Detection of Attacks in Internet of Thing Networks Using the SEQIRE Model

The rapid expansion of Internet of Things (IoT) networks has heightened the risk of sophisticated malware attacks due to the inherent vulnerabilities of resource-constrained devices. This study proposes the SEQIRE model - a novel compartmental framework inspired by epidemiological modeling - to analyze, detect, and control malware propagation in IoT ecosystems. The model extends classical SEIR-type structures by incorporating two additional compartments: Quarantined (Q) and Enhanced Monitoring (E*), enabling a more accurate representation of real-world cybersecurity interventions. A system of nonlinear ordinary differential equations was formulated to describe device transitions across six compartments: Susceptible, Exposed, Quarantined, Infected, Recovered, and Enhanced Monitoring. Theoretical analyses, including boundedness, positivity, and Lyapunov-based global stability, were conducted to ensure model feasibility. The basic reproduction number R0​ was derived using the Next-Generation Matrix method as a threshold condition for malware persistence. Numerical simulations using Python’s Runge-Kutta (RK45) method over a 200-day window validated the model's predictive performance. Key parameters - quarantine rate (γ), recovery rate (μ), and monitoring activation rate (θ) - were varied to assess their influence on infection suppression. Results indicate that increasing these parameters significantly reduces infection peaks and accelerates system stabilization. The SEQIRE model offers both analytical rigor and practical utility for dynamic threat mitigation in IoT networks. Its flexibility allows for deployment in real-time detection systems and supports decision-making for resource-optimized cybersecurity strategies.