# Quarantining Malicious IoT Devices in Intelligent Sliced Mobile Networks
## Appendix A Analytical Model  
### Probability of a Flow with Malicious Devices to Be Detected in Specific Scenarios  
This appendix develops a formula tailored to scenarios where all flows containing some malicious device of type different than 0 are detected. In particular, these formulas have been used to analyze the scenario with the following configuration arised from Figure 2a:  
* \(p_{m}=0.01\)
* \(f_{m}=100\)
* \(t_{r}=1.01\)
* \(p_{t}(i)=0.25\)\(\forall i\)
* \(r(0)=2.4\) kbit/s, \(r(1)=800\) kbit/s, \(r(2)=120\) kbit/s and \(r(3)=24\) kbit/s.
* \(n<500\)  
The model builds on the fact that for this configuration, a flow containing some malicious device of type different than manufacturing cell will always be detected.  
Let us define the following list of events to be used in the formulas:  
* \(A\): A flow is detected as malicious.
* \(B\): A flow contains malicious devices.
* \(C\): A flow contains some malicious device of type different than 0 (manufacturing cell).
* \(D(i)\): A flow contains exactly \(i\) malicious devices of type 0 and no other malicious device.  
\[P(A\mid B)=P((A\cap C)\mid B)+P((A\cap C^{\prime})\mid B) \tag{1}\]  
where \(C^{\prime}\) denotes the complementary event of \(C\) and equality holds due to the law of total probability.  
\[P((A\cap C)\mid B)=\frac{P(A\cap C\cap B)\times P(B\mid(A\cap C))}{P(B)}=\frac {P(A\cap C\cap B)}{P(B)} \tag{2}\]  
where the first step holds due to [PERSON] theorem and the second step holds because \(P(B\mid(A\cap C))=1\) since flows detected as malicious always contain malicious devices (i.e., flows without malicious devices are never detected as malicious).  
\[P((A\cap C^{\prime})\mid B)=\frac{P(A\cap C^{\prime}\cap B)\times P(B\mid(A \cap C^{\prime}))}{P(B)}=\frac{P(A\cap C^{\prime}\cap B)}{P(B)} \tag{3}\]  
where the first step holds due to [PERSON] theorem and the second step holds because \(P(B\mid(A\cap C^{\prime}))=1\) since flows detected as malicious always contain malicious devices (i.e., flows without malicious devices are never detected as malicious).  
\[P(B)=P\left(\text{B}(n,p_{m})>0\right)=1-(1-p_{m})^{n} \tag{4}\]  
\[P(A\cap C\cap B)=P(A\cap C)=P(A\mid C)\times P(C)=P(C) \tag{5}\]  
where the first step holds because \(C\subset B\) and thus \(C\cap B=C\) (i.e., a flow which contains some malicious device of type different than 0 always contains malicious devices).  
\[P(C)=P\left(\text{B}\left(n,p_{m}\times\sum_{k=0}^{3}p_{t}(k)\right)>0\right) =1-\left(1-\left(p_{m}\times\sum_{k=0}^{3}p_{t}(k)\right)\right)^{n} \tag{6}\]  
\[P(A\mid C)=1 \tag{7}\]where this holds from the fact that a throughput excess of \(\min\limits_{i\
eq 0}\left(r(i)\right)\) always exceeds the threshold ratio \(t_{r}\) for our input parameters of \(p_{m}=0.01,f_{m}=100,t_{r}=1.01\ n<500\), \(p_{t}(i)=0.25\ \forall i,r(0)=2.4\,\text{kbit}/\text{s}\), \(r(1)=800\,\text{kbit}/\text{s}\), \(r(2)=120\,\text{kbit}/\text{s}\) and \(r(3)=24\,\text{kbit}/\text{s}\).  
\[P(A\cap C^{\prime}\cap B)=\sum_{i=0}^{n}P(A\cap C^{\prime}\cap B\cap D(i))= \sum_{i=1}^{n}P(A\cap D(i))=\sum_{i=1}^{n}P(A\mid D(i))\times P(D(i)) \tag{10}\]  
where the first step holds for the law of total probability and the second one holds because \(C^{\prime}\cap B\cap D(i)=D(i)\ \forall i\
eq 0\) and \(0\) for \(i=0\).  
\[P\left(D(i)\right)=\binom{n}{i}\left(p_{m}\times p_{t}(0)\right)^{i}\times(1- p_{m})^{n-i} \tag{11}\]  
\[\begin{split} P(A\mid D(i))&=\sum_{n_{0}=0}^{n} \sum_{n_{1}=0}^{n-n_{0}}\sum_{n_{2}=0}^{n-n_{0}-n_{1}}\binom{n}{n_{0}}\binom{n- n_{0}}{n_{1}}\binom{n-n_{0}-n_{1}}{n_{2}}\\ &\times(p_{t}\left(0\right))^{n_{0}}\times(p_{t}\left(1\right))^ {n_{1}}\times(p_{t}\left(2\right))^{n_{2}}\times(p_{t}\left(3\right))^{n-n_{0} -n_{1}-n_{2}}\\ &\times\left[\frac{(n_{0}\times r(0)+n_{1}\times r(1)+n_{2}\times r (2)+(n-n_{0}-n_{1}-n_{2})\times r(3))\times(t_{r}-1)}{(f_{m}-1)\times r(0)}<i \right]\end{split} \tag{12}\]  
where \([\text{expression}]\) notation refers to Iverson brackets (i.e., \([\text{expression}]\) is \(1\) if expression is true and \(0\) otherwise).