Complexity-theoretic Modeling of Biological Cyanide Poisoningas Security Attack in Self-organizing Networks

Jiejun Kong‡, Xiaoyan Hong†, Dapeng Wu‡, Mario Gerla∗‡Dept. of Electric & Computer Eng. †Dept. of Computer Science ∗Dept. of Computer Science

University of Florida University of Alabama University of CaliforniaGainesville, FL 32611 Tuscaloosa, AL 35487 Los Angeles, CA 90095jiejunkong@yahoo.com, hxy@cs.ua.edu, wu@ece.ufl.edu, gerla@cs.ucla.edu

Abstract—We draw an analogy of biological cyanide poisoningto security attacks in self-organizing mobile ad hoc networks.When a circulatory system is treated as an enclosed networkspace, a hemoglobin is treated as a mobile node, and ahemoglobin binding with cyanide ion is treated as a compromisednode (which cannot bind with oxygen to furnish its oxygen-transport function), we show how cyanide poisoning can reducethe probability of oxygen/message delivery to a “negligible”quantity. Like modern cryptography, security problem in ournetwork-centric model is defined on the complexity-theoreticconcept of “negligible”, which is asymptotically sub-polynomialwith respect to a pre-defined system parameter x. Intuitively,the parameter x is the key length n in modern cryptography,but is changed to the network scale, or the number of networknodes N , in our model. Based on this new analytic model, weshow that RP (n-runs) complexity class with a virtual oracle canformally model the cyanide poisoning phenomenon and similarnetwork threats. This new analytic approach leads to a new viewof biological threats from the perspective of network security andcomplexity theoretic study.

I. INTRODUCTION

In bioinformatics, analyzing mobility related problems is anew challenge. Typical research efforts in sequence alignment,gene finding, genome assembly, protein structure alignment,protein structure prediction, and the modeling of evolution donot study molecule level mobility and related security threats.For instance, many biological threats use the circulatory sys-tem as their entrance to disable the life sustaining functions.Related analysis must study a large amount of moleculesmoving in the circulatory system. Due to the probabilisticnature of each molecule’s mobility pattern and the intractablecomplexity caused by the sheer amount of molecules, it isa non-trivial challenge to deliver a meaningful analysis toanswer the following questions: How do we quantitativelymeasure the impact of a simple algorithmic attacking strategyin an environment with probabilistic mobility and huge amountof nodes? What types of metrics can we use to quantify thehighly complex behavior in the system (in the example, thecirculatory system)?

In this paper, we answer these questions by identifyingthe connection between the biological threats and randomized

Part of the work is supported by NSF grant DBI-0529012 and supportedthrough participation in the International Technology Alliance sponsored bythe U.S. Army Research Laboratory and the U.K. Ministry of Defense underAgreement Number W911NF-06-3-0001.

complexity theory [8]. Our study shows that a generic classof self-organizing network algorithms can be modeled by avariant of computational complexity theory if commonly usedcomputational metrics are replaced with network metrics. Weshow that biological cyanide poisoning[11][10] is a real-worldexample which belongs to the generic network algorithm class.

A. Notation

For the ease of formal presentation, we list the notions usedin this paper below:

N network scale (number of nodes in the network)θ percentage of dishonest nodes, i.e., θ·N nodes are attackers|x| the cardnality of a set xτ least network time granularity (e.g., 1 nano-sec)α = poly(N) α is a polynomial of NΣ < O(poly(N)) Σ is asymptotically less than poly(N)S the size of the entire network spaces the size of an average node “position”l the size of the largest mobile node’s storage

B. Our contributions

First, we adopt a formal approach to characterize a generalcategory of random algorithms, which belongs to the familyof Monte Carlo algorithms with 1-side or 2-side errors. In acomplex self-organizing network, it is impossible to determineevery system behavior in a deterministic manner. We haveto adopt a probabilistic framework. For example, in regardto security attacks and countermeasures, we speak of the“feasibility or infeasibility” of breaking a network systemrather than the “possibility or impossibility” of breaking thesame system. We seek to prove that the success (or failure)probability of any network protocol is negligible (see formaldefinition in Section III) in regard to a network metric x, whichis the network scale N (the total number of network nodes)in this paper.

(x)ε

(x)ε

(x)ε

(x)ε

(x)ε(x)ε . . . . . . . . . . . . . . . . . . . . . . . . . . .

poly(x)

deviation bound

deviation bound

the ideal linedefined by Las Vegas algorithm

Fig. 1. Polynomial-time Monte Carlo algorithm family with negli-gible deviations ε(x) (2-side errors depicted)

Second, not all Monte Carlo algorithms are qualified in thenew formal model. As depicted in Figure 1, we explore aconstraint on the difference between Las Vegas algorithms andMonte Carlo algorithms. If an algorithm belongs to Las Vegasrandom algorithm family, then the algorithm always producescorrect result but the algorithm execution is probabilisticallyefficient, sometimes inefficient. If an algorithm belongs toMonte Carlo algorithm family, then the algorithm executionis always efficient but with probabilistic 1-side or 2-sideerrors/deviations from the ideal Las Vegas results. In particular,we use a special Monte Carlo algorithm family with clearlydefined metric bounds:

1) The special class of Monte Carlo algorithm used inthis work belongs to complexity class P . It ends inpolynomial-time (or polynomial-step) and with negligi-ble deviation ε(x) from the ideal result (which is definedby a counterpart Las Vegas algorithm).

2) Moreover, as depicted in Figure 1, the deviation staysas negligible in polynomial steps poly(x). That is, thenegligible deviation ε(x) is an asymptotic invariant interms of an input metric x.

3) The input metric x of any polynomial discussed in thispaper is defined as N , the total number of networkmembers in the target network.

We prove the depicted polynomial-time invariant negligibilityproperty to illustrate how a node-wise simple local behavioraffects global behaviors of the entire system with N <poly(N) peer nodes. Therefore, we seek to explain node-wiselocal behaviors in a complex probabilistic system, then thecorresponding global behaviors can be deduced safely due tothe important invariant property.

Third, we define a concept of “GVG polynomial-time algo-rithm” (or “GVG polynomial-step protocol” in network term)by introducing a GVG oracle in network complexity theory.Given a “global virtual god” (GVG) that virtually oversees thenetwork, we show that the number of steps in a protocol isindeed polynomially bounded in regard to the number of nodesN . This includes the following modeling aspects:

• RP (n-runs) model: Like BPP class used in moderncryptography, our RP (n-runs) class characterizes prob-abilistic polynomial-time algorithms. In cyanide poison-ing, the circulatory oxygen-transport function is reducedinto negative GVG − RP class, which has negligiblesuccess probability ε(N) at every step and globally.

• Polynomially-bounded adversary: The adversary is al-lowed to compromise a fraction θ of N (since θ·Nis a polynomial of N ) network members. In cyanidepoisoning, a hemoglobin binding with cyanide ion butnot oxygen is a compromised node, otherwise it isuncompromised. The cyanide ions do not (directly) killbiological cells or organs like the heart (the centralizedserver), but rather disable the fully distributed oxygen-transport function.

The rest of the paper is organized as follows. Section II we

describe cyanide poisoning in a biological view. In Section IIIwe present the details of our formal model to show the reasonwhy cyanide poisoning is in negative GVG −RP complexityclass. Finally Section IV summarizes the paper.

Fig. 2. Abstraction of circulatory system as an enclosed networkspace S holding the mobile hemoglobin nodes

II. BIOLOGICAL CYANIDE POISONING

Hemoglobin (Hb) is the oxygen-transport metalloprotein inthe red cells of the blood in mammals and other animals. Forexample, hemoglobin in human’s circulatory system transportsoxygen from the lungs to the rest of the body, such as to themuscles, where it releases the oxygen load. If this function isblocked, the host will quickly die from hypoxia.

The hemoglobin’s binding of oxygen is affected bymolecules such as cyanide ion (CN-), carbon monoxide (CO),sulfur monoxide (SO), etc. For example, hemoglobin’s bindingaffinity for CO is 200 times greater than its affinity foroxygen, and for cyanide the affinity is thousands of timesgreater [6][11][10]. This means that small amounts of cyanide(or CO, SO, etc.) dramatically inhibits oxygen-binding, re-duces hemoglobin’s ability to transport oxygen, hence causesgrave toxicity and eventually death1.

As Figure 2 shows, at a highly abstract level we can treat thecirculatory system as an enclosed (3-dimensional) space. Eachhemoglobin is a molecular agent node who carries a message,which is oxygen, from one region in the space to another. Anyattack that successfully blocks the message-transport functionalso destroys the circulatory system’s function.

III. COMPLEXITY-THEORETIC MODEL OF CYANIDE

POISONING

Nevertheless, the previous intuition is not a formal answerto the problem. To illustrate the network system’s complexbehavior under cyanide poisoning, we need a more formalspecification to identify the security properties and securityinvariants in the scalable and probabilistic network system.

1Another basis for cyanide poisoning is by binding cyanide to the activesite of cytochrome oxidase, there by stopping aerobic cell metabolism so thatthe cell can no longer aerobically produce ATP for energy. But this biologicaleffect is beyond the scope of this paper.

TABLE IPROBABILISTIC BEHAVIORS OF VARIOUS ALGORITHM CLASSES

Las Vegas AnswerMonte Carlo Answer

RP (1-run) class GVG −RP & RP (n-runs) class Negative GVG −RP (n-runs) classSUCCESS/YES FAILURE/NO SUCCESS/YES FAILURE/NO SUCCESS/YES FAILURE/NO

SUCCESS/YES > 12

+ ε(x) < 12− ε(x) > 1 − ε(x) < ε(x) < ε(x) > 1 − ε(x)

FAILURE/NO 0 1 0 1 0 1

A. Sound model of analysis

The concept of negligibility used in this paper can find itstrace back to sound models of analysis. Though the conceptsof “continuity” and “infinitesimal” became important in math-ematics during Newton and Leibniz’s time (1680s), they werenot well-defined until late 1810s. The first reasonably rigorousdefinition of continuity in mathematic analysis was due toBernard Bolzano, who wrote in 1817 the modern definitionof continuity. Lately Cauchy and Weierstrass also defined asfollows (with all numbers in the real number domain R):

Definition 1: (Continuous function) A function f(x) iscontinuous at x = x0 if for every positive number ε > 0,there exists a positive number δ > 0 such that |x − x0| < δimplies |f(x)− f(x0)| < ε.

This classic definition of continuity can be transformed intothe definition of negligibility in a few steps by changing aparameter used in the definition. First, in case x0 = ∞, wemust define the concept of “sufficiently large”, then defineinfinitesimal function:

Definition 2: (Sufficiently large) A mathematic proposi-tion is true when a number x is sufficiently large if there existsa positive number Nc > 0, for all x > Nc, the proposition istrue.

Definition 3: (Infinitesimal function) A continuous func-tion µ(x) is infinitesimal if for all sufficiently large numberx’s, for every positive number2 pnum = 1

ε > 0 such that|µ(x)| < ε = 1

pnum .

Next, we change “positive number ε” to “positive polyno-mial function ε(x)”. Since a number is actually a polynomialof degree 0, the definition of negligible function is clearlyan extension3 of the definition of infinitesimal function byextending the input parameter ε from a polynomial of degree0 to a polynomial of arbitrary constant degree.

Definition 4: (Negligible function) A continuous functionµ(x) is negligible if for all sufficiently large x’s, for everypositive polynomial poly(x) = 1

ε(x) > 0 such that |µ(x)| <ε(x) = 1

poly(x) .

In complexity-based modern cryptography, a securityscheme is provably secure if the probability of security failure(e.g., inverting a one-way function, distinguishing crypto-graphically strong pseudorandom bits from truly random bits)

2Note that the reciprocal pnum is not needed if the function domain isreal number. We write in this way to show the steps more clearly.

3Formal treatment of “field extension” is omitted in this paper due to pagelimit.

is negligible in terms of the cryptographic key length x = n.Nevertheless, the general notion of negligibility has neversaid that the system input parameter x must be the keylength n. Indeed, x can be any predetermined system metricand corresponding mathematic analysis would illustrate somehidden analytical behaviors of the system. In our analysis,the input parameter x is changed to the number of networkmembers N , that is, a crucial network metric which measuresnetwork scalability.

In below we propose a concept of “GVG-polynomial time”protocol/algorithm as the formal model of network securityand the explanation of the probabilistic nature of cyanidepoisoning. Given a probabilistic Turing Machine controlledby a “global virtual god” (GVG) who virtually oversees theentire network, the number of protocol steps is polynomiallybounded by x = N , the number of network members.

B. Required complexity classes

Like modern cryptography, our net-centric security notion isbased on “non-deterministic” and “probabilistic” algorithms.In modern cryptography, negligibility is defined on naturalnumber domain N because key length n must be a naturalnumber. Similarly, in this paper the number of network mem-bers N is also a natural number.

Definition 5: (Negligible function defined on naturalnumber): A function µ : N → R is negligible if for everypositive polynomial poly(x), and all sufficiently large x’s (i.e.,there exists Nc, for all x > Nc), µ(x) < 1

poly(x) .

From the definition, we need to prove the mathematicproperty depicted in Figure 1, that is, if per-step probabilityof protocol deviation/failure compared to an ideal Las Vegasprotocol is negligible, then the overall probability of protocoldeviation/failure after polynomial steps stays as negligible.This means that negligibility is an asymptotic fixed point forpolynomial-time algorithms.

At first, we define the ideal Las Vegas protocol for mobilead hoc message/oxygen transportation:

Definition 6: (The ideal Las Vegas routing/transporting)The ideal Las Vegas case of ad hoc routing is a trivial floodingprotocol in an ad hoc network with infinite bandwidth. Thistakes N < poly(N) steps in a loop-free delivery, hencepolynomial-step/time. If the network is partitioned betweenthe source node and the destination node, then the LasVegas scheme results in FAILURE/NO, otherwise it resultsin SUCCESS/YES. If such Las Vegas algorithm/protocol re-turns FAILURE/NO, then any Monte Carlo algorithm/protocolalso returns FAILURE/NO. There is no error/deviation when

the protocols return NO. Thus only 1-side Monte-Carlo er-ror/deviation is possible when the Las Vegas protocol returnsYES. This is the reason why we use 1-side errorRP algorithmclass in our modeling.

In a circulatory system, let’s put a virtual source node atthe place where an oxygen molecule originates, and a virtualdestination node at the place where the oxygen molecule issupposed to be delivered. The Las Vegas case is an ideal rout-ing scheme where we assume that the oxygen molecule couldbe sent from one hemoglobin to neighboring hemoglobins asif it is a broadcast packet. In practice, hemoglobins do nothave this assumed capability and the routing success ratio isworse. If this Las Vegas case fails due to attack, any MonteCarlo variant will certainly fail.

We then define the RP protocol/algorithm class with 1-sideerrors.

Let x be the input in the polynomial size of a systemparameter N , let M(x) be the random variable denoting theoutput of a PTM M . Let

Pr [M(x) = y] =|d∈0, 1tM (x) : Md(x) = y|

rtM (x)

where d is a truly random coin-flip, tM (x) is the polynomialnumber of coin-flips made by M on input x, and M d(x)denotes the output of M on input x, when d is the outcomeof its coin-flips (i.e., the random tape of an equivalent DTM).

Definition 7: (Randomized Polynomial-time, RP class):We say that L is recognized by the probabilistic polynomial-time Turing Machine M with biased single-side errors if

• for every x∈L it holds that4 Pr [M accepts x] ≥ 12 +

1poly(n) for every polynomial poly(n).

• for every x∈L it holds that Pr [M accepts x] = 0.

RP is the class of languages that can be recognized by sucha probabilistic polynomial time Turing Machine.

Definition 8: (RP n-runs class): We say that L is recog-nized by the probabilistic polynomial-time Turing Machine Mwith negligible single-side errors if

• for every x∈L it holds that Pr [M accepts x] ≥ 1 −1

poly(n) for every polynomial poly(n).• for every x∈L it holds that Pr [M accepts x] = 0.

RP n-runs class is the class of languages that can be recog-nized by such a probabilistic polynomial time Turing Machine.

Definition 9: (Negative RP n-runs class): We say thatL is recognized by the probabilistic polynomial-time TuringMachine M with negligible single-side success if

• for every x∈L it holds that Pr [M accepts x] ≤ 1poly(n)

for every polynomial poly(n).• for every x∈L it holds that Pr [M accepts x] = 0.

4In the definition 12

can be replaced by any constant fraction number inthe open range (0..1), not necessarily the value 1

2.

Negative RP n-runs class is the class of languages that canbe recognized by such a probabilistic polynomial time TuringMachine.

The procedure to obtain RP n-runs class from RP 1-runclass is called RP amplification, which trivially runs an RP1-run class algorithm n times, then the failure probability ofan RP n-runs algorithm (i.e., not returning YES after runningthe RP 1-run algorithm n times) exponentially decreases, andbecomes negligible.

C. Polynomial-time invariant property

Now we prove the property depicted in Figure 1. Thisproperty illustrates that how a node-wise local behavior ateach individual peer node affects the network-wise globalbehavior of the entire probabilistic system, which is comprisedof N < poly(N) peer nodes.

Theorem 1: If an RP n-runs protocol X’s failure probabil-ity is negligible, then the failure probability stays as negligiblewhen the same protocol X is executed polynomial times.

Proof: By assumption, X has p(N) steps, where p(N) isa positive polynomial. Given that per-step security successprobability is Ponetime, the probability of success of the entireprotocol Ppolytime is

Ppolytime = 1 − (1 − Ponetime)p(N).

By assumption, Ponetime is negligible, thus is asymptoti-cally less than any given 1

p(N)·q(N) , where q(N) is a positivepolynomial and so p(N)·q(N) is also a positive polynomial.In other words, there exists a positive integer Nc > 0, suchthat Ponetime < 1

p(N)·q(N)for all x > Nc. Then we have

(1 − Ponetime)p(N) >

„1 − 1

p(N)·q(N)

«p(N)

> e− 1

q(N)

since (1 − 1x)x > e−1 for all x > 1.

According to Lagrange mean value theorem, for a functionf(x) continuous on [a, b], there exists a c∈(a, b) such thatf(b) = f(a)+f ′(c) ·(b−a) for 0 < a < b. Then let f(x) = e−x,there exists a ξ∈(0, z), such that e−z = 1 + (−e−ξ)·z > 1 − z.Thus we have

(1 − Ponetime)p(N) > e

− 1q(N) > 1 − 1

q(N).

Therefore, for any polynomial q(N) and sufficiently largeN ,

Ppolytime = 1 − (1 − Ponetime)p(N) <

1

q(N).

D. Modeling mobile networks: a PTM approach with a GVGoracle

We propose to use a special form of PTM to model theprobabilistic stochastic behaviors of a mobile network. Thefundamental idea is to use a global virtual god (GVG) oracleto handle the PTM’s control states, while each mobile node isonly treated as a tape carrier.

As depicted in Figure 3, the entire network space is offinite size S. The finite network space S is divided into large

# # # # # # # # # # # # #

t ψϕ

Mq

Fig. 3. A GVG Probabilistic Turing Machine (GVG PTM) to model mobile nodes in a finite cubic space (only 2-D depicted)with a large number of node “positions”. The figure shows that N = 3 of η (N η < O(poly(N))) such “positions” havebeen taken by N = 3 mobile nodes. Each empty “position” is filled with a tape of poly(N) blank symbols, and the blanktape is replaced with a mobile node’s tape once the corresponding position is taken, or the tape goes back to the blank tapeupon the node’s leaving of the position. If the largest tape length of each mobile node can carry is l < O(poly(N)), thenthe GVG PTM’s consummate tape length is η·l. The GVG PTM’s tape head always parks at the place corresponding to thecurrent symbol of the first mobile node (i.e., the node with least node index). The mobile node’s mobility patterns are “asif” decided by the GVG using coin-flips. In theory, the GVG does all symbol processing and coin-flipping operations and itsoperation speed is fast enough to process all symbols on its tape within the least network time granularity τ

number of tiles (or cubes for 3-D space) of tiny size s, andeach tile/cube is smaller than the physical size of any singlemobile node. In other words, each tile/cube is virtually a node“position” to place on. The number of node “positions” η = S

sis quite large. It is nevertheless a finite number. In a nutshell,η = S

s is a large constant, but is always asymptotically lessthan poly(N), that is, η < O(poly(N)).

Tape Each mobile node functions as a carrier of a movingtape of polynomial size of the network scale N . That is, eachmobile node carries a tape of O(poly(N)) bits. A movingtape is intuitively the computer memory snapshot of thecorresponding mobile node. Let l < O(poly(N)) be the size ofthe largest moving tape. An empty node “position” is occupiedby a blank tape of l blank symbols. This blank tape is replacedwith a node’s moving tape once the corresponding position istaken by the node, or the tape goes back to the blank tapeupon the node’s leaving of the position. If the largest tapelength of each mobile node can carry is l < O(poly(N)),then the GVG PTM’s consummate tape length is η·L, whichis < O(poly(η))·O(poly(N)), thus < O(poly(N)).

Control state operations Each mobile node’s decision of net-work operation (e.g., packet transmission), though autonomousin nature, can be translated into an equivalent form as if allthe decisions are made by the GVG using coin-flips. Along thetimeline, there exists a minimal time granularity τ such thatany Turing Machine operation latency less than τ will make nodifference in network protocol execution. We model that theGVG can make decisions for all mobile nodes and emulate allthe decisions globally within the granularity τ (e.g., 1 nano-second).

The mobile nodes are indexed from 1 to N . At the be-

ginning/end of each τ time granularity, the PTM’s tape headalways parks at the place corresponding to the current symbolof the first mobile node (with node index 1). During a τinterval, the PTM processes every mobile node’s tape oneby one (treating the corresponding node as a puppet TuringMachine of the GVG).Environmental randomness As to environmental conditions,for each network operation (e.g., message delivery), the GVGemulates the physical condition (e.g., blood condition andobstacles that affect blood flowing) in a perfect manner, andprecisely moves each message from one node to another. Thatis, the message content is deleted from the sending node’smoving tape, and the received message content is added to theproper place of the receiving node’s moving tape. In the eyesof the GVG, any message transportation is simply a movementof a set of tape symbol from one place of its consummate tapeto another place.PTM as DTM with random tape If we use DTM ratherthan PTM to model the network protocol execution, theGVG can pre-cast many coin-flips to emulate the probabilisticevents in the network, and place the result of the coin-flipsto an added consummate random tape. These probabilisticevents include mobile node’s probabilistic moving pattern,probabilistic message delivery requests at the message sourcesand destinations, and so on. The total number of coin-flips (orthe length of the consummate random tape) is bounded bynetwork space and network scale < O(poly(η))·O(poly(N)),thus < O(poly(N)).

Definition of GVG PTM We formally define GVG Proba-bilistic Turing Machine and GVG polynomial-time protocolsin below.

Definition 10: A GVG Polynomial-time Probabilistic Tur-ing Machine (GVG-PPTM) is an octuple

M = (N,GVG(Q, r),Γ,Σ, qI ,#, F, δ),• N is a pre-defined system parameter. N quantifies the

size of the GVG-PPTM’s input and output. For anyconfiguration (q, ϕ, t, ψ), ϕψ ∈ Γ∗, t∈Γ, q∈Q onany single tape of the machine, |ϕ|, |ψ| < O(poly(N)).

• GVG(Q, r) is a global virtual god oracle with finite setof states Q and a probabilistic coin-flip sequence r (i.e.,the random tape input of an equivalent DTM). |Q| and|r| are < O(poly(N)).

• Γ is a finite set of the tape alphabet.• Σ ⊆ Γ is a finite set of the input alphabet.• qI∈Q is the initial state.• #∈(Γ− Σ) is the blank symbol.• F⊆Q is the set of final or accepting states.• δ is the transition set. For 1-tape GVG-PPTM, δ is

δ : Q× Γ←Q× Γ× Le,Ri,while for k-tape GVG-PPTM, δ is

δ : Q× Γk←Q× (Γ× Le,Ri, St)k

Here Le is left shift, Ri is right shift, and St is stationarywithout shift.

We say that L is recognized by the GVG-PPTM M withnegligible errors if

• for every x∈L it holds that Pr [M accepts x] ≥ 1 −1

poly(N) for every polynomial poly(N);• for every x∈L it holds that Pr [M accepts x] = 0.

GVG − RP (n-runs) is the class of languages that can berecognized by such a GVG-PPTM.

We say that L is recognized by the GVG-PPTM M withnegligible success if

• for every x∈L it holds that Pr [M accepts x] ≤ 1poly(N)

for every polynomial poly(N);• for every x∈L it holds that Pr [M accepts x] = 0.

Negative GVG − RP (n-runs) is the class of languages thatcan be recognized by such a GVG-PPTM.

For every x∈L, Pr [M accepts x] means “probability ofprotocol success”, while its complement Pr [M rejects x]

means “probability of protocol failure”. In GVG − RP 5, theformer one must be 1− ε(N) and the latter one must be ε(N)in terms of network scale N .

Example 1: (Mobile message transportation) In a mo-bile network, nodes can be viewed as controlled proxyagents of the GVG. Based on the random coin-flips (orthe random tape of an equivalent DTM) that simulate theprobabilistic environment, GVG initiates a message/oxygen

5In this paper, the notion “GVG-RP ” denotes “GVG-RP n-runs” classfor the ease of presentation.

on a source node. When intended destination node suc-cessfully accepts the message/oxygen, GVG enters a fi-nal acceptance state to finish the mobile message delivery.For a valid cyanide poisoning in negative GVG − RP ,the probability of hemoglobin’s oxygen-transportation FAIL-URE/NO Pr [destination cannot receive oxygen] must be 1 −ε(N), while the probability of transportation SUCCESS/YESPr [destination receives oxygen] must be ε(N).

E. Mobility model

In an enclosed network space S, we divide the networkspace S into a large amount of small virtual tiles (cubes) ofarea (volume) s, so that the tile area (cube volume) is evensmaller than the physical size of the smallest network node.This way, each tile (cube) is either empty, or is occupied bya single node. Also because the network space is much largerthan the sum of all mobile nodes’ physical size, the probabilitythat a tile (cube) is occupied by a mobile node is very small.

Now a binomial distribution B(η, p) defines the probabilis-tic distribution of how these tiles (cubes) are occupied byeach mobile ad hoc node. Here η = S

s , the total numberof “positions”, is very large but < O(poly(N)); and p, theprobability that a cube is occupied by the single node, isvery small. When η is large and p is small, it is well-known that a binomial distribution B(η, p) approaches Poissondistribution with parameter ρ1 = η·p. Hence this binomialspatial distribution is translated into a spatial Poisson pointprocess [4] to model the random presence of the networknodes. In other words, ρ1 can be treated as a mobile node’sarrival rate of each presence “position”. Moreover, supposethat N events occur in space S (here an event is a mobilenode’s physical presence), ρ

N= N

S (where ρN

= N · ρ1 bytreating ρ1 as the average node PDF amongst the N nodes) isequivalent to a random sampling of S with rate ρ

N.

Eulerian and Lagrangian motion models In kinematics,a given flow’s motion depends not only upon position butupon time as well. Consider any scalar quantity σ whichis a continuous function of the four independent variablesrepresenting position and time (x, y, z) and t, with t beingtime, for which the space and time derivatives exists. Thetotal rate of change of σ with time is in general defined by anoperator D

Dt :

D

Dtσ =

∂σ

∂t+

∂σ

∂x· dx

dt+

∂σ

∂y· dy

dt+

∂σ

∂z· dz

dt=

∂σ

∂t+ V · σ,

where the differential displacements dx, dy, dz are specifiedfor the elapsed time dt. Here − is the gradient of a scalar:

= x · ∂

∂x+ y · ∂

∂y+ z · ∂

∂z

and V is the flow vector:

V = x · dx

dt+ y · dy

dt+ z · dz

dt,

where x,y,z are unit vectors in the x, y, z directions, respec-tively. Clearly, the term ∂σ

∂t represents the local time rate ofchange of the quantity σ at a fixed position point. The termV ·σ is a scalar representing the advectional or field changesin the flow associated with the motion of the flow.

For a network of many mobile nodes flowing through afinite area, we can specify either the field of V or the paths(trajectories) of the mobile nodes. The former is normallyreferred to as the Eulerian description of motion while thelatter is endowed with the title of Lagrangian description ofmotion.

In below, we will adopt an Eulerian description in ourstochastic mobility analysis. The scalar quantity σ is thearrival rate of an average node on a position, that is, theprobability of an average node’s presence at a position.

The stochastic mobility PDF Let ρ1 denote the mobil-ity probability distribution function of a single node in thebounded network space S. For a network deployed in abounded system space, let the random variable Ω = (X,Y, Z)denote the Cartesian location of a mobile node in the 3-dimensional network space at an arbitrary time instant t.

The probability that a given node is located in a subspaceS′ of the system space S can be computed by integrating ρ1

over this subspace

Pr [node in S′] = Pr [(X, Y, Z)∈S′] =

ZZZS′

fXY Z (x, y, z) dS

where fXY Z(x, y, z) can be computed by a stochastic analysisof an arbitrary mobility model.

Let x denote the random variable of number of mobile nodesin any network space concerned:

• (Uniform ρ1) the probability that there are exactly k nodesin a specific space S ′ following a uniform distributionmodel is

Pr [x = k] =(N ·ρ1 · S′)k

k!·e−N·ρ1·S′

. (1)

• (Non-uniform ρ1) More generally, in arbitrary distributionmodels including non-uniform models, the arrival rate islocation dependent. The probability that there are exactlyk nodes in a specific space S ′ is

Pr [x = k] =

ZZZS′

„(N ·ρ1)k

k!·e−N·ρ1

«dS. (2)

The choice of ρ1 depends on the underlying mobilitymodel. Some stochastic mobility models which directly choosea destination direction rather than a destination point andallow a bound back or wrap-around behavior at the borderof the system area, including the random walk model ona 2-D torus surface, are able to achieve a uniform spatialdistribution [2][3][1]. However, ρ1 is typically non-uniform.Fortunately, our GVG −RP and negative GVG −RP modelsdo not assume any specific mobility model and mobile nodepresence PDF. As depicted in Figure 4, the stochastic PDF

can be an arbitrary but continuous function over the networkarea/space.

0

10

20

30

40

50

010

2030

4050

0

0.5

1

1.5

2

x 10−3

X (unit)

Y (unit)

Nod

e S

toch

astic

Pre

senc

e P

DF

ρ1

Fig. 4. Stochastic node presence PDF in an arbitrary mobilitymodel by Eulerian description

F. Cyanide poisoning: formal specification

In this section, we use the negligibility-based model toexplain a theoretic reason why cyanide poisoning is fatal. Weshow that the success probability of carrying message at asingle node is negligible under cyanide poisoning.

As specified previously, there are N nodes in the boundednetwork area, amongst them there are θ·N compromised(i.e.,binding with θ·N cyanide ions) and (1−θ)·N uncompro-mised nodes. The random variable y denotes the number ofuncompromised nodes in an arbitrary space S ′. The probabilitythat there are k uncompromised nodes in the space S ′ is

Pr [y = k] =

ZZZS′

((1 − θ) · N · ρ1)k

k!·e−(1−θ)·N·ρ1 dS

Let z denote the random variable of number of compro-mised nodes in the same space S ′. The probability that thereare k compromised nodes in the space S ′ is

Pr [z = k] =

ZZZS′

(θ·N · ρ1)k

k!·e−θ·N·ρ1 dS

Given a hemoglobin in binding mode, one cyan ion withinthe binding distance will deprive the chance of nearby oxy-gen molecules’ chance to bind with the hemoglobin. Thehemoglobin node’s oxygen binding success ratio is

Psuccess = Pr [y≥1] · Pr [z = 0]

=

ZZZS′

“(1 − e−(1−θ)·N·ρ1)·e−θ·N·ρ1

”dS

=

ZZZS′

((1 − ε(N))·ε(N)) dS <

ZZZS′

ε(N) dS= ε(N).

where S ′ denotes the nominal size of the biochemical bindingrange and ε(N) denotes a negligible quantity with respect toN .

The mobility PDF ρ is arbitrary in our study as longas it is continuous in the space S, thus could be locationdependent and becomes a function of the location space S.Therefore, triple integrals must be used here. Fortunately,because ex is a fixed point in differential and integral calculus,that is, dex

dx= ex and

Rex dx = ex + C = O(ex), such

integrals or differentials do not change the magnitude oforder. In a nutshell, exponential orders O(eN ) and polynomialorders O(poly(N)) are unchanged in magnitude through theseintegrals or differentials. And this concludes that the last step= ε(N) holds.

Hence we have proved that cyanide poisoning reduces node-wise success probability of oxygen-transport to ε(N) for everysingle hemoglobin node. Then by the asymptotic invariantproved in Theorem 1, the network-wise success probability ofoxygen-transport by all N < poly(N) nodes stays as ε(N).In a nutshell, cyanide poisoning reduces an oxygen-transportprotocol into the negative GVG −RP class.

G. Countermeasuring treatments

Nevertheless, it is easy to restore an algorithm/protocol fromthe negative RP class to the RP class. This can be doneby introducing treatment agents that have a much greaterbinding affinity for cyanide ion than hemoglobin[12][5][7].For example, cyanide preferentially bonds to methemoglobinrather than the cytochrome oxidase, and hydroxycobalamin (aform of vitamin B12) can be used to bind cyanide to form theharmless vitamin B12a cyanocobalamin. A treatment like thiscan be analyzed below.

Suppose we can introduce γ·N treatment agent nodes tobind with cyanide ion. The probability that there are k suchtreatment agents in the space S ′ is

Pr [w = k] =

ZZZS′

(γ · N · ρ1)k

k!·e−γ·N·ρ1 dS

Whenever Pr [w≥1], a cyanide ion will bind toward thetreatment agent rather than a hemoglobin node. A hemoglobinnode’s oxygen binding success probability is changed to be

Psuccess = Pr [y≥1] · Pr [w≥1]

=

ZZZS′

“(1 − e−(1−θ)·N·ρ1 )·(1 − e−(1−γ)·N·ρ1

”dS

=

ZZZS′

((1 − ε(N))·(1 − ε(N))) dS

>

ZZZS′

(1 − 2ε(N)) dS.

This is a 1−ε(N) quantity. In contrast, the failure probabil-ity becomes ε(N). This way, the hemoglobin node’s oxygen-transport scheme is converted from the negativeRP class backto the RP class.

IV. CONCLUSIONS AND FUTURE WORK

In this paper we have formally describe the behavior ofcyanide poisoning following a complexity-theoretic approach.

Like modern cryptography, security threat in our network-centric model is defined on the complexity-theoretic conceptof “negligible” ε(x), which is asymptotically sub-polynomialwith respect to a pre-defined system parameter x. The pa-rameter x is the key length n in modern cryptography, but ischanged to the total number of network nodes N in our model.

We draw an analogy of biological cyanide poisoning tosecurity attacks in self-organizing mobile ad hoc networks.When the victim circulatory system is treated as an enclosednetwork space, a hemoglobin is treated as a mobile node,and a hemoglobin binding with cyanide ion is treated as acompromised node, we define a randomized complexity classGVG − RP to show how cyanide poisoning can reduce theprobability of oxygen/message delivery to a ε(N) quantity.This is accomplished in two steps: (1) We prove that thenegligibility property ε(N) is an asymptotic invariant in termsof the input parameter N for any polynomial-time algorithm;(2) We also prove that the life-sustaining node-wise oxygen-transport function succeeds (or fails in case of poisoningtreatment) with ε(N) probability, then by the invariant prop-erty the network-wise oxygen-transport function also succeeds(or fails in case of poisoning treatment) with the invariantε(N) probability. This leads to a new analysis of biologicalthreats based on network and complexity theoretic study. Toverify the theoretic analysis, we are developing a discrete-event simulation program (similar to [9]) which creates aparallel computing thread for every biological node and simu-lates biochemical processes by computational processes. Thesimulation results will be shown in a separated report.

REFERENCES

[1] C. Bettstetter. Mobility Modeling in Wireless Networks: Categorization,Smooth Movement, and Border Effects. ACM Mobile Computing andCommunication Review, 5(3):55–67, 2001.

[2] C. Bettstetter, H. Hartenstein, and X. Perez-Costa. Stochastic Propertiesof the Random Waypoint Mobility Model. ACM/Kluwer WirelessNetworks, Special Issue on Modeling and Analysis of Mobile Networks,10(5):555–567, 2004.

[3] C. Bettstetter and C. Wagner. The Spatial Node Distribution of theRandom Waypoint Mobility Model. In German Workshop on MobileAd Hoc Networks (WMAN), pages 41–58, 2002.

[4] N. Cressie. Statistics for Spatial Data. John Wiley and Sons, 1993.[5] A. V. Heijst and J. Meredith. Antidotes for Cyanide Poisoning. In

G. Volanis, J. Sims, F. Sullivan, and P. Turner, editors, Basic Science inToxicology (Brighton, Taylor and Francis Publishers), pages 558–566,1990.

[6] E. Kindwall. Carbon monoxide and cyanide poisoning. In J. Davis andT. Hunt, editors, Hyperbaric Oxygen Therapy, Bethesda MD: UnderseaMedical Society, pages 177–190, 1977.

[7] C. Mushett. Antidotal Efficacy of Vitamin B12 a (hydroxocobalamin)in Experimental Cyanide Poisoning. Proceedings of The Society forExperimental Biology and Medicine, 81:234–237, 1952.

[8] C. Papadimitriou. Computational Complexity. Addison Wesley, 1stedition, 1993.

[9] Scalable Network Technologies (SNT). QualNet. http://www.qualnet.com/.

[10] A. Sykes. Early studies on the toxicology of cyanide. In B. Vennesland,E. Conn, C. Knowles, J. Westly, and F. Wissing, editors, Cyanide inBiology, pages 1–9, 1981.

[11] J. Vick and H. Froehlich. Studies of Cyanide Poisoning. Arch IntPharmacodyn Ther, 273:314–322, 1985.

[12] J. Vick and H. Froehlich. Treatment of Cyanide Poisoning. J ToxicolClin Exp, 25:125–138, 1988.