Urban Cyber-Resilience Under Malware Propagation: An Administrator-Assisted CLP-SEIRS-T Framework for Clustered Temporal Communication Networks+

An administrator-assisted CLP-SEIRS-T+ framework is developed to model malware propagation and urban cyber-resilience in clustered temporal communication networks. The model extends CLP-SEIRS-T by integrating community structure, predicted links, asynchronous node activation, and an endogenous defense layer in which administrator nodes remain infectable, recover faster than ordinary nodes, and trigger local patch diffusion when community-level prevalence exceeds a risk threshold. Unlike formulations that treat defense as an external or perfectly reliable safeguard, the proposed framework embeds administrator intervention directly within the epidemic state space and couples propagation dynamics with resilience-oriented performance measures, including safe functionality, absorptive capacity, spillover attenuation, recovery time, and service continuity. To keep experimental evidence scale-explicit, the validation is organized as a tiered protocol: a 48-node isolated virtual-machine cyber-range verifies safe mechanism realization; emulation-calibrated logical traces and pilot repeated comparisons examine trajectory behavior, pathway composition, and defense-component effects; and expanded numerical sweeps assess scalability, threshold sensitivity, alternative link-prediction scores, and adaptive-stress assumptions. The results show that direct links dominate local amplification, whereas predicted links contribute disproportionately to cross-community spillover. In the pilot comparison, the full CLP-SEIRS-T+ configuration achieves the best observed balance, reducing mean peak burden by 56.9%, shortening mean recovery time by 86.7%, increasing absorptive capacity by 37.1%, and improving service continuity by 12.0% relative to the no-intervention baseline. Larger-network sweeps over N=48,100,150,200, and 500 logical hosts preserve the same qualitative mechanism ordering while keeping functionality error below 0.02. Threshold analysis indicates that intermediate trigger values provide a better burden–cost balance than either overly aggressive or delayed patching. Link-score comparisons show that local-neighborhood predictors yield consistent spillover interpretations, whereas degree-driven prediction can increase bridge exposure. Parameterized adaptive-stress tests further indicate that the mechanism remains beneficial under moderate stress but degrades under severe patch suppression, false telemetry, or intensified bridge seeking. These findings suggest that urban cyber-resilience depends jointly on network modularity, temporal availability, structurally likely bridge formation, state-dependent local defense, and the integrity of administrative response.