{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,20]],"date-time":"2026-06-20T02:12:10Z","timestamp":1781921530099,"version":"3.54.5"},"reference-count":91,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2023,8,18]],"date-time":"2023-08-18T00:00:00Z","timestamp":1692316800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2023,8,18]],"date-time":"2023-08-18T00:00:00Z","timestamp":1692316800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"name":"Northeastern University USA"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Appl Netw Sci"],"abstract":"<jats:title>Abstract<\/jats:title><jats:p>Self-propagating malware (SPM) is responsible for large financial losses and major data breaches with devastating social impacts that cannot be understated. Well-known campaigns such as WannaCry and Colonial Pipeline have been able to propagate rapidly on the Internet and cause widespread service disruptions. To date, the propagation behavior of SPM is still not well understood. As result, our ability to defend against these cyber threats is still limited. Here, we address this gap by performing a comprehensive analysis of a newly proposed epidemiological-inspired model for SPM propagation, the <jats:italic>Susceptible-Infected-Infected Dormant-Recovered<\/jats:italic> (SIIDR) model. We perform a theoretical analysis of the SIIDR model by deriving its basic reproduction number and studying the stability of its disease-free equilibrium points in a homogeneous mixed system. We also characterize the SIIDR model on arbitrary graphs and discuss the conditions for stability of disease-free equilibrium points. We obtain access to 15 WannaCry attack traces generated under various conditions, derive the model\u2019s transition rates, and show that SIIDR fits the real data well. We find that the SIIDR model outperforms more established compartmental models from epidemiology, such as SI, SIS, and SIR, at modeling SPM propagation.<\/jats:p>","DOI":"10.1007\/s41109-023-00578-z","type":"journal-article","created":{"date-parts":[[2023,8,18]],"date-time":"2023-08-18T13:02:18Z","timestamp":1692363738000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":26,"title":["Modeling self-propagating malware with epidemiological models"],"prefix":"10.1007","volume":"8","author":[{"given":"Alesia","family":"Chernikova","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Nicol\u00f2","family":"Gozzi","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Nicola","family":"Perra","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Simona","family":"Boboila","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tina","family":"Eliassi-Rad","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Alina","family":"Oprea","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2023,8,18]]},"reference":[{"issue":"3","key":"578_CR1","first-page":"201","volume":"24","author":"H Abbey","year":"1952","unstructured":"Abbey H (1952) An examination of the Reed-Frost theory of epidemics. Hum Biol 24(3):201\u201333","journal-title":"Hum Biol"},{"issue":"6","key":"578_CR2","doi-asserted-by":"publisher","first-page":"716","DOI":"10.1109\/TAC.1974.1100705","volume":"19","author":"H Akaike","year":"1974","unstructured":"Akaike H (1974) A new look at the statistical model identification. IEEE Trans Autom Control 19(6):716\u2013723. https:\/\/doi.org\/10.1109\/TAC.1974.1100705","journal-title":"IEEE Trans Autom Control"},{"key":"578_CR3","doi-asserted-by":"publisher","first-page":"111","DOI":"10.1016\/j.compeleceng.2019.03.012","volume":"76","author":"M Akbanov","year":"2019","unstructured":"Akbanov M, Vassilakis VG, Logothetis MD (2019) Ransomware detection and mitigation using software-defined networking: the case of WannaCry. Comput Electr Eng 76:111\u2013121. https:\/\/doi.org\/10.1016\/j.compeleceng.2019.03.012","journal-title":"Comput Electr Eng"},{"issue":"1","key":"578_CR4","doi-asserted-by":"publisher","first-page":"47","DOI":"10.1103\/RevModPhys.74.47","volume":"74","author":"R Albert","year":"2002","unstructured":"Albert R, Barab\u00e1si AL (2002) Statistical mechanics of complex networks. Rev Mod Phys 74(1):47\u201397. https:\/\/doi.org\/10.1103\/RevModPhys.74.47","journal-title":"Rev Mod Phys"},{"key":"578_CR5","doi-asserted-by":"publisher","first-page":"28039","DOI":"10.1109\/ACCESS.2021.3058897","volume":"9","author":"FM Alotaibi","year":"2021","unstructured":"Alotaibi FM, Vassilakis VG (2021) SDN-based detection of self-propagating ransomware: the case of BadRabbit. IEEE Access 9:28039\u201328058. https:\/\/doi.org\/10.1109\/ACCESS.2021.3058897","journal-title":"IEEE Access"},{"key":"578_CR6","unstructured":"Azzara M (2021) What is WannaCry Ransomware and how does it work? \u201chttps:\/\/www.mimecast.com\/blog\/all-you-need-to-know-about-wannacry-ransomware\/\u201d"},{"issue":"16","key":"578_CR7","doi-asserted-by":"publisher","first-page":"879","DOI":"10.1098\/rsif.2007.1100","volume":"4","author":"S Bansal","year":"2007","unstructured":"Bansal S, Grenfell B, Meyers L (2007) When individual behaviour matters: homogeneous and network models in epidemiology. J R Soc Interface 4(16):879\u2013891. https:\/\/doi.org\/10.1098\/rsif.2007.1100","journal-title":"J R Soc Interface"},{"issue":"5439","key":"578_CR8","doi-asserted-by":"publisher","first-page":"509","DOI":"10.1126\/science.286.5439.509","volume":"286","author":"AL Barab\u00e1si","year":"1999","unstructured":"Barab\u00e1si AL, Albert R (1999) Emergence of scaling in random networks. Science 286(5439):509\u2013512","journal-title":"Science"},{"issue":"5939","key":"578_CR9","doi-asserted-by":"publisher","first-page":"412","DOI":"10.1126\/science.1173299","volume":"325","author":"AL Barab\u00e1si","year":"2009","unstructured":"Barab\u00e1si AL (2009) Scale-free networks: a decade and beyond. Science 325(5939):412\u2013413. https:\/\/doi.org\/10.1126\/science.1173299","journal-title":"Science"},{"issue":"1","key":"578_CR10","doi-asserted-by":"publisher","first-page":"52","DOI":"10.1016\/j.cmpb.2007.07.002","volume":"88","author":"G Bellu","year":"2007","unstructured":"Bellu G, Saccomani MP, Audoly S et al (2007) Daisy: a new software tool to test global identifiability of biological and physiological systems. Comput Methods Progr Biomed 88(1):52\u201361","journal-title":"Comput Methods Progr Biomed"},{"key":"578_CR11","doi-asserted-by":"publisher","unstructured":"Ben\u00a0Said N, Biondi F, Bontchev V et al (2018) Detection of Mirai by syntactic and behavioral analysis. In: IEEE 29th International symposium on software reliability engineering (ISSRE), pp 224\u2013235. https:\/\/doi.org\/10.1109\/ISSRE.2018.00032","DOI":"10.1109\/ISSRE.2018.00032"},{"key":"578_CR12","doi-asserted-by":"crossref","DOI":"10.1007\/978-1-4612-0653-8","volume-title":"Matrix analysis","author":"R Bhatia","year":"1997","unstructured":"Bhatia R (1997) Matrix analysis, vol 169. Springer, New York"},{"key":"578_CR13","doi-asserted-by":"crossref","unstructured":"Blackwood JC, Childs LM (2018) An introduction to compartmental modeling for the budding infectious disease modeler. Lett Biomath","DOI":"10.30707\/LiB5.1Blackwood"},{"key":"578_CR14","unstructured":"Bof N, Carli R, Schenato L (2018) Lyapunov theory for discrete time systems. arXiv preprint arXiv:1809.05289"},{"key":"578_CR15","doi-asserted-by":"crossref","unstructured":"Brauer F (2008) Compartmental models in epidemiology. Math Epidemiol 19\u201379","DOI":"10.1007\/978-3-540-78911-6_2"},{"issue":"4","key":"578_CR16","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/1284680.1284681","volume":"10","author":"D Chakrabarti","year":"2008","unstructured":"Chakrabarti D, Wang Y, Wang C et al (2008) Epidemic thresholds in real networks. ACM Trans Inf Syst Secur 10(4):1\u201326","journal-title":"ACM Trans Inf Syst Secur"},{"key":"578_CR17","doi-asserted-by":"publisher","unstructured":"Chen Q, Bridges RA (2017) Automated behavioral analysis of malware: a case study of WannaCry ransomware. In: 16th IEEE international conference on machine learning and applications (ICMLA), pp 454\u2013460. https:\/\/doi.org\/10.1109\/ICMLA.2017.0-119","DOI":"10.1109\/ICMLA.2017.0-119"},{"key":"578_CR18","doi-asserted-by":"crossref","unstructured":"Chernikova A, Gozzi N, Boboila S et al (2022) Cyber network resilience against self-propagating malware attacks. In: Proceedings 27th European symposium on research in computer security (ESORICS)","DOI":"10.1007\/978-3-031-17140-6_26"},{"issue":"11","key":"578_CR19","doi-asserted-by":"publisher","DOI":"10.1371\/journal.pone.0027755","volume":"6","author":"OT Chis","year":"2011","unstructured":"Chis OT, Banga JR, Balsa-Canto E (2011) Structural identifiability of systems biology models: a critical comparison of methods. PLoS ONE 6(11):e27755","journal-title":"PLoS ONE"},{"issue":"3","key":"578_CR20","first-page":"379","volume":"2","author":"G Chowell","year":"2017","unstructured":"Chowell G (2017) Fitting dynamic models to epidemic outbreaks with quantified uncertainty: a primer for parameter uncertainty, identifiability, and forecasts. Infect Dis Model 2(3):379\u2013398","journal-title":"Infect Dis Model"},{"key":"578_CR21","unstructured":"Dahleh M, Dahleh MA, Verghese G (2004) Lectures on dynamic systems and control. A+ A 4(100):1\u2013100"},{"key":"578_CR22","doi-asserted-by":"publisher","DOI":"10.1016\/j.epidem.2022.100643","volume":"41","author":"EA Dankwa","year":"2022","unstructured":"Dankwa EA, Brouwer AF, Donnelly CA (2022) Structural identifiability of compartmental models for infectious disease transmission is influenced by data type. Epidemics 41:100643","journal-title":"Epidemics"},{"issue":"4","key":"578_CR23","doi-asserted-by":"publisher","first-page":"365","DOI":"10.1007\/BF00178324","volume":"28","author":"O Diekmann","year":"1990","unstructured":"Diekmann O, Heesterbeek JAP, Metz JA (1990) On the definition and the computation of the basic reproduction ratio R 0 in models for infectious diseases in heterogeneous populations. J Math Biol 28(4):365\u2013382","journal-title":"J Math Biol"},{"issue":"47","key":"578_CR24","doi-asserted-by":"publisher","first-page":"873","DOI":"10.1098\/rsif.2009.0386","volume":"7","author":"O Diekmann","year":"2010","unstructured":"Diekmann O, Heesterbeek J, Roberts MG (2010) The construction of next-generation matrices for compartmental epidemic models. J R Soc Interface 7(47):873\u2013885","journal-title":"J R Soc Interface"},{"issue":"1","key":"578_CR25","doi-asserted-by":"publisher","first-page":"23","DOI":"10.1177\/096228029300200103","volume":"2","author":"K Dietz","year":"1993","unstructured":"Dietz K (1993) The estimation of the basic reproduction number for infectious diseases. Stat Methods Med Res 2(1):23\u201341","journal-title":"Stat Methods Med Res"},{"issue":"7","key":"578_CR26","doi-asserted-by":"publisher","first-page":"53","DOI":"10.1145\/306549.306571","volume":"42","author":"R Durst","year":"1999","unstructured":"Durst R, Champion T, Witten B et al (1999) Testing and evaluating computer intrusion detection systems. Commun ACM 42(7):53\u201361","journal-title":"Commun ACM"},{"key":"578_CR27","doi-asserted-by":"crossref","unstructured":"Erd\u0151s P, R\u00e9nyi A (1959) On random graphs i. Publ math debrecen 6(290-297):18","DOI":"10.5486\/PMD.1959.6.3-4.12"},{"issue":"1","key":"578_CR28","doi-asserted-by":"publisher","first-page":"87","DOI":"10.1515\/sagmb-2012-0069","volume":"12","author":"S Filippi","year":"2013","unstructured":"Filippi S, Barnes CP, Cornebise J et al (2013) On optimality of kernels for approximate Bayesian computation using sequential Monte Carlo. Stat Appl Genet Mol Biol 12(1):87\u2013107","journal-title":"Stat Appl Genet Mol Biol"},{"issue":"5934","key":"578_CR29","doi-asserted-by":"publisher","first-page":"1557","DOI":"10.1126\/science.1176062","volume":"324","author":"C Fraser","year":"2009","unstructured":"Fraser C, Donnelly CA, Cauchemez S et al (2009) Pandemic potential of a strain of influenza A (H1N1): early findings. Science 324(5934):1557\u20131561","journal-title":"Science"},{"issue":"3","key":"578_CR30","doi-asserted-by":"publisher","first-page":"eabg5234","DOI":"10.1126\/sciadv.abg5234","volume":"8","author":"L Gallo","year":"2022","unstructured":"Gallo L, Frasca M, Latora V et al (2022) Lack of practical identifiability may hamper reliable predictions in COVID-19 epidemic models. Sci Adv 8(3):eabg5234","journal-title":"Sci Adv"},{"key":"578_CR31","doi-asserted-by":"publisher","first-page":"20325","DOI":"10.1109\/ACCESS.2020.2968916","volume":"8","author":"C Gan","year":"2020","unstructured":"Gan C, Feng Q, Zhang X et al (2020) Dynamical propagation model of malware for cloud computing security. IEEE Access 8:20325\u201320333","journal-title":"IEEE Access"},{"key":"578_CR32","doi-asserted-by":"publisher","first-page":"217","DOI":"10.1016\/j.cnsns.2017.08.011","volume":"56","author":"JH Guill\u00e9n","year":"2018","unstructured":"Guill\u00e9n JH, del Rey AM (2018) Modeling malware propagation using a carrier compartment. Commun Nonlinear Sci Numer Simul 56:217\u2013226","journal-title":"Commun Nonlinear Sci Numer Simul"},{"key":"578_CR33","doi-asserted-by":"publisher","first-page":"411","DOI":"10.1016\/j.physa.2017.03.023","volume":"479","author":"JH Guill\u00e9n","year":"2017","unstructured":"Guill\u00e9n JH, del Rey AM, Encinas LH (2017) Study of the stability of a SEIRS model for computer worm propagation. Phys A 479:411\u2013421","journal-title":"Phys A"},{"key":"578_CR34","doi-asserted-by":"publisher","first-page":"135472","DOI":"10.1109\/ACCESS.2019.2942809","volume":"7","author":"JH Guill\u00e9n","year":"2019","unstructured":"Guill\u00e9n JH, del Rey AM, Casado-Vara R (2019) Security countermeasures of a SCIRAS model for advanced malware propagation. IEEE Access 7:135472\u2013135478","journal-title":"IEEE Access"},{"key":"578_CR35","unstructured":"Guo Y, Gong W, Towsley D (2000) Time-stepped hybrid simulation (TSHS) for large scale networks. In: Proceedings IEEE INFOCOM 2000. Conference on computer communications. Nineteenth annual joint conference of the IEEE computer and communications societies (Cat. No. 00CH37064). IEEE, pp 441\u2013450"},{"key":"578_CR36","doi-asserted-by":"publisher","DOI":"10.2307\/j.ctvcm4hws","volume-title":"Nonlinear dynamical systems and control: a Lyapunov-based approach","author":"WM Haddad","year":"2011","unstructured":"Haddad WM, Chellaboina V (2011) Nonlinear dynamical systems and control: a Lyapunov-based approach. Princeton University Press, Princeton"},{"issue":"3","key":"578_CR37","doi-asserted-by":"publisher","first-page":"525","DOI":"10.1137\/S0036144500378302","volume":"43","author":"DJ Higham","year":"2001","unstructured":"Higham DJ (2001) An algorithmic introduction to numerical simulation of stochastic differential equations. SIAM Rev 43(3):525\u2013546","journal-title":"SIAM Rev"},{"key":"578_CR38","volume-title":"Differential equations, dynamical systems, and linear algebra","author":"M Hirsch","year":"1974","unstructured":"Hirsch M, Smale S (1974) Differential equations, dynamical systems, and linear algebra. Academic Press, Oxford"},{"issue":"9","key":"578_CR39","doi-asserted-by":"publisher","first-page":"1831","DOI":"10.1002\/cpa.21921","volume":"73","author":"H Hong","year":"2020","unstructured":"Hong H, Ovchinnikov A, Pogudin G et al (2020) Global identifiability of differential models. Commun Pure Appl Math 73(9):1831\u20131879","journal-title":"Commun Pure Appl Math"},{"key":"578_CR40","doi-asserted-by":"crossref","unstructured":"Ilmer I, Ovchinnikov A, Pogudin G (2021) Web-based structural identifiability analyzer. In: Computational methods in systems biology: 19th international conference, CMSB 2021, Bordeaux, France, September 22\u201324, 2021, Proceedings 19. Springer, pp 254\u2013265","DOI":"10.1007\/978-3-030-85633-5_17"},{"key":"578_CR41","doi-asserted-by":"crossref","unstructured":"Keeling M, Rohani P (2008) Modeling infectious diseases in humans and animals. 837 Princeton university press","DOI":"10.1515\/9781400841035"},{"key":"578_CR42","doi-asserted-by":"crossref","unstructured":"Kephart JO, White SR (1993) Measuring and modeling computer virus prevalence. In: Proceedings 1993 IEEE computer society symposium on research in security and privacy. IEEE, pp 2\u201315","DOI":"10.1109\/RISP.1993.287647"},{"key":"578_CR43","doi-asserted-by":"crossref","unstructured":"Kiddle C, Simmonds R, Williamson C et\u00a0al (2003) Hybrid packet\/fluid flow network simulation. In: Seventeenth workshop on parallel and distributed simulation, 2003. (PADS 2003). Proceedings. IEEE, pp 143\u2013152","DOI":"10.1109\/PADS.2003.1207430"},{"key":"578_CR44","unstructured":"Kim HA, Karp B (2004) Autograph: toward automated, distributed worm signature detection. In: 13th USENIX security symposium (USENIX Security 04). USENIX Association, San Diego, CA"},{"key":"578_CR45","doi-asserted-by":"crossref","unstructured":"Kumar A, Lim TJ (2020) Early detection of Mirai-like Iot bots in large-scale networks through sub-sampled packet traffic analysis. In: Advances in information and communication: proceedings of the 2019 future of information and communication conference (FICC), vol 2. Springer, pp 847\u2013867","DOI":"10.1007\/978-3-030-12385-7_58"},{"key":"578_CR46","doi-asserted-by":"crossref","unstructured":"Le LT, Eliassi-Rad T, Tong H (2015) MET: a fast algorithm for minimizing propagation in large graphs with small eigen-gaps. In: Proceedings of the 2015 SIAM International conference on data mining (SDM), pp 694\u2013702","DOI":"10.1137\/1.9781611974010.78"},{"key":"578_CR47","unstructured":"Leskovec J, Mcauley J (2012) Learning to discover social circles in ego networks. Adv Neural Inf Process Syst 25"},{"key":"578_CR48","doi-asserted-by":"crossref","unstructured":"Leskovec J, Kleinberg J, Faloutsos C (2005) Graphs over time: densification laws, shrinking diameters and possible explanations. In: Proceedings of the eleventh ACM SIGKDD international conference on Knowledge discovery in data mining, pp 177\u2013187","DOI":"10.1145\/1081870.1081893"},{"issue":"1","key":"578_CR49","doi-asserted-by":"publisher","first-page":"2-es","DOI":"10.1145\/1217299.1217301","volume":"1","author":"J Leskovec","year":"2007","unstructured":"Leskovec J, Kleinberg J, Faloutsos C (2007) Graph evolution: densification and shrinking diameters. ACM Trans Knowl Discov Data (TKDD) 1(1):2-es","journal-title":"ACM Trans Knowl Discov Data (TKDD)"},{"issue":"4","key":"578_CR50","doi-asserted-by":"publisher","first-page":"349","DOI":"10.1007\/s41060-020-00225-1","volume":"10","author":"N Levy","year":"2020","unstructured":"Levy N, Rubin A, Yom-Tov E (2020) Modeling infection methods of computer malware in the presence of vaccinations using epidemiological models: an analysis of real-world data. Int J Data Sci Anal 10(4):349\u2013358","journal-title":"Int J Data Sci Anal"},{"key":"578_CR51","doi-asserted-by":"publisher","unstructured":"Li J, Stafford S (2014) Detecting smart, self-propagating Internet worms. In: IEEE Conference on communications and network security, pp 193\u2013201. https:\/\/doi.org\/10.1109\/CNS.2014.6997486","DOI":"10.1109\/CNS.2014.6997486"},{"key":"578_CR52","doi-asserted-by":"crossref","unstructured":"Mart\u00ednez\u00a0Mart\u00ednez I, Flori\u00e1n\u00a0Quiti\u00e1n A, D\u00edaz-L\u00f3pez D et al (2021) MalSEIRS: Forecasting malware spread based on compartmental models in epidemiology. Complexity","DOI":"10.1155\/2021\/5415724"},{"issue":"1","key":"578_CR53","doi-asserted-by":"publisher","first-page":"4","DOI":"10.1214\/17-STS618","volume":"33","author":"TJ McKinley","year":"2018","unstructured":"McKinley TJ, Vernon I, Andrianakis I et al (2018) Approximate Bayesian computation and simulation-based inference for complex stochastic epidemic models. Stat Sci 33(1):4\u201318","journal-title":"Stat Sci"},{"issue":"1","key":"578_CR54","doi-asserted-by":"publisher","first-page":"3","DOI":"10.1137\/090757009","volume":"53","author":"H Miao","year":"2011","unstructured":"Miao H, Xia X, Perelson AS et al (2011) On identifiability of nonlinear ode models and applications in viral dynamics. SIAM Rev 53(1):3\u201339","journal-title":"SIAM Rev"},{"key":"578_CR55","doi-asserted-by":"publisher","DOI":"10.1016\/j.epidem.2019.100368","volume":"29","author":"A Minter","year":"2019","unstructured":"Minter A, Retkute R (2019) Approximate Bayesian computation for infectious disease modelling. Epidemics 29:100368","journal-title":"Epidemics"},{"issue":"3","key":"578_CR56","doi-asserted-by":"publisher","first-page":"710","DOI":"10.1016\/j.apm.2009.06.011","volume":"34","author":"BK Mishra","year":"2010","unstructured":"Mishra BK, Jha N (2010) SEIQRS model for the transmission of malicious objects in computer network. Appl Math Model 34(3):710\u2013715","journal-title":"Appl Math Model"},{"issue":"7\u20138","key":"578_CR57","doi-asserted-by":"publisher","first-page":"2173","DOI":"10.1016\/j.apm.2013.10.046","volume":"38","author":"BK Mishra","year":"2014","unstructured":"Mishra BK, Pandey SK (2014) Dynamic model of worm propagation in computer network. Appl Math Model 38(7\u20138):2173\u20132179","journal-title":"Appl Math Model"},{"issue":"2","key":"578_CR58","first-page":"1476","volume":"188","author":"BK Mishra","year":"2007","unstructured":"Mishra BK, Saini DK (2007) SEIRS epidemic model with delay for transmission of malicious objects in computer network. Appl Math Comput 188(2):1476\u20131482","journal-title":"Appl Math Comput"},{"key":"578_CR59","doi-asserted-by":"publisher","DOI":"10.1093\/oso\/9780198805090.001.0001","volume-title":"Networks","author":"M Newman","year":"2018","unstructured":"Newman M (2018) Networks. Oxford University Press, Oxford"},{"issue":"2","key":"578_CR60","doi-asserted-by":"publisher","first-page":"167","DOI":"10.1137\/s003614450342480","volume":"45","author":"MEJ Newman","year":"2003","unstructured":"Newman MEJ (2003) The structure and function of complex networks. SIAM Rev 45(2):167\u2013256. https:\/\/doi.org\/10.1137\/s003614450342480","journal-title":"SIAM Rev"},{"key":"578_CR61","doi-asserted-by":"publisher","unstructured":"Newsome J, Karp B, Song D (2005) Polygraph: automatically generating signatures for polymorphic worms. In: IEEE Symposium on security and privacy (S &P), pp 226\u2013241. https:\/\/doi.org\/10.1109\/SP.2005.15","DOI":"10.1109\/SP.2005.15"},{"issue":"3","key":"578_CR62","doi-asserted-by":"publisher","first-page":"2525","DOI":"10.1007\/s11277-020-07809-x","volume":"116","author":"RP Ojha","year":"2021","unstructured":"Ojha RP, Srivastava PK, Sanyal G et al (2021) Improved model for the stability analysis of wireless sensor network against malware attacks. Wirel Pers Commun 116(3):2525\u20132548","journal-title":"Wirel Pers Commun"},{"key":"578_CR63","doi-asserted-by":"crossref","unstructured":"Ongun T, Spohngellert O, Miller BA et al (2021) PORTFILER: port-level network profiling for self-propagating malware detection. In: Proceedings of the 9th IEEE conference on communications and network security (CNS), pp 182\u2013190","DOI":"10.1109\/CNS53000.2021.9705045"},{"key":"578_CR64","doi-asserted-by":"publisher","first-page":"925","DOI":"10.1103\/RevModPhys.87.925","volume":"87","author":"R Pastor-Satorras","year":"2015","unstructured":"Pastor-Satorras R, Castellano C, Van Mieghem P et al (2015) Epidemic processes in complex networks. Rev Mod Phys 87:925\u2013979. https:\/\/doi.org\/10.1103\/RevModPhys.87.925","journal-title":"Rev Mod Phys"},{"key":"578_CR65","volume-title":"Differential equations and dynamical systems","author":"L Perko","year":"2013","unstructured":"Perko L (2013) Differential equations and dynamical systems, vol 7. Springer Science & Business Media, New York"},{"key":"578_CR66","doi-asserted-by":"crossref","unstructured":"Perumalla KS, Sundaragopalan S (2004) High-fidelity modeling of computer network worms. In: 20th Annual computer security applications conference. IEEE, pp 126\u2013135","DOI":"10.21236\/ADA470528"},{"key":"578_CR67","first-page":"537","volume":"33","author":"B Prakash","year":"2011","unstructured":"Prakash B, Chakrabarti D, Faloutsos M et al (2011) Threshold conditions for arbitrary cascade models on arbitrary networks. Knowl Inf Syst 33:537\u2013546","journal-title":"Knowl Inf Syst"},{"issue":"2","key":"578_CR68","doi-asserted-by":"publisher","first-page":"116","DOI":"10.1145\/985793.985795","volume":"14","author":"GF Riley","year":"2004","unstructured":"Riley GF, Ammar MH, Fujimoto RM et al (2004) A federated approach to distributed network simulation. ACM Trans Model Comput Simul (TOMACS) 14(2):116\u2013148","journal-title":"ACM Trans Model Comput Simul (TOMACS)"},{"key":"578_CR69","volume-title":"Introduction to the modeling and analysis of complex systems","author":"H Sayama","year":"2015","unstructured":"Sayama H (2015) Introduction to the modeling and analysis of complex systems. Open SUNY, New York"},{"key":"578_CR70","doi-asserted-by":"crossref","unstructured":"Szymanski BK, Liu Y, Gupta R (2003) Parallel network simulation under distributed genesis. In: Seventeenth workshop on parallel and distributed simulation, 2003. (PADS 2003). Proceedings. IEEE, pp 61\u201368","DOI":"10.1109\/PADS.2003.1207421"},{"key":"578_CR71","unstructured":"The Zeek Project (2023) Zeek network monitoring tool. https:\/\/docs.zeek.org\/en\/master\/script-reference\/log-files.html. Accessed 11 July 2022"},{"key":"578_CR72","doi-asserted-by":"crossref","unstructured":"Tong H, Prakash BA, Eliassi-Rad T et\u00a0al (2012) Gelling, and melting, large graphs by edge manipulation. In: Proceedings of the 21st ACM conference on information and knowledge management (CIKM), pp 245\u2013254","DOI":"10.1145\/2396761.2396795"},{"issue":"31","key":"578_CR73","doi-asserted-by":"publisher","first-page":"187","DOI":"10.1098\/rsif.2008.0172","volume":"6","author":"T Toni","year":"2009","unstructured":"Toni T, Welch D, Strelkowa N et al (2009) Approximate Bayesian computation scheme for parameter inference and model selection in dynamical systems. J R Soc Interface 6(31):187\u2013202","journal-title":"J R Soc Interface"},{"key":"578_CR74","doi-asserted-by":"publisher","first-page":"656","DOI":"10.1137\/20M1352132","volume":"3","author":"L Torres","year":"2021","unstructured":"Torres L, Chan K, Tong H et al (2021) Nonbacktracking eigenvalues under node removal: X-centrality and targeted immunization. SIAM J Math Data Sci 3:656\u2013675","journal-title":"SIAM J Math Data Sci"},{"issue":"6","key":"578_CR75","doi-asserted-by":"publisher","first-page":"2751","DOI":"10.1016\/j.apm.2011.09.058","volume":"36","author":"OA Toutonji","year":"2012","unstructured":"Toutonji OA, Yoo SM, Park M (2012) Stability analysis of VEISV propagation modeling for network worm attack. Appl Math Model 36(6):2751\u20132761","journal-title":"Appl Math Model"},{"key":"578_CR76","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1016\/j.mbs.2018.02.004","volume":"299","author":"N Tuncer","year":"2018","unstructured":"Tuncer N, Le TT (2018) Structural and practical identifiability analysis of outbreak models. Math Biosci 299:1\u201318","journal-title":"Math Biosci"},{"issue":"SI","key":"578_CR77","doi-asserted-by":"publisher","first-page":"271","DOI":"10.1145\/844128.844154","volume":"36","author":"A Vahdat","year":"2002","unstructured":"Vahdat A, Yocum K, Walsh K et al (2002) Scalability and accuracy in a large-scale network emulator. ACM SIGOPS Op Syst Rev 36(SI):271\u2013284","journal-title":"ACM SIGOPS Op Syst Rev"},{"issue":"1","key":"578_CR78","doi-asserted-by":"publisher","first-page":"12172","DOI":"10.1038\/srep12172","volume":"5","author":"LD Valdez","year":"2015","unstructured":"Valdez LD, Arag\u00e3o R\u00eago H, Stanley HE et al (2015) Predicting the extinction of Ebola spreading in Liberia due to mitigation strategies. Sci Rep 5(1):12172","journal-title":"Sci Rep"},{"key":"578_CR79","doi-asserted-by":"crossref","unstructured":"Van\u00a0den Driessche P, Watmough J (2008) Further notes on the basic reproduction number. Math Epidemiol 59\u2013178","DOI":"10.1007\/978-3-540-78911-6_6"},{"key":"578_CR80","volume-title":"Nonlinear differential equations and dynamical systems","author":"F Verhulst","year":"2006","unstructured":"Verhulst F (2006) Nonlinear differential equations and dynamical systems. Springer Science & Business Media, Utrecht"},{"issue":"1","key":"578_CR81","doi-asserted-by":"publisher","first-page":"32","DOI":"10.1038\/nphys2160","volume":"8","author":"A Vespignani","year":"2012","unstructured":"Vespignani A (2012) Modelling dynamical processes in complex socio-technical systems. Nat Phys 8(1):32\u201339","journal-title":"Nat Phys"},{"issue":"6684","key":"578_CR82","doi-asserted-by":"publisher","first-page":"440","DOI":"10.1038\/30918","volume":"393","author":"DJ Watts","year":"1998","unstructured":"Watts DJ, Strogatz SH (1998) Collective dynamics of \u2018small-world\u2019 networks. Nature 393(6684):440\u2013442","journal-title":"Nature"},{"issue":"1\u20132","key":"578_CR83","first-page":"151","volume":"5","author":"S Wei","year":"2010","unstructured":"Wei S, Hussain A, Mirkovic J et al (2010) Tools for worm experimentation on the deter testbed. Int J Commun Netw Distrib Syst 5(1\u20132):151\u2013171","journal-title":"Int J Commun Netw Distrib Syst"},{"issue":"1","key":"578_CR84","doi-asserted-by":"publisher","first-page":"8751","DOI":"10.1038\/srep08751","volume":"5","author":"JS Weitz","year":"2015","unstructured":"Weitz JS, Dushoff J (2015) Modeling post-death transmission of Ebola: challenges for inference and opportunities for control. Sci Rep 5(1):8751","journal-title":"Sci Rep"},{"issue":"Sl","key":"578_CR85","doi-asserted-by":"publisher","first-page":"255","DOI":"10.1145\/844128.844152","volume":"36","author":"B White","year":"2002","unstructured":"White B, Lepreau J, Stoller L et al (2002) An integrated experimental environment for distributed systems and networks. ACM SIGOPS Op Syst Rev 36(Sl):255\u2013270","journal-title":"ACM SIGOPS Op Syst Rev"},{"key":"578_CR86","unstructured":"Wikipedia (2023a) Colonial Pipeline ransomware attack. URL https:\/\/en.wikipedia.org\/wiki\/Colonial_Pipeline_ransomware_attack. Accessed 7 May 2022"},{"key":"578_CR87","unstructured":"Wikipedia (2023b) Petya and NotPetya. URL https:\/\/en.wikipedia.org\/w\/index.php?. Accessed 7 May 2022"},{"key":"578_CR88","unstructured":"Wikipedia (2023c) Wannacry ransomware attack. URL https:\/\/en.wikipedia.org\/w\/index.php?title=WannaCry_ransomware_attack &oldid=1086034703, accessed 7-May-2022"},{"key":"578_CR89","doi-asserted-by":"crossref","unstructured":"Yao Y, Fu Q, Yang W et al (2018) An epidemic model of computer worms with time delay and variable infection rate. Secur Commun Netw 2018","DOI":"10.1155\/2018\/9756982"},{"key":"578_CR90","doi-asserted-by":"crossref","unstructured":"Zheng Y, Zhu J, Lai C (2020) A SEIQR model considering the effects of different quarantined rates on worm propagation in mobile internet. Math Probl Eng","DOI":"10.1155\/2020\/8161595"},{"issue":"12","key":"578_CR91","doi-asserted-by":"publisher","first-page":"5117","DOI":"10.1016\/j.cnsns.2012.05.030","volume":"17","author":"Q Zhu","year":"2012","unstructured":"Zhu Q, Yang X, Ren J (2012) Modeling and analysis of the spread of computer virus. Commun Nonlinear Sci Numer Simul 17(12):5117\u20135124","journal-title":"Commun Nonlinear Sci Numer Simul"}],"container-title":["Applied Network Science"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s41109-023-00578-z.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s41109-023-00578-z\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s41109-023-00578-z.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,11,19]],"date-time":"2023-11-19T13:03:26Z","timestamp":1700399006000},"score":1,"resource":{"primary":{"URL":"https:\/\/appliednetsci.springeropen.com\/articles\/10.1007\/s41109-023-00578-z"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,8,18]]},"references-count":91,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2023,12]]}},"alternative-id":["578"],"URL":"https:\/\/doi.org\/10.1007\/s41109-023-00578-z","relation":{},"ISSN":["2364-8228"],"issn-type":[{"value":"2364-8228","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,8,18]]},"assertion":[{"value":"9 June 2023","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"3 August 2023","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"18 August 2023","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no competing interests.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"52"}}