# Markov-Based Malware Propagation Modeling and Analysis in Multi-Layer Networks
###### Abstract  
In this paper, we focus on the dynamics of the spread of malicious software (malware) in multi-layer networks of various types, e.g., cyber-physical systems. Recurring malware has been one of the major challenges in modern networks, and significant research and development has been dedicated to mitigating it. The majority of relevant works has focused on networks characterized by \"flat\" topologies, namely topologies in which all nodes consist of a single layer, studying the dynamics of propagation of a specific threat or various types of malware over a homogeneous topology. As cyber-physical systems and multi-layer networks in general are gaining in popularity and penetration, more targeted studies are needed. In this work, we focus on the propagation dynamics of recurring malware, namely Susceptible-Infected-Susceptible (SIS type) in multi-layer topologies consisting of combinations of two different types of networks, e.g., a small-world overlaying a random geometric, or other such combinations. We utilize a stochastic modeling framework based on Markov Random Fields for analyzing the propagation dynamics of malware over such networks. Through analysis and simulation, we discover the most vulnerable and the most robust topology among the six considered combinations, as well as a result of rather practical use, namely that the denser the network, the more flexibility it provides for malware mitigation eventually. complex networks; multi-layer networks; malware spread; Markov Random Fields (MRF); network resilience +
Footnote †: journal:  
0000-0001-4500-5500][PERSON]. [PERSON] 0000-0002-0002-0002-0003][PERSON]. [PERSON] 0000-0002-0002-0003-0002-0003][PERSON]. [PERSON] 0000-0002-0003-0002-0003-0003][PERSON]. [PERSON] 0000-0002-0002-0003-0003-0003-0003-000  
However, the proliferation of such systems has attracted malicious activity as well, which has been expressed in different forms of spreading malware across network topologies and devices, calling for accurate modeling, capable of yielding epidemic control tools. Multi-layer networks face higher attach potentials than single-layer (\"flat\") topologies. Each node in each layer is a potential attack seed, and vice-versa, each node in each layer may be reached eventually by malicious nodes in other layers. Thus, the degrees of freedom of a potential attacker increase, and it is necessary to reconsider various malware propagation modeling approaches with respect to their potential in multi-layer networks. Along these lines, in this work, we are interested in investigating such a research problem for a specific malware propagation modeling approach, and we investigate its behavior and modeling potentials in multi-layer networks. We adopt a macroscopic view of malware propagation, focusing on whether each device/software agent is infected or not within a longer period of time, and we focus specifically on the modeling and analysis of malware in two-layer networks. Such networks are good representatives of cyber-physical systems, and thus, our study here can be equally considered as a macroscopic malware modeling study in cyber-physical topologies of various types. A cyber-physical system is represented as a two-layer network, and in our case, malware propagation is modeled via a Markov Random Field (MRF). MRFs are stochastic spatial (or graphical) models; they have been used extensively for image processing and have recently been proposed for macroscopic modeling of malware propagation in \"flat\" networks of various types of topologies as well [2]. In this work, we propose the use of the MRF framework for modeling malware propagation in multi-layer networks and more specifically cyber-physical systems (two-layer networks) for the first time. We study the properties and characteristics of propagation in topologies consisting of different types of topologies, e.g., cyber-physical networks combining different types of topologies, such as random with power-law, random geometric graph, random graph, small-world, scale-free and regular.