# Security Threats and Cryptographic Protocols for Medical Wearables
## 3 Simulation of a Malware Attack against Medical Devices
* Human action refers to human intervention in the device functioning. * Human action level on the network: may vary according to the required patient interaction with the device or sensors. \begin{table}
\begin{tabular}{l l} \hline \hline
**Type of Agents** & **Characteristics** \\ \hline WHMS sensors & Type: Sensor or sink nodes \\  & Computational capacity: Low \\  & Energy consumption: Low or medium \\  & Capacity of transmission and reception of information: Low \\  & Security level for nodes: Low or medium \\  & Data collection method: Periodical or requested \\  & Duty cycle: Active or inactive \\ \hline Malware & Type: IoT based malware \\  & Spreading mechanisms: Self-replication, exploit, or user interaction \\  & Target: DoS/DDoS or botnet attack, or information exfiltration \\ \hline Network topology & Type: BAN \\  & Routing protocols: ATAR/WETRP, BLE/Wi-Fi/RF or Internet \\ \hline Phenomenon of interest & Risk of malware attack: medium or high \\ \hline Human action & Level: medium or high \\ \hline External devices & Risk of devices infected with malware: Low, medium or high \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Agents with their characteristics. * External devices: connections to external devices for manual data download may expose the sensors to malware. * Risk of devices infected with malware: those external devices that can connect to unsecured networks are at higher risk of exposure to malware, and therefore, if a WHMS connects to this external device, it may have a high probability of malware infection. The following values have been used for the agent characteristics in both scenarios: the computational capacity is low, the energy consumption is medium, the information transmission capacity is low, the security level ranges from low to medium, and a periodical data collection. The propagation of IoT-based malware has been simulated, using self-replication to turn the devices into a botnet. The network type for medical devices is always a personal area network; in addition, connection via BLE/Wi-Fi/RF is used for these cases. Finally, the interaction of humans with devices is high, so the risk of malware attacks is high, too, and the risk of infecting devices is also high. Considering a scenario of 10 diabetic patients using a wearable to collect temperature data from their feet, with 6 sensors (3 per foot) distributed in specific regions of interest [18], the simulation is shown in Figure 3. This simulation was made with MESA framework, Apache2 licensed agent-based modeling environment [67]. After 168 h, the number of susceptible devices decrease, and susceptible individuals increase. This behavior is even more drastic when the network is bigger. More sensors could be added to the wearable to get more measures and analyze the results. In the case of 15 diabetic patients with 17 sensors in each foot, the graph shows that the malware invades all the network. This fact can be appreciated in Figure 4, where the number of susceptible sensors decrease and after 24 h, exposed, recovered, and death sensors are bigger than susceptible ones.