# Threat Analysis for Smart Homes +
## 7 Network Topology Simulation  
To validate the outputs of the network topology algorithm and the attack model graph representation developed and described in Sections 5 and 6, we developed a network simulation of a smart home system. The simulation was implemented with the INET framework version 4.1.0 of OMNeT++ version 5.4.1 [39]. The simulation, based on a pre-existing configuration provided by the INET framework, consists of a hierarchical mixed wireless/wired network. Two different network configurations are used to highlight the effect of dynamic and intermittent nodes on malware propagation in a network. The first network is comprised of three areas, each containing two local area networks (LANs). Each LAN contains three heterogeneous hosts. The hosts in the LAN connect to an area router through switches. The three area routers connect to a central backbone router. The network contains three hierarchical levels, which correspond to the hosts in the LANs, the area routers, and the backbone router. In addition, two wireless access points are added to the network. The access points are connected to _area1 router_ and _area3 router_, respectively. These access points allow for wireless hosts to be connected to the network. Two wireless hosts are connected to each access point. Different Service Set Identifiers (SSIDs) are configured for the members of the two wireless LANs, so they do not communicate directly with each other. To assign IP addresses hierarchically, starting from the central router to the single hosts, the following strategy was adopted: the first octet of the address for all nodes is 10; the second octet denotes the area; the third octet denotes the LAN within the area; and the fourth octet is the host identifier within a LAN. For example, a host _host1_ found in area 3 in lan 1 would have the IP address 10.3.1.1. Figure 11 shows the configuration for the first network simulation. To visualize malware scanning and malware propagation, localized routing tables for ping communication are made. These tables determine the routes that packets have to follow when trying to reach a certain host. Packet reception is interpreted as successful malware scanning. A state variable is added to all hosts. Whenever the malware scans a certain host, the state variable is updated following the conditional probability functions of Equation (1). Whenever a host transits between two states, a message stating which state-transition the host has gone through is printed. The second network configuration modifies the behavior of certain devices in the network, to account for intermittent availability and mobility of nodes. First, shut down and startup scenarios have been scripted for \begin{table}
\begin{tabular}{c c c} \hline \hline
**State** & **Markov Model Average** & **Hybrid Model Average** \\ \hline Infected & 10.3 & 7 \\ Recovered & 2.8 & 2.8 \\ Susceptible & 1.9 & 1.2 \\ Quarantined & 5 & 5.8 \\ Intermittent & null & 3.2 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Average results of 50 simulations of the Markov model and the hybrid model. certain nodes in the network.This addition allows the implementation of intermittent availability to nodes. In particular, _area2 lan1 host3_, _area2 lan2 host1_ and _area3 switch2_ are scripted to shut down and start up sequentially after specific time intervals. Nodal mobility is also added to the previously static _area1 lan3 dynamichost1_ and _area3 lan3 dynamichost2_. A rectangular moving pattern, with constant speed and acceleration is added to these two hosts, taking them out of the range of their initial access points and into the range of another access point during the course of their movement pattern. The results of running the second configuration of the network simulation confirm that intermittent availability of nodes affects malware propagation in a way that is inversely proportional; the more intermittent nodes in a network and the longer these nodes are \"hidden\" to the malware scanning, the slower the propagation of the malware.