# Markov-Based Malware Propagation Modeling and Analysis in Multi-Layer Networks
## 2 Related Work
Theoretical analyses and extensive simulations in real and synthetic topologies of large networks have been performed. The results show that the Markov model equipped with the simple spatial dependence can achieve greater accuracy than the independent model, especially in sparse graphs [21]. An overview of Markov Random Fields is presented in [32]. Various approaches have been proposed for modeling and simulating malware spreading over different topologies. [PERSON] and [PERSON] presented an epidemiological model, which is suitable for analyzing the spread of viruses in random graphs [33]. [PERSON] et al. analyzed malware that spread to small global topologies using a variation of the influence model, where the influence of neighbors is limited to taking a polyline format [25]. [PERSON] et al. studied the epidemic spread in complex networks [34], and [PERSON] et al. proposed a model for virus propagation in arbitrary topologies [35]. [PERSON] et al. and [PERSON] et al. investigated the effect of topology and immunization on the spread of computer virus through simulation [36, 30]. [PERSON] et al. modeled the spread of an epidemic as a contact process to study how it works, whether it is weak or strong [37]. The model assumes that a vulnerable node can be infected by its infected neighbors at a rate commensurate with the number of infected neighbors. [PERSON] et al. in a recent study focused on the spread of randomly crawling worms. A model of the spread of Code Red worm, taking into account human countermeasures and the impact of the worm on the Internet infrastructure, was proposed in [27]. [PERSON] et al. studied the proliferation of active worms using random scanning and extended the proposed modeling method to investigate the spread of localized scan worms [28]. [PERSON] et al. applied the epidemiological model to investigate the requirements for limiting the self-propagating worm by randomly selecting a target [26]. Due to the rapid development of complex communication networks, the need to protect the networking infrastructure from malicious software attacks has increased. In [2], a spatio-stochastic framework based on Markov Random Field (MRF) is proposed for modeling the macroscopic behavior of a complex communication network under random attack, where malicious threats propagate through direct interactions and follow the paradigm of Susceptible-Infected-Susceptible infections. Through the MRF framework, a detailed study of the dynamic propagation is performed in different topologies of complex communication networks, for example grid topology, random, scale-free, small-world and random geometric graphs. Combining Gibbs sampling with simulated annealing, the behavior of the above systems for various parameters related to topological and malicious programs in relation to the general random attacks under consideration was studied. Random networks have been shown to be more powerful, followed by scale-free, regular and small-worlds, while multihop seems to be the most vulnerable of all. The role of topology depends on the spread of malware, [38]. A tail-based framework was developed in [39] for multi-layer wireless networks and used in [40, 41] to analyze attack strategies using topology control [42]. The MRF framework employed in this paper focuses on similar objectives but assumes arbitrary complex communication network topologies in a unified manner. Several other projects have identified the importance of controlling topology in the spread and mitigation of malware on wireless and social networks. In [43, 44], the concept of differentiating wireless transmission power for effective defense design in conjunction with optimal dynamic epidemic control was adopted and examined. Contrary to that, our approach focuses on the study of general malware that spreads with repetitive behavior against arbitrary topologies. The MRF framework is different, as it can deal more holistically with different topologies and application scenarios, inherently integrating topology information into the MRF framework.