Cyber epidemic spread forecasting based on the entropy-extremal dynamic interpretation of the SIR model

The spread of a cyber epidemic at an early stage is an uncertain process characterized by a small amount of statistically unreliable data. Nonlinear dynamic models, most commonly the SIR model, are widely used to describe such processes. The description of the studied process obtained using this model is sensitive to the initial conditions set and the quality of tuning the controlled parameters based on the results of operational observations, which are inherently uncertain. This article proposes a transition to a stochastic interpretation of the controlled parameters of the SIR model and the introduction of additional stochastic parameters that represent the variability of operational data measurements. The process of estimating the probability density functions of these parameters and noises is implemented as a strict optimization problem. The resulting mathematical apparatus is generalized in the form of two versions of the entropy-extremal adaptation of the SIR model, which are applied to forecast the spread of a cyber epidemic. The first version is focused on estimating the SIR model parameters based on operational data. In contrast, the second version focuses on stochastic modelling of the transmission rate indicator and its impact on forecasting the studied process. The forecasting result represents the average trajectory from the set of trajectories obtained using the authors’ models, which characterize the dynamics of compartment I. The experimental part of the article compares the classical Least Squares method with the authors’ entropy-extremal approach for estimating the SIR model parameters based on etalon data on the spread of the most threatening categories of malware cyber epidemics. The empirical results are characterized by a significant reduction in the Mean Absolute Percentage Error regarding the etalon data over the prediction interval, which proves the adequacy of the proposed approach.