Epidemic Math Meets Cyber Warfare: New Model Predicts How APT Malware Spreads Through Networks

When a sophisticated cyberattack slips into an organization’s network, security teams often discover it weeks or months too late, after the intruder has quietly moved from machine to machine, harvesting credentials and exfiltrating data. A team of Vietnamese researchers now argues that the spread of such threats can be forecast in advance, using mathematical machinery borrowed from epidemiology but rebuilt from the ground up for the peculiar behavior of advanced persistent threats. In a study published in Cluster Computing, Tran Hai Anh and Nguyen Thanh Thuy of Vietnam National University in Hanoi, together with Do Xuan Cho of the Posts and Telecommunications Institute of Technology, introduce a modeling framework called Dual SPLIR that aims to predict how APT malware propagates through complex organizational networks with greater accuracy and realism than previous approaches.

The acronym SPLIR stands for Susceptible, Protected, Latent, Infectious, and Recovered, a five-state extension of the classic SIR epidemic models that have been used for a century to track measles, influenza, and other human contagions. In this cyber adaptation, every device in a network occupies one of those states at any moment: susceptible machines are vulnerable to infection, protected ones carry effective defenses, latent machines harbor the malware in a dormant form, infectious machines actively spread it to their neighbors, and recovered machines have been cleaned and patched. The crucial innovation is the latent state, which captures the defining signature of APT malware: its ability to sit quietly inside a compromised host, evading detection, sometimes for months, before activating to launch lateral movement or data theft.

That dormancy is not a minor detail. Traditional malware propagation models, most of them derived from SIS or SIR formulations, assume that an infected machine either spreads the contagion immediately or is quickly cleaned. APT malware, by contrast, behaves more like a slow-burning infection with long incubation periods, sometimes triggered by logic-bomb conditions or by sandbox-evasion routines that keep it inert on machines where it senses analysis tools. By adding an explicit latent compartment with its own transition rates, the Dual SPLIR model can represent this waiting phase, and the researchers show that ignoring it systematically distorts predictions of when an outbreak will peak and how large it will become.

The second major innovation is the word Dual. Real organizational networks are not homogeneous populations of identical machines; they are mixtures of workstations, laptops, servers, and specialized devices, each with different exposure levels, patching schedules, and defensive capabilities. The researchers therefore split the network into two distinct machine groups, each with its own set of epidemiological parameters, and coupled them through cross-group transmission terms. This allows the model to compute different transmission dynamics for, say, a heavily defended server cluster and a fleet of lightly protected endpoint devices, and to capture how an outbreak seeded in the weaker group can spill over into the stronger one. The authors describe this as accounting for environmental variability, the fact that infection pressure differs across heterogeneous devices and machine groups within the same infrastructure.

The third pillar of the framework is organizational policy. Firewalls, antivirus deployment, patch management, and user training all shape how malware moves, yet most propagation models treat these human and institutional factors as fixed background constants. The Vietnamese team instead treats policy-related parameters as explicit inputs and then asks, quantitatively, how much each one matters. To do so they employ the Sobol method, a global sensitivity analysis technique originally developed for complex physical and financial models, which decomposes the variance in model output and attributes it to individual parameters and their interactions. Combined with elasticity analysis, which measures the percentage change in outcomes per percentage change in a parameter, the approach reveals which organizational levers exert the strongest influence on the course of an outbreak.

The mathematical payoff of this framework is a defense threshold expressed through the basic reproduction number, the same quantity that dominated public discussion during the COVID-19 pandemic. If the reproduction number for a given malware strain in a given network configuration falls below one, the outbreak dies out; if it exceeds one, the malware persists and spreads toward an endemic equilibrium. The researchers derive analytic expressions for this threshold and, crucially, invert them: given everything else about the network, one can compute the maximum value of an ineffective-defense coefficient that the system can tolerate before the malware takes hold. In one worked example, tightening the defense parameter for the server group from 0.3 to 0.1 drove the reproduction number from approximately 1.199 down to 0.732, flipping the system from an endemic state, where roughly one in ten machines remained compromised in the long run, to a malware-free equilibrium. The analysis showed that keeping the ineffective defense coefficient below 0.215 would guarantee eradication under the tested conditions.

Stability of the resulting equilibria was verified using the Routh-Hurwitz criterion, a classical control-theory test that confirms whether a system, once perturbed, returns to its steady state rather than oscillating or diverging. This matters for practitioners because an unstable prediction is useless for planning: security teams need to know not only whether malware will persist but whether the projected trajectory is reliable. The authors suggest that their threshold formula could serve as a theoretical benchmark for comparing real-world defense products, with effectiveness estimates drawn from regression models trained on practical security assessment data, such as independent antivirus test results.

Validating such a model poses its own challenge, because genuine APT outbreaks inside corporate networks are rare, closely guarded secrets. The researchers sidestepped the problem by constructing a synthetic malware propagation dataset that combines graph-based network modeling with the MITRE ATT&CK framework, the widely used public catalog of adversary tactics and techniques maintained by MITRE. By mapping known APT behaviors, drawn from groups cataloged by MITRE such as Turla and APT36, onto simulated network topologies, they generated propagation scenarios that reflect the multi-stage, reconnaissance-driven character of real intrusions rather than the indiscriminate spraying of conventional worms. Experimental results showed the proposed model outperforming existing approaches across multiple evaluation metrics, although the abstract-level summary does not specify which competing models were compared or by what margins.

The study builds on the authors’ own earlier work, a Dual-SPIR model published in Computers and Electrical Engineering in 2025, and situates itself within a growing literature that applies epidemic mathematics to cybersecurity. Recent contributions in this space include SIS epidemic modeling on hypergraphs, adaptive fuzzy SIR models for industrial Internet of Things networks, Markov-chain analyses of malware propagation under network-level mitigation, and heterogeneous-device propagation models for IoT ecosystems. What distinguishes the new framework, according to the authors, is the simultaneous treatment of APT-specific dormancy, environmental heterogeneity, and policy sensitivity, three factors they argue have remained largely unaddressed in prior research despite their outsized effect on prediction outcomes.

The practical implications extend beyond academic modeling. If security teams can estimate a network’s reproduction number for a given threat class, they gain a principled target for hardening efforts: reduce the parameters that matter most until the threshold crosses below one, rather than spreading resources uniformly across all defenses. The Sobol and elasticity analyses provide exactly that prioritization, identifying which organizational policies, whether faster patching, stronger endpoint protection on servers, or stricter segmentation between machine groups, yield the greatest reduction in outbreak risk. The work also underscores a lesson familiar from public health: dormant infections are dangerous precisely because they are invisible, and models that ignore latency will underestimate both the duration and the ultimate size of an epidemic. As APT campaigns grow more patient and more sophisticated, the researchers suggest, forecasting frameworks that respect the full behavioral repertoire of the adversary, from silent incubation to targeted lateral movement, will become an essential layer of organizational defense, complementing rather than replacing the detection tools that operate at the level of individual machines.

Subject of Research: Epidemiological modeling of advanced persistent threat malware propagation in organizational networks

Article Title: A novel framework for forecasting the spread of APT malware in complex networks

Article References: A novel framework for forecasting the spread of APT malware in complex networks. (n.d.). https://doi.org/10.1007/s10586-026-06590-z

Image Credits: AI Generated

DOI: 10.1007/s10586-026-06590-z

Keywords: APT malware, malware propagation, epidemic modeling, Dual SPLIR model, MITRE ATT&CK, network security, basic reproduction number, Sobol sensitivity analysis, cybersecurity, complex networks, dormant malware, defense threshold