Hybrid Control Strategies for Mitigating Covert Malware Spread in Heterogeneous Networks

In the current era of information explosion, cybersecurity challenges have become increasingly prominent. Compared to malware that causes direct attacks, covert malware poses a significant cybersecurity threat as it can remain hidden within networks for extended periods while stealthily stealing users’ private information. To address the challenge of clearing covert malware, this study proposes two defense mechanisms: the Patch Propagation Mechanism (PPM) the aSleep-aWake Mechanism (SWM). Based on these mechanisms, we develop a mean-field two-layer propagation model, SW-VIPU (aSleep-aWake-Vulnerable-Infected-Patched-Unaware), to analyze the network’s dynamic evolution. In addition to theoretical analysis, the effectiveness of PPM and SWM in curbing the spread of malware is validated through comparisons with existing models and simulations on real-world network topologies. Subsequently, to enhance the performance of SWM, we introduce a multi-pulse control mechanism and analyze the dynamic performance of SW-VIPU under this mechanism. Finally, to comprehensively explore and improve the control effectiveness, we introduce static strategies as well as an objective-function-based dynamic defense framework, leading to the development of several hybrid control strategies (HCSs). The effectiveness of these HCSs is confirmed through simulation experiments. The experimental results demonstrate that the proposed dynamic HCSs outperform static HCSs in most scenarios. Furthermore, when malware exhibits a high propagation capability, patches should be deployed at their maximum deployment output, and users should be forced to log out and be prohibited from logging back in. Conversely, when malware spread capability is weaker, although the patch output should still be maintained at its highest level, user logins and logouts should not be restricted.