Pith. sign in

REVIEW 4 major objections 5 minor 51 references

Understanding Malware Propagation Dynamics through Scientific Machine Learning

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Hybrid physics-informed differential equations, called universal differential equations, forecast malware propagation 44% more accurately than either a classical epidemiological model or a pure neural model, while preserving…

desk verdict The headline 44% figure rests on a target-forcing term that makes the forecast comparison not a clean prediction test; the paper has a useful setup but the central claim is unsupported until that is fixed. read the letter →

arxiv 2507.07143 v1 pith:2UPUKUWR submitted 2025-07-09 cs.LG cs.CR

Karthik Pappu , Prathamesh Dinesh Joshi , Raj Abhijit Dandekar , Rajat Dandekar , Sreedath Panat This is my paper
classification cs.LGcs.CR
keywords malwarepropagationuniversaldifferentialequationsneuralODEsscientificmachinelearningCodeRedwormsymbolicregressionepidemicmodelinginterpretable
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that a hybrid model--a classical epidemiological differential equation with one hand-built feedback term replaced by a small neural network--predicts malware spread better than either a purely analytical model or a purely neural one. It tests the three approaches on the Code Red worm outbreak and reports a 44% reduction in prediction error (RMSE $2289.12 \rightarrow 1281.80$) for the hybrid Universal Differential Equation (UDE), with a correlation to observed data matched only by the analytical baseline. The paper then recovers an explicit five-term formula for the neural component, which acts mostly as a suppression mechanism, and maps each recovered term to a concrete cybersecurity phenomenon such as network saturation, address-space exhaustion, security response, peer-to-peer propagation, and variant evolution. A sympathetic reader would take the central claim to be that physics-informed hybrid models give both accuracy and interpretability for cyber-outbreak forecasting.

What carries the argument

The central object is the Universal Differential Equation (UDE): a dynamical model that keeps the interpretable analytical skeleton of an epidemiological ODE but replaces one structural term with a neural network. Here the skeleton is logistic growth plus external forcing $\eta(t)$ and quadratic suppression $\beta M^2$, and the neural network $N_\varphi(M)$ substitutes for the analytical feedback $\kappa M\log(1+M)$. A two-phase optimizer (Adam then L-BFGS) trains the network through the ODE solver, and symbolic regression on the trained network recovers an explicit algebraic surrogate with five terms. The machinery works by giving the neural component the narrow job of learning only the residual feedback that the analytical form mis-specifies, which is why the model needs only 31 neural parameters versus 337 for the pure Neural ODE.

What would settle it

Retrain the UDE on the first 25% of the Code Red series with the forcing term $\eta(t)$ frozen at its last training value (or set to zero) across the forecast horizon. If RMSE stays close to 1087, the reported forecast gain is genuine; if the error jumps toward the ODE's level around 2434, then the advantage depends on feeding the forecast the very observations it is meant to predict.

Watch

Extended reading notes

Core claim

On the authors' own terms, the discovery is that the balance between mechanistic and learned components is what matters for malware propagation modeling. The UDE model $dM/dt = \alpha(t)\,M(1 - M/K) + \eta(t) - \beta M^2 + N_\varphi(M)$, with the neural network $N_\varphi(M)$ replacing the fixed logarithmic feedback term, achieves RMSE 1281.8 on Code Red data, versus 2289.12 for the classical ODE and 2036.78 for a pure Neural ODE. The learned feedback is not a black-box abstraction: symbolic recovery turns it into $-2608.692\cdot M/(1+M) -2459.9124\cdot \log(1+M) -2113.3055\cdot M +1366.5024\cdot M^2 +831.707\cdot M\cdot \log(1+M)$, in which the dominant negative terms are interpreted as suppression by network saturation, address-space exhaustion, and security response. The paper's conclusion is that classical epidemiological analogies overestimate malware spread because they omit these suppression mechanisms, and that learned residual terms can discover and express them.

Load-bearing premise

The UDE's external forcing term $\eta(t)$ is built from the smoothed, observed infection counts--the same target the model is scored against--and the paper never states whether future values of that forcing are supplied during the forecasting runs, so the 44% improvement could be interpolative rather than predictive if they are.

Editorial extensions

If this is right

  • If the UDE result holds, early-warning systems can be built from hybrid models that stay accurate with only the first 25% of an outbreak's data (RMSE 1087.19, 19.4% better than the Neural ODE at the same data size).
  • The recovered suppression terms imply that classical SIR-style models overestimate malware spread in real networks, so forecasts should explicitly include saturation, address-space, and response terms.
  • Hybrid models dominate pure neural models on small, noisy outbreak data while needing far fewer neural parameters, giving defenders an accuracy gain without losing interpretability.
  • With abundant training data, a pure Neural ODE can become competitive in forecasting, so model choice should depend on data availability: UDE for early warning and noisy monitoring, Neural ODE for complete forensic datasets.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the forecasting protocol is changed so that the forcing term $\eta(t)$ is never observed ahead of time, the reported 44% margin is likely to shrink; the size of that shrink is an empirical question the paper leaves open.
  • A natural next test is to run the same UDE and symbolic-recovery pipeline on independent malware outbreaks, such as WannaCry or Conficker, and check whether the same five-term suppression structure reappears with comparable coefficients.
  • A further extension is to apply sparse regression directly to the full observed dynamics rather than only to the trained network's output, which would test whether the recovered five terms are uniquely identifiable or just one of several equivalent descriptions.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper compares three approaches for modeling the Code Red worm outbreak: a mechanistic ODE with logistic growth, external forcing, quadratic suppression, and adaptive feedback; a Universal Differential Equation (UDE) that replaces the feedback term with a small neural network; and a fully data-driven Neural ODE. The central claims are that the UDE reduces prediction error by 44% over both baselines, that it forecasts well with only 25% of training data, and that symbolic recovery of the learned feedback term reveals interpretable suppression mechanisms such as network saturation and security response. The manuscript is well structured and uses a public dataset, but the experimental design contains a target-leakage problem: the external forcing term η(t) in the ODE and UDE is constructed by interpolating the smoothed observed infection intensity, which is exactly the quantity the models are supposed to predict. The forecasting experiments do not state that η(t) is restricted to the training interval, and the algorithms evaluate ηinterp(t) unconditionally. As written, the reported improvements are therefore not a valid test of predictive skill, and the symbolic-recovery interpretation is compromised because the neural term learns only a residual after the target-informed forcing has already supplied the observed dynamics.

Significance. If the UDE approach genuinely outperformed both a mechanistic baseline and a Neural ODE on real malware data while producing interpretable terms, it would be a useful contribution to the cyber-physical modeling literature. The paper has several strengths: it uses a real-world dataset (CAIDA Code Red), it implements all three models in a reproducible ecosystem (Julia DifferentialEquations.jl), it includes an ablation study isolating the feedback term, and it is transparent about the absence of significance testing. However, the central empirical claim is load-bearing and currently unsupported because of the target-dependent forcing term. The claimed 44% error reduction and the forecasting results in Table 3 cannot be interpreted as evidence of model quality unless η(t) is shown to be withheld during forecasting. The symbolic recovery result, presented as a discovery about malware suppression, is also not independent evidence because the neural network is fitting the residual left after the observed trajectory has been injected into the right-hand side.

major comments (4)
  1. [§3.1, Eqs. (1) and (6), §4.3] The external forcing term η(t) is constructed from the smoothed observed infection intensity over the full Code Red time series (§3.1, step 3). Both the ODE (Eq. 1) and the UDE (Eq. 6) include this term on the right-hand side, and Algorithms 1 and 3 evaluate ηinterp(t) at every integration step. The forecasting experiments in §4.3 train on 25%, 50%, or 75% of the data and then forecast beyond the training boundary, but the paper never states that η(t) is restricted to the training portion. If ηinterp(t) is evaluated at future times from the full-data interpolant, the UDE and ODE are being fed the exact future values of the target series they are supposed to predict. This is a direct form of target leakage and invalidates the forecasting RMSE comparisons in Table 3 and the headline claim of a 44% error reduction.
  2. [Eq. (3) vs. Eq. (6), §4.1, Table 2] The Neural ODE baseline (Eq. 3) has no external forcing term and must learn the full dynamics from data, while the UDE receives η(t), which is an interpolated version of the observed target itself. The comparison in Table 2 is therefore not apples-to-apples: the UDE's lower RMSE (1281.80 vs. 2036.78 for the Neural ODE) may reflect the fact that the UDE is partially interpolating the target through η(t) rather than learning superior dynamics. The paper needs to either remove η(t) from the comparison models or, if η(t) is meant to be an exogenous observable, demonstrate that it is independent of the target and that the same forecasting protocol is applied to all models.
  3. [§4.5, Eq. (10), §4.5.1] The symbolic recovery analysis interprets the negative output of the learned neural feedback as a discovered 'suppression mechanism' (network saturation, security response, variant evolution). This interpretation is not supported by the experimental design. Because η(t) already injects the observed trajectory into the model, the neural network Nφ(M) is trained to produce whatever correction is needed to match the data after the target-informed forcing term has been applied. The predominantly negative values in Eq. (10) are therefore an artifact of the residual learning setup, not an independent discovery about malware dynamics. To support the interpretability claim, the authors would need to show that the same symbolic terms emerge under a protocol where η(t) is withheld or treated as a genuinely exogenous input.
  4. [§6, Section 4, Algorithms 1–3] The paper reports precise performance numbers (e.g., 44.0% improvement, 40.54% improvement in the ablation study) without any confidence intervals, significance tests, or multiple-seed variation. Section 6 acknowledges the absence of statistical significance testing, but the problem is compounded by the lack of code or a precise statement of the data split for η(t). Without code or a detailed protocol describing how ηinterp(t) is constructed during training and forecasting, the results cannot be independently verified or reproduced. At minimum, the authors should release the preprocessing and forecasting scripts and report uncertainty over random initializations and train/test splits.
minor comments (5)
  1. [§5.1, Table 3] The paragraph following Table 3 contains an incomplete sentence: '...achieving competitive results with abundant data (661.86 RMSE at 75% training) but poor performance with limited data (1348.11 RMSE at 25' is cut off and should be completed.
  2. [Table 2] The MAPE values are surprising (ODE: 1503.79%, Neural ODE: 9368.04%) and need clarification. Since infection intensity can be near zero, the standard MAPE definition will produce extreme values; the paper should state how MAPE is computed and whether a modified definition (e.g., with a denominator floor) is used.
  3. [§3.2, Eq. (1)] The ODE baseline is described as 'classical' but it includes several non-classical terms (external forcing, quadratic suppression, adaptive feedback). This is not a standard SIR or epidemic model, and the paper should clearly state that this is a custom mechanistic baseline rather than a classical epidemiological model.
  4. [§3.1 and §3.4.2, Eqs. (2), (5), (8)] The notation is inconsistent: the loss functions refer to ηsmooth(t), while the model equations refer to η(t). The relationship between η(t), ηsmooth(t), and the binned intensity Ii should be made explicit in one place.
  5. [§2, related work] The acronym 'SCIRAS' in the discussion of Hernández Guillén et al. is not defined; please expand or explain it on first use.

Circularity Check

2 steps flagged · score 8.0 of 10

Central prediction results are driven by injecting the observed target η(t) into the model equations; forecasting performance reduces to target leakage.

  1. fitted input called prediction [Section 3.1 (preprocessing, step 3); Eqs. (1) and (6); Algorithms 1 and 3; Section 4.3]
    "A continuous-time infection intensity function η(t) is constructed via linear interpolation of the smoothed intensity signal using scipy's interpolation methods. This enables evaluation at arbitrary time points during differential equation integration and model simulation, providing the external forcing term required for our mathematical models."

    η(t) is the smoothed observed infection intensity, built from the full time series. The forecasting experiments in §4.3 train on a prefix and then integrate beyond it, while Algorithm 1 and 3 call ηinterp(t) at every integration step with no restriction to the training interval. The UDE and ODE forecasts are therefore forced by the future observed values they are supposed to predict. The reported RMSE measures tracking of an injected target, not predictive skill, and the Neural ODE baseline lacks this forcing, making the 44% comparison an artifact of target leakage by construction.

  2. self definitional [Section 4.5, Eq. (8) and Eq. (10)]
    "The neural network primarily functions as a suppression mechanism, with an overwhelmingly negative contribution that increases with malware intensity."

    Nφ is trained to minimize MSE to ηsmooth (Eq. 8), and the same ηsmooth is injected as the η(t) term on the RHS of Eq. (6). The symbolic-recovery insight that the neural term represents suppression mechanisms such as network saturation, security response, and variant evolution is thus an interpretation of a residual trained to force agreement with the injected target. The discovered formula is defined by the target data, so the claimed mechanistic discovery is a restatement of the fit rather than an independent result.

full rationale

The paper's central claimed contribution—a 44% reduction in prediction error for UDE over ODE and Neural ODE—is not a genuine forecasting gain as described. The model equations (1) and (6) include an external forcing term η(t), which Section 3.1 constructs by linear interpolation of the full smoothed observed infection-intensity series. During the forecasting experiments of Section 4.3, Algorithms 1 and 3 evaluate ηinterp(t) at every integration time step without any stated restriction to the training interval, so future target values are fed into the model. Consequently, the reported forecast RMSE measures how well the trajectory tracks the injected target, and the Neural ODE baseline is at an unfair disadvantage because it contains no such forcing term. The symbolic recovery in Section 4.5 compounds the issue: the neural component is fitted to the same ηsmooth that is also an RHS input, so the 'discovered' suppression mechanisms are descriptions of a residual that absorbs the mismatch between the mechanistic terms and the injected target, not independent physical findings. No load-bearing self-citation chain is present; the circularity is instead one of construction, where the prediction target is an input to the model. This warrants a score of 8.

Assumptions & free parameters 8 free parameters · 5 assumptions · 0 invented entities

The analysis relies on the external forcing assumption, the proxy validity of the data, and the completeness of the symbolic library. These are not independently validated, and the external forcing premise is the most fragile.

free parameters (8)
  • alpha0 (initial infection rate) = 0.0501 day^-1
    Table 1, fitted to Code Red data; controls logistic growth.
  • beta (suppression coefficient) = 1e-4 intensity^-1 day^-1
    Table 1, fitted to Code Red data; quadratic suppression term.
  • kappa (feedback strength) = 0.005 day^-1
    Table 1, fitted for the classical ODE only; replaced by a neural network in the UDE.
  • K (carrying capacity) = 1e5 intensity units
    Table 1, fitted; caps logistic growth.
  • pdecay (temporal decay rate) = 0.48 dimensionless
    Table 1, fitted; controls exponential decay of infection rate.
  • Ridge regression lambda = 1.0
    Chosen by hand in Section 4.5 for symbolic recovery; not data-fitted.
  • Neural network weights (UDE) = 31 parameters
    Learned via Adam and L-BFGS; part of the UDE model.
  • Neural network weights (Neural ODE) = 337 parameters
    Learned via Adam and L-BFGS; part of the Neural ODE baseline.
assumptions (5)
  • domain assumption The smoothed observed intensity η(t) is a valid external forcing function available at any time t during simulation.
    Equations (1) and (6) add η(t) to the derivative; if η(t) is the target variable itself, the model is given the answer.
  • domain assumption The neural network can represent the unmodeled feedback dynamics.
    Standard universal approximation assumption for UDEs.
  • ad hoc to paper The candidate symbolic functions in the regression library span the true feedback mechanism.
    Symbolic recovery in Section 4.5 uses a fixed library; no guarantee the true mechanism lies in it.
  • ad hoc to paper Ridge regression with λ=1.0 gives a parsimonious accurate approximation.
    The choice of regularization parameter is not derived from theory or data.
  • domain assumption Code Red scan counts are a valid proxy for infection intensity.
    The dataset records darknet telescope scans, not confirmed infections.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Understanding Malware Propagation Dynamics through Scientific Machine Learning." pith.science (2026). https://pith.science/paper/2UPUKUWR

@misc{pith2026250707143,
  author       = {Pith},
  title        = {Pith review of: Understanding Malware Propagation Dynamics through Scientific Machine Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2UPUKUWR}},
  note         = {Machine review of arXiv:2507.07143}
}
read the original abstract

Accurately modeling malware propagation is essential for designing effective cybersecurity defenses, particularly against adaptive threats that evolve in real time. While traditional epidemiological models and recent neural approaches offer useful foundations, they often fail to fully capture the nonlinear feedback mechanisms present in real-world networks. In this work, we apply scientific machine learning to malware modeling by evaluating three approaches: classical Ordinary Differential Equations (ODEs), Universal Differential Equations (UDEs), and Neural ODEs. Using data from the Code Red worm outbreak, we show that the UDE approach substantially reduces prediction error compared to both traditional and neural baselines by 44%, while preserving interpretability. We introduce a symbolic recovery method that transforms the learned neural feedback into explicit mathematical expressions, revealing suppression mechanisms such as network saturation, security response, and malware variant evolution. Our results demonstrate that hybrid physics-informed models can outperform both purely analytical and purely neural approaches, offering improved predictive accuracy and deeper insight into the dynamics of malware spread. These findings support the development of early warning systems, efficient outbreak response strategies, and targeted cyber defense interventions.

Figures

Figures reproduced from arXiv: 2507.07143 by the authors.

Figure 1
Figure 1. Comparison of model predictions against malware intensity data. The UDE model (green) achieves the lowest [PITH_FULL_IMAGE:figures/full_fig_p009_1.png] view at source ↗
Figure 2
Figure 2. Ablation study comparing models with progressively more sophisticated feedback mechanisms. The UDE [PITH_FULL_IMAGE:figures/full_fig_p010_2.png] view at source ↗
Figure 3
Figure 3. Forecasting performance comparison using only 25% of data for training. The UDE model (green, RMSE: [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Model performance degradation with increasing noise levels. The UDE model (green) consistently demon [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]
Figure 5
Figure 5. Figure 5: Symbolic recovery of the neural network contribution. The actual neural network output (green) can be [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]
Figure 6
Figure 6. Figure 6: Cybersecurity interpretation of recovered symbolic terms. The height of each bar represents the absolute [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

51 extracted references · 41 canonical work pages

  1. [1]

    A critical analysis of cyber threats and their global impact,

    S. A. Afaq, M. S. Husain, A. Bello, and H. Sadia, “A critical analysis of cyber threats and their global impact,” in Computational Intelligent Security in Wireless Communications , pp. 201–220, CRC Press, 2023

    work page 2023

  2. [2]

    Dynamic malware analysis in the modern era—a state of the art survey,

    O. Or-Meir, N. Nissim, Y . Elovici, and L. Rokach, “Dynamic malware analysis in the modern era—a state of the art survey,”ACM Computing Surveys, vol. 52, no. 5, pp. 1–48, 2019. 15 Malware Dynamics via SciML A PREPRINT

    work page 2019

  3. [3]

    Before we knew it: an empirical study of zero-day attacks in the real world,

    L. Bilge and T. Dumitras, “Before we knew it: an empirical study of zero-day attacks in the real world,” in Proceedings of the 2012 ACM Conference on Computer and Communications Security , pp. 833–844, 2012

    work page 2012

  4. [4]

    Security countermeasures of a sciras model for advanced malware propagation,

    J. D. Hernández Guillén, A. Martín del Rey, and R. Casado-Vara, “Security countermeasures of a sciras model for advanced malware propagation,” IEEE Access, vol. 7, pp. 135472–135477, 2019

    work page 2019

  5. [5]

    A contribution to the mathematical theory of epidemics,

    W. O. Kermack and A. G. McKendrick, “A contribution to the mathematical theory of epidemics,”Proceedings of the Royal Society of London. Series A , vol. 115, no. 772, pp. 700–721, 1927

    work page 1927

  6. [6]

    The mathematics of infectious diseases,

    H. W. Hethcote, “The mathematics of infectious diseases,” SIAM Review, vol. 42, no. 4, pp. 599–653, 2000

    work page 2000

  7. [7]

    Computer viruses: theory and experiments,

    F. Cohen, “Computer viruses: theory and experiments,” Computers & Security, vol. 6, no. 1, pp. 22–35, 1987

    work page 1987

  8. [8]

    Directed-graph epidemiological models of computer viruses,

    J. O. Kephart and S. R. White, “Directed-graph epidemiological models of computer viruses,” Proceedings of the 1991 IEEE Computer Society Symposium on Research in Security and Privacy , pp. 343–359, 1991

    work page 1991

Show all 51 references
  1. [9]

    Code red worm propagation modeling and analysis,

    C. C. Zou, W. Gong, and D. Towsley, “Code red worm propagation modeling and analysis,” inProceedings of the 9th ACM conference on Computer and communications security , pp. 138–147, 2002

    2002

  2. [10]

    Dynamical and correlation properties of the internet,

    R. Pastor-Satorras and A. Vespignani, “Dynamical and correlation properties of the internet,”Physical Review Letters, vol. 87, no. 25, p. 258701, 2001

    2001

  3. [11]

    Stochastic models for computer malware propagation,

    I. Zhuravel and S. Semenyuk, “Stochastic models for computer malware propagation,” in 2024 IEEE 17th Inter- national Conference on Advanced Trends in Radioelectronics, Telecommunications and Computer Engineering (TCSET), (Lviv, Ukraine), pp. 424–427, IEEE, 2024

    2024

  4. [12]

    A taxonomy of ddos attack and ddos defense mechanisms,

    J. Mirkovic and P. Reiher, “A taxonomy of ddos attack and ddos defense mechanisms,”ACM SIGCOMM Computer Communication Review, vol. 34, no. 2, pp. 39–53, 2004

    2004

  5. [13]

    How to own the internet in your spare time,

    S. Staniford, V . Paxson, and N. Weaver, “How to own the internet in your spare time,” inProceedings of the 11th USENIX Security Symposium, (San Francisco, CA), pp. 149–167, USENIX Association, August 2002

    2002

  6. [14]

    The effect of network topology on the spread of epidemics,

    A. Ganesh, L. Massoulié, and D. Towsley, “The effect of network topology on the spread of epidemics,” in Proceedings IEEE INFOCOM 2005, vol. 2, pp. 1455–1466, 2005

    2005

  7. [15]

    Goodfellow, Y

    I. Goodfellow, Y . Bengio, and A. Courville,Deep learning. MIT Press, 2016

    2016

  8. [16]

    Neural odes with irregular and noisy data,

    P. Goyal and P. Benner, “Neural odes with irregular and noisy data,” arXiv preprint arXiv:2205.09489, 2022

    2022 arXiv

  9. [17]

    Partial differential equation modeling of malware propagation in social networks with mixed delays,

    B. Du and H. Wang, “Partial differential equation modeling of malware propagation in social networks with mixed delays,” Computers & Mathematics with Applications , vol. 76, no. 10, pp. 2446–2465, 2018

    2018

  10. [18]

    Malware propagation in large-scale networks,

    S. Yu, G. Gu, A. Barnawi, S. Guo, and I. Stojmenovic, “Malware propagation in large-scale networks,” IEEE Transactions on Knowledge and Data Engineering , vol. 27, no. 1, pp. 170–179, 2015

    2015

  11. [19]

    Epidemic processes in complex networks,

    R. Pastor-Satorras, C. Castellano, P. Van Mieghem, and A. Vespignani, “Epidemic processes in complex networks,” Reviews of Modern Physics, vol. 87, no. 3, pp. 925–979, 2015

    2015

  12. [20]

    Physics-informed machine learning,

    G. E. Karniadakis, I. G. Kevrekidis, L. Lu, P. Perdikaris, S. Wang, and L. Yang, “Physics-informed machine learning,” Nature Reviews Physics, vol. 3, no. 6, pp. 422–440, 2021

    2021

  13. [21]

    Neural ordinary differential equations,

    R. T. Chen, Y . Rubanova, J. Bettencourt, and D. K. Duvenaud, “Neural ordinary differential equations,”Advances in neural information processing systems , vol. 31, 2018

    2018

  14. [22]

    Universal differential equations for scientific machine learning,

    C. Rackauckas, Y . Ma, J. Martensen, C. Warner, K. Zubov, R. Supekar, D. Skinner, A. Ramadhan, and A. Edelman, “Universal differential equations for scientific machine learning,” arXiv preprint arXiv:2001.04385, 2020

    2001 arXiv

  15. [23]

    A physics-informed neural network approach towards cyber attack detection in vehicle platoons,

    S. D. Vyas, S. K. Padisala, and S. Dey, “A physics-informed neural network approach towards cyber attack detection in vehicle platoons,” in 2023 American Control Conference (ACC), pp. 4533–4538, IEEE, 2023

    2023

  16. [24]

    Automatic cyber security risk assessment based on fuzzy fractional ordinary differential equations,

    Z. Wang, X. Huang, and J. Li, “Automatic cyber security risk assessment based on fuzzy fractional ordinary differential equations,” Alexandria Engineering Journal, vol. 59, no. 6, pp. 4535–4543, 2020

    2020

  17. [25]

    A survey on malware detection with graph representation learning,

    T. Bilot, N. El Madhoun, K. Al Agha, and A. Zouaoui, “A survey on malware detection with graph representation learning,” ACM Computing Surveys, vol. 56, no. 11, pp. 278:1–278:37, 2024

    2024

  18. [26]

    Multi-loss siamese neural network with batch normalization layer for malware detection,

    X. Li, Y . Chen, W. Zhang, and Q. Liu, “Multi-loss siamese neural network with batch normalization layer for malware detection,” IEEE Access, vol. 9, pp. 69621–69632, 2021

    2021

  19. [27]

    Android malware detection using machine learning and neural network: A hybrid approach with federated learning,

    B. S. Purkayastha, M. M. Rahman, and M. Shahpasand, “Android malware detection using machine learning and neural network: A hybrid approach with federated learning,” in 2023 IEEE International Conference on Contemporary Computing and Communications (InC4) , pp. 1–8, IEEE, 2023

    2023

  20. [28]

    Monitoring and early warning for internet worms,

    C. C. Zou, L. Gao, W. Gong, and D. Towsley, “Monitoring and early warning for internet worms,” inProceedings of the 10th ACM conference on Computer and communications security , pp. 190–199, ACM, 2003. 16 Malware Dynamics via SciML A PREPRINT

    2003

  21. [29]

    Modeling self-propagating malware with epidemio- logical models,

    A. Chernikova, E. Egorova, M. I. Bocicor, and A.-J. Molnar, “Modeling self-propagating malware with epidemio- logical models,” Applied Network Science, vol. 8, no. 1, pp. 1–34, 2023

    2023

  22. [30]

    On the usability of the sir model for malware propagation compared to diffusion models,

    E. Ginters and C. Martin-Vide, “On the usability of the sir model for malware propagation compared to diffusion models,” Computer Science and Information Systems , vol. 20, no. 2, pp. 775–798, 2023

    2023

  23. [31]

    A malware propagation prediction model based on representation learning and graph convolutional networks,

    T. Li, Y . Liu, Q. Liu, W. Xu, Y . Xiao, and H. Liu, “A malware propagation prediction model based on representation learning and graph convolutional networks,” Digital Communications and Networks , vol. 9, no. 5, pp. 1090–1100, 2023

    2023

  24. [32]

    Physics-informed machine learning for reliability and systems safety applications: State of the art and challenges,

    Y . Xu, S. Kohtz, J. Boakye, P. Gardoni, and P. Wang, “Physics-informed machine learning for reliability and systems safety applications: State of the art and challenges,” Reliability Engineering & System Safety , vol. 230, p. 108900, 2023

    2023

  25. [33]

    Discovering governing equations from data by sparse identification of nonlinear dynamical systems,

    S. L. Brunton, J. L. Proctor, and J. N. Kutz, “Discovering governing equations from data by sparse identification of nonlinear dynamical systems,” Proceedings of the National Academy of Sciences , vol. 113, no. 15, pp. 3932–3937, 2016

    2016

  26. [34]

    Distilling free-form natural laws from experimental data,

    M. Schmidt and H. Lipson, “Distilling free-form natural laws from experimental data,”Science, vol. 324, no. 5923, pp. 81–85, 2009

    2009

  27. [35]

    Code Red worm dataset

    CAIDA, “Code Red worm dataset.” https://catalog.caida.org/dataset/telescope_codered_worm,

  28. [36]

    Statistical modeling of computer malware propagation dynamics in cyberspace,

    Z. Fang, P. Zhao, M. Xu, S. Xu, T. Hu, and X. Fang, “Statistical modeling of computer malware propagation dynamics in cyberspace,” Journal of Applied Statistics, vol. 47, no. 5, pp. 858–883, 2020

    2020

  29. [37]

    Differentialequations.jl – a performant and feature-rich ecosystem for solving differential equations in julia,

    C. Rackauckas and Q. Nie, “Differentialequations.jl – a performant and feature-rich ecosystem for solving differential equations in julia,” Journal of Open Research Software, vol. 5, no. 1, p. 15, 2017

    2017

  30. [38]

    Hairer and G

    E. Hairer and G. Wanner, Solving Ordinary Differential Equations II: Stiff and Differential-Algebraic Problems , vol. 14 of Springer Series in Computational Mathematics . Springer Berlin, Heidelberg, 2 ed., 1996

    1996

  31. [39]

    Augmented neural odes,

    E. Dupont, A. Doucet, and Y . W. Teh, “Augmented neural odes,” inAdvances in Neural Information Processing Systems, vol. 32, Curran Associates, Inc., 2019

    2019

  32. [40]

    Kidger, On Neural Differential Equations

    P. Kidger, On Neural Differential Equations . Doctoral thesis, University of Oxford, 2022. arXiv preprint arXiv:2202.02435

    2022 arXiv

  33. [41]

    Adam: A method for stochastic optimization,

    D. P. Kingma and J. Ba, “Adam: A method for stochastic optimization,” in 3rd International Conference on Learning Representations (ICLR), (San Diego, CA), 2015. arXiv preprint arXiv:1412.6980

    2015 arXiv

  34. [42]

    Multilayer feedforward networks are universal approximators,

    K. Hornik, M. Stinchcombe, and H. White, “Multilayer feedforward networks are universal approximators,” Neural networks, vol. 2, no. 5, pp. 359–366, 1989

    1989

  35. [43]

    Physics-informed neural networks: A deep learning framework for solving forward and inverse problems involving nonlinear partial differential equations,

    M. Raissi, P. Perdikaris, and G. E. Karniadakis, “Physics-informed neural networks: A deep learning framework for solving forward and inverse problems involving nonlinear partial differential equations,”Journal of Computational Physics, vol. 378, pp. 686–707, 2019

    2019

  36. [44]

    A review of physics-informed machine learning in fluid mechanics,

    P. Sharma, W. T. Chung, B. Akoush, and M. Ihme, “A review of physics-informed machine learning in fluid mechanics,” Energies, vol. 16, no. 5, p. 2343, 2023

    2023

  37. [45]

    A machine learning-aided global diagnostic and comparative tool to assess effect of quarantine control in covid-19 spread,

    R. Dandekar, C. Rackauckas, and G. Barbastathis, “A machine learning-aided global diagnostic and comparative tool to assess effect of quarantine control in covid-19 spread,” Patterns, vol. 1, no. 9, p. 100145, 2020

    2020

  38. [46]

    Integrating physics-based modeling with machine learning: A survey,

    J. D. Willard, X. Jia, S. Xu, M. S. Steinbach, and V . Kumar, “Integrating physics-based modeling with machine learning: A survey,” 2020

    2020

  39. [47]

    Stop explaining black box machine learning models for high stakes decisions and use interpretable models instead,

    C. Rudin, “Stop explaining black box machine learning models for high stakes decisions and use interpretable models instead,” Nature Machine Intelligence, vol. 1, no. 5, pp. 206–215, 2019

    2019

  40. [48]

    Regression shrinkage and selection via the lasso,

    R. Tibshirani, “Regression shrinkage and selection via the lasso,” Journal of the Royal Statistical Society: Series B (Methodological), vol. 58, no. 1, pp. 267–288, 1996

    1996

  41. [49]

    "why should i trust you?

    M. T. Ribeiro, S. Singh, and C. Guestrin, “"why should i trust you?": Explaining the predictions of any classifier,” in Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining , pp. 1135–1144, ACM, 2016

    2016

  42. [50]

    Practical automated detection of stealthy portscans,

    S. Staniford, J. A. Hoagland, and J. M. McAlerney, “Practical automated detection of stealthy portscans,” Journal of Computer Security, vol. 10, no. 1-2, pp. 105–136, 2002. 17

    2002

  43. [2001]

    Accessed: 2024-05-25

    2024

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.