A Network-Based SEIRS Model for IoT Malware Propagation with Optimal Control and Connectivity-Driven Dynamics

The number of Internet of Things (IoT) devices is growing quickly, creating large networks that are attractive targets for malware such as Mirai and Mozi. Most existing epidemic models assume homogeneous mixing, where every device has an equal probability of contacting others, although real IoT networks are characterized by heterogeneous connectivity in which highly connected hub devices accelerate malware propagation. This study proposes a network-based SEIRS model that incorporates connectivity-driven transmission dynamics by allowing the infection rate to depend on device degree. The model is used to derive the basic reproduction number (R0) and establish the local and global stability conditions of the malware-free and endemic equilibria. Three intervention measures, namely patch deployment, network quarantine, and user-awareness campaigns, are incorporated into an optimal control framework using Pontryagin's Minimum Principle to balance infection reduction and intervention costs. The proposed model is evaluated using CICIoT2023 and CIC IoT-DIAD 2024 traffic datasets, complemented by network-topology information from N-BaIoT, representing 105 IoT devices and 33 attack types. Simulation results show that the combined optimal-control strategy reduces the peak number of infected devices by 78.4% compared with the uncontrolled scenario and by 31.6% compared with a conventional SEIRS model that ignores network structure, while reducing overall intervention costs by 42.3%. Sensitivity analysis identifies device connectivity as the dominant factor influencing outbreak severity, highlighting the importance of network-aware segmentation and prioritized patching for effective IoT malware containment.