# Reliability Evaluation for Clustered WSNs under Malware Propagation
## 3 Modeling State Transitions of a Sensor Node as a CTMC  
The various epidemic-malware propagation models mentioned above are actually state transition models. These states are mutually exclusive: a sensor node is in exactly one state at any time. During its lifecycle, a sensor node interchanges among different states. Figure 1 illustrates a CTMC indicating state transitions of a sensor node, where \(p_{ij}\), \(i\), \(j\in\{S,\ \widehat{S},\ I,\ \widehat{I},\ R,\ \widehat{R},\ D\}\), denotes the transition rate from state \(i\) to state \(j\), and \(S,\ \widehat{S},\ I,\ \widehat{I},\ R,\ \widehat{R}\), and \(D\) denote states _Susceptible_, _Susceptible_ while _sleeping_, _Infected_, _Infected_ while _sleeping_, _Recovered_ while _sleeping_, and _Dead_, respectively. Each sensor node's characteristics determine its state. State \(S\) denotes a sensor node that works normally and is not infected by malware, but it is susceptible to malware. \(\widehat{S}\) denotes a sleeping sensor node that malware cannot infect although the node is susceptible. \(I\) denotes a sensor node that has been infected by malware and may propagate malware to neighboring nodes with which it communicates as it is under the malware's control. \(\widehat{I}\) denotes an infected sensor node that is sleeping; thus, it cannot propagate malware. \(R\) denotes a \"recovered\" node that can be \"immunized\" to current malware, but not to future malware. \(\widehat{R}\) denotes a recovered node that is sleeping. \(D\) denotes a node that is unusable because malware exhausted its energy, deliberately destroyed it, or both.  
In practice, behaviors of both sensor nodes and malware trigger each state transition. For each sensor node, installing security patches is a normal method to either prevent susceptible nodes from known malware by fixing bugs or to remedy an infected node and immunize it to known malware. Thus, this action results in the state transitions \(S\to R\) and \(I\to R\). In general, each node is scheduled to sleep, which saves energy, or to awaken, which leads to the state transitions \(S\rightarrow\widehat{S}\) or \(\widehat{S}\to S\). The state transitions \(I\rightarrow\widehat{I}\) or \(\widehat{I}\to I\) as well as \(R\rightarrow\widehat{R}\) or \(\widehat{R}\to R\) follow likewise. When confronting unknown malware, a sensor node usually lacks immunity, and the state transition \(R\to S\) follows. In addition, the state transitions \(S\to D\), \(\widehat{S}\to D\), \(I\to D\), \(\widehat{I}\to D\), \(R\to D\), and \(\widehat{R}\to D\) take place when malware exhausts a sensor node's energy. On the other hand, contamination by malware leads to the state transition \(S\to I\). Moreover, malware can deliberately destroy an infectious sensor node besides the case of death from energy exhaustion; hence, the state transition \(I\to D\) occurs.  
However, the state transition \(S\to I\) cannot be formulated as a stochastic process because the infection behavior resulting in this transition is deliberate. Even though the time to execute action _Infect_ is stochastically distributed, the decision to execute the actual infection is not. Since malware decides whether to infect a susceptible sensor node, there is an infection probability that malware determines to execute infection. We let \(\rho_{I}\) be the probability that the malware will choose action _Infect_ to propagate itself and \(\lambda\) be the probability of a successful infection in order to formalize the malware's decision. Thus, the infection rate (_i.e._, the state transition rate) from state \(S\) to state \(I\) becomes:  
\[p_{SI}=\rho_{I}\lambda \tag{1}\]  
By introducing the infection probability \(\rho_{I}\), we can model the consequence of a successful infection as one deliberate state transition of the CTMC, which describes the dynamics of a sensor node's behavior. In this manner, our modeling approach concentrates on the higher-level effects of infection on a sensor node rather than the lower-level specific infection procedures.