<p>Wireless mesh networks (WMN) are characterized by multi-hop transmission and dynamic routing, enabling wide-area coverage and flexible communication. However, these same features also facilitate the rapid spread of malicious code, posing severe threats to device security and user privacy in Internet-connected environments. To address this challenge, this study proposes a joint defense mechanism based on the integration of cloud computing and wireless mesh networks (Cloud-WMN), combining cloud-side security analysis with frequent inter-node communications inherent to WMN. A core innovation of this work is the introduction of a warning state into the classical Susceptible-Infectious-Recovered (SIR) model, resulting in an enhanced Susceptible-Infectious-Recovered-Warning (SIR-W) model that more accurately captures the early detection and response phases of malicious code spread. Through analytical derivation, the propagation threshold and equilibrium points are obtained, and the stability of the system is rigorously verified using a Lyapunov function. Numerical simulations demonstrate that under continuous attack, the proposed SIR-W model reduces the number of infected nodes by 44.8% compared to the classical SIR model, 39.3% compared to a cloud-security-only model, and 9.9% compared to a point-to-group communication model lacking security detection. These results suggest that the proposed model enhances malicious code containment while offering a practical and scalable solution for real-world WMN, including smart cities, industrial IoT, and emergency networks where early warning and adaptive defense are vital.</p>