Security and Communication Networks

This is achieved by performing matrix operations on P Thusthe eigenvalues of P can be given by

120582 (P) = 120573 times 120582 (A) cup 0 (19)

Combining (8) (14) (17) and (19) the epidemic willbecome extinct if 1205731205821(A) minus (120574 + 1205732) lt 0 In other wordsthe epidemic threshold denoted by 120591lowast is given by

120591lowast = 11205821 (A) minus 12 (20)

The epidemic dies out if 120591 = 120573120574 lt 120591lowast5 Simulation and Numerical Results

In this section numerical and simulation results are pre-sented to validate the proposed group-based SIS modeland the deduced epidemic threshold In every run of thesimulations the groups and the network topology ie thescale and structure are first set up according to the rulesspecified in Section 3 ie 119886119894119895 number of directed edges areadded from a 119866119894-node to 119886119894119895 number of randomly selected119866119895-nodes The nodes do not connect themselves despite119886119894119894 ge 0 Then the infection rate 120573 and the curing rate 120574 areconfigured based on the analytical epidemic threshold 120591lowastThe simulations are carried out on theNepidemiX [33] whichis a Python library implementing simulations of epidemicsFor initialization randomly selected 10 of the nodes areinfected During a simulation run the infected nodes canbe cured at the rate of 120574 Every infected node can infect itsneighbors connected by edges at the rate of 120573 Every dotin the figures is the average of 100 independent runs underthe same configurations including the network topology thepercentage of initially infected nodes 120573 and 120574

We first validate our model on a 1000-node networkwhere nodes connect each other and form a complete graphThe infection and curing rates are set to be 120573 = 00005 and120574 = 01 per time slot 120591 = 120573120574 = 0005 is set to be larger than120591lowast = 0001 to evaluate the proposed model Ten percent ofnodes are randomly chosen to be infected at 119905 = 0 Figure 3plots the infection density given bysum[119868]119894119873 from 119905 = 0 to 30The analytical results are numerically evaluated by employing(6a)ndash(6c) with the nodes evenly divided into 1 2 5 10 25 and50 groups respectively

From Figure 3 we can see that the analytical resultscan asymptotically approach the simulation results with theincreasing number of groups eg from 119899 = 1 to 119899 = 50 Thesimulation results can outgrow the analytical results whenthe number of node groups is small The analytical resultsunder a single group of nodes ie 119899 = 1 can substantiallyunderestimate the infection density The analytical result isonly 838 (06708) of the simulation result when 119905 = 30 Incontrast the analytical results under 50 groups of nodes iewhen 119899 = 50 match the simulation results indistinguishablyThis is because the proposed model is designed to decouplethe state transitions of edges connecting nodes from differentgroups and estimate the number of edges connecting infectednodes and subsequently the population of infected nodesThe

Simulation resultsAnalytical results

Analytical results with

from bottom to topn=1 2 5 10 25 50

5 10 15 20 25 300t

01

02

03

04

05

06

07

08

09

Infe

ctio

n de

nsity

Figure 3 The growth of infection density where a complete graphwith 1000 nodes is considered 120573 = 00005 and 120574 = 01 Theanalytical results are obtained based on (6a)ndash(6c) by evenly dividingthe nodes into 1 2 5 10 25 and 50 groups

mean-field approximation is applied to model the interplaybetween the averaged ratios of infectious edges connectingdifferent pairs of node groups With an increasing number ofnode groups the averaged ratio of infectious edges connect-ing a specific pair of node groups can become increasinglyrepresentative with a reducing deviation In other words theaveraged ratio becomes increasingly precise for a reducing setof edges In the special case where every node forms a group(ie the number of groups is 119899 = 1000) the ratio is exactlythe probability at which an edge is infectious The proposedmodel is able to capture the state transition of an edge underthe averaged effect of all other individual edges and can befairly accurate given the large number of edges Note that thenumber of groups eg 119899 = 50 is far less than the networksize ie 1000 This finding allows us to model the epidemicpropagation with a small number of differential equationsFigure 3 also shows that the analytical results can be accurateat the initial stage (or low infection densities) even with fewnode groups This is because the state transitions of differentedges are loosely coupled if only very few nodes are infected

We proceed to evaluate the model accuracy with differentinfection densities This is done by adjusting the infectionrate A 1000-node network is considered where nodes con-nect each other and form a complete graph The epidemicpropagationwith four effective spreading rates ie 120591 = 120573120574 =0002 00015 00011 and 0001 are simulated and analyzedThe values of 120591 are larger than and close to the analyticalthreshold The infection rates are obtained by adjusting 120573while setting 120574 to 01 The analysis is based on (6a)ndash(6c)by evenly dividing the nodes into 5 groups to explore theapplicability of the model to a small number of groups

Security and Communication Networks 7

Analytical resultsSimulation results

=0001

=0002

=00015

=00011

5 10 15 20 25 30 35 400t

005

01

015

02

025

03

035

04

045

05

Infe

ctio

n de

nsity

Figure 4 The infection density with the growth of time wherea complete graph with 1000 nodes is considered The analyticalresults are obtained based on (6a)ndash(6c) by evenly dividing the nodesinto 5 groups where 120591 = 120573120574 = 0002 00015 00011 and 0001respectively

From Figure 4 we can see that the simulation results stillovertake the analytical results when 120591 = 00015 and 0002For example the simulation result is 0459 in the case of119905 = 40 and 120591 = 0002 while the analytical result is only 0418However the gap between simulation results and analyticalresults decreases with dropping 120591 ie from 120591 = 0002 to00015When 120591 further declines ie 120591 = 00011 and 0001 theanalytical results are able tomatch the simulation results fromthe beginning to the end According to (20) the epidemicthreshold is given by 120591lowast = 0001 This figure reveals that theproposed mean-field model is asymptotically accurate witha decreasing 120591 and is able to precisely describe the epidemicpropagation when the effective spreading rate is around theepidemic threshold

We evaluate the epidemic threshold 120591lowast given by (20) inFigure 5 Three networks with 500 nodes are consideredwhere nodes are divided into three groups (ie N =[100 200 200]) The impact of the network topology on thethreshold is evaluated by varying the number of edges in thenetworkWithout loss of generality their collapsed adjacencymatrixA is set to

A = 120572[[[10 20 2010 20 2010 20 20

]]] (21)

where 120572 = 4 6 or 8 The curing rate 120574 is set to be 01 Tenpercent of nodes are randomly selected to be infected at theinitial state The infection density at 119905 = 1000 is used as thestable infection density as indicated by the 119910-axis Evaluatedwith (20) the epidemic threshold is 120591lowast= 0005 00033 and00025 when 120572= 4 6 and 8 respectively We can see from

times10 -3

= 8

= 6

= 4

2 3 4 5 6 7 8 9 101

0

01

02

03

04

05

06

07

08

Infe

ctio

n de

nsity

Simulation resultslowast

Figure 5The validation of epidemic threshold given by (20) wherethe 119910-axis is the infection density at 119905 = 1000 Three networks with500 nodes are considered 120574 is set to be 01 120572 = 4 6 8 is used toadjust the number of edges

Figure 5 that 120591lowast (the solid vertical lines) can precisely specifythe epidemic thresholds When 120591 lt 120591lowast the epidemic can besuppressed eventually When 120591 gt 120591lowast the infection densitygrows with 120591 and also exhibits convexity We can see thatthe network topology has a strong impact on the epidemicthreshold and the infection density Specifically the thresholddecreases with the growth of 120572 For example 120591 halves from0005 to 00025 when 120572 doubles from 4 to 8 (the number ofedges doubles as well) The infection density increases withthe growth of120572 especially around the threshold For examplein the case of 120572 = 8 and 120591 = 0005 the infection density is 05as compared to the infection density of 120572 = 4

We note that the epidemic threshold given by (20) isdetermined by the network structure A rather than thenumber of nodes given by N To illustrate this we comparethe number of infected populations in different scales ofnetworks illustrated by Figure 6 To be specific N = 120575 times[10 20 20] where 120575 = 2 4 and 6 respectively Theircollapsed adjacencymatrices are obtained with (21) by letting120572 = 1 As a result 120591lowast = 002 Figure 6 firstly confirmsthe accuracy of 120591lowast illustrated by the solid vertical line Theobservation that the three networks with the same structurebut different scales share the same epidemic threshold val-idates that the epidemic threshold depends on the networkstructure rather than the scale This finding can significantlyreduce the complexity to deduce the epidemic thresholdie from decomposing an 119873-dimensional matrix by using11205821(A) given by [12] to decomposing an 119899 dimensionalmatrix (119899 ≪ 119873) For example 119873 = 1000 and 119899 = 5in Figure 4 and 119873 = 500 and 119899 = 3 in Figure 5 It isinteresting to notice that the infection densities are the sameeg 796100 asymp 1588200 asymp 240300 in the case of 120591 = 01

8 Security and Communication Networks

Simulation results

= 6

= 4

= 2

lowast

002 004 006 008 010

0

50

100

150

200

250

[I] infin

Figure 6 The validation of epidemic threshold where the 119910-axisis the infected population at 119905 = 1000 Different scales of networks(119873=100 200 and 300 respectively) are considered 120574 is set to be 01

although the infected population varies in different scalesof networks This can be the reason of that the epidemicthreshold depends on the network structure rather than thenetwork scale

6 Conclusion

In this paper we designed a continuous-time SIS model inlarge-scale networks By categorizing nodes into groups themodel complexity was significantly reduced The proposedepidemic model was validated to be asymptotically accuratewith the decrease of the effective spreading rate andorthe increase of node groups The epidemic threshold canbe deduced with the largest eigenvalue of the collapsedadjacency matrix whose dimension is much smaller than thenetwork scale Simulation results corroborated the effective-ness of the model as well as the analytical accuracy of thethreshold in large-scale networks

Data Availability

The simulations are built on the epidemic simulation plat-form NepidemiX

Conflicts of Interest

The authors declare that they have no conflicts of interest

Acknowledgments

This work was supported by the National Key RampD ProgramofChina (no 2017YFB0802703) theNationalNatural Science

Foundation of China (no 61121061) and UTS DVC-R Fund-ing Initiative for Research Strengths

References

[1] J O Kephart and S R White ldquoDirected-graph epidemiologicalmodels of computer virusesrdquo in Proceedings of the IEEE Com-puter Society Symposium on Research in Security and Privacypp 343ndash359 IEEE Oakland CA USA May 1991

[2] X Wang K Zheng X Niu B Wu and C Wu ldquoDetection ofcommand and control in advanced persistent threat based onindependent accessrdquo in Proceedings of the 2016 IEEE Interna-tional Conference on Communications ICC 2016 pp 1ndash6 IEEEKuala Lumpur Malaysia May 2016

[3] WYang YQin andY Yang ldquoAnalysis ofmalicious flows via SISepidemicmodel in CCNrdquo in Proceedings of the IEEE INFOCOM2018 - IEEE Conference on Computer Communications Work-shops (INFOCOMWKSHPS) pp 748ndash753 IEEE Honolulu HIUSA April 2018

[4] Z Kong and E M Yeh ldquoResilience to degree-dependentand cascading node failures in random geometric networksrdquoInstitute of Electrical and Electronics Engineers Transactions onInformation Theory vol 56 no 11 pp 5533ndash5546 2010

[5] R M Anderson Infectious Diseases of Humans Dynamics AndControl vol 28 Wiley Online Library 1992

[6] X Wang X Zha G Yu et al ldquoAttack and defence of ethereumremote apisrdquo in Proceedings of the IEEE Globecom Workshops(GCWkshpsrsquo18) IEEE Abu Dhabi UAE 2018

[7] X Wang W Ni K Zheng R P Liu and X Niu ldquoVirusPropagation Modeling and Convergence Analysis in Large-Scale Networksrdquo IEEE Transactions on Information Forensicsand Security vol 11 no 10 pp 2241ndash2254 2016

[8] P Van Mieghem J Omic and R Kooij ldquoVirus spread innetworksrdquo IEEEACM Transactions on Networking vol 17 no1 pp 1ndash14 2009

[9] Y Wang D Chakrabarti C Wang and C Faloutsos ldquoEpi-demic spreading in real networks an eigenvalue viewpointrdquoin Proceedings of the 22nd International Symposium on ReliableDistributed Systems (SRDS rsquo03) pp 25ndash34 IEEE Florence ItalyOctober 2003

[10] L P Kadanoff ldquoMore is the same phase transitions and meanfield theoriesrdquo Journal of Statistical Physics vol 137 no 5 pp777ndash797 2009

[11] A Ganesh L Massoulie and D Towsley ldquoThe effect of networktopology on the spread of epidemicsrdquo in Proceedings of theProceedings IEEE 24th Annual Joint Conference of the IEEEComputer and Communications Societies vol 2 pp 1455ndash1466IEEE Miami FL USA 2005

[12] P Van Mieghem and R Van De Bovenkamp ldquoNon-Markovianinfection spread dramatically alters the susceptible-infected-susceptible epidemic threshold in networksrdquo Physical ReviewLetters vol 110 no 10 Article ID 108701 2013

[13] A Barabasi and E Bonabeau ldquoScale-Free Networksrdquo ScientificAmerican vol 288 no 5 pp 60ndash69 2003

[14] R Pastor-Satorras C Castellano P Van Mieghem andA Vespignani ldquoEpidemic processes in complex networksrdquoReviews of Modern Physics vol 87 no 3 pp 925ndash979 2015

[15] R Pastor-Satorras and A Vespignani ldquoEpidemic spreading inscale-free networksrdquo Physical Review Letters vol 86 no 14 pp3200ndash3203 2001

Security and Communication Networks 9

[16] H Kang and X Fu ldquoEpidemic spreading and global stability ofan SIS model with an infective vector on complex networksrdquoCommunications in Nonlinear Science amp Numerical Simulationvol 27 no 1ndash3 pp 30ndash39 2015

[17] T Li X Liu J Wu C Wan Z-H Guan and Y Wang ldquoAnepidemic spreadingmodel on adaptive scale-free networks withfeedback mechanismrdquo Physica A Statistical Mechanics and itsApplications vol 450 pp 649ndash656 2016

[18] J O Kephart and S R White ldquoMeasuring and modeling com-puter virus prevalencerdquo in Proceedings of the IEEE ComputerSociety Symposium onResearch in Security and Privacy pp 2ndash15IEEE Oakland Calif USA May 1993

[19] MVojnovic andA J Ganesh ldquoOn the race ofworms alerts andpatchesrdquo IEEEACM Transactions on Networking vol 16 no 5pp 1066ndash1079 2008

[20] Y Yao Q Fu W Yang Y Wang and C Sheng ldquoAn epidemicmodel of computer worms with time delay and variable infec-tion raterdquo Security and Communication Networks vol 2018Article ID 9756982 11 pages 2018

[21] L Liu R K L Ko G Ren and X Xu ldquoMalware propagationand prevention model for time-varying community networkswithin software defined networksrdquo Security and Communica-tion Networks vol 2017 Article ID 2910310 8 pages 2017

[22] C C Zou D Towsley and W B Gong ldquoModeling andsimulation study of the propagation and defense of internete-mail wormsrdquo IEEE Transactions on Dependable and SecureComputing vol 4 no 2 pp 105ndash118 2007

[23] C Li R van de Bovenkamp and P VanMieghem ldquoSusceptible-infected-susceptiblemodel A comparison of n-intertwined andheterogeneous mean-field approximationsrdquo Physical Review Evol 86 no 3 p 026116 2012

[24] W K Chai and G Pavlou ldquoPath-Based Epidemic Spreading inNetworksrdquo IEEEACM Transactions on Networking vol 25 no1 pp 565ndash578 2017

[25] J Kim andM Hastak ldquoSocial network analysis Characteristicsof online social networks after a disasterrdquo International Journalof Information Management vol 38 no 1 pp 86ndash96 2018

[26] L A Meyers M E Newman and B Pourbohloul ldquoPredictingepidemics on directed contact networksrdquo Journal of TheoreticalBiology vol 240 no 3 pp 400ndash418 2006

[27] C Li H Wang and P Van Mieghem ldquoEpidemic threshold indirected networksrdquoPhysical Review E Statistical Nonlinear andSoft Matter Physics vol 88 no 6 p 062802 2013

[28] A Khanafer T Basar and B Gharesifard ldquoStability of epidemicmodels over directed graphs a positive systems approachrdquoAutomatica vol 74 pp 126ndash134 2016

[29] A Lyapunov ldquoThe general problem of the stability of motionrdquoInternational Journal of Control vol 55 no 3 pp 531ndash534 1992English Translation

[30] M J Keeling ldquoThe effects of local spatial structure on epidemi-ological invasionsrdquo Proceedings of the Royal Society of London BBiological Sciences vol 266 no 1421 pp 859ndash867 1999

[31] K J Sharkey C Fernandez K L Morgan et al ldquoPair-levelapproximations to the spatio-temporal dynamics of epidemicson asymmetric contact networksrdquo Journal of MathematicalBiology vol 53 no 1 pp 61ndash85 2006

[32] D K Arrowsmith and C M Place Dynamical Systems Dif-ferential Equations Maps and Chaotic Behaviour Chapman ampHall London UK 1992

[33] L Ahrenberg ldquoNepidemixrdquo httpnepidemixirmacssfuca

Security and Communication Networks 7

Analytical resultsSimulation results

=0001

=0002

=00015

=00011

5 10 15 20 25 30 35 400t

005

01

015

02

025

03

035

04

045

05

Infe

ctio

n de

nsity

Figure 4 The infection density with the growth of time wherea complete graph with 1000 nodes is considered The analyticalresults are obtained based on (6a)ndash(6c) by evenly dividing the nodesinto 5 groups where 120591 = 120573120574 = 0002 00015 00011 and 0001respectively

From Figure 4 we can see that the simulation results stillovertake the analytical results when 120591 = 00015 and 0002For example the simulation result is 0459 in the case of119905 = 40 and 120591 = 0002 while the analytical result is only 0418However the gap between simulation results and analyticalresults decreases with dropping 120591 ie from 120591 = 0002 to00015When 120591 further declines ie 120591 = 00011 and 0001 theanalytical results are able tomatch the simulation results fromthe beginning to the end According to (20) the epidemicthreshold is given by 120591lowast = 0001 This figure reveals that theproposed mean-field model is asymptotically accurate witha decreasing 120591 and is able to precisely describe the epidemicpropagation when the effective spreading rate is around theepidemic threshold

We evaluate the epidemic threshold 120591lowast given by (20) inFigure 5 Three networks with 500 nodes are consideredwhere nodes are divided into three groups (ie N =[100 200 200]) The impact of the network topology on thethreshold is evaluated by varying the number of edges in thenetworkWithout loss of generality their collapsed adjacencymatrixA is set to

A = 120572[[[10 20 2010 20 2010 20 20

]]] (21)

where 120572 = 4 6 or 8 The curing rate 120574 is set to be 01 Tenpercent of nodes are randomly selected to be infected at theinitial state The infection density at 119905 = 1000 is used as thestable infection density as indicated by the 119910-axis Evaluatedwith (20) the epidemic threshold is 120591lowast= 0005 00033 and00025 when 120572= 4 6 and 8 respectively We can see from

times10 -3

= 8

= 6

= 4

2 3 4 5 6 7 8 9 101

0

01

02

03

04

05

06

07

08

Infe

ctio

n de

nsity

Simulation resultslowast

Figure 5The validation of epidemic threshold given by (20) wherethe 119910-axis is the infection density at 119905 = 1000 Three networks with500 nodes are considered 120574 is set to be 01 120572 = 4 6 8 is used toadjust the number of edges

Figure 5 that 120591lowast (the solid vertical lines) can precisely specifythe epidemic thresholds When 120591 lt 120591lowast the epidemic can besuppressed eventually When 120591 gt 120591lowast the infection densitygrows with 120591 and also exhibits convexity We can see thatthe network topology has a strong impact on the epidemicthreshold and the infection density Specifically the thresholddecreases with the growth of 120572 For example 120591 halves from0005 to 00025 when 120572 doubles from 4 to 8 (the number ofedges doubles as well) The infection density increases withthe growth of120572 especially around the threshold For examplein the case of 120572 = 8 and 120591 = 0005 the infection density is 05as compared to the infection density of 120572 = 4

We note that the epidemic threshold given by (20) isdetermined by the network structure A rather than thenumber of nodes given by N To illustrate this we comparethe number of infected populations in different scales ofnetworks illustrated by Figure 6 To be specific N = 120575 times[10 20 20] where 120575 = 2 4 and 6 respectively Theircollapsed adjacencymatrices are obtained with (21) by letting120572 = 1 As a result 120591lowast = 002 Figure 6 firstly confirmsthe accuracy of 120591lowast illustrated by the solid vertical line Theobservation that the three networks with the same structurebut different scales share the same epidemic threshold val-idates that the epidemic threshold depends on the networkstructure rather than the scale This finding can significantlyreduce the complexity to deduce the epidemic thresholdie from decomposing an 119873-dimensional matrix by using11205821(A) given by [12] to decomposing an 119899 dimensionalmatrix (119899 ≪ 119873) For example 119873 = 1000 and 119899 = 5in Figure 4 and 119873 = 500 and 119899 = 3 in Figure 5 It isinteresting to notice that the infection densities are the sameeg 796100 asymp 1588200 asymp 240300 in the case of 120591 = 01

8 Security and Communication Networks

Simulation results

= 6

= 4

= 2

lowast

002 004 006 008 010

0

50

100

150

200

250

[I] infin

Figure 6 The validation of epidemic threshold where the 119910-axisis the infected population at 119905 = 1000 Different scales of networks(119873=100 200 and 300 respectively) are considered 120574 is set to be 01

although the infected population varies in different scalesof networks This can be the reason of that the epidemicthreshold depends on the network structure rather than thenetwork scale

6 Conclusion

In this paper we designed a continuous-time SIS model inlarge-scale networks By categorizing nodes into groups themodel complexity was significantly reduced The proposedepidemic model was validated to be asymptotically accuratewith the decrease of the effective spreading rate andorthe increase of node groups The epidemic threshold canbe deduced with the largest eigenvalue of the collapsedadjacency matrix whose dimension is much smaller than thenetwork scale Simulation results corroborated the effective-ness of the model as well as the analytical accuracy of thethreshold in large-scale networks

Data Availability

The simulations are built on the epidemic simulation plat-form NepidemiX

Conflicts of Interest

The authors declare that they have no conflicts of interest

Acknowledgments

This work was supported by the National Key RampD ProgramofChina (no 2017YFB0802703) theNationalNatural Science

Foundation of China (no 61121061) and UTS DVC-R Fund-ing Initiative for Research Strengths

References

[1] J O Kephart and S R White ldquoDirected-graph epidemiologicalmodels of computer virusesrdquo in Proceedings of the IEEE Com-puter Society Symposium on Research in Security and Privacypp 343ndash359 IEEE Oakland CA USA May 1991

[2] X Wang K Zheng X Niu B Wu and C Wu ldquoDetection ofcommand and control in advanced persistent threat based onindependent accessrdquo in Proceedings of the 2016 IEEE Interna-tional Conference on Communications ICC 2016 pp 1ndash6 IEEEKuala Lumpur Malaysia May 2016

[3] WYang YQin andY Yang ldquoAnalysis ofmalicious flows via SISepidemicmodel in CCNrdquo in Proceedings of the IEEE INFOCOM2018 - IEEE Conference on Computer Communications Work-shops (INFOCOMWKSHPS) pp 748ndash753 IEEE Honolulu HIUSA April 2018

[4] Z Kong and E M Yeh ldquoResilience to degree-dependentand cascading node failures in random geometric networksrdquoInstitute of Electrical and Electronics Engineers Transactions onInformation Theory vol 56 no 11 pp 5533ndash5546 2010

[5] R M Anderson Infectious Diseases of Humans Dynamics AndControl vol 28 Wiley Online Library 1992

[6] X Wang X Zha G Yu et al ldquoAttack and defence of ethereumremote apisrdquo in Proceedings of the IEEE Globecom Workshops(GCWkshpsrsquo18) IEEE Abu Dhabi UAE 2018

[7] X Wang W Ni K Zheng R P Liu and X Niu ldquoVirusPropagation Modeling and Convergence Analysis in Large-Scale Networksrdquo IEEE Transactions on Information Forensicsand Security vol 11 no 10 pp 2241ndash2254 2016

[8] P Van Mieghem J Omic and R Kooij ldquoVirus spread innetworksrdquo IEEEACM Transactions on Networking vol 17 no1 pp 1ndash14 2009

[9] Y Wang D Chakrabarti C Wang and C Faloutsos ldquoEpi-demic spreading in real networks an eigenvalue viewpointrdquoin Proceedings of the 22nd International Symposium on ReliableDistributed Systems (SRDS rsquo03) pp 25ndash34 IEEE Florence ItalyOctober 2003

[10] L P Kadanoff ldquoMore is the same phase transitions and meanfield theoriesrdquo Journal of Statistical Physics vol 137 no 5 pp777ndash797 2009

[11] A Ganesh L Massoulie and D Towsley ldquoThe effect of networktopology on the spread of epidemicsrdquo in Proceedings of theProceedings IEEE 24th Annual Joint Conference of the IEEEComputer and Communications Societies vol 2 pp 1455ndash1466IEEE Miami FL USA 2005

[12] P Van Mieghem and R Van De Bovenkamp ldquoNon-Markovianinfection spread dramatically alters the susceptible-infected-susceptible epidemic threshold in networksrdquo Physical ReviewLetters vol 110 no 10 Article ID 108701 2013

[13] A Barabasi and E Bonabeau ldquoScale-Free Networksrdquo ScientificAmerican vol 288 no 5 pp 60ndash69 2003

[14] R Pastor-Satorras C Castellano P Van Mieghem andA Vespignani ldquoEpidemic processes in complex networksrdquoReviews of Modern Physics vol 87 no 3 pp 925ndash979 2015

[15] R Pastor-Satorras and A Vespignani ldquoEpidemic spreading inscale-free networksrdquo Physical Review Letters vol 86 no 14 pp3200ndash3203 2001

Security and Communication Networks 9

[16] H Kang and X Fu ldquoEpidemic spreading and global stability ofan SIS model with an infective vector on complex networksrdquoCommunications in Nonlinear Science amp Numerical Simulationvol 27 no 1ndash3 pp 30ndash39 2015

[17] T Li X Liu J Wu C Wan Z-H Guan and Y Wang ldquoAnepidemic spreadingmodel on adaptive scale-free networks withfeedback mechanismrdquo Physica A Statistical Mechanics and itsApplications vol 450 pp 649ndash656 2016

[18] J O Kephart and S R White ldquoMeasuring and modeling com-puter virus prevalencerdquo in Proceedings of the IEEE ComputerSociety Symposium onResearch in Security and Privacy pp 2ndash15IEEE Oakland Calif USA May 1993

[19] MVojnovic andA J Ganesh ldquoOn the race ofworms alerts andpatchesrdquo IEEEACM Transactions on Networking vol 16 no 5pp 1066ndash1079 2008

[20] Y Yao Q Fu W Yang Y Wang and C Sheng ldquoAn epidemicmodel of computer worms with time delay and variable infec-tion raterdquo Security and Communication Networks vol 2018Article ID 9756982 11 pages 2018

[21] L Liu R K L Ko G Ren and X Xu ldquoMalware propagationand prevention model for time-varying community networkswithin software defined networksrdquo Security and Communica-tion Networks vol 2017 Article ID 2910310 8 pages 2017

[22] C C Zou D Towsley and W B Gong ldquoModeling andsimulation study of the propagation and defense of internete-mail wormsrdquo IEEE Transactions on Dependable and SecureComputing vol 4 no 2 pp 105ndash118 2007

[23] C Li R van de Bovenkamp and P VanMieghem ldquoSusceptible-infected-susceptiblemodel A comparison of n-intertwined andheterogeneous mean-field approximationsrdquo Physical Review Evol 86 no 3 p 026116 2012

[24] W K Chai and G Pavlou ldquoPath-Based Epidemic Spreading inNetworksrdquo IEEEACM Transactions on Networking vol 25 no1 pp 565ndash578 2017

[25] J Kim andM Hastak ldquoSocial network analysis Characteristicsof online social networks after a disasterrdquo International Journalof Information Management vol 38 no 1 pp 86ndash96 2018

[26] L A Meyers M E Newman and B Pourbohloul ldquoPredictingepidemics on directed contact networksrdquo Journal of TheoreticalBiology vol 240 no 3 pp 400ndash418 2006

[27] C Li H Wang and P Van Mieghem ldquoEpidemic threshold indirected networksrdquoPhysical Review E Statistical Nonlinear andSoft Matter Physics vol 88 no 6 p 062802 2013

[28] A Khanafer T Basar and B Gharesifard ldquoStability of epidemicmodels over directed graphs a positive systems approachrdquoAutomatica vol 74 pp 126ndash134 2016

[29] A Lyapunov ldquoThe general problem of the stability of motionrdquoInternational Journal of Control vol 55 no 3 pp 531ndash534 1992English Translation

[30] M J Keeling ldquoThe effects of local spatial structure on epidemi-ological invasionsrdquo Proceedings of the Royal Society of London BBiological Sciences vol 266 no 1421 pp 859ndash867 1999

[31] K J Sharkey C Fernandez K L Morgan et al ldquoPair-levelapproximations to the spatio-temporal dynamics of epidemicson asymmetric contact networksrdquo Journal of MathematicalBiology vol 53 no 1 pp 61ndash85 2006

[32] D K Arrowsmith and C M Place Dynamical Systems Dif-ferential Equations Maps and Chaotic Behaviour Chapman ampHall London UK 1992

[33] L Ahrenberg ldquoNepidemixrdquo httpnepidemixirmacssfuca

8 Security and Communication Networks

Simulation results

= 6

= 4

= 2

lowast

002 004 006 008 010

0

50

100

150

200

250

[I] infin

Figure 6 The validation of epidemic threshold where the 119910-axisis the infected population at 119905 = 1000 Different scales of networks(119873=100 200 and 300 respectively) are considered 120574 is set to be 01

although the infected population varies in different scalesof networks This can be the reason of that the epidemicthreshold depends on the network structure rather than thenetwork scale

6 Conclusion

In this paper we designed a continuous-time SIS model inlarge-scale networks By categorizing nodes into groups themodel complexity was significantly reduced The proposedepidemic model was validated to be asymptotically accuratewith the decrease of the effective spreading rate andorthe increase of node groups The epidemic threshold canbe deduced with the largest eigenvalue of the collapsedadjacency matrix whose dimension is much smaller than thenetwork scale Simulation results corroborated the effective-ness of the model as well as the analytical accuracy of thethreshold in large-scale networks

Data Availability

The simulations are built on the epidemic simulation plat-form NepidemiX

Conflicts of Interest

The authors declare that they have no conflicts of interest

Acknowledgments

This work was supported by the National Key RampD ProgramofChina (no 2017YFB0802703) theNationalNatural Science

Foundation of China (no 61121061) and UTS DVC-R Fund-ing Initiative for Research Strengths

References

[1] J O Kephart and S R White ldquoDirected-graph epidemiologicalmodels of computer virusesrdquo in Proceedings of the IEEE Com-puter Society Symposium on Research in Security and Privacypp 343ndash359 IEEE Oakland CA USA May 1991

[2] X Wang K Zheng X Niu B Wu and C Wu ldquoDetection ofcommand and control in advanced persistent threat based onindependent accessrdquo in Proceedings of the 2016 IEEE Interna-tional Conference on Communications ICC 2016 pp 1ndash6 IEEEKuala Lumpur Malaysia May 2016

[3] WYang YQin andY Yang ldquoAnalysis ofmalicious flows via SISepidemicmodel in CCNrdquo in Proceedings of the IEEE INFOCOM2018 - IEEE Conference on Computer Communications Work-shops (INFOCOMWKSHPS) pp 748ndash753 IEEE Honolulu HIUSA April 2018

[4] Z Kong and E M Yeh ldquoResilience to degree-dependentand cascading node failures in random geometric networksrdquoInstitute of Electrical and Electronics Engineers Transactions onInformation Theory vol 56 no 11 pp 5533ndash5546 2010

[5] R M Anderson Infectious Diseases of Humans Dynamics AndControl vol 28 Wiley Online Library 1992

[6] X Wang X Zha G Yu et al ldquoAttack and defence of ethereumremote apisrdquo in Proceedings of the IEEE Globecom Workshops(GCWkshpsrsquo18) IEEE Abu Dhabi UAE 2018

[7] X Wang W Ni K Zheng R P Liu and X Niu ldquoVirusPropagation Modeling and Convergence Analysis in Large-Scale Networksrdquo IEEE Transactions on Information Forensicsand Security vol 11 no 10 pp 2241ndash2254 2016

[8] P Van Mieghem J Omic and R Kooij ldquoVirus spread innetworksrdquo IEEEACM Transactions on Networking vol 17 no1 pp 1ndash14 2009

[9] Y Wang D Chakrabarti C Wang and C Faloutsos ldquoEpi-demic spreading in real networks an eigenvalue viewpointrdquoin Proceedings of the 22nd International Symposium on ReliableDistributed Systems (SRDS rsquo03) pp 25ndash34 IEEE Florence ItalyOctober 2003

[10] L P Kadanoff ldquoMore is the same phase transitions and meanfield theoriesrdquo Journal of Statistical Physics vol 137 no 5 pp777ndash797 2009

[11] A Ganesh L Massoulie and D Towsley ldquoThe effect of networktopology on the spread of epidemicsrdquo in Proceedings of theProceedings IEEE 24th Annual Joint Conference of the IEEEComputer and Communications Societies vol 2 pp 1455ndash1466IEEE Miami FL USA 2005

[12] P Van Mieghem and R Van De Bovenkamp ldquoNon-Markovianinfection spread dramatically alters the susceptible-infected-susceptible epidemic threshold in networksrdquo Physical ReviewLetters vol 110 no 10 Article ID 108701 2013

[13] A Barabasi and E Bonabeau ldquoScale-Free Networksrdquo ScientificAmerican vol 288 no 5 pp 60ndash69 2003

[14] R Pastor-Satorras C Castellano P Van Mieghem andA Vespignani ldquoEpidemic processes in complex networksrdquoReviews of Modern Physics vol 87 no 3 pp 925ndash979 2015

[15] R Pastor-Satorras and A Vespignani ldquoEpidemic spreading inscale-free networksrdquo Physical Review Letters vol 86 no 14 pp3200ndash3203 2001

Security and Communication Networks 9

[16] H Kang and X Fu ldquoEpidemic spreading and global stability ofan SIS model with an infective vector on complex networksrdquoCommunications in Nonlinear Science amp Numerical Simulationvol 27 no 1ndash3 pp 30ndash39 2015

[17] T Li X Liu J Wu C Wan Z-H Guan and Y Wang ldquoAnepidemic spreadingmodel on adaptive scale-free networks withfeedback mechanismrdquo Physica A Statistical Mechanics and itsApplications vol 450 pp 649ndash656 2016

[18] J O Kephart and S R White ldquoMeasuring and modeling com-puter virus prevalencerdquo in Proceedings of the IEEE ComputerSociety Symposium onResearch in Security and Privacy pp 2ndash15IEEE Oakland Calif USA May 1993

[19] MVojnovic andA J Ganesh ldquoOn the race ofworms alerts andpatchesrdquo IEEEACM Transactions on Networking vol 16 no 5pp 1066ndash1079 2008

[20] Y Yao Q Fu W Yang Y Wang and C Sheng ldquoAn epidemicmodel of computer worms with time delay and variable infec-tion raterdquo Security and Communication Networks vol 2018Article ID 9756982 11 pages 2018

[21] L Liu R K L Ko G Ren and X Xu ldquoMalware propagationand prevention model for time-varying community networkswithin software defined networksrdquo Security and Communica-tion Networks vol 2017 Article ID 2910310 8 pages 2017

[22] C C Zou D Towsley and W B Gong ldquoModeling andsimulation study of the propagation and defense of internete-mail wormsrdquo IEEE Transactions on Dependable and SecureComputing vol 4 no 2 pp 105ndash118 2007

[23] C Li R van de Bovenkamp and P VanMieghem ldquoSusceptible-infected-susceptiblemodel A comparison of n-intertwined andheterogeneous mean-field approximationsrdquo Physical Review Evol 86 no 3 p 026116 2012

[24] W K Chai and G Pavlou ldquoPath-Based Epidemic Spreading inNetworksrdquo IEEEACM Transactions on Networking vol 25 no1 pp 565ndash578 2017

[25] J Kim andM Hastak ldquoSocial network analysis Characteristicsof online social networks after a disasterrdquo International Journalof Information Management vol 38 no 1 pp 86ndash96 2018

[26] L A Meyers M E Newman and B Pourbohloul ldquoPredictingepidemics on directed contact networksrdquo Journal of TheoreticalBiology vol 240 no 3 pp 400ndash418 2006

[27] C Li H Wang and P Van Mieghem ldquoEpidemic threshold indirected networksrdquoPhysical Review E Statistical Nonlinear andSoft Matter Physics vol 88 no 6 p 062802 2013

[28] A Khanafer T Basar and B Gharesifard ldquoStability of epidemicmodels over directed graphs a positive systems approachrdquoAutomatica vol 74 pp 126ndash134 2016

[29] A Lyapunov ldquoThe general problem of the stability of motionrdquoInternational Journal of Control vol 55 no 3 pp 531ndash534 1992English Translation

[30] M J Keeling ldquoThe effects of local spatial structure on epidemi-ological invasionsrdquo Proceedings of the Royal Society of London BBiological Sciences vol 266 no 1421 pp 859ndash867 1999

[31] K J Sharkey C Fernandez K L Morgan et al ldquoPair-levelapproximations to the spatio-temporal dynamics of epidemicson asymmetric contact networksrdquo Journal of MathematicalBiology vol 53 no 1 pp 61ndash85 2006

[32] D K Arrowsmith and C M Place Dynamical Systems Dif-ferential Equations Maps and Chaotic Behaviour Chapman ampHall London UK 1992

[33] L Ahrenberg ldquoNepidemixrdquo httpnepidemixirmacssfuca

Security and Communication Networks 9

[16] H Kang and X Fu ldquoEpidemic spreading and global stability ofan SIS model with an infective vector on complex networksrdquoCommunications in Nonlinear Science amp Numerical Simulationvol 27 no 1ndash3 pp 30ndash39 2015

[17] T Li X Liu J Wu C Wan Z-H Guan and Y Wang ldquoAnepidemic spreadingmodel on adaptive scale-free networks withfeedback mechanismrdquo Physica A Statistical Mechanics and itsApplications vol 450 pp 649ndash656 2016

[18] J O Kephart and S R White ldquoMeasuring and modeling com-puter virus prevalencerdquo in Proceedings of the IEEE ComputerSociety Symposium onResearch in Security and Privacy pp 2ndash15IEEE Oakland Calif USA May 1993

[19] MVojnovic andA J Ganesh ldquoOn the race ofworms alerts andpatchesrdquo IEEEACM Transactions on Networking vol 16 no 5pp 1066ndash1079 2008

[20] Y Yao Q Fu W Yang Y Wang and C Sheng ldquoAn epidemicmodel of computer worms with time delay and variable infec-tion raterdquo Security and Communication Networks vol 2018Article ID 9756982 11 pages 2018

[21] L Liu R K L Ko G Ren and X Xu ldquoMalware propagationand prevention model for time-varying community networkswithin software defined networksrdquo Security and Communica-tion Networks vol 2017 Article ID 2910310 8 pages 2017

[22] C C Zou D Towsley and W B Gong ldquoModeling andsimulation study of the propagation and defense of internete-mail wormsrdquo IEEE Transactions on Dependable and SecureComputing vol 4 no 2 pp 105ndash118 2007

[23] C Li R van de Bovenkamp and P VanMieghem ldquoSusceptible-infected-susceptiblemodel A comparison of n-intertwined andheterogeneous mean-field approximationsrdquo Physical Review Evol 86 no 3 p 026116 2012

[24] W K Chai and G Pavlou ldquoPath-Based Epidemic Spreading inNetworksrdquo IEEEACM Transactions on Networking vol 25 no1 pp 565ndash578 2017

[25] J Kim andM Hastak ldquoSocial network analysis Characteristicsof online social networks after a disasterrdquo International Journalof Information Management vol 38 no 1 pp 86ndash96 2018

[26] L A Meyers M E Newman and B Pourbohloul ldquoPredictingepidemics on directed contact networksrdquo Journal of TheoreticalBiology vol 240 no 3 pp 400ndash418 2006

[27] C Li H Wang and P Van Mieghem ldquoEpidemic threshold indirected networksrdquoPhysical Review E Statistical Nonlinear andSoft Matter Physics vol 88 no 6 p 062802 2013

[28] A Khanafer T Basar and B Gharesifard ldquoStability of epidemicmodels over directed graphs a positive systems approachrdquoAutomatica vol 74 pp 126ndash134 2016

[29] A Lyapunov ldquoThe general problem of the stability of motionrdquoInternational Journal of Control vol 55 no 3 pp 531ndash534 1992English Translation

[30] M J Keeling ldquoThe effects of local spatial structure on epidemi-ological invasionsrdquo Proceedings of the Royal Society of London BBiological Sciences vol 266 no 1421 pp 859ndash867 1999

[31] K J Sharkey C Fernandez K L Morgan et al ldquoPair-levelapproximations to the spatio-temporal dynamics of epidemicson asymmetric contact networksrdquo Journal of MathematicalBiology vol 53 no 1 pp 61ndash85 2006

[32] D K Arrowsmith and C M Place Dynamical Systems Dif-ferential Equations Maps and Chaotic Behaviour Chapman ampHall London UK 1992

[33] L Ahrenberg ldquoNepidemixrdquo httpnepidemixirmacssfuca

International Journal of

AerospaceEngineeringHindawiwwwhindawicom Volume 2018

RoboticsJournal of

Hindawiwwwhindawicom Volume 2018

Hindawiwwwhindawicom Volume 2018

Active and Passive Electronic Components

VLSI Design

Hindawiwwwhindawicom Volume 2018

Hindawiwwwhindawicom Volume 2018

Shock and Vibration

Hindawiwwwhindawicom Volume 2018

Civil EngineeringAdvances in

Acoustics and VibrationAdvances in

Hindawiwwwhindawicom Volume 2018

Hindawiwwwhindawicom Volume 2018

Electrical and Computer Engineering

Journal of

Advances inOptoElectronics

Hindawiwwwhindawicom

Volume 2018

Hindawi Publishing Corporation httpwwwhindawicom Volume 2013Hindawiwwwhindawicom

The Scientific World Journal

Volume 2018

Control Scienceand Engineering

Journal of

Hindawiwwwhindawicom Volume 2018

Hindawiwwwhindawicom

Journal ofEngineeringVolume 2018

SensorsJournal of

Hindawiwwwhindawicom Volume 2018

International Journal of

RotatingMachinery

Hindawiwwwhindawicom Volume 2018

Modelling ampSimulationin EngineeringHindawiwwwhindawicom Volume 2018

Hindawiwwwhindawicom Volume 2018

Chemical EngineeringInternational Journal of Antennas and

Propagation

International Journal of

Hindawiwwwhindawicom Volume 2018

Hindawiwwwhindawicom Volume 2018

Navigation and Observation

International Journal of

Hindawi

wwwhindawicom Volume 2018

Advances in

Multimedia

Submit your manuscripts atwwwhindawicom