Dynamics of defensive and malicious worm co-propagation across networked systems

The proliferation of Internet of Things (IoT) devices has greatly enhanced global connectivity but has also amplified cybersecurity risks, particularly from self-propagating malware or black worms. As a countermeasure, some researchers have proposed white worms: benign, self-replicating agents designed to autonomously patch vulnerable systems. Yet, their autonomous behavior raises complex ethical and legal concerns. In this paper, we develop a dynamical model of interacting black and white worms using tools from network epidemiology to explore their co-propagation and emergent behavior across IoT networks. We investigate how parameters related to user response, worm aggressiveness, and network topology shape the system’s stability and their dynamics. Our results show that ethical restrictions, such as reduced autonomy or shorter activity, significantly limit the ability of white worms to suppress botnets. Moreover, network structure plays a decisive role in shaping these outcomes. Overall, the study highlights a fundamental tension between ethical design and practical efficacy: to be truly effective, a white worm must behave in ways that challenge its ethical intent. • Model assesses ethically-constrained white worm effectiveness. • Nonlinear thresholds govern botnet suppression dynamics. • Network topology strongly modulates emergent protection in IoT systems.