Evolutionary virus immune strategy for temporal networks based on community vitality

Future Generation Computer Systems (

)

–

Contents lists available at ScienceDirect

Future Generation Computer Systems journal homepage: www.elsevier.com/locate/fgcs

Evolutionary virus immune strategy for temporal networks based on community vitality Min Li a , Cai Fu a,∗ , Xiao-Yang Liu b , Jia Yang a , Tianqing Zhu c , Lansheng Han a a

Computer School, Huazhong University of Science and Technology, Wuhan, 430074, China

b

Computer School, Shanghai Jiao Tong University, Shanghai, 200240, China

c

Information Technology School, Deakin University, Burwood, Victoria, 3125, Australia

highlights • Community vitality is used to analyze the evolutionary characteristics of temporal networks. • A better virus immune strategy is proposed for temporal networks based on Community vitality. • Theoretical analysis and real temporal community network datasets are used to verify the effectiveness of immune strategy.

article

info

Article history: Received 2 October 2015 Received in revised form 2 May 2016 Accepted 11 May 2016 Available online xxxx Keywords: Community vitality Evolutionary virus immune strategy Temporal networks

abstract Preventing viruses spreading in networks is a hot topic. Existing immune strategies are mainly designed for static networks, which become ineffective for temporal networks. In this paper, we propose an evolutionary virus immune strategy for temporal networks, which takes into account the community evolution. First, we define a new metric, community vitality (CV), to quantize the evolution characteristics of communities. Second, based on the community vitality, we propose an immune strategy which selects an optimized number of initial nodes according to node influence (NI). Third, a theoretical analysis is proposed to measure the immune effect of the evolutionary immune strategy. Compared with the random immunization, the targeted immunization and the acquaintance immune strategy, we show that the proposed strategy has a much larger coverage, i.e., more nodes will have immune ability given the same number of initial immune nodes. © 2016 Elsevier B.V. All rights reserved.

1. Introduction Given that viruses are ubiquitous in networks and cause significant financial losses every year, the prevention of virus propagation on network communities is important. Viruses have become increasingly prevalent because of the mobile network [1] and the social network [2] development. Various new viruses cause many immunization problems. Therefore new immune methods need to be urgently developed. Existing immune methods are insufficient in temporal networks, which are networks that change over time. Various viruses break network usability and reliability. Hence, virus defenses are becoming increasingly complex and important with increasing virus types.

∗

Corresponding author. E-mail address: [email protected] (C. Fu).

http://dx.doi.org/10.1016/j.future.2016.05.015 0167-739X/© 2016 Elsevier B.V. All rights reserved.

The immune strategy is a major part of defense approaches. Two traditional immune strategies are applied to prevent virus propagation. Random immune strategy. The random immune strategy is also known as the uniform immune strategy. In this strategy, a given number of initial nodes are randomly selected to plant immune vaccines. The remaining nodes are immunized by propagating the initial immune nodes. This immune strategy does not consider the specific network structure. The random immune strategy is convenient and operable for large and complex networks with overall network structures that are hard to determine. This strategy is robust against the loss of immune nodes for a dynamic network because the immune vaccines are randomly planted. For example, Hu [3] proposed immunization for scale-free networks [4] by random walker, which can lead to the eradication of the epidemic by immunizing a small fraction of the nodes in the networks. However, this random strategy is insufficient for immune route disappearance.

2

M. Li et al. / Future Generation Computer Systems (

Targeted immune strategy. The targeted immune strategy is also known as the selected immune strategy. The targeted immune strategy highlights network node differences. The targeted immune strategy selects a certain number of nodes to meet some requirements according to the node properties or network structural attributes. For example, nodes with the maximum degree are selected to plant immune vaccines. Other immune routes are still present if some immune routes disappear because the node with the maximum degree has been chosen. However, this strategy is not robust against immune node loss. Many propagation routes would disappear if the selected immune nodes are lost. Acquaintance immune strategy. Traditional acquaintance immunization randomly chooses a node and randomly immunizes one of its neighbor nodes. Little information about networks is required, but randomly immunizing neighbor node is of blindness and is not efficient enough to protect important nodes, especially to some particular network topology. The strategy requires no knowledge of the node degrees or any other global knowledge, as do random immune strategy. Traditional acquaintance immune strategy is a special random immune strategy. For example, Pan [5] proposed a modified acquaintance immune strategy, which picks up the common neighbor of the randomly chosen nodes in the network. Koohborfardhaghighi [6] proposed one node at one step discovery process as an immunization strategy. In his work, they exploited the idea of acquiring partial information with the help of each node’s direct contacts. Therefore, they proposed summarization of information related to neighborhood of each node in their algorithm. This immune strategy essentially combined the targeted immunization, random immunization and acquaintance immunization. However, they also put all immune vaccines at the first time slot and overlooked the evolutionary characteristics of temporal network. In some extreme condition, all immune nodes may be disappeared at the next time slot. Therefore, these immune strategies will be ineffective in this temporal network. These traditional immune strategies are unsuitable for temporal networks because the temporal network structure changes over time. Unlike traditional static networks, the dynamic characteristics of temporal networks will lessen the immune effect of the traditional immune strategy. The strategy designs for temporal networks face two challenges. First, some immune nodes may disappear when nodes join or leave networks, i.e., immune sources are lost. Second, some immune routes can disappear when the network structure dynamically changes over time. The disappearance of edges disconnects some propagation routes. The community structures are reconstructed with the addition or deletion of edges and nodes, which means the foundation of the immune strategy also vanishes. The existing immune strategies cannot perfectly solve the two abovementioned challenges. The immune effect is poor even though they can be used for temporal networks. In this example, some nodes are disappeared and some are created when the immune source is limited at time slot t + 1. Node 5 is immunized at previous time slot t − 1. After a time slot, node 3, 4, 5, 6 are immunized. However, with the network dynamically changing, immune node 3, 4, 5, 6 are disappeared, and there are no immune nodes on the time slot t + 1. No nodes can be immunized if all immune nodes of time slot t disappear on time slot t + 1. Moreover, the immune process will be terminated if all immune routes are lost. Traditional strategies are invalid in these occasions. The network evolution process needs to be observed and quantified to solve the disappearance of immune routes and the loss of immune vaccines. A metric is needed to represent the community status and depict the network evolution process. On the basis of the required metric and the limited immune vaccines, we propose a novel immune strategy that is suitable for temporal

)

–

Table 1 Propagation notations. Variable

Definition

n p st rt Nti Nt kti ⟨kt ⟩ CV (t , q) 1CV j

The total number of immune vaccines The probability of adding or reducing a node The rate of susceptive nodes on time slot t The rate of immune nodes on time slot t The number of nodes for a kind of degree on time slot t The total number of nodes on time slot t A kind of the degree on time slot t The average degree of all nodes on time slot t The community vitality for community q on time slot t The community vitality changing rate of community j

networks and decide how to plant limited immune vaccines in suitable communities and time. We should also analyze and verify the immune effect of the proposed immune strategy. This study tackles the following problems: (1) How to define a metric to quantize the community evolution. (2) How to design a specific immune strategy according to the network evolution indicators. (3) How to theoretically analyze and verify the immune effect. This paper presents a strategy for temporal community networks. We observe that community vitality (CV) is an important metric that can reflect network evolution. We design a new strategy for temporal networks on the basis of CV to solve the first problem. We also choose some communities with large CVs to plant the immune vaccines. We apply the coverage ratio to evaluate the effectiveness of immunization for the third problem. The main contributions of this study are as follows: (1) We introduce a new metric, namely, the CV, to present the community evolution. (2) We propose an immune strategy according to the CV. This strategy selects an optimized number of initial nodes with the greatest NI. We design a practical algorithm to realize this evolutionary virus immune strategy. (3) We propose a theoretical analysis to analyze the propagation scope of immune nodes in temporal community networks. The remainder of this paper is organized as follows: Section 2 provides the background knowledge and introduces the common immune strategies; Section 3 presents the new metric (i.e., CV); Section 4 describes the evolutionary virus immune strategy; Section 5 presents the quantitative analysis of the vaccine propagation speed; Section 6 provides the evaluations; Section 7 draws the conclusions. 2. Background 2.1. Notation The immune strategy is analyzed by first defining the propagation factors. Table 1 denotes all propagation notations. 2.2. Community network model The proposed immune strategy is designed for temporal community networks. The community structure is related to the properties of the small world, as well as high aggregation and distinct structure. The network community structure reflects the features and functions of the network. A whole network can be divided into several communities. A community is a group of tightknit nodes with many internal connections. Several communities form a social network. Let G = (V , E ) be an undirected and unweighted graph representing a network, where V is the set of N nodes, and E is the set of M edges.

M. Li et al. / Future Generation Computer Systems (

Let G0 = (V0 , E0 ) be the initial network and Gt = (Vt , Et ) be a time dependent network at time t. Let m and n be the number of edges and nodes, respectively. Let 1Vt and 1Et be the sets of nodes and edges to be added to or removed from the network. Let C = {C1 , C2 , . . . , Ck } be the community structure, (i.e., a collection of a subset of V where each Ci ∈ C and its induced subgraph forms a community of G). 2.3. Virus propagation The virus propagation model stems from the propagation characteristics of biological viruses. Network nodes come into contact with other nodes and spread immune vaccines or viruses by the conjoint edges. Susceptible nodes will be infected with a certain probability if they contact with infected nodes. Infected nodes will be immunized with a certain probability if they come into contact with immune nodes. The most representative spread models include the SIS model [7] proposed by Kephart and White in 1993, the SIR model extended from the SIS model, the SEIR model [8] and the SIDS model [9]. Some scholars have established a propagation model from other perspectives. Shui [10] proposed a strict two-layer model and indicated that the distribution of malware followed an exponential distribution. Eshghi [11] used the maximal principle of Pontryagin, obtained a plate-like malware propagation model, and considered the network structure of industrial cluster and mobile contact utilization. This model also used an optimized patch management to reduce the virus propagation cost. 2.4. Related work Virus immunization is always a hot topic in the network security field. The targeted immunity [12], random immunity and acquaintance immunity are the most basic immune strategies. In recent years, academic research on virus immunization has been performed in the propagation characteristics of the virus, network structure of virus propagation and dynamic characteristics of the spreading network. Accordingly, some propagation models and immunization strategies have been proposed. Considering the virus infection characteristics, Yan et al. [13] presented a detailed analytical model that characterized the propagation dynamics of Bluetooth worms. This model captured not only the behavior of Bluetooth protocol but also the impact of the mobility patterns on Bluetooth worm propagation. As regards the smart phone malware field, the short history of the mobile malware evolution and their infection vectors can be found in [14]. Zhou et al. believed that the popularity and adoption of smart phones had greatly stimulated the spread of mobile malware, especially on the popular platforms (e.g., Android) [15]. Wang et al. found that Bluetooth viruses spread slowly because of human mobility but can reach all susceptible handsets with time, thereby offering ample opportunities for the deployment antiviral software [16]. Hari et al. investigated the problem of optimally distributing content-based malware signatures, which help detect the corresponding malware and disable further propagation, to minimize the number of infected nodes [17]. In addition to the abovementioned bodies of research, the control theoretic approach and game theory have also been used to analyze the spreading virus and obtain the containment policy in [18,19]. In addition to the virus infection characteristics, network structure features are also important factors in virus immunization [20,21]. These studies can generally be classified into two categories. The first category is for the traditional static networks. Shin investigated the massive worm Conficker and showed that neighbor supervision is an effective method for restraining propagation; the security alert sharing or association (especially

)

–

3

for the adjacent network) was also an effective method [22]. Youssef and Scoglio proposed an optimized control framework to slow down virus propagation. The network in this framework was modeled as an undirected graph with nodes and weighted links [23]. Some immune strategies considered the dynamic characteristics of viruses. The defense method should combine the system immune ability and network structures when many viruses attack [24]. If the system performance is a key factor, the Metropolis sampler and encounter based distributed algorithm has an effective virus defense result [25]. However, such methods are invalid when the network topology changes during the immune process. The second category is for the dynamic networks (e.g., mobile networks [26] and social networks). Jackson [27] studied the scenario of heterogeneous Bluetooth networks and discussed the effects of human behavior on virus propagation. The maximal principle of Pontryagin was used to obtain a plate-like malware propagation model. The model considered the network structure of industrial cluster and mobile contact utilization. The model also used optimized patch management, which reduced the virus propagation cost [11,28]. Jie [29] used a set of mobile agents to remove black viruses. From an abstract vicious code perspective, Chao [30] proposed a two-layer network model by Bluetooth and by message imitation. He also provided two strategies, namely the immunization and the automation of computing. In addition to the abovementioned networks, the wireless sensor networks have also attracted significant attention. The optimized epidemic models in [31,32] proposed temporal dynamics of the virus spreading process or the protocol communication patterns. The targeted immunity, random immunity and acquaintances immunity are the most basic immune strategies. For example, Hu [3] proposed a modified random immunization in scale-free network [4], which immunized a small fraction of the nodes rather than entire network structure. Pan [5] proposed a modified acquaintance immune strategy, which picked up the common neighbor of the randomly chosen nodes in the network. Koohborfardhaghighi [6] proposed summarization of information related to neighborhood of each node in their algorithm. This immune strategy essentially combined the targeted immunization, random immunization and acquaintance immunization. The social network is now a considerable virus propagation space [33]. Accordingly, the social communication software is the virus propagation source. Wen [34] proposed an e-mail virus propagation model. Yang [35] also proposed a clustering-based immune strategy that uses the structural property of social networks. This strategy identified nodes that connected multiple communities as the initial immune nodes. The community structures had become an important element in virus propagation. Zhang et al. [36] proposed a SEAIR epidemic network model with community structure, and Tunc et al. [37] studied epidemic spread on an adaptive network with community structure. Given that many real-world networks exhibit overlapping community structure, Shang et al. [38] classified vertices into overlapping and non-overlapping ones and investigated in detail how they affected the spread of epidemics. Current studies have been performed in many network fields. Furthermore, corresponding virus propagation models and immunization strategies have been proposed. However, the relationship between immune effect and evolution characteristic is still ambiguous in temporal networks. Quantifying the evolution process and deciding on the adaptive immunization are still challenging. The temporal network is a relatively young field [39]. The epidemic threshold in the temporal network field is always a key feature in virus propagation in [40]. Aditya [41] presented that the epidemic threshold for a network is exactly the inverse of the largest eigenvalue of its adjacency matrix. Aditya showed that the threshold depended on the first eigenvalue of

4

M. Li et al. / Future Generation Computer Systems (

the connectivity matrix. An infection propagator approach was proposed to compute the epidemic threshold accounting for more realistic effects regarding a varying force of infection per contact, the presence of immunity, and a limited time resolution of the temporal network. The immunization algorithms in time-varying networks had been discussed in [42]. Existing works mainly discuss the immune strategy on the basis of propagation and the defense measures on the basis of virus characteristics. However, these studies do not meet the fast development of mobile and social networks with evolutionary structures. A better immune strategy is proposed to meet the temporal characteristics. 3. Temporal community networks The evolutionary immune strategy is proposed for temporal community networks. The temporal social network is first defined before the immune strategy steps are discussed in detail. 3.1. Community network structure The existing descriptions of community structure [43] are mainly based on the static social network. Our immune strategy is proposed for the temporal social network. We expand the social network structure on the basis of intrinsic characteristics of the temporal social network. We also expand community structure definition to prove the immune effect of the proposed strategy. We use the CNM algorithm to partition communities for the initial structure of a temporal social network [44]. The CNM algorithm uses polymerized idea to split communities and creates an incremental matrix on the basis of modularity. The biggest community structure is obtained with changing incremental matrix. The CNM algorithm has less time complexity than other community partition algorithms. The CNM works toward the classification of the network nodes into different groups that are densely connected. Let G = (V , E ) denote the initial social network. We then obtain the network community structure. Let C = {C1 , C2 , . . . , Cc } be the community structure, (i.e. a collection of V subsets, where each Ci ∈ C and its induced subgraph forms a community of G). c is the number of initial communities. Each community has N0 nodes. Let 1Vt = (n1 − n2 )p. A node is added to a community with the probability p on each time slot, and this process runs for n1 times. A node is reduced in a community with the probability p, and this process runs for n2 times. The community is in a growth state if n1 ≥ n2 . The CV changing rate is greater than zero. Each node’s average degree is k, m edges are added to a node. Each edge is added in the community with the probability q. The total number of nodes is N1 = cN0 at the initial moment when t = 1. The degree distribution is as follows: N11 = cN0

and

k11 = k

(1)

where N0 is the number of nodes in a community, and k11 is the initial average degree of a node. N11 indicates that the cN0 nodes with the average degree k11 on the time lost t = 1. The c represents the number of initial communities. The total number of nodes is expressed as follows when t = 2 N2 = c [N0 + (n1 p − n2 p)].

(2)

All degree distributions will be expressed as follows:

 N21 = cn1 p and k21 = m       cn2 p  N22 = 1 − N11 and N1     k22 = N11 k11 − (1 + q)cn2 pk11 + mcn1 p . N22

)

–

The total number of nodes is calculated as follows when t = s: Ns = c × [N0 + (s − 1)(n1 p − n2 p)].

N = cn p and k = m s1 1 21      cn p  2   N(s−1)1 and Ns2 = 1 −   Ns−1     N(s−1)1 k(s−1)1 − (1 + q)cn2 pk(s−1)1 +   ks2 =    Ns2    N(s−1)1   mcn p 1  N(s−1)     Ns2

..   .       cn2 p   N(s−1)(s−1) and N = 1 −  ss   Ns−1     N(s−1)(s−1) k(s−1)(s−1) − (1 + q)cn2 pk(s−1)(s−1)   kss =    Nss    N(s−1)(s−1)   + mcn p 1  N(s−1)  × .

(5)

Nss

Some nodes and edges are added or deleted at each time slot. A new degree is subsequently created in this stage. The degree of the current time slot t is related to the degree of the former time slot t − 1. We use the degree of the former time slot t − 1 to add the increased edges and subtract the disappeared edges. We then obtain a new degree on the current time slot t. The distribution of all node degrees is listed. This distribution is used to analyze the immune effect, while calculating the coverage ratio of the immune nodes. As pointed out in the social network structure, we consider the temporal community graph in Fig. 1. We use two community networks to express the community evolution. Fig. 2(a) shows the three communities in this network. Some nodes are added or deleted after a period of time. Some communities also become large, whereas some communities disappear. Fig. 2(b) finally shows the existence of only two communities in this network. 3.2. Community vitality The CV concept [44] is used to quantify the life intensity of communities on every time slot. This metric is proposed for the temporal social network. In fact, a temporal social network mainly changes over changing nodes and edges. We propose the CV to better define the network evolution. A community’s CV is decided by the number of nodes, edges, and structure compactness in the community. Our immune strategy reaches three important factors to measure the temporal network evolution. We use a metric to combine the influence factors of nodes, edges, and structure compactness. The evolutionary immune strategy is based on the CV. We can quantize the community structure evolution according to this metric. We can also choose suitable communities to plant immune vaccines and continue to implement our strategy. However, traditional immune strategies are proposed for the static network. These strategies do not consider the network evolution. The CV has less meaning for the static network. Traditional immune strategies place all immune vaccines at the first time slot. Therefore, the CV is not considered. q The CV for community Ct on time slot t is defined as follows: CV (t , q) = ϖ1 Q + ϖ2 Nt + ϖ3 kNt

(3)

(4)

The degree distribution is as follows:

(6)

where Nt is the total number of nodes on time slot t, kNt is number of edges, and Q is the clustering coefficient. The clustering coefficient describes the node aggregation (i.e., network compactness).

M. Li et al. / Future Generation Computer Systems (

)

–

5

Fig. 1. Propagation of immune nodes in an extreme situation.

(b) Network at time slot t + 1.

(a) Network at time slot t.

Fig. 2. Temporal social network.

Therefore, node aggregation is an influence factor of CV. As regards the large clustering coefficient in a social network, nodes have more links in a community and less links between communities. ϖ1 , ϖ2 , and ϖ3 present the degree of importance for nodes, edges, and community structure to CV, respectively. All the parameters used in this paper (including ϖ1 , ϖ2 , and ϖ3 ) are decided by using the entropy method. The method can be used to determine the evaluation indicators of the arbitrary evaluation problem. It can also be used to remove indicators that have a slight effect on the evaluation result and objectively reflect the importance of every indicator. The clustering coefficient Q describes the aggregation degree of nodes (i.e., network compactness). Node 1 can connect with node 3 is possible if node 1 connects with node 2 and node 2 connects with node 3. The clustering coefficient of node i is calculated as follows: Q (i) =

E (i) ki (ki − 1)/2

.

E (i) is the number of edges for node i, ki is the degree of node i.

(7)

The average clustering coefficient of all nodes is the network clustering coefficient, which is expressed as follows: 1 

Q (i). (8) N N is the total number of nodes. A community’s state and changing degree are directly quantified using the proposed community validity changing rate (CVCR). The CVCR shows a community’s structure change degree between the consecutive time slots. The CVCR is calculated as follows: Q =

p

q

1CV (Ct −1 , Ct ) =

CV (t , q) − CV (t − 1, p) CV (t − 1, p)

.

(9)

The CVCR is further used to show the community evolution trend, and to predict the community status on the next time slot. The evolutionary virus immune strategy needs to consider how the community changes over time and how the community influences the entire network at the current time. Therefore, we need to consider the CV and the CVCR indicators.

6

M. Li et al. / Future Generation Computer Systems (

4. Evolutionary virus immune strategy We propose an evolutionary immune strategy based on the CV of the temporal community structure. We separately plant limited immune vaccines during several initial time slots. Our strategy mainly solves the allotment of immune vaccines to obtain the best immune effect. Therefore, we use the CV and the Node Influence (NI) to evaluate the community and the node, respectively. We then choose a certain number of nodes with high NI in selected communities to plant immune vaccines. This strategy is suitable for the temporal community structure. The main highlights of our immune strategy are the selection of strong communities on the basis of CV and the selection of nodes on the basis of node influence (NI) in selected communities to plant limited immune vaccines. We will introduce the specific steps of our immune strategy in the sections that follow. This immune strategy tends to accelerate the propagation velocity of immune nodes fast. An assumption that the immune vaccines are limited exists. We select an optimized number of initial immune nodes with greatest NI. We will successively provide immune vaccines starting from the time slot t. The provided times are called h times. We have a total of n immune vaccines. We provide the number of vaccines each time as nt , nt +1 , nt +2 , nt +3 , . . . nt +h−1 . These numbers satisfy nt + nt +1 + nt +2 + nt +3 + nt +h−1 = n. The strategy has the following steps: (1) The CVs of all communities are calculated. (2) All communities are divided into three levels. (3) The number of immune vaccines in each level is calculated, and some immune communities with large CVs are chosen in each level. (4) The nodes with great influence in selected communities are chosen and a given number of immune vaccines are planted in these nodes. Step 1. The community structure is first obtained. Each community’s CV t +i on the time slot t + i (i represents the ith immune vaccines planted) is then computed. We obtain each evolutionary process of the community before the time slot t +i+1. We then calculate all CVCR 1CV t +i according to Eq. (7) before the time slot t + i + 1. Subsequently, we fit the CVCR curve according to all CVCRs 1CV t +i . We then predict the changing trend of the CV for a community on the next time slot. Consequently, this time slot is prepared for the selection of the immune community. The specific curve is decided by the specific experiment datasets. Step 2. All communities are divided into three levels, namely L1 , L2 , and L3 , j according to the CV t +i and the 1CV t +i . The jth community Ct +i ’s level is calculated as follows:

j

C t +i

 L1 ,    L , = 2  L ,   2 L3 ,

j

j

if CV t +i ≥ T and 1CV t +i ≥ 0 if if if

j CV t +i j CV t +i j CV t +i

≥ T and 1CV jt +i < 0 < T and 1CV jt +i ≥ 0 < T and 1CV jt +i < 0.

(10)

j

1CV t +i represents the CVCR of community j on time slot t + i + 1. T is defined as the CV threshold, which depends on the partition method of the communities. This partition method is decided according to all CVs. This value is adjusted according to the specific network characteristics, and represents the stability of a network community structure. T is closer to the CV average value when the community structure is uniform. The T value can be larger than the CV average value when the minority community structures are large. Step 3. We divide all communities into three levels according to the two previous steps. We then need to plant the limited immune

)

–

vaccines into these three levels. The number of immune vaccines in each level is first decided. The total number of immune vaccines nt +i is divided into n1l t +i , 2l nt +i and n3l with the percentage of p = [ p , p , p ] . They are the 1 2 3 t +i number of immune vaccines in the three community levels. 2l 3l n1l t + i + nt + i + nt + i = nt + i .

(11)

The number of immune vaccines (IV) for the jth community in the kth level Lk is calculated as follows based on the previous calculations: NC j

= nkt+i ×

IV C j

t +i

NC j

t +i

Nk

.

(12)

represents the number of community j’s nodes on time slot

t +i

t + i. Nk represents the total number of entire the Lk level’s nodes. Some communities cannot be allocated immune vaccines in this process. We preferentially choose some communities with the large CVs. We then plant a given number of immune vaccines in the selected communities. Step 4. We select suitable communities on the basis of step 3. We should then decide which nodes should have immune vaccines after the immune community is determined. We j subsequently calculate the (NI) of all nodes for community Ct +i on the time slot t + i. All the selected community nodes’INs can be sorted in descending order. We then plant immune vaccines in the beginning IV Cj of the infected nodes with the greatest NI. The NI of a node indicates the importance of the node in its community. A node with greater NI can attract a new connection p with larger probability. Let a community on time slot t be Ct . The node ID is denoted by 1, 2, . . . , n and the degree of nodes is denoted by d1 , d2 , . . . , dn . The influence of node i is calculated as follows: p

NI (i, Ct ) =

di n 

.

(13)

dj

j =1

This immune strategy still needs to be optimized. The immune community has 100% immune nodes after the propagation of previous time slots under some conditions. Therefore, planting immune vaccines in this community is necessary. We consider planting the immune vaccines in other communities to reduce the immune time and cost. We divide all communities into three levels on the basis of CV and CVCR. We calculate the number of immune vaccines on each level, and select communities with large CVs. We then plant immune vaccines in nodes with large NIs in those selected communities. The proposed immune strategy mainly answers the problem of how to continuously plant limited immune vaccines in optimal nodes. Therefore the propagation of immune nodes has better performance. The evolutionary immune strategy obtains a better immune effect for temporal networks. This strategy also deals with the disappearance of immune routes and the loss of immune nodes. We use two algorithms to show our immune strategy and its immune effect. The algorithm of our immune strategy is shown in Algorithm 1, which introduces the process of planting limited immune vaccines during initial m time slots. We use Algorithm 2 on the basis of the prerequisite of putting all immune vaccines to calculate, the number of immune nodes in each time slot. The time and space complexities of our immune effect are O (n). 5. Immune effect analysis The previous sections introduce the strategy steps. In this section, we use theoretical analysis to verify the immune effect of the evolutionary immune strategy.

M. Li et al. / Future Generation Computer Systems (

Algorithm 1 Immune strategy Require: 1: Input: 2: Social network C = C1 , C2 , ..., Ck ; 3: The provided frequency of immune vaccines is m; 4: for i ∈ [1 : m] do 5: The CV and CVCR of all communities are calculated: 6: CV (t , q) = ϖ1 Q + ϖ2 Nt + ϖ3 kNt . CV (t ,q)−CV (t −1,p) . 7: CVCR(t , q) = CV (t −1,p) 8: All communities are divided into three levels: 9: if CV ≥ T and CVCR ≥ 0 then 10: These communities in level 1. 11: end if 12: if (CV < T and CVCR ≥ 0)||(CV ≥ T and CVCR < 0) then 13: These communities in level 2. 14: end if 15: if CV < T and CVCR < 0 then 16: These communities in level 3. 17: end if 18: Calculate the number of immune vaccines in each level: N j

19:

IVC j

t +i

20: 21: 22: 23: 24: 25:

= nkt+i ×

C

t +i Nk

.

The CVs for the three levels are sorted; All NIs are calculated and sorted; Communities with great CVs are selected on each level; Immune vaccines are put in nodes with great NIs for selected communities; Output: nodes that are planted immune vaccines. end for

Algorithm 2 Immune effect Require: Input: 2: Initial social network C(0); A constant m (as the same with Algorithm 1); 4: loop Increased n nodes and m edges; 6: if i < m then Form a new community structure of current social network; 8: Use Algorithm 1 to put immune vaccines; i + +; 10: end if for Walk all community nodes do 12: if nodes are connected with the immune nodes then nodes are immunized; 14: end if end for 16: Output: the number of immune nodes. end loop All nodes are immunized. 5.1. Strategy parameters Our immune strategy has three important parameters: (1) Number of immune vaccines; (2) CV; (3) NI. Parameter 1. The number of immune vaccines will be decided by successively planting immune vaccines to meet the community evolution. We are able to supplement the immune node by using this method when the immune node leaves the network in the next time slot t. We can then immediately adjust the immune situation after the number of immune vaccines on the several initial time slots is decided and when the immune effort is insufficient.

)

–

7

Parameter 2. The CV and CVCR are used to choose suitable communities in the evolutionary immune strategy. We choose the community with a larger CV, more nodes, or a closer community structure according to CV and CVCR. The immune node is more likely to move between those communities, or the community has a longer life cycle. The CVCR can also can be used to predict the community structure’s behavior on the next time slot t. We avoid putting the limited immune sources in the perishing community. This strategy decreases the immunization cost and increases the effectiveness of the immune response. Parameter 3. NI is used to represent the importance of the node. A node with greater NI has a more important status and a closer link with other existing nodes. They also easily attract new nodes. Nodes with the great influence survive longer and spread the immune vaccines faster. We choose these nodes as the immune nodes to accelerate the propagation velocity of the immune nodes. 5.2. Strategy effect The immune effect is evaluated by calculating, the coverage ratio of the immune nodes. This ratio represents the proportion of the number of immune nodes to the total number of nodes on each time slot. The coverage ratio is defined as follows: r (t ) =

t Nim

Nt

.

(14)

t Nim represents the number of immune nodes in time slot t. N t represents the total number of nodes in time slot t. We can obtain the two following theorems according to the coverage ratio of the immune nodes. These two theorems prove that our immune strategy is better than other immune strategies for temporal networks. However, the dynamics of the temporal networks will reduce the immune effects of all immune strategies. Assuming that s(t ) and r (t ) respectively represent the proportion of normal and immune nodes on time slot t, and s(t ) + r (t ) = 1, the two theorems are presented as follows:

• Theorem 1. The dynamic network characteristics negatively affect the immune ability of the targeted immune strategy as well as the evolutionary virus immune strategy. • Theorem 2. With the same dynamic network characteristics, the evolutionary virus immune strategy has a better effect on the immune ability than the targeted immune strategy. These two theorems verify that our proposed immune strategy is more acceptable for temporal networks. 5.2.1. Proof of Theorem 1 This proof uses the mathematical formula of the coverage ratio of immune nodes on time slot t + 1 rt +1 and parameter a to verify that rt +1 will decrease with the increase of dynamic metric p, a is expressed by the formula of p. Proof. Nt +1 = Nt + c (n1 p − n2 p). We use recurrence relation in the specific immune process when t ≥ 1 to calculate the number of immune nodes. The number of immune nodes on time slot t + 1 is equal to time slot t. This result is obtained by subtracting the number of immune nodes that disappeared and by adding the number of the increased immune nodes. The increased immune nodes are equal to the contact rate obtained by multiplying the number of non-immune nodes and the immune rate on time slot t. Nt +1 r (t + 1)

= Nt r (t ) − r (t )cn2 p   t +1  Nt s(t ) − s(t )cn2 p + cn1 p k(t +1)i p(k(t +1)i ) N(t +1)i + ⟨kt +1 ⟩ N t +1 i =1

8

M. Li et al. / Future Generation Computer Systems (

×

)

–

Nt r (t ) − r (t )cn2 p N t +1

= Nt r (t ) − r (t )cn2 p [Nt +1 − Nt r (t ) − r (t )cn2 p][Nt r (t ) − r (t )cn2 p] + (Nt +1 )3 t +1  k(t +1)i × (N(t +1)i )2 . ⟨ kt +1 ⟩ i =1 The r (t + 1) value is then presented as follows: r (t + 1) =

r (t )(Nt − cn2 p) Nt +1 t +1  k(t +1)i × ⟨ kt +1 ⟩ i =1



 1+ N(t +1)i

 1−

2 

N t +1

r (t )(Nt − cn2 p)

Fig. 3. Relationship of r (t + 1) and a.



Nt +1

immune nodes can degenerate into selecting network nodes with large NIs.

.

Let α =

 k(t +1)i b = ⟨kt +1 ⟩ i=1 =



N(t +1)i

(15)

2

Nt +1

k(t +1)1 (N(t +1)1 )2 + k(t +1)2 (N(t +1)2 )2 + k(t +1)1 N(t +1)1 Nt +1 + k(t +1)2 N(t +1)2 Nt +1 +

×

t +1

k(t +1)i

i=1 ⟨kt +1 ⟩

r (t + 1) = −α 2 β r 2 (t ) + α(1 + β)r (t )

Parameter b is then obtained as follows: t +1

and β =



N(t +1)i Nt +1

2

. The coverage

ratio of the immune nodes is calculated as follows,

Moreover,

 r (t )(Nt − cn2 p)    a = Nt +1 t + 1  k(t +1)i  N(t +1)i 2   b = .  ⟨kt +1 ⟩ Nt +1 i =1

Nt −cn2 p , Nt +1

· · · + k(t +1)(t +1) (N(t +1)(t +1) )2 · · · + k(t +1)(t +1) N(t +1)(t +1) Nt +1

≤ 1. The previous formula is simplified as follows: r (t + 1) = a[1 + (1 − a)b] = −ba2 + (1 + b)a.  Fig. 3 shows the relationship of r (t + 1) and a. Accordingly, a ≤ 1. Therefore, a will increase if r (t ) is increased. r (t + 1) will also be increased. a and r (t + 1) will decrease if p is increased. The abovementioned proof shows that the relationship between the rate of the immune nodes and the network dynamic characteristics can be described by a quadratic polynomial. Its relation function resembles a parabolic function. The rate of the immune nodes in each time slot decreases with increasing network dynamic characteristics (i.e., p increasing,). The dynamic characteristics negatively affect the immune strategy. 5.2.2. Proof of Theorem 2 We calculate the coverage ratios of the targeted immune strategy rT and the evolutionary virus immune strategy rI . We then compare rT and rI , and obtain rI ≥ rT . The comparison shows that the evolutionary virus immune strategy is better than other strategies. Proof. We plant N immune vaccines for the targeted immune strategy when t = 1. In the evolutionary virus immune strategy, we successively provide immune vaccines during the s time slots starting from time slot t = 1. The provided number of immune vaccines are n1 , n2 , . . . , ns in the t = 1, 2, . . . , s (s ≥ 1) time slot. Moreover, n1 + n2 + · · · + ns = n. In the evolutionary virus immune strategy, all communities are in a growth state and are also at the same level. The choice of

(t ≥ 1).

(16)

Although α and β change over time, the two immune strategies have the same α and β values at the same time. The immune effects of the two immune strategies are presented in the sections that follow. For the targeted immunization, at the initial time, N1 rT (1) = N + N11 × rT (1) =

(2N1 − N )N N12

N1 − N N1

×

N N1

,

(17)

.

(18)

When t ≥ 2, rT (t ) = α rT (t − 1)[1 + β(1 − α rT (t − 1))]

= −α 2 β rT2 (t − 1) + (1 + β)α rT (t − 1). For the evolutionary virus immune strategy, at the initial time, rI (1) =

(2N1 − n1 )n1 N12

.

(19)

When s ≥ t ≥ 2,

    nt nt rI (t ) = α rI (t − 1) + 1 + β 1 − α rI (t − 1) − Nt Nt   nt = −α 2 β rT2 (t − 1) + 1 + β − 2β α rI ( t − 1 ) Nt   nt nt + 1+β −β . Nt

Nt

When t > s, rI (t ) = −α 2 β rI2 (t − 1) + (1 + β)α rI (t − 1).



(20)

The two strategies are compared at the initial time, when t = 1, rT (1) > rI (1). Fig. 3 and Eqs. (15)–(18) show that rT (t ) ≥ rI (t ) if rT (s) ≥ rI (s) when t > s. On the contrary, rT (t ) < rI (t ) if rT (s) < rI (s). Therefore, if rT (t ) < rI (t ) during s ≥ t ≥ 2, we can get rT (t ) < rI (t ) when t > s. A comparison of the immune effects of the targeted immune and the evolutionary virus immune strategies during the s ≥ t ≥ 2 time slots shows that rI (t ) = (1 + β − β Nntt ) Nntt > 0 when α = 0, rT (t ) = 0. Therefore, there is a time slot ψ (2 ≤ ψ ≤ s) to make rT (t ) < rI (t ), t ≥ ψ . The abovementioned proof shows that the evolutionary immune strategy performs better than the existing immune strategy for temporal networks under the same dynamic condition. The network dynamics increases the difficulty of immune and weakens the immune effect. However, our immune strategy uses the limited immune vaccines to achieve better performance.

M. Li et al. / Future Generation Computer Systems (

(a) CV for the selected community in 1990.

(d) CVCR for the selected community in 1990.

(b) CV for the selected community in 1991.

(e) CVCR for the selected community in 1991.

)

–

9

(c) CV for the selected community in 1992.

(f) CVCR for the selected community in 1992.

Fig. 4. CV and CVCR for the CDBLP datasets.

6. Performance evaluation 6.1. Experiment setting 6.1.1. Datasets The experiments are conducted on two real datasets, namely, the CDBLP and the Enron Email (EED) dataset. We compare our strategy with some existing immune strategies. CDBLP dataset. CDBLP has been published by the ‘‘Automation Discipline Innovation Method’’ research group of the Chinese Academy of Sciences Institute of Automation. This dataset is derived from the network of the Computer Chinese Journal. Part of the data from 1990 to 1998 is used in our experiment. We set year as the time interval and integrate annual data as time slot data. EED dataset. EED has been collected by CALO (a cognitive assistant that learns and organizes) project. The dataset represents the connections between employees. The part of the data in 2001 is used in our experiment. We set a month as the time interval and integrate each month data as a time slot data. Emulation dataset. We use an emulation dataset to verify the relationship of the dynamic characteristics and the immune strategy. Table 2 shows specific parameters. We vary probability p to represent different dynamic effects of temporal networks. p is set as an observed indicator of the dynamic effects. 6.1.2. Experiment parameters setting Evolutionary immunization (our algorithm). We deliver immune vaccines for 3 initial successive time slots starting from the initial time slot 1990 or Apr. We test 23 and 57 immune vaccines for the CDBLP dataset. Table 3 shows the specific experiment parameters. We test 6 and 24 immune vaccines for the EED dataset. Table 4 shows the specific experiment parameters. Random immunization. The CDBLP experiment has a total of 23 immune vaccines, whereas the EED experiment has 6. We randomly select 23 CDBLP and six EED nodes as the initial immune nodes. We observe the propagation of the immune nodes in the 9 consecutive time slots. The experiment is repeated 50 times to

Table 2 Parameters of the emulation data sets. The number of communities The number of initial nodes for the 1st community The number of initial nodes for the 2nd community The number of initial nodes for the 3rd community The number of initial nodes for the 4th community The number of new nodes in each community The number of deleted nodes in each community The number of new edges on each node The probability that an edge is added in the community The number of initial immune vaccines

c=4 N0 = 25 N0 = 27 N0 = 45 N0 = 30 n1 = 20 n2 = 10 m=2 q = 0.6 127 × 3% = 4

obtain the average result. We use 57 CDBLP and 24 EED immune vaccines to further verify the proposed immune strategy, for the CDBLP and EED dataset experiments to experiment again. Targeted immunization. We calculate the INs of all CDBLP and EED nodes. We then select 23 CDBLP and 6 EED nodes with the greatest NIs as the initial immune nodes at the initial time slot 1990 or April. We observe the subsequent immune effects. Subsequently, we use 57 CDBLP and 24 EED immune vaccines to experiment again. 6.2. Effect of CV and CVCR In the CDBLP experiment, we calculate all the CVs and CVCRs of all communities during the three initial time slots. We choose the suitable communities and nodes to plant immune vaccines according to our proposed immune strategy. The selected communities are decided by steps 1 and 2. We then calculate the NIs of all nodes for the selected communities. Table 5 shows the selected communities and the number of immune vaccines in these communities for the CDBLP datasets according to the calculated results. Fig. 4 presents the CVs and CVCRs of these communities. We sort all CVs during the three initial time slots. We also mark the CVCRs when they are larger than zero and then calculate the CV threshold T . These three parameters divide all communities into three levels. We choose five communities at time slot 1990. Fig. 4 shows that the CV of the 47th community is larger than T . The CVCR

10

M. Li et al. / Future Generation Computer Systems (

)

–

Table 3 Parameters of the evolutionary immune strategy for CDBLP datasets. The total number of immune vaccines The provided frequency of immune vaccines The starting time of the provided immune vaccine The number of immune vaccines in 1990 (23 initial immune vaccines) The number of immune vaccines in 1990 (57 initial immune vaccines) The number of immune vaccines in 1991 (23 initial immune vaccines) The number of immune vaccines in 1991 (57 initial immune vaccines) The number of immune vaccines in 1992 (23 initial immune vaccines) The number of immune vaccines in 1992 (57 initial immune vaccines) The reference value of CV

N = 23 and N = 57 m=3 t = 1990 n1990 = 7 n1990 = 17 n1991 = 7 n1991 = 17 n1992 = 9 n1992 = 23 T = 6.0

The ratio of immune vaccines in first level communities

p1 =

The ratio of immune vaccines in second level communities

p2 =

The ratio of immune vaccines in third level communities

p3 = 0

3 7 4 7

Table 4 Parameters of the evolutionary immune strategy for EED datasets. The total number of immune vaccines The provided frequency of immune vaccines The starting time of the provided immune vaccines The number of immune vaccines in Apr (6 initial immune vaccines) The number of immune vaccines in Apr (24 initial immune vaccines) The number of immune vaccines in May (six initial immune vaccines) The number of immune vaccines in May (24 initial immune vaccines) The number of immune vaccines in June (six initial immune vaccines) The number of immune vaccines in June (24 initial immune vaccines) The reference value of the CV

N = 6 and N = 24 m=3 t = Apr n4 = 2 n4 = 8 n5 = 2 n5 = 8 n6 = 2 n6 = 8 T = 2.0

The ratio of immune vaccines in first level communities

p1 =

The ratio of immune vaccines in second level communities

p2 =

The ratio of immune vaccines in third level communities

p3 = 0

of the 47th community is also larger than zero. This community is in the first level and is planted with three immune vaccines. The other four communities are in the second level and are planted with one immune vaccine. We employ the similar method to choose the suitable communities at time slots 1991 and 1992. Fig. 5 demonstrates the changing trend of CVs and CVCRs for the selected communities, which better illustrates that the CDBLP dataset is in a growth status. We repeat the same steps for the EED experiment. However, we choose less communities because the EED nodes are less than the CDBLP nodes. We choose 1st and 21st communities on the April time slot, whereas the 7th, the 10th, the 25th communities are chosen for the May time slot. We choose the 11th, the 13rd, the 33rd and the 30th communities on time slot June. Fig. 5 shows the CVs and CVCRs of these communities. Fig. 5 demonstrates that the EED dataset is less than the CDBLP dataset. We have less immune vaccines, and choose less communities. We sort all CVs and mark the CVCRs when they are larger than zero. We calculate the CV threshold T . We use more immune vaccines in the first level, where the CVs of the communities are larger than T , and the CVCRs are larger than 0. The changing trend of the CVs and the CVCRs in three initial time slots indicates that the EED dataset is stable status. Accordingly, the 1st, the 2nd and the 10th communities are slowly changing. 6.3. Strategy performance Figs. 7(a) and 8(a) show the total number of the CDBIP and EED nodes on each time slot, respectively. We test three immune strategies. Figs. 6(b) and 7(b) represent the rate of new nodes on each time slot for the CDBLP and EED, respectively. The strategy reflects the dynamic characteristics of temporal networks to a certain extent. T represents the elapsed time slots of a community from appearance to disappearance (Figs. 6(d) and 7(d)). The contact of

3 4 1 4

Table 5 Selected communities and the number of immune vaccines in those selected communities for CDBLP datasets. Year

Community number

The number of immune vaccines

1990

The 47th community The 30th community The 58th community The 168th community the 32nd community

3 1 1 1 1

1991

The 17th community The 36th community The 10th community The 28th community The 58th community The 39th community

2 1 1 1 1 1

1992

The 26th community The 42nd community The 114th community The 39th community The 85th community The 99th community

2 2 2 1 1 1

network users for two real datasets is of short duration, which indicates the short life cycle of a community is short. Figs. 7(c) and 8(c) show that the dynamic characteristics of the CDBLP nodes are greater than those of the EED nodes. The CDBLP datasets are in a growth status, whereas the EED datasets are stable. We compare the immune node coverage ratios of the three immune strategies. Figs. 7 and 8 show the results for the CDBIP and the EED, respectively. For the 23 initial CDBLP immune vaccines (Fig. 7(e)), the immune effect of the evolutionary virus immune strategy, except for the initial time slot, is better than that of the random and the targeted immunities. The network structure on the initial time slot is considered as a static network structure. The immune effect depends on the number and the characteristics of the initial immune nodes. For the acquaintance immune strategy,

M. Li et al. / Future Generation Computer Systems (

(a) CV for the selected community in Apr.

(d) CVCR for the selected community in Apr.

(b) CV for the selected community in May.

(e) CVCR for the selected community in May.

)

–

11

(c) CV for the selected community in June.

(f) CVCR for the selected community in June.

Fig. 5. CV and CVCR for the EED datasets.

it is better than the random walker and the one node at one step immunization process. However, the random walker and the one node at one step immunization is more suitable for the static scale-free world. The targeted immunization tends to select the node with the better characteristics from entire network. The random walker, common acquaintance immunization and the one node at one step tends to select nodes from the region of entire network. With the network dynamically changing, the nodes that are put immune vaccines at first time maybe disappear in the random walker, common acquaintance immunization and the one node at one step immunization. The random immunization has a certain of randomness. Therefore, the simple random immunization has a better immune effect than the random walker immunization. Therefore, Fig. 6(e) appears reasonable. The immune effect of the evolution immune strategy for the 57 initial immune vaccines is much greater than that of the two other immune strategies when we increase the initial immune vaccines. Fig. 6(f) shows that the immune effect of the 57 immune vaccines is better than the 23 immune vaccines, especially for the evolutionary immune strategy. For the EED experiment, the immune effect of the evolutionary virus immune strategy is better than that of the random immunity (Fig. 7(e)). The immune effect of the evolutionary virus immune strategy is better than that of the targeted immunity only in a few cases. The evolutionary virus immune strategy has the same immune effect as the targeted immune strategy when the dynamic network degenerates into the static network. The former’s immune effect is not better than that of the targeted immunity when the network structure is no longer changed. The network of the EED nodes is more stable than that of the CDBLP nodes. The network structure of the EED nodes on each time slot resembles the static network structure. The targeted immune strategy for the static network requires the planting of all immune vaccines at the beginning of time, thus making its propagation time longer than that of the immune vaccines in our immune strategy. Therefore Fig. 7(e) is reasonable. Fig. 7(f) shows that the immune effects of the three immune strategies are gradually close to each other when we increase initial immune vaccines. An analysis of Figs. 6(f) and 7(f) shows that the evolutionary virus immune strategy is suitable for temporal networks. The traditional acquaintance immunization and random walker immunization are not very suitable in temporal networks, because they also

put all immune vaccines at the first time slot based on their own algorithm. They overlook the evolutionary characteristics of temporal network. In some extreme condition, all immune nodes are disappeared at the next time slot, these immune strategies cannot be used in this temporal network. 6.4. Effect of parameter p The relationship between dynamics and immune effect is analyzed by calculating the rate of the immune nodes in different ps (p is the probability of adding or reducing a node). The social analysis software called Pajek is used to obtain the imitative temporal community networks on each time slot (Fig. 8). Four network structures are chosen during the four time slots to present the network dynamic characteristics. Four non-uniform communities are selected at the initial time slot. Nodes and edges are added after a period of time. A community is also added in the network. Five communities become larger, and four figures show a temporal social network. These communities have good growth status. We set different ps to express different dynamic characteristics and compare the immune effect of the three immune strategies. Fig. 9 shows the experimental results of the various ps. The change rate of nodes and edges increases with increasing p. Some communities become large and small after a period of time. Some communities disappeared, and some are created. Some immune routes and nodes also disappear. The immune effect of the targeted and random immune strategies becomes worse. Fig. 9 shows that the immune effect of the evolutionary virus immune strategy is much better than that of other immune strategies with the network dynamic characteristics becoming greater. The experiments illustrate that the dynamic characteristics of networks negatively affect the immune ability of the targeted and evolutionary virus immune strategies. The rate of the immune nodes decreases on each time slot with the increase of dynamic parameter p. However, the immune effect of the evolutionary immune strategy is much better than that of the other immune strategies. We calculate the rate of the immune nodes for the three immune strategies on each time slot. The evolutionary virus immune strategy has a better effect than the other two

12

M. Li et al. / Future Generation Computer Systems (

(a) Total number of the CDBLP nodes on each time slot.

(d) Ratio of the community life cycle.

(b) Rate of new CDBLP nodes on each time slot.

(e) Rate of the CDBLP immune nodes (23 initial immune vaccines).

)

–

(c) Number of the CDBLP communities on each time slot.

(f) Rate of the CDBLP immune nodes (57 initial immune vaccines).

Fig. 6. CDBLP datasets.

(a) Total number of the EED nodes on each time slot.

(d) The ratio of the community life cycle.

(b) Rate of new EED nodes on each time slot.

(e) Rate of the EED immune nodes (six initial immune vaccines).

(c) Number of the EED communities on each time slot.

(f) Rate of the EED immune nodes (24 initial immune vaccines).

Fig. 7. EED datasets.

immune strategies under the same network dynamic characteristic condition. Therefore, the evolutionary immune strategy has a better immune effect for temporal networks. 6.5. Discussion The experiments comprise three parts. We plant immune vaccines during the three initial time slots to observe the immune effect of our immune strategy. We conduct experiments on CV and CVCR calculations. We use Figs. 4 and 5 to show the CV and the CVCR of the selected communities. We made experiments to compare the immune effects of the three immune strategies based on the CV. This experiment is also used to verify Theorem 1. Our immune strategy is proposed for the temporal social network. We

verify the relationship with our immune strategy and dynamic characteristics. Therefore, we use a series of different ps (p is the probability of adding or reducing a node) to show the three immune effects for the three immune strategies. The series is also used to verify Theorem 2. We verify from the three immune experiments that the evolutionary virus immune strategy has a better effect on the immune ability than the targeted and random immune strategies for the same temporal social network. However, the dynamic characteristics of the networks negatively affect the immune ability of the targeted, random, and the evolutionary virus immune strategies. For a temporal network, our immune strategy has a larger coverage ratio of immune nodes on each time slot. The evolutionary immune strategy has a better immune effect.

M. Li et al. / Future Generation Computer Systems (

)

–

(a) Network structure at time slot t.

(b) Network structure at time slot t + 1.

(c) Network structure at time slot t + 2.

(d) Network structure at time slot t + 3.

13

Fig. 8. Temporal social network.

(a) Total number of nodes.

(d) Immune effect of p = 0.5.

(b) Immune effect of p = 0.

(e) Immune effect of p = 0.75.

(c) Immune effect of p = 0.25.

(f) Immune effect of p = 1.

Fig. 9. Immune effect of various p.

7. Conclusion With the development of mobile and community networks, considering the network evolutionary characteristics in the virus immunization is important. The random and targeted immune strategies are first analyzed based on the network dynamic characteristics. An evolutionary virus immune strategy based on the CV is then proposed after the dynamic network structure analysis. The following investigations are presented in this paper: (1) We design an evolutionary virus immune strategy based on the CV and create a theoretical model to analyze its immune effect.

(2) We quantize the relation between the dynamic characteristics of networks and the virus immune effect. The dynamic characteristics negatively affect all immune strategies. However, the evolutionary virus immune strategy has a better immune performance than the targeted immune strategy with the same dynamic characteristics of networks. (3) A comparison of the immune effect of the three immune strategies shows that the evolutionary immune strategy has a better performance than other strategies. The relationship of the evolutionary virus immune strategy and the dynamic characteristics of temporal networks can also be checked in the experiments.

14

M. Li et al. / Future Generation Computer Systems (

We will continue to study more indicators to depict community evolution better in future works. Moreover, we will deeply optimize the relationship of the evolutionary virus immune strategy and the dynamic nature of temporal networks. Finally, we will further study the immune effect of the evolutionary virus immune strategy in some other network structures. Acknowledgments The paper is supported by China NSF (61572222, 61272405, 60903175, 61472121, 61272033, 61272451) and the Fundamental Research Funds for the Central Universities [2015MS078]. References [1] S. Misra, B.K. Saha, S. Pal, Opportunistic Mobile Networks—Advances and Applications, in: Ser. Computer Communications and Networks, Springer, 2016, [Online]. Available: http://dx.doi.org/10.1007/978-3-319-29031-7. [2] C. Fu, Q. Huang, L. Han, L. Shen, X. Liu, Virus propagation power of the dynamic network, EURASIP J. Wirel. Commun. Netw. 2013 (2013) 210. [Online]. Available: http://dx.doi.org/10.1186/1687-1499-2013-210. [3] T.Y. Hu Ke, Immunization for scale-free networks by random walker, Chin. Phys. B 15 (12) (2006) 2782. [Online]. Available: http://cpb.iphy.ac.cn/EN/ abstract/article_21637.shtml. [4] R. Cohen, K. Erez, D.B. Avraham, S. Havlin, Resilience of the Internet to random breakdowns, Phys. Rev. Lett. 85 (2000) 4626–4628. [5] P. Liu, H. Miao, Q. Li, A common acquaintance immunization strategy for complex network, in: 8th IEEE/ACIS International Conference on Computer and Information Science, IEEE/ACIS ICIS 2009, June 1–3, 2009, Shanghai, China, 2009, pp. 713–717. [Online]. Available: http://dx.doi.org/10.1109/ICIS.2009.68. [6] S. Koohborfardhaghighi, J. Kim, One node at one step discovery process as an immunization strategy, J. Inf. Sci. Eng. 30 (5) (2014) 1425–1444. [Online]. Available: http://www.iis.sinica.edu.tw/page/jise/2014/201409_08.html. [7] J.O. Kephart, S.R. White, Directed-graph epidemiological models of computer viruses, in: IEEE Symposium on Security and Privacy, 1991, pp. 343–361. [Online]. Available: http://dx.doi.org/10.1109/RISP.1991.130801. [8] Z. Jiang, W. Ma, J. Wei, Global hopf bifurcation and permanence of a delayed SEIRS epidemic model, Math. Comput. Simulation 122 (2016) 35–54. [Online]. Available: http://dx.doi.org/10.1016/j.matcom.2015.11.002. [9] C. Huang, C. Lee, T. Wen, C. Sun, A computer virus spreading model based on resource limitations and interaction costs, J. Syst. Softw. 86 (3) (2013) 801–808. [Online]. Available: http://dx.doi.org/10.1016/j.jss.2012.11.027. [10] S. Yu, G. Gu, A. Barnawi, S. Guo, I. Stojmenovic, Malware propagation in largescale networks, IEEE Trans. Knowl. Data Eng. 27 (1) (2015) 170–179. [Online]. Available: http://dx.doi.org/10.1109/TKDE.2014.2320725. [11] S. Eshghi, M.H.R. Khouzani, S. Sarkar, S.S. Venkatesh, Optimal patching in clustered malware epidemics, CoRR, vol. abs/1403.1639, 2014. [Online]. Available: http://arxiv.org/abs/1403.1639. [12] S. Ariffin, R. Mahmod, A. Jaafar, M.R.K. Ariffin, Symmetric encryption algorithm inspired by randomness and non-linearity of immune systems, IJNCR 3 (1) (2012) 56–72. [Online]. Available: http://dx.doi.org/10.4018/jncr. 2012010105. [13] G. Yan, S. Eidenbenz, Modeling propagation dynamics of bluetooth worms (extended version), IEEE Trans. Mob. Comput. 8 (3) (2009) 353–368. [Online]. Available: http://doi.ieeecomputersociety.org/10.1109/TMC.2008.129. [14] S. Peng, S. Yu, A. Yang, Smartphone malware and its propagation modeling: A survey, IEEE Commun. Surv. Tutor. 16 (2) (2014) 925–941. [Online]. Available: http://dx.doi.org/10.1109/SURV.2013.070813.00214. [15] Y. Zhou, X. Jiang, Dissecting android malware: Characterization and evolution, in: IEEE Symposium on Security and Privacy, SP 2012, 21–23 May 2012, San Francisco, California, USA, 2012, pp. 95–109. [Online]. Available: http://dx.doi.org/10.1109/SP.2012.16. [16] P. Wang, M.C. González, C.A.H.R. , A. Barabási, Understanding the spreading patterns of mobile phone viruses, CoRR, vol. abs/0906.4567, 2009. [Online]. Available: http://arxiv.org/abs/0906.4567. [17] B. Hari, P. Reddy, S. Kumari, Efficient defence system for avoid malware propagation in mobile network, in: Research in Computer and Communication Technology, Vol. 4, 2015. [18] A.M. Jeffrey, X. Xia, I.K. Craig, When to initiate HIV therapy: a control theoretic approach, IEEE Trans. Biomed. Eng. 50 (11) (2003) 1213–1220. [Online]. Available: http://dx.doi.org/10.1109/TBME.2003.818465. [19] R. Dantu, J.W. Cangussu, S. Patwardhan, Fast worm containment using feedback control, IEEE Trans. Dependable Secure Comput. 4 (2) (2007) 119–136. [Online]. Available: http://doi.ieeecomputersociety.org/10.1109/ TDSC.2007.1002. [20] A.J. Ganesh, L. Massoulié, D.F. Towsley, The effect of network topology on the spread of epidemics, in: 24th Annual Joint Conference of the IEEE Computer and Communications Societies, 13–17 March 2005, Miami, FL, USA, INFOCOM 2005, 2005, pp. 1455–1466. [Online]. Available: http://dx.doi.org/10.1109/INFCOM.2005.1498374.

)

–

[21] Z. Liu, X. Wu, P.M. Hui, An alternative approach to characterize the topology of complex networks and its application in epidemic spreading, Front. Comput. Sci. China 3 (3) (2009) 324–334. [Online]. Available: http://dx.doi.org/10.1007/s11704-009-0058-7. [22] S. Shin, G. Gu, A.L.N. Reddy, C.P. Lee, A large-scale empirical study of conficker, IEEE Trans. Inf. Forensics Secur. 7 (2) (2012) 676–690. [Online]. Available: http://dx.doi.org/10.1109/TIFS.2011.2173486. [23] M. Youssef, C.M. Scoglio, Optimal network-based intervention in the presence of undetectable viruses, IEEE Commun. Lett. 18 (8) (2014) 1347–1350. [Online]. Available: http://dx.doi.org/10.1109/LCOMM.2014.2325026. [24] S. Xu, W. Lu, Z. Zhan, A stochastic model of multivirus dynamics, IEEE Trans. Dependable Secure Comput. 9 (1) (2012) 30–45. [Online]. Available: http://doi.ieeecomputersociety.org/10.1109/TDSC.2011.33. [25] Y. Li, P. Hui, D. Jin, L. Su, L. Zeng, Optimal distributed malware defense in mobile networks with heterogeneous devices, IEEE Trans. Mob. Comput. 13 (2) (2014) 377–391. [Online]. Available: http://doi.ieeecomputersociety.org/ 10.1109/TMC.2012.255. [26] N. Valler, B.A. Prakash, H. Tong, M. Faloutsos, C. Faloutsos, Epidemic spread in mobile ad hoc networks: Determining the tipping point, in: NETWORKING 2011—10th International IFIP TC 6 Networking Conference, Valencia, Spain, May 9–13, 2011, Proceedings, Part I, 2011, pp. 266–280. [Online]. Available: http://dx.doi.org/10.1007/978-3-642-20757-0_21. [27] J.T. Jackson, S. Creese, Virus propagation in heterogeneous bluetooth networks with human behaviors, IEEE Trans. Dependable Secure Comput. 9 (6) (2012) 930–943. [Online]. Available: http://dx.doi.org/10.1109/TDSC.2012.72. [28] M.H.R. Khouzani, S. Sarkar, E. Altman, Maximum damage malware attack in mobile wireless networks, IEEE/ACM Trans. Netw. 20 (5) (2012) 1347–1360. [Online]. Available: http://dx.doi.org/10.1109/TNET.2012.2183642. [29] J. Cai, P. Flocchini, N. Santoro, Network decontamination from a black virus, in: 2013 IEEE International Symposium on Parallel & Distributed Processing, Workshops and Ph.D. Forum, Cambridge, MA, USA, May 20–24, 2013, 2013, pp. 696–705. [Online]. Available: http://dx.doi.org/10.1109/IPDPSW.2013. 115. [30] C. Gao, J. Liu, Modeling and restraining mobile virus propagation, IEEE Trans. Mob. Comput. 12 (3) (2013) 529–541. [Online]. Available: http://doi.ieeecomputersociety.org/10.1109/TMC.2012.29. [31] S. Tang, D. Myers, J. Yuan, Modified SIS epidemic model for analysis of virus spread in wireless sensor networks, IJWMC 6 (2) (2013) 99–108. [Online]. Available: http://dx.doi.org/10.1504/IJWMC.2013.054048. [32] P. De, Y. Liu, S.K. Das, An epidemic theoretic framework for vulnerability analysis of broadcast protocols in wireless sensor networks, IEEE Trans. Mob. Comput. 8 (3) (2009) 413–425. [Online]. Available: http://doi.ieeecomputersociety. org/10.1109/TMC.2008.115. [33] S.Y. Bhat, M. Abulaish, A.A. Mirza, Spammer classification using ensemble methods over structural social network features, in: 2014 IEEE/WIC/ACM International Joint Conferences on Web Intelligence (WI) and Intelligent Agent Technologies (IAT), Warsaw, Poland, August 11–14, 2014—Vol. I, 2014, pp. 454–458. [Online]. Available: http://dx.doi.org/10.1109/WI-IAT.2014.133. [34] S. Wen, W. Zhou, J. Zhang, Y. Xiang, W. Zhou, W. Jia, C.C. Zou, Modeling and analysis on the propagation dynamics of modern email malware, IEEE Trans. Dependable Secure Comput. 11 (4) (2014) 361–374. [Online]. Available: http://doi.ieeecomputersociety.org/10.1109/TDSC.2013.49. [35] Y. Qin, X. Zhong, H. Jiang, Y. Ye, An environment aware epidemic spreading model and immune strategy in complex networks, Appl. Math. Comput. 261 (2015) 206–215. [Online]. Available: http://dx.doi.org/10.1016/j.amc.2015.03. 110. [36] J. Zhang, Z. Jin, Epidemic spreading on complex networks with community structure, Appl. Math. Comput. 219 (6) (2012) 2829–2838. [Online]. Available: http://dx.doi.org/10.1016/j.amc.2012.06.057. [37] I. Tunc, L.B. Shaw, Effects of community structure on epidemic spread in an adaptive network, CoRR, vol. abs/1212.3229, 2012. [Online]. Available: http://arxiv.org/abs/1212.3229. [38] J. Shang, L. Liu, F. Xie, C. Wu, How overlapping community structure affects epidemic spreading in complex networks, in: IEEE 38th Annual Computer Software and Applications Conference, COMPSAC Workshops 2014, Vasteras, Sweden, July 21–25, 2014, 2014, pp. 240–245. [Online]. Available: http://dx.doi.org/10.1109/COMPSACW.2014.43. [39] P. Holme, Modern temporal network theory: A colloquium, CoRR, vol. abs/1508.01303, 2015. [Online]. Available: http://arxiv.org/abs/1508.01303. [40] D. Chakrabarti, Y. Wang, C. Wang, J. Leskovec, C. Faloutsos, Epidemic thresholds in real networks, ACM Trans. Inf. Syst. Secur. 10 (4) (2008) [Online]. Available: http://doi.acm.org/10.1145/1284680.1284681. [41] B.A. Prakash, D. Chakrabarti, N. Valler, M. Faloutsos, C. Faloutsos, Threshold conditions for arbitrary cascade models on arbitrary networks, Knowl. Inf. Syst. 33 (3) (2012) 549–575. [Online]. Available: http://dx.doi.org/10.1007/s10115012-0520-y. [42] B.A. Prakash, H. Tong, N. Valler, M. Faloutsos, C. Faloutsos, Virus propagation on time-varying networks: Theory and immunization algorithms, in: Machine Learning and Knowledge Discovery in Databases, European Conference, ECML PKDD 2010, Barcelona, Spain, September 20–24, 2010, Proceedings, Part III, 2010, pp. 99–114. [Online]. Available: http://dx.doi.org/10.1007/978-3-64215939-8_7. [43] S. Tsugawa, H. Ohsaki, Community structure and interaction locality in social networks, JIP 23 (4) (2015) 402–410. [Online]. Available: https://www.jstage. jst.go.jp/article/ipsjjip/23/4/23_402/_article. [44] C. Fu, M. Li, D. Zou, S. Qu, L. Han, J.H. Park, Community vitality in dynamic temporal networks, IJDSN 2013 (2013) [Online]. Available: http://dx.doi.org/ 10.1155/2013/281565.

M. Li et al. / Future Generation Computer Systems (

)

–

15

Min Li, received the B.E. degree in computer science and technology from Nanchang University, Nanchang, Jiangxi, China, in 2012. She is currently a master degree candidate at Huazhong Science and technology University, Wuhan, Hubei, China. Her research interests focus on social networks and network security.

Jia Yang, received the B.E. degree in Information Security from Hubei university of Police, China, in 2014. She is currently a master degree candidate at Huazhong Science and technology University, Wuhan, Hubei, China. Her research interests focus on malicious code and network security.

Cai Fu, IEEE member, Ph.D. associate professor, deputy director of Information Security Institute of Computer School. His main research interests include wireless networking security, routing algorithms and distributed computing.

Tianqing Zhu received her B.Eng. and M.Eng. degrees from Wuhan University, China, in 2000 and 2004, respectively, and a Ph.D. degree from Deakin University in Computer Science, Australia, in 2014. Dr. Tianqing Zhu is currently a continuing Teaching Scholar in the School of Information Technology, Deakin University, Australia. Her research interests include privacy preserving, data mining and network security. She has won the best student paper award in PAKDD 2014.

Xiao-Yang Liu, received his B.A. degree in computer science and technology from the Huazhong University of Science and Technology, Wuhan, in 2010. He is a now Ph.D. candidate in the Department of Computer Science and Engineering at the Shanghai Jiao Tong University. His research interests include wireless communication, sensor networks, MANETs, VANETs, Cyber–Physical System and networksecurity.

Lansheng Han, Ph.D. associate professor, Information Security Institute of Computer School. His main research interests include network security, malicious code, routing algorithms and distributed computing.