Internet malware propagation: Dynamics and control through SEIRV epidemic model with relapse and intervention

TL;DR

This paper models malware spread using a SEIRV epidemic framework, analyzing its dynamics and stability, and proposes an optimization-based approach to design effective control strategies, validated with real infection data.

Contribution

It introduces a comprehensive SEIRV model for malware propagation, including relapse and intervention, and develops a hybrid optimization method for control strategy design.

Findings

Identified key parameters influencing malware spread.

Demonstrated exponential decay in cases with earlier intervention.

Validated model with real malware infection data.

Abstract

Malware attacks in today's vast digital ecosystem pose a serious threat. Understanding malware propagation dynamics and designing effective control strategies are therefore essential. In this work, we propose a generic SEIRV model formulated using ordinary differential equations to study malware spread. We establish the positivity and boundedness of the system, derive the malware propagation threshold, and analyze the local and global stability of the malware-free equilibrium. The separatrix defining epidemic regions in the control space is identified, and the existence of a forward bifurcation is demonstrated. Using normalized forward sensitivity indices, we determine the parameters most influential to the propagation threshold. We further examine the nonlinear dependence of key epidemic characteristics on the transmission rate, including the maximum number of infected, time to peak infection, and total number of infected. We propose a hybrid gradient-based global optimization framework using simulated annealing approach to identify effective and cost-efficient control strategies. Finally, we calibrate the proposed model using infection data from the "Windows Malware Dataset with PE API Calls" and investigated the effect of intervention onset time on averted cases, revealing an exponential decay relationship between delayed intervention and averted cases.