Malware containment with immediate response in IoT networks: An optimal control approach

Abstract

The exponential growth of Internet of Things (IoT) devices has triggered a substantial increase in cyber-attacks targeting these systems. Recent statistics show a surge of over 100 percent in such attacks, underscoring the urgent need for robust cybersecurity measures. When a cyber-attack breaches an IoT network, it initiates the dissemination of malware across the network. However, to counteract this threat, an immediate installation of a new patch becomes imperative. The time frame for developing and deploying the patch can vary significantly, contingent upon the specifics of the cyber-attack. This paper aims to address the challenge of pre-emptively mitigating cyber-attacks prior to the installation of a new patch. The main novelties of our work include: (1) A well-designed node-level model known as Susceptible, Infected High, Infected Low, Recover First, and Recover Complete $\left({\mathrm{SI}}_H{I}_L{R}_F{R}_C\right)$. It categorizes the infected node states into infected high and infected low, according to the categorization of infection states for IoT devices, to accelerate containment strategies for malware propagation and improve mitigation of cyber-attacks targeting IoT networks by incorporating immediate response within a restricted environment. (2) Development of an optimal immediate response strategy (IRS) by modeling and analyzing the associated optimal control problem. This model aims to enhance the containment of malware propagation across IoT networks by swiftly responding to cyber threats. Finally, several numerical analyses were performed to fully illustrate the main findings. In addition, a dataset has been constructed for experimental purposes to simulate real-world scenarios within IoT networks, particularly in smart home environments.