key: cord-0474263-6njrtxo5
authors: Benomar, Ziyad; Ghribi, Chaima; Cali, Elie; Hinsen, Alexander; Jahnel, Benedikt
title: Agent-based modeling and simulation for malware spreading in D2D networks
date: 2022-01-28
journal: nan
DOI: nan
sha: 8815068a62d0a900710c8975826358ca71dfa9b5
doc_id: 474263
cord_uid: 6njrtxo5

This paper presents a new multi-agent model for simulating malware propagation in device-to-device (D2D) 5G networks. This model allows to understand and analyze mobile malware-spreading dynamics in such highly dynamical networks. Additionally, we present a theoretical study to validate and benchmark our proposed approach for some basic scenarios that are less complicated to model mathematically and also to highlight the key parameters of the model. Our simulations identify critical thresholds for"no propagation"and for"maximum malware propagation"and make predictions on the malware-spread velocity as well as device-infection rates. To the best of our knowledge, this paper is the first study applying agent-based simulations for malware propagation in D2D.

D2D communications is one of the key emerging technologies for 5G networks and beyond. It enables a direct exchange of data between mobile devices, which extends coverage for devices lacking direct access to the cellular infrastructure and therefore enhances the network capacity. However, security issues are very challenging for D2D systems as malware can easily compromise mobile devices and propagate across the decentralized network. Compromised devices represent infection threats for all of their connected neighbors as they can, in their turn, propagate malware through susceptible devices and form an epidemic outbreak. This enables attackers to infect a larger population of devices and to launch cyber-and physical malicious attacks. Therefore, it is of great importance to have a good understanding of vulnerability and security issues, particularly of the malware propagation processes, in such networks and to be able to design optimal defense strategies.

Modeling malware propagation in D2D is challenging due to the complexity of such networks induced for example by topology or device mobility. In order to cope with this, D2D can be investigated and analyzed using analytical models (e.g., stochastic geometry, stochastic processes, etc.). Some of these approaches have been proposed to model malware spreading in D2D networks [1] , [2] , [3] . Nevertheless, classical simulation and analytical tools are often not suitable for capturing the global dynamics of complex systems. ziyad.benomar@orange.com chaima.ghribi@orange.com elie.cali@orange.com alexander.hinsen@wias-berlin.de benedikt.jahnel@wias-berlin. de In this paper we propose to tackle the problem from the perspective of complex-systems science and present a new agent-based model (ABM) in order to analyze and understand malware propagation in D2D networks. For this, the agentbased simulation approach provides the possibility to simulate complex-systems dynamics and to test theories about local behaviors and their emergence. Unlike traditional techniques of simulation, based on mathematical or stochastic models, multi-agent simulation is more suitable for complex problem modeling and simulation. In fact, applying classical simulation and analytical tools, such as differential equations, to complex systems often produces undesired complications. Indeed, many challenges that arise in the traditional numerical modeling come from the fact that individual actions (activities that result in a modification of the system) and their impact on the dynamics of the system are often underrepresented. Usually, individual behaviors, i.e., decisions made at the individual or group level, cannot be incorporated into these simulations. On the other hand, in a multi-agent simulation, the model is not a set of equations as in mathematical models, but a set of entities. Here agents represent the set of all the simulated individuals, objects encode the set of all represented passive entities, and the environment is the topological space where agents and objects are located and which they can move in and act upon.

Although agent-based simulations have been successfully used to model complex systems in different areas like biology, sociology, political science and economics, it is still insufficiently explored in the field of telecommunication networks, specifically for malware spreading in D2D. In this work, we aim to shed more light on whether such highly dynamical D2D networks can be treated as a complex system and whether complex-systems science can give insights on the emergent properties of malware propagation. The main contributions of this paper are as follows:

• We propose a new ABM for studying malware propagation in D2D 5G+ networks and we formally prove its correctness for predicting different agents status over the time. • We perform a theoretical study to estimate the critical values of the model's parameters and to identify the most important ones to consider for simulations. • We perform simulations to study and understand malware-spreading dynamics. Some critical thresholds have been identified. Important aspects like malware infection rates and velocities have been also studied to understand how they will evolve as functions of the parameters. The rest of the manuscript is organized as follows. Section II reviews related work. Section III describes the ABM for malware propagation in D2D networks. Section IV shows details of our multi-agent simulation implementation. Section V presents a theoretical study for the problem in some specific scenarios. Section VI shows simulation results followed by conclusions in Section VII.

ABMs are effective and robust tools in simulating complex and dynamic phenomena like epidemic spreading. These models have been used primarily in epidemiological studies of infectious diseases and have recently gained a great importance also in the epidemiological modeling as can be seen from the vast literature in the context of the COVID-19 pandemic, see for example [4] , [5] , [6] , [7] .

However, ABMs are still in their infancy with regard to telecommunication networks. Some ABMs have been proposed in the literature for IoT networks. Authors in [8] , [9] , [10] proposed ABMs for analyzing IoT systems. Other applications of ABMs to telecommunication networks are proposed in [11] and [12] , where authors analyzed the effectiveness of ABMs to understand self-organization in peer-to peer and ad-hoc networks. These studies provide further motivation to our investigation on applying ABMs for studying malware spreading dynamics in D2D 5G networks.

Let us again mention that conventionally D2D systems are modeled using analytical methods (e.g., stochastic geometry) which have proven to be powerful tools for modeling spatial device and road systems. In this context, the authors in [1] and [2] present a framework for the modeling and understanding of malware spread in D2D with mobile devices and study some strategies of both defenders and attackers. The proposed model is based on an analytical approach and does not consider urban environments. In view of this, a standard SIR model is presented in [13] , to study malware propagation in D2D considering urban environments but mobility was not taken into account. Even though the obtained results were promising, some questions remained open regarding the convergence of the malware propagation speed, the shape theorem of the infection and the critical thresholds. This mainly comes from the fact that the dynamics of the system were insufficiently captured.

This section gives a detailed description of the D2D malware propagation model in urban environments. In this ABM description, devices are represented as reactive agents that move in the environment and have a variety of capabilities like neighborhood discovery and malware propagation. In short terms, the system has the following composition. We consider an urban environment. At initial time, devices are placed randomly on the streets (we make the simplifying assumption that devices that are situated in buildings are not to be taken into account : this can be justified by the high frequencies used in 5G). The devices move independently and randomly at a constant speed. Moreover, two devices can communicate directly with each other if they are close enough and on the same street. Let us note that this approach takes shadowing into account, but not interference. At time zero, a virus is introduced carried by a device near to the center of the city. The virus can now propagate from one device to another if they can communicate for a sufficiently long time that represents the discovery time plus the transmission time.

We consider our urban street environment E as a twodimensional planar Poisson-Voronoi tessellation (PVT, see [14] ) induced by a homogeneous Poisson point process (PPP) X E of positive intensity λ. The PVT is a one-parameter segment process that has been shown to be a good fit for the street systems of European cities (see [15] , [16] , [17] ). It has been widely used to model different urban environments as random tessellations, since it allows to go beyond specific urban topologies. We will denote by S the set of edges of E (representing the streets). The devices are placed on S as a linear PPP of intensity θ, thus forming a Cox point process (CPP) on the plane with random intensity measure Λ(B) = θ|S ∩ B| for every measurable B ∈ R 2 . Here |S ∩ B| stands for the total length of S in the area B.

We note first that the environment is modeled as an undirected graph, relying on some stochastic-geometry concepts, as described in Section III-A. Then, we define our malwarepropagation system in D2D as a finite number of agents, states, actions and rules, MAS := {A, St, Act, R, T}.

More precisely, we consider a set of n agents A = { a i : i ∈ [1, n] } corresponding to devices and a state space St = {susceptible, infected}. Further, Act = {"move", "discover", "connect", "infect"} denotes the set of actions that each agent can perform according to its state. R represents the set of the behavioral rule base. Time T is assumed to be divided in time units called slots, where each slot k is represented by a positive integer.

Initially, agents are distributed on the edges of E (i.e., streets of the city) as described in Section III-A. One agent of type infected is introduced around the center of the map. Then, formally, each agent a i is defined at each time slot by a tuple

Here, X i,k specifies the agent's location in terms of coordinates at time kdt, V i,k = v represents the agent's moving speed and N i,k the knowledge base, representing what each agent a i knows about its neighboring agents and the environment at time slot k. Further, ξ i,k ∈ St represents the state of agent a i and Act i,k is the set of actions that can be performed by a i . Finally, T (I) i,k represents the first time when a i becomes infected. It will be updated during the simulation depending on the agent's interactions. T (I) i,0 is set to +∞ for initially susceptible agents and 0 for the infected one. The state of a i ∈ A at kdt for k ≥ 1 is given by

In particular, the state of a i at a step k of the simulation is computed using the variables (T (I) i,k−1 ) ai∈A from the previous step. This formula also implies that the states of the agents will not change between the steps 0 and 1. It will be indeed the case since we will consider a time step dt smaller than ρ.

(See Section IV-B).

Let us describe the three different behaviors of agents: mobility, communication and infection.

1) Mobility behavior: Devices move at the same constant speed v, starting from a base position, and repeating indefinitely the following street-adapted random-waypoint model:

• Each device independently picks a destination on the street. For this we sample a random point P in the plane using a Gaussian distribution centered on the device X, and with a standard deviation equal to σ X = (15min)×v.

The destination we take for X is then the closest point of P in E. This choice of σ X shows that devices will go to destinations that they can reach in an average time of 15min if they take a straight path. • Devices move to their destinations following the shortest path along the streets. • Once arrived, devices go back to their starting position following the shortest path along the streets (anchored movement). 2) Communication behavior: In order to exchange messages, two communicating devices/agents must obey the following rules:

• (RAD): The Euclidean distance between the two devices is less than a given constant threshold r. • (LOS): The two devices are on the same street. The first rule supposes that the emission power of the devices is a constant and that we do not take into account interference. The second rule means that the signal cannot go through the buildings and that reflections and diffractions are not taken into account. In symbols, for X i (t) the position of device a i at time t and N (a i , a j ) := {t ≥ 0 : X i (t) − X j (t) < r and ∃s ∈ S such that (X i (t), X j (t)) ∈ s}, we have that a i and a j are connected at time t if and only if t ∈ N (a i , a j ).

3) Infection behavior: We will follow a standard SI compartmental model, very similar to SIR which is a classical approach in epidemiology often used within the framework of differential equations. However, unlike the latter, in a D2D context, users are constrained to be positioned on streets and are mobile, two aspects that are usually not represented in epidemiological studies. The SI model is formulated by first partitioning devices into two distinct categories called susceptible (S) and infected (I). At time zero, only one device will be in the infected state, while a CPP X S with intensity θ will define the susceptible devices, independent of the former one given the PVT tessellation. When an infected device is connected to a susceptible device for a time longer than a given threshold ρ, the susceptible device will become infected. More precisely, if the device a i is infected at time t and if [t, t + ρ] ∈ N (a i , a j ), then a j is infected at (t + ρ). 4) Agent states: Agent states specify what state an agent is in. Agent-state transitions are driven by the rule base R that implements the reactive behavior of agents. It allows to select actions to take for agent a i depending on its current local state ξ i,k and its knowledge base N i,k . More specifically, we write R = {Θ} where Θ(ξ i,k , N i,k ) are the active rules that map the set of states and observations to actions for reactive tasks

i,j be the connection duration between agents a i and a j and ρ be the needed time for the virus transmission from one agent to another. Then the principal rule-based function is described as follows.

• Malware infection rule: If agent a i is infected, agent a j is susceptible (ξ i,k = infected, ξ j,k = susceptible ) and a i was connected to a j for a time longer than the infection threshold (T

, then the state of agent a j will be transited from susceptible to infected (the action infect will be activated),

A more detailed description of the algorithm associated to malware infection will be given in Section IV.

In this section we present more details on the implementation of our multi-agent simulation tool. Let us denote by P := {dt, ρ, r, λ, θ, v} the set of key model parameters where dt represents the elapsed time in each step, ρ and r represent respectively connection time needed for virus transmission and communication radius of agents. λ is the intensity of Voronoi seeds (seed/km 2 ), θ is the intensity of susceptible agents (agent/km) and v denotes agents speed (km/h). Other parameters such as the dimensions (H 1 , H 2 ) of the map can be added to this list, but we will not focus on these in our study. For the most part of the manuscript, we give the same speed to all the agents in order to keep a restraint number of parameters. However, we can easily have a more general model where the speeds of the agents are distributed following some probability law. Each agent could have for example a speed taken uniformly at random in some interval [v 1 , v 2 ]. Our simulation is done over steps, each step corresponds to a time instant kdt. In the following we will denote by M k the model at step k. It represents the map, the agents and all their attributes (coordinates, states, etc.) at step k. In the simulation, we first generate a random map, then the agents, and after that we run the function Step(M k ), that updates the variables of the model, taking it from a step k to the next step k + 1, for a number k max of iterations. Algorithm 1 describes the entry function of the simulation. The function GenerateMap(λ) Algorithm 1: Main(P, k max ): The main function describing the simulation Input : The set of parameters P and the maximum number of steps k max Output: The state of a randomly generated model at

where A S is the set of initially susceptible agents distributed on M using homogeneous PPP with parameters θ. a i0 is the initially infected agent, placed near the center of the map.

Recall that our simulations are done over steps, where each step k corresponds to a time instant kdt. A difficulty lies in the correct updating of the states of the agents. From step k to k + 1, each agent moves independently as described in Section III-C1, which means that we can access the positions of the agents at times (kdt) k∈N knowing their velocities and the edges they have been through, but it is complicated to know all the interactions they had given only this information.

To overcome this, we first impose the constraint dt < ρ. This guarantees that, by only observing the positions of the agents at discrete times with a step dt, we will not miss any two devices that connect for a duration longer than ρ, see Section IV-B for more details. Let k ∈ N, and let us assume that a i , a j are connected to each other at kdt. We will treat the general case where they can have different speeds v i and v j , and we will compute the duration of the connection using their movement equations. Let us denote by t

i,s ) the time when a i gets in (respectively out) of the street s. These can easily be computed knowing X i and the length L(s) of the street s. Since s has two different directions, we need to consider their velocities v i , v j . Let P 1 , P 2 be the positions of the two extremities of the street s, let e := (P 2 −P 1 )/ P 2 −P 1 (we can take −e instead), and ν i , ν j be such that v i = ν i e, v j = ν j e. We recall that the absolute speed v i of a i obeys v i = v i = ±ν i , the same holds for a j . Finally, let us also define the coordinates of a i , a j on the street s by d i,k := (X i,k − P 1 ) · e and d j,k := (X j,k − P 1 ) · e. Then we have the following result that we present without proof. Lemma 1. If a i , a j are connected at time kdt and if ν i = ν j , then they are connected during all the time interval

The connection duration of a i , a j is then T

In words, two agents on the same street can have different speeds and move either in the same or in opposite directions. Recall that the connection-time interval is the set of all times such that the distance of the two agents is less than r.

We saw in Section III-B, that agents states will be determined by the variable T (I) i,k−1 at each step k ≥ 1. We call S k , I k the sets of susceptible and infected agents. Let ConnectionInterval(a i , a j , k) be a function computing t

as in Lemma 1 knowing that a i , a j are connected at kdt, and let GetNeighbors(a i ) be a function returning the set of neighbors of a i defined as: N k (a i ) := {a j ∈ A : X i,k − X j,k ≤ r and a i , a j on the same street}. Finding the neighbors of all the agents would normally require a O(n 2 ) time complexity, but since only agents on the same street can connect to each other, we can considerably reduce this complexity by searching neighbors of each agent only among those that are on the same street. From here, we can write Algorithm 2 that updates the values T 

Line 4 makes sure that we only compute the time when the agents are connected and a i is infected. Note that in Line 6, we cannot set the value of T (I) j,k simply to t (C,i) i,j + ρ as agent a j might be connected to several infected agents, and it will become infected as soon as it stays connected to one of them for longer than ρ. Finally, we can write the core function of our simulation, that is Algorithm 3.

We denote by ξ i (t) the state of agent a i at continuous time t for any a i ∈ A. On the other hand, for each k ∈ N we denote as before by ξ i,k the state of a i at discrete time kdt as 

predicted by our ABM. The following theorem states that for sufficiently small time slots, at the discrete time points, our model is equivalent to its continuous-time version and is then theoretically proven to be correct.

Theorem 2. If dt < ρ, then we have

In words, Theorem 2 guarantees that, by discretizing, we do not miss infection events and the introduced time differences do not induce errors in the discretized model. Let us first define the first continuous time when a j ∈ A is infected, i.e., T i,0 for all a i ∈ A. We have the following lemma. Lemma 3. If dt < ρ, then for any k ∈ N, assertion B k is true

∀a j ∈ A,

Note that, if B k is verified for some k ∈ N, thenS k ⊂ S k andĨ k ⊂ I k . But sinceS ∪Ĩ k = S k ∪ I k , this means that S k = S k andĨ k = I k and thus Theorem 2 is proved.

Proof. For k = 0 the assertion is true by definition of (T (I) i,−1 ) ai∈A . Let k ≥ 1, assume that B k is true and let a j ∈ A. If T j,k was updated during step k, i.e., there exists an agent a i ∈ I k for which InfectNeighbor(a i ) was called and such that a j ∈ N (S) i,k and t 2 − t 1 ≥ ρ with t 1 = max{t N (a i , a j ) , and since a i ∈ I k , we have by the induction hypothesis thatT ≤ (k + 1)dt, this implies that a j ∈S k and there exists a i ∈ A such that [t,t + ρ] ⊂ N (a i , a j ) andt ≥T

and this implies that a i ∈Ĩ k and kdt ∈ [t,t + ρ] ⊂ N (a i , a j ) . Thus InfectNeighbors is called on a i at step k and a j is among the visited agents during this call (neighbors of a i ).T (I) j,k will then be updated and its final value will be at mostt+ρ =T

j,k that we already proved, we deduce thatT

Finally, for any k ∈ N, we have by Lemma 3 thatS k = S k andĨ k = I k . This means that the states of the agents predicted by the simulator correspond to their real states.

The model that we presented so far is very rich with many parameters. It is therefore difficult to run simulations varying all these parameters and see how each of them influences the propagation of the virus. So, in order to better choose the values we will assign to them, in this section, we present a theoretical study on a simplified model to identify critical relationships between parameters and values that will lead to drastic changes in the system's evolution. Let us highlight that we consider a different model that does not arise as a limiting object. It is mainly introduced in order to sharpen the intuition for threshold values of important parameters.

As in the first model, we start with a single infected agent a i0 , and we will take interest in the time of the first virus transmission, which we will denote by τ in the following. Let us stress that the simplified model that we present here is used only as a mathematical model. All the simulations results in Section VI are based on the original model and not this simplified one.

We consider the following mean-field approximation of our spatial model. Instead of considering a i0 to be moving on a PVT, we will consider that it moves on a succession of streets s 0 , s 1 , . . ., each having a length L (i) λ that is a random variable with density f λ,L , where f λ,L is the density function of the edges lengths in a PVT having a seeds intensity equal to λ (see Section III-A). We will assume that, when a i0 enters a street, other agents are distributed on it as an homogeneous PPP with parameter θ, and that they can move in any of the two possible directions. What we mainly lose in this simplified model is the dependence between the lengths of the successive streets visited by a i0 .

For each street s i visited by a i0 , let C i be the number of agents that a i0 infects while being on s i . Let p := Pr[C i ≥ 1] denote the probability that a i0 infects at least some agent on s i (p is independent of i).

Then, we have the following main results.

Theorem 4. If τ is the first time when a i0 infects another agent, then

There exists a positive constantC such that if p is sufficiently small, then for t 0 = 1/(3 √ pλv) we have

These theorems indicate that, if the probability of infecting another agent on a single street s i is low, then the waiting time before the virus transmission is very large, and therefore the virus propagation is weak. In terms of the asymptotic behavior of the system, we can state that, when

The proofs rely on results for typical edge length in PVT and Berry-Esseen inequalities. Let us start by presenting a first lemma on the edges-lengths distribution when λ = 1, as described in [18] . Lemma 6. In a random planar PVT, if we choose a random edge, then its length L is a random variable having a distribution f L satisfying Lemma 7. If P λ is a PVT generated with an intensity of seeds λ > 0, then the edges length in P λ will have a density function f λ,L given by

Then we have the following statement.

Corollary 8. If L λ is a random variable with density f λ,L , then for any positive integer n, L λ has a n-th moment given by

Finally, since f L is a rapidly decreasing function when is large, we have the following probability estimate.

Lemma 9. There exists l 0 > 0 such that for any x ≥ l 0 / √ λ

Next, the following theorem is a corollary of the Berry-Esseen's inequality [19] , [20] 

Here Φ is the cumulative distribution function of the standard normal distribution.

We are now in the position to prove our main theorems.

Proof of Theorem 4. We only need to observe that τ 0 + . . . Proof of Theorem 5. To prove this theorem, we first need to observe that for anym

Pr[m ≥m] (the second inequality is true because all the τ i are non-negative).

On the other hand, if p ≤ (6σ L ) −4 , using Theorem 10 and the inequality Φ(−x) ≤ exp(−x)/ √ 2π, which is true for any x ≥ 2, we find a constant C 1 verifying

Finally, when p is small enough, we deduce using again Bernoulli's inequality that

This finishes the proof.

We will now apply the previous theorems to show that the virus propagation is slow in any of the following cases.

• The transmission time of the virus is very large compared to the expected time spent by agents on streets :

√ λρv 1 • The number of agents reachable within the communication radius is very small: θr 1 • The number of agents on each street is very small: θ/ √ λ 1.

. The result follows directly from Theorem 4.

Proof. If r < ρv, then a i0 can only infect the agents moving in the same direction as him: its connection time with the agents moving in the opposite direction is upper bounded by r/v < ρ. Let N c be the number of agents that a i0 connects to while being on s 0 . Since each agent in s 0 can be moving in any of the directions with a probability 1/2, N c is dominated by a random Poisson variable with parameter 2θr/2 = θr, which means that

Since C 0 ≤ N c , Theorem 4 gives the desired result.

Proof. We can easily prove that the number N of agents that were on s 0 at some time instant when a i0 was on it too follows a Poisson distribution with parameter 2θL

λ . In fact, when a i0 enters s 0 , there are N 1 agents on the street, and by the time it reaches the end of the street, since all the agents have the same speed, all of these will have left it and N 2 new agents will have come. N 1 and N 2 both follow a Poisson distribution with parameter θL (0) λ and N = N 1 + N 2 . Finally, given that C 0 ≤ N , we have

Applying Theorem 4 concludes the proof.

Using Theorem 5 in these three cases, we can also find lower bounds for τ that hold with high probability.

This section discusses simulations that were performed to analyze malware propagation in D2D, to benchmark the mathematical study made in Section V and to show how the various parameters accelerate or slow down propagation. Our ABM was built based on Mesa [21] , which is a very suitable python framework for ABMs that we have extended to generate and visualize street system environments.

We present some indicators that allow us to analyze malware propagation. They should be independent of the dimensions of the map, since we theoretically want to study propagation on an infinite plan. To study the system behaviour, we will set a value of u large enough and observe V u considering that it approximates sufficiently the asymptotic values. We remind that we denote by I(t) the set of infected agents at time t, and that we call a I0 the only initially infected agent, and X I0 its position at time 0. a I0 is always chosen close to the center of the map.

is the open ball of center X I0 (0) and radius u, and τ u is as in Definition 14.

Note that |{X j (τ u )} ∩ B(X I0 (0), u)| is simply the number of agents inside B(X I0 (0), u) at time τ u .

V and R are defined as limits, let V u and R u be the expressions in Definitions 14 and 15 that converge to them respectively. Since the plots we will make require running lots of simulations, and thus take a very long time to be constructed, we were not able to make them with different values of u and study the convergence of V u , R u to V, R.

Since we are mostly interested in the behavior of the system and not really in the exact values of the propagation speed and the infection rate, it is enough to set a large enough value for u, consider that V ≈ V u and R ≈ R u , and interpret the results.

For all simulations, unless otherwise stated, parameters are set by default as follows: (u = 3.5km, H = 10km, λ = 50km −2 , θ = 3km −1 , v = 5km/h, ρ = 20s, r = 200m).

where H is the side length of the square surface containing the map. We assume dt = 0.9ρ. Each value in the diagrams we will present later is the average over 20 simulations with the same set of parameters. In the diagrams where λ does not vary, we use the same 20 maps for all the points.

1) The threshold √ λρv: The critical regimes seen in Section V are relevant and confirm the intuitive expectations one may have for the virus propagation. However, the most remarkable result concerns the regime √ λρv 1, because the lower bound found for E[τ ] grows with a speed of x → exp(x 2 )/x in the quantity √ λρv, we can thus expect to observe a rather tight threshold at the level of which the propagation is no longer possible. To have meaningful results, we will vary λ from 10 to 200 and the speed of the agents from 1 to 90, and the other parameters will be set by default as in Sections VI-B. However, when λ is very large, the number of agents E[|A|] = 2 √ λH 2 θ will be also large since, even if it is only proportional to √ λ, the multiplicative constant is large. To keep a reasonable number of agents, we use maps with side-length H λ := 20λ −1/4 for each value of λ, and the stopping propagation radius u λ := 0.45 × H λ to have H > 2u. This will guarantee that the expected number of agents is E[A] = 2400 (θ = 3), and the side-lengths will vary from ≈ 11.24 to ≈ 5.32km.

We observe in Figures 1 and 2 that the rate of infection and the speed of propagation both cancel out above a certain threshold curve, having a shape of type v(λ) = c/(ρ √ λ), as indicated in blue (for c = 2/3) and white (for c = 3/2). This confirms the hypothesis of the exponential lower bound of E[τ ], although it is obtained with a simplified mathematical model. It seems however that this threshold is sharper for R than for V. The reason why we have such a threshold is that the distribution of the edges lengths in a PVT makes it very rare to have edges much larger than the mean edge length E[L λ ] = 2/(3 √ λ) (see Corollary 8) , and therefore, when there is no edge larger than ρv, the virus cannot propagate since connection require agents to be on the same street.

With respect to Figure 2 , we see that the virus can hardly propagate if √ λρv ≥ 3/2. A surprising remark is that the maximum infection rate is always not far below the curve √ λρv = 2/3, while the maximum propagation speed seems to be achieved exactly at the points verifying this equation. We also observe a lower threshold value of the speed: the virus hardly propagates for v = 3, but as soon as v = 6, we see a remarkable jump in the values of R and V. It is to be expected to have a weaker propagation for the small values of the speed because in the limit v = 0 the virus can propagate at most in the street where it was initially placed.

The third observation is that the virus propagation becomes slower as λ becomes larger. The reason is that, as predicted by the simplified model in Section V, when √ λ becomes much larger than θ, we have too many streets compared to the number of agents, and therefore a I0 will only meet a few agents.

2) How is the propagation speed impacted by θ and v?: The propagation speed of the virus is certainly a function of all the parameters of our model. However, the distance r is given by the technology and cannot be changed, and the intensity of streets λ is known for a given city. Now, for a given malware, we want to see the influence of the intensity and speed of users on the propagation speed and the infection rate. In fact, agents that move fast enough but not too fast, i.e., not to have √ λρv ≥ 3/2, will rapidly carry the virus to the other edges and facilitate its spreading. Also, when agents' intensity is important, there will be always agents on these streets that will get infected and carry the virus further.

Considering Figure 4 , we see that the propagation speed and the infection rate show different behaviors. Indeed, although both are increasing in θ, R is maximal for v around 7 − 10km/h, while V is maximal for v around 15 − 20km/h. Moreover, the high values of the propagation speed are more concentrated while those of R seem to be more spread out. Also, for every θ, there is clearly an increase and then a decrease of V when we increase v, going from ≈ 0km/h to the maximal value and then returning to 0km/h. But the value R does not change a lot in the first range of values of v. This means that, when agents are slow, they will stay sufficiently long on every street and therefore, once an infected agent reaches a street, it will infect many agents being on it too. Propagation speed is nevertheless slow because agents take a lot of time before exiting each street and carrying the virus to the next one. This correlation between R and V confirms the need to study these two quantities together.

Returning to the results of Figure 3 , the value of v for which √ λρv = 2/3 is v 0 ≈ 16.97. Thus, we have again that R is maximal in the region below the level line √ λρv = 2/3, and V is maximal exactly in its close neighborhood. This property would therefore be true even when varying θ. For larger values of v, we expect that the virus will not propagate anymore because the streets are not long enough, and we already see the beginning of this behavior. However, we notice that the speed at which the propagation weakens depends on θ: the higher the intensity of the agents, the higher the speed needed to weaken the virus propagation, which is to be expected since the increase of θ favors the propagation of the virus. Moreover, for small values of θ, the propagation never takes place whatever the value of v because the agents are few and do not establish enough connections (θ is below the percolation threshold).

This paper presents a novel ABM for analyzing malware propagation dynamics in D2D networks. This approach, traditionally applied for complex systems, allows us to obtain relevant and surprising findings about malware propagation in D2D, which demonstrate also the effectiveness for such dynamical communication networks. Notably, malware propagation was not possible above a first threshold ( √ λρv > 3/2) and was maximal around a second threshold ( √ λρv = 2/3), which corresponds to having an average length of streets equal to the distance traveled by an agent during the time ρ (needed for infection transmission). This shows the importance of street system characteristics, which has been traditionally neglected when studying malware propagation in D2D. We believe that the ABM approach has a great potential for studying malware spread in D2D communication networks. Besides generalizations such as adding attributes for the street widths, devices out of the street system or sojourn times, as future work, we aim to model and simulate countermeasure policies for reversing malware attacks.

Preventing malware propagation in D2D offloading networks with strategic mobile users

Differential security game in heterogeneous deviceto-device offloading network under epidemic risks

Malware propagation in urban D2D networks

Predicting the effects of Covid-19 related interventions in urban settings by combining activity-based modelling, agent-based simulation, and mobile phone data

Determining the optimal CovidFWiopt-19 policy response using agentbased modelling linked to health and cost modelling: Case study for victoria, australia

Agent-based modelling for Sars-CoV-2 epidemic prediction and intervention assessment: A methodological appraisal

Designing social simulation to (seriously) support decision-making: Comokit, an agent-based modelling toolkit to analyse and compare the impacts of public health interventions against Covid-19

Agent-based modeling of an IoT network

Agent-based modeling for distributed decision support in an IoT network

Fabiot: A flexible agent-based simulation model for IoT environments

Agent-based tools for modeling and simulation of self-organization in peer-to-peer, ad hoc, and other complex networks

A novel agent-based simulation framework for sensing in complex adaptive environments

Phase transitions for chase-escape models on Poisson-Gilbert graphs

Stochastic Geometry and Its Applications, ser. Wiley Series in Probability and Statistics

Fitting of stochastic telecommunication network models via distance measures and monte-carlo tests

Parametric distance distributions for fixed access network analysis and planning

Cost estimation of a fixed network deployment over an urban territory

Statistics of random plane Voronoi tessellations

The accuracy of the Gaussian approximation to the sum of independent variables

On the liapunoff limit of error in the theory of probability

Utilizing Python for agent-based modeling: The Mesa framework