Mathematical Modelling of Cybersecuritythreat Dynamics Using a Compartmental approach

Imagine the internet not as a cloud of data, but as a bustling, invisible city where millions of computers live, talk, and trade information. Just like a city full of people, this digital metropolis can get sick. When a computer virus or a piece of malicious software (malware) finds a way in, it doesn't just sit there; it spreads, infecting neighbors and turning them into new carriers of the disease. This is the world of cybersecurity, a field dedicated to keeping our digital city safe. For years, scientists have tried to predict these outbreaks using "compartmental models," which are basically fancy maps that sort computers into different groups: those who are healthy, those who are sick but hiding it, those who are actively spreading the virus, and those who have been cured or destroyed. While these maps are useful, the old ones often missed some of the sneakiest parts of the game, like the "latency" phase where a computer is infected but hasn't started attacking yet, or the specific role of a computer that has been hijacked to launch organized attacks.

In this new study, a team of researchers from universities in Pakistan, Ghana, Azerbaijan, and Turkey has built a more detailed, six-lane highway map of how cyber-attacks travel. They call their model "SEAMRD," which stands for Susceptible, Exposed, Malicious, Attacker, Recovered, and Dead. Think of it as a game of digital tag with six distinct roles. A computer starts as Susceptible (healthy but vulnerable). It gets tagged and becomes Exposed (infected but sleeping, like a sleeper agent). Then, it wakes up as Malicious (infected and spreading the virus). Some of these wake up even more aggressively as Attackers (actively launching new strikes). The good news is that some get Recovered (patched up and safe), while the worst-case scenario is that they become Dead (permanently broken and removed from the network). The researchers used complex math to simulate how these groups interact, calculating a "propagation number" (called $R_0$) that tells us how likely an outbreak is to take over the whole network. Their simulations suggest that the speed at which the virus spreads is the biggest driver of an outbreak, but that strong recovery systems and "awareness" (like better security updates) can act as a shield, slowing the spread and potentially stopping the epidemic before it takes hold.

The Digital City and Its Six Zones

To understand what these researchers did, let's walk through their digital city. In the real world, if you catch a cold, you might feel fine for a few days before you start sneezing on everyone. In the computer world, this is called the "Exposed" phase. A computer has been hit by a virus, but it's not yet spreading it. Old models often skipped this step or lumped it together with the "sick" phase. But this team realized that in the cyber world, the difference between a sleeping virus and an active one is huge.

They divided every computer in their network into one of six buckets:

1. Susceptible (S): These are the healthy computers, wide open and ready to be infected. They are the "uninfected" population.
2. Exposed (E): These computers have been hit by a virus but are in a "latent" or dormant state. They are infected but not yet spreading it. It's like a computer that has a virus file downloaded but hasn't executed it yet.
3. Malicious (M): Now the virus is awake. These computers are infected and are actively spreading the malware to others.
4. Attacker (A): This is the scary part. Some infected computers don't just spread the virus; they become "zombies" used to launch organized, aggressive attacks on other systems. The researchers treated these as a separate, highly dangerous group.
5. Recovered (R): These are the computers that have been cleaned, patched, and secured. They are back in the game, safe from the current virus.
6. Dead (D): Sometimes, a virus is so destructive it crashes the system permanently. These computers are "dead"—they are removed from the network and can no longer be infected or infect others.

The Math Behind the Madness

The researchers didn't just guess how these groups interact; they wrote a set of equations (a system of nonlinear differential equations) to describe the flow of computers between these six states. Imagine a water tank system where water flows from one tank to another. The "Susceptible" tank loses water to the "Exposed" tank when a virus strikes. The "Exposed" tank drains into the "Malicious" tank when the virus wakes up. The "Malicious" tank can drain into the "Attacker" tank, the "Recovered" tank, or the "Dead" tank.

One of the most important things they calculated is something called $R_0$ (the basic propagation number). In simple terms, $R_0$ is a score that tells you: "If one infected computer enters a network of healthy computers, how many new computers will it infect on average?"

• If $R_0$ is less than 1, the virus will eventually die out. It's like a fire that doesn't have enough fuel to keep burning.
• If $R_0$ is greater than 1, the virus will spread exponentially, causing an epidemic.

The team used a method called the "next-generation matrix" to calculate this score for their specific SEAMRD model. They found that the transmission rate (how easily the virus jumps from one computer to another) is the most dominant factor. If the virus spreads easily, $R_0$ shoots up. However, they also found that increasing the "recovery rate" (how fast we patch and fix computers) and the "awareness rate" (how fast we detect and stop the attack) can push $R_0$ down.

The Stability of the System

The researchers then asked a crucial question: "Is this system stable?" In math terms, they wanted to know if the network would naturally return to a healthy state or if it would get stuck in a state of constant infection.

They proved two main things:

1. The "No-Virus" State is Stable (if $R_0 < 1$): If the transmission rate is low enough (meaning the virus isn't very contagious or we are very good at fixing things), the network will naturally settle into a state where no computers are infected. They used a mathematical tool called a "Lyapunov function" to prove that no matter how the virus starts, it will eventually die out if $R_0$ is below 1.
2. The "Infected" State is Stable (if $R_0 > 1$): If the virus is too strong and $R_0$ is above 1, the network will settle into a state where the virus is always present. It won't go away on its own. The system will reach a "Malicious Equilibrium" where there is always a certain number of infected, attacking, and dead computers.

What Makes the Virus Win or Lose?

To figure out which levers we can pull to stop an attack, the team performed a "sensitivity analysis." This is like testing which knobs on a machine have the biggest effect on the output. They tweaked each parameter in their equations to see how much it changed the $R_0$ score.

The results were clear:

• The Transmission Rate ($\beta$): This is the big boss. If the virus spreads faster, the infection explodes. This parameter has the most positive influence on $R_0$.
• The Recovery Rate ($\gamma$) and Removal Rate ($\delta$): These are the heroes. If we can fix computers faster (recovery) or remove broken ones from the network (removal), the $R_0$ score drops significantly.
• The "Attacker" Transition ($\pi_A$): The rate at which a "Malicious" computer turns into an "Attacker" also matters. The more aggressive the infected computers become, the harder it is to stop the spread.

The Takeaway

The study concludes that while we cannot stop every cyber-attack, we can control the spread. The simulations suggest that if we focus on vigorous recovery systems (fixing computers quickly) and suitable control mechanisms (stopping the virus from spreading in the first place), we can reduce the number of infections.

The researchers didn't just say "it's a good idea"; they used rigorous math to prove that if we can keep the transmission rate low and the recovery rate high, the network can return to a safe, virus-free state. However, if the virus is too strong ($R_0 > 1$), the network will remain in a state of constant battle. The key, they found, is understanding that not all infected computers are the same. Some are just sleeping, some are spreading, and some are actively attacking. By treating them differently in our defense strategies, we can build a more resilient digital city.

In the end, this paper is a blueprint for a smarter defense. It tells us that by recognizing the different stages of a cyber-attack and reacting with the right speed, we can tip the scales in our favor, turning a potential digital apocalypse into a manageable, contained event. The math says: if we patch fast and spread awareness, the virus loses.