Montacer Billah Zemmal

ABSTRACT Polymorphic malware poses a persistent cybersecurity challenge due to its ability to dynamically alter its code structure while preserving malicious functionality, thereby evading signature‐based defenses. We develop an adaptive multi‐variant ordinary differential equation (ODE) framework that captures the co‐evolutionary dynamics between polymorphic malware and responsive defense mechanisms, integrating mutation‐driven variant switching with a feedback‐driven antivirus response. Using the next‐generation matrix approach, we derive the basic reproduction number and show that crossing induces a transcritical bifurcation separating eradication and persistence regimes. Global asymptotic stability of the disease‐free equilibrium is proved via the Castillo–Chavez–Feng–Huang framework. Endemic equilibria are analyzed through analytical arguments and reproducible numerical simulations, demonstrating that adaptive mutation pressure can sustain persistence even under strong defensive responses. The framework provides actionable theoretical insights for designing system‐level cybersecurity strategies.

This study investigates the propagation dynamics of computer viruses using a delayed susceptible–latent–breaking ( S – L – B ) compartmental model that incorporates a discrete latency delay and a saturated incidence rate. While global behavior away from the critical threshold is well documented in the literature, the dynamics at R 0 = 1 remain delicate because the disease‐free equilibrium is nonhyperbolic. We analyze this regime using a center‐manifold reduction for retarded functional differential equations. The delayed characteristic equation is used to identify the threshold, and the local reduced dynamics have a transcritical normal form structure under the standard spectral nonresonance assumption. The resulting critical trajectory exhibits algebraic relaxation ( O (1/ t )) instead of exponential decay. The saturation coefficient enters the quadratic normal‐form term with a fixed sign pattern, implying a forward threshold for all physically admissible κ ≥ 0. The WannaCry incident is considered solely as a qualitative source of motivation, and no parameter calibration based on incident telemetry data has been conducted. Complementary delay‐aware simulations and near‐threshold sweeps show that the just‐below‐threshold regimes remain exponential but can decay slowly, whereas the delay mainly perturbs the amplitude in the critical tail for a nominal parameter set. From a cybersecurity standpoint, these findings suggest that adjusting defense mechanisms only to achieve R 0 ⟶1 − may still result in prolonged and transient infection dynamics. Consequently, effective mitigation strategies should aim to maintain a sufficiently safe margin below the unity.