A compartmental model for cyber-epidemics

TL;DR

This paper develops a compartmental model to analyze the spread of cyber-epidemics, incorporating device states and user awareness, and compares impacts across different network architectures and malware behaviors.

Contribution

It introduces a novel compartmental modeling framework tailored for cyber-epidemics, including awareness dynamics and malware mutation effects.

Findings

Different network structures influence malware spread and damage.

Awareness waves can mitigate the impact of cyber-epidemics.

Malware mutation increases the complexity of containment strategies.

Abstract

In our more and more interconnected world, a specific risk is that of a cyber-epidemic (or cyber-pandemic), produced either accidentally or intentionally, where a cyber virus propagates from device to device up to undermining the global Internet system with devastating consequences in terms of economic costs and societal harms related to the shutdown of essential services. We introduce a compartmental model for studying the spreading of a malware and of the awareness of its incidence through different waves which are evolving on top of the same graph structure (the global network of connected devices). This is realized by considering vectorial compartments made of two components, the first being descriptive of the state of the device with respect to the new malware's propagation, and the second accounting for the awareness of the device's user about the presence of the cyber threat. By introducing suitable transition rates between such compartments, one can then follow the evolution of a cyber-epidemic from the moment at which a new virus is seeded in the network, up to when a given user realizes that his/her device has suffered a damage and consequently starts a wave of awareness which eventually ends up with the development of a proper antivirus software. We then compare the overall damage that a malware is able to produce in Erd\H{o}s-R\'enyi and scale-free network architectures for both the case in which the virus is causing a fixed damage on each device and the case where, instead, the virus is engineered to mutate while replicating from device to device. Our result constitute actually the attempt to build a specific compartmental model whose variables and parameters are entirely customized for describing cyber-epidemics.