# Teletraffic Analysis of DoS and Malware Cyber Attacks on P2P Networks under Exponential Assumptions
## 5 Mathematical Model
### P2P Infected by Malware  
Based on this basic model, we now develop the Markov chain that describes the peer infection procedure. In this model, we assume that there are \(N_{i}\) malicious nodes at the beginning of the file distribution attacking the system. Furthermore, new nodes that arrive, at the rate \(\lambda\), are not infected, but, if they connect to an infected node, they become infected. For this infection model, we assume that nodes cannot be uninfected, but this restriction will be relaxed in further sections. Hence, the Markov chain that models these dynamics can be formed by four states \((X_{n},X_{i},Y_{n},Y_{i})\), where \(X_{n}:\) uninfected leechers, \(X_{n}:\) infected leechers, \(Y_{n}:\) non-infected seeds, \(Y_{i}:\) infected seeds, and the initial state is \((0,0,1,N_{i})\). Leechers (seeds), whether infected or not, can leave the system at the rate \(\theta\) (\(\gamma\)). Figure 4: Markov chain of the basic P2P system. A non-infected leecher that never downloaded a chunk from an infected peer becomes a non-infected seed at the rate \(\tau_{nn}\), given by:  
\[\tau_{nn}=\min[cP_{n}X_{n},\mu(\eta\cdot X_{n}+Y_{n})] \tag{2}\]  
where \(P_{n}\) is the probability that a peer does not get infected. Note that in order for a leecher to not get infected, all of the available uplink bandwidth, i.e., all of the resources shared with this leecher, have to be free from infected peers. Conversely, an infected leecher that downloaded chunks from infected peers at some point in the file exchange procedure becomes a seed at the rate \(\tau_{i}\)  
\[\tau_{i}=\min\left[cX_{i},\mu(\eta\cdot X+Y)\frac{X_{i}}{X}\right] \tag{3}\]  
where the total number of leechers is given by \(X=X_{n}+X_{i}\), and the total number of seeds is \(Y=Y_{n}+Y_{i}\). For this rate, note that \(cX_{i}\) is the total download rate from infected leechers downloading in abundance conditions, and, in penury, the portion of infected leechers is \(X_{i}/X\), and only infected peers are uploading to these leechers. If not, i.e., if uninfected peers were exchanging chunks, these uninfected peers would become infected. As such, the only bandwidth considered for an infected leecher to become an infected seed is: \(\mu(\eta\cdot X+Y)\frac{X_{i}}{X}\). Moreover, an uninfected leecher can become an infected seed at the rate:  
\[\tau_{ni}=\min[c(1-P_{n})X_{n},\mu(\eta\cdot X+Y)(1-P_{n})] \tag{4}\]  
In this case, the leecher managed to remain uninfected during the file downloading only until the final chunks when it becomes a seed and downloads the last chunks from an infected source. Then, the uninfected nodes (\(X_{n}\)) are the peers downloading, but they get infected in this process with the probability \((1-P_{n})\). Furthermore, unlike the case of \(\tau_{nn}\), all peers can upload the file to these leechers as long as they get infected at this point, explaining the right part of this expression. To calculate \(P_{n}\), we have to consider that the total bandwidth in the system is given by \(\mu(X\eta+Y)\), while the bandwidth provided by non-infected peers is \(\mu(X_{n}\eta+Y_{n})\), and the bandwidth provided by infected peers is \(\mu(X_{i}\eta+Y_{i})\). Then, considering that any peer can be connected to any other peer in the system, the probability that only the non-infected bandwidth is used can be expressed as:  
\[P_{n}=\frac{X_{n}\eta+Y_{n}}{X\eta+Y} \tag{5}\]  
From this, the rate at which leechers become infected during the file-sharing process before becoming seeds, i.e., considering that they can be infected by downloading any possible chunk in the file, can be written as:  
\[\tau_{c}=\min[ck(1-P_{n})X_{n},\mu k(\eta\cdot X+Y)(1-P_{n})] \tag{6}\]  
where \(k\) is the number of chunks, each of size \(B\) bytes, forming a file of size \(F\) bytes. Then, the number of chunks in a file is given by \(k=F/B\). From this, we can see that the chunk download (upload) rate is \(ck\) (\(\mu k\)), which is \(k\) times faster than the file download (upload) rate.