# Markov-Based Malware Propagation Modeling and Analysis in Multi-Layer Networks
## 5 Discussion  
In this section, we perform a cumulative comparison across the considered scenarios for the purpose of obtaining useful observations and insights. We are mostly interested in observations and their reasoning regarding the structural properties and behavioral features expressed by different types of considered topologies. The following figures present cumulative results for all considered scenarios, aiming towards comparing among the different combinations of the considered complex topologies and the extraction of longer-term useful observations. Figure 8 presents the cumulative results when N_1 = 100 nodes, Figure 9 presents the cumulative results when N_1 = 250 nodes, and Figure 10 presents the cumulative results when N_1 = 500 nodes. These three figures allow comparing the behavior of the considered scenarios and topologies with respect to the size of the first topology. The first interesting outcome is that a quite similar behavior is exhibited among the different scenarios as the first network becomes larger (and denser). This is due to the fact that some of the topologies share some common features, e.g., SW with SF, etc. The less vulnerable combination is that of RGG-SF, while the most vulnerable one being the RG-RG. The performance of the rest of the schemes performing in between these two extremes remains the same for all three values of the size of the first network. This is due to the fact that the epidemic behavior depends more on the structural properties of the corresponding topologies rather than on the exact size (density of the network). Of course, as can be observed by the three figures, there is more prominent segregation of the relative performance as the topology of the first network becomes larger. The topology determines the neighboring relations and thus defines terminally the allowed interactions and hence the allowed diffusion paths in the network. In any case, the structural feature seems to have a stronger effect than the size of the topology. Then, Figures 11-15 present similar cumulative results for the number of infected nodes when the second topology has N_2 = 100, 250, 500, 750 and 1000 nodes, respectively. Such figures allow comparing the behavior of the considered scenarios-topologies as well, this time with reference to the second topology. A similar interesting outcome, as in the  
Figure 8: Spread of malware while the nodes of the 1 st topology remain equal to N_1 = 100. Figure 9: Spread of malware while the nodes of the 1 st topology remain equal to N_1 = 250.  
previous case, is that a quite similar behavior is exhibited among the different scenarios in each figure, as the second network becomes larger (and denser). However, here, the relative ordering of the behavior of each combination changes. The more robust combination is that of RG-RG, while the most vulnerable one is the RGG-SF. The relative ordering of the performance of the schemes in between remains the same for all the considered sizes of the second topology. The reason for the repeating relative ordering is again the fact that the epidemic behavior depends more on the structural properties of the corresponding topologies rather than on the exact size (density of the network). The segregation of the relative ordering is again due to the second topology becoming more dense and thus producing more epidemic events in the corresponding scenarios. The modification in the relative ordering compared to the previous set of results is due to the nature of the type of each employed topology as second topology in the two-layer combination. Differences in the density of such topologies lead to different relative orderings. In any case, the structural feature prevails overall, having a stronger effect than the size of the topology. Through the above analysis for random attacks, it can be concluded that overall, and with gravity of importance on the factors of structural topology, the combination RGG-SF is more vulnerable.