# Teletraffic Analysis of DoS and Malware Cyber Attacks on P2P Networks under Exponential Assumptions
## 1 Introduction
Based on the above, in this paper, we develop a mathematical model based on Markov chains that captures the main dynamics of the system, including peer  
Figure 1: Flow chart for operation of the P2P network. arrival and exit, file downloading, and infected chunks being disseminated. In this sense, the main contributions of our work are as follows:  
* We propose an analytical framework to study the behavior of the malware attack that allows identification of the rate at which the malware is dispersed and the number of infected nodes. * We develop a mathematical analysis to study the impact of jamming the communications of a group of nodes under a DoS attack. * Based on the insight gained from the mathematical description of the attacks, we recommend the use of countermeasures to investigate the dynamics of the attack when cybersecurity measures are enabled. * We obtain the performance metrics of the system under the different attacks and different conditions of the attacks. The proposed teletraffic model is an approximation analysis for different cyber attacks on P2P systems when events occur in exponentially distributed times. Expressly, for the DoS type of attack, we assume that the attacker impairs or limits the communication capabilities of the network during exponentially distributed random times. If the attack has a random duration with distributions with a coefficient of variation (CoV) different from one (as in the case of the exponential distribution), this model is no longer accurate. However, it can be easily extended by using phase-type distributions to account for a CoV \(<1\) using an Erlang distribution or for a CoV \(>1\) using a hyper-exponential distribution, in both cases using the developed Markov chains in this work as the basic models. For the malware attack, we consider that there is an initial number of malicious peers, \(N_{I}\), that is registered in the system and that will begin the worm dissemination when the file distribution begins. These malicious nodes have the same characteristics in terms of their communication and processing capabilities. As such, the upload and download bandwidths are not different from the rest of the nodes. Whenever the system operation begins, the malicious nodes will spread the malware to any other peer in the system, and these infected peers will continue the malware propagation to other peers that connect to them, and so on. As such, the only variable of the attack is \(N_{I}\). Note that the malicious nodes cannot behave differently than regular nodes in terms of the upload and download rates because the P2P system would not be compatible, and they would not be able to communicate. If countermeasures are considered, we assume that these measures will prevent some nodes from being infected, while others would not be able to avoid infection (with the probability \(P_{I}\) in our model) since there are no completely secure cyber systems. In the case of the DoS attack, there is no malware attack, but rather some peers are unable to communicate. Hence, the model considers the portion of nodes that cannot download nor upload any chunks, \(\delta\), and the average duration of the attack, \(1/\triangle\). We believe that these are the only parameters of the attack from the standpoint of the effect on the P2P communication capabilities. In addition, in this work, we are not concerned with the computational effects of cyber attacks, i.e., the effect on electronics or computer-related processes. Indeed, our model and analysis cannot reflect these issues, as pointed out by the reviewer. Our model can only reflect the impact on the communication capabilities under the malware and DoS attacks. However, our analysis can consider different characteristics of these attacks, such as the number of initially infected nodes, the mean duration of the attacks, the efficiency of the countermeasures, and the number of nodes that cannot use their communication capabilities.