A multi-layer SEIRS-V network epidemic model for IoT malware propagation with heterogeneous device types and patch dynamics

The Internet of Things (IoT) ecosystem comprises billions of heterogeneous devices with diverse hardware architectures, operating systems, vulnerability profiles, and patch management capabilities, creating a complex and dynamic attack surface for malware propagation. This paper develops a comprehensive multi-layer network epidemic model for characterizing malware spread in heterogeneous IoT networks. The proposed framework integrates three key dimensions: (۱) a Susceptible-Exposed-Infected-Recovered-Susceptible with Vaccination (SEIRS-V) compartmental structure capturing device-level infection states and patching status, (۲) a multi-layer network topology distinguishing between physical proximity, logical connectivity, and protocolbased communication graphs, and (۳) device-type heterogeneity with class-specific parameters for vulnerability, infectiousness, and recovery rates. The hybrid formulation yields a system of coupled differential equations that admits analytical expressions for the basic reproduction number R۰, type-specific epidemic thresholds, and equilibrium prevalence. Numerical simulations calibrated with empirical IoT device data from Shodan and Censys demonstrate that physical proximity layers increase early-stage propagation speed by ۲۸-۴۳% compared to logical connectivity alone, while device-type heterogeneity reduces the critical epidemic threshold by ۳۱-۴۷% relative to homogeneous assumptions. The model provides security analysts with quantitative tools for identifying critical infection pathways, prioritizing device classes for patching, and evaluating network segmentation strategies.

کلیدواژه ها:

IoT security ، multi-layer networks ، epidemic modeling ، heterogeneous devices ، patch management