^{1,2}

^{2}

^{3}

^{1}

^{2}

^{3}

The Flash Disk worms, spreading via both Web-based scanning and removable devices between multiple subnets, have become a serious threat to the Internet, especially those physically isolated subnets. We present a model which incorporates specific features of these worms in this paper. Then, we analyze the dynamic behaviors of the model when one
subnet is considered. Analytical result shows that the Flash Disk worm can self-perpetuate when

The Flash Disk worms, which spread via both Web-based scanning on the Internet and removable devices, mainly attack SIMATIC and WinCC software. Those worms appear to be aimed directly at controlling physical machinery and attempt to take control of critical physical infrastructure. Stuxnet which is a kind of the Flash Disk worms has infected about 500,000–1000,000 computers, mainly in Iran, India, Indonesia, and Pakistan [

For a great many similarities between computer worms and biological virus [

Jin and Wang describe the FD-SEIR model to analyze and control the Flash Disk worms [

The organization of this paper is as follows. In Section

The Flash Disk worms spread by Web-based scanning on the Internet and using removable devices between subnets. In the different subnets, the Flash Disk worms may have the different spreading speed. Thus, the propagation of worms can be considered to be a fast system. If they spread slowly, these subnets will be seen as a slow system. For simplicity, we suppose that the removable devices represent all mobile devices related to computer, including flash disk, mobile hard disk, and memory card. Assume that computer hosts are classified in three compartments: susceptible (

In the section, two parts will be analyzed. In the first part, we will not consider the worms spreading among different subnets. In the second part, we will consider worms spreading among different subnets.

If we let

By calculating, we obtain that

Furthermore, we consider the stability of equilibria. We have the following theorems.

If

The Jacobian matrix of (

Then the characteristic equation is

When

Take Lyapunov function,

If

The matrix of the linearization of system (

To prove the global stability, we have a dimensionless transformation where

When

Take Lyapunov function,

In the subsection, we will analyze the existence of positive equilibrium for system (

Take the determined parameters and the average value of about 100 experimental results. Firstly, let

The change figure of proportion of infected computers with time

The change figure of proportion of infected computers

The change figure of proportion of infected computers

In this paper, we proposed a new model focusing on the Flash Disk worms spreading via both Web-based scanning and removable devices in multiple subnets. In the

Number of total computer hosts and removable devices in the

Number of susceptible computer hosts and removable devices in the

Number of infected computer hosts and removable devices in the

Number of recovered computer hosts in the

Quarantine or replacement rate of computer hosts and removable devices, respectively

Recovery rate of infected computer hosts and infected removable devices, respectively

Infection rate of susceptible computer hosts in the

Infection rate from removable devices to susceptible computer hosts

Infection rate of susceptible computer hosts in the

Infection rate of susceptible computer hosts in the

Infection rate of susceptible computer hosts in the

The removable devices using probability per unit time in the

The removable devices of the

Probability of direct opening when using removable devices

A small dimensionless parameter.

The authors declare that there is no conflict of interests regarding the publication of this paper.

This work is supported by the National Science Foundation of China (11201434, 11331009, and 61379125), Fund Program for the Scientific Activities of Selected Returned Overseas Professionals in Shanxi Province, and Research Project Supported by Shanxi Scholarship Council of China (2013-087).