Study of the antivirus patch testing problem through optimal control modeling

Abstract

The lag of antivirus (AV) software development relative to malware development makes it necessary to constantly release AV patches. In practice, an AV patch can be deployed on an organization’s intranet only when it passes compatibility test. In this context, a subset of hosts may be assigned to perform the test. The function of the fraction of the assigned hosts with respect to time is referred to as an AV patch testing (AVPT) policy, and the problem of finding a satisfactory AVPT policy in terms of the cost benefit is referred to as the AVPT problem. This paper addresses the AVPT problem through optimal control modeling. A new mathematical model of characterizing the evolution of the intranet’s expected state is introduced by incorporating the effect of AV patch testing. On this basis, the AVPT problem is modeled as an optimal control problem (the AVPT model). By applying the Pontryagin Maximum Principle to this model, an iterative algorithm of solving the model is presented. The usability of the algorithm, including its convergence and effectiveness, is validated. Finally, the effect of a pair of controllable factors is inspected. This work initiates the study of patch testing-related issues through optimal control modeling.

Introduction

Malicious software, or malware, serves as the umbrella term of all kinds of computer programs that perform vicious operations [1]. Computer viruses, worms, Trojan horses, rootkits, and ransomware are typical examples of malware. Today, the development of malware has come to be a highly profitable business, with the intent of extorting money from computer users or stealing their credentials for stealing their money or digital assets. With the rapidly increasing number and variety of malware, the total amount of financial losses suffered by the whole world is increasing every year. To exemplify, it was reported that, owing to the rampage of the infamous ransomware, only in 2020 the overall ransom paid by the victims was over 412 million US dollars [2].

To mitigate the serious consequence of malware, a multitude of malware detection techniques have been developed [3, 4]. There are two different kinds of malware detection techniques: signature-based and behavioral-based. A signature-based malware detection technique can accurately identify malware with known signatures but fails when facing new malware with no known signatures. A behavioral-based malware detection technique can identify some new malware but with higher false positive rate. Antivirus (AV) software refers to software designed to detect and remove malware from computers [5]. The development of AV software depends heavily on the advance of malware detection techniques. Nowadays, there are lots of commercially available AV products.

Motivation

With the rapid progress of software automation techniques, the development of malware is speeding up at an alarming rate. As a result, lots of new malware is emerging on a daily basis. In contrast, the development of AV software markedly lags behind that of malware. Therefore, new AV patches must be developed constantly to come up with the emerging malware. As a special kind of software patch, AV patch must be managed following the standard procedure of patch management [6].

As a critical component of AV patch management, AV patch testing aims to decide on if an AV patch is compatible with the software and applications existing in a computer [7]. Although each and every AV patch undergoes rigorous compatibility test before it is released, it is impossible for an AV patch vendor to examine the compatibility of an AV patch by exhausting all possibilities. Therefore, before an AV patch can be installed on a computer, it is typically the computer user’s obligation to test the patch compatibility comprehensively.

Consider the typical application scenario where a large-scale organization owns an intranet and has subscribed VIP services from a well-known AV vendor. This implies that at any time the organization can acquire up-to-date AV patches from the vendor. In this situation, the organization’s network administrator is responsible for testing the compatibility of the newly acquired AV patches with the software and applications deployed on the intranet. To manage the AV patch update process efficiently, the organization needs to allocate a certain amount of resources for patch testing in advance [8].

Suppose at each time point in a period of time, a subset of hosts in the intranet are assigned to participate in AV patch testing. It is easily understood that assigning a host to perform AV patch test helps reduce the likelihood of exposure of patch incompatibility, at the cost of a certain degree of performance degradation. We refer to the function of the fraction of the assigned hosts with respect to time as an AV patch testing (AVPT) policy. In practice, the organization needs to solve the following problem:

AVPT problem: Find a cost-effective AVPT policy from massive candidate AVPT policies.

To our knowledge, this problem has not been touched in literature. This paper aims to solve the AVPT problem.

Contributions

The main contributions of this paper are sketched below.

* Formulation and modeling of the AVPT problem. The AVPT problem is formulated explicitly. By incorporating the effect of AV patch testing, a new mathematical model of characterizing the evolution of the intranet’s expected state is introduced. On this basis, the AVPT problem is boiled down to an optimal control problem (the AVPT model).

* Solution of the AVPT model. By applying the Pontryagin Maximum Principle to the AVPT model, an iterative algorithm for solving the AVPT model is presented. The usability of the algorithm, including its convergence and effectiveness, is validated through numerical experiments.

* Further discussions. A pair of factors that are under the control of the organization are identified. The effect of these two factors on the AVPT policy generated by the above algorithm is examined.

The remaining part of this paper is organized in this way: Section II reviews the related work. Section III establishes the AVPT model. Section IV gives an algorithm of solving the AVPT model and validates its usability. Section V inspects the effect of a pair of controllable factors. Finally, this work is summarized by section VI.

Related work

This section is dedicated to reviewing the related work.

Modeling of malware propagation

Infectious diseases can spread in populations. To evaluate the prevalence of an infectious disease as well as the effect of a treatment measure, in 1927 Kermack and McKendrick introduced a differential system, termed the susceptible-infected-recovered (SIR) model, to capture the spreading process of an epidemic with no recurrence [9]. Later, in 1933 they suggested a differential system, termed the susceptible-infected-susceptible (SIS) model, to characterize the spreading process of an endemic or a recurrent epidemic [10]. Their seminal work laid foundation for the birth of epidemic dynamics [11].

In 1964 Goffman and Newill suggested to view any propagation phenomenon as an ‘epidemic’ and investigate its propagation laws through epidemic modeling [12]. In response to this suggestion, in 1991-1993 Kephart and White advised the earliest malware propagation models to evaluate the impact of malware propagation as well as the effect of AV patch release [13, 14]. Their work laid foundation for the birth of malware propagation dynamics. Since then, many malware propagation models, ranging from ordinary models [15, 16] to delayed models [17, 18], and from models on homogeneous networks [15, 16] and models on inhomogeneous networks [19, 20] to models on arbitrary networks [21, 22], have been proposed.

In practice, there are two different kinds of AV patch distribution mechanism: centralized and decentralized. With regard to the former distribution mechanism, all customers of an AV vendor acquire AV patches by downloading them directly from the vendor’s website. See [13–22] for some malware propagation models under the centralized AV patch distribution mechanism. The major defect of this distribution mechanism lies in the limited bandwidth available for AV patch downloading. When it comes to the latter distribution mechanism, only a small fraction of customers acquire AV patches through direct patch downloading, while all the remaining customers acquire them through automated AV patch forwarding over the Internet [23]. In this situation, malware and AV patches can propagate simultaneously over the same or different networks. See [24–28] for some malware-patch mixed propagation models under the decentralized AV patch distribution mechanism. This distribution mechanism overcomes the limitation on the bandwidth available for downloading AV patches.

In all the above-mentioned malware propagation models, the AV patch downloading rate is assumed to be time-invarying. Additionally, in all the above-mentioned malware-patch mixed propagation models, the AV patch forwarding rate is assumed to be time-invarying. In practice, these rates can be adjusted flexibly.

Optimal control of malware propagation

In the presence of a sole decision-maker, optimal control theory aims to find a policy governing a dynamical system so that the decision-maker’s payoff is optimized [29]. In the presence of multiple decision-makers (players), differential game theory aims to find a policy portfolio governing a dynamical system so that each and every player is satisfied with his own payoff [30]. By introducing one or more control variables into a malware propagation model, the control problem of malware propagation can be modeled as an optimal control problem or a differential game problem.

Based on a malware propagation model on a mobile wireless network, [31] considered the tradeoff between the network’s security risk and the bandwidth consumption of patching. Through optimal control modeling and analysis, the authors acquired a better tradeoff policy. Based on a malware propagation model on an inhomogeneous mobile network, [32] attempted to minimize the overall cost yielded by malware propagation and patching. Again through optimal control modeling, the authors acquired a better centralized AV distribution policy. In the presence of a strategic, intelligent malware maker and based on a malware-patch mixed propagation model, [33] addressed the downloading of AV patches. Through differential game modeling, the authors acquired a better AV patch downloading policy. Recently, based on a delayed malware propagation model on a mobile wireless sensor network, [34] addressed the minimization of the sum of the amount of losses caused by malware propagation and the cost used for patching. Through optimal control modeling of delayed dynamic system, the authors obtained a better centralized AV patch distribution strategy.

In practice, a new AV patch must be tested before it is installed. However, none of the above work considered the effect of AV patch testing.

Software patch management

[35] offered an excellent literature review on software patch management. In particular, the authors pointed out that one of the biggest challenges faced by patch testing is the lack of a proper automated test strategy. This may be attributed to multiple aspects, ranging from complex patch dependencies [36, 37] to expenive cost for establishing test environment [38, 39]. As a result, most of the current patch testing are conducted manually to avoid unexpected system breakdown. However, the poor test quality in manual patch testing increases the risk of system performance degradation. In recent years some automated patch testing techniques have been developed [40–42]. We believe that, in the near future, the accuracy of automated patch testing will be enhanced greatly. This is the foundation on which the present work is based.

In a patch management process involving a software vendor and a firm, the vendor wishes to determine the best patch-release policy, and the firm wants to select the best patch-update policy. In the context of time-driven patch release and update, [8] developed a game model to characterize the strategic interaction between the vendor and the firm. Under the centralized path-release and update mechanism, the authors showed that the social loss is minimized when the patch-release and update cycles are synchronized. Under the decentralized path-release and update mechanism, the authors gave a sufficient condition for a pair of patch-release and update policies to achieve equilibrium. This work is somewhat related to ours. However, this work has no relationship with patch testing.

Novelties of the present paper

Albert Einstein once said: “To raise new questions, new possibilities, to regard old problems from a new angle, requires creative imagination and marks real advance in science.” The first novelty of the present paper is to propose a new, valuable problem (i.e., the AVPT problem). First, this problem has never been touched in literature. Second, the problem is worth studying from the perspective of patch management, because its solution could offer insight into AV patch testing.

The second novelty of the present paper is to introduce a new malware propagation model. To our knowledge, none of existing malware propagation models took the effect of AV patch testing into account. In our proposed malware propagation model, the performance degradation caused by AV patch testing and that caused by the exposed patch incompatibility are well characterized. This work lays foundation for the theoretical study of AV patch testing.

The third novelty of the present paper is to study the proposed AVPT problem through mathematical modeling. To our knowledge, all the existing researches on patch testing lack an in-depth mathematical treatment. Based on our proposed malware propagation model, in this paper the AVPT problem is successfully reduced to an optimal control problem. As a result, the AVPT problem is resolved successfully by applying optimal control theory to the proposed optimal control problem.

Modeling of the AVPT problem

This section is devoted to the modeling of the AVPT problem proposed in the first section.

Formalization of AVPT policy

Consider the AVPT problem. Suppose the organization possesses an intranet of N hosts and has subscribed VIP services from an AV vendor. This implies that, whenever necessary, the organization can acquire up-to-date AV patches from the AV vendor. To safeguard the intranet against malware attack, the organization’s network administrator needs to timely test and deploy newly acquired AV patches. In this context, it is necessary to evaluate the effect of AV patch testing in advance. Let denote the future time horizon preset for the evaluation. We refer to T as the test evaluation period.

For our purpose, we need to formalize an AVPT policy. Let x(t) denote the fraction of hosts assigned to perform AV patch test at time t. Then, , . We refer to the function x defined on the interval as an AV patch testing (AVPT) policy.

Assigning a host to perform AV patch test would lead to a certain degree of performance degradation of the organization. This is because the host cannot be assigned to perform any other operations at the same time. Define the basic test cost, denoted , as the per-unit-time cost yielded by the performance degradation caused by assigning a host to perform AV patch test. Then, an AVPT policy x is implemented at the test cost

(1)

Now, consider the feasibility of an AVPT policy. On the one hand, to guarantee the organization’s normal operation, the fraction of the assigned hosts must be small. Suppose all x(t) are bounded by . We refer to as the maximal host fraction. On the other hand, to guarantee smooth transition of the assigned hosts, the change in the fraction of the assigned hosts must be small. Hence, in what follows assume an AVPT policy is feasible only if it is piecewise continuous. Let denote the set of piecewise continuous functions defined on . Combining the above discussions, we get that an AVPT strategy is feasible if and only if it falls into the set

(2)

Expected state of the intranet and its evolution

For our purpose, it is essential to define the intranet’s expected state and model its evolution.

At any time point in the future time interval , each and every host in the intranet is either operable, i.e., working normally, or inoperable, i.e., not working normally. In what follows we make the following ideal assumptions:

1. (A₁). If a host is operable at a time point, this can be attributed to one of two possibilities: (i) The installed AV patches are compatible perfectly with the system and applications deployed on the host. (ii) Although the installed AV patches are not perfectly compatible, this imperfection doesn’t hinder the host’s normal operation at this time point.

2. (A₂). If a host doesn’t operable at a time point, this can be exclusively attributed to the possibility that (i) the installed AV patches are not perfectly compatible, and (ii) this imperfection impedes the host’s normal operation at this time point.

Furthermore, at any time point each and every operable host may be susceptible, i.e., not currently infected with malware, or compromised, i.e., currently infected with malware. Combining the above discussions, at any time point each and every host in the intranet is in one of three possible states: susceptible, compromised, and inoperable.

Let X₁(t) (resp. X₂(t), X₃(t)) denote the number of susceptible (resp. compromised, inoperable) hosts at time t. As , we define the state of the intranet at time t as the vector

(3)

In practice, X(t) is a random vector, which cannot be predicted accurately. Instead, below let us define the expected state of the intranet.

Let S(t) (resp. C(t), I(t)) denote the expected number of susceptible (resp. compromised, inoperable) hosts at time t. As , we define the expected state of the intranet at time t as the vector

(4)

In practice, E(t) can be predicted accurately.

To capture the evolution of the expected state of the intranet over time, below let us introduce several reasonable assumptions. Here. the term rate refers to probability per unit time.

1. (A₃). Owing to the impact of malware attack coming from outside of the organization, each and every susceptible host gets infected at any time at the constant rate (the external infection rate).

2. (A₄). Owing to the impact of malware attack coming from a compromised host, each and every susceptible host gets infected at any time at the constant rate (the internal infection rate).

3. (A₅). Owing to the influence of the installed AV patches, each and every compromised host becomes susceptible at any time at the constant rate (the disinfection rate).

4. (A₆). Owing to the impact of exposure of incompatibility of the installed AV patches, each and every operable host becomes inoperable at any time at the rate , where z stands for the fraction of hosts assigned to perform AV patch test at that time. The function is referred to as the incompatibility rate function. By the definition, is decreasing.

5. (A₇). Owing to the influence of reinstalling systems on inoperable hosts, each and every inoperable host becomes susceptible at any time at the constant rate (the repair rate).

6. (A₈). At the initial time, the intranet has just been fully disinfected and restarted successfully. This implies .

Under the above assumptions, the evolution of the expected state of the intranet obeys the following differential system:

(5)

Fig 1 gives a diagram of this system.

[Figure omitted. See PDF.]

Optimal control modeling of the AVPT problem

We are ready to finish the modeling of the AVPT problem.

The exposure of incompatibility of the AV patches installed on an operable host would render the host inoperable and lead to a certain degree of performance degradation of the organization. Define the basic incompatibility cost, denoted , as the per-unit-time cost yielded by the performance degradation caused by the exposed incompatibility of the AV patches installed on an host. Then, an AVPT policy x is implemented at the incompatibility cost

(6)

A susceptible host can bring a certain amount of benefit. This is because the host is not only working normally but not infected with malware. Define the basic security benefit, denote , as the per-unit-time benefit yielded by a susceptible host. Then, the benefit brought by an AVPT policy x is estimated to be

(7)

In view of Eq. 1, the cost benefit of implementing an AVPT policy x is estimated to be

(8)

Combining the previous discussions, in what follows we reduce the AVPT problem to the following optimal control problem:

(9)

We refer to the problem (9) as the AVPT model. Each instance of the AVPT model (AVPT instance, for short) is captured by a 11-tuple of the form

(10)

Solution of the AVPT model

This section is dedicated to solving the AVPT model established in the preceding section. First, solving the AVPT model is partly reduced to solving a system. Second, an iterative algorithm for solving the system is given. For detailed knowledge on optimal control theory, see [29].

Optimality system

The Hamiltonian function for the AVPT model reads

(11)

Here, stands for the adjoint of H.

Suppose x is an optimal AVPT policy for the AVPT model (9). Let be the solution to the associated expected state evolutionary model (5). It follows from the Pontryagin Maximum Principle [29] that there exists an adjoint funtion such that

(12)

Through direct calculations, we get that

(13)

Again by the Pontryagin Maximum Principle [29], we have

(14)

Let

(15)

It follows from Eqs. 14 and through simple algebraic calculations that

(16)

Combining Eqs. 5, 13, and 16, we get the optimality system for the AVPT model (9), which is given below.

(17)

In what follows we view the optimality system (17) as a system in x. Here, S, C, , and are viewed as auxiliary functions.

An optimal control for the AVPT model (9) must be a solution to the system (17). But the converse is untrue.

Solving the optimality system

See Ref. [43] for a standard method of solving open-loop, deterministic optimal control problems. On this basis, an algorithm of solving the AVPT model (9), termed the AVPT algorithm, is formulated in Algorithm 1. When performing the algorithm, a sequence of feasible AVPT policies are generated. The algorithm terminates if and only if the generated sequence converges in terms of the preset convergence error. If this is the case, the algorithm returns the finally generated AVPT policy.

Algorithm 1 AVPT

Input: an AVPT instance , a convergence error .

Output: an AVPT policy x.

1: ; ;

2: repeat

3:   ;

4:   forwardly caculate using Eqs. 5 with ;

   ;

5:   backwardly caculate using Eqs. 13 with

   and ; ;

6:   caculate x by solving the minimization problems (16) with

   and ; ;

7: until ;

8: return x^(k).

Before the AVPT algorithm can be used to solve the AVPT model, a pair of questions must be answered beforehand. The first question is: Does the AVPT algorithm converge? (equivalently, does the sequence of AVPT policies generated by the AVPT algorithm converge?) After all, the AVPT algorithm returns a feasible AVPT policy if and only if it converges. The second question is: In the case where the AVPT algorithm converges, is the AVPT algorithm effective? (equivalently, is the AVPT policy generated by the AVPT algorithm cost-effective)? Now, let us answer these two questions through extensive numerical experiments.

Experiment 1. Consider the AVPT instance , where N = 1000, T = 20, , , , , , , , , .

1. Convergence. When performing the AVPT algorithm on , it is observed that the algorithm terminates in six iterations, returning an AVPT policy, denoted x^* and plotted in Fig. 2(a).

2. Effectiveness. Randomly and uniformly generate a set of 100 feasible AVPT policies, denoted . Fig. 2(b) exhibits J(x) versus x, . It is observed that J(x^*)>J(x) for all . That is, x^* is superior to all the 100 AVPT policies in in terms of the cost benefit.

[Figure omitted. See PDF.]

Experiment 2. Consider the AVPT instance , where N = 2000, T = 30, , , , , , , , , .

1. Convergence. When performing the AVPT algorithm on , it is observed that the algorithm terminates in four iterations, returning an AVPT policy, denoted x^* and plotted in Fig. 3(a).

2. Effectiveness. Randomly and uniformly generate a set of 100 feasible AVPT policies, denoted . Fig. 3(b) exhibits J(x) versus x, . It is observed that J(x^*)>J(x), . That is, outperforms all the 100 AVPT policies in in terms of the cost benefit.

[Figure omitted. See PDF.]

Experiment 3. Consider the AVPT instance , where N = 3000, T = 50, , , , , , , , , .

1. Convergence. When performing the AVPT algorithm on , it is observed that the algorithm terminates in three iterations, returning an AVPT policy, denoted x^* and plotted in Fig 4a.

2. 2. Effectiveness. Randomly and uniformly generate a set of 100 feasible AVPT policies, denoted . Fig 4b exhibits J(x) versus x, . It is observed that J(x^*)>J(x), . That is, beats all the 100 AVPT policies in in terms of the cost benefit.

[Figure omitted. See PDF.]

Additionally, 10000 similar experiments have been conducted. In each of these experiments, similar phenomena are observed. Hence, it is concluded that the AVPT algorithm converges almost surely and that the resulting AVPT policy outperforms most other feasible AVPT policies in terms of the cost benefit almost surely. That is, the two previously proposed questions are answered positively. Therefore, it is concluded that the AVPT algorithm can be used to solve the AVPT model successfully. Consequently, the AVPT policy generated by the AVPT algorithm is strongly recommended.

Look at Ref. [44]. A dynamic programming method of solving optimal control problems was presented. It is concluded that, generally speaking, our method is significantly superior to this method in terms of the cost benefit, the time cost, and the smoothness of the control strategy.

Further discussions

This section is devoted to inspecting the effect of some key factors on the AVPT policy obtained by the AVPT algorithm.

Classification of the relevant factors

First, the eleven factors involved in the AVPT instance (10) can be categorized as three classes, which are listed below.

* Class 1: Known factors. There is only one such factor: the intranet size N.

* Class 2: Controllable factors. There are two factors that are under the control of the organization: the test evaluation period T and the maximal host fraction . In practice, T is preset by the organization based on the evaluation requirement, is determined by the organization based on the demanded performance level.

* Class 3: Uncontrollable but estimable factors. There are eight such factors: the external infection rate , the internal infection rate , the disinfection rate , the incompatibility rate function , the repair rate , the basic test cost , the basic incompatibility cost , and the basic security benefit .

In practice, and can be estimated by averaging the historical data of the relevant malware infection rate, can be estimated by averaging the historical data of the AV patch installation rate, can be estimated by averaging the historical data of system installation rate, can be approximated by fitting the historical data about the probability distribution of the exposure of AV patch incompatibility, and can be estimated based on the degree of performance degradation caused by a computer in downtime, and can be estimated based on the economic losses caused by a compromised computer.

In practice, when all the above-mentioned factors have been determined or estimated, an AVPT instance takes shape. By performing the AVPT algorithm on this instance (as well as a given convergence error), a cost-effective AVPT policy is generated, which is recommended to the associated organization.

Effect of a pair of controllable factors

In the previous subsection, we stated that there are a pair of factors, i.e., the test evaluation period and the maximal host fraction, that are under the control of the organizations. Now, let us inspect the effect of these factors on the AVPT policy generated by the AVPT algorithm through numerical experiments. First, examine the effect of the test evaluation period.

Experiment 4. Let .

1. Consider the collection of AVPT instances: , where N = 1000, , , , , , , , , , and . Let denote the AVPT policy generated by performing the AVPT algorithm on . Fig. 5(a) displays versus T, . It is observed that increases rapidly with the increase of T.

2. Consider the collection of AVPT instances: , where N = 2000, , , , , , , , , , and . Let denote the AVPT policy generated by performing the AVPT algorithm on . Fig. 5(b) exhibits versus T, . It is observed that increases rapidly with the increase of T.

3. Consider the collection of AVPT instances: , where N = 3000, , , , , , , , , , and . Let denote the AVPT policy generated by performing the AVPT algorithm on . Fig. 5(c) depicts versus T, . It is observed that increases rapidly with the increase of T.

[Figure omitted. See PDF.]

We have conducted 100 similar experiments. In each of these experiments, similar phenomenon is observed. Therefore, we conclude that, almost surely, the cost benefit of the AVPT policy generated by the AVPT algorithm increases rapidly with the increase of the test evaluation period. In practice, the organization is suggested to properly extend the test evaluation period to enhance the cost benefit of the AVPT policy generated by performing the AVPT algorithm.

Second, investigate the effect of the maximal host fraction.

Experiment 5. Let .

1. Consider the collection of AVPT instances: , where N = 1000, T = 20, , , , , , , , , and . Let denote the AVPT policy generated by performing the AVPT algorithm on . Fig. 6(a) shows versus , . It is observed that, with the increase of , first increases rapidly then flattens out.

2. Consider the collection of AVPT instances: , where N = 2000, T = 30, , , , , , , , , and . Let denote the AVPT policy generated by performing the AVPT algorithm on . Fig. 6(b) displays versus , . It is observed that, with the increase of , first increases rapidly then flattens out.

3. Consider the collection of AVPT instances: , where N = 3000, T = 50, , , , , , , , , and . Let denote the AVPT policy generated by performing the AVPT algorithm on . Fig. 6(c) displays versus , . It is observed that, with the increase of , first increases rapidly then flattens out.

[Figure omitted. See PDF.]

We have conducted 100 similar experiments. In each of these experiments, similar phenomenon is observed. Therefore, we conclude that, almost surely, the cost benefit of the AVPT policy generated by the AVPT algorithm first increases rapidly then flattens out with the increase of the maximal host fraction. In practice, the organization is suggested to properly enhance the maximal host fraction to enhance the cost benefit of the AVPT policy generated by performing the AVPT algorithm.

Concluding remarks

This paper has proposed an AV patch testing-related problem (i.e., the AVPT problem). By taking into account the effect of AV patch testing, a novel malware propagation model has been established. On this basis, the AVPT problem has been modeled as an optimal control problem. The model has been resolved successfully, yielding a cost-effective host assignment policy.

There are some related problems that are yet to be addressed. First, in this paper it is assumed that, although a newly installed AV patch just passed the compatibility test, it may immediately exhibit incompatibility with the deployed system and applications. In practice, there typically exists a delay from the time an AV patch is tested and installed to the time the patch exhibits incompatibility. In this situation, the proposed AVPT problem may be reduced to the optimal control problem of a delayed dynamic system [45, 46]. Second, to avoid being detected and removed by AV patches, modern malware are often designed to attack AV patches, with the intent of disabling them. In this context, there exists a non-cooperative game between the malware maker and the AV vendor, and the AVPT problem can be addressed in the framework of game theory [47]. Next, the methodology developed in this paper can be applied to some other areas, ranging from the suppression of rumor spreading [48, 49], social media advertising [50, 51], and the protection of smart grid [52, 53] to the defense against advanced cyber attacks [54, 55], provided the term compatibility can be given with special meaning. Finally, the state evolution model (5) may be extended to stochastic differential models [56–59] or fractional differential models [60, 61].

Acknowledgments

The authors are grateful to the two anonymous reviewers and the editor for their valuable suggestions.

References

1. 1. Szor P. The art of computer virus research and defense. Addison-Wesley Professional; 2005.

2. 2. Aycock J. Computer viruses and malware. Springer Science & Business Media 2006 .

3. 3. Kshetri N, Voas J. Ransomware as a Business (RaaB). IT Professional 2022;24(2):83–7.

* View Article

* Google Scholar

4. 4. Aboaoja FA, Zainal A, Ghaleb FA, Al-rimy BAS, Eisa TAE, Elnour AAH. Malware detection issues, challenges and future Directions: a survey. Appl Sci. 2022;12:8482.

* View Article

* Google Scholar

5. 5. Amira A, Derhab A, Karbab EB, Nouali O. A survey of malware analysis using community detection algorithms. ACM Comput Surv 2023;56(2):40.

* View Article

* Google Scholar

6. 6. Koret J, Bachaalany E. The antivirus’s Hacker’s handbook. John Wiley & Sons, Inc. 2015.

7. 7. Blokdyk G. Patch management tools: a complete guide 2020 Edition). 5STARCooks; 2019.

8. 8. Nicastro F. Security patch management. Routledge; 2011 .

9. 9. Cavusoglu H, Cavusoglu H, Zhang J. Security patch management: share the burden or share the damage? Manage Sci. 2008;54(4):657–70.

* View Article

* Google Scholar

10. 10. Kermack WO, McKendrick AG. A contribution to the mathematical theory of epidemics. In: Proceedings of the Royal Society of London, Series A, Containing Papers of a Mathematical and Physical Character 1927;115(772):700–21.

* View Article

* Google Scholar

11. 11. Kermack WO, McKendrick AG. A contribution to the mathematical theory of epidemics III: Further studies of the problem of endemicity. Proc R Soc A Math Phys Eng Sci. 1933;141(83):94–122.

* View Article

* Google Scholar

12. 12. Britton NF. Essential mathematical biology. Springer; 2003.

* View Article

* Google Scholar

13. 13. Goffman W, Newill VA. Generalization of epidemic theory: an application to the transmission of ideas. Nature 1964;204: 225–8. pmid:14212412

* View Article

* PubMed/NCBI

* Google Scholar

14. 14. Kephart JO, White SR. Directed-graph epidemiological models of computer viruses. In: Proceedings of 1991 IEEE Computer Society Symposium on Research in Security and Privacy, California, Los Alamitos, 1991, pp. 343–59.

15. 15. Kephart JO, White SR. Measuring and modeling computer virus prevalence. In: Proceedings of 1991 IEEE Computer Society Symposium on Research in Security and Privacy, California, Los Alamitos, 1993, pp. 2–15.

16. 16. Gan C, Yang X. Theoretical, experimental analysis of the impacts of removable storage media and antivirus software on viral spread. Commun Nonlinear Sci Numer Simul. 2015:22(1–3):167–174.

* View Article

* Google Scholar

17. 17. Chernikova A, Gozzi N, Perra N, Boboila S, Eliassi-Rad T, Oprea A. Modeling self-propagating malware with epidemiological models. Appl Netw Sci 2023;8:52.

* View Article

* Google Scholar

18. 18. Yao Y, Fu Q, Yang W, Wang Y, Sheng C. An epidemic model of computer worms with time delay and variable infection rate. Secur Commun Netw. 2018;2018:9756982.

* View Article

* Google Scholar

19. 19. Yu X, Zeb A, Zhang Z. Mathematical analysis of a delayed malware propagation model on mobile wireless sensor network. Fractals. 2022;30(5):2240160.

* View Article

* Google Scholar

20. 20. Yang LX, Yang X, Liu J, Zhu Q, Gan C. Epidemics of computer viruses: a complex-network approach. Appl Math Comput. 2013;219(16):8705–717.

* View Article

* Google Scholar

21. 21. Hosseini S, Azgomi MA. A model for malware propagation in scale-free networks based on rumor spreading process. Comput Netw 2016;18(108):97–107.

* View Article

* Google Scholar

22. 22. Van Mieghem P, Omic J, Kooij R. Virus spread in networks. IEEE/ACM Trans Netw 2009;17(1):1–14.

* View Article

* Google Scholar

23. 23. Yang LX, Yang X, Tang YY. A bi-virus competing spreading model with generic infection rates. IEEE Trans Netw Sci Eng. 2018;5(1):2–13.

* View Article

* Google Scholar

24. 24. Goldenberg J, Shavitt Y, Shir E, Solomon S. Distributive immunization of networks against viruses using the ‘honey-pot’ architecture. Nature Phys. 2005;1:184—8.

* View Article

* Google Scholar

25. 25. Yang LX, Yang X. A novel virus-patch mixed spreading model. PLoS ONE 2015;10(9):e0137858.

* View Article

* Google Scholar

26. 26. Yang LX, Yang X, Wu Y. The impact of patch forwarding on the prevalence of computer virus: a theoretical assessment approach. Appl Math Modell 2017:43:110–25.

* View Article

* Google Scholar

27. 27. Zhao D, Wang L, Wang Z, Xiao G. Virus propagation, patch distribution in multiplex networks: modeling, analysis and optimal allocation. IEEE Trans. Inf. Forensics Secur. 2018;14(7):1755–67.

* View Article

* Google Scholar

28. 28. Huang DW, Yang LX, Yang X, Wu Y, Tang YY. Towards understanding the effectiveness of patch injection. Phys A Stat Mech Appl 2019;526:120956.

* View Article

* Google Scholar

29. 29. Huang DW, Yang LX, Yang X, Wu Y, Tang YY. Evaluating the performance of a static patching strategy against computer viruses. Complexity. 2020;2020:9408942.

* View Article

* Google Scholar

30. 30. Kirk DE. Optimal Control theory: an introduction. Dover Publications; 2004.

31. 31. Mehlmann A. Applied differential games. New York, NY: Springer; 1988.

* View Article

* Google Scholar

32. 32. Khouzani MHR, Sarkar S, Altman E. Optimal dissemination of security patches in mobile wireless networks. IEEE Trans Inform Theory. 2012;58(7):4714–32.

* View Article

* Google Scholar

33. 33. Eshghi S, Khouzani MHR, Sarkar S, Venkatesh SS. Optimal patching in clustered malware epidemics. IEEE/ACM Trans Netw. 2014;24(1):283–298.

* View Article

* Google Scholar

34. 34. Yang LX, Li P, Yang X, Xiang Y, Zhou W. A differential game approach to patch injection. IEEE Access. 2018;6:58924–38.

* View Article

* Google Scholar

35. 35. Zhang H, Upadhyay RK, Liu G, Zhang Z. Hopf bifurcation and optimal control of a delayed malware propagation model on mobile wireless sensor networks. Results Phys. 2022:41:105926.

* View Article

* Google Scholar

36. 36. Dissanayake N, Jayatilaka A, Zahedi M, Ali Babar M. Software security patch management - a systematic literature review of challenges, approaches, tools and practices. Inform Softw Technol. 2022;144:106771.

* View Article

* Google Scholar

37. 37. Tiefenau C, Haring M, Krombholz K, Von Zezschwitz E. Security, availability and multiple information sources: exploring update behavior of system administrators. In: Proceedings of SOUPS’20 2020, pp. 239–58.

38. 38. Jenkins A, Kalligeros P, Vaniea K, Wolters MK. “Anyone else seeing this error?’’: community, system administrators and patch information. In: Proceedings of EuroS’P 2012, pp. 105–19.

39. 39. Maurer M, Brumley D. TACHYON: tandem execution for efficient live patch testing. In: Proceedings of Security’12 2012, p. 43.

40. 40. Li F, Rogers L, Mathur A, Malkin N, Chetty M. Keepers of the machines: examining how system administrators manage software updates. In: Proceedings of SOUPS’19 2019, pp. 273—88.

41. 41. Wang S, Wen M, Lin B, Wu H, Qin Y, Zou D, et al. Automated patch correctness assessment: how far are we? In: Proceedings of ASE 2020, 2020, pp. 968–80.

42. 42. Ye H, Martinez M, Monperrus M. Automated patch assessment for program repair at scale. Empir Software Eng. 2021;26(2):20.

* View Article

* Google Scholar

43. 43. Ghanbari A, Marcus A. Patch correctness assessment in automated program repair based on the impact of patches on production and test code. In: Proceedings of ISSTA 2022, 2022, pp. 564–665.

44. 44. McAsey M, Mou L, Han W. Convergence of the forward-backward sweep method in optimal control. Comput Optim Appl. 2012 ;53:207—26. https://doi.org/10.1007/s10589-011-9454-7

45. 45. Hu J, Yang L-X, Yang X, Huang K, Li G, Xiang Y. Cost-effective company response policy for product co-creation in company-sponsored online community. IEEE Trans Syst Man Cybern Syst. 2024;54(7):4494–4506.

* View Article

* Google Scholar

46. 46. Kim AV, Ivanov AV. Systems with delays: analysis, control and computations. Wiley; 2015.

47. 47. Park JH, Lee TH, Liu Y, Chen J. Dynamic systems with time delays: stability and control. Springer; 2019.

48. 48. Gillman RA, Housman D. Game theory. Chapman and Hall/CRC; 2023.

49. 49. Dang Z, Li L, Ni W, Liu R, Peng H, Yang Y. How does rumor spreading affect people inside and outside an institution. Inform Sci. 2021;574:377–93.

* View Article

* Google Scholar

50. 50. Huang K, Yang X, Yang LX, Zhu Y, Li G. Mitigating the impact of a false message through sequential release of clarifying messages. IEEE Trans Netw Sci Eng. 2024;11(2):1785–98.

* View Article

* Google Scholar

51. 51. Sriram KV, Namitha KP, Giridhar BK. Social media advertisements and their influence on consumer purchase intention. Cogent Bus. Manag. 2021;1:2000697.

* View Article

* Google Scholar

52. 52. Huang K, Yang LX, Yang X, Tang YY. Effective multiplatform advertising policy. IEEE Trans Syst Man Cybern Syst 2022;52(7):4483–93.

* View Article

* Google Scholar

53. 53. Bi J, Luo F, He S, Liang G, Meng W, Sun M. False data injection-and propagation-aware game theoretical approach for microgrids. IEEE Trans Smart Grid. 2022;13(5):3342–53.

* View Article

* Google Scholar

54. 54. Bi J, Luo F, Liang G, Yang X, He S, Dong ZY. Impact assessment and defense for smart grids with FDIA against AMI. IEEE Trans Netw Sci Eng. 2022;10(2):578–91.

* View Article

* Google Scholar

55. 55. Yang LX, Huang K, Yang X, Zhang Y, Xiang Y, Tang YY. Defense against advanced persistent threat through data backup and recovery. IEEE Trans Netw Sci Eng. 2021;8(3):2001–13.

* View Article

* Google Scholar

56. 56. Sun H, Yang X, Yang LX, Huang K, Li G. Impulsive artificial defense against advanced persistent threat. IEEE Trans Inform Forensics Secur. 2023;18:3506–16.

* View Article

* Google Scholar

57. 57. Din A, Li Y. Optimizing HIV/AIDS dynamics: stochastic control strategies with education and treatment. Eur Phys J Plus. 2024;139(9):1–19.

* View Article

* Google Scholar

58. 58. Din A. Bifurcation analysis of a delayed stochastic HBV epidemic model: cell-to-cell transmission. Chaos Solitons Fractals. 2024;181:114714.

* View Article

* Google Scholar

59. 59. Amin QT. Nonlinear stochastic cholera epidemic model under the influence of noise. J Math Tech Model. 2024;1(1):52–74.

* View Article

* Google Scholar

60. 60. Shah SMA, Tahir H, Khan A, khan WA, Arshad A. Stochastic model on the transmission of worms in wireless sensor network. J Math Tech Model. 2024;1(1):75–88.

* View Article

* Google Scholar

61. 61. Ullah S. Investigating a coupled system of Mittag-Leffler type fractional differential equations with coupled integral boundary conditions. J Math Tech Model. 2024;1(2):16–28.

* View Article

* Google Scholar

62. 62. Khan WA, Zarin R, Zeb A, Khan Y, Khan A. Navigating food allergy dynamics via a novel fractional mathematical model for antacid-induced allergies. J Math Tech Model. 2024;1(1):25–51.

* View Article

* Google Scholar

Citation: Liu G, Fu C, Yang X, Yang L, Feng Y, Qin Y (2025) Study of the antivirus patch testing problem through optimal control modeling. PLoS One 20(5): e0319916. https://doi.org/10.1371/journal.pone.0319916

About the Authors:

Guofang Liu

Roles: Investigation, Writing – original draft

Affiliation: Department of Computer Science, Sichuan University Jinjiang College, MeiShan, Sichuan 620860, China

Chunlong Fu

Roles: Investigation

Affiliation: Department of Computer Science, Sichuan University Jinjiang College, MeiShan, Sichuan 620860, China

Xiaofan Yang

Roles: Supervision, Writing – review & editing

E-mail: [email protected]

Affiliations: Department of Computer Science, Sichuan University Jinjiang College, MeiShan, Sichuan 620860, China, School of Big Data and Software Engineering, Chongqing University, Chongqing 400044, China

ORICD: https://orcid.org/0000-0002-3273-1233

Luxing Yang

Roles: Writing – review & editing

Affiliation: School of Information Technology, Deakin University, Melbourne, Victoria 3125, Australia

Yanhua Feng

Roles: Software

Affiliation: School of Big Data and Software Engineering, Chongqing University, Chongqing 400044, China

Yang Qin

Roles: Methodology

Affiliation: School of Big Data and Software Engineering, Chongqing University, Chongqing 400044, China

[/RAW_REF_TEXT]

[/RAW_REF_TEXT]

[/RAW_REF_TEXT]

[/RAW_REF_TEXT]

[/RAW_REF_TEXT]

[/RAW_REF_TEXT]

[/RAW_REF_TEXT]

[/RAW_REF_TEXT]

[/RAW_REF_TEXT]

[/RAW_REF_TEXT]

[/RAW_REF_TEXT]

[/RAW_REF_TEXT]

[/RAW_REF_TEXT]

[/RAW_REF_TEXT]

[/RAW_REF_TEXT]

[/RAW_REF_TEXT]

[/RAW_REF_TEXT]

[/RAW_REF_TEXT]

References

1. Szor P. The art of computer virus research and defense. Addison-Wesley Professional; 2005.

2. Aycock J. Computer viruses and malware. Springer Science & Business Media 2006 .

3. Kshetri N, Voas J. Ransomware as a Business (RaaB). IT Professional 2022;24(2):83–7.

4. Aboaoja FA, Zainal A, Ghaleb FA, Al-rimy BAS, Eisa TAE, Elnour AAH. Malware detection issues, challenges and future Directions: a survey. Appl Sci. 2022;12:8482.

5. Amira A, Derhab A, Karbab EB, Nouali O. A survey of malware analysis using community detection algorithms. ACM Comput Surv 2023;56(2):40.

6. Koret J, Bachaalany E. The antivirus’s Hacker’s handbook. John Wiley & Sons, Inc. 2015.

7. Blokdyk G. Patch management tools: a complete guide 2020 Edition). 5STARCooks; 2019.

8. Nicastro F. Security patch management. Routledge; 2011 .

9. Cavusoglu H, Cavusoglu H, Zhang J. Security patch management: share the burden or share the damage? Manage Sci. 2008;54(4):657–70.

10. Kermack WO, McKendrick AG. A contribution to the mathematical theory of epidemics. In: Proceedings of the Royal Society of London, Series A, Containing Papers of a Mathematical and Physical Character 1927;115(772):700–21.

11. Kermack WO, McKendrick AG. A contribution to the mathematical theory of epidemics III: Further studies of the problem of endemicity. Proc R Soc A Math Phys Eng Sci. 1933;141(83):94–122.

12. Britton NF. Essential mathematical biology. Springer; 2003.

13. Goffman W, Newill VA. Generalization of epidemic theory: an application to the transmission of ideas. Nature 1964;204: 225–8. pmid:14212412

14. Kephart JO, White SR. Directed-graph epidemiological models of computer viruses. In: Proceedings of 1991 IEEE Computer Society Symposium on Research in Security and Privacy, California, Los Alamitos, 1991, pp. 343–59.

15. Kephart JO, White SR. Measuring and modeling computer virus prevalence. In: Proceedings of 1991 IEEE Computer Society Symposium on Research in Security and Privacy, California, Los Alamitos, 1993, pp. 2–15.

16. Gan C, Yang X. Theoretical, experimental analysis of the impacts of removable storage media and antivirus software on viral spread. Commun Nonlinear Sci Numer Simul. 2015:22(1–3):167–174.

17. Chernikova A, Gozzi N, Perra N, Boboila S, Eliassi-Rad T, Oprea A. Modeling self-propagating malware with epidemiological models. Appl Netw Sci 2023;8:52.

18. Yao Y, Fu Q, Yang W, Wang Y, Sheng C. An epidemic model of computer worms with time delay and variable infection rate. Secur Commun Netw. 2018;2018:9756982.

19. Yu X, Zeb A, Zhang Z. Mathematical analysis of a delayed malware propagation model on mobile wireless sensor network. Fractals. 2022;30(5):2240160.

20. Yang LX, Yang X, Liu J, Zhu Q, Gan C. Epidemics of computer viruses: a complex-network approach. Appl Math Comput. 2013;219(16):8705–717.

21. Hosseini S, Azgomi MA. A model for malware propagation in scale-free networks based on rumor spreading process. Comput Netw 2016;18(108):97–107.

22. Van Mieghem P, Omic J, Kooij R. Virus spread in networks. IEEE/ACM Trans Netw 2009;17(1):1–14.

23. Yang LX, Yang X, Tang YY. A bi-virus competing spreading model with generic infection rates. IEEE Trans Netw Sci Eng. 2018;5(1):2–13.

24. Goldenberg J, Shavitt Y, Shir E, Solomon S. Distributive immunization of networks against viruses using the ‘honey-pot’ architecture. Nature Phys. 2005;1:184—8.

25. Yang LX, Yang X. A novel virus-patch mixed spreading model. PLoS ONE 2015;10(9):e0137858.

26. Yang LX, Yang X, Wu Y. The impact of patch forwarding on the prevalence of computer virus: a theoretical assessment approach. Appl Math Modell 2017:43:110–25.

27. Zhao D, Wang L, Wang Z, Xiao G. Virus propagation, patch distribution in multiplex networks: modeling, analysis and optimal allocation. IEEE Trans. Inf. Forensics Secur. 2018;14(7):1755–67.

28. Huang DW, Yang LX, Yang X, Wu Y, Tang YY. Towards understanding the effectiveness of patch injection. Phys A Stat Mech Appl 2019;526:120956.

29. Huang DW, Yang LX, Yang X, Wu Y, Tang YY. Evaluating the performance of a static patching strategy against computer viruses. Complexity. 2020;2020:9408942.

30. Kirk DE. Optimal Control theory: an introduction. Dover Publications; 2004.

31. Mehlmann A. Applied differential games. New York, NY: Springer; 1988.

32. Khouzani MHR, Sarkar S, Altman E. Optimal dissemination of security patches in mobile wireless networks. IEEE Trans Inform Theory. 2012;58(7):4714–32.

33. Eshghi S, Khouzani MHR, Sarkar S, Venkatesh SS. Optimal patching in clustered malware epidemics. IEEE/ACM Trans Netw. 2014;24(1):283–298.

34. Yang LX, Li P, Yang X, Xiang Y, Zhou W. A differential game approach to patch injection. IEEE Access. 2018;6:58924–38.

35. Zhang H, Upadhyay RK, Liu G, Zhang Z. Hopf bifurcation and optimal control of a delayed malware propagation model on mobile wireless sensor networks. Results Phys. 2022:41:105926.

36. Dissanayake N, Jayatilaka A, Zahedi M, Ali Babar M. Software security patch management - a systematic literature review of challenges, approaches, tools and practices. Inform Softw Technol. 2022;144:106771.

37. Tiefenau C, Haring M, Krombholz K, Von Zezschwitz E. Security, availability and multiple information sources: exploring update behavior of system administrators. In: Proceedings of SOUPS’20 2020, pp. 239–58.

38. Jenkins A, Kalligeros P, Vaniea K, Wolters MK. “Anyone else seeing this error?’’: community, system administrators and patch information. In: Proceedings of EuroS’P 2012, pp. 105–19.

39. Maurer M, Brumley D. TACHYON: tandem execution for efficient live patch testing. In: Proceedings of Security’12 2012, p. 43.

40. Li F, Rogers L, Mathur A, Malkin N, Chetty M. Keepers of the machines: examining how system administrators manage software updates. In: Proceedings of SOUPS’19 2019, pp. 273—88.

41. Wang S, Wen M, Lin B, Wu H, Qin Y, Zou D, et al. Automated patch correctness assessment: how far are we? In: Proceedings of ASE 2020, 2020, pp. 968–80.

42. Ye H, Martinez M, Monperrus M. Automated patch assessment for program repair at scale. Empir Software Eng. 2021;26(2):20.

43. Ghanbari A, Marcus A. Patch correctness assessment in automated program repair based on the impact of patches on production and test code. In: Proceedings of ISSTA 2022, 2022, pp. 564–665.

44. McAsey M, Mou L, Han W. Convergence of the forward-backward sweep method in optimal control. Comput Optim Appl. 2012 ;53:207—26. https://doi.org/10.1007/s10589-011-9454-7

45. Hu J, Yang L-X, Yang X, Huang K, Li G, Xiang Y. Cost-effective company response policy for product co-creation in company-sponsored online community. IEEE Trans Syst Man Cybern Syst. 2024;54(7):4494–4506.

46. Kim AV, Ivanov AV. Systems with delays: analysis, control and computations. Wiley; 2015.

47. Park JH, Lee TH, Liu Y, Chen J. Dynamic systems with time delays: stability and control. Springer; 2019.

48. Gillman RA, Housman D. Game theory. Chapman and Hall/CRC; 2023.

49. Dang Z, Li L, Ni W, Liu R, Peng H, Yang Y. How does rumor spreading affect people inside and outside an institution. Inform Sci. 2021;574:377–93.

50. Huang K, Yang X, Yang LX, Zhu Y, Li G. Mitigating the impact of a false message through sequential release of clarifying messages. IEEE Trans Netw Sci Eng. 2024;11(2):1785–98.

51. Sriram KV, Namitha KP, Giridhar BK. Social media advertisements and their influence on consumer purchase intention. Cogent Bus. Manag. 2021;1:2000697.

52. Huang K, Yang LX, Yang X, Tang YY. Effective multiplatform advertising policy. IEEE Trans Syst Man Cybern Syst 2022;52(7):4483–93.

53. Bi J, Luo F, He S, Liang G, Meng W, Sun M. False data injection-and propagation-aware game theoretical approach for microgrids. IEEE Trans Smart Grid. 2022;13(5):3342–53.

54. Bi J, Luo F, Liang G, Yang X, He S, Dong ZY. Impact assessment and defense for smart grids with FDIA against AMI. IEEE Trans Netw Sci Eng. 2022;10(2):578–91.

55. Yang LX, Huang K, Yang X, Zhang Y, Xiang Y, Tang YY. Defense against advanced persistent threat through data backup and recovery. IEEE Trans Netw Sci Eng. 2021;8(3):2001–13.

56. Sun H, Yang X, Yang LX, Huang K, Li G. Impulsive artificial defense against advanced persistent threat. IEEE Trans Inform Forensics Secur. 2023;18:3506–16.

57. Din A, Li Y. Optimizing HIV/AIDS dynamics: stochastic control strategies with education and treatment. Eur Phys J Plus. 2024;139(9):1–19.

58. Din A. Bifurcation analysis of a delayed stochastic HBV epidemic model: cell-to-cell transmission. Chaos Solitons Fractals. 2024;181:114714.

59. Amin QT. Nonlinear stochastic cholera epidemic model under the influence of noise. J Math Tech Model. 2024;1(1):52–74.

60. Shah SMA, Tahir H, Khan A, khan WA, Arshad A. Stochastic model on the transmission of worms in wireless sensor network. J Math Tech Model. 2024;1(1):75–88.

61. Ullah S. Investigating a coupled system of Mittag-Leffler type fractional differential equations with coupled integral boundary conditions. J Math Tech Model. 2024;1(2):16–28.

62. Khan WA, Zarin R, Zeb A, Khan Y, Khan A. Navigating food allergy dynamics via a novel fractional mathematical model for antacid-induced allergies. J Math Tech Model. 2024;1(1):25–51.