# Variance of the Infection Number of Heterogeneous Malware Spread in Network
## 3 Methodology  
### Theory Framework  
We consider a Markov process representing the SIS process in a network with a finite size, where the topology of the network is specified by an undirected and unweighted graph \(G\). The size \(N\) of a graph \(G\) denotes the number of nodes belonging to \(G\). We denote by \(A\) the adjacency matrix of the topology, where an element \(a_{ij}\) of the matrix is equal to \(1\) if the connection between nodal pair \(i\) and \(j\) exists or \(0\) if the connection does not exist. The degree \(d_{i}\) of the node \(i\) is usually defined as \(d_{i}=\sum_{j=1}^{N}a_{ij}\). Each node \(i\) could be in one of two states at a time \(t\): the infected state, meaning that the node is capable of infecting others, or the susceptible state, meaning that the node is healthy but susceptible to infection. The infected state and the susceptible state of the node \(i\) are denoted by \(I\) or \(S\), respectively. The heterogeneous NIMFA is rehearsed in the following. At time \(t\), the viral state of a node \(i\) is represented by a Bernoulli random variable \(X_{i}(t)\in\{0,1\}\). The viral state of the node \(i\) could either be the infected state with probability \(v_{i}(t)=\Pr[X_{i}(t)=1]\), or the susceptible state with probability \(1-v_{i}(t)=1-\Pr[X_{i}(t)=1]\). Assuming there is a link between an infected node \(i\) and a susceptible node \(j\), the infection process per link connecting an infected node and a susceptible node is a Poisson process with rate \(\beta_{i}\), as shown in Figure 1a. The infection process for each nodal pair of infected nodes and one of its neighbors is independent. Any infected node \(i\) will achieve recovery with rate \(\delta_{i}\). If the node \(i\) recovers, the viral state of node \(i\) becomes \(X_{i}=0\) from \(X_{i}=1\). This is called the curing process for the infected node \(i\), which is a Poisson process with rate \(\delta_{i}\), as shown in Figure 1b. The curing process for each node is independent. The heterogeneous SIS epidemic process is composed of all curing processes and infection processes in a given finite-size network. It is useful to introduce the notation \(\tau_{i}\), named the effective infection rate, defined as \(\tau_{i}=\beta_{i}/\delta_{i}\). At time \(t\), the number of infected nodes and the expected fraction of infected nodes are defined as \(I(t)=\sum_{i}X_{i}(t)\) and \(y(t)=\sum_{i}v_{i}(t)/N\), respectively. The steady state of the system composed of the SIS process in a given finite-size network actually corresponds to the metastable state [5]. The steady state, denoted by \(v_{i\infty}\), implies  
\[\left.\frac{v_{i}(t)}{dt}\right|_{t\rightarrow\infty}=0. \tag{1}\]  
We also denote by \(y\) or \(y_{\infty}\), and \(I\) or \(I_{\infty}\), the metastable-state fraction of infected nodes and the metastable-state number of infected nodes. The only approximation employed by the NIMFA framework leads to  
\[\Pr[X_{i}=1,X_{j}=1]=\Pr[X_{i}]\Pr[X_{j}], \tag{2}\]  
which means that the random variables \(X_{i}\) and \(X_{j}\) are assumed to be independent [5]. This assumption of independence approximation further induces  
\[E[X_{i}=1,X_{j}=1]=E[X_{i}=1]E[X_{j}=1]=v_{i}v_{j}. \tag{3}\]  
Figure 1: Schematic diagram of two independent Poisson processes of a SIS epidemic dynamic between a nodal pair in a network. The independent processes are (**a**) the infection process describing an infected node infecting its susceptible neighboring node. (**b**) The curing process describing an infected node infecting recovered individuals. The exact Markov differential equation for the viral state of node \(i\) can be expressed as  
\[\frac{d\mathbb{E}[X_{i}(t)]}{dt}=E\left[-\delta_{i}X_{i}+\sum_{j=1}^{N}a_{ij} \beta_{j}X_{j}(1-X_{i})\right]. \tag{4}\]  
Substituting (3) into (4) leads to  
\[ \begin{split}\frac{dv_{i}(t)}{dt}&=-\delta_{i}v_{i }+\sum_{j=1}^{N}a_{ij}\beta_{j}v_{j}(1-v_{i})\\ &=\sum_{j=1}^{N}a_{ij}\beta_{j}v_{j}-v_{i}\left(\sum_{j=1}^{N}a_{ ij}\beta_{j}v_{j}+\delta_{i}\right).\end{split}