A mathematical model for IoT malware propagation with adaptive patching strategy based on R₀: a simple optimal control approach

Abstract

This paper presents a mathematical framework for modeling and controlling internet of things (IoT) malware propagation via an adaptive patching strategy governed by the real-time basic reproduction number R₀. We introduce the SEIR-P (susceptible–exposed–infected–recovered–patched) model, where the patching control rate u(t) is a sigmoid feedback function of R₀(t). All epidemiological parameters are calibrated from three empirical malware captures of the IoT-23 dataset (Stratosphere laboratory, Czech Technical University) a publicly available labeled collection of real IoT network traffic comprising 23 captures from infected and benign devices: CTU-IoT-1 (Mirai), CTU-IoT-9 (Torii), and CTU-IoT-17 (IRCBot) yielding the first empirically grounded parameter set for SEIR-type IoT epidemic models with confidence intervals. The optimal control problem is formulated via pontryagin’s maximum principle (PMP), and a closed-form R₀(u) expression is derived via the next-generation matrix (NGM), yielding the critical threshold u_crit = 0.142 day⁻¹. Five comparative simulation scenarios over a 365-day horizon show that the proposed R₀-adaptive strategy achieves a 91.3% reduction in peak infection (360 vs. 4,142 devices), eradicates malware by day 179, and attains the highest cost-effectiveness index (CEI = 1.142). Global asymptotic stability of the disease-free equilibrium under u*(t) is proven via Lyapunov’s method and LaSalle’s Invariance Principle. PRCC sensitivity analysis identifies u_max and β as dominant parameters. This closed-loop framework bridges the gap between abstract epidemic theory and deployable IoT security management.