# Markov-Based Malware Propagation Modeling and Analysis in Multi-Layer Networks
## 2 Related Work  
One of the first epidemic models was devised by [PERSON] in 1760, aiming at studying the spread of smallpox [10]. Further development of such models dates back in the 1900s [11, 12, 13]. These studies aimed to model the spread of various diseases in the general population. In malware modeling, we are concerned with two main types of spreading: worms and e-mail viruses. Of course, there are other various types of malware, but focusing on the previous two essentially captures the majority of features that malware uses for propagation/spreading. Since the appearance of the Morris worm in 1988, active worms have been a major and persistent threat to Internet security. Code Red and Nimda worms infected hundreds of thousands of systems and cost the public and private sectors millions of dollars [14, 15, 16]. Active worms spread automatically as they infect computer systems. [PERSON] et al. [17], have shown that active worms can potentially spread in the Internet in seconds. Modeling and monitoring the spread of active worms as well as the ability to generate methods to effectively defend our systems against them can help us understand how they are contagious, monitor and effectively defend computer systems. The ultimate goal of the worms is usually to perform various malicious actions, such as destroying personal files, intercepting information and causing the system to shut down completely [18]. [PERSON] [19] introduced a stochastic density-dependent Markov propagation model by jumping and random scanning. Email viruses are one of the most important threats in the Internet. [PERSON] et al. [20] presented an email virus model that shows the behaviors of email users, for example the frequency with which incoming emails are checked and the probability of an attachment being opened in an email. Email viruses spread to a logical network defined by email address books. Email network topology plays an important role in determining the behavior of virus spread via email. It compares the spread of the e-mail virus in three topologies: power law, small world and random graph topologies. The impact of power-law topology on the spread of email viruses is mixed: email viruses spread faster than in a small-world or random graph topology, but virus defense is more effective in a power-law topology [21]. In addition, sending viruses via e-mail does not require \"holes\" in the operating system or software [22]. Protecting a computer system from malicious attacks is a major challenge for network security and management. Such attacks are due to the spread of malware. A detailed explanation of the malware classification is provided by [PERSON] and [PERSON] [23]. [PERSON] et al. [24] suggested several different classifiers and a set classifier to classify files as malware or benign. The frequency and infectivity of malware epidemics have increased dramatically in recent years, posing a significant threat to network infrastructure. As mentioned before, there are mainly two types of malware that are classified according to how they are spread: active worm networks, such as Sapphire and Morris that exploit malicious code of self-propagation [24], and viruses, such as Melissa and Concept, which rely on human interactions to spread [25]. A recent malware investigation focuses primarily on modeling the spread of malware using a random scan format [26, 27, 28]. Malicious software may use other scanning methods. For example, the Morris worm uses a topographic scan, which examines local configuration files to find potential target neighbors [29]. Topological scanning is a potential thread of network routing infrastructure, global web networks and peer-to-peer systems [17], where topologies play an important role in the spread of malware [30]. The Markov model incorporates the simplest spatial dependence, which is guided by the Bethe approach used in graphical models [31]. The spatial Markov assumption factorizes an exact joint probability distribution into a form that only depends on one-node and two-node marginal probabilities.