With the rapid development and application of Internet of Things (IoT) technology, a large number of various types of IoT devices with security vulnerabilities have been connected to the public network. Attackers only need to use malware to successfully infect a few types of IoT devices to generate large-scale propagation in the network and capture a large number of broilers, which in turn lays the foundation for subsequent attacks. In this study, an innovative malware propagation model [i.e., IoT-susceptible-latent-propagated-recovered (IoT-SLPR)] based on epidemiological theory is developed for malware propagation in multiple IoT heterogeneous devices. The proposed model incorporates the propagation mechanism of malware in real IoT networks, and considers heterogeneous devices with different infection rates and recovery rates. This study calculates and proves the basic reproductive rate of malware and the stability of equilibrium points for different types of devices. In addition, this study designs a dynamic recovery rate optimal defense strategy, which comprehensively considers the cost and the overall infection rate of the device. The experimental results show that the proposed propagation model can effectively reflect the propagation dynamics of malware in multiple heterogeneous devices, and the achieved dynamic recovery rate defense strategy performs better than the static strategy regarding the overall results.

Identifying influential spreaders in complex networks is critical for information spread and malware diffusion suppression. In this paper, we propose a novel influential spreader identification method, called SpreadRank, which considers the path reachability in information spreading and uses its quantitative index as a measure of node spread centrality to obtain the spread influence of a single node. To avoid the overlapping of the influence range of the node spread, this method establishes a dynamic influential node set selection mechanism based on the spread centrality value and the principle of minimizing the maximum connected branch after network segmentation, and it selects a group of nodes with the greatest overall spread influence. Experiments based on the SIR model demonstrate that, compared to other existing methods, the selected influential spreaders of SpreadRank can quickly diffuse or suppress information more effectively.

Wireless sensor networks (WSNs) are highly vulnerable to malware attacks due to resource constraints. However, existing propagation models often overlook the heterogeneous security levels in hierarchically protected WSNs, leading to inaccurate representations of dynamics across network layers. This paper proposes a novel malware propagation model specifically for hierarchically protected WSNs to capture the distinct defense capabilities of heterogeneous nodes. Based on epidemiological theory, nodes are stratified into high protection level (HPL) and low protection level (LPL) categories within a susceptible‐exposed‐infected‐recovered (SEIR) differential equation framework. We rigorously derive the basic reproduction number () and prove the global asymptotic stability of equilibrium points using Lyapunov function analysis. Theoretical and experimental results demonstrate that malware is eradicated when , whereas it persists endemically when . Specifically, simulations reveal that while HPL nodes exhibit lower infection rates, their compromise significantly accelerates network‐wide propagation due to high connectivity. Furthermore, a critical communication radius threshold is identified; exceeding this threshold triggers a transition to an endemic state. The proposed model offers theoretical insights for defense strategies, suggesting that optimizing the HPL node proportion and regulating communication radius are critical for mitigating malware propagation.

Social Internet of Things (SIoT) relationships enable service discovery and create pathways for malware propagation. We develop a heterogeneous susceptible–exposed–infected–recovered model coupling resource-constrained patching with reversible, trust-aware relationship suppression. A controlled next-generation operator yields a reproduction threshold, local stability, spectral monotonicity, and a uniform eradication condition. A finite-horizon security–service objective and its necessary conditions motivate joint adaptive topology and patching (JATP), a feasible sampled-data feedback heuristic combining prevalence, structural influence, trust evidence, and service importance. Under reference capacities, JATP reduces peak infection and cumulative burden by 49.43% and 38.97% relative to risk-only patching while retaining 0.8184 of weighted relationship intensity. Under a common expenditure ceiling, its objective is 59.56% above the best feasible offline nonlinear-programming value found. Explicit-network tests support aggregation under moderate heterogeneity and identify larger prediction errors under strong degree variation and susceptible-entry churn. Trust-related gains depend on alignment with model-defined propagation risk; field calibration remains open. These results characterize the operating scope of a feedback policy that coordinates two defense channels under hard resource limits. The framework links epidemic thresholds, intervention allocation, and service preservation to support the design of resource-limited SIoT containment.