Shared Fate: Operationalising Cyber Epidemiology for Critical Infrastructure Resilience

This thesis advances the field of cyber epidemiology by integrating epidemiological theory, quantitative modelling, and operational practice to address the cascading risks that cyber incidents pose to critical infrastructure. It contributes both conceptual and technical novelty: a seven-state SUEICRN compartmental model that better captures malware persistence and recovery dynamics; inferential pipelines for estimating reproduction numbers (Rₜ) and dispersion (K) across malware families; and the iLTR framework for likelihood-ratio tracking that turns heterogeneous telemetry into auditable early-warning signals. Empirical anchors, from WannaCry and NotPetya to the Colonial Pipeline breach and the 2024 CrowdStrike outage, demonstrate how these methods can reduce peaks and shorten recovery tails through targeted interventions such as staged rollouts, canarying, and carrier remediation. Alongside this technical core, the thesis interrogates socio-technical dimensions of cyber resilience, including DNS-based risk factor profiling, insider threats, and the geopolitical and legal barriers to intelligence sharing. The work is grounded in industry application and endorsed through patent filings, conference contributions, and operational pilots, positioning cyber epidemiology as both a rigorous analytical discipline and a practical decision-support pipeline. Collectively, the thesis establishes a shared-fate framework in which noisy signals can be translated into actionable interventions, thereby strengthening cross-sector resilience against the accelerating scale and complexity of cyber cascades