# Markov-Based Malware Propagation Modeling and Analysis in Multi-Layer Networks
## 3 Malware Propagation Modeling in Multi-Layer Networks
### Malware Propagation Modeling in Cyber-Physical Systems  
A cyber-physical system (CPS) consists of a physical substrate (sensor, actuator, etc.) controlled or monitored by software. In cyber-physical systems, physical and software components are capable of operating at different spatial and temporal scales. They also exhibit multiple and distinct behaviors and interact with each other in ways that change with the environment. The cyber-physical system integrates the dynamics of physical processes with those of networking and software, providing modeling, design and analysis techniques for the integrated whole. A complete cyber-physical system is usually designed as a network of interacting elements with physical input and output. The concept is closely related to the concepts of robotics and sensor networks with intelligence mechanisms suitable for computational intelligence. The cyber-physical system includes interacting digital, analog, physical and human components designed to function through integrated physics and logic. Cyber-natural systems will bring progress in personalized healthcare, emergency response, traffic flow management and electricity generation and delivery as well as in many other areas just envisioned [58, 59].  
In this work, we employ the cyber-physical paradigm as a realistic representative of a multi-layer network topology, and more specifically, a two-layer complex topology. The physical devices of the system form a topology depending on the potential interactions they may develop, while the cyber part of the system may form a separate network topology, possibly using other communication means than the one employed by the physical system. The two resulting topologies of the cyber-physical system may be completely different or exhibit correlations. In this paper, we assume that the two emerging topologies are independent as far as each separate topology is concerned (\"horizontal\" topology), while there are \"vertical\" correlations emerging between the cyber and physical part of the system, representing correlations among the two layers.  
The research so far has mainly dealt with the spread of malware on single-layer (\"flat\") topologies. Given the widespread use of computer devices and the rapid evolution of the use of the Internet in our daily lives, it makes sense to investigate the spread of malware in topologies with two or more layers (multi-layer topologies). We are focusing toward this direction, and in the following, we determine the combination of the topologies that we set [60, 61, 62]. Based on the above, it makes sense to study combinations of network topologies, which are prone to emerge in various daily-used applications in various cyber-physical systems, as we do in the following. After extracting the results, i.e., calculating the average of the infected nodes of the networks we set, we performed for each combination of topologies a graph with three curves, one for each different value of the nodes of the first topology. The nodes of the second topology are displayed on the horizontal axis, while the number obtained by dividing the number of nodes by the final infected ones is displayed on the vertical axis.