Optimal Patching in Clustered Malware Epidemics

Studies on the propagation of malware in mobile networks have revealed that the spread of malware can be highly inhomogeneous. Platform diversity, contact list utilization by the malware, clustering in the network structure, etc. can also lead to differing spreading rates. In this paper, a general formal framework is proposed for leveraging such heterogeneity to derive optimal patching policies that attain the minimum aggregate cost due to the spread of malware and the surcharge of patching. Using Pontryagin’s Maximum Principle for a stratified epidemic model, it is analytically proven that in the mean-field deterministic regime, optimal patch disseminations are simple single-threshold policies. Through numerical simulations, the behavior of optimal patching policies is investigated in sample topologies and their advantages are demonstrated.

💡 Research Summary

The paper addresses the problem of designing optimal patch‑distribution policies for malware epidemics in heterogeneous mobile networks. Recognizing that real‑world wireless environments exhibit strong inhomogeneities—due to geographic clustering, platform diversity, differing contact patterns, and other factors—the authors move beyond the classical homogeneous‑mixing assumption and formulate a stratified mean‑field epidemic model with M distinct node types (or clusters).

Two propagation settings are considered. In the non‑replicative case, only a pre‑selected fraction of nodes (dispatchers) are initially equipped with the patch; they can transmit the patch to susceptible and infected nodes but the recipients do not further spread it. In the replicative case, once a node receives the patch it joins the pool of dispatchers, so the patch spreads analogously to the malware. For each type i, the state variables S_i(t), I_i(t), and R_i(t) denote the fractions of susceptible, infected, and recovered nodes, respectively, with S_i+I_i+R_i=1. Contact rates for infection (β_ij) and for patch transmission ( (\bar β_{ij}) ) are allowed to differ across type pairs, capturing arbitrary network topologies. An efficacy coefficient π_ij∈