A Network-Based SEIRS Model for IoT Malware Propagation with Optimal Control and Connectivity-Driven Dynamics

Dwi Ely  Kurniawan; Aini Suri Talita; Eri Prasetyo  Wibowo; Sarifuddin  Madenda; Michel Paindavoine

doi:10.29207/resti.v10i5.7786

Authors

Dwi Ely Kurniawan Politeknik Negeri Batam
Aini Suri Talita Universitas Gunadarma
Eri Prasetyo Wibowo Universitas Gunadarma
Sarifuddin Madenda Universitas Gunadarma
Michel Paindavoine Université Bourgogne Europe

DOI:

https://doi.org/10.29207/resti.v10i5.7786

Keywords:

basic reproduction number, IoT malware, network topology, optimal control, SEIRS model

Abstract

The number of Internet of Things (IoT) devices is growing quickly, creating large networks that are attractive targets for malware such as Mirai and Mozi. Most existing epidemic models assume homogeneous mixing, where every device has an equal probability of contacting others, although real IoT networks are characterized by heterogeneous connectivity in which highly connected hub devices accelerate malware propagation. This study proposes a network-based SEIRS model that incorporates connectivity-driven transmission dynamics by allowing the infection rate to depend on device degree. The model is used to derive the basic reproduction number (R₀) and establish the local and global stability conditions of the malware-free and endemic equilibria. Three intervention measures, namely patch deployment, network quarantine, and user-awareness campaigns, are incorporated into an optimal control framework using Pontryagin's Minimum Principle to balance infection reduction and intervention costs. The proposed model is evaluated using CICIoT2023 and CIC IoT-DIAD 2024 traffic datasets, complemented by network-topology information from N-BaIoT, representing 105 IoT devices and 33 attack types. Simulation results show that the combined optimal-control strategy reduces the peak number of infected devices by 78.4% compared with the uncontrolled scenario and by 31.6% compared with a conventional SEIRS model that ignores network structure, while reducing overall intervention costs by 42.3%. Sensitivity analysis identifies device connectivity as the dominant factor influencing outbreak severity, highlighting the importance of network-aware segmentation and prioritized patching for effective IoT malware containment.

Downloads

Download data is not yet available.

References

[1] W. Melibari, H. Baodhah, and N. Akkari, “IoT-Based Smart Cities Beyond 2030: Enabling Technologies, Challenges, and Solutions,” in 2023 1st International Conference on Advanced Innovations in Smart Cities (ICAISC), Jan. 2023, pp. 1–6. doi: 10.1109/ICAISC56366.2023.10085126.

[2] C. Xenofontos, I. Zografopoulos, C. Konstantinou, A. Jolfaei, M. K. Khan, and K.-K. R. Choo, “Consumer, commercial, and industrial iot (in) security: Attack taxonomy and case studies,” IEEE Internet of Things Journal, vol. 9, no. 1, pp. 199–221, 2021, doi: 10.1109/JIOT.2021.3079916.

[3] M. Antonakakis et al., “Understanding the mirai botnet,” in 26th USENIX security symposium (USENIX Security 17), 2017, pp. 1093–1110. Accessed: Mar. 06, 2026. [Online]. Available: https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/antonakakis.

[4] S. Herwig, K. Harvey, G. Hughey, R. Roberts, and D. Levin, “Measurement and Analysis of Hajime, a Peer-to-peer IoT Botnet,” Network and Distributed Systems Security (NDSS) Symposium, Jan. 2019, doi: 10.14722/ndss.2019.23488.

[5] “AV-ATLAS.” Accessed: May 04, 2026. [Online]. Available: https://portal.av-atlas.org/.

[6] L. Amer, “Malware development threats with modern technologies,” CSJ, vol. 6, no. 2, p. 178, Dec. 2022, doi: 10.69554/IXOV9059.

[7] C. Nowzari, V. M. Preciado, and G. J. Pappas, “Analysis and control of epidemics: A survey of spreading processes on complex networks,” IEEE Control Systems Magazine, vol. 36, no. 1, pp. 26–46, 2016, doi: 10.1109/MCS.2015.2495000.

[8] M. T. Hoang, “Mathematical analysis and numerical simulation of a generalized epidemiological model for malware propagation,” Nonlinear Dyn, vol. 114, no. 1, p. 53, Dec. 2025, doi: 10.1007/s11071-025-11912-8.

[9] H. Xia, L. Li, X. Cheng, C. Liu, and T. Qiu, “A Dynamic Virus Propagation Model Based on Social Attributes in City IoT,” IEEE Internet of Things Journal, vol. 7, no. 9, pp. 8036–8048, Sep. 2020, doi: 10.1109/JIOT.2020.2990365.

[10] L. Bai, J. Liu, R. Han, and W. Zhang, “Wireless Radar Sensor Networks: Epidemiological Modeling and Optimization,” IEEE Journal on Selected Areas in Communications, vol. 40, no. 6, pp. 1993–2005, Jun. 2022, doi: 10.1109/JSAC.2022.3155549.

[11] B. K. Mishra and D. Saini, “Mathematical models on computer viruses,” Applied Mathematics and Computation, vol. 187, no. 2, pp. 929–936, Apr. 2007, doi: 10.1016/j.amc.2006.09.062.

[12] B. K. Mishra and D. K. Saini, “SEIRS epidemic model with delay for transmission of malicious objects in computer network,” Applied Mathematics and Computation, vol. 188, no. 2, pp. 1476–1482, May 2007, doi: 10.1016/j.amc.2006.11.012.

[13] J. Chen, Y. Huang, R. Zhang, and Q. Zhu, “Optimal curing strategy for competing epidemics spreading over complex networks,” IEEE Transactions on Signal and Information Processing over Networks, vol. 7, pp. 294–308, 2021, doi: 10.1109/TSIPN.2021.3075338.

[14] Y. Zhou, B.-T. Liu, K. Zhou, and S.-F. Shen, “Malware propagation model of fractional order, optimal control strategy and simulations,” Frontiers in Physics, vol. 11, p. 1201053, 2023, doi: 10.3389/fphy.2023.1201053.

[15] R. Pastor-Satorras, C. Castellano, P. Van Mieghem, and A. Vespignani, “Epidemic processes in complex networks,” Rev. Mod. Phys., vol. 87, no. 3, pp. 925–979, Aug. 2015, doi: 10.1103/RevModPhys.87.925.

[16] L. Quiroga-Sánchez, G. A. Montoya, and C. Lozano-Garzon, “The SEIRS-NIMFA epidemiological model for malware propagation analysis in IoT networks,” Cybersecurity, vol. 8, no. 1, p. 2, Jan. 2025, doi: 10.1186/s42400-024-00310-z.

[17] E. Asadi and S. Hosseini, “Modeling of Malware Propagation Under the Clustering Approach in Scale-Free Networks,” SECURITY AND PRIVACY, vol. 8, no. 1, p. e465, 2025, doi: 10.1002/spy2.465.

[18] M. T. Jafar, L.-X. Yang, G. Li, Q. Zhu, C. Gan, and X. Yang, “Malware containment with immediate response in IoT networks: An optimal control approach,” Computer Communications, vol. 228, p. 107951, 2024, doi: 10.1016/j.comcom.2024.107951.

[19] R. Casado-Vara, R. Rodríguez García, C. Cambra, A. García-Fischer, E. Jove, and A. Herrero, “An Optimal Control Problem for a SIR Model with Two Mitigation Strategies for Malware Spread,” in Computational Intelligence in Security for Information Systems, E. Corchado, H. Quintián, H. Pérez García, J. L. Calvo Rolle, S. F. Ramos, F. J. Martínez de Pisón, Á. Herrero Cosío, and P. Fosci, Eds., Cham: Springer Nature Switzerland, 2026, pp. 147–156. doi: 10.1007/978-3-032-19770-2_14.

[20] P. Kumar, P. Rai, and B. K. Mishra, “Detection of Attacks in Internet of Thing Networks Using the SEQIRE Model,” Cureus Journal of Computer Science, Sep. 2025, doi: 10.7759/s44389-025-05898-y.

[21] S. Zhang, “Pontryagin Maximum Principle and Its Applications,” in Functional Analysis and Applications, S. Zhang, Ed., Singapore: Springer Nature, 2026, pp. 163–172. doi: 10.1007/978-981-95-0355-1_6.

[22] U. Boscain, M. Sigalotti, and D. Sugny, “Introduction to the Pontryagin Maximum Principle for Quantum Optimal Control,” PRX Quantum, vol. 2, no. 3, p. 030203, Sep. 2021, doi: 10.1103/PRXQuantum.2.030203.

[23] Y. Meidan et al., “N-baiot—network-based detection of iot botnet attacks using deep autoencoders,” IEEE Pervasive Computing, vol. 17, no. 3, pp. 12–22, 2018, doi: 10.1109/MPRV.2018.03367731.

[24] E. C. P. Neto, S. Dadkhah, R. Ferreira, A. Zohourian, R. Lu, and A. A. Ghorbani, “CICIoT2023: A real-time dataset and benchmark for large-scale attacks in IoT environment,” Sensors, vol. 23, no. 13, p. 5941, 2023, doi: 10.3390/s23135941.

[25] Canadian Institute for Cybersecurity, “CIC IoT-DIAD 2024: A dual-function dataset for IoT device identification and anomaly detection.” Accessed: May 04, 2026. [Online]. Available: https://www.unb.ca/cic/datasets/iot-diad-2024.html

[26] J. Shi and L. Zhu, “Epidemic spreading on heterogeneous probabilistic activity driven network model,” Nonlinear Dyn, vol. 114, no. 3, p. 161, Jan. 2026, doi: 10.1007/s11071-025-12206-9.

[27] X. Zhu and N. Fu, “Modeling and Stability Analysis of Malware Propagation in Hierarchically Protected WSNs Based on Epidemiological Theory,” IET Control Theory & Applications, vol. 20, no. 1, p. e70100, 2026, doi: 10.1049/cth2.70100.

[28] A. Karnik and P. Dayama, “Optimal control of information epidemics,” in 2012 Fourth International Conference on Communication Systems and Networks (COMSNETS 2012), Jan. 2012, pp. 1–7. doi: 10.1109/COMSNETS.2012.6151316.

[29] Md. A. Hossain, “Deep learning-based intrusion detection for IoT networks: a scalable and efficient approach,” EURASIP J. on Info. Security, vol. 2025, no. 1, p. 28, Sep. 2025, doi: 10.1186/s13635-025-00202-w.

[30] P. Jain, A. Rathour, A. Sharma, and G. S. Chhabra, “Bridging Explainability and Security: An XAI-Enhanced Hybrid Deep Learning Framework for IoT Device Identification and Attack Detection,” IEEE Access, vol. 13, pp. 127368–127390, 2025, doi: 10.1109/ACCESS.2025.3590159.

[31] H. Guo, M. Li, and Z. Shuai, “A graph-theoretic approach to the method of global Lyapunov functions,” Proceedings of the American Mathematical Society, vol. 136, no. 8, pp. 2793–2802, 2008, doi: 10.1090/S0002-9939-08-09341-6.