Cyber threats have evolved in complexity, aiming at a wide range of sectors using advanced methods and tools. This evolving threat landscape challenges existing cybersecurity frameworks, many of which lack the adaptability to counteract the complex tactics of sophisticated adversaries. Developing robust cyber defense strategies requires simulating dynamic interactions between attackers and defenders across high, moderate, and low-impact scenarios. The Flip-It cyber game serves as an intelligent framework for simulating these interactions, enabling the analysis of adaptive strategies in cybersecurity. This paper aims to address the problem of mitigating malware prevalence in full consideration of attack/defense capabilities in arbitrary network topologies. This paper proposes a sophisticated discrete-time epidemic model to characterize security state transitions over time for all three scenarios within the Flip-It game framework. On this basis, the original problem is modeled as a closed-loop control problem to seek the optimal containment strategy. Deep Reinforcement Learning (DRL) is then used to tackle the problem, generating efficient defense strategies that are well-adapted to changing cybersecurity environments. Numerical simulations based on small-world networks, scale-free networks, and router networks are then carried out to generate corresponding strategies. Additionally, we have evaluated the performance of the proposed method against the State-Of-The-Art (SOTA) in terms of attack/defense objective function, control actions, number of devices under the control of the attacker and defender, stability, execution time, and scalability. This comprehensive approach integrates epidemiological modeling, game theory, and advanced machine learning to effectively tackle the complexities of contemporary cybersecurity threats. • Mitigates malware across low, medium, and high-impact cyberattacks. • Integrates the Flip-It game for attacker-defender dynamic interactions. • Employs DRL to enable adaptive and optimized defense strategies. • Evaluates defense evolution across diverse network topologies.

Despite notable advancements in applying epidemic models to cybersecurity, current approaches often underperform in practice. Research indicates that these models can produce substantial prediction errors due to challenges in parameter estimation, the complexity and heterogeneity of real-world networks, and limitations in accurately evaluating model performance against empirical data. Prior models frequently rely on generalized or static parameters, which can further exacerbate prediction inaccuracies, particularly when estimating infection spread in complex and heterogeneous network environments. Such inaccuracies limit their ability to support timely and effective threat response. To address this gap, this article presents a novel hybrid framework that integrates attack graphs with epidemic modeling. Attack graphs provide a structured representation of potential attack paths and interdependencies within a network, enabling the incorporation of real, context-aware values into the epidemic model. This integration enhances parameter accuracy and improves predictive capability. Experimental evaluations demonstrate that the proposed framework (PFW) achieves a 91.25% improvement in performance. More specifically, the results indicate that the average number of infected devices using the proposed method with an attack graph for multivulnerabilities is 5, while for single-vulnerability cases it is 18. In comparison, traditional epidemic models without attack graph integration result in an average of 70 infected devices. These findings highlight the effectiveness of our approach in minimizing infection spread under diverse vulnerability conditions. Overall, the results demonstrate the value of grounding epidemic models in realistic network conditions, thereby advancing adaptive threat modeling, proactive defense strategies, and informed decision-making. Our work bridges the gap between theoretical modeling and real-world application, offering a significant step toward practical epidemic-based approaches in cybersecurity.

Despite extensive research on optimal control formulations for cyber threat mitigation, a significant gap persists between theoretical and practical implementation in real-time scenarios. The open-loop structure of the optimal control framework is insufficiently robust for effectively addressing cyber threats. To overcome this, adopting a model learning process that iteratively updates the optimal control strategy is proposed. This paper proposes an innovative approach to addressing cybersecurity attacks in the Internet of Things (IoT) networks by integrating reinforcement learning (RL) and model predictive control (MPC) in a hybrid framework to optimize control parameters and enhance system effectiveness in combating malware. This novel approach aims to overcome the limitations of the previous approaches and establish superior control strategies for IoT network security. This approach enhances the adaptability and responsiveness of the mitigation process, improving the handling of evolving cyber threats in real-world applications. This framework enhances the security and resilience of IoT networks against malicious activities, offering a robust solution for mitigating cyber threats by leveraging RL algorithms and the proactive capabilities of MPC. A comprehensive evaluation demonstrates the effectiveness and efficiency of the hybrid framework, highlighting its potential to protect IoT networks from evolving cybersecurity risks. The primary aim extends beyond using an RL agent solely for computing control actions to optimize closed-loop performance and stability. It also leverages RL to estimate model parameters that are currently unknown but within known bounds. Our main objective in using the RL agent is to accurately estimate unidentified model parameters within specified limits. The simulation results provide compelling evidence supporting the effectiveness of this methodology in mitigating malware propagation, highlighting its superior performance compared to state-of-the-art methods. RLMPC rapidly initiated recovery, achieving full network restoration in 8 seconds and recovering 60 IoT devices. Also, the evaluation focused on average speed, scalability, and performance under various cyber-attack scenarios.