SI/SIS/SIR models for malware propagation in P2P networks: Numerical analysis and perspectives for fractional-order extensions - Džamić, Dušan; Marković, Aleksa (Advances in Differential Equations and Control Processes, 2026)
In this paper, we examined the suitability of epidemic models on networks to assess their potential application for detecting malware propagation patterns in peer-to-peer (P2P) computer networks. We analyzed how the Susceptible-Infected (SI), Susceptible-Infected-Susceptible (SIS), and Susceptible-Infected-Recovered (SIR) models, which were originally developed for biological viruses, can be applied to digital viruses. Using the Gnutella network dataset as a representative topology of P2P networks, we simulated infection scenarios to evaluate how scale-free network properties and the presence of high-degree nodes acting as super-spreaders influence the propagation speed and network saturation. The obtained results show that the examined models can be used and provide valuable insight into epidemic dynamics. However, the existing models are not perfect, and the introduction of additional states, such as L for latency and Q for quarantine, is proposed, since these are relevant for digital devices and digital viruses. More precisely, the absence of latent (L) and quarantine (Q) components leads to an overestimation of infection speed and an inability to model strategic isolation. Accordingly, this study provides empirical evidence that standard biological models are not sufficient for accurate predictions in the field of cybersecurity in P2P environments, and that future modeling efforts should move from basic compartmental models toward more advanced frameworks, such as SEIR and SIQR, to realistically capture malware activation delays and the impact of active defense strategies.