💻 computer science

Deep Learning Enhanced Mathematical Model for Malware Propagation under Two-Level Security Protection

This paper proposes a hybrid framework combining a nonlinear two-level security epidemic model with a deep neural network to analyze, predict, and efficiently simulate malware propagation dynamics, demonstrating high accuracy and computational efficiency for cybersecurity applications.

Original authors: RP Chauhan, Sumit Kumar, Devesh Tiwari, CH Manvitha

Published 2026-10-12

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: RP Chauhan, Sumit Kumar, Devesh Tiwari, CH Manvitha

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the digital world, computer networks are constantly under siege by malicious software, often called malware. These are programs designed to disrupt systems, steal data, or cause chaos, spreading from one device to another much like a virus moves through a population. For decades, security experts have relied on mathematical models to predict how these digital infections spread. These models treat computers as individuals in a crowd, tracking how many are healthy, how many are sick, and how many have recovered or been isolated. The goal is to find the tipping point where an infection dies out naturally versus the point where it becomes a permanent, unmanageable problem. Understanding this balance is critical because modern threats have evolved into sophisticated, fast-moving attacks that can cripple entire organizations in minutes.

A team of researchers has now refined this approach by acknowledging a reality that older models often missed: not all computers are equally safe. In the real world, some devices have weak security, perhaps running outdated software or lacking a firewall, while others are fully protected with the latest updates and strict access controls. The researchers built a new, more detailed model that separates these two groups, treating weakly protected machines as vulnerable but not doomed, and fully protected machines as nearly immune. They then combined this mathematical framework with a powerful type of artificial intelligence known as a deep neural network. This hybrid system allows them to simulate how malware moves through a network with two layers of defense, identifying exactly which security measures matter most and creating a fast, accurate tool to predict future outbreaks without needing to run slow, complex calculations every time.

The researchers started by dividing a computer network into six distinct groups. There are the susceptible machines, those that are healthy but unprotected. Then there are the weakly protected nodes, which have some security but can still be infected, and the fully protected nodes, which are so well-defended that the malware cannot get in. Alongside these are the infected machines, the quarantined ones that have been isolated to stop the spread, and the recovered ones that have been cleaned and are safe for now. The model tracks how computers move between these groups. New machines enter the network, some choose to upgrade their security from weak to full protection, and others lose their protection over time, slipping back into a vulnerable state. The core of the study was to see how these movements interact. They found that the speed at which infected machines are quarantined is the single most powerful factor in stopping an outbreak. If the quarantine rate is high enough, the infection dies out. If it is too low, the malware settles into the network and persists indefinitely.

To make these predictions useful for real-time decision-making, the team introduced a deep neural network, a type of computer program that learns patterns from data. Instead of solving complex equations step-by-step, which can be slow, they trained this neural network on the results of their mathematical model. Once trained, the neural network could instantly predict the number of infected and quarantined computers at any given moment. The results were strikingly accurate. The artificial intelligence model matched the traditional mathematical calculations with an error so small it was almost invisible, achieving a level of precision that suggests it could be used as a reliable substitute for the slower methods. This means that security teams could potentially use this tool to get immediate answers about how an infection might spread under different scenarios, allowing them to react faster than ever before.

The study also tested how different security strategies would change the outcome. They discovered that simply having a few fully protected machines is not enough; the rate at which weakly protected machines are upgraded to full protection is equally vital. Furthermore, the effectiveness of the weak protection itself matters. If the weak security is very good, it slows the spread significantly, but if it is poor, the malware moves quickly. The researchers used these insights to map out exactly how changing one variable, like the speed of quarantine or the rate of security upgrades, would ripple through the entire system. They found that combining a high rate of quarantine with a strong push to upgrade all machines to full protection creates a powerful barrier that can drive the reproduction number of the malware below the critical threshold, effectively clearing the network of the threat.

This work does more than just offer a new equation; it provides a practical, fast way to understand the complex dance of digital infection. By proving that a deep neural network can accurately mimic the behavior of a sophisticated mathematical model, the researchers have opened the door to faster, more efficient cybersecurity analysis. Their findings confirm that while malware is a persistent threat, the combination of rapid isolation and consistent security upgrades offers a clear path to control. The study concludes that these hybrid models, which blend traditional math with modern artificial intelligence, are ready to become essential tools for keeping our digital infrastructure safe, offering a way to see the future of an outbreak before it happens.

Technical Summary: Deep Learning Enhanced Mathematical Model for Malware Propagation under Two-Level Security Protection

Problem Statement
Malware propagation remains a critical threat to the security and reliability of computer networks, evolving from simple viruses to sophisticated threats like WannaCry and Ryuk. While conventional mathematical models, often adapted from epidemiological SIR-type frameworks, have been used to study virus spread, they frequently treat all protected nodes as equally secure. This simplification fails to capture the heterogeneous security postures of real-world networks, where devices vary significantly in patch status, configuration completeness, and update frequency. Furthermore, while deep learning has shown promise in approximating dynamical systems, its specific application as a computationally efficient surrogate for complex malware propagation models with multi-level security states requires further investigation.

Methodology
The authors propose a hybrid framework combining a nonlinear mathematical model with a Deep Neural Network (DNN).

Mathematical Formulation (SP1P2IQR Model):
The study introduces a six-compartment epidemic model: Susceptible ( $S$ ), Weakly Protected ( $P_1$ ), Fully Protected ( $P_2$ ), Infected ( $I$ ), Quarantined ( $Q$ ), and Recovered ( $R$ ).
- Two-Level Protection: The model distinguishes between weakly protected nodes (which can still be infected, though at a reduced rate determined by efficacy parameter $\epsilon$ ) and fully protected nodes (assumed completely resistant).
- Dynamics: The system is governed by a set of non-linear ordinary differential equations (ODEs) incorporating parameters for node entry ( $\Pi$ ), transmission rates ( $\beta$ ), protection adoption ( $\alpha_1, \alpha_2$ ), protection loss ( $\gamma$ ), upgrades ( $\delta$ ), quarantine ( $\eta$ ), and recovery ( $\phi, \theta$ ).
- Qualitative Analysis: The authors rigorously established the positivity and boundedness of solutions, proving the existence of an invariant region $\Omega$ . They derived the basic reproduction number ( $R_0$ ) using the next-generation matrix technique and analyzed the stability of the malware-free equilibrium (MFE) and endemic equilibrium (EE).
Sensitivity Analysis:
A normalized forward sensitivity index was calculated for $R_0$ to identify parameters with the most significant influence on malware persistence.
Deep Neural Network (DNN) Surrogate:
To address the computational cost of iterative ODE solving, a feedforward DNN was developed as a surrogate model.
- Architecture: The network features an input layer (12 neurons), four hidden layers (20, 15, 10, and 5 neurons respectively) using hyperbolic tangent (tansig) activation, and an output layer (2 neurons) using linear (purelin) activation to predict the infected ( $I(t)$ ) and quarantined ( $Q(t)$ ) compartments.
- Training: The network was trained using the Levenberg-Marquardt backpropagation algorithm on data generated by the ode45 solver. The dataset (500 time points) was split into 70% training, 15% validation, and 15% testing.

Key Results

Mathematical Stability: The analysis confirmed that the MFE is locally asymptotically stable when $R_0 < 1$ and unstable when $R_0 > 1$ . When $R_0 > 1$ , a unique endemic equilibrium exists.
Sensitivity Findings: The quarantine rate ( $\eta$ ) exhibited the strongest negative sensitivity index ($-0.8065$), indicating that increasing quarantine rates significantly reduces $R_0$ . The transmission rate ( $\beta$ ) and node entry rate ( $\Pi$ ) had the strongest positive impact ( $+1.0$ ). The direct adoption of full protection ( $\alpha_2$ ) was found more effective at suppressing $R_0$ than adopting weak protection.
Numerical Simulations: Simulations demonstrated that when $R_0 < 1$ , the network converges to a malware-free state. Conversely, when $R_0 > 1$ , the system settles into a stable endemic state with persistent infection levels.
DNN Performance: The DNN surrogate model achieved exceptional predictive accuracy.
- Accuracy: The Mean Squared Error (MSE) for both $I(t)$ and $Q(t)$ was $9.94 \times 10^{-11}$ .
- Regression: The model achieved an $R^2$ value of $1.0000$ for both compartments.
- Efficiency: The network converged in 936 epochs (approximately 2 minutes and 10 seconds), providing instant predictions post-training compared to iterative ODE solving.
- Generalization: The model demonstrated robust performance in both interpolation and extrapolation scenarios without overfitting.

Significance and Claims
The paper claims that the proposed hybrid mathematical-DNN framework offers a dual contribution to cybersecurity analysis:

Realistic Modeling: By incorporating two distinct levels of security protection, the SP1P2IQR model provides a more accurate representation of heterogeneous network environments than traditional models that assume uniform security.
Computational Efficiency: The DNN serves as a highly accurate and computationally inexpensive surrogate model. It captures the nonlinear dynamics of malware spread with negligible error, offering a viable alternative to conventional numerical solvers for real-time applications and rapid scenario analysis.

The authors conclude that this framework effectively bridges theoretical epidemiological modeling with artificial intelligence, providing a useful tool for understanding and predicting malware dynamics under varying security conditions. They suggest future work could extend the model to include time delays and stochastic network effects.

Technical Summary: Deep Learning Enhanced Mathematical Model for Malware Propagation under Two-Level Security Protection

More like this