Internet of Things (IoT) networks have experienced rapid development in areas such as smart cities, smart health, and smart transportation. Such networks have characteristics such as node mobility, node heterogeneity, link heterogeneity, and topology diversity [1]. Facing these characteristics and the large data processing demands brought by the explosive growth of IoT nodes, edge computing has become an emerging network architecture that provides powerful computing capabilities and good service functions to support IoT applications [2–4]. In this manner, Edge Computing-enabled IoT (ECIoT) architecture brings computation, storage, and analytic capabilities closer to the data source, enabling real-time decision-making and reducing the latency of data transmission to cloud-based systems [5]. However, ECIoT nodes (ECIoTNs) with distributed and interconnected nature involve security vulnerabilities [6] introduced by malicious software such as Trojans, spyware, viruses, worms, rootkits, etc. Each type of malicious software has certain characteristics and infiltrates the ECIoT through different methods [7]. Incidents of significant losses caused by the spread of malicious software are not uncommon in society [8]. In November 2022, a new type of ransomware attacked the Australian insurance giant Medibank, which affected the personal information of 9.7 million customers, involving multiple sectors such as healthcare institutions and government departments [9]. The attackers typically spread malicious software to victims’ systems through email attachments or network vulnerabilities, and then demanded ransom to decrypt the infected files. The ransomware attack has caused significant financial losses and leads to data breaches and system paralysis. In the same year, the Bank of Zambia was hit by ransomware attacks, causing disruptions in some systems, threatening crucial financial data and impacting its normal operations and financial system stability, and resulting in certain negative effects on the country’s economy. These two attacks resulted in many organizations facing the risks of data loss, business disruptions, and substantial financial losses [10].

Recent research shows that malicious software in ECIoT is capable of spreading itself and has become a major factor affecting ECIoT security [11]. Once malicious software exploits vulnerabilities in ECIoTNs and spreads widely in the ECIoT, it can eavesdrop on ECIoTNs data and even cause ECIoTNs to completely lose their functionality by depleting their energy sources [12,13]. This seriously affects the availability, confidentiality, and stability of ECIoT services. Therefore, it is urgent to study the infection behavior and influencing factors of malicious software in ECIoT and provide methods for analyzing the stability of the infection model of malicious software in ECIoT [14].

The goal of the current work is to explore the spread rule of malicious software within ECIoTNs and propose strategies to prevent and inhibit its spread. It also proposes a malicious software infection model that integrates the expected probability of malicious software infection behavior by extending epidemic theory [15]. Subsequently, we study the stability of this model and finally obtain results that can reveal the infection mechanism of malicious software in ECIoT. By integrating insights from previous research, this study makes an effort to provide a comprehensive analysis of malicious software spreading dynamics in ECIoT networks and offer valuable insights for designing effective security countermeasures.

Here are our contributions:

(1) An epidemiology-based Susceptible-Curb-Infectious-Removed-Dead (SCIRD) model is proposed, which studies the characteristics of malicious software propagation in ECIoT networks by considering node heterogeneity, link heterogeneity, and topology structure heterogeneity. The model extends the Markov chain to study the state transition of ECIoTNs.

(2) The differential equations of the SCIRD model are derived, which represent the proportion dynamics of different compartments, namely S, C, I, R, and D, in the SCIRD model at various extents.

(3) Equilibrium states in the SCIRD model are demonstrated. Therefore, the conditions to determine whether malicious software will spread or die out in ECIoT networks can be obtained to guide the security mechanism defending malicious software propagation.

The key contributions of this paper are as follows. The application of the proposed SCIRD model can help researchers gain a deeper understanding of the propagation mechanism of malicious software in ECIoT networks, including characteristics such as propagation speed, range, and pathways, which will provide a more systematic and comprehensive perspective for the analysis, prediction, and formulation of strategies to combat malicious software propagation. Such a model can facilitate a better understanding and control of malicious software propagation behavior, contributing to enhancing security alertness and preventive capabilities of ECIoT networks. Moreover, our model can be extended to one considering different types of network topologies such as random, small-world, and scale-free networks to study the dynamics and patterns of malicious software propagation in different network structures.

The remaining sections of this paper are structured as follows. In Section 2, we examine the current state of research and put forth several issues that need to be addressed regarding the propagation of malicious software in ECIoT networks. In Section 3, we build a state graph for ECIoTNs infected by malicious software, taking into consideration the distinctive characteristics of current malicious software propagation, and propose the SCIRD model. Section 4 is dedicated to demonstrating equilibrium states of the SCIRD model, calculating the fundamental reproduction number, and affirming the model stability. Moving forward, in Section 5, we propose an algorithm using Matlab, and conduct experiments to validate the stability of equilibrium points. Finally, in Section 6, we provide a summary of the paper. Fig. 1 shows the paper workflow providing sufficient visual aids to guide readers through the various phases and steps of the work.

The propagation of malicious software in the context of ECIoT bears certain similarity to infectious diseases to some extent [16]. Common epidemic models are classified based on the type of infectious diseases, such as the Susceptible-Infectious (SI) [17] and Susceptible-Infectious-Susceptible (SIS) [18] models. They can also be categorized based on the transmission mechanisms, including Partial Differential Equations (PDEs), Ordinary Differential Equations (ODEs), and network dynamics. For examples, the model STSIR (Social Internet of Things Susceptible-Infectious-Removed) was proposed to illustrate malicious software propagation among IoT nodes considering people behavior [19], however, the application of the model may require adjustments and validation in specific scenarios. By adding the state E (exposed), an SEIR (Susceptible-Exposed-Infectious-Removed) model was proposed to analyze the interval of logging, the number of friends in the list, and the influence of the malicious software’s initial spreading rate [20], but the fixed immunity assumption in the SEIR model may not accurately describe factors in the propagation of malicious software.

Some researchers have studied the spread of malicious software from different perspectives. Guo et al. [21] put forward a method to represent the impact of different network structures on virus transmission using growth curves. Li et al. [22] began to study the impact model of information dissemination in mobile social networks from a multi-role perspective. Li et al. [23] used structural optimization to control information diffusion in social networks. Wang et al. [24] proposed a new data-driven approach, based on intuitive assumptions, to enhance the detection of zombie networks. They utilized honeypots to simulate zombie network attacks on medical devices and assets connected to the IoT with healthcare settings. In addition to the above models, others include models twin-SIR (twin Susceptible-Infectious-Removed) [25], SLBRS (Susceptible-Latent-Breaking-out-Recovered-Susceptible) [26], SEIRS-QV (Susceptible-Exposed-Infected-Recovered-Susceptible with Quarantine and Vaccination) [27], SEIQ-VS (Susceptible-Exposed-Infected-Quarantine with Vaccination-Susceptible) [28], and SIQR (Susceptible-Infected-Quarantine-Removed) [29]. Wherein, the twin-SIR model lacks of consideration for real-world factors such as changes of node behavior and network structure. The SLBRS model is indeed novel when proposed, but, due to considering multiple factors, its complexity increases, its interpretability decreases, and it requires higher requirements for actual data. Both the SEIRS-QV and SEIQ-VS models consider a wide range of influencing factors, but they both require accurate parameter estimation and extensive data support. The SIQR model neglects some complex propagation dynamics, such as latency and immune details.

These models all add certain states to the original classical SIR (Susceptible-Infectious-Removed) or SI model, while considering the communication radius and node distribution density. Besides, worm viruses are also highly contagious in the IoT, so people have proposed various propagation models based on compartmental populations [30], specifically designed for heterogeneous and hierarchical networks incorporating human behaviors. At the same time, the dynamics of worm propagation in complex networks have been extensively modeled and studied, and it has been confirmed that the network topology has a significant impact on the worm propagation in such networks [31,32]. The researchers also proposed a propagation model for the defense of PLC-PC (Programmable Logic Controller-Personal Computer) worms in industrial networks [33]. In the meanwhile, Yang et al. presented a new VEIQS (Vaccination-Exposed-Infected-Quarantine-Susceptible) worm propagation model [34]. But the model typically assumes that propagation is unobstructed and does not take into account the impact of defensive measures. Table 1 summarizes some representative papers on the propagation of malicious software, and compares with our work to provide a brief overview for better understanding in terms of the model name, main contributions, projecting point, and weakness.

However, the above research still fails to address some problems related to the spread of ECIoT malicious software. One problem is how to describe the actual situation where an ECIoTN becomes ineffectual due to energy depletion, physical degradation, or malicious software attacks. The other problem is how to ascertain the conditions under which malicious software will spread or disappear in wireless hardware. Herein, considering the heterogeneity of communication connectivity among ECIoTNs, we address the first problem by adding two states, namely, the dead state and the suppressed state, to the traditional SIR model. Furthermore, we address the second problem by studying the equilibrium point stability of our non-homogeneous model and mathematically verifying the correctness of our theoretic results.

Viewed in terms of the network’s topology, we assume that the malicious software-infected ECIoT consists of M stationary ECIoTNs that are uniformly distributed across a two-dimensional region. Each ECIoTN is equipped with an omnidirectional antenna available for signal transmission. When an ECIoTN detects local data, it can forward this data to neighboring ECIoTNs located within its transmission range. These neighboring ECIoTNs then relay the data to their respective neighbors in an ongoing fashion.

Based on the characteristics of ECIoTNs, we develop a state diagram to represent the behavior of an ECIoTN within the malicious software-infected ECIoT. This can be analogized to an epidemiology-based model for malicious software propagation. In the state diagram, an ECIoTN is assigned to a single state that reflects its manner. We categorize an ECIoTN as state S if it exhibits its vulnerabilities but remains uninfected. When an ECIoTN is infected with malicious software but there exists security software that can contain the propagation of malicious software, it is classified as state C. When an ECIoTN becomes infected by malicious software and can transmit malicious software to neighboring nodes through data or control information, it transitions to state I. Upon applying security patches and achieving immunity to the current malicious software, an ECIoTN enters state R. An ECIoTN is assigned to state D when it becomes non-functional, either due to complete energy depletion or damage caused by malicious software. Thus, we extend the traditional SIR model to establish the SCIRD model, encompassing all the states of ECIoTNs within the malicious software-infected ECIoT.

As illustrated in Fig. 2, any ECIoTN within the network has the potential to undergo a state transition in reaction to external factors. This means that the current state of an ECIoTN can be altered due to external influences. When susceptible ECIoTNs become infected through the propagation of malicious software, not all nodes are necessarily affected, as a portion of nodes can successfully thwart the infection due to the presence of security software. This results in a transition of their state from S to C. However, security software is incapable of completely impeding the spread of malicious software. Furthermore, when infected ECIoTNs have the ability to transmit malicious software, their state transitions from S to I. Once a complete infection occurs, we employ patching of the security programs to treat the infected ECIoTNs, granting them immunity against known malicious software. This action leads to a state transition from I to R. Additionally, considering the mechanical nature of computers, any ECIoTN has the potential to transition to state D due to hardware malfunction or power depletion.

We categorize the ECIoTNs based on their heterogeneous communication connectivity. Within the ECIoT, all ECIoTNs can be classified into L clusters, each characterized by the same degree of connectivity. For simplicity, we adopt a unified notation to represent both the cluster and its degree, where i∈{1,2,…,L} is used to denote the degree of cluster i. To simplify the description, we use Si(t), Ci(t), Ii(t), Ri(t), and Di(t) to represent the proportions of ECIoTNs in cluster i at time t that are in states S, C, I, R, and D, respectively. Clearly, we can derive alternative expressions for these quantities as (1)Si(t)+Ci(t)+Ii(t)+Ri(t)+Di(t)=1, (2)Ii(0)=α,0<α<1, (3)Ci(0)=Ri(t)=Di(t)=0, (4)Si(0)=1−α,where α means the initial proportion of ECIoTNs assigned to cluster i in state I.

Let Ffgi denote the feasibility of an ECIoTN in cluster i∈{1,2,…,L} transforming its state from f∈{S,C,I,R,D} to g∈{S,C,I,R,D}. At time t, an ECIoTN assigned to cluster i∈{1,2,…,L} in state S meets one or more infectious ECIoTNs with feasibility Ei(t): (5)Ei(t)=1⟨ad⟩∑i=1LδiϑiIi(t).

Here, ⟨ad⟩ represents the average degree of the ECIoTNs, δi represents the feasibility that an ECIoTN involves degree i, and ϑi represents the spread capability of an ECIoTN. These variables have the following conditions: (6)∑i=1Lδi=1,and (7)<ad>=∑i=1Liδi.

Various equations for the spread capability that may be borrowed to ECIoTNs have been presented. Representative examples contain (1) ϑi=i [35]; (2) ϑi=AC [36], where AC is a fixed value; and (3) ϑi=φir/(1+ϕir) [37], with three variables: φ, r, and ϕ.

Up to this point, we have established the dynamics of all states. At time t, an ECIoTN assigned to cluster i∈{1,2,…,L} in state C becomes I, R, and D at proportions FCIiCi(t), FCRiCi(t), and FCDiCi(t), respectively. An ECIoTN assigned to cluster i∈{1,2,…,L} in state I becomes D at the proportion FIDiIi(t). An ECIoTN assigned to cluster i∈{1,2,…,L} in state R becomes D at the proportion FRDiRi(t). Furthermore, certain malfunctioning ECIoTNs that are irreparable need to be substituted with new ones to ensure the proper functioning of the entire ECIoTN. This manner leads to increasing the proportion τ to the proportion Si(t). As a result, we can achieve our SCIRD model characterizing the proportions of ECIoTNs assigned to cluster i∈{1,2,…,L} in states S, C, I, R, D using differential equations, as follows: (8){dSi(t)dt=τ+FRSiRi(t)+FCSiCi(t)−FSIiEi(t)Si(t)−FSDiSi(t)Si(0)=1−α, (9){dCi(t)dt=FICiIi(t)−FCSiCi(t)−FCRiCi(t)−FCDiCi(t)Ci(0)=0, (10){dIi(t)dt=FSIiEi(t)Si(t)−FICiIi(t)−FIDiIi(t)Ii(0)=α, (11){dRi(t)dt=FCRiCi(t)−FRSiRi(t)−FRDiRi(t)Ri(0)=0, (12){dDi(t)dt=FSDiSi(t)+FIDiIi(t)+FCRiCi(t)+FRDiRi(t)−τDi(0)=0,

satisfying equations ∀t,Si(t),Ii(t),Ci(t),Ri(t),Di(t)≥0, (13)Si(t)+Ci(t)+Ii(t)+Ri(t)+Di(t)=1, 0<α<1.

To confirm the SCIRD model for malicious software-infected ECIoTNs, we implemented the model using MATLAB R2022a. The computational algorithm, Algorithm 1, was utilized for this purpose.

In the simulation program of MATLAB, the ECIoT network consists of 1500 static ECIoTNs. The interval Δt is 1d. We establish the ECIoTN topology and determine the values of the remaining parameters by consulting other research. In this case, we set the range of degrees to be between 2 and 20, with an average value of 4. Additionally, the infection rate is set as a function of the degree, denoted as FSIi=ξi, and ξ=0.01.