# Teletraffic Analysis of DoS and Malware Cyber Attacks on P2P Networks under Exponential Assumptions
## 5 Mathematical Model
### Markov Chain with a DoS Attack  
In this attack, nodes are unable to communicate, preventing resources from sharing with other peers. Building on this, the Markov chain that captures the main dynamics of this system is given the following valid state space \((X_{n},X_{d},Y_{n},Y_{d})\) for \((\Omega_{X_{n},X_{d},Y_{n},Y_{d}}\mid X_{n},X_{d},Y_{n}\leq 0,Y_{n}\leq 1)\) where \(X_{n}\) and \(Y_{n}\) (\(X_{d}\) and \(Y_{d}\)) are the leechers and seeds without an attack (under the DoS attack). From this, when the system is in the state \((X_{n},X_{d},Y_{n},Y_{d})\), the possible transitions are shown in Figure 7 and are described as follows:  
* To the state \((X_{n}+1,X_{d},Y_{n},Y_{d})\) at the rate \(\lambda\) when a new leecher arrives. We assume that new peers are not under the DoS attack.
* To the state \((X_{n}-1,X_{d},Y_{n},Y_{d})\) when a leecher without an attack leaves the system at the rate \(X_{n}\theta\).
* To the state \((X_{n},X_{d}-1,Y_{n},Y_{d})\) when a leecher under attack leaves the system at the rate \(X_{n}\theta_{d}\). In this case, we assume that a leecher that realizes that it cannot communicate may choose to leave the system as soon as it detects a possible attack or perceives a malfunction by maybe trying to reset the communication device or leaving the system to re-enter at a future time. As such, the node may leave the system earlier than usual; then, \(\theta_{d}>\theta\).
* To the state \((X_{n}-1,X_{d},Y_{n}+1,Y_{d})\) when a leecher without an attack downloads the complete file and becomes a seed. Indeed, if this peer is not under attack while downloading the file, it is very likely that it will remain in the same conditions when it finishes its download process. This occurs at the rate \(\tau=\min[CX_{n},\mu(\eta X_{n}+Y_{n})]\). It is important to note that only peers without an attack can share their resources, while nodes under the DoS are not considered in the communication bandwidth. Additionally, only the leechers without an attack can become seeds, which explains the left side of this rate.
* To the state \((X_{n},X_{d},Y_{n}-1,Y_{d})\) at the rate \(Y_{n}\gamma\) when a seed without an attack leaves the system.
* To the state \((X_{n},X_{d},Y_{n},Y_{d}-1)\) at the rate \(Y_{d}\gamma\) when a seed that is being attacked leaves the system. In this case, since the peer has already downloaded the file, it may not detect an ongoing attack. As such, the departure rate remains the same as seeds without any attacks.
* To the state \((X_{n}-[X_{n}\delta^{l}],X_{d}+[X_{n}\delta^{l}],Y_{n}-[Y_{n}\delta^{s}],Y_{d }+[Y_{n}\delta^{s}])\) when a portion of new peers get attacked. Hence, in the case that a malicious node generates a spurious signal in a given area, some nodes inside this region can be leechers (in this case \(\delta^{l}\)), and some other nodes can be seeded (\(\delta^{s}\) in this model).
* To the state \((X_{n}+[X_{n}\delta^{l}],X_{d}-[X_{n}\delta^{l}],Y_{n}+[Y_{n}\delta^{s}],Y_{d }-[Y_{n}\delta^{s}])\) when the attacker desists its attack in some region. We consider that the average attack time is \(1/\Delta\). Then, this occurs at the rate \(I(X_{d},Y_{d})\Delta\) where \(I(X_{d},Y_{d})\) is an indicator function (the end of an attack can only occur if an attack is present in the system) given as: \[I(X_{d},Y_{d})=\begin{cases}0\text{ if }&X_{d}\text{ or }Y_{d}=0\\ 1\text{ if }&X_{d}\text{ or }Y_{d}\
eq 0\end{cases}\]