# A Perturbation and Symmetry-Based Analysis of Mobile Malware Dynamics in Smartphone Networks
## 3 Methodology and Model Formulation  
To study the propagation dynamics of malware in mobile networks, we propose a compartmental model denoted as \(M_{\mathit{s}iqr}\), which divides the mobile device population into four interacting classes: susceptible (\(M_{s}\)), infected (\(M_{i}\)), quarantined (\(M_{q}\)), and recovered (\(M_{r}\)). This model adopts the structure of classical epidemic frameworks but is tailored to reflect the unique characteristics of mobile malware, including device turnover and malware-induced disconnection. The model is represented by a system of nonlinear ordinary differential equations (1) that govern the evolution of each compartment over time. The equations are given by  
\[\dot{M}_{s} =\lambda-\Pi M_{s}M_{i}-\delta_{1}M_{s}\] \[\dot{M}_{i} =\Pi M_{s}M_{i}-\theta M_{i}-\delta_{1}M_{i}-\delta_{2}M_{i} \tag{1}\] \[\dot{M}_{q} =\theta_{1}M_{i}-qM_{q}-\delta_{1}M_{q}-\delta_{3}M_{q}\] \[M_{r} =qM_{q}+\theta_{2}M_{i}-\delta_{1}M_{r}\]  
where \(\theta=\theta_{1}+\theta_{2}\) over the region \(\mathcal{N}=\{p=(M_{s},\,M_{i},\,M_{q},\,M_{r}):\,p_{i}\geq 0,\,M_{N}\leq\frac{ \lambda}{\theta_{1}}\}\), where \(M_{N}=M_{s}+M_{i}+M_{q}+M_{r}\). Figure 1 visualizes the spread and control of mobile malware. Table 1 outlines the meaning of each variable and parameter in the differential equation system. Model (1) parameters are operationally defined through measurable mobile network behaviors. The effective contact rate \(\Pi\) represents successful malware transmissions per device pair per day, quantified via Bluetooth and WiFi Direct proximity logs. Network growth rate \(\lambda\) corresponds to new device activations recorded in carrier provisioningsystems. Quarantine rate \(\theta_{1}\) reflects the inverse of mean detection time from mobile security services, while recovery rate \(\theta_{2}\) captures devices cleared through OS updates or user remediation. Disconnection parameters include \(\delta_{1}\) for natural device turnover from carrier churn metrics, \(\delta_{2}\) for malware-induced disconnections via performance thresholds, and \(\delta_{3}\) for carrier-enforced isolation of compromised devices. Each parameter's measurement derives from established protocols. Transmission rates use packet sniffing and proximity detection. Containment parameters draw from security service telemetry with temporal resolution matching actual response cycles. Disconnection metrics follow 3 GPP and GSMA reporting standards for mobile networks. Validation occurs through historical outbreak comparisons, with parameter ranges constrained by empirical observations from documented malware campaigns and carrier network statistics. This operational grounding ensures all theoretical parameters correspond to measurable network phenomena while maintaining model tractability. \begin{table}
\begin{tabular}{l l} \hline \hline
**Parameter** & **Description** \\ \hline \(M_{s}\) & Susceptible mobiles: Devices vulnerable to malware infection. \\ \hline \(M_{i}\) & Infected mobiles: Devices compromised by malware. \\ \hline \(M_{r}\) & Recovered mobiles: Devices that have recovered from malware infection. \\ \hline \(M_{q}\) & Isolated mobiles: Devices isolated from the network to prevent malware spread. \\ \hline TI & Effective contact rate \\ \hline \(\theta_{1}\) & Quarantine rate \\ \hline \(\theta_{2}\) & Recovery rate \\ \hline \(q\) & Rate of quarantine to become recovered \\ \hline \(\lambda\) & Rate of growth of the mobile network \\ \hline \(\delta_{1}\) & Natural disconnected rate of mobiles from the network \\ \hline \(\delta_{2}\) & Disconnected by malware effects \\ \hline \(\delta_{3}\) & Disconnected by malware for quarantined mobiles \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Definitions of parameters used in the \(M_{sigr}\) mobile malware propagation model. Figure 1: Flow diagram of the mobile malware model \(M_{sigr}\), illustrating the transition dynamics among device compartments.