Improving resilience of mobile Internet of Things against malware attacks via optimal patch allocation

Mobile Internet of Things (MIoT) has emerged as a key enabler of the low-altitude economy. However, task-driven dynamic interactions among mobile devices introduce significant security risks due to malware attacks. Despite extensive studies on malware defense, identifying effective patch allocation strategies to enhance MIoT resilience remains challenging. To fill this gap, we first develop a temporal multilayer model that integrates device mobility with decentralized patch dissemination. Second, we establish a microscopic Markov chain approximation-based malware-patch propagation model and derive a defense-dependent resilience boundary. This boundary characterizes whether an initial malware introduction will die out under a given defense regime. Third, we formulate a finite-horizon resource-constrained optimization problem that minimizes cumulative infections subject to network bandwidth and maintenance budgets, and propose a Dynamic Deployable Optimization (DDO) algorithm for patch allocation. Extensive experiments demonstrate that the DDO algorithm outperforms topology-based heuristics. The results further reveal distinct time-scale dependencies in defense. Specifically, bandwidth optimization is critical for rapid short-term suppression, whereas long-term resilience benefits from maintenance policies that maximize sustained immunization. We also find that the impact of device mobility on malware propagation is not strictly amplifying or suppressing, as it reshapes the spatial heterogeneity of device distribution among stations. Overall, this work provides a theoretically grounded framework for adaptive decentralized patching, enabling resilience enhancement in evolving cyber–physical systems.