Steady-State Availability Evaluation for Heterogeneous Edge Computing-Enabled WSNs with Malware Infections

To evaluate the steady-state availability of heterogeneous edge computing-enabled wireless sensor networks (HECWSNs) with malware infections, we ﬁ rst propose a Stackelberg attack-defence game to predict the optimal strategies of malware and intrusion detection systems (IDSs) deployed in heterogeneous sensor nodes (HSNs). Next, we present a new malware infection model — heterogeneous susceptible-threatened-active-recovered-dead (HSTARD) based on epidemic theory. Then, considering the heterogeneity of sink sensor nodes and common sensor nodes and the malware attack correlation, we derive the state transition probability matrix of an HSN based on a semi-Markov process (SMP), as well as the steady-state availability of an HSN. Furthermore, based on a data ﬂ ow analysis of HSNs, we deduce the steady-state availability of HECWSNs with various topologies, including the star topology, cluster topology, and mesh topology. Finally, numerical analyses illustrate the in ﬂ uence of the IDS parameters on the optimal infection probability of malware and reveal the e ﬀ ect of multiple factors on the steady-state availability of HSNs, including the initial infection rate, the infection change rate, and the malware attack correlation. In addition, we present data analyses of the steady-state availability of HECWSNs with various topologies, including the star topology, cluster topology, and mesh topology, which provide a theoretical basis for the design, deployment, and maintenance of high-availability HECWSNs.


Introduction
In recent years, edge computing has emerged to address computation-intensive tasks in the 5G architecture [1], for which it can deploy servers at the edges of the network and provide services for the end users. This architecture is also applicable to heterogeneous wireless sensor networks (HWSNs), which enables heterogeneous sensor nodes (HSNs) to offload computation tasks to the deployment servers through the base stations [2]. In this manner, edge computing systems have begun to provide services for HWSNs to improve the performance of HSNs.
With the popularity of low-budget smart sensors, HWSNs have attracted considerable attention from researchers in many fields, including smart transportation, smart grids, the military, and smart homes [3][4][5][6][7][8][9]. These applications make our lives more comfortable. However, HWSNs have the same deficiencies as WSNs: HSNs have limited energy, computa-tional capacity, and storage capacity [10,11]. The other concern is that HWSNs are vulnerable to malware attacks, and malware can damage HWSNs in many ways, which not only affects the performance of HWSNs but also renders HWSNs unable to provide normal services [12]. The steady-state availability of HECWSNs is one of the factor to evaluate its performance, which indicates the probability that HECWSNs are available or reliable when sensing data, transmitting data, and aggregating data during the long-term operation. To address these issues, we evaluate the steady-state availability of heterogeneous edge computing-enabled wireless sensor networks (HECWSNs) with malware infections.
Malware refers to any malicious program with intentional attacks and serious destructive power [13][14][15][16][17], which causes great damage to networks, computer systems, and data [18]. Due to the limited resource allocation of HSNs [19], HECWSNs are vulnerable to malware attacks [20][21][22]. Once a piece of malware has attacked an HECWSN successfully through the HSN system's security vulnerabilities, it will eavesdrop on information, block networks, wastefully spend the HSN's energy, or compromise it [23], which can seriously corrupt and damage the HECWSN. This paper will study the service availability of HECWSNs, and it aims to judge the steady-state availability of HECWSNs by evaluating the performance of HSNs. In other words, when HECWSNs are infected by malware, we study whether the HECWSNs can reach a steady state and provide data acquisition, data transmission, and data processing services normally or not.
Because malware infection in HECWSNs is similar to that of epidemic in people, the epidemic model is usually adopted for reference when establishing a malware infection model for HECWSNs [24]. The classical epidemic models include SI, SIS, and SIR [14]. For example, the SIR model classifies all nodes' states into susceptible (S), infectious (I), and recovered (R). When a heterogeneous sensor node (HSN) in HECWSNs is attacked by malware, its state will undergo a series of changes. Based on the classical SIR epidemic model, considering the characteristics of malware hiding and acting, this paper proposes a heterogeneous susceptible-threatenedactive-recovered-dead (HSTARD) model to describe the states of HSNs, which includes the states susceptible (S), threatened (T), active (A), recovered (R), and dead (D).
In recent years, an increasing number of researchers have studied the problem of network security with game theory [25][26][27][28]. During the process of malware infection in HECWSNs, to defend against malware, HECWSNs use a deployed intrusion detection system (IDS) in the system of HSNs to detect malware with a certain probability [29]. The malware, to prevent detection by the IDS, will attack with a certain probability. Clearly, the attack-defence process between malware and the deployed IDS is a game problem. In this attack-defence game, the attack and defence actions initiated by the malware and IDS have priority, so it is appropriate to solve the attack-defence problem based on a Stackelberg game. Therefore, we propose a Stackelberg attack-defence game (SADG) to predict the optimal infection probability of malware, where malware is the leader and the IDS is the follower.
For an HSN, its current state determines the change in the next state, independently of the previous state, which means that the HSN state transition is random. Thus, it is appropriate to describe the state transition of an HSN using a semi-Markov process (SMP). We derive the state transition probability matrix of an HSN based on an SMP and obtain the steady-state availability of an HSN.
The contributions of this paper are summarized as follows: First, considering that the deployed IDS and malware are two agents, we establish an SADG to predict the optimal infection probability of malware. The SADG can reflect the influence of the real HECWSNs situation when players choose their strategies.
Second, considering the characteristics of malware hiding and acting, we propose an HSTARD model by adding the states threatened, active, and dead to the classical epidemic model SIR. The HSTARD model can not only reflect the latent characteristics of malware but also consider the influence of the optimal defence strategy of the IDS on malware infection.
Third, considering the heterogeneity of HSNs and malware attack correlations, which will jointly affect the vulnerability of HSNs, we derive the state transition probability matrix of an HSN based on an SMP. We also derive the steady-state availability of an HSN, which not only reflects the characteristics of sensor node heterogeneity but also reflects the influence of the number of malware attacks on the state of HSNs.
Fourth, considering the topological heterogeneity of HECWSNs, we derive the steady-state availability of HECWSNs with various topologies, including the star topology, cluster topology, and mesh topology. The steady-state availability evaluation of HECWSNs can provide a theoretical basis for the design, deployment, and maintenance of high-availability HECWSNs.
The rest of the paper is organized as follows: Section 2 describes related work. Section 3 predicts the optimal infection probability of malware based on an SADG. Section 4 describes the dynamic state transition of an HSN and proposes an HSTARD model. Section 5 derives the steadystate availability of an HSN using an SMP. Section 6 describes the steady-state availability of HECWSNs with various topologies, including the star topology, cluster topology, and mesh topology. Section 7 describes the analysis of the experimental data. Section 8 summarizes this paper.
To facilitate understanding of this paper, all symbols used are listed in Table 1.

Related Work
Edge computing helps improve computing efficiency and reduce the network transmission delay. Therefore, edge computing is widely used in 5G architecture, Internet of Things, and intelligent vehicle networking. Xiao et al. [30] presented reinforcement learning for edge computing to avoid jamming attacks and interference. Xu [31] used mobile edge computing technology to manage digital communities. Rimal et al. [32] discussed mobile edge computing's potential service scenarios and designed scenarios for mobile edge computing over Wi-Fi networks. Corcoran and Soumya [33] discussed edge computing that was suitable for real-time operation and low latency requirements, which extended computing capabilities and services to the edge of the network.
At present, researchers have presented many extended epidemic models for WSNs, some of which consider the heterogeneity of WSNs. Examples include the SEIRSV model, containing states S, E (exposed), I, R, and V (vaccination); the susceptible-infected-immunized (SII) model [34]; the worm infection model considering the spatial-temporal perspective [35]; the susceptible-active-dormant-immune (SADI) model considering the hierarchical structure [36]; and the susceptible-exposed-infected-recovered-susceptible with vaccination and quarantine states (SEIRS-QV) model considering user awareness and network delay [37].
To date, many researchers have studied malware infection in HWSNs through game theory. Lalropuia and Gupta 2 Mobile Information Systems [38] developed an availability model to resolve the problem of the unavailability of a 5G WCN attacked by a denial of service (DoS) attack using a Bayesian game. Jiang et al. [39] established an attack-defence game based on a Stackel-berg game to study the reliability of WSNs. Shen et al. [40] set up a dependability assessment mechanism for HWSNs using a noncooperative non-zero-sum game. Shen et al. [41] formulated a malware-defence differential game to 3 Mobile Information Systems study the decision-making problem between an IDS and malware. Liu et al. [42] proposed a stochastic evolutionary coalition game (SECG) to study the reliable service of virtual-sensor-service nodes. Shen et al. [43] proposed a malware detection strategy for the Internet of Things based on a signalling game. Liu et al. [44] proposed a Bayesian Q-learning game to study the problem of task offloading in sensor edge clouds. Liu et al. [45] also proposed a Stackelberg game to study the problem of malware infection defence in sensor edge clouds based on a deep neural network.
To date, researchers have presented many models for evaluating network stability or availability, which have provided a reference for evaluating the availability of HWSNs. Famila et al. [46] proposed a cluster head selection technique by semi-Markov prediction to enhance WSNs' availability. Kanchana and Ganesan [47] proposed an inspired selfaware cooperative scheme using an SMP to prolong WSNs' lifetimes. Shakya et al. [48] proposed a correlation-based susceptible-infectious-recovered epidemic model to study the stability of WSNs. Tang et al. [49] built an evaluation approach for WSNs' availability based on Markov chains. Gour et al. [50] studied the availability of service function chains in 5G transport networks by designing a slice. Pereira et al. [51] proposed an availability analysis model to evaluate the availability of edge and fog nodes based on Markov chains.
From these references, it can be seen that there are some problems regarding the availability of HECWSNs with malware infections, which need to be resolved. The first issue is how to determine the optimal infection probability of malware. The second issue is how to accurately describe the state of HSNs in HECWSNs with malware infections. The third issue is how to describe the heterogeneity of HSNs and the correlation of malware attacks on HSNs. The fourth issue is how to obtain the steady-state availability of HECWSNs. To address the first issue, we calculate the optimal infection probability of malware through an SADG. To address the second issue, we describe the state of HSNs by adding the states threatened and active and propose a malware infection HSTARD model. To address the third issue, considering the heterogeneity of security defence policies of HSNs and the malware attack correlation, we deduce the steady-state availability of an HSN based on an SMP. To address the fourth issue, considering the topology heterogeneity of HECWSNs, we deduce the steady-state availability of HECWSNs with various topologies, including the star topology, cluster topology, and mesh topology.

HSTARD Model
We assume an HECWSN scenario, which is composed of HWSNs, a base station (BS), and edge computing servers (ECServers), where the HWSNs are based on various topologies, including the star topology, cluster topology, and mesh topology (see Figure 1). To provide services for the HWSNs, edge computing servers are deployed at the BS. According to the computing tasks, the HWSNs determine whether computation services are offloaded to ECServers via wireless links.
To clearly describe the relationship among HSNs in an HECWSNs with malware infection, the HECWSN is described as an undirected network denoted by T = ðV, BÞ. Here, V represents HSNs and B represents the connection between any two HSNs, indicating "connected" by 1 and "not connected" by 0. The total number of HSNs is set as H, and the degree of a heterogeneous sensor node represents the number of other heterogeneous sensor nodes connected to it, which is denoted by k.
All HSNs can be roughly divided into two types by their functions: sink sensor nodes and common sensor nodes. Sink sensor nodes are responsible for pooling and processing the data collected by common sensor nodes. Compared with common sensor nodes, sink sensor nodes are configured with much stronger computing resources, storage resources, energy, and security defence policies. Considering that these two sensor node types differ in their security defence policies, they have different initial infection probabilities. Sink sensor nodes are configured with stronger security defence policies, so they are not easily infected. The probability of initial infection is related to their degree k. The higher the degree is, the easier it is to infect the node, and the higher the initial infection probability is. While common sensor nodes have weaker security defense policies, therefore, they are more likely to be infected. We set the initial infection probability of all common sensor nodes to be the same. Suppose the initial infection probability of an HSN with degree k, denoted by βðkÞ, is set as In HECWSNs with malware infections, when an HSN is infected by malware, its states will undergo a series of changes. We propose an HSTARD model containing five states: S, T, A, R, and D. The state set of HSNs is expressed as G = fS, T, A, R, Dg. An HSN in state S is vulnerable to malware due to its weak security defence policy. An HSN in state T has been infected by malware, but the resident malware is hidden, and the HSN cannot spread the malware to other HSNs. An HSN in state A has been infected by malware, and the resident malware is active, so the HSN will spread the malware to other HSNs. An HSN in state R is immune to the known malware because the system has been patched or the resident malware has been removed by the IDS. An HSN in state D is unable to provide normal services due to malware attacks or energy consumption.
The dynamic state transitions of an HSN are illustrated in Figure 2, where the state transitions are caused by the actions of the HSNs and malware. For an HSN in state S, when it is infected by malware, its state will transition to T; when it is patched by the IDS, its state will transition to R. For an HSN in state T, when the resident malware is activated, its state will transition to A; when it is patched by the IDS, its state will also transition to R. For an HSN in state A, when the resident malware is detected and removed by 4 Mobile Information Systems the IDS, its state will transition to R. For an HSN in state R, when it is scanned for security vulnerabilities by new malware, its state will transition to S. When an HSN is unable to provide normal services due to malware attacks or energy consumption, its state will transition to D. To ensure that there are enough HSNs in the HECWSNs, the HSNs in state D are updated regularly; at the same time, new HSNs in state R are added. For HSNs in all states, the death probability due to environmental influence, malware infection, and physical damage is set as φ. At time t, the probability that HSN i is in state xðx ∈ GÞ is denoted by p i x ðtÞ, and the probability that HSN i transitions from state xðx ∈ GÞ to y ðy ∈ GÞ is denoted by p i xy ðtÞ. Suppose the initial state of all HSNs is R; thus, for any HSN i, we have p R i ð0Þ = 1 and For an HSN in state S, when its security vulnerabilities are detected by the IDS, it will be patched, and its state will transition to R with probability ξq. Here, ξq is the probability of successful detection by the IDS, where ξ is the detection probability of the IDS and q is the probability of the IDS choosing the strategy detection, which is calculated by the proposed SADG. When it communicates with neighbouring nodes, if it is not infected by any neighbouring node, its state will still be S with probability where α is the optimal infection probability of the malware, and it is calculated by the proposed SADG. In addition, it has a death probability φ; therefore, when it communicates with its neighbouring nodes in state A, its state transitions to T with probability Thus, at time t, for HSN i with degree k in state S, its state transition probabilities are expressed as

Mobile Information Systems
For an HSN in state T, when its security vulnerabilities are detected by the IDS, it will be patched, and its state will transition to R with probability ξq. When it is continuously attacked by malware, in view of the malware attack correlation, the probability that it is successfully activated is related to the number of malware attacks. For an HSN with degree k, suppose the number of its neighbouring nodes in state A is n ð0 ≤ n ≤ kÞ and the number of malware attacks is set as L ð0 ≤ L ≤ n ≤ kÞ. The greater L is, the greater the probability that resident malware will be activated is. Once the resident malware is activated, its state will transition to A with probability βðkÞ where j is a random variable that follows a binomial distribution [52]. In addition, it has a death probability φ. Thus, at time t, for HSN i with degree k in state T, its state transition probabilities are expressed as where βðkÞ is the initial infection rate and Δβ is the infection change rate. These variables indicate the variation characteristics of the probability of HSNs being infected by malware. In addition, Δβ indicates the sensitivity of the probability of HSN infection by malware to the number of malware attacks. As the number of malware attacks increases, the larger Δβ is, the more sensitive the probability of malware infection is to the number of malware attacks; correspondingly, the greater the probability of HSNs being infected by malware is.
For an HSN in state A, when it is detected by the IDS, the resident malware will be removed, and the system will be patched; its state will transition to R with probability ξq. In addition, it has a death probability of φ, so it remains in state A with a probability of 1 − ξq − φ − θ. Thus, at time t, for HSN i in state A, its state transition probabilities are expressed as For an HSN in state R, its state will transition to S after it is scanned for security vulnerabilities by new malware, and the probability of its state transitioning from R to S is denoted by δ. In addition, it has a death probability of φ, so it remains in state R with probability 1 − δ − φ. Thus, at time t, for HSN i in state R, its state transition probabilities are expressed as For an HSN in state D, when it is updated regularly, the newly added HSNs are in state R, and the update probability of dead HSNs is denoted by θ. Thus, at time t, for HSN i in state D, its state transition probabilities are expressed as Note that the aim of the SADG is not to deduce the detection probability of an IDS. In this SADG, the malware makes the attack strategy first, and then, the IDS chooses the defence strategy. In other words, the malware is the leader, and the IDS is the follower.  Table 1. ξ (0 < ξ < 1) and ζ (0 < ζ < 1) denote the detection rate and the false alarm rate of the IDS, respectively. C I (C I > 0) denotes the infection cost of the malware, C D (C D > 0) denotes the detection cost of the IDS, ω I (ω I > 0) denotes the utility of the malware for successful infection, and ω D denotes the utility of the IDS for successful detection.
Definition 1 shows that the SADG has two players: malware ðMÞ and IDS ðZÞ. The two pure strategies for M to choose are Infect ðIÞ and Noninfectð e ∅Þ, and the two pure strategies for S to choose are Detect ðDÞ and Nondetectð∅Þ.

6
Mobile Information Systems Therefore, these two players have four combinations of pure strategies in the SADG, and the corresponding utilities form the payoff matrix (see Table 2). For the combination of pure strategies fInfect, Detectg, which means that malware selects the pure strategy Infect, and IDS selects the pure strategy Detect, the detection rate and the false alarm rate of the IDS are ξ and ζ, so it gains ξω D and loses ζω D , while malware loses ξω I and gains ζω I . In response, the rate of malware infection is 1 − ξ, so malware gains ð1 − ξÞω I and IDS loses ð1 − ξÞω D . In addition, the infection cost of malware is C I , so malware loses C I . The detection cost of IDS is C D , so it loses C D . Therefore, the utilities of malware U M ID and IDS U Z ID are, respectively, For the combination of pure strategies fInfect, Nondetectg, which means that malware selects the pure strategy Infect and IDS selects the pure strategy Nondetect. Under this case, malware gains ω I and IDS loses ω D . In addition, the infection cost of malware is C I , so malware loses C I . Therefore, the utilities of malware U M I∅ and IDS U Z I∅ are, respectively, For the combination of pure strategies fNoninfect, Detectg, which means that malware selects the pure strategy Noninfect and IDS selects the pure strategy Detect, the false alarm rate of the IDS is ζ, so IDS loses ζω D . In addition, the detection cost of the IDS is C D , so IDS loses C D . Therefore, the utilities of malware U M ∅D and IDS U Z ∅D are, respectively, For the combination of pure strategies fNoninfect, Nondetectg, which means that malware selects the pure strategy Noninfect and IDS selects the pure strategy Nondetect, the utilities of malware U M ∅∅ and IDS U Z ∅∅ are both equal to 0.
Let q denote the probability that the follower IDS selects the pure strategy Detect. Correspondingly, the probability that it selects the pure strategy Nondetect is denoted by 1 − q. Let α denote the probability that the leader malware selects the pure strategy Infect. Correspondingly, the probability that it selects the pure strategy Noninfect is denoted by 1 − α.
For IDS, the greater the probability q is, the greater the energy consumed by detection. That is, the detection cost C D becomes greater as q increases, so we set the detection cost C D as a linear function of the detection probability q.
We obtain the expected payoff of IDS as and the detection cost C D is where σ D expresses the basic cost of detection of IDS.
Then, using (11) to replace C D in (10), we can obtain U Z as For malware, the greater the probability α is, the greater the attack needs to consume the resources is. That is, the infection cost C I becomes greater as α increases, so we set the infection cost C I as a linear function of the infection probability α. We obtain the expected payoff of malware as and the infection cost C I is where σ I expresses the basic cost of infection by malware. Then, using (14) to replace C I in (13), we can obtain U M as

Predicting the Optimal Infection Probability of Malware.
In this section, we predict the optimal infection probability of malware by calculating the Stackelberg equilibrium of the SADG.

Theorem 1.
In the SADG, the optimal infection probability α of malware choosing the pure strategy Infect is Proof. According to the equilibrium solution of the Stackelberg game, we first calculate the reaction of the follower IDS and obtain the optimal detection probability q that maximizes U S . Then, based on the known optimal detection probability q, we can calculate the reaction of the leader malware and obtain the optimal infection probability α.

Mobile Information Systems
First, we calculate the first-order partial derivative of U Z with respect to q as The second-order partial derivative of U Z with respect to q is Since the basic cost of detection σ D is greater than 0, −σ D is less than 0. Therefore, U Z has the maximum value. Setting (17) equal to zero, we can obtain Then, we calculate the reaction of the leader malware by introducing the parameter q, and we obtain the optimal infection probability α.
The first-order partial derivative of U M with respect to α is The second-order partial derivative of U M with respect to α is Since the basic cost of infection σ I is greater than 0, −σ I is less than 0. Therefore, U M has the maximum value. Setting (20) equal to zero for maximization, we substitute (19) with the optimal detection probability q and obtain the optimal infection probability α as It can be seen from the proof and derivation that α is the optimal infection probability of malware. The proof is complete.

Steady-State Availability of a Heterogeneous Sensor Node
The steady state of an HSN is an important factor determining whether it can work normally. It is random, which means that the current state of an HSN determines the change in the next state independently of the previous state. Thus, it is appropriate to describe the state transition of an HSN using an SMP. Comparing the Markov process (MP) and SMP, the MP has strict requirements for the state resi-dence time, which must follow an exponential distribution, while the SMP does not limit the state residence time, which can follow any distribution form. Therefore, modelling the dynamic state transition process of an HSN based on an SMP appears more objective, and it is more in line with practical conditions. The transition from one state to another based on an SMP can be considered as two logical steps, which are the residence time of an HSN in state x and the transition process from state x to y. Definition 3. Suppose the residence time of an HSN in state x is expressed as t x ; then, the t x distribution is expressed as Definition 4. Let ν x represent the probability that an HSN translates to state x, and let the ν x distribution be expressed as Vðv Definition 5. The steady-state probability is the share of the residence time of an HSN in each state in the total residence time of all states. Let π x represent the steady-state probability vector of an HSN; the π x distribution is expressed as According to the proposed HSTARD model, the state transition matrix P of an HSN is constructed as where π sum = π s t s + π T t T + π A t A + π R t R + π D t D , Z = 1 − ðφ/ 1 + φ + P DD Þ, pS = 1 − p SS , pT = 1 − p TT , and pÃ = 1 − p AA . Since the steady-state availability of an HSN describes its ability to continue working after being damaged or attacked by malware, an HSN in state A or D cannot work normally. Therefore, the steady-state availability of an HSN of type h in HECWSNs with topology j, denoted by A h j , is 6. Steady-State Availability of HECWSNs 6.1. Steady-State Availability of HECWSNs with a Star Topology. HECWSNs with a star topology are composed of a single sink sensor node and some common sensor nodes (see Figure 3). The common sensor nodes are responsible for collecting data and forwarding them to the sink sensor node, which is responsible for processing data and transfer-ring them to the base station. Common sensor nodes work in parallel without affecting each other and are classified into a parallel system. Thus, to enable HECWSNs to work normally, two conditions should be met: (1) the sink sensor node is able to work normally, and (2) a certain number of common sensor nodes can work normally.
Assuming that the HECWSNs with a star topology contain X s common sensor nodes, the steady-state availability of each common sensor node is denoted by A c star . It is required that there be at least m s common sensor nodes working normally in the HECWSNs. When the HECWSNs can work normally, the number of common working sensor nodes is denoted by N s . In the HECWSNs, the steady-state availability of the sink sensor node is denoted by A sink star ðX s Þ, which is expressed as ∑ The steady-state availability of the HECWSNs with a star topology, denoted by A Star , is 6.2. Steady-State Availability of HECWSNs with a Cluster Topology. HECWSNs with a cluster topology are composed of three node types: sink sensor nodes, cluster head nodes [53], and common sensor nodes (see Figure 4). Cluster head nodes are selected from common sensor nodes [54], so the availability of cluster head nodes is equal to that of common sensor nodes. A cluster is composed of a cluster head node and some common sensor nodes. When the HECWSNs work, the common sensor nodes first communicate with the cluster head node, and then, the cluster head node communicates with the sink sensor node. As long as there is one common working sensor node in a cluster, the cluster is available.
In HECWSNs with a cluster topology, suppose that the steady-state availability of a common sensor node in a cluster is denoted by A cs c and that the number of common sensor nodes in a cluster is expressed by X cs . The steady-state availability of a cluster in the HECWSNs, denoted by A c c , is Sink sensor node Common sensor node Figure 3: HECWSNs with a star topology.

Mobile Information Systems
For HECWSNs with a cluster topology, if a cluster is regarded as one unit, it can be regarded as having a star structure. Suppose that there are X c clusters and that the steady-state availability of the sink sensor nodes is denoted by A sink cluster ðX c Þ. Suppose that there are at least m c clusters required to work normally in the HECWSNs and that the number of working clusters is denoted by N c . The steadystate availability of the HECWSNs with a cluster topology, denoted by A Cluster , is 6.3. Steady-State Availability of HECWSNs with a Mesh Topology. HECWSNs with a mesh topology usually contain several sink sensor nodes, and each sink sensor node manages some common sensor nodes (see Figure 5). The common sensor nodes are responsible for translating the collected data to the corresponding sink sensor node, and then, the sink sensor node sends data to the base station [55].
In HECWSNs with a mesh topology, communication between a sink sensor node and its common sensor nodes occurs in a parallel system (see Figure 5), so the HECWSNs can be regarded as a combination of multiple HECWSNs with star topologies. Assume that the total number of common sensor nodes connecting to the sink sensor node is X c mesh , the minimum number of common sensor nodes required to work normally is m c mesh , the steady-state availability of a common sensor node is denoted by A c mesh , and the number of common working sensor nodes connecting to the sink sensor node is denoted by N c mesh . Then, the steady-state availability of the sink sensor node, denoted by A s mesh , is To enable HECWSNs with a mesh topology to work normally, at least a certain number of sink sensor nodes are required to work normally. Assume that the total number of sink sensor nodes is X s mesh , the minimum number of sink sensor nodes required to work normally is m s mesh , and the number of working sink sensor nodes is denoted by N s mesh . Then, the steady-state availability of the HECWSNs with a mesh topology is denoted by A Mesh , which can be expressed as

Experimental Simulations and Data Analysis
In this paper, simulation experiments to verify the steadystate availability of HECWSNs are completed based on MATLAB 2015. The steady-state availability of HECWSNs with malware infections is affected by many factors, including the initial infection probability βðkÞ, the infection change rate Δβ, and the infection probability of malware. First, we analyse the influence of the detection rate ξ and false alarm rate ζ of the IDS on the optimal infection probability of malware. Second, we analyse the impact of the initial infection probability βðkÞ and infection change rate Δβ on the steady-state availability of HSNs. Third, we evaluate the steady-state availability of HECWSNs with various topologies, including the star topology, cluster topology, and mesh topology. With the increase of the detection rate ξ of the IDS, the optimal infection probability of malware will decrease (see

10
Mobile Information Systems Figure 6), but with the increase of the false alarm rate ζ of the IDS, the optimal infection probability of malware will also increase. For example, when the detection rate ξ of the IDS increases from 0.5 to 0.95, the optimal infection probability of malware decreases from 0.06 to 0.01 when ζ = 0:06.
When the false alarm rate ζ of the IDS increases from 0.04 to 0.12, the optimal infection probability of malware increases from 0.04 to 0.14 when ξ = 0:6.
According to the analysis of the experimental data, to decrease the optimal infection probability of malware, we should prioritize reducing the false alarm rate to improve the detection rate.

Effect of the Initial Infection Rate and the Infection
Change Rate on the Steady-State Availability of an HSN. The steady-state availability of an HSN is related to the initial infection rate and the infection change rate (see Figure 7). It can be seen from the experimental data curves that with the increase of the initial infection rate and the infection change rate, the steady-state availability of an HSN decreases gradually.
For example, when the initial infection rate increases from 0.1 to 0.6, the steady-state availability of the HSN decreases from 0.8596, 0.8543, and 0.8483 to 0.8021, 0.7953, and 0.7886, corresponding to three values of the

11
Mobile Information Systems infection change rate, Δβ = 0:05, Δβ = 0:1, and Δβ = 0:15, respectively. The data analysis indicates that the higher the initial infection rate is, the greater the probability of HSNs being infected by malware is, and the lower the steadystate availability of the HSNs is. The higher the infection change rate is, the more difficult it is for HSNs to suppress malware infection. Therefore, to improve the steady-state availability of HSNs, we should reduce the initial infection rate and the infection change rate.
The initial infection rate and the infection change rate influence the steady-state availability of a sink sensor node (see Figure 8). It can be seen from the experimental data curves that with the increase of the sink sensor node's degree k, the steady-state availability of the sink sensor node decreases gradually. Three functions of the initial infection rate are considered in the experiment: βðkÞ = ck, βðkÞ = c log k, and βðkÞ = ce k . Figure 7 shows that when the degree k of the sink sensor node increases from 10 to 60, the steady-state availability of the sink sensor node decreases from 0.8673 to 0.7535. When the initial infection rate of the sink sensor node satisfies the power function, the steadystate availability of the sink sensor node is least affected by its degree k, followed by the linear function and then the exponential function.

Mobile Information Systems
For example, when the degree k of the sink sensor node is set as 35, the steady-state availability of the sink sensor node is 0.8565, 0.8214, and 0.7946, corresponding to three functions of the initial infection rate β S ðkÞ = ce k , β S ðkÞ = ck, and β S ðkÞ = c log k, respectively. Experimental data analysis indicates that the function of the initial infection β S ðkÞ = ce k is the most appropriate for HECWSNs.

Steady-State Availability of HECWSNs with a Star
Topology. Figure 9 shows the evaluation results of the steady-state availability of HECWSNs with a star topology. The x-axis shows the number of common working sensor nodes connecting to the sink sensor node, which ranges from 15 to 30. The y-axis shows the total number of common sensor nodes connecting to the sink sensor node, which ranges from 20 to 30. The z-axis shows the steady-state availability of HECWSNs with a star topology, which ranges from 0 to 1.
With the increase in the total number of common sensor nodes connecting to the sink sensor node, the steady-state availability of the HECWSNs will increase (see Figure 9). However, with the increase in the number of common working sensor nodes connecting to the sink sensor node, the steady-state availability of the HECWSNs will decrease. For example, when the number of common working sensor nodes connecting to the sink sensor node is 20, the steadystate availability of HECWSNs with a star topology will gradually increase from 0 to 0.75 as the total number of common sensor nodes connecting to the sink sensor node increases from 20 to 30. When the total number of common sensor nodes connecting to the sink sensor node is 30, the steady-state availability of HECWSNs with a star topology will gradually decrease from 0.75 to 0 as the number of common working sensor nodes connecting to the sink sensor node increases from 15 to 30. Therefore, when constructing HECWSNs with a star topology, it is necessary to increase the number of redundant common sensor nodes according to the actual situation, which helps to increase the steadystate availability of HECWSNs with a star topology.

Steady-State Availability of HECWSNs with a Cluster
Topology. Figure 10 shows the evaluation results for the steady-state availability of HECWSNs with a cluster topology. The x-axis shows the number of working clusters, which ranges from 15 to 30. The y-axis shows the total number of clusters, which ranges from 20 to 30. The z-axis shows the steady-state availability of HECWSNs with a cluster topology, which ranges from 0 to 1.
With the increase in the total number of clusters, the steady-state availability of HECWSNs with a cluster topology will increase (see Figure 10). However, with the increase in the number of working clusters, the steady-state availability of HECWSNs with a cluster topology will decrease. For example, when the number of working clusters is 25, the steady-state availability of HECWSNs with a cluster topology will gradually increase from 0 to 0.75 as the total number of clusters increases from 24 to 30. When the total number of clusters is 26, the steady-state availability of HECWSNs with a cluster topology will gradually decrease from 0.75 to 0 as the number of working clusters increases from 15 to 27. Therefore, when constructing HECWSNs with a cluster topology, it is necessary to increase the number of redundant clusters according to the actual situation, which helps to increase the steady-state availability of HECWSNs with a cluster topology. 7.5. Steady-State Availability of HECWSNs with a Mesh Topology. Figure 11 shows the evaluation results of the steady-state availability of HECWSNs with a mesh topology. The x-axis shows the number of common working sensor nodes in a subnet, which ranges from 2 to 6. The y-axis

13
Mobile Information Systems shows the total number of common sensor nodes in a subnet, which ranges from 20 to 30. The z-axis shows the steady-state availability of HECWSNs with a mesh topology, which ranges from 0 to 1.
With the increase in the number of common sensor nodes in a subnet, the steady-state availability of HECWSNs with a mesh topology will increase (see Figure 11). However, with the increase in the number of common working sensor nodes in a subnet, the steady-state availability of HECWSNs with a mesh topology will decrease. For example, when the number of common working sensor nodes in a subnet is 2, the steady-state availability of HECWSNs with a mesh topology will increase from 0 to 1 as the total number of common sensor nodes in a subnet increases from 20 to 30. When the total number of common sensor nodes in a subnet is 30, the steady-state availability of HECWSNs with a mesh topology will decrease from 1 to 0.18 as the number of common working sensor nodes in a subnet increases from 2 to 6. Therefore, when constructing HECWSNs with a mesh topology, it is necessary to increase the number of redundant common sensor nodes in a subnet and the number of sink sensor nodes, which helps to increase the steady-state availability of HECWSNs with a mesh topology.

Conclusions
To suppress the spread of malware and improve the steady-state availability of HECWSNs, considering the heterogeneity of common sensor nodes and sink sensor nodes in HECWSNs with malware infections, we evaluated the steady-state availability of HECWSNs with malware infections based on an SMP and a Stackelberg game. First, we established the SADG to predict the optimal infection probability of malware. Second, extending the classical epidemic SIR model by adding states T, A, and D, we proposed an HSTARD model to describe the states of HSNs. Third, considering the influence of the malware attack correlation on the steady-state availability of HECWSNs, we obtained the steady-state availability of HECWSNs with various topologies, including the star topology, cluster topology, and mesh topology. The steady-state availability evaluation of HECWSNs provides a theoretical basis for the design, deployment, and maintenance of high-availability HECWSNs.
In future work, an even more interesting direction to consider is the heterogeneity of infection change rate of HSNs. When the influences of neighbour sensor nodes are considered, the infection change rate of HSNs is effect by their degree. In addition, another consideration is to evaluate the steady-state availability of HECWSNs with multiple topologies, in which HSNs are deployed in a variety of topologies, including star topology, cluster topology, and mesh topology.

Data Availability
No data were used to support this study.

Conflicts of Interest
The authors declare no conflicts of interest in this paper. 14 Mobile Information Systems