💻 computer science

GTI-mSEMP Framework : A Proposed Framework to Simulate Malware Propagation with Inclusion of Attacker-Defender Strategy

This paper proposes the GTI-mSEMP framework, which integrates game theory into modified epidemic models to simulate and analyze dynamic malware propagation in resource-constrained cyber-physical networks by explicitly modeling the strategic interactions between attackers and defenders across various operational regimes.

Original authors: Shadeeb Hossain, Kristopher Wilson

Published 2026-06-30

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Shadeeb Hossain, Kristopher Wilson

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a smart city where thousands of tiny, battery-powered devices (like smart sensors) talk to each other to manage traffic, lights, and energy. Now, imagine a digital virus trying to spread through this city, turning these helpful devices into a chaotic mob.

This paper proposes a new way to simulate that chaos. Instead of just watching the virus spread like a simple cold, the authors built a virtual war game between an Attacker (the virus) and a Defender (the security team).

Here is the breakdown of their idea, the "game" they played, and what they found, using simple analogies.

1. The Old Way vs. The New Way

The Old Way (Static Models): Imagine trying to predict how a fire spreads in a forest by assuming the wind never changes and the firefighters always stand in the same spot. Traditional computer models treat security defenses as "static"—they don't change, even if the attacker gets smarter.
The New Way (GTI-mSEMP): The authors say, "Real life isn't static." If the attacker changes their tactics, the defender must change theirs instantly. They created a framework called GTI-mSEMP. Think of this as a live chess match where every time the attacker moves a piece, the defender immediately recalculates their next move based on where the threat is strongest right now.

2. The Four "States" of a Device

The paper tracks every device in the network through four stages, similar to how a person gets sick:

Susceptible (S): A healthy device that hasn't been hit yet but is vulnerable.
Exposed (E): The device has been "touched" by the virus but hasn't fully turned evil yet. It's in a "latency" period, like a person who has the flu but isn't coughing yet.
Infected (I): The device is now fully compromised. It is actively spreading the virus to its neighbors.
Recovered (R): The security team has patched the device, and it's safe again (for now).

3. The Game: Attacker vs. Defender

The core of the paper is how the Attacker and Defender spend their "energy points" (resources).

The Attacker's Strategy: They have a matrix (a grid) of resources. They can choose to attack the "Gateways" (the main highways), the "Routers" (the local streets), or the "Sensors" (the individual houses). They also choose their weapon: a Brute Force Attack (trying every password until one works) or a Zero-Day Exploit (using a secret, unknown hole in the software).
The Defender's Strategy: The defender also has a grid of resources. They must decide how much of their "security budget" to spend on protecting the Gateways vs. the Sensors, and how much to spend on stopping Brute Force vs. Zero-Day attacks.

The Twist: The paper introduces a "Game Theory" element. The probability of a device getting infected isn't a fixed number. It changes based on who is winning the local battle.

If the Attacker spends a lot of energy on a specific area, the infection rate goes up.
If the Defender spends a lot of energy there, the infection rate goes down and the recovery rate goes up.

4. The Three Scenarios (The "What Ifs")

The authors ran three different simulations to see what happens under different conditions:

Scenario A: The Balanced Matchup
- The Analogy: Both the attacker and defender have equal resources and spread them evenly across the whole city.
- The Result: The virus spreads, but the defender manages to save the most devices overall. It's a fair fight, and the network survives best here.
Scenario B: The Evasive Exploit Surge (The "Trap")
- The Analogy: The defender is reactive. They see the virus hitting the "Sensors" (the edge of the network), so they rush all their security guards to the Sensors.
- The Result: The attacker sees this and sneaks around to the "Gateways" (the main highways) where no one is watching. Because the defender moved all their guards to the wrong place, the virus spreads faster and longer. The paper calls this an "evasive" attack where the defender is outmaneuvered.
Scenario C: The Aggressive Quarantine (The "Fortress")
- The Analogy: The defender decides to build an impenetrable wall around the "Gateways" (the most important part) and leaves the rest of the city less protected.
- The Result: The Gateways are safe, but the virus eats through the rest of the city (the Sensors and Routers) very quickly. The network collapses faster than in the balanced scenario because the defense was too focused on one spot.

5. The Big Discovery

The most important finding is about adaptability.

When the Defender is Stronger: If the defender's tools are slightly better than the attacker's (meaning they can patch faster than the virus can spread), the network stabilizes. The "epidemic curve" flattens out, and the system recovers.
When the Attacker is Stronger: The paper ran a simulation where the attacker's tools were supercharged (5x more effective than the defender's). In this case, the virus exploded. The number of infected devices skyrocketed, and the healthy devices were wiped out almost instantly.

Summary

The paper argues that you cannot treat cybersecurity like a static wall. You have to treat it like a dynamic game.

If you put all your security guards in one place, the enemy will go around them.
If you spread your guards out evenly, you might survive better.
Most importantly, the defender must constantly watch where the virus is right now and move their resources there instantly. If they do this, they can stop the virus. If they are too slow or too rigid, the network will collapse.

The authors used a computer program (MATLAB) to run these "what-if" games and proved that a smart, moving defense is the only way to survive a fast-moving digital virus.

Technical Summary: GTI-mSEMP Framework

Problem Statement

The rapid proliferation of automated, multi-vector malware threats poses a critical risk to heterogeneous, resource-constrained cyber-physical networks, particularly within the Internet of Things (IoT) ecosystem. Existing epidemiological models used to simulate malware propagation (such as standard SEIR models) often treat security defenses as static parameters. This approach fails to capture the strategic, asymmetric maneuvers between attackers and defenders, where defensive strategies must dynamically adapt to offensive actions under strict computational and operational constraints. Consequently, traditional models cannot accurately predict localized node population states or the transient dynamics of network security in highly adversarial environments.

Methodology

To address these limitations, the authors propose the Game-Theory-Integrated Modified Multi-Wireless Sensor Epidemic Malware Propagation (GTI-mSEMP) framework. This model integrates stochastic game theory with compartmental epidemic modeling to create a dynamic simulation environment.

Core Mathematical Formulation:
The framework modifies the standard Susceptible-Exposed-Infected-Recovered (SEIR) model by treating transition rates as dynamic variables dependent on the strategic profiles of both the attacker ( $A$ ) and the defender ( $D$ ).

Susceptible State ( $S$ ): The transition probability ( $p$ ) from Susceptible to Exposed is modeled as a function of network spatial density ( $\rho$ ), the attacker's offensive strategy matrix ( $A$ ), and the defender's mitigation policy matrix ( $D$ ). The probability is defined as a ratio of offensive investment to the sum of offensive investment and defensive efficiency.
Exposed State ( $E$ ): The transition rate ( $\lambda_1$ ) from Exposed to Infected is no longer a fixed constant but a dynamic coefficient influenced by the attacker's payload optimization and the defender's runtime auditing intensity.
Infected State ( $I$ ): The recovery rate ( $\gamma$ ) is formalized as a joint function of the attacker-defender strategies, representing the rate at which nodes are successfully patched or removed from the network.
Recovered State ( $R$ ): The model includes a re-susceptibility coefficient ( $\delta$ ) that accounts for nodes reverting to a vulnerable state due to patch expiration or configuration resets, also governed by the strategic interaction between adversaries.

Simulation Setup:
The framework was evaluated using a MATLAB environment with a 4th-order Runge-Kutta (RK4) numerical solver. The simulation modeled a heterogeneous network topology consisting of three node classes: Core Gateways, Intermediate Routing Nodes, and Low-Power Peripheral Sensors. Two primary threat vectors were simulated: Brute-Force Attacks (BFA) and Zero-Day Exploits.

Three operational regimes were analyzed to test the framework's sensitivity:

Balanced Equilibrium Matchup: Symmetric resource allocation between attacker and defender.
Evasive Exploit Surge: A scenario where the defender is outmaneuvered, simulating a strategic mismatch.
Aggressive Quarantine: A hardened defense posture with concentrated resources on core gateways.

Key Contributions

Dynamic Transition Rates: The paper introduces a mathematical formulation where transmission rates, recovery rates, and effective reproduction numbers are not time-invariant but are dynamic variables dependent on localized strategy profiles executed within a stochastic game framework.
Strategic Matrix Modeling: The authors formalize offensive and defensive strategies as $n \times m$ matrices, allowing for the allocation of resources across different node classes and exploit vectors simultaneously.
Closed-Loop Optimization: The framework demonstrates a reactive defense mechanism where the defender dynamically updates resource allocation weights based on the real-time infection footprint ( $I$ and $E$ states) of specific network layers.

Results and Discussion

Numerical simulations yielded the following observations across the three operational regimes:

Balanced vs. Asymmetric Defense: In the Balanced Matchup (Case I), the network achieved the highest global remediation ceiling (~435 nodes), suggesting that a balanced distribution of defensive capital across all topological layers yields superior long-term resilience compared to hyper-localized strategies.
Vulnerability of Concentrated Defense: In the Aggressive Quarantine (Case III), while the core gateways were hardened, the concentration of defensive assets left intermediate routing and peripheral layers vulnerable. This allowed adversaries to exploit unhardened sectors, accelerating the system-wide depletion of healthy nodes compared to the more gradual decay in other cases.
Impact of Scaling Vectors: The study highlighted the critical importance of scaling efficiency coefficients ( $\eta$ $η$ for defense vs. $\mu$ $μ$ for attack).
- When defensive scaling factors held an advantage ( $\eta > \mu$ ), the system exhibited a suppressed epidemic footprint and a flattened Infectious ( $I$ ) peak.
- When the scaling vectors were inverted to favor offensive capabilities (simulating a severe adversary advantage), the network experienced a massive, unchecked epidemic cascade. The Infectious population peaked at approximately 450 nodes (a >400% increase compared to the defender-favorable scenario), and the Susceptible population dropped to critically low levels (125 nodes).
Dynamic Resource Allocation: The simulation confirmed that continuously updating resource distribution in real-time, based on the shifting threat landscape, successfully counters evasive attacker strategies and dictates the recovery rate of the network.

Significance and Claims

The paper claims that the GTI-mSEMP framework provides a rigorous mathematical and numerical foundation for evaluating dynamic malware propagation in highly adversarial network environments. By moving beyond static parameters, the model offers a more realistic simulation of the "cat-and-mouse" dynamics inherent in cyber warfare. The authors assert that their findings validate the necessity of real-time state-dependent resource optimization to disrupt automated propagation engines, such as Brute-Force Attacks and Zero-Day threats. The framework is presented as a tool to predict localized node population states and evaluate the efficacy of dynamic cyber-defense strategies in resource-constrained cyber-physical systems.