# Steady-State Availability Evaluation for Heterogeneous Edge Computing-Enabled WSNs with Malware Infections

Authors: Hong Zhang; Shumin Yang; Guowen Wu; Shigen Shen; Qiying Cao
Journal: Mobile Information Systems
 (2022)

---

## Abstract

To evaluate the steady-state availability of heterogeneous edge computing-enabled wireless sensor networks (HECWSNs) with malware infections, we first propose a Stackelberg attack-defence game to predict the optimal strategies of malware and intrusion detection systems (IDSs) deployed in heterogeneous sensor nodes (HSNs). Next, we present a new malware infection model—heterogeneous susceptible-threatened-active-recovered-dead (HSTARD) based on epidemic theory. Then, considering the heterogeneity of sink sensor nodes and common sensor nodes and the malware attack correlation, we derive the state transition probability matrix of an HSN based on a semi-Markov process (SMP), as well as the steady-state availability of an HSN. Furthermore, based on a data flow analysis of HSNs, we deduce the steady-state availability of HECWSNs with various topologies, including the star topology, cluster topology, and mesh topology. Finally, numerical analyses illustrate the influence of the IDS parameters on the optimal infection probability of malware and reveal the effect of multiple factors on the steady-state availability of HSNs, including the initial infection rate, the infection change rate, and the malware attack correlation. In addition, we present data analyses of the steady-state availability of HECWSNs with various topologies, including the star topology, cluster topology, and mesh topology, which provide a theoretical basis for the design, deployment, and maintenance of high-availability HECWSNs.


---

## Body

## 1. Introduction

In recent years, edge computing has emerged to address computation-intensive tasks in the 5G architecture [1], for which it can deploy servers at the edges of the network and provide services for the end users. This architecture is also applicable to heterogeneous wireless sensor networks (HWSNs), which enables heterogeneous sensor nodes (HSNs) to offload computation tasks to the deployment servers through the base stations [2]. In this manner, edge computing systems have begun to provide services for HWSNs to improve the performance of HSNs.With the popularity of low-budget smart sensors, HWSNs have attracted considerable attention from researchers in many fields, including smart transportation, smart grids, the military, and smart homes [3–9]. These applications make our lives more comfortable. However, HWSNs have the same deficiencies as WSNs: HSNs have limited energy, computational capacity, and storage capacity [10, 11]. The other concern is that HWSNs are vulnerable to malware attacks, and malware can damage HWSNs in many ways, which not only affects the performance of HWSNs but also renders HWSNs unable to provide normal services [12]. The steady-state availability of HECWSNs is one of the factor to evaluate its performance, which indicates the probability that HECWSNs are available or reliable when sensing data, transmitting data, and aggregating data during the long-term operation. To address these issues, we evaluate the steady-state availability of heterogeneous edge computing-enabled wireless sensor networks (HECWSNs) with malware infections.Malware refers to any malicious program with intentional attacks and serious destructive power [13–17], which causes great damage to networks, computer systems, and data [18]. Due to the limited resource allocation of HSNs [19], HECWSNs are vulnerable to malware attacks [20–22]. Once a piece of malware has attacked an HECWSN successfully through the HSN system’s security vulnerabilities, it will eavesdrop on information, block networks, wastefully spend the HSN’s energy, or compromise it [23], which can seriously corrupt and damage the HECWSN. This paper will study the service availability of HECWSNs, and it aims to judge the steady-state availability of HECWSNs by evaluating the performance of HSNs. In other words, when HECWSNs are infected by malware, we study whether the HECWSNs can reach a steady state and provide data acquisition, data transmission, and data processing services normally or not.Because malware infection in HECWSNs is similar to that of epidemic in people, the epidemic model is usually adopted for reference when establishing a malware infection model for HECWSNs [24]. The classical epidemic models include SI, SIS, and SIR [14]. For example, the SIR model classifies all nodes’ states into susceptible (S), infectious (I), and recovered (R). When a heterogeneous sensor node (HSN) in HECWSNs is attacked by malware, its state will undergo a series of changes. Based on the classical SIR epidemic model, considering the characteristics of malware hiding and acting, this paper proposes a heterogeneous susceptible-threatened-active-recovered-dead (HSTARD) model to describe the states of HSNs, which includes the states susceptible (S), threatened (T), active (A), recovered (R), and dead (D).In recent years, an increasing number of researchers have studied the problem of network security with game theory [25–28]. During the process of malware infection in HECWSNs, to defend against malware, HECWSNs use a deployed intrusion detection system (IDS) in the system of HSNs to detect malware with a certain probability [29]. The malware, to prevent detection by the IDS, will attack with a certain probability. Clearly, the attack-defence process between malware and the deployed IDS is a game problem. In this attack-defence game, the attack and defence actions initiated by the malware and IDS have priority, so it is appropriate to solve the attack-defence problem based on a Stackelberg game. Therefore, we propose a Stackelberg attack-defence game (SADG) to predict the optimal infection probability of malware, where malware is the leader and the IDS is the follower.For an HSN, its current state determines the change in the next state, independently of the previous state, which means that the HSN state transition is random. Thus, it is appropriate to describe the state transition of an HSN using a semi-Markov process (SMP). We derive the state transition probability matrix of an HSN based on an SMP and obtain the steady-state availability of an HSN.The contributions of this paper are summarized as follows:First, considering that the deployed IDS and malware are two agents, we establish an SADG to predict the optimal infection probability of malware. The SADG can reflect the influence of the real HECWSNs situation when players choose their strategies.Second, considering the characteristics of malware hiding and acting, we propose an HSTARD model by adding the statesthreatened, active, and dead to the classical epidemic model SIR. The HSTARD model can not only reflect the latent characteristics of malware but also consider the influence of the optimal defence strategy of the IDS on malware infection.Third, considering the heterogeneity of HSNs and malware attack correlations, which will jointly affect the vulnerability of HSNs, we derive the state transition probability matrix of an HSN based on an SMP. We also derive the steady-state availability of an HSN, which not only reflects the characteristics of sensor node heterogeneity but also reflects the influence of the number of malware attacks on the state of HSNs.Fourth, considering the topological heterogeneity of HECWSNs, we derive the steady-state availability of HECWSNs with various topologies, including the star topology, cluster topology, and mesh topology. The steady-state availability evaluation of HECWSNs can provide a theoretical basis for the design, deployment, and maintenance of high-availability HECWSNs.The rest of the paper is organized as follows: Section2 describes related work. Section 3 predicts the optimal infection probability of malware based on an SADG. Section 4 describes the dynamic state transition of an HSN and proposes an HSTARD model. Section 5 derives the steady-state availability of an HSN using an SMP. Section 6 describes the steady-state availability of HECWSNs with various topologies, including the star topology, cluster topology, and mesh topology. Section 7 describes the analysis of the experimental data. Section 8 summarizes this paper.To facilitate understanding of this paper, all symbols used are listed in Table1.Table 1
Symbols.
SymbolDescriptionHNumber of HSNs in HECWSNs infected by malware.GState set of an HSN in HECWSNs infected by malware.pxtProbability of an HSN being in statex at time t.pxytProbability of an HSN changing from statex to y at time t.kDegree of an HSN.βkInitial infection probability of an HSN with degreek.nNumber of neighbour nodes inactive state of an HSN.LNumber of malware attacks on an HSN.αOptimal infection probability of malware.φDeath probability of an HSN.θUpdate probability of dead HSNs.δProbability of an HSN changing from stateR to S.ξDetection rate of the IDS.vxProbability of an HSN transitioning into statex.πxSteady-state probability of an HSN staying in statex.PState transition matrix of an HSN.AjhkSteady-state availability of an HSN with degreek of type h with topology j.XsTotal number of common sensor nodes connecting to a sink sensor node in HECWSNs with star topology.msMinimum number of common sensor nodes connecting to a sink sensor node in HECWSNs with star topology.NsNumber of common working sensor nodes connecting to a sink sensor node in HECWSNs with star topology.AsskSteady-state availability of a sink sensor node with degreek in HECWSNs with star topology.AStarSteady-state availability of HECWSNs with star topology.XcsTotal number of common sensor nodes connecting to a cluster sensor node in HECWSNs with cluster topology.AccSteady-state availability of a cluster head node in HECWSNs with cluster topology.AccsSteady-state availability of a common sensor node in a cluster in HECWSNs with cluster topology.AclustersinkSteady-state availability of a sink sensor node in HECWSNs with cluster topology.XcTotal number of cluster head nodes connecting to a sink sensor node in HECWSNs with cluster topology.mcMinimum number of cluster head nodes to which a sink sensor node needs to connect in HECWSNs with cluster topology.NcNumber of cluster head working nodes connecting to a sink sensor node in HECWSNs with cluster topology.AClusterSteady-state availability of HECWSNs with cluster topology.XmeshcTotal number of common sensor nodes connecting to a sink sensor node in HECWSNs with mesh topology.mmeshncMinimum number of common sensor nodes to which a sink sensor node needs to connect in HECWSNs with mesh topology.NmeshcNumber of common sensor nodes connecting to a sink sensor node in HECWSNs with mesh topology.XmeshsTotal number of sink sensor nodes in HECWSNs with mesh topology.mmeshnsMinimum number of sink sensor nodes that are required for normal work in HECWSNs with mesh topology.NmeshsNumber of sink working sensor nodes in HECWSNs with mesh topology.AmeshcSteady-state availability of a common sensor node in HECWSNs with mesh topology.AmeshsSteady-state availability of a sink sensor node in HECWSNs with mesh topology.AMeshSteady-state availability of HECWSNs with mesh topology.


## 2. Related Work

Edge computing helps improve computing efficiency and reduce the network transmission delay. Therefore, edge computing is widely used in 5G architecture, Internet of Things, and intelligent vehicle networking. Xiao et al. [30] presented reinforcement learning for edge computing to avoid jamming attacks and interference. Xu [31] used mobile edge computing technology to manage digital communities. Rimal et al. [32] discussed mobile edge computing’s potential service scenarios and designed scenarios for mobile edge computing over Wi-Fi networks. Corcoran and Soumya [33] discussed edge computing that was suitable for real-time operation and low latency requirements, which extended computing capabilities and services to the edge of the network.At present, researchers have presented many extended epidemic models for WSNs, some of which consider the heterogeneity of WSNs. Examples include the SEIRSV model, containing statesS, E (exposed), I, R, and V (vaccination); the susceptible-infected-immunized (SII) model [34]; the worm infection model considering the spatial-temporal perspective [35]; the susceptible-active-dormant-immune (SADI) model considering the hierarchical structure [36]; and the susceptible-exposed-infected-recovered-susceptible with vaccination and quarantine states (SEIRS-QV) model considering user awareness and network delay [37].To date, many researchers have studied malware infection in HWSNs through game theory. Lalropuia and Gupta [38] developed an availability model to resolve the problem of the unavailability of a 5G WCN attacked by a denial of service (DoS) attack using a Bayesian game. Jiang et al. [39] established an attack-defence game based on a Stackelberg game to study the reliability of WSNs. Shen et al. [40] set up a dependability assessment mechanism for HWSNs using a noncooperative non-zero-sum game. Shen et al. [41] formulated a malware-defence differential game to study the decision-making problem between an IDS and malware. Liu et al. [42] proposed a stochastic evolutionary coalition game (SECG) to study the reliable service of virtual-sensor-service nodes. Shen et al. [43] proposed a malware detection strategy for the Internet of Things based on a signalling game. Liu et al. [44] proposed a Bayesian Q-learning game to study the problem of task offloading in sensor edge clouds. Liu et al. [45] also proposed a Stackelberg game to study the problem of malware infection defence in sensor edge clouds based on a deep neural network.To date, researchers have presented many models for evaluating network stability or availability, which have provided a reference for evaluating the availability of HWSNs. Famila et al. [46] proposed a cluster head selection technique by semi-Markov prediction to enhance WSNs’ availability. Kanchana and Ganesan [47] proposed an inspired self-aware cooperative scheme using an SMP to prolong WSNs’ lifetimes. Shakya et al. [48] proposed a correlation-based susceptible-infectious-recovered epidemic model to study the stability of WSNs. Tang et al. [49] built an evaluation approach for WSNs’ availability based on Markov chains. Gour et al. [50] studied the availability of service function chains in 5G transport networks by designing a slice. Pereira et al. [51] proposed an availability analysis model to evaluate the availability of edge and fog nodes based on Markov chains.From these references, it can be seen that there are some problems regarding the availability of HECWSNs with malware infections, which need to be resolved. The first issue is how to determine the optimal infection probability of malware. The second issue is how to accurately describe the state of HSNs in HECWSNs with malware infections. The third issue is how to describe the heterogeneity of HSNs and the correlation of malware attacks on HSNs. The fourth issue is how to obtain the steady-state availability of HECWSNs. To address the first issue, we calculate the optimal infection probability of malware through an SADG. To address the second issue, we describe the state of HSNs by adding the statesthreatened and active and propose a malware infection HSTARD model. To address the third issue, considering the heterogeneity of security defence policies of HSNs and the malware attack correlation, we deduce the steady-state availability of an HSN based on an SMP. To address the fourth issue, considering the topology heterogeneity of HECWSNs, we deduce the steady-state availability of HECWSNs with various topologies, including the star topology, cluster topology, and mesh topology.


## 3. HSTARD Model

We assume an HECWSN scenario, which is composed of HWSNs, a base station (BS), and edge computing servers (ECServers), where the HWSNs are based on various topologies, including the star topology, cluster topology, and mesh topology (see Figure1). To provide services for the HWSNs, edge computing servers are deployed at the BS. According to the computing tasks, the HWSNs determine whether computation services are offloaded to ECServers via wireless links.Figure 1
HECWSN model.To clearly describe the relationship among HSNs in an HECWSNs with malware infection, the HECWSN is described as an undirected network denoted byT=V,B. Here, V represents HSNs and B represents the connection between any two HSNs, indicating “connected” by 1 and “not connected” by 0. The total number of HSNs is set as H, and the degree of a heterogeneous sensor node represents the number of other heterogeneous sensor nodes connected to it, which is denoted by k.All HSNs can be roughly divided into two types by their functions: sink sensor nodes and common sensor nodes. Sink sensor nodes are responsible for pooling and processing the data collected by common sensor nodes. Compared with common sensor nodes, sink sensor nodes are configured with much stronger computing resources, storage resources, energy, and security defence policies. Considering that these two sensor node types differ in their security defence policies, they have different initial infection probabilities. Sink sensor nodes are configured with stronger security defence policies, so they are not easily infected. The probability of initial infection is related to their degreek. The higher the degree is, the easier it is to infect the node, and the higher the initial infection probability is. While common sensor nodes have weaker security defense policies, therefore, they are more likely to be infected. We set the initial infection probability of all common sensor nodes to be the same. Suppose the initial infection probability of an HSN with degree k, denoted by βk, is set as
(1)βk=β0,commonsensornodes,βsk,sinksensornodes.In HECWSNs with malware infections, when an HSN is infected by malware, its states will undergo a series of changes. We propose an HSTARD model containing five states:S, T, A, R, and D. The state set of HSNs is expressed as G=S,T,A,R,D. An HSN in state S is vulnerable to malware due to its weak security defence policy. An HSN in state T has been infected by malware, but the resident malware is hidden, and the HSN cannot spread the malware to other HSNs. An HSN in state A has been infected by malware, and the resident malware is active, so the HSN will spread the malware to other HSNs. An HSN in state R is immune to the known malware because the system has been patched or the resident malware has been removed by the IDS. An HSN in state D is unable to provide normal services due to malware attacks or energy consumption.The dynamic state transitions of an HSN are illustrated in Figure2, where the state transitions are caused by the actions of the HSNs and malware. For an HSN in state S, when it is infected by malware, its state will transition to T; when it is patched by the IDS, its state will transition to R. For an HSN in state T, when the resident malware is activated, its state will transition to A; when it is patched by the IDS, its state will also transition to R. For an HSN in state A, when the resident malware is detected and removed by the IDS, its state will transition to R. For an HSN in state R, when it is scanned for security vulnerabilities by new malware, its state will transition to S. When an HSN is unable to provide normal services due to malware attacks or energy consumption, its state will transition to D. To ensure that there are enough HSNs in the HECWSNs, the HSNs in state D are updated regularly; at the same time, new HSNs in state R are added.Figure 2
State transition model of an HSN.For HSNs in all states, the death probability due to environmental influence, malware infection, and physical damage is set asφ. At time t, the probability that HSN i is in state xx∈G is denoted by pixt, and the probability that HSN i transitions from state xx∈G to yy∈G is denoted by pixyt. Suppose the initial state of all HSNs is R; thus, for any HSN i, we have piR0=1 and piS0=piT0=piA0=piD0=0.For an HSN in state S, when its security vulnerabilities are detected by the IDS, it will be patched, and its state will transition to R with probabilityξq. Here, ξq is the probability of successful detection by the IDS, where ξ is the detection probability of the IDS and q is the probability of the IDS choosing the strategy detection, which is calculated by the proposed SADG. When it communicates with neighbouring nodes, if it is not infected by any neighbouring node, its state will still be S with probability ∏j=1k1−αpjAt−1, where α is the optimal infection probability of the malware, and it is calculated by the proposed SADG. In addition, it has a death probability φ; therefore, when it communicates with its neighbouring nodes in state A, its state transitions to T with probability 1−∏j=1k1−αpjAt−1−φ−ξq. Thus, at time t, for HSN i with degree k in state S, its state transition probabilities are expressed as
(2)piSRt=ξq,piSDt=φ,piSSt=∏j=1k1−αpjAt−1,piSTt=1−φ−ξq−∏j=1k1−αpjAt−1.For an HSN in state T, when its security vulnerabilities are detected by the IDS, it will be patched, and its state will transition toR with probability ξq. When it is continuously attacked by malware, in view of the malware attack correlation, the probability that it is successfully activated is related to the number of malware attacks. For an HSN with degree k, suppose the number of its neighbouring nodes in state A is n0≤n≤k and the number of malware attacks is set as L0≤L≤n≤k. The greater L is, the greater the probability that resident malware will be activated is. Once the resident malware is activated, its state will transition to A with probability βk+Δβ∑j=1nLCnjαj1−αn−j/piST, where j is a random variable that follows a binomial distribution [52]. In addition, it has a death probability φ. Thus, at time t, for HSN i with degree k in state T, its state transition probabilities are expressed as
(3)piTRt=ξq,piTDt=φ,piTAt=βk+Δβ∑j=1nLCnjαj1−αn−jpiST,piTTt=1−ξq−φ−βk−Δβ∑j=1nLCnjαj1−αn−jpiST,where βk is the initial infection rate and Δβ is the infection change rate. These variables indicate the variation characteristics of the probability of HSNs being infected by malware. In addition, Δβ indicates the sensitivity of the probability of HSN infection by malware to the number of malware attacks. As the number of malware attacks increases, the larger Δβ is, the more sensitive the probability of malware infection is to the number of malware attacks; correspondingly, the greater the probability of HSNs being infected by malware is.For an HSN in stateA, when it is detected by the IDS, the resident malware will be removed, and the system will be patched; its state will transition to R with probability ξq. In addition, it has a death probability of φ, so it remains in state A with a probability of 1−ξq−φ−θ. Thus, at time t, for HSN i in state A, its state transition probabilities are expressed as
(4)piARt=ξq,piADt=φ,piAAt=1−ξq−φ.For an HSN in stateR, its state will transition to S after it is scanned for security vulnerabilities by new malware, and the probability of its state transitioning from R to S is denoted by δ. In addition, it has a death probability of φ, so it remains in state R with probability 1−δ−φ. Thus, at time t, for HSN i in state R, its state transition probabilities are expressed as
(5)piRDt=φ,piRSt=δ,piRRt=1−δ−φ.For an HSN in stateD, when it is updated regularly, the newly added HSNs are in state R, and the update probability of dead HSNs is denoted by θ. Thus, at time t, for HSN i in state D, its state transition probabilities are expressed as
(6)piDDt=1−θ,piDRt=θ.


## 4. A Stackelberg Attack-Defence Game for Predicting the Optimal Infection Probability of Malware

### 4.1. Defining a Stackelberg Attack-Defence Game

The Stackelberg game is a noncooperative strategic game, and its strategies have priority. We establish an SADG to predict the optimal infection probability of malware in HECWSNs. Note that the aim of the SADG is not to deduce the detection probability of an IDS. In this SADG, the malware makes the attack strategy first, and then, the IDS chooses the defence strategy. In other words, the malware is the leader, and the IDS is the follower.Definition 1.
The Stackelberg attack-defence game (SADG) is expressed by a 3-tuple <B,E,U>, where
(i)
B=malwareM,IDSZ denotes a set of players(ii)
E=EM×EZ, where EM=InfectI,Noninfect∅~ and EZ=DetectD,Nondetect∅ denote the pure strategies sets that malware and IDS can choose, respectively(iii)
U=UeMeZb, for b∈B, eM∈EM, and eZ∈EZ, denotes a payoff matrix, where UeMeZb:eM×eZ↦ℝ denotes the payoff that player b obtains when player M selects the pure strategy eM and player Z selects the pure strategy eZThe parameters used in the SADG are listed in Table1. ξ (0<ξ<1) and ζ (0<ζ<1) denote the detection rate and the false alarm rate of the IDS, respectively. CI (CI>0) denotes the infection cost of the malware, CD (CD>0) denotes the detection cost of the IDS, ωI (ωI>0) denotes the utility of the malware for successful infection, and ωD denotes the utility of the IDS for successful detection.Definition1 shows that the SADG has two players: malwareM and IDSZ. The two pure strategies for M to choose are InfectI and Noninfect∅~, and the two pure strategies for S to choose are DetectD and Nondetect∅. Therefore, these two players have four combinations of pure strategies in the SADG, and the corresponding utilities form the payoff matrix (see Table 2).Table 2
The payoff matrix of the SADG.
DetectNondetectInfectζ−2ξ+1ωI−CI,2ξ−1−ζωD−CDωI−CI,−ωDNoninfect0,−ζωD−CD0,0For the combination of pure strategiesInfect,Detect, which means that malware selects the pure strategy Infect, and IDS selects the pure strategy Detect, the detection rate and the false alarm rate of the IDS are ξ and ζ, so it gains ξωD and loses ζωD, while malware loses ξωI and gains ζωI. In response, the rate of malware infection is 1−ξ, so malware gains 1−ξωI and IDS loses 1−ξωD. In addition, the infection cost of malware is CI, so malware loses CI. The detection cost of IDS is CD, so it loses CD. Therefore, the utilities of malwareUIDM and IDS UIDZ are, respectively,
(7)UIDM=ζ−2ξ+1ωI−CI,UIDZ=2ξ−1−ζωD−CD.For the combination of pure strategiesInfect,Nondetect, which means that malware selects the pure strategy Infect and IDS selects the pure strategy Nondetect. Under this case, malware gains ωI and IDS loses ωD. In addition, the infection cost of malware is CI, so malware loses CI. Therefore, the utilities of malware UI∅M and IDS UI∅Z are, respectively,
(8)UI∅M=ωI−CI,UI∅Z=−ωD.For the combination of pure strategiesNoninfect,Detect, which means that malware selects the pure strategy Noninfect and IDS selects the pure strategy Detect, the false alarm rate of the IDS is ζ, so IDS loses ζωD. In addition, the detection cost of the IDS is CD, so IDS loses CD. Therefore, the utilities of malware U∅~DM and IDS U∅~DZ are, respectively,
(9)U∅~DM=0,U∅~DZ=−ζωD−CD.For the combination of pure strategiesNoninfect,Nondetect, which means that malware selects the pure strategy Noninfect and IDS selects the pure strategy Nondetect, the utilities of malware U∅~∅M and IDS U∅~∅Z are both equal to 0.Letq denote the probability that the follower IDS selects the pure strategy Detect. Correspondingly, the probability that it selects the pure strategy Nondetect is denoted by 1−q. Let α denote the probability that the leader malware selects the pure strategy Infect. Correspondingly, the probability that it selects the pure strategy Noninfect is denoted by 1−α.For IDS, the greater the probabilityq is, the greater the energy consumed by detection. That is, the detection cost CD becomes greater as q increases, so we set the detection cost CD as a linear function of the detection probability q. We obtain the expected payoff of IDS as
(10)UZ=2qαωDξ−αωD−qζωD−qCD,and the detection cost CD is
(11)CD=qσD,where σD expresses the basic cost of detection of IDS.Then, using (11) to replace CD in (10), we can obtain UZ as
(12)UZ=2qαωDξ−αωD−qζωD−q2σD.For malware, the greater the probabilityα is, the greater the attack needs to consume the resources is. That is, the infection cost CI becomes greater as α increases, so we set the infection cost CI as a linear function of the infection probability α. We obtain the expected payoff of malware as
(13)UM=ζ−2ξqαωI+αωI−αCI,and the infection cost CI is
(14)CI=ασI,where σI expresses the basic cost of infection by malware.Then, using (14) to replace CI in (13), we can obtain UM as
(15)UM=ζ−2ξqαωI+αωI−α2σI.


### 4.2. Predicting the Optimal Infection Probability of Malware

In this section, we predict the optimal infection probability of malware by calculating the Stackelberg equilibrium of the SADG.Theorem 1.
In the SADG, the optimal infection probabilityα of malware choosing the pure strategy Infect is
(16)α=ζ2ωIωD−2ξζωIωD−ωI2ζξωIωD−4ξ2ωIωD−σI.Proof.
According to the equilibrium solution of the Stackelberg game, we first calculate the reaction of the follower IDS and obtain the optimal detection probabilityq that maximizes US. Then, based on the known optimal detection probability q, we can calculate the reaction of the leader malware and obtain the optimal infection probability α.
First, we calculate the first-order partial derivative ofUZ with respect to q as
(17)∂UZ∂q=2αωDξ−ζωD−qσD.
The second-order partial derivative ofUZ with respect to q is
(18)∂2UZ∂2q=−σD.
Since the basic cost of detectionσD is greater than 0, −σD is less than 0. Therefore, UZ has the maximum value. Setting (17) equal to zero, we can obtain
(19)q=2αωDξ−ζωDσD.
Then, we calculate the reaction of the leader malware by introducing the parameterq, and we obtain the optimal infection probability α.
The first-order partial derivative ofUM with respect to α is
(20)∂UM∂α=ζ−2ξqωI+ωI−ασI.
The second-order partial derivative ofUM with respect to α is
(21)∂2UM∂2α=−σI.
Since the basic cost of infectionσI is greater than 0, −σI is less than 0. Therefore, UM has the maximum value. Setting (20) equal to zero for maximization, we substitute (19) with the optimal detection probability q and obtain the optimal infection probability α as
(22)α=ζ2ωIωD−2ξζωIωD−ωI2ζξωIωD−4ξ2ωIωD−σI.
It can be seen from the proof and derivation thatα is the optimal infection probability of malware. The proof is complete.


## 4.1. Defining a Stackelberg Attack-Defence Game

The Stackelberg game is a noncooperative strategic game, and its strategies have priority. We establish an SADG to predict the optimal infection probability of malware in HECWSNs. Note that the aim of the SADG is not to deduce the detection probability of an IDS. In this SADG, the malware makes the attack strategy first, and then, the IDS chooses the defence strategy. In other words, the malware is the leader, and the IDS is the follower.Definition 1.
The Stackelberg attack-defence game (SADG) is expressed by a 3-tuple <B,E,U>, where
(i)
B=malwareM,IDSZ denotes a set of players(ii)
E=EM×EZ, where EM=InfectI,Noninfect∅~ and EZ=DetectD,Nondetect∅ denote the pure strategies sets that malware and IDS can choose, respectively(iii)
U=UeMeZb, for b∈B, eM∈EM, and eZ∈EZ, denotes a payoff matrix, where UeMeZb:eM×eZ↦ℝ denotes the payoff that player b obtains when player M selects the pure strategy eM and player Z selects the pure strategy eZThe parameters used in the SADG are listed in Table1. ξ (0<ξ<1) and ζ (0<ζ<1) denote the detection rate and the false alarm rate of the IDS, respectively. CI (CI>0) denotes the infection cost of the malware, CD (CD>0) denotes the detection cost of the IDS, ωI (ωI>0) denotes the utility of the malware for successful infection, and ωD denotes the utility of the IDS for successful detection.Definition1 shows that the SADG has two players: malwareM and IDSZ. The two pure strategies for M to choose are InfectI and Noninfect∅~, and the two pure strategies for S to choose are DetectD and Nondetect∅. Therefore, these two players have four combinations of pure strategies in the SADG, and the corresponding utilities form the payoff matrix (see Table 2).Table 2
The payoff matrix of the SADG.
DetectNondetectInfectζ−2ξ+1ωI−CI,2ξ−1−ζωD−CDωI−CI,−ωDNoninfect0,−ζωD−CD0,0For the combination of pure strategiesInfect,Detect, which means that malware selects the pure strategy Infect, and IDS selects the pure strategy Detect, the detection rate and the false alarm rate of the IDS are ξ and ζ, so it gains ξωD and loses ζωD, while malware loses ξωI and gains ζωI. In response, the rate of malware infection is 1−ξ, so malware gains 1−ξωI and IDS loses 1−ξωD. In addition, the infection cost of malware is CI, so malware loses CI. The detection cost of IDS is CD, so it loses CD. Therefore, the utilities of malwareUIDM and IDS UIDZ are, respectively,
(7)UIDM=ζ−2ξ+1ωI−CI,UIDZ=2ξ−1−ζωD−CD.For the combination of pure strategiesInfect,Nondetect, which means that malware selects the pure strategy Infect and IDS selects the pure strategy Nondetect. Under this case, malware gains ωI and IDS loses ωD. In addition, the infection cost of malware is CI, so malware loses CI. Therefore, the utilities of malware UI∅M and IDS UI∅Z are, respectively,
(8)UI∅M=ωI−CI,UI∅Z=−ωD.For the combination of pure strategiesNoninfect,Detect, which means that malware selects the pure strategy Noninfect and IDS selects the pure strategy Detect, the false alarm rate of the IDS is ζ, so IDS loses ζωD. In addition, the detection cost of the IDS is CD, so IDS loses CD. Therefore, the utilities of malware U∅~DM and IDS U∅~DZ are, respectively,
(9)U∅~DM=0,U∅~DZ=−ζωD−CD.For the combination of pure strategiesNoninfect,Nondetect, which means that malware selects the pure strategy Noninfect and IDS selects the pure strategy Nondetect, the utilities of malware U∅~∅M and IDS U∅~∅Z are both equal to 0.Letq denote the probability that the follower IDS selects the pure strategy Detect. Correspondingly, the probability that it selects the pure strategy Nondetect is denoted by 1−q. Let α denote the probability that the leader malware selects the pure strategy Infect. Correspondingly, the probability that it selects the pure strategy Noninfect is denoted by 1−α.For IDS, the greater the probabilityq is, the greater the energy consumed by detection. That is, the detection cost CD becomes greater as q increases, so we set the detection cost CD as a linear function of the detection probability q. We obtain the expected payoff of IDS as
(10)UZ=2qαωDξ−αωD−qζωD−qCD,and the detection cost CD is
(11)CD=qσD,where σD expresses the basic cost of detection of IDS.Then, using (11) to replace CD in (10), we can obtain UZ as
(12)UZ=2qαωDξ−αωD−qζωD−q2σD.For malware, the greater the probabilityα is, the greater the attack needs to consume the resources is. That is, the infection cost CI becomes greater as α increases, so we set the infection cost CI as a linear function of the infection probability α. We obtain the expected payoff of malware as
(13)UM=ζ−2ξqαωI+αωI−αCI,and the infection cost CI is
(14)CI=ασI,where σI expresses the basic cost of infection by malware.Then, using (14) to replace CI in (13), we can obtain UM as
(15)UM=ζ−2ξqαωI+αωI−α2σI.


## 4.2. Predicting the Optimal Infection Probability of Malware

In this section, we predict the optimal infection probability of malware by calculating the Stackelberg equilibrium of the SADG.Theorem 1.
In the SADG, the optimal infection probabilityα of malware choosing the pure strategy Infect is
(16)α=ζ2ωIωD−2ξζωIωD−ωI2ζξωIωD−4ξ2ωIωD−σI.Proof.
According to the equilibrium solution of the Stackelberg game, we first calculate the reaction of the follower IDS and obtain the optimal detection probabilityq that maximizes US. Then, based on the known optimal detection probability q, we can calculate the reaction of the leader malware and obtain the optimal infection probability α.
First, we calculate the first-order partial derivative ofUZ with respect to q as
(17)∂UZ∂q=2αωDξ−ζωD−qσD.
The second-order partial derivative ofUZ with respect to q is
(18)∂2UZ∂2q=−σD.
Since the basic cost of detectionσD is greater than 0, −σD is less than 0. Therefore, UZ has the maximum value. Setting (17) equal to zero, we can obtain
(19)q=2αωDξ−ζωDσD.
Then, we calculate the reaction of the leader malware by introducing the parameterq, and we obtain the optimal infection probability α.
The first-order partial derivative ofUM with respect to α is
(20)∂UM∂α=ζ−2ξqωI+ωI−ασI.
The second-order partial derivative ofUM with respect to α is
(21)∂2UM∂2α=−σI.
Since the basic cost of infectionσI is greater than 0, −σI is less than 0. Therefore, UM has the maximum value. Setting (20) equal to zero for maximization, we substitute (19) with the optimal detection probability q and obtain the optimal infection probability α as
(22)α=ζ2ωIωD−2ξζωIωD−ωI2ζξωIωD−4ξ2ωIωD−σI.
It can be seen from the proof and derivation thatα is the optimal infection probability of malware. The proof is complete.


## 5. Steady-State Availability of a Heterogeneous Sensor Node

The steady state of an HSN is an important factor determining whether it can work normally. It is random, which means that the current state of an HSN determines the change in the next state independently of the previous state. Thus, it is appropriate to describe the state transition of an HSN using an SMP. Comparing the Markov process (MP) and SMP, the MP has strict requirements for the state residence time, which must follow an exponential distribution, while the SMP does not limit the state residence time, which can follow any distribution form. Therefore, modelling the dynamic state transition process of an HSN based on an SMP appears more objective, and it is more in line with practical conditions.The transition from one state to another based on an SMP can be considered as two logical steps, which are the residence time of an HSN in statex and the transition process from state x to y.Definition 3.
Suppose the residence time of an HSN in statex is expressed as tx; then, the tx distribution is expressed as Ttx=tS,tT,tA,tR,tD.Definition 4.
Letνx represent the probability that an HSN translates to state x, and let the νx distribution be expressed as Vvx=vS,vT,vA,vR,vD.Definition 5.
The steady-state probability is the share of the residence time of an HSN in each state in the total residence time of all states. Letπx represent the steady-state probability vector of an HSN; the πx distribution is expressed as Xπx=πS,πT,πQ,πI,πR,πD, where
(23)πx=vxtx∑y∈Gvyty,x,y∈G.According to the proposed HSTARD model, the state transition matrixP of an HSN is constructed as
(24)P=pSSpST0pSRpSD0pTTpTApTRpTD00pAApARpADpRS00pRRpRD000pDRpDD.Here,pSS=piSSt, pST=piSTt, pSR=piSRt, pSD=piSDt, pTT=piTTt,pTA=piTAt, pTR=piTRt, pTD=piTDt, pAA=piAAt, pAR=piARt, pAD=piADt, pRS=piRSt, pRR=piRRt, pRD=piRDt, pDR=piDRt, and pDD=piDDt.According to the discrete Markov properties, we obtain(25)V=VP,∑x∈Gvx=1.Combining and solving (24) and (25), we can obtain
(26)vS=pRSpT~pA~ZpT~pA~pRS+pS~+pSTpRSpA~+pTA,vT=pRSpSTpA~ZpT~pA~pRS+pS~+pSTpRSpA~+pTA,vA=pRSpSTpTAZpT~pA~pRS+pS~+pSTpRSpA~+pTA,vR=pS~pT~pA~ZpT~pA~pRS+pS~+pSTpRSpA~+pTA,vD=1−Z.SubstitutingvS, vT, vA, vR, and vD into (25), we can obtain
(27)πS=pRSpT~pA~tSZpT~pA~pRS+pS~+pSTpRSpA~+pTAπsum,πT=pRSpSTpA~tTZpT~pA~pRS+pS~+pSTpRSpA~+pTAπsum,πA=pRSpSTpTAtAZpT~pA~pRS+pS~+pSTpRSpA~+pTAπsum,πR=pS~pT~pA~tRZpT~pA~pRS+pS~+pSTpRSpA~+pTAπsum,πD=1−ZtDπsum,where πsum=πsts+πTtT+πAtA+πRtR+πDtD, Z=1−φ/1+φ+PDD, pS~=1−pSS, pT~=1−pTT, and pA~=1−pAA.Since the steady-state availability of an HSN describes its ability to continue working after being damaged or attacked by malware, an HSN in stateA or D cannot work normally. Therefore, the steady-state availability of an HSN of type h in HECWSNs with topology j, denoted by Ajh, is
(28)Ajh=1−πA−πD.


## 6. Steady-State Availability of HECWSNs

### 6.1. Steady-State Availability of HECWSNs with a Star Topology

HECWSNs with a star topology are composed of a single sink sensor node and some common sensor nodes (see Figure3). The common sensor nodes are responsible for collecting data and forwarding them to the sink sensor node, which is responsible for processing data and transferring them to the base station. Common sensor nodes work in parallel without affecting each other and are classified into a parallel system. Thus, to enable HECWSNs to work normally, two conditions should be met: (1) the sink sensor node is able to work normally, and (2) a certain number of common sensor nodes can work normally.Figure 3
HECWSNs with a star topology.Assuming that the HECWSNs with a star topology containXs common sensor nodes, the steady-state availability of each common sensor node is denoted by Astarc. It is required that there be at least ms common sensor nodes working normally in the HECWSNs. When the HECWSNs can work normally, the number of common working sensor nodes is denoted by Ns. In the HECWSNs, the steady-state availability of the sink sensor node is denoted by AstarsinkXs, which is expressed as ∑Ns=msXsCXsNsAstarcNs1−AstarcXs−Ns. The steady-state availability of the HECWSNs with a star topology, denoted by AStar, is
(29)AStar=AstarsinkXs∑Ns=msXsCXsNsAstarcNs1−AstarcXs−Ns.


### 6.2. Steady-State Availability of HECWSNs with a Cluster Topology

HECWSNs with a cluster topology are composed of three node types: sink sensor nodes, cluster head nodes [53], and common sensor nodes (see Figure 4). Cluster head nodes are selected from common sensor nodes [54], so the availability of cluster head nodes is equal to that of common sensor nodes. A cluster is composed of a cluster head node and some common sensor nodes. When the HECWSNs work, the common sensor nodes first communicate with the cluster head node, and then, the cluster head node communicates with the sink sensor node. As long as there is one common working sensor node in a cluster, the cluster is available.Figure 4
HECWSNs with a cluster topology.In HECWSNs with a cluster topology, suppose that the steady-state availability of a common sensor node in a cluster is denoted byAccs and that the number of common sensor nodes in a cluster is expressed by Xcs. The steady-state availability of a cluster in the HECWSNs, denoted by Acc, is
(30)Acc=1−1−AccsXcs.For HECWSNs with a cluster topology, if a cluster is regarded as one unit, it can be regarded as having a star structure. Suppose that there areXc clusters and that the steady-state availability of the sink sensor nodes is denoted by AclustersinkXc. Suppose that there are at least mc clusters required to work normally in the HECWSNs and that the number of working clusters is denoted by Nc. The steady-state availability of the HECWSNs with a cluster topology, denoted by ACluster, is
(31)ACluster=AclustersinkXc∑Nc=mcXcCXcNc⋅AccNc⋅1−AccXc−Nc.


### 6.3. Steady-State Availability of HECWSNs with a Mesh Topology

HECWSNs with a mesh topology usually contain several sink sensor nodes, and each sink sensor node manages some common sensor nodes (see Figure5). The common sensor nodes are responsible for translating the collected data to the corresponding sink sensor node, and then, the sink sensor node sends data to the base station [55].Figure 5
HECWSNs with a mesh topology.In HECWSNs with a mesh topology, communication between a sink sensor node and its common sensor nodes occurs in a parallel system (see Figure5), so the HECWSNs can be regarded as a combination of multiple HECWSNs with star topologies. Assume that the total number of common sensor nodes connecting to the sink sensor node is Xmeshc, the minimum number of common sensor nodes required to work normally is mmeshc, the steady-state availability of a common sensor node is denoted by Ameshc, and the number of common working sensor nodes connecting to the sink sensor node is denoted by Nmeshc. Then, the steady-state availability of the sink sensor node, denoted by Ameshs, is
(32)Ameshs=AmsinkXm∑Nmeshc=mmeshcXmeshcCXmeshckmAmeshcNmeshc1−AmeshcXmeshc−Nmeshc.To enable HECWSNs with a mesh topology to work normally, at least a certain number of sink sensor nodes are required to work normally. Assume that the total number of sink sensor nodes isXmeshs, the minimum number of sink sensor nodes required to work normally is mmeshs, and the number of working sink sensor nodes is denoted by Nmeshs. Then, the steady-state availability of the HECWSNs with a mesh topology is denoted by AMesh, which can be expressed as
(33)AMesh=∑Nmeshs=mmeshsXmeshsCXmeshsXmeshcAmeshsXmeshc1−AmeshsXmeshs−Xmeshc.


## 6.1. Steady-State Availability of HECWSNs with a Star Topology

HECWSNs with a star topology are composed of a single sink sensor node and some common sensor nodes (see Figure3). The common sensor nodes are responsible for collecting data and forwarding them to the sink sensor node, which is responsible for processing data and transferring them to the base station. Common sensor nodes work in parallel without affecting each other and are classified into a parallel system. Thus, to enable HECWSNs to work normally, two conditions should be met: (1) the sink sensor node is able to work normally, and (2) a certain number of common sensor nodes can work normally.Figure 3
HECWSNs with a star topology.Assuming that the HECWSNs with a star topology containXs common sensor nodes, the steady-state availability of each common sensor node is denoted by Astarc. It is required that there be at least ms common sensor nodes working normally in the HECWSNs. When the HECWSNs can work normally, the number of common working sensor nodes is denoted by Ns. In the HECWSNs, the steady-state availability of the sink sensor node is denoted by AstarsinkXs, which is expressed as ∑Ns=msXsCXsNsAstarcNs1−AstarcXs−Ns. The steady-state availability of the HECWSNs with a star topology, denoted by AStar, is
(29)AStar=AstarsinkXs∑Ns=msXsCXsNsAstarcNs1−AstarcXs−Ns.


## 6.2. Steady-State Availability of HECWSNs with a Cluster Topology

HECWSNs with a cluster topology are composed of three node types: sink sensor nodes, cluster head nodes [53], and common sensor nodes (see Figure 4). Cluster head nodes are selected from common sensor nodes [54], so the availability of cluster head nodes is equal to that of common sensor nodes. A cluster is composed of a cluster head node and some common sensor nodes. When the HECWSNs work, the common sensor nodes first communicate with the cluster head node, and then, the cluster head node communicates with the sink sensor node. As long as there is one common working sensor node in a cluster, the cluster is available.Figure 4
HECWSNs with a cluster topology.In HECWSNs with a cluster topology, suppose that the steady-state availability of a common sensor node in a cluster is denoted byAccs and that the number of common sensor nodes in a cluster is expressed by Xcs. The steady-state availability of a cluster in the HECWSNs, denoted by Acc, is
(30)Acc=1−1−AccsXcs.For HECWSNs with a cluster topology, if a cluster is regarded as one unit, it can be regarded as having a star structure. Suppose that there areXc clusters and that the steady-state availability of the sink sensor nodes is denoted by AclustersinkXc. Suppose that there are at least mc clusters required to work normally in the HECWSNs and that the number of working clusters is denoted by Nc. The steady-state availability of the HECWSNs with a cluster topology, denoted by ACluster, is
(31)ACluster=AclustersinkXc∑Nc=mcXcCXcNc⋅AccNc⋅1−AccXc−Nc.


## 6.3. Steady-State Availability of HECWSNs with a Mesh Topology

HECWSNs with a mesh topology usually contain several sink sensor nodes, and each sink sensor node manages some common sensor nodes (see Figure5). The common sensor nodes are responsible for translating the collected data to the corresponding sink sensor node, and then, the sink sensor node sends data to the base station [55].Figure 5
HECWSNs with a mesh topology.In HECWSNs with a mesh topology, communication between a sink sensor node and its common sensor nodes occurs in a parallel system (see Figure5), so the HECWSNs can be regarded as a combination of multiple HECWSNs with star topologies. Assume that the total number of common sensor nodes connecting to the sink sensor node is Xmeshc, the minimum number of common sensor nodes required to work normally is mmeshc, the steady-state availability of a common sensor node is denoted by Ameshc, and the number of common working sensor nodes connecting to the sink sensor node is denoted by Nmeshc. Then, the steady-state availability of the sink sensor node, denoted by Ameshs, is
(32)Ameshs=AmsinkXm∑Nmeshc=mmeshcXmeshcCXmeshckmAmeshcNmeshc1−AmeshcXmeshc−Nmeshc.To enable HECWSNs with a mesh topology to work normally, at least a certain number of sink sensor nodes are required to work normally. Assume that the total number of sink sensor nodes isXmeshs, the minimum number of sink sensor nodes required to work normally is mmeshs, and the number of working sink sensor nodes is denoted by Nmeshs. Then, the steady-state availability of the HECWSNs with a mesh topology is denoted by AMesh, which can be expressed as
(33)AMesh=∑Nmeshs=mmeshsXmeshsCXmeshsXmeshcAmeshsXmeshc1−AmeshsXmeshs−Xmeshc.


## 7. Experimental Simulations and Data Analysis

In this paper, simulation experiments to verify the steady-state availability of HECWSNs are completed based on MATLAB 2015. The steady-state availability of HECWSNs with malware infections is affected by many factors, including the initial infection probabilityβk, the infection change rate Δβ, and the infection probability of malware. First, we analyse the influence of the detection rate ξ and false alarm rate ζ of the IDS on the optimal infection probability of malware. Second, we analyse the impact of the initial infection probability βk and infection change rate Δβ on the steady-state availability of HSNs. Third, we evaluate the steady-state availability of HECWSNs with various topologies, including the star topology, cluster topology, and mesh topology.


### 7.1. Optimal Infection Probability of Malware under the Influence of IDS Parameters

In this section, the experimental data show the influence of the detection rateξ and false alarm rate ζ of the IDS on the optimal infection probability of malware. In the experiment, the relevant parameters are set as σI=20, σD=10, ωI=50, and ωD=40.With the increase of the detection rateξ of the IDS, the optimal infection probability of malware will decrease (see Figure 6), but with the increase of the false alarm rate ζ of the IDS, the optimal infection probability of malware will also increase. For example, when the detection rate ξ of the IDS increases from 0.5 to 0.95, the optimal infection probability of malware decreases from 0.06 to 0.01 when ζ=0.06. When the false alarm rate ζ of the IDS increases from 0.04 to 0.12, the optimal infection probability of malware increases from 0.04 to 0.14 when ξ=0.6.Figure 6
Influence of the IDS parameters on the optimal infection probability of malware.According to the analysis of the experimental data, to decrease the optimal infection probability of malware, we should prioritize reducing the false alarm rate to improve the detection rate.


### 7.2. Effect of the Initial Infection Rate and the Infection Change Rate on the Steady-State Availability of an HSN

The steady-state availability of an HSN is related to the initial infection rate and the infection change rate (see Figure7). It can be seen from the experimental data curves that with the increase of the initial infection rate and the infection change rate, the steady-state availability of an HSN decreases gradually.Figure 7
Influence of the initial infection rate and the infection change rate on the steady-state availability of an HSN.For example, when the initial infection rate increases from 0.1 to 0.6, the steady-state availability of the HSN decreases from 0.8596, 0.8543, and 0.8483 to 0.8021, 0.7953, and 0.7886, corresponding to three values of the infection change rate,Δβ=0.05, Δβ=0.1, and Δβ=0.15, respectively. The data analysis indicates that the higher the initial infection rate is, the greater the probability of HSNs being infected by malware is, and the lower the steady-state availability of the HSNs is. The higher the infection change rate is, the more difficult it is for HSNs to suppress malware infection. Therefore, to improve the steady-state availability of HSNs, we should reduce the initial infection rate and the infection change rate.The initial infection rate and the infection change rate influence the steady-state availability of a sink sensor node (see Figure8). It can be seen from the experimental data curves that with the increase of the sink sensor node’s degree k, the steady-state availability of the sink sensor node decreases gradually. Three functions of the initial infection rate are considered in the experiment: βk=ck, βk=clogk, and βk=cek. Figure 7 shows that when the degree k of the sink sensor node increases from 10 to 60, the steady-state availability of the sink sensor node decreases from 0.8673 to 0.7535. When the initial infection rate of the sink sensor node satisfies the power function, the steady-state availability of the sink sensor node is least affected by its degree k, followed by the linear function and then the exponential function.Figure 8
Influence of the degree of sink sensor nodes on the steady-state availability of the sink sensor nodes.For example, when the degreek of the sink sensor node is set as 35, the steady-state availability of the sink sensor node is 0.8565, 0.8214, and 0.7946, corresponding to three functions of the initial infection rate βSk=cek, βSk=ck, and βSk=clogk, respectively. Experimental data analysis indicates that the function of the initial infection βSk=cek is the most appropriate for HECWSNs.


### 7.3. Steady-State Availability of HECWSNs with a Star Topology

Figure9 shows the evaluation results of the steady-state availability of HECWSNs with a star topology. The x-axis shows the number of common working sensor nodes connecting to the sink sensor node, which ranges from 15 to 30. The y-axis shows the total number of common sensor nodes connecting to the sink sensor node, which ranges from 20 to 30. The z-axis shows the steady-state availability of HECWSNs with a star topology, which ranges from 0 to 1.Figure 9
Steady-state availability of HECWSNs with a star topology.With the increase in the total number of common sensor nodes connecting to the sink sensor node, the steady-state availability of the HECWSNs will increase (see Figure9). However, with the increase in the number of common working sensor nodes connecting to the sink sensor node, the steady-state availability of the HECWSNs will decrease. For example, when the number of common working sensor nodes connecting to the sink sensor node is 20, the steady-state availability of HECWSNs with a star topology will gradually increase from 0 to 0.75 as the total number of common sensor nodes connecting to the sink sensor node increases from 20 to 30. When the total number of common sensor nodes connecting to the sink sensor node is 30, the steady-state availability of HECWSNs with a star topology will gradually decrease from 0.75 to 0 as the number of common working sensor nodes connecting to the sink sensor node increases from 15 to 30. Therefore, when constructing HECWSNs with a star topology, it is necessary to increase the number of redundant common sensor nodes according to the actual situation, which helps to increase the steady-state availability of HECWSNs with a star topology.


### 7.4. Steady-State Availability of HECWSNs with a Cluster Topology

Figure10 shows the evaluation results for the steady-state availability of HECWSNs with a cluster topology. The x-axis shows the number of working clusters, which ranges from 15 to 30. The y-axis shows the total number of clusters, which ranges from 20 to 30. The z-axis shows the steady-state availability of HECWSNs with a cluster topology, which ranges from 0 to 1.Figure 10
Steady-state availability of HECWSNs with a cluster topology.With the increase in the total number of clusters, the steady-state availability of HECWSNs with a cluster topology will increase (see Figure10). However, with the increase in the number of working clusters, the steady-state availability of HECWSNs with a cluster topology will decrease. For example, when the number of working clusters is 25, the steady-state availability of HECWSNs with a cluster topology will gradually increase from 0 to 0.75 as the total number of clusters increases from 24 to 30. When the total number of clusters is 26, the steady-state availability of HECWSNs with a cluster topology will gradually decrease from 0.75 to 0 as the number of working clusters increases from 15 to 27. Therefore, when constructing HECWSNs with a cluster topology, it is necessary to increase the number of redundant clusters according to the actual situation, which helps to increase the steady-state availability of HECWSNs with a cluster topology.


### 7.5. Steady-State Availability of HECWSNs with a Mesh Topology

Figure11 shows the evaluation results of the steady-state availability of HECWSNs with a mesh topology. The x-axis shows the number of common working sensor nodes in a subnet, which ranges from 2 to 6. The y-axis shows the total number of common sensor nodes in a subnet, which ranges from 20 to 30. The z-axis shows the steady-state availability of HECWSNs with a mesh topology, which ranges from 0 to 1.Figure 11
Steady-state availability of HECWSNs with a mesh topology.With the increase in the number of common sensor nodes in a subnet, the steady-state availability of HECWSNs with a mesh topology will increase (see Figure11). However, with the increase in the number of common working sensor nodes in a subnet, the steady-state availability of HECWSNs with a mesh topology will decrease. For example, when the number of common working sensor nodes in a subnet is 2, the steady-state availability of HECWSNs with a mesh topology will increase from 0 to 1 as the total number of common sensor nodes in a subnet increases from 20 to 30. When the total number of common sensor nodes in a subnet is 30, the steady-state availability of HECWSNs with a mesh topology will decrease from 1 to 0.18 as the number of common working sensor nodes in a subnet increases from 2 to 6. Therefore, when constructing HECWSNs with a mesh topology, it is necessary to increase the number of redundant common sensor nodes in a subnet and the number of sink sensor nodes, which helps to increase the steady-state availability of HECWSNs with a mesh topology.


## 7.1. Optimal Infection Probability of Malware under the Influence of IDS Parameters

In this section, the experimental data show the influence of the detection rateξ and false alarm rate ζ of the IDS on the optimal infection probability of malware. In the experiment, the relevant parameters are set as σI=20, σD=10, ωI=50, and ωD=40.With the increase of the detection rateξ of the IDS, the optimal infection probability of malware will decrease (see Figure 6), but with the increase of the false alarm rate ζ of the IDS, the optimal infection probability of malware will also increase. For example, when the detection rate ξ of the IDS increases from 0.5 to 0.95, the optimal infection probability of malware decreases from 0.06 to 0.01 when ζ=0.06. When the false alarm rate ζ of the IDS increases from 0.04 to 0.12, the optimal infection probability of malware increases from 0.04 to 0.14 when ξ=0.6.Figure 6
Influence of the IDS parameters on the optimal infection probability of malware.According to the analysis of the experimental data, to decrease the optimal infection probability of malware, we should prioritize reducing the false alarm rate to improve the detection rate.


## 7.2. Effect of the Initial Infection Rate and the Infection Change Rate on the Steady-State Availability of an HSN

The steady-state availability of an HSN is related to the initial infection rate and the infection change rate (see Figure7). It can be seen from the experimental data curves that with the increase of the initial infection rate and the infection change rate, the steady-state availability of an HSN decreases gradually.Figure 7
Influence of the initial infection rate and the infection change rate on the steady-state availability of an HSN.For example, when the initial infection rate increases from 0.1 to 0.6, the steady-state availability of the HSN decreases from 0.8596, 0.8543, and 0.8483 to 0.8021, 0.7953, and 0.7886, corresponding to three values of the infection change rate,Δβ=0.05, Δβ=0.1, and Δβ=0.15, respectively. The data analysis indicates that the higher the initial infection rate is, the greater the probability of HSNs being infected by malware is, and the lower the steady-state availability of the HSNs is. The higher the infection change rate is, the more difficult it is for HSNs to suppress malware infection. Therefore, to improve the steady-state availability of HSNs, we should reduce the initial infection rate and the infection change rate.The initial infection rate and the infection change rate influence the steady-state availability of a sink sensor node (see Figure8). It can be seen from the experimental data curves that with the increase of the sink sensor node’s degree k, the steady-state availability of the sink sensor node decreases gradually. Three functions of the initial infection rate are considered in the experiment: βk=ck, βk=clogk, and βk=cek. Figure 7 shows that when the degree k of the sink sensor node increases from 10 to 60, the steady-state availability of the sink sensor node decreases from 0.8673 to 0.7535. When the initial infection rate of the sink sensor node satisfies the power function, the steady-state availability of the sink sensor node is least affected by its degree k, followed by the linear function and then the exponential function.Figure 8
Influence of the degree of sink sensor nodes on the steady-state availability of the sink sensor nodes.For example, when the degreek of the sink sensor node is set as 35, the steady-state availability of the sink sensor node is 0.8565, 0.8214, and 0.7946, corresponding to three functions of the initial infection rate βSk=cek, βSk=ck, and βSk=clogk, respectively. Experimental data analysis indicates that the function of the initial infection βSk=cek is the most appropriate for HECWSNs.


## 7.3. Steady-State Availability of HECWSNs with a Star Topology

Figure9 shows the evaluation results of the steady-state availability of HECWSNs with a star topology. The x-axis shows the number of common working sensor nodes connecting to the sink sensor node, which ranges from 15 to 30. The y-axis shows the total number of common sensor nodes connecting to the sink sensor node, which ranges from 20 to 30. The z-axis shows the steady-state availability of HECWSNs with a star topology, which ranges from 0 to 1.Figure 9
Steady-state availability of HECWSNs with a star topology.With the increase in the total number of common sensor nodes connecting to the sink sensor node, the steady-state availability of the HECWSNs will increase (see Figure9). However, with the increase in the number of common working sensor nodes connecting to the sink sensor node, the steady-state availability of the HECWSNs will decrease. For example, when the number of common working sensor nodes connecting to the sink sensor node is 20, the steady-state availability of HECWSNs with a star topology will gradually increase from 0 to 0.75 as the total number of common sensor nodes connecting to the sink sensor node increases from 20 to 30. When the total number of common sensor nodes connecting to the sink sensor node is 30, the steady-state availability of HECWSNs with a star topology will gradually decrease from 0.75 to 0 as the number of common working sensor nodes connecting to the sink sensor node increases from 15 to 30. Therefore, when constructing HECWSNs with a star topology, it is necessary to increase the number of redundant common sensor nodes according to the actual situation, which helps to increase the steady-state availability of HECWSNs with a star topology.


## 7.4. Steady-State Availability of HECWSNs with a Cluster Topology

Figure10 shows the evaluation results for the steady-state availability of HECWSNs with a cluster topology. The x-axis shows the number of working clusters, which ranges from 15 to 30. The y-axis shows the total number of clusters, which ranges from 20 to 30. The z-axis shows the steady-state availability of HECWSNs with a cluster topology, which ranges from 0 to 1.Figure 10
Steady-state availability of HECWSNs with a cluster topology.With the increase in the total number of clusters, the steady-state availability of HECWSNs with a cluster topology will increase (see Figure10). However, with the increase in the number of working clusters, the steady-state availability of HECWSNs with a cluster topology will decrease. For example, when the number of working clusters is 25, the steady-state availability of HECWSNs with a cluster topology will gradually increase from 0 to 0.75 as the total number of clusters increases from 24 to 30. When the total number of clusters is 26, the steady-state availability of HECWSNs with a cluster topology will gradually decrease from 0.75 to 0 as the number of working clusters increases from 15 to 27. Therefore, when constructing HECWSNs with a cluster topology, it is necessary to increase the number of redundant clusters according to the actual situation, which helps to increase the steady-state availability of HECWSNs with a cluster topology.


## 7.5. Steady-State Availability of HECWSNs with a Mesh Topology

Figure11 shows the evaluation results of the steady-state availability of HECWSNs with a mesh topology. The x-axis shows the number of common working sensor nodes in a subnet, which ranges from 2 to 6. The y-axis shows the total number of common sensor nodes in a subnet, which ranges from 20 to 30. The z-axis shows the steady-state availability of HECWSNs with a mesh topology, which ranges from 0 to 1.Figure 11
Steady-state availability of HECWSNs with a mesh topology.With the increase in the number of common sensor nodes in a subnet, the steady-state availability of HECWSNs with a mesh topology will increase (see Figure11). However, with the increase in the number of common working sensor nodes in a subnet, the steady-state availability of HECWSNs with a mesh topology will decrease. For example, when the number of common working sensor nodes in a subnet is 2, the steady-state availability of HECWSNs with a mesh topology will increase from 0 to 1 as the total number of common sensor nodes in a subnet increases from 20 to 30. When the total number of common sensor nodes in a subnet is 30, the steady-state availability of HECWSNs with a mesh topology will decrease from 1 to 0.18 as the number of common working sensor nodes in a subnet increases from 2 to 6. Therefore, when constructing HECWSNs with a mesh topology, it is necessary to increase the number of redundant common sensor nodes in a subnet and the number of sink sensor nodes, which helps to increase the steady-state availability of HECWSNs with a mesh topology.


## 8. Conclusions

To suppress the spread of malware and improve the steady-state availability of HECWSNs, considering the heterogeneity of common sensor nodes and sink sensor nodes in HECWSNs with malware infections, we evaluated the steady-state availability of HECWSNs with malware infections based on an SMP and a Stackelberg game. First, we established the SADG to predict the optimal infection probability of malware. Second, extending the classical epidemic SIR model by adding statesT, A, and D, we proposed an HSTARD model to describe the states of HSNs. Third, considering the influence of the malware attack correlation on the steady-state availability of HECWSNs, we obtained the steady-state availability of HECWSNs with various topologies, including the star topology, cluster topology, and mesh topology. The steady-state availability evaluation of HECWSNs provides a theoretical basis for the design, deployment, and maintenance of high-availability HECWSNs.In future work, an even more interesting direction to consider is the heterogeneity of infection change rate of HSNs. When the influences of neighbour sensor nodes are considered, the infection change rate of HSNs is effect by their degree. In addition, another consideration is to evaluate the steady-state availability of HECWSNs with multiple topologies, in which HSNs are deployed in a variety of topologies, including star topology, cluster topology, and mesh topology.



---

*Source: 4743605-2022-04-11.xml*