# Reliability Evaluation for Clustered WSNs under Malware Propagation
## 4 A Strategic Malware-Infection Game to Obtain the Infection Probability
However, no IDS can entirely detect all current and future malware: all IDSes have true positive rates and false positive rates. Next, we consider these two rates as defining the payoffs of _malware_ and _system_ and we let \(\alpha\) and \(\beta\) be the true positive rate and the false positive rate of the WSN IDS, respectively. We also let \(c_{I}\) and \(c_{D}\) be the cost of player _malware_ infecting a susceptible sensor node and player _system_ detecting the _malware_'s infection, respectively. Obviously, there are four possible payoffs constructing the payoff matrix, since each of _malware_ and _system_ has two possible actions. For the action profile (_Infect_, _Defend_), player _malware_ will obtain gain \((1-\alpha)\omega\) from detection failure as well as loss \(\alpha\omega\) from being detected successfully and loss \(c_{I}\) from adopting action _Infect_. Thus, the payoff of player _malware_, \(u^{1}_{ID}\), is:  
\[u^{I}_{ID}=(1-\alpha)\omega-\alpha\omega-c_{I}=(1-2\alpha)\omega-c_{I} \tag{2}\]  
On the other hand, player _system_ obtains gain \(\alpha\omega\) as well as loses \((1-\alpha)\omega\) from detection failure, \(\beta\omega\) from false positive detection, and \(c_{D}\) from detecting _malware_'s infection. Thus, the payoff of player _system_, \(u^{S}_{ID}\), is:  
\[u^{S}_{ID}=\alpha\omega-(1-\alpha)\omega-\beta\omega-c_{D}=(2\alpha-1-\beta) \omega-c_{D} \tag{3}\]  
For the action profile (_Infect_, _Non-defend_), player _malware_ obtains gain \(\lambda\omega\) from successful infection and loses \(c_{I}\) from adopting action _Infect_. Thus, the payoff of player _malware_, \(u^{I}_{I\phi}\) is:\[u^{I}_{i\phi}=\lambda\omega-c_{I} \tag{4}\]  
whereas the payoff of player _system_, \(u^{S}_{i\phi^{\prime}}\) is:  
\[u^{S}_{i\phi}=-\lambda\omega \tag{5}\]  
For the action profile (_Non-infect_, _Defend_), the payoff of player _malware_, \(u^{I}_{\phi D^{\prime}}\), is:  
\[u^{I}_{\phi D}=0 \tag{6}\]  
whereas the payoff of player _system_, \(u^{S}_{\phi D}\), is:  
\[u^{S}_{\phi D}=-\beta\omega-c_{D} \tag{7}\]  
Finally, for the action profile (_Non-infect_, _Non-defend_), since neither player _malware_ nor player _system_ can obtain any gain or produce any loss, the payoff of player _malware_, \(u^{I}_{\phi\phi^{\prime}}\) is:  
\[u^{I}_{\phi\phi}=0 \tag{8}\]  
and the payoff of player _system_, \(u^{S}_{\phi\phi}\), is:  
\[u^{S}_{\phi\phi}=0 \tag{9}\]  
Table 1 summarizes our defined payoff matrix. The objective of player _malware_ is to maximize its expected infection utility, whereas the objective of player _system_ is to minimize its expected defense utility. This objective can be achieved by solving the mixed-strategy Nash Equilibrium (NE) of the strategic game. **Theorem 1**. : _In the SMIG, the optimal probability of player malware choosing action Infect is:_  
\[\rho^{*}_{I}=\frac{\beta\omega+c_{D}}{(\lambda+2\alpha-1)\omega} \tag{10}\]  
**Proof:** Under player _malware_'s mixed strategy, player _system_'s expected payoffs for choosing actions _Defend_ and _Non-defend_ are:  
\[u^{I}_{ID}=(1-\alpha)\omega-\alpha\omega-c_{I}=(1-2\alpha)\omega-c_{I} \tag{2}\]0  
and:  
\[u^{I}_{ID}=(1-\alpha)\omega-\alpha\omega-c_{I}=(1-2\alpha)\omega-c_{I} \tag{2}\]1  
respectively. From the indifference between actions _Defend_ and _Non-defend_ under the optimal mixed strategy of player _system_, we obtain:  
\[u^{I}_{ID}=(1-\alpha)\omega-\alpha\omega-c_{I}=(1-2\alpha)\omega-c_{I} \tag{2}\]2  
Therefore, the optimal probability of player _malware_ choosing action _Infect_ is: \begin{table}
\begin{tabular}{c c c} \hline \hline  & _Defend_ & _Non-Defend_ \\ \hline
\begin{tabular}{c c} _Infect_ & \((1-2\alpha)\omega-c_{I}\), \((2\alpha-1-\beta)\omega-c_{D}\) & \(\lambda\omega-c_{I}-\lambda\omega\) \\ _Non-infect_ & \(0\), \(-\beta\omega-c_{D}\) & \(0\), \(0\) \\ \hline \hline \end{tabular}
\end{table} 
Table 1: The payoff matrix of the SMIG.