# Markov-Based Malware Propagation Modeling and Analysis in Multi-Layer Networks
## 3 Malware Propagation Modeling in Multi-Layer Networks
### Modeling Malware Propagation via a Markov Random Field  
We consider a malware propagative complex communication networks (CCN) with \(N\) nodes. In our case, the considered CCN will be a two-layer network, such as the one shown in Figure 1. The term malware propagative denotes that wherever a legitimate node is infected, it can further infect with malware other non-infected legitimate nodes. We study the macroscopic behavior of the system, in which nodes may become infected, then recover to the susceptible state, and become re-infected at a later time instant. This behavior is effectively described by an SIS infection paradigm. Assume a finite set \(S,|S|=N\), with elements \(s\in S\) corresponding to the nodes of the network. We define the phase space \(\Lambda\) as the set of possible states of each \(s\in S\). We define a random field on \(S\), the collection \(X=\{X_{s},\forall s\in S\}\) of random variables with values in \(\Lambda\). A configuration \(\mathbf{x}=\{x_{s},\forall s\in S,x_{s}\in\Lambda\}\) corresponds to one of all possible states of the nodes. The employed MRF framework abstracts connectivity and local interactions through the neighborhood system of each node's set of neighbors. A neighborhood system on \(S\) is defined as a family \(\mathcal{N}=\{\mathcal{N}_{s}\}_{s\in S}\) of subsets \(\mathcal{N}_{s}\subset S\), such that for every \(s\in S\), \(s\
eq\mathcal{N}_{s}\) and\(r\in\mathcal{N}_{s}\) if and only if \(s\in\mathcal{N}_{r}\). \(\mathcal{N}_{s}\) is called the neighborhood of node \(s\). The random field \(X\) is called a Markov Random Field (MRF) with respect to \(\mathcal{N}\) if for every node \(s\in S\),  
\[\mathbb{P}(X_{s}=x_{s}\mid X_{r}=x_{r},r\
eq s)=\mathbb{P}(X_{s}=x_{s}\mid X_{ r}=x_{r},r\in\mathcal{N}_{s}). \tag{3}\]  
Direct interactions between infected and sensitive nodes are recorded, covering cases where malware infections spread in a localized way that depends on the one-hop communications [43]. However, we can adapt the neighborhood system definition by appropriately defining a new neighborhood system where the nodes involved are direct neighbors (in the overlay topology). The MRF framework achieves macroscopic evolution of the system through point-to-point interactions between adjacent nodes. For an appropriate MRF modeling of an SIS malware propagation epidemic, we select for each node \(k\) a pairwise (depending on neighboring interactions) potential function of the form:  
\[\Phi_{x}(x)=\Phi_{x}(x_{x})=-D\sum_{r}\sigma_{x}\sigma_{r},\forall r\in N_{x},D>0, \tag{4}\]  
for each pair of neighboring nodes \(\kappa,r\in S\). Function \(\sigma_{x}\) is a bijective function of \(x_{i}\), \(x_{i}\) being the node state with 0 denoting a susceptible node, 1 denoting an infected one and \(\mathbf{x}\) being the vector of all node states denoting the overall system state. Parameter \(D\) is a constant scaling factor that can be used to change the sensitivity of the MRF model. The exact definition of the node-specific function \(\sigma(\cdot)\) can slightly affect the sensitivity of the model but not the observed behavior. The exact potential function essentially captures the pairwise interactions between network nodes and quantifies the outcome of such interactions, depending on the individual node states, e.g., interactions between infected-susceptible nodes, infected-infected, and susceptible-susceptible. All contributions are aggregated and reflected in the total \"energy\" value of the system. The goal is to bring the system to a state with the least possible energy, the latter being symbolized by the potential function divided by temperature. Simulated annealing (SA) can be combined with Gibbs sequential sampling to analyze the evolution of the cumulative state of the system.