# A Perturbation and Symmetry-Based Analysis of Mobile Malware Dynamics in Smartphone Networks
## 3 Methodology and Model Formulation
We begin our model validation and analysis with the following theorem to demonstrate that the total number of devices remains non-negative and bounded over time, ensuring the model's consistency and feasibility. (\(\mathcal{N}\)) is a positive invariant set, where the closed set \(\mathcal{N}\) is defined by \(\mathcal{N}=\{p=(M_{s},\,M_{i},\,M_{q},\,M_{r}):\,p_{i}\geq 0,\,M_{N}\leq\frac{ \lambda}{\delta}\}\). Proof. : Let \(M_{N}=M_{s}+M_{i}+M_{q}+M_{r}\) be the total network nodes. Then, \(M_{N}=\dot{M}_{s}+\dot{M}_{i}+\dot{M}_{q}+\dot{M}_{r}\). Using the main model (1), we can obtain \(\dot{M}_{N}=\lambda-\delta_{1}(M_{s}+M_{i}+M_{q}+M_{r})-\delta_{1}M_{i}-\delta _{2}M_{q}\leq\lambda-\delta_{1}M_{N}\Rightarrow\dot{M}_{N}\leq\lambda-\delta_{ 1}M_{N}\). Therefore, theorem [35] can be used to prove that \(M_{N}\leq M_{N}(0)e^{-\delta t}+\frac{\lambda}{\delta}(1-e^{-\delta t})\). In particular, if \(M_{N}(0)\leq\frac{\lambda}{\delta}\), then \(M_{N}(t)\leq\frac{\lambda}{\delta}\) as required. This shows that \(\mathcal{N}\) is positively invariant. The \(M_{siqr}\) mobile malware model offers a comprehensive framework that bridges theoretical analysis with practical cybersecurity insights. It establishes mathematical well-posedness via positive invariance, derives the basic reproduction number \(\mathcal{R}_{0}\) as a persistence threshold, and provides closed-form expressions for equilibrium states. The model innovatively incorporates quarantine dynamics (\(M_{q}\)), distinguishes disconnection pathways (\(\delta_{1}\), \(\delta_{2}\), and \(\delta_{3}\)), and captures recovery both directly (\(\theta_{2}\)) and post-quarantine (\(q\)). These features enhance predictive capabilities, support outbreak assessment, and guide malware control strategies. By adapting epidemiological modeling to mobile networks, the model remains analytically tractable while laying the groundwork for optimal mobile security interventions. Our model assumes uniform interaction patterns, while real mobile networks exhibit heterogeneous connectivity and device susceptibility. The relationship between \(R_{0}^{\text{hom}}\) (reproduction number under homogeneous mixing) and \(R_{0}^{\text{true}}\) (actual reproduction number in heterogeneous networks) follows [24]:  
\[R_{0}^{\text{hom}}=R_{0}^{\text{true}}\cdot\left(1+\frac{\text{Var}(k)}{\langle k \rangle^{2}}\right)\cdot\left(1+\frac{\text{Var}(\beta)}{\langle\beta\rangle^ {2}}\right)\]  
For Android networks, connectivity variance gives \(\frac{\text{Var}(k)}{\langle k\rangle^{2}}\approx 0.18\) and security behavior variance yields \(\frac{\text{Var}(\beta)}{\langle\beta\rangle^{2}}\approx 0.12\)[25; 26]. The combined effect results in \(R_{0}^{\text{hom}}\approx 1.32R_{0}^{\text{true}}\), overestimating by 32%. This conservative bias is beneficial for security assessment as it provides safety margins. The epidemic threshold remains valid: \(R_{0}^{\text{hom}}>1\iff R_{0}^{\text{true}}>0.76\). Our homogeneous assumption simplifies network clustering and temporal variations but maintains qualitative dynamics with only 0.1 absolute error in threshold detection. The 32% overestimation compensates for these simplifications, making the model suitable for preliminary threat assessment and control strategy evaluation.