In the current era of information explosion, cybersecurity challenges have become increasingly prominent. Compared to malware that causes direct attacks, covert malware poses a significant cybersecurity threat as it can remain hidden within networks for extended periods while stealthily stealing users’ private information. To address the challenge of clearing covert malware, this study proposes two defense mechanisms: the Patch Propagation Mechanism (PPM) the aSleep-aWake Mechanism (SWM). Based on these mechanisms, we develop a mean-field two-layer propagation model, SW-VIPU (aSleep-aWake-Vulnerable-Infected-Patched-Unaware), to analyze the network’s dynamic evolution. In addition to theoretical analysis, the effectiveness of PPM and SWM in curbing the spread of malware is validated through comparisons with existing models and simulations on real-world network topologies. Subsequently, to enhance the performance of SWM, we introduce a multi-pulse control mechanism and analyze the dynamic performance of SW-VIPU under this mechanism. Finally, to comprehensively explore and improve the control effectiveness, we introduce static strategies as well as an objective-function-based dynamic defense framework, leading to the development of several hybrid control strategies (HCSs). The effectiveness of these HCSs is confirmed through simulation experiments. The experimental results demonstrate that the proposed dynamic HCSs outperform static HCSs in most scenarios. Furthermore, when malware exhibits a high propagation capability, patches should be deployed at their maximum deployment output, and users should be forced to log out and be prohibited from logging back in. Conversely, when malware spread capability is weaker, although the patch output should still be maintained at its highest level, user logins and logouts should not be restricted.

The advent of smart terminals and the IOT era has prompted the emergence of the multiplex network system. With the rapid information transmission in multiplex networks, security incidents caused by malicious attackers occur frequently. In light of the foregoing, this paper concentrates on modeling and analyzing the propagation process of multiplex networks. Particularly, this paper proposes an epidemic-based RCMO (Running- Confined- Malfuntioned- Overhauled) model after considering the operating state of equipment and a class of visibility-aware malware. After that, the stability analysis of the equilibria is performed to verify the effectiveness of the propagation threshold obtained in RCMO. Then, we introduce static controls including unique control, target control, acquaintance control, and pulse control, as well as dynamic controls including continuous-time and pulsed forms to the suppression strategies for preventing the spread of malware. Furthermore, the control strategies are cross-combined into$6\times 6$hybrid maintenance strategies (HMS), and the simulation analysis is performed from three perspectives: evolution of state variables, accumulation of revenue, and change of controls. We discovered through experimental results that the optimal HMS to inhibit the propagation of malware and the HMS with the highest revenue are always different under various network topologies, but they are all hybrid combinations of continuous-time and pulse controls. To some extent, dynamic control can reduce discrepancies between the HMS and generate approximate returns. Finally, we propose a few cyber defense recommendations for network administrators.