A Clustered Link-Prediction SEIRS Model with Temporal Node Activation for Modeling Computer Virus Propagation in Urban Communication Systems

We propose the Clustered Link-Prediction SEIRS model with Temporal Node Activation (CLP-SEIRS-T), a novel epidemiological framework that integrates community structure, link prediction, and temporal activation schedules to simulate malware propagation in urban communication networks. Unlike traditional static or homogeneous models, our approach captures the heterogeneous community structure of the network (modular connectivity), along with evolving connectivity (emergent links) and periodic device-usage patterns (online/offline cycles), providing a more realistic portrayal of how computer viruses spread. Simulation results demonstrate that strong community modularity and intermittent connectivity significantly slow and localize outbreaks. For instance, when devices operate on staggered duty cycles (asynchronous online schedules), malware transmission is fragmented into multiple smaller waves with lower peaks, often confining infections to isolated communities. In contrast, near-continuous and synchronized connectivity produces rapid, widespread contagion akin to classic epidemic models, overcoming community boundaries and infecting the majority of nodes in a single wave. Furthermore, by incorporating a common-neighbor link-prediction mechanism, CLP-SEIRS-T accounts for future connections that can bridge otherwise disconnected clusters. This inclusion significantly increases the reach and persistence of malware spread, suggesting that ignoring evolving network topology may underestimate outbreak risk. Our findings underscore the importance of considering temporal usage patterns and network evolution in malware epidemiology. The proposed model not only elucidates how timing and community structure can flatten or exacerbate infection curves, but also offers practical insights for enhancing the resilience of urban communication networks—such as staggering device online schedules, limiting inter-community links, and anticipating new connections—to better contain fast-spreading cyber threats.