# Markov-Based Malware Propagation Modeling and Analysis in Multi-Layer Networks
## 3 Malware Propagation Modeling in Multi-Layer Networks
### Modeling Malware Propagation via a Markov Random Field
An RF \(X\) is called a Gibbs Random Field (GRF) if it satisfies:  
\[\mathbb{P}(X=\mathbf{x})=\frac{1}{Z}e^{-\frac{U(\mathbf{x})}{T}}, \tag{5}\]  
where \(Z:=\sum_{\kappa\in\Lambda^{\pi}}e^{-\frac{U(\mathbf{x})}{T}}\) is called the partition function and \(T\) is called the temperature of the system. \(U(\mathbf{x})\) is the general potential function mentioned above. It is not unique. The approach works as follows. In each iteration, each node is visited once according to a specific visiting scheme, and the status of each site is updated according to its neighboring situations, depending on its possible operation. The process is repeated for a number of scans \(s\) until the system converges to its steady state. Before this iterative process, a temperature \(T(\cdot)=T(s)\) and the maximum number of scans \(s\) are selected. SA requires a gradual reduction in temperature as the simulation progresses, so that the system initially wanders to a wide area of the search space that contains good candidate solutions. It then drifts to low-energy areas and finally downhill according to the steepest heuristic descent. For each node, a binary decision is made as to whether its status will remain the same for the next scan or change. For every possible value of each state \(l\in\Lambda_{\kappa}\), where \(\Lambda_{\kappa}\) is the phase space of the node \(\kappa\), the potential function for each position \(\kappa\), \(\Phi_{\kappa}(x_{k}^{l})=\Phi_{x}(x_{\kappa})=l,x_{\kappa}^{\prime}:x^{\prime} \in N_{\kappa}\), depends only on the state of node \(k\) and the states of all neighboring sites \(x^{\prime}\in N_{k}\). The decision for the next state of each node can be made according to the following probability:  
\[\Pr(x_{k}=\ell)=\frac{e^{-\frac{\Phi_{k}\left(x_{k}^{(\ell)}\right)}{T(n)}}}{\sum \limits_{\ell^{\prime}\in\Lambda_{k}}e^{-\frac{\Phi_{k}\left(x_{k}^{(\ell^{ \prime})}\right)}{T(n)}}}. \tag{6}\]  
Thus, with the above probability, the next state of node \(k\) will be \(\ell\). Given that \(\Lambda_{k}=\{1,0\}\) in our case, corresponding to infected and non-infected (susceptible) states, the above can be written in a simpler general form:  
\[\Pr(x_{k}=\ell)=\frac{1}{1+e^{-\frac{\Phi_{k}\left(x_{k}^{(\ell^{\prime})} \right)-\Phi_{k}\left(x_{k}^{(\ell)}\right)}{T(n)}}}, \tag{7}\]  
where \(\ell,\ell^{\prime}\in\{0,1\}\) and \(\ell\
eq\ell^{\prime}\). Taking into account the values of the phases in the defined phase space, we have chosen the following potential function expressions:  
\[\Phi_{k}(x_{k}^{(0)})=-J\sum\limits_{k^{\prime}\in\mathcal{N}_{k}}\sigma_{k} \sigma_{k^{\prime}}=-J\sum\limits_{k^{\prime}\in\mathcal{N}_{k}}x_{k}x_{k^{ \prime}}=0, \tag{8}\]  
\[\Phi_{k}(x_{k}^{(1)})=-J\sum\limits_{k^{\prime}\in\mathcal{N}_{k}}\sigma_{k} \sigma_{k^{\prime}}=-J\sum\limits_{k^{\prime}\in\mathcal{N}_{k}}x_{k}x_{k^{ \prime}}=-J\sum\limits_{k^{\prime}\in\mathcal{N}_{k}}x_{k^{\prime}}, \tag{9}\]  
which yield the following expressions for the node state probabilities:  
\[\Pr(x_{k}=1) = \frac{1}{1+e^{-J\frac{\sum\limits_{k^{\prime}\in\mathcal{N}_{k} }x_{k^{\prime}}}{T(n)}}}, \tag{10}\] \[\Pr(x_{k}=0) = 1-\Pr(x_{k}=1)=\frac{1}{1+e^{J\frac{\sum\limits_{k^{\prime}\in \mathcal{N}_{k}}x_{k^{\prime}}}{T(n)}}}. \tag{11}\]  
The annealing pattern is chosen as \(T(s)=\frac{c_{0}}{logn}\), where \(c_{0}\) is a constant (\(c_{0}=1000\)) that affects the convergence and accuracy of the model. Higher values \(J/c_{0}\) correspond to more vulnerable topologies where malware spreads more easily, while lower values correspond to more powerful ones. The maximum number of scans is selected as \(s=2000\). Such a number ensures that the sampling process converges to the steady-state system with a high probability, which is verified by ensuring that the system state remains unchanged for a number of consecutive scans. The selected parameter ensures this for all scenarios, as they proved to be sufficient even for smaller values \(s\), e.g., \(s=1000\) or \(1500\) scans.