Fractional Dynamics of Stuxnet Virus Propagation in Industrial Control Systems

Abstract

The designed fractional order Stuxnet, the virus model, is analyzed to investigate the spread of the virus in the regime of isolated industrial networks environment by bridging the air-gap between the traditional and the critical control network infrastructures. Removable storage devices are commonly used to exploit the vulnerability of individual nodes, as well as the associated networks, by transferring data and viruses in the isolated industrial control system. A mathematical model of an arbitrary order system is constructed and analyzed numerically to depict the control mechanism. A local and global stability analysis of the system is performed on the equilibrium points derived for the value of $\alpha$ = 1. To understand the depth of fractional model behavior, numerical simulations are carried out for the distinct order of the fractional derivative system, and the results show that fractional order models provide rich dynamics by means of fast transient and super-slow evolution of the model’s steady-state behavior, which are seldom perceived in integer-order counterparts.

1. Introduction

A small piece of software code or program in a computer system that works on a system without the consent of the user may cause damage or steal information for the exploitation of the desired targets. In strategic conflicting environments, as well as in the financial market, computer viruses can be used in a network operation as a digital weapon against the desired targets, e.g., a computer spyware program used as an information collection platform in the Syrian war [1], or Shamoon and Stuxnet viruses for cyber incidents [2]. The tools used for cyberwar vary from a tiny code that exhibits annoying messages on the console to a complicated routine that physically damages the system, such as Stuxnet [3]. Stuxnet was discovered at Natanz, Iran, a nuclear enrichment facility, in June 2010 [4]. The name of the Stuxnet virus was derived from two keywords in its source code, .stub and mrxnet.sys. The Stuxnet virus is a sophisticated piece of code that mainly targets the supervisory control and data acquisition systems (SCADA), exploits zero-day vulnerabilities/bugs to attack the targeted hosts, and uses advanced technology to hide from guard programs. The Stuxnet virus exploits different services, such as a print spooler (MS 10-061), the zero-day vulnerability of the windows system, network shares, file-sharing and server message block (SMB), etc. Stuxnet virus monitors the frequency of motors operating centrifuge machines before modification, which must be in the range of from 807 Hertz to 1210 Hertz. Stuxnet virus controls the running frequency of centrifuge machines for a short interval of time to 1410 Hertz and then decreases to 2 Hz and increases to 1064 Hertz. A change in the output frequency of the motors essentially sabotages the working of machines [5]. Due to the attack of the Stuxnet virus, approximately 1000 centrifuge machines were out of order, of a total of 5000 machines operating in the Iran nuclear facility at Natanz [6]. The purpose of the virus was not just to infect the computers, but to cause real-world physical damage.

A theoretical study of the Stuxnet’s malicious code behavior was conducted through the strength of epidemic modeling of virus spread [7,8,9]. The control scheme of these malicious codes is very challenging because they often hide, and may exploit zero-day vulnerabilities, gain administrative rights and execute code as an authenticated program. The development in technologies creates new issues regarding the safety and security of the critical infrastructure of the countries in the presence of these vulnerabilities and smart viruses. The desire to manufacture an automated process immensely increases software dependencies, which ultimately require lengthy and complex routines.

These complex codes are challenging to screen out completely using software testing mechanisms, and leftover vulnerabilities in these codes can compromise the whole system [10]. Therefore, the comprehensive and dynamic study of these codes is a promising domain for research communities to investigate.

The spread of the virus in a computer network is closely related to the spread of biological viruses in the population. Mathematical and statistical models are often based on concepts and methods borrowed from physics. Models play an important role in infection control by quickly predicting and understanding disease outbreaks. In recent decades, new infectious diseases have been observed, together with the development of eliminated technologies.

The ability to quickly measure the unfolding of outbreaks, communications, and movements is key to capturing the spread of a virus. The inherent complexity of such methods limits the study of these processes. However, developments in technology are helping to lift these limitations [11]. Classical approaches and linear thinking are unable to effectively mitigate the problem due to the lack of equilibrium and non-linear nature of the problems. A complex system, its counter-intuitive behavior, and other macro-level changes can be addressed by applying complex sciences. The usual models did not provide an in-depth picture of real system dynamics because these systems neglect feedback scenarios, cascade effects, and instabilities. To predict the global-scale spread of disease dynamics, several factors, such as demographic disparity, mobility scenarios which include air-flow system, commuter movement in the area, disease-specific information, and control mechanisms, should be acccounted for. There has long been work on the development of mathematical models for use in the analysis of infectious disease behavior. The mathematical model of Daniel Bernoulli against smallpox disease was published in 1766. Mathematical models of these types were designed to elaborate the behavior of an epidemic over the course of time, in which every single population of the virus is assumed to interact with the individual of other populations. The ability to monitor hidden outbreaks, as well as contact and communication, are key to the portrayal of disease-spreading [12]. It is known that immunizing a large fraction of the population or a computer network, the epidemic that spreads upon contact between infected nodes or individuals can be stopped.

Some diseases require 80–90% immunization (measles requires 95%), and the same is true for the computer, where 100% immunization from the Internet may stop viruses in connected networks [13]. Mathematical modeling of infectious disease or viruses in biology or in computer systems gives us a thorough understanding of the problem and helps us to devise a reliable, viable, and robust control strategy [14]. It was observed that the state of the various biological organisms at a certain time depends on its past states and fractional derivatives that also contains those characteristics. Thus, a fractional derivative is a natural approach to the solution of these biological systems. Mathematical modeling is used in numerous disciplines of science and engineering problems [15,16]. Kermack and McKendrick founded mathematical modeling at the beginning of twentieth century with a series of publications, and introduced a susceptible, infected and recovered epidemic model [17]. In this field, several other scientists, biologists, computer engineers and mathematicians have worked on epidemic modeling and published work in this area, such as time delay virus models [18], a fractional epidemiological model [19], antivirus strategy for computer virus model [20], modified susceptible, infected and susceptible models [21] and epidemic models with two control mechanisms, quarantine and immunity [22], and models that highlight the topological facets of the network [23]. Besides these, the role of fundamental concepts and underlying theories of fractional calculus was effectively applied in modeling complex systems in diversified fields with rich dynamics compared to its integer counterparts [24,25,26,27]. Considering these facts, the current study aims to exploit the rich heritage of fractional dynamics for the development of the fractional Stuxnet virus model by using the features of the Stuxnet model to illustrate the virus spread in SCADA systems [28]. In this study, a fractional-order mathematical model of the Stuxnet virus is presented to study the ultra-fast transient and slow evolutions of the virus spread dynamic and attack pattern on isolated critical infrastructures, managed by industrial control computers. The contribution of the proposed fractional Stuxnet virus model is briefly described as:

• A novel fractional-order Stuxnet virus model is proposed by exploiting the rich heritage of fractional calculus in an isolated and air-gapped network environment.
• Stability analysis of Stuxnet virus model for both local and global equilibrium points when disease-free, and endemic spread is performed.
• Correctness of the proposed Grunwald–Letnikov-based fractional numerical solver is ascertained, with close results to the state-of-the-art Runge–Kutta numerical solver for integer-order variants of the model.
• Numerical simulation with Grunwald–Letnikov-based fractional numerical solver for a distinct order of the fractional derivative terms in the system shows that fractional-order models offer rich characteristics by way of ultrafast transience and ultra-slow advancements of steady-state.

2. Fractional Calculus Fundamentals

2.1. Preliminaries

Fractional calculus is a branch of mathematics and a generalization of the calculus theory of integrals and derivatives of a real number or complex number power. The discussion of fractional calculus was started 300 years ago, and the idea of fractional calculus was first listed in the literature with a letter from Leibniz to L’Hostital in 1696. In this letter, a half-derivative term was introduced, i.e., the generalization of the derivative operator $D^{\alpha }$$f\left(\right)$, where $\alpha$, representing the order of a fractional derivative. The history of the fractional derivative is as long as the classical differential operators in calculus, but the inherent strength of the fractional operator is relatively less exploited in engineering domains until the early 1980s. The physical interpretation of the fractional derivative outcomes is still ambiguous, and remained an open debate for clarity in the research community. However, the fractional derivative is an inspiring operator to describe the physics of many modeling phenomena, which are difficult to realize through integer-order derivatives. Recently, the kernel function of a fractional derivative is referred to as a memory function, and fractional-order derivative is proposed as a memory index [29,30] with different types of kernel [31,32,33,34,35,36]. The theory development of fractional calculus belonged to the efforts of several scientists, such as Letnikov, Liouville, Euler, and Riemann [37,38]. Different definitions of fractional order derivatives have existed; the most-used definitions are those of Riemann–Liouville (RL), Caputo (CP), and Grunwald–Letnikov (GL) [39]. The GL definition of fractional derivative is as follows:

$${}_a^{GL}{D}_t^{\alpha }f\left(t\right)=\underset{h\to 0}{lim}\frac{1}{h^{\alpha }}\sum _{m=0}^{(t-a)/\phantom{(t-a)h}h}{(-1)}^m\left({}_m^{\alpha }\right)f(t-mh),t>a,a>0.$$

(1)

The definition of Caputos fractional derivatives can be written as:

$${}_a^{CP}{D}_t^{\alpha }f\left(t\right)=\frac{1}{\mathsf{\Gamma }(n-\alpha )}\underset{a}{\overset{t}{\int }}\frac{f^n\left(x\right)}{{(t-x)}^{\alpha -n+1}}dx,$$

(2)

for $(n-1<\alpha <n)$ and where $\mathsf{\Gamma }(·)$ is a gamma function.

The RL definition is given as:

$${}_a^{RL}{D}_t^{\alpha }f\left(t\right)=\frac{1}{\mathsf{\Gamma }(n-\alpha )}\frac{d^n}{dt}\underset{a}{\overset{t}{\int }}\frac{f\left(x\right)}{{(t-x)}^{\alpha -n+1}}dx.$$

(3)

For $(n-1<\alpha <n)$, while a and t are the bounds of the operation for ${}_a{D}_t^{\alpha }$, the Laplace transform method is normally used with CP, GL and-RL fractional derivatives under zero initial conditions, as: [40]

$$\pounds {\{}_a{D}_t^{\pm \alpha }f\left(t\right);s\}=s^{\pm \alpha }F\left(s\right),$$

(4)

while the analytical expressions are represented by Mittag–Leffler (ML)-type functions [41] introduced by Agarwal and Humbert [42] and are given mathematically as:

$$E_{\alpha ,\beta }\left(z\right)=\sum _{k=0}^{\infty }\frac{z^k}{\mathsf{\Gamma }(\beta +\alpha k)},$$

(5)

$$\begin{array}{c}\hfill \alpha ,\beta ,z\in C,\Re \left(\alpha \right)>0,\Re \left(\beta \right)>0,\end{array}$$

where C represents the set of complex numbers and $E_{\alpha ,\beta }$ is a two-parameter-based ML function.

2.2. Grunwald–Letnikov-Based Numerical Solver for FDEs

Analytical solution to the fractional differential equations (FDEs) generally determined through the Laplace transform method (4), and these expressions are commonly represented by the ML function (5), while, for the numerical solutions, the most commonly used method is based on GL definition.

To introduce the numerical solver based on GL [43] for FDEs, let a general from of an FDE, along with its initial conditions, is given as follows:

$$\begin{array}{cc}\hfill {}_a{D}_t^{\alpha }f\left(t\right)& =f\left(y\right(t),t),\hfill \\ \hfill y^{\left(k\right)}\left(0\right)& =y_0^{\left(k\right)},k=0,1,2,\dots n-1,\hfill \end{array}$$

(6)

where $(n-1<\alpha <n)$, using Equation (1), Ivo Petras [44] provided the final recursive expression of a GL-based solver is as follows:

$$\frac{1}{h^{\alpha }}\sum _{j=0}^{\left[\right(t-a)/\phantom{\left[\right(t-a)h}h]}{(-1)}^j\left({}_k^{\alpha }\right)y(t-jh)\approx f(y\left(t\right),t),$$

simplifying above relation, we have

$$y\left(t\right)+\sum _{j=1}^{\left[\right(t-a)/\phantom{\left[\right(t-a)h}h]}{(-1)}^j\left({}_k^{\alpha }\right)y(t-jh)\approx h^{-\alpha }f(y\left(t\right),t).$$

In case of discrete input grids between interval $t\in [0,T]=[0,h,2h,\dots ,Mh=T]$, where h represents the step size parameter, so $[0,T]=[t_0=0,t_1,\dots ,t_M=T]$ and any grid points in the interval are represented as $t_m=mh\mathrm{for}m=0,1,2,\dots ,M$. Thus, in a discrete form, the above equation is written as:

$$y\left(t_m\right)+\sum _{j=1}^m{(-1)}^j\left({}_j^{\alpha }\right)y(t_m-jh)=h^{-\alpha }f(y\left(t_m\right),t_m),m=0,1,2,\dots ,M.$$

In simple usage, the above term is written as:

$$y\left(t_m\right)+\sum _{j=1}^m{c}_j^{\alpha }y(t_m-jh)=h^{-\alpha }f(y\left(t_m\right),t_m),m=0,1,2,\dots ,M,$$

where $c_j^{\left(\alpha \right)}$ is defined as:

$$c_j^{\alpha }={(-1)}^j\left({}_j^{\alpha }\right),$$

(7)

or equivalently with $c_0^{\alpha }=1$,

$$c_j^{\alpha }=\left(1-\frac{1+\alpha }{j}\right)c_{j-1}^{\alpha },j=0,1,\dots$$

GL numerical solver in the recursive form is written as:

$$y\left(t_m\right)=f(y\left(t_m\right),t_m)h^{-\alpha }-\sum _{j=1}^k{c}_j^{\alpha }y\left(t_{m-j}\right),m=0,1,2,\dots ,M.$$

(8)

A further elaboration of the Grunwald–Letnikov (GL)-based numerical solver can be seen in [45].

3. Model Formulation of Fractional Order Stuxnet Virus

The formulation of a fractional-order Stuxnet virus model (FO-SVM) is presented here. A detailed workflow of the proposed FO-SVM is shown in Figure 1. The entire FO-SVM is segmented into five classes: three for computer population, i.e., susceptible $S\left(t\right)$, infected $I\left(t\right)$, and damaged $M\left(t\right)$, and two for removable storage media, i.e., susceptible storage media $U_s\left(t\right)$ and infected storage media $U_s\left(t\right)$. However, $N\left(t\right)$ represents the total population, i.e., $N\left(t\right)=S\left(t\right)+I\left(t\right)+M\left(t\right)$, and total removable devices $U\left(t\right)$, i.e., $U\left(t\right)=U_s\left(t\right)+U_I\left(t\right)$. In the rest of the article, the variables with respect to time t, $S\left(t\right)$, $I\left(t\right)$, $M\left(t\right)$, $U_s\left(t\right)$, $U_s\left(t\right)$, $N\left(t\right)$, and $U\left(t\right)$ are denoted by S, I, M, $U_s$, $U_I$, N, and U, respectively. Let $A_1$ and $A_2$ represent the arrival of new computing nodes and removable storage media, respectively, damage rate caused to PLC’s due to virus infection is represented by $\rho$, ${\beta }_1$ is the infectious contact rate of susceptible nodes with infected nodes during the network scan, and ${\beta }_2$ denotes the contact rate of infectious-removable storage media with susceptible computer nodes, $r_1$ and $r_2$ represent the natural removal (death) of computer nodes and removable devices from the network, respectively. The number of nodes in Internet protocol version 4 (IPv4) is $2^{32}$, and the probability of finding susceptible nodes in IPv4 scheme is $S/2^{32}$. Susceptible nodes can be infected at the rate ${\beta }_{1}SI$ or at ${\beta }_{2}S{U}_I/\phantom{{\beta }_{2}S{U}_{I}N}N$, while the removable storage media could be infected at a rate of ${\beta }_2{U}_{s}I/\phantom{{\beta }_2{U}_{s}IN}N$. Removable storage media is a common source of virus spread in critical industrial air-gapped networks, which are isolated from normal networks. The removable storage devices facilitate the flow of information to and from the networks that make them as an easy prey for intruders [46]. In this study, fractional-order virus model is used to explain the spread of the virus, especially Stuxnet [47,48] in industrial networks through removable storage media. A proposed flow chart diagram of the Stuxnet virus model is shown in Figure 2, and the fundamental mathematical equations of the model are given as:

$$\begin{array}{cc}\hfill D^{\alpha }S& =A_1-\frac{{\beta }_{1}SI}{2^{32}}-\frac{{\beta }_{2}S{U}_I}{N}-r_{1}S,\hfill \\ \hfill D^{\alpha }I& =\frac{{\beta }_{1}SI}{2^{32}}+\frac{{\beta }_{2}S{U}_I}{N}-\rho I-r_{1}I,\hfill \\ \hfill D^{\alpha }M& =\rho I-r_{1}M,\hfill \\ \hfill D^{\alpha }{U}_s& =A_2-\frac{{\beta }_2{U}_{s}I}{N}-r_2{U}_s,\hfill \\ \hfill D^{\alpha }{U}_I& =\frac{{\beta }_2{U}_{s}I}{N}-r_2{U}_I\hfill \end{array}$$

(9)

where $\alpha \in [0,1]$ represents the order of the fractional derivative term $D^{\alpha }=d^{\alpha }/\phantom{d^{\alpha }d{t}^{\alpha }}d{t}^{\alpha }$. For the value of $\alpha =1$, the above-mentioned FO-SVM system provided in a set of Equation (9) will be converted into a first-order system. From the differential equations mentioned in (9), solving the equations by taking the value of $\alpha$ = 1, we get

$$\begin{array}{cc}\hfill \frac{dN}{dt}& =A_1-r_{1}N,\hfill \\ \hfill \frac{dU}{dt}& =A_2-r_{2}U.\hfill \end{array}$$

(10)

The change in population is given by $c_1=A_1-r_1$ and $c_2=A_2-r_2$, and the values of these constants may be negative, positive or zero.

Solving the set of Equation (10), we get

$$\begin{array}{c}\hfill N\left(t\right)\to \frac{A_1}{r_1}\stackrel{\Delta }{=}{N}^{*},t\to \infty ,\\ \hfill U\left(t\right)\to \frac{A_2}{r_2}\stackrel{\Delta }{=}{U}^{*},t\to \infty .\end{array}$$

(11)

The system given in Equation (9) can be simplified by incorporating N and U variables, as in:

$$\begin{array}{cc}\hfill D^{\alpha }I& =\frac{{\beta }_1(N-I-M)I}{2^{32}}+\frac{{\beta }_2(N-I-M)U_I}{N}-\rho I-r_{1}I,\hfill \\ \hfill D^{\alpha }M& =\rho I-r_{1}M,\hfill \\ \hfill D^{\alpha }{U}_I& =\frac{{\beta }_2(U-U_I)I}{N}-r_2{U}_I,\hfill \end{array}$$

(12)

where

$$\begin{array}{cc}\hfill N\left(t\right)& =N^{*}+(N\left(0\right)-N^{*})e^{-r_{1}t},\hfill \\ \hfill U\left(t\right)& =U^{*}+(U\left(0\right)-U^{*})e^{-r_{2}t}.\hfill \end{array}$$

(13)

Using Equation (11) in system (12), one may obtain a limit system ($IM{U}_I$), as in [49,50]:

$$\begin{array}{cc}\hfill D^{\alpha }I& =\frac{{\beta }_1(N^{*}-I-M)I}{2^{32}}+\frac{{\beta }_2(N^{*}-I-M)U_I}{N^{*}}-\rho I-r_{1}I,\hfill \\ \hfill D^{\alpha }M& =\rho I-r_{1}M,\hfill \\ \hfill D^{\alpha }{U}_I& =\frac{{\beta }_2(U^{*}-U_I)I}{N^{*}}-r_2{U}_I.\hfill \end{array}$$

(14)

The equations in system (14), are the reduced version of (9), and will be used in further investigations.

4. Model Analysis

In this unit, stability analysis of the model is performed through the derivation of basic reproduction number, $R_0$. The endemic and disease-free equilibrium points of the system are investigated for a local as well as global stability analysis.

4.1. Basic Reproduction Number ($R_0$)

In epidemiology modeling, a basic reproduction number is defined as the advent of a new infection in an entirely susceptible population due to an infected individual, and is usually represented by $R_0$. The value of $R_0$ determines the spread of infection; for $R_0>1$ infection will spread in the population, and for $R_0<1$ infection will soon end [51].

To simplify the derivation process, a reduced model (14) has been utilized for further investigation of $R_0$. The calculation of $R_0$ is based on the value of $\alpha$ = 1. The necessary condition of a disease epidemic is based on the increase in the infected individuals, with the supposition that, initially, the entire population is susceptible.

For the case of $D^{\alpha }I>0$, we have $D^{\alpha }{U}_I>0$

$$\frac{{\beta }_1(N^{*}-I-M)I}{2^{32}}+\frac{{\beta }_2(N^{*}-I-M)U_I}{N^{*}}-\rho I-r_{1}I>0,$$

(15)

and, accordingly, in case of $D^{\alpha }{U}_I>0$, we have

$$\frac{{\beta }_2(U^{*}-U_I)I}{N^{*}}-r_2{U}_I>0.$$

(16)

With the assumption that all the population is susceptible at the start, the above expressions may be written as:

$$\begin{array}{c}\frac{{\beta }_1{N}^{*}I}{2^{32}}+\frac{{\beta }_2{N}^{*}{U}_I}{N^{*}}-\rho I-r_{1}I>0,\end{array}$$

(17)

$$\begin{array}{c}\frac{{\beta }_2{U}^{*}I}{N^{*}}-r_2{U}_I>0.\end{array}$$

(18)

Simplifying the above relations, we have

$$\frac{{\beta }_1{N}^{*}}{(\rho +r_1)2^{32}}+\frac{{\beta }_2^2{U}^{*}}{r_2{N}^{*}(\rho +r_1)}>1.$$

(19)

Accordingly,

$$R_0=\frac{{\beta }_1{N}^{*}}{2^{32}(\rho +r_1)}+\frac{{\beta }_2^2{U}^{*}}{r_2{N}^{*}(\rho +r_1)}.$$

(20)

Equation (20) represents the basic reproduction number derived for the model.

4.2. Equilibria Studies

In this subsection, we study the equilibrium points of FO-SVM model Equation (14). The FO-SVM model has virus-free equilibrium and endemic equilibrium points. In the endemic equilibrium point, the spread of infection is observed.

For equilibria studies, we have

$$D^{\alpha }I=0,D^{\alpha }M=0,D^{\alpha }{U}_I=0,$$

equilibrium points of system (14) for virus-free and endemic are as: $K_0$ = (I, M, $U_I$) = (0, 0, 0) and $K^{*}$ = ($I^{*}$, $M^{*}$, $U_I^{*}$) for $R_0>1$.

The analysis for the endemic equilibria of model (14) is written as:

$$\begin{array}{cc}\hfill \frac{{\beta }_1(N^{*}-I-M)I}{2^{32}}+\frac{{\beta }_2(N^{*}-I-M)U_I}{N^{*}}-\rho I-r_{1}I& =0,\hfill \\ \hfill \rho I-r_{1}M& =0,\hfill \\ \hfill \frac{{\beta }_2(U^{*}-U_I)I}{N^{*}}-r_2{U}_I& =0.\hfill \end{array}$$

(21)

Solving the equations in set (21), we obtain the expressions for the endemic equilibrium point ($I^{*}$, $M^{*}$, $U_I^{*}$) as:

$$\begin{array}{cc}\hfill I^{*}& =\frac{\sqrt{b^2-4ac}-b}{2a},\hfill \end{array}$$

(22)

$$\begin{array}{cc}\hfill M^{*}& =\frac{\rho }{r_1}{I}^{*},\hfill \end{array}$$

(23)

$$\begin{array}{cc}\hfill U_I^{*}& =\frac{{\beta }_2{U}^{*}}{{\beta }_2{I}^{*}+r_2{N}^{*}}{I}^{*},\hfill \end{array}$$

(24)

where

$$\begin{array}{cc}\hfill a& =\frac{(\rho +r1)\beta 1\beta 2}{2^{32}{r}_1{N}^{*}},\hfill \\ \hfill b& =\frac{{\beta }_2(\rho +r_1)(1-R_0)}{N^{*}}+\frac{{\beta }_2^3{U}^{*}}{N^{*}{r}_2}+\frac{{\beta }_1\left(r_2\right){\beta }_2^2{U}^{*}}{2^{32}{r}_1}(\rho +r_1),\hfill \\ \hfill c& =(\rho +r_1)(1-R_0)r_2.\hfill \end{array}$$

It is evident from Equation (22) that the possibility of infection spread, i.e., $I^{*}>0$, is only verified for the value of $R_0>1$.

4.3. Disease Free Equilibrium

Theorem 1.

Disease-free equilibrium (DFE) point of a system is locally and asymptotically stable at $K_0$, if $R_0<1$.

Proof. 

The DFE point of a system is locally asymptotically stable at $K_0$ = (I, M, $U_I$) = (0, 0, 0). The Jacobian matrix of function $f:R^3\to R^3$ with components:

$$\begin{array}{cc}\hfill D^{\alpha }I& =\frac{{\beta }_1(N^{*}-I-M)I}{2^{32}}+\frac{{\beta }_2(N^{*}-I-M)U_I}{N^{*}}-\rho I-r_{1}I,\hfill \\ \hfill D^{\alpha }M& =\rho I-r_{1}M,\hfill \\ \hfill D^{\alpha }{U}_I& =\frac{{\beta }_2(U^{*}-U_I)I}{N^{*}}-r_2{U}_I.\hfill \end{array}$$

(25)

Thus, the Jacobian matrix at $K_0$, DFE point of integer-order model (14) is given as:

$$\begin{array}{c}DFE\left(K_0\right)=\left(\begin{array}{ccc}\frac{{\beta }_1{N}^{*}}{2^{32}}-\rho -r_1& 0& {\beta }_2\\ \rho & -r_1& 0\\ \frac{{\beta }_2{U}^{*}}{N^{*}}& 0& -r_2.\end{array}\right)\end{array}$$

(26)

System (26) characteristic equation is

$$\begin{array}{c}\left|\lambda I-DFE\left(K_0\right)\right|=\left|\begin{array}{ccc}\lambda -\frac{{\beta }_1{N}^{*}}{2^{32}}+\rho +r_1& 0& -{\beta }_2\\ -\rho & \lambda +r_1& 0\\ -\frac{{\beta }_2{U}^{*}}{N^{*}}& 0& \lambda +r_2\\ \end{array}\right|=0,\end{array}$$

(27)

and simplify as:

$$\begin{array}{c}(\lambda +r_1)\left[\left(\lambda -\frac{N^{*}{\beta }_1}{2^{32}}+\rho +r_1\right)(\lambda +r_2)-\frac{{\beta }_2^2{U}^{*}}{N^{*}}\right]=0.\end{array}$$

(28)

The corresponding Eigen values of the above relation are

$$\begin{array}{c}\begin{array}{c}{\lambda }_1=-r_1,\hfill \\ \left[\left(\lambda -\frac{N^{*}{\beta }_1}{2^{32}}+\rho +r_1\right)(\lambda +r_2)-\frac{{\beta }_2^2{U}^{*}}{N^{*}}\right]=0.\hfill \end{array}\end{array}$$

(29)

Simplifying the above expression to find the remaining Eigenvalues

$$\begin{array}{cc}\hfill r_1\left(\lambda +r_2\right)+\rho \left(\lambda +r_2\right)+\lambda \left(\lambda +r_2\right)-\left(\lambda +r_2\right)\frac{N^{*}{\beta }_1}{2^{32}}-\frac{{{\beta }_2}^2{U}^{*}}{N^{*}}& =0,\hfill \\ \hfill {\lambda }^2+\lambda \left(r_1+r_2+\rho -\frac{N^{*}{\beta }_1}{2^{32}}\right)+r_1{r}_2+\rho r_2-r_2\frac{N^{*}{\beta }_1}{2^{32}}-\frac{{{\beta }_2}^2{U}^{*}}{N^{*}}& =0,\hfill \\ \hfill \frac{{\lambda }^2}{r_2(\rho +r_1)}+\frac{\lambda \left(r_1+r_2+\rho -\frac{N^{*}{\beta }_1}{2^{32}}\right)}{r_2(\rho +r_1)}+\left(1-\frac{N^{*}{\beta }_1}{2^{32}(\rho +r_1)}-\frac{{{\beta }_2}^2{U}^{*}}{N^{*}{r}_2(\rho +r_1)}\right)& =0,\hfill \\ \hfill \frac{{\lambda }^2}{r_2(\rho +r_1)}+\frac{\lambda }{r_2}\left(\frac{r_2}{\rho +r_1}+\frac{r_1+\rho }{\rho +r_1}-\frac{N^{*}{\beta }_1}{2^{32}(\rho +r_1)}\right)+\left(1-R_0\right)& =0,\hfill \end{array}$$

and rearranging the above expression

$$\frac{{\lambda }^2}{r_2(\rho +r_1)}+\frac{\lambda }{r_2}\left(\frac{r_2}{\rho +r_1}+1-\frac{N^{*}{\beta }_1}{2^{32}(\rho +r_1)}\right)+\left(1-R_0\right)=0,$$

(30)

and, for $R_0<1$, Equation (9) can be written as:

$$\frac{{\lambda }^2}{r_2(\rho +r_1)}+\frac{\lambda }{r_2}\left(\frac{r_2}{\rho +r_1}+1-\frac{N^{*}{\beta }_1}{2^{32}(\rho +r_1)}\right)+\left(1-R_0\right)=0.$$

(31)

Using the expression (31) in Section 4.3, make the coefficient positive for $R_0<1$, which shows that system Section 4.3 eigenvalues are in a stable region; this confirms that the system is asymptotically stable for point $K_0$ when $R_0<1$. If system is stable for the value of $\alpha =1$, it will be stable for the value of $\alpha <1$, as reported in [52]. This completes the proof. □

Theorem 2.

If $R_0<1$, then point $K_0$ is globally asymptotically stable, and otherwise unstable.

Proof. 

Considering the Lyapunov function mentioned below,

$$L(I,M,U_I)=I+\frac{{\beta }_1}{2^{33}\rho }{M}^2+\frac{{\beta }_2}{r_2}{U}_I.$$

(32)

The function in $R^3$ is positive, for $R^3$ = ($I,M,UI$) and $(I>0,M>0,UI>0)$.

For $\alpha$ = 1, the derivative of Lyapunov function (32) is

$$D^{\alpha }L\left(I,M,U_I\right)=D^{\alpha }I+\frac{2{\beta }_1}{2^{33}\rho }M{D}^{\alpha }M+\frac{{\beta }_2}{r_2}{D}^{\alpha }{U}_I,$$

(33)

$$\begin{array}{cc}\hfill D^{\alpha }L(I,M,U_I)& =\frac{{\beta }_1(N^{*}-I-M)I}{2^{32}}+\frac{{\beta }_2(N^{*}-I-M)U_I}{N^{*}}-\rho I-r_{1}I+\frac{{\beta }_{1}MI}{2^{32}}+\frac{r_1{\beta }_1{M}^2}{2^{32}\rho }\hfill \\ & +\frac{{{\beta }_2}^2{U}^{*}I}{N^{*}{r}_2}-\frac{{{\beta }_2}^2{U}_{1}I}{N^{*}{r}_2}-{\beta }_2{U}_1,\hfill \\ \hfill & =\left(\frac{{\beta }_1{N}^{*}}{2^{32}}+\frac{{{\beta }_2}^2{U}^{*}}{N^{*}{r}_2}-\rho -r_1\right)I-\frac{{\beta }_1{I}^2}{2^{32}}-\frac{{\beta }_2(M+I)U_I}{N^{*}}-\frac{r_1{\beta }_1{M}^2}{2^{32}\rho }\hfill \\ & -\frac{{{\beta }_2}^2{M}^2{U}_{I}I}{N^{*}{r}_2},\hfill \\ \hfill & =\left(\begin{array}{c}(\rho +r_1)\left(\frac{{\beta }_1{N}^{*}}{2^{32}(\rho +r_1)}+\frac{{{\beta }_2}^2{U}^{*}}{N^{*}{r}_2(\rho +r_1)}\right)\hfill \\ -\rho -r_1\hfill \end{array}\right)I-\frac{{\beta }_1{I}^2}{2^{32}}-\frac{{\beta }_2(M+I)U_I}{N^{*}}-\frac{r_1{\beta }_1{M}^2}{2^{32}\rho }\hfill \\ & -\frac{{{\beta }_2}^2{M}^2{U}_{I}I}{N^{*}{r}_2},\hfill \\ \hfill & =(\rho +r_1)(R_0-1)I-\frac{{\beta }_1{I}^2}{2^{32}}-\frac{{\beta }_2(M+I)U_I}{N^{*}}-\frac{r_1{\beta }_1{M}^2}{2^{32}\rho }-\frac{{{\beta }_2}^2{U}_{I}I}{N^{*}{r}_2}.\hfill \end{array}$$

(34)

For $R_0<1$, this implies that $D^{\alpha }L\le 0$ and $K_0$ is the only invariant set of system (21). According to the LaSalle Invariance Principle, $K_0$ is proven to be globally asymptotically stable. Hence, equilibrium point $K_0$ is globally asymptotically stable for $R_0<1$. Additionally, if the system is stable for the value of $\alpha =1$, then the system will be stable for $\alpha <1$, as described in [52]. □

4.4. Endemic Stability

The endemic stability of equilibrium point $K^{*}$= ($I^{*}$, $M^{*}$, $U_I^{*}$) is investigated in this section for the values of $R_0>1$ and $I^{*}\ge 0$.

Theorem 3.

Endemic equilibrium point $K^{*}$ is locally asymptotically stable, if $R_0>1$.

Proof. 

Consider the function $f:R^3\to R^3$ with components and the Jacobian matrix of the system (14) as:

$$\begin{array}{cc}\hfill D^{\alpha }I& =f_1(I^{*},M^{*},U_I^{*})=\frac{{\beta }_1(N^{*}-I^{*}-M^{*})I^{*}}{2^{32}}+\frac{{\beta }_2(N^{*}-I^{*}-M^{*})U_I^{*}}{N^{*}}-\rho I^{*}-r_1{I}^{*},\hfill \\ \hfill D^{\alpha }M& =f_2(I^{*},M^{*},U_I^{*})=\rho I^{*}-r_1{M}^{*},\hfill \\ \hfill D^{\alpha }{U}_I& =f_3(I^{*},M^{*},U_I^{*})=\frac{{\beta }_2(U^{*}-U_I^{*})I^{*}}{2^{32}}-r_2{U}_I^{*},\hfill \end{array}$$

$$\begin{array}{c}J(I^{*},M^{*},U_I^{*})=\left(\begin{array}{c}\frac{\partial f_1}{\partial I^{*}}\frac{\partial f_1}{\partial M^{*}}\frac{\partial f_1}{\partial U_I^{*}}\hfill \\ \frac{\partial f_2}{\partial I^{*}}\frac{\partial f_2}{\partial M^{*}}\frac{\partial f_2}{\partial U_I^{*}}\hfill \\ \frac{\partial f_3}{\partial I^{*}}\frac{\partial f_3}{\partial M^{*}}\frac{\partial f_3}{\partial U_I^{*}}\hfill \end{array}\right).\end{array}$$

The endemic equilibrium of system (14) is $K^{*}$= ($I^{*}$, $M^{*}$, $U_I^{*}$), for the value of $\alpha$ = 1, the Jacobian matrix at endemic point is mentioned below.

$$\begin{array}{c}\hfill J\left(K^{*}\right)=\left(\begin{array}{ccc}\mathsf{\Lambda }& -\frac{{\beta }_1{I}^{*}}{2^{32}}-\frac{{\beta }_2{U_I}^{*}}{N^{*}}& \frac{{\beta }_2(N^{*}-I^{*}-M^{*})}{N^{*}}\\ \rho & -r_1& 0\\ \frac{{\beta }_2(U^{*}-{U_I}^{*})}{N^{*}}& 0& \frac{{\beta }_2{I}^{*}}{N^{*}}-r_2\end{array}\right),\end{array}$$

(35)

where $\mathsf{\Lambda }=\frac{{\beta }_1(N^{*}-2I^{*}-M^{*})}{2^{32}}-\frac{{\beta }_2{U_I}^{*}}{N^{*}}-\rho -r_1$.

The characteristic equation of (35) is

$$\begin{array}{cc}\hfill & \left|\lambda I-J\left(K^{*}\right)\right|=0,\hfill \\ \hfill & \left|\begin{array}{ccc}\lambda -\mathsf{\Lambda }& \frac{{\beta }_1{I}^{*}}{2^{32}}+\frac{{\beta }_2{U_I}^{*}}{N^{*}}& -\frac{{\beta }_2(N^{*}-I^{*}-M^{*})}{N^{*}}\\ -\rho & \lambda +r_1& 0\\ -\frac{{\beta }_2(U^{*}-{U_I}^{*})}{N^{*}}& 0& \lambda +\frac{{\beta }_2{I}^{*}}{N^{*}}+r_2\end{array}\right|=0,\hfill \end{array}$$

simplifies as:

$$\begin{array}{cc}\hfill & {\lambda }^3+(b_{11}+b_{22}+b_{33}){\lambda }^2+(b_{11}{b}_{22}+b_{11}{b}_{33}+b_{22}{b}_{33}\hfill \\ & -b_{12}{b}_{21}-b_{13}{b}_{31})\lambda +b_{11}{b}_{22}{b}_{33}-b_{12}{b}_{21}{b}_{33}-b_{13}{b}_{31}{b}_{22}=0,\hfill \end{array}$$

(36)

where

$$\begin{array}{c}{b}_{11}=-\frac{{\beta }_1{N}^{*}}{2^{32}}+\frac{{\beta }_1(2I^{*}+M^{*})}{2^{32}}+\frac{{\beta }_2{U}_I^{*}}{N^{*}}+\rho +r_1,\hfill \\ b_{12}=\frac{{\beta }_1{I}^{*}}{2^{32}}+\frac{{\beta }_2{U}_I^{*}}{N^{*}},\hfill \\ b_{21}=-\rho ,b_{23}=0,b_{22}=r_1,b_{13}=-\frac{{\beta }_2(N^{*}-I^{*}-M^{*})}{N^{*}},\hfill \\ b_{31}=-\frac{{\beta }_2(U^{*}-U_I^{*})}{N^{*}},b_{33}=\frac{{\beta }_2{I}^{*}}{N^{*}}+r_2,b_{32}=0.\hfill \end{array}$$

For stability analysis, Hurwitz criteria may be used, as reported in [53,54] for system (36). Equating the Equation (36) coefficient with the general characteristics equation, we have

$$\begin{array}{c}{b}_0=1,\hfill \\ b_1=b_{11}+b_{22}+b_{33},\hfill \\ b_2=b_{11}{b}_{22}+b_{11}{b}_{33}+b_{22}{b}_{33}-b_{12}{b}_{21}-b_{13}{b}_{31},\hfill \\ b_3=b_{11}{b}_{22}{b}_{33}-b_{12}{b}_{21}{b}_{33}-b_{13}{b}_{31}{b}_{22}.\hfill \end{array}$$

Determinants ($D_1$, $D_2$ and $D_3$) of the Equation (36) are stated in Hurwitz as:

$$\begin{array}{cc}\hfill D_1& =b_1=b_{11}+b_{22}+b_{33},\hfill \\ \hfill & =-\frac{{\beta }_1{N}^{*}}{2^{32}}+\frac{{\beta }_1(2I^{*}+M^{*})}{2^{32}}+\frac{{\beta }_2{U}_I^{*}}{N^{*}}\hfill \\ & +\rho +r_1+r_1+\frac{{\beta }_2{I}^{*}}{N^{*}}+r_2,\hfill \end{array}$$

using the value of Equation (20) for $R_0>1$ as:

$$\begin{array}{c}\hfill \frac{{\beta }_1{N}^{*}}{2^{32}}+\frac{{\beta }_2^2{U}^{*}}{r_2{N}^{*}}>\rho +r,\mathrm{we}\mathrm{have}\\ \hfill D_1=-\frac{{\beta }_1{N}^{*}}{2^{32}}+\frac{{\beta }_1(2I^{*}+M^{*})}{2^{32}}+\frac{{\beta }_2{U}_I^{*}}{N^{*}}+\frac{{\beta }_1{N}^{*}}{2^{32}}+\frac{{\beta }_2^2{U}^{*}}{r_2{N}^{*}}+r_1+\frac{{\beta }_2{I}^{*}}{N^{*}}+r_2,\\ \hfill D_1=\frac{{\beta }_1(2I^{*}+M^{*})}{2^{32}}+\frac{{\beta }_2{U}_I^{*}}{N^{*}}+\frac{{\beta }_2^2{U}^{*}}{r_2{N}^{*}}+r_1+\frac{{\beta }_2{I}^{*}}{N^{*}}+r_2,\\ \hfill D_1>0,\end{array}$$

and

$$\begin{array}{cc}\hfill D_2=& b_1{b}_2-b_3{b}_0,\hfill \\ \hfill D_2=& (b_{11}+b_{22}+b_{33})(b_{11}{b}_{22}+b_{11}{b}_{33}+b_{22}{b}_{33}-b_{12}{b}_{21}\hfill \\ & -b_{13}{b}_{31})-b_{11}{b}_{22}{b}_{33}+b_{12}{b}_{21}{b}_{33}+b_{13}{b}_{31}{b}_{22},\hfill \\ \hfill =& b_{11}^2{b}_{22}+b_{11}^2{b}_{33}+b_{11}{b}_{22}{b}_{33}-b_{11}{b}_{12}{b}_{21}-b_{11}{b}_{13}{b}_{31}\hfill \\ & +b_{11}{b}_{22}^2+b_{11}{b}_{22}{b}_{33}+b_{22}^2{b}_{33}-b_{22}{b}_{12}{b}_{21}\hfill \\ & -b_{22}{b}_{13}{b}_{31}+b_{11}{b}_{22}{b}_{33}+b_{11}{b}_{33}^2+b_{22}{b}_{33}^2\hfill \\ & -b_{33}{b}_{12}{b}_{21}-b_{33}{b}_{13}{b}_{31}-b_{11}{b}_{22}{b}_{33}\hfill \\ & +b_{33}{b}_{12}{b}_{21}+b_{22}{b}_{13}{b}_{31},\hfill \\ \hfill D_2=& b_{11}^2{b}_{22}+b_{11}^2{b}_{33}+b_{11}{b}_{22}^2+b_{22}{b}_{33}^2+b_{11}{b}_{33}^2+b_{22}^2{b}_{33}\hfill \\ & +2b_{11}{b}_{22}{b}_{33}-b_{11}{b}_{12}{b}_{21}-b_{11}{b}_{13}{b}_{31}-b_{22}{b}_{12}{b}_{21}-b_{33}{b}_{13}{b}_{31}.\hfill \end{array}$$

The above expressions remain positive, except for $-b_{13}{b}_{31}(b_{11}+b_{33})$, $D_2$, which, if positive for $R_0>1$, is simply represented as:

$$\begin{array}{c}{D}_2=+\mathrm{ve}\mathrm{terms}+(b_{11}{b}_{33}-b_{13}{b}_{31})(b_{11}+b_{33}),\hfill \\ D_2=D_{2-1}+D_{2-2},\hfill \end{array}$$

Here, $D_{2-1}$ represent the positive terms in $D_2$, while, for the remaining terms, represented with $D_{2-2}$, we have

$$\begin{array}{c}\hfill \begin{array}{c}{D}_{2-2}=(b_{11}{b}_{33}-b_{13}{b}_{31})(b_{11}+b_{33})\hfill \\ =\left\{\begin{array}{c}\left(\frac{{\beta }_1(N^{*}-I^{*}-M^{*})}{2^{32}}+\rho +r_1\right)r_2\hfill \\ -\frac{{{\beta }^2}_2(N^{*}-I^{*}-M^{*})(U^{*}-{U_I}^{*})}{N^{*2}}\hfill \end{array}\right\}(b_{11}+b_{33}),\hfill \\ =\left\{\left(\begin{array}{c}\frac{{\beta }_1(N^{*}-I^{*}-M^{*})}{2^{32}}+\rho +r_1\hfill \\ -\frac{{{\beta }^2}_2(N^{*}-I^{*}-M^{*})(U^{*}-{U_I}^{*})}{r_2{N}^{*2}}\hfill \end{array}\right)r_2\right\}(b_{11}+b_{33}),\hfill \\ =\left\{\left(\begin{array}{c}\frac{{\beta }_1(N^{*}-I^{*}-M^{*})}{2^{32}}+\rho +r_1\hfill \\ -\frac{{{\beta }^2}_2(N^{*}-I^{*}-M^{*})U^{*}}{r_2{N}^{*2}}+\hfill \\ \frac{{{\beta }^2}_2(N^{*}-I^{*}-M^{*}){U_I}^{*}}{r_2{N}^{*2}}\hfill \end{array}\right)r_2\right\}(b_{11}+b_{33}),\hfill \\ =\left\{\left(\begin{array}{c}\frac{{\beta }_1(N^{*}-I^{*}-M^{*})}{2^{32}}+\rho +r_1-\hfill \\ \frac{{{\beta }^2}_2{U}^{*}}{r_2{N}^{*}}+\frac{{{\beta }^2}_2{I}^{*}{U}^{*}}{r_2{N}^{*2}}+\frac{{{\beta }^2}_2{M}^{*}{U}^{*}}{r_2{N}^{*2}}\hfill \\ +\frac{{{\beta }^2}_2(N^{*}-I^{*}-M^{*}){U_I}^{*}}{r_2{N}^{*2}}\hfill \end{array}\right)r_2\right\}(b_{11}+b_{33}),\hfill \end{array}\end{array}$$

using the value of $R_0>1$, and after simplification, the above expression becomes

$$\begin{array}{c}\hfill \begin{array}{c}{D}_{2-2}>\left\{\left(\begin{array}{c}\frac{{\beta }_1(N^{*}-I^{*}-M^{*})}{2^{32}}\hfill \\ +\frac{{\beta }_1{N}^{*}}{2^{32}}+\frac{{{\beta }^2}_2{U}^{*}}{r_2{N}^{*}}-\hfill \\ \frac{{{\beta }^2}_2{U}^{*}}{r_2{N}^{*}}+\frac{{{\beta }^2}_2{I}^{*}{U}^{*}}{r_2{N}^{*2}}\hfill \\ +\frac{{{\beta }^2}_2{M}^{*}{U}^{*}}{r_2{N}^{*2}}+\hfill \\ \frac{{{\beta }^2}_2(N^{*}-I^{*}-M^{*}){U_I}^{*}}{r_2{N}^{*2}}\hfill \end{array}\right)r_2\right\}(b_{11}+b_{33}),\hfill \\ D_{2-2}>\left\{\left(\begin{array}{c}\frac{{\beta }_1(N^{*}-I^{*}-M^{*})}{2^{32}}\hfill \\ +\frac{{\beta }_1{N}^{*}}{2^{32}}+\frac{{{\beta }^2}_2{I}^{*}{U}^{*}}{r_2{N}^{*2}}\hfill \\ +\frac{{{\beta }^2}_2{M}^{*}{U}^{*}}{r_2{N}^{*2}}+\hfill \\ \frac{{{\beta }^2}_2(N^{*}-I^{*}-M^{*}){U_I}^{*}}{r_2{N}^{*2}}\hfill \end{array}\right)r_2\right\}(b_{11}+b_{33}),\hfill \\ D_{2-2}>0,\hfill \end{array}\end{array}$$

as a result

$$\begin{array}{cc}\hfill D_2& >0.\hfill \\ \hfill D_3& =b_3(b_1{b}_2-b_0{b}_3),\hfill \\ \hfill D_3& =b_3\left(D_2\right),\hfill \\ \hfill & =(b_{11}{b}_{22}{b}_{33}-b_{12}{b}_{21}{b}_{33}-b_{13}{b}_{31}{b}_{22})\left(\right(b_{11}+b_{22}\hfill \\ & +b_{33})(b_{11}{b}_{22}+b_{11}{b}_{33}+b_{22}{b}_{33}-b_{12}{b}_{21}-b_{13}{b}_{31})\hfill \\ & -b_{11}{b}_{22}{b}_{33}+b_{12}{b}_{21}{b}_{33}+b_{13}{b}_{31}{b}_{22})\hfill \\ \hfill & =(b_{11}{b}_{22}{b}_{33}-b_{12}{b}_{21}{b}_{33}-b_{13}{b}_{31}{b}_{22})D_2,\hfill \\ \hfill & >(b_{11}{b}_{33}-b_{13}{b}_{31})b_{22}{D}_2,\hfill \end{array}$$

The positivity of the expression $b_{11}{b}_{33}-b_{13}{b}_{31}$ for $R_0>1$ is already proved for the case $D_2$; therefore, $D_3>0$.

Thus, all the values of $D_1$, $D_2$ and $D_3$ are positive, so all the eigenvalues of the Equation (36) are negative, for $R_0>1$. This proves that the endemic equilibrium point $K^{*}$ is locally asymptotically stable. The proof of theorem is completed. □

5. Simulation and Results

In this section, the results of numerical simulations for FO-SVM are presented to understand the dynamics of virus spread in a critical network infrastructure in the presence of removable storage connectivity, which may compromise the air-gap between the networks. Numerical experimentation is conducted for the designed FO-SVM as given in Equation (9) for a different variation in parameters and initial start-up scenarios, as given in

Table 1. Values of parameters used in model simulation for different scenarios.

Parameter	Case 1	Case 2	Case 3	Case 4	Case 5	Case 6	Case 7	Case 8	Case 9
$A_1$	0.042	0.042	40	100	5600	5600	5600	412	5600
$A_2$	0.042	0.042	45.7	60	412	412	412	5600	412
${\beta }_1$	0.6	0.4	0.385	0.4	0.4	0.4	0.745	0.4	0.4
${\beta }_2$	0.6	0.8	0.795	0.635	0.745	0.745	0.4	0.745	0.004
$\rho$	0.00265	0.0051	0.001	0.009	0.021	0.8	0.021	0.021	0.021
$r_1$	0.1126	0.19	0.0804	0.1598	0.1276	0.0804	0.1276	0.1276	0.1276
$r_2$	0.0088	0.027	0.027	0.027	0.0131	0.0131	0.0131	0.0131	0.0131

and

Table 2. Starting values of variables used in the simulation of different scenarios.

Variables	S	I	M	${\mathit{U}}_{\mathit{S}}$	${\mathit{U}}_{\mathit{I}}$
Case 1	$2.3\times {10}^6$	10,000	10	50,000	10,000
Case 2	$2.3\times {10}^6$	30,000	10	50,000	10,000
Case 3	$2.3\times {10}^6$	30,000	10	30,000	10,000
Case 4–9	$2.3\times {10}^6$	30,000	10	30,000	5000

, respectively. The dynamic behavior of the fractional order (FO) model is studied by varying the non-integer order derivative $\alpha$. Most FO differential systems lack exact analytical solutions, so the numerical solver based on Grunwald–Letnikov (GL) procedure, as described in Section 2 is exploited for an approximate solution to the model. The security firms, including Symantec, tracked 100,000 infected computers as of 29 September 2010, in the world. Additionally, available real data are used to validate the accuracy and convergence of the model for the Stuxnet virus spread. The virus infects approximately 100,000 users from 155 different countries, and 63% were only in Iran. Due to this attack, the number of hosts that lost functionality (hardware connected to these hosts was damaged due to sudden increase in frequency of up to 1410 Hz, which then decreased to 2 Hz and increased to 1064 Hz in spite of the normal working range of from 807 Hz to 1210 Hz) due to virus attack. A virus operates the machines connected with the hosts at an extreme range of frequencies dictated by Stuxnet and caused physical damage to 1500 centrifuge machines (approximately 1200 in Iran only). Approximately 3280 unique samples and variants of the Stuxnet virus were recorded by Symantec and other security corporations [3,6,55].

In order to establish the working accuracy of GL-based numerical solvers, the results of the scheme are compared with state-of-the-art numerical solvers based on the Runge–Kutta (RK) method for the value of $\alpha$ = 1. The results are determined for nine cases of integer order models (9) by a GL-based computing technique for inputs $t\in [0,60]$ with step size h = 0.001 (time t represents months). Numerical solutions to the model for the same inputs are also calculated by the RK method for each variation. Figure 3 highlights the comparison of model behavior with Stuxnet virus real-world data. FO-SVM model results shown in Figure 3 are calculated using the RK method to assume the value of fractional order $\alpha$ = 1.

In Figure 3, the number of hosts versus time in months is plotted, which shows the effect of the Stuxnet attack on the number of hosts as time passes.The number of infected hosts is 96,760 (real infected host number was 100,000), and the number of damaged hosts is 1500 (real damaged host number was 1500) in 23 months time, which shows the model accuracy for real-world virus data, as shown in Figure 3, with red and blue dots, respectively. In this case, removable media are considered to be 60,000, and, after increasing the number of removable-storage media, infection in the host nodes also increases (96,760 after 23 months).

The number of infected removable-storage devices is 43,740 in 23 months, and in 24 months, the time number of infected devices increases to 44,920. An increase in the number of damaged hosts is observed after the increase in infected hosts in 24 months’ time. This highlights the role of removable-storage media in spreading the infection in isolated critical networks in the absence of any remedial strategy in the model. Stuxnet is an advanced, persistent threat (APT) type of malicious code that penetrates in the remote system in a quasi-autonomous fashion. Then, a 23-month decline in the number of infected hosts is observed due to the availability of remedial technique and other controlling mechanisms. However, the Stuxnet virus was carried by removable-storage media spreads in other·networks.

In Figure 4, the solutions to the RK method with GL solver is compared with an error analysis of susceptible hosts S: a and b for cases 2 to 4, c and d for cases 5 to 7, and e and f for cases 8 to 10. Comparisons of results from both the RK numerical solver and GL-based method (for fractional-order $\alpha$ = 1) are presented for susceptible hosts S in nine cases. The error analysis, based on the absolute difference between the two approaches, is also plotted in Figure 4 to assess closeness. The results show a matching of both solutions of up to three decimal places of accuracy. The small errors in these plots show that the results of the GL method are in good agreement with the standard RK numerical technique, which establishes the working accuracy of the GL-based solver. In Figure 5, the solution of the RK method with the GL solver is compared in the case of infected hosts I and damaged hosts M: a and b for cases 1 to 3, c and d for cases 4 to 6, and e and f for cases 7 to 9. Figure 4 compares solutions for the RK method with GL solver in case of susceptible and infected removable-storage media: a and b for cases 1 to 3, c and d for cases 4 to 6, and e and f for cases 7 to 9. In Figure 5 and Figure 6, the solution of the RK method with a GL solver are compared and presented for infected nodes I, damaged node M, susceptible removable-storage media $U_s$ and infected removable-storage media $U_I$, respectively, for nine model cases.

These nine cases also explain the virus spread behavior in different scenarios. Considering Figure 4, Figure 5 and Figure 6, and the different cases simulated, we have the following comments.

The effect of changing the infectious contact rate ${\beta }_1$ from 36.6% to 60% is highlighted in case 1 of Equation (9) (value of ${\beta }_1$ in Figure 3 is 36.6%). It is observed that the number of infected hosts in 24 months is 96,760, as shown in Figure 5a (in Figure 3, the number of infected hosts in 24 months is 96,270), which shows a slight increase in infected hosts due to ${\beta }_1$. In case 2, the number of initially infected hosts is assumed to be 30,000. Increasing the contact rate of infectious removable media (in case 2) reduces the number of susceptible hosts rapidly as compared to case 1 (Figure 4a). However, the number of infected hosts is reduced (Figure 5a) due to an increase in the natural removal rate of hosts and removable storage $r_1$ and $r_2$ (hosts are removed to save them from the Stuxnet attack). In case 3, we reduce the damage rate and the quantity of initial susceptible removable-storage media, which reduces infected removable-storage media number (Figure 6b) and increases the infected hosts, as in Figure 5a). A decrease in damaged hosts is observed in case 3, despite the increase in the number of infected hosts.

In case 4, FO-SVM model dynamics are observed by increasing the arrival rate of new nodes and the arrival rate of new removable-storage devices, as mentioned in Table 1 and Table 2. The results show that increasing the arrival rate of new hosts and arrival rate of new removable-storage media will not spread the infection faster without the presence of a sufficient number of infected removable-storage devices, as shown in Figure 5c. In cases 5 and 6, we further increase the values of the arrival rate of new nodes as well as removable-storage devices for an in-depth behavior analysis of the model. Both cases have similar parameters, except case 6, which represents a higher damage rate (especially for zero-day vulnerability or for a new virus attack) that increases the number of damaged computers and reduces the number of infected computers (removed due to high damage rate) in the networks as compared to case 5. Case 5 shows the high number of infected nodes (Figure 5c) because the Stuxnet virus only destroys the machines with specific hardware (Siemens specific PLCs) and remains dormant till it finds the target. In case 6 (Figure 5c,d), the number of infected hosts decreases; however an increase in the number of damaged hosts is observed due to an increase in damage rate $\rho$.

In case 7, the values of ${\beta }_1$ and ${\beta }_2$ of case 6 are swapped to observe the behavior of the model. In case 7, the value of ${\beta }_1$ = 0.745, as compared to 0.4 in case 6, and the value of ${\beta }_2$ = 0.4, as compared to 0.745 in case 6. These swaps are carried out to observe the devastation effect of infected removable storage media as compared to the effect of infected nodes in the model, because infected removable media have a greater devastation effect. Simulation results show that the number of damaged nodes in case 6 is 35,000, whereas, in case 7, it is 5000, due to a decrease in the value of ${\beta }_2$ infectious contact rate of removable storage media (Figure 5e).

However, by increasing ${\beta }_2$ value (removable-storage media’s infectious contact rate with susceptible computers) and $A_2$ (the arrival of removable-storage media) for case 8 will also increase the infection in the network. This outlines the importance of removable-storage media in spreading the virus in air-gapped networks (Figure 5e). In case 9, the contact rate of susceptible computer nodes with infectious removable-storage media ${\beta }_2$ is reduced, which results in a reduction in damaged nodes (Figure 5f) and infected nodes (Figure 5e), and an increase in the number of susceptible storage devices (Figure 6e). Case 9 further elaborates the scenario presented in case 8.

The derivative order $\alpha$ = 1 is presented in Figure 4, Figure 5 and Figure 6. The effect of change in fractional order $\alpha$ is presented in Figure 7, Figure 8, Figure 9, Figure 10 and Figure 11. A detailed analysis of the FO-SVM model is conducted by changing the fractional order $\alpha$ in the system (9), such that one may observe fast-changing as well as super-slow growth in the model dynamics. The fractional order solution of the FO-SVM model for different values of the fractional order $\alpha$ is solved using a GL-based solver. The solutions are determined for nine cases of FO-SVM by a GL-based numerical procedure for different fractional orders, i.e., $\alpha$ = [0.5, 0.75, 0.8, 0.85, 0.9, 0.95, 1], for the inputs $t\in [0,60]$ with step size h = 0.001. Results for the dynamics of the FO-SVM model in terms of susceptible S, infected I, and damaged M computers are plotted in Figure 7, Figure 8 and Figure 9 for cases 1–3, 4–6, and 7–9, respectively. Susceptible removable-storage media $U_s$ and infected-removable-storage media $U_I$ are plotted in Figure 10 and Figure 11 for cases 1–4 and 5–9, respectively, for different values of the fractional order $\alpha$.

Figure 7 shows a simulation of fractional order, i.e., $\alpha$ = [0.5, 0.75, 0.8, 0.85, 0.9, 0.95, 1] for the FO-SVM model for different values of fractional order $\alpha$ for case 1–3 of susceptible S, infected I and damaged hosts M. In Figure 7, the number of susceptible, infected and damaged hosts is plotted versus time for cases 1–3 for different values of $\alpha$ = [0.5, 0.75, 0.8, 0.85, 0.9, 0.95, 1]. A consistent pattern is observed in the evolution of curves with the value of $\alpha$. The value of infected hosts in case 1 with $\alpha$ = 1 is 96,760, and for $\alpha$ = 0.95, the value of infected hosts is approximately 56,000 for t = 24 months, as shown in Figure 7b. In Figure 7c, the number of damaged hosts (hosts that were connected with specific models of Siemens PLCs) for the value of $\alpha$ = 0.95 are 1000 for t = 30. Adjusting the value of $\alpha$ to 0.98 may adjust the number of damaged hosts to 1500, which matches the real published data of the Stuxnet virus. This illustrates the controllability feature of $\alpha$ for tuning the model. Despite the rapid spreadability of the Stuxnet virus, it causes little or no harm to the systems that do not have specific hardware.

Figure 8 shows the simulation of fractional order dynamics of the FO-SVM model for different values of fractional order $\alpha$ for cases 4–6, and Figure 9 depicts the simulation of fractional-order dynamics of the FO-SVM model for case 7–9. Figure 8 and Figure 9 highlight the results for variation in fractional order $\alpha$, which shows that variation in $\alpha$ gives smooth variations in the dynamics of the model. For $\alpha$ = 0.1, we have the slowest evolution. Simulation of fractional order dynamics of FO-SVM model for different values of fractional order $\alpha$ for case 1–5 of susceptible removable-storage media $U_s$ and infected-removable-storage media $U_I$ are illustrated in Figure 10. Figure 11 shows the simulation of fractional order dynamics of FO-SVM model for different values of fractional order $\alpha$, for cases 5–9 of susceptible removable-storage media $U_s$, and infected-removable-storage media $U_I$. In Figure 10 and Figure 11, the number of susceptible storage media and infected storage media is plotted for case 1–9 against the time variation for different values of fractional order $\alpha$ = [0.5, 0.75, 0.8, 0.85, 0.9, 0.95, 1]. It is observed that tuning the values of $\alpha$ tunes the dynamics of transients, as shown in Figure 10a. The value of susceptible storage media for t = 1 and $\alpha$ = 0.95 is 35,000, which is effectively reduced to 10,000 by a slight change in fractional order $\alpha$ from 0.95 to 0.8. In contrast, a slow change is observed in the dynamics of the FO-SVM model for $\alpha$ = 0.1. Increasing the fractional order $\alpha$ increases the rate of change of the variables. Fractional-order virus models provide extra tunable parameters in the form of $\alpha$, which highlight more minute changes in the model dynamics.

6. Conclusions

A detailed analysis of the novel design of the fractional order Stuxnet virus model is presented, with richer dynamics for the transmission of virus spread in an isolated critical network through removable-storage media. The fractional-order Stuxnet-virus-based mathematical models are found to be at least as stable as integer-order models. The fractional order value $\alpha$ of the proposed fractional Stuxnet virus model more effectively controls the solution reachability towards a steady state point. Additionally, the fractional order system of the Stuxnet virus model can tackle the different responses, including super-slow evolutions and very fast transients; these responses are found to have long memory characteristics in the system. Taking the value of $\alpha$ = 0.98, one may adjust the number of damaged hosts to 1500 in case 1, which matches the damage caused by the Stuxnet virus. The transformation process of the classical model into a fractional model is very sensitive to the value of the order of differentiation $\alpha$, and can be converted to a simple SIR model if we choose the values of the infectious contact rate ${\beta }_2=0$. A theoretical analysis of the model capturing the Stuxnet virus-spreading characteristics is determined by a mathematical derivation of the basic reproduction number $R_0$ for the value of $\alpha$ = 1. Equilibrium points of the model are globally and asymptomatically stable for $R_0<1$ and $R_0>1$, respectively.

In the future, one may exploit the strength of stochastic numerical solvers [56,57,58,59,60,61] based on fractional evolutionary and swarming techniques [62,63,64,65,66,67] for a detailed analysis of the designed fractional-order Stuxnet virus model. Additionally, new definitions of the fractional operator, such as Yang–Machado [35] and Yang–Abdel–Aty–Cattani [36] fractional derivatives looks promising for the development of new computing solvers for the numerical solution of the fractional-order Stuxnet virus model and other fractional-order systems with better theoretical justifications, a better applicability domain, proof of the accuracy, convergence, stability, and robustness.