# Reliability Evaluation for Clustered WSNs under Malware Propagation
## 4 A Strategic Malware-Infection Game to Obtain the Infection Probability  
We employ a strategic game to predict the malware's infection behavior, namely obtaining the probability \(\rho_{I}\). We adopt game-theoretic analysis as the following dilemma arises: the malware attempts to infect as many sensor nodes as possible without detection, whereas the defender attempts to enhance the network robustness by detecting more malware. Facing this dilemma, we introduce players _malware_ and _system_ to play the strategic game. Even though there are various kinds of malware whose goals may be to eavesdrop on private sensed data or to disable communication among sensor  
Figure 1: A CTMC that illustrates the state transition of a sensor node. nodes, it is sufficient to regard all malware as player _malware_ due to malware's similar motivations and skills. Player _system_, the opponent of _malware_, actually corresponds to IDSes residing in WSNs. In practice, iterations of the strategic game can be depicted as follows. There are discrete periods of time in which player _malware_ launches infection. Player _system_ intends to prevent infection in any of these periods. In each period, each player has two actions: player _malware_ can either infect or not infect while player _system_ can either defend or not defend. But each player can choose only one action with either pure or mixed strategies. If player _malware_ takes no action and player _system_ does not defend, then the game enters the next stage. Next, we formally define our strategic game and we explore the game entirely from _malware_'s view, since the target of our strategic game is to predict the infection intention of player _malware_ and not to obtain the optimal defense strategies for player _system_. **Definition 1**. : _The Strategic Malware-Infection Game (SMIG) is formulated by a 4-tuple \(\mathbb{G}=(\mathcal{N},\mathcal{A}_{M},\mathcal{A}_{S},\mathcal{U})\), where:_  
* \(\mathcal{N}=\{\textit{malware},\textit{ system}\}\) _is a set of players;_
* \(\mathcal{A}_{M}=\{\textit{Infect}\ \left(I\right),\ Non-\textit{infect}\ \left(\phi\right)\}\) _is a set of actions performed by player_ malware;
* \(\mathcal{A}_{S}=\{\textit{Defend}\ \left(D\right),\ Non-\textit{defend}\ \left(\phi\right)\}\) _is a set of actions performed by player_ system;
* \(\mathcal{U}:\mathcal{A}_{M}\times\mathcal{A}_{S}\mapsto\mathbb{R}\) _is a payoff matrix._  
Let \(\rho_{I}\) and \(\rho_{\phi}\) be the probabilities that player _malware_ adopts actions _Infect_ and _Non-infect_, respectively. Let \(\delta_{D}\) and \(\delta_{\phi}\) be the probabilities that player _system_ adopts actions _Defend_ and _Non-defend_, respectively. Accordingly, infection strategy \(\rho\) and defense strategy \(\delta\) are mixed strategies \((\rho_{I},\rho_{\phi})\) and \((\delta_{D},\delta_{\phi})\), which represent the probability distributions over action sets \(\mathcal{A}_{M}\) and \(\mathcal{A}_{S}\), respectively. Both of them certainly satisfy \(\rho_{I}+\rho_{\phi}=1\) and \(\delta_{D}+\delta_{\phi}=1\). Actually, the infection probability \(\rho_{I}\) describes the degree of infection for a sensor node (equivalently, the aggressiveness of player _malware_ targeting a sensor node). The larger \(\rho_{I}\) is, the greater the probability of action _Infect_ and, hence, the larger the corresponding infection rate for a sensor node. Now we consider the payoff matrix to explore _malware_'s motivation. For simplicity, we denote the worth of a sensor node by \(\omega\), where \(\omega>0\). Actually, \(\omega\) is equivalent to a degree of damage such as the loss of sensed data, loss due to compromise, and so on. If player _malware_ infects successfully, it will obtain payoff \(\omega\) and its opponent will obtain payoff \(-\omega\). On the contrary, if player _system_ succeeds in defense, its payoff is \(\omega\) because it has protected a sensor node worth \(\omega\) and player _malware_ will be penalized by \(\omega\).