A Cellular Automaton (CA) is a discrete dynamic system in time and space, it is composed of cells and the evolution of the system depends on the previous state, that is, each cell will influence the following evolution. It is basically a type of finite-state machine that is capable of simulating complex systems efficiently and effectively. The state of each cell will define the general state of the system [28] . Therefore, local interactions are considered and, therefore, individual aspects, making it possible to simulate each individual in a very simple way.

A CA can be considered as a system composed of a cell array A. Each cell c i represents a finite automaton with a set of states Q, in an alphabet Σ and a transition function δ : Q × Σ → Q . The input of the alphabet Σ is given by all the possible combinations of the state of the adjacent cells of each cell. Each cell c_i and its adjacent cells are considered all together and represented as the unique set N = { c i } ∪ N − c i where N − c i is the set of cells considered as neighbors of an arbitrary cell c i . Then, the Cellular Automaton can be defined as a 4-tuple M = { A , Q , δ , N } [29] .

The components of a CA are:

· Cellular space: it is the physical space where the automaton evolves, being an arrangement, it has dimension D or infinite.

· Transition function: this function can be a rule or a set of rules that will define an evolution in time, causing a change of state in the system, so the set of rules δ define the dynamics of the CA. Given a cell i in a state k_i and the set of states of the neighbors N of i, at an instant of time t, δ is deterministic and calculates the next state of time t + 1 for cell i.

· Time variable: the dynamics of the cellular system develops over a discrete time.

· Neighborhood: are the cells that will influence the evolution of a cell. So, to each cell i it is necessary to assign a set of cells called neighbors, including itself.

· Border: in the case that the cellular space is finite, the border is the condition in which the cells that are in the perimeter of the cellular space are found.

· States: is the set of possible states Q in which the system can be, in particular the cells, at time t.

From the definition of CA, modifications have been made to them such as modifying the cellular space, thus emerging a new theory of CA. In particular, if we change the cell space from an array to a graph, we get a new automaton called the Network Automaton.

Being able to model systems is a really complicated task, but when trying to model complex systems it is even more complicated. A complex system is one that is composed of a variety of entities, including another system or another individual. Many systems have been represented through graphs, remembering that a graph G can be represented through a tuple (V, E) where V is the set of nodes and E is the set of edges. Due to the need to represent complex systems, modifications have been made to the so-called simple graphs, obtaining graphs such as: directed graphs, labeled graphs, multigraphs, hypergraphs, among others. Many combinations of graphs have resulted in what are called complex networks.

A complex network is a network, represented by a graph, which has statistics and specific characteristics in its structure or topology. Some examples of these types of networks are:

· Scale Free Networks (SFN): they are graphs where the degree of their nodes follows a Power Law distribution [30] , that is, most nodes are connected to few nodes while the minority is highly connected to many nodes. The distribution can be described as follows: P ( k ) = k − γ , where γ > 0. According to Barabási Albert [31] , we can build a scale-free network by executing his algorithm step by step. It has been found suitable to use an SFN to represent a social network [30] [32] .

· Small world networks: they are graphs where the distance between any pair of nodes is relatively small while at the same time the level of transitivity or clustering is relatively high [33] .

Then, a Network Automaton N can be defined as a 3-tuple (G, Q, { f i | i ∈ N } ) [34] , where G is a graph in N, Q is a set of states and f i : Q | U i | → Q a mapping, called the transition rule associated with vertex i. U i = { j ∈ N | { j , i } ∈ E } is the neighborhood of i, i.e. the set of vertices connecting i and | U i | denotes the number of vertices joining U i . The graph G is assumed locally infinite.

A Network Automaton follows the definition of a CA, as it differs only in cell space. Local interactions are still considered, that is when one node interacts with another, through the transition function. Once the transition function has been executed, it will indicate to which state it will evolve. Therefore, it continues to preserve the important characteristics of a CA, as well as simplicity.

The model consists of a Network Automaton, denoted as N = ( G , Q , F ) , where each node represents an agent that emulates a user and his device (smartphone) connected in the cellular network, denoted as G, each smartphone attribute varies over time. Each node will belong to a single state of the set of states, denoted as Q, at an instant of time t. The next state to which the device will belong will be defined by the transition function, denoted as F, which evaluates the parameters and current state of each node to obtain the next state. For practical purposes, it will be referred to in the following sections as a smartphone or device, both to the user and to their device.

Listed below are some important considerations, which directly affect the propagation dynamics in the model:

· Only the sending of SMS messages is considered an infection vector.

· It is considered that the worm that infects the device will always have access to the contact list.

· A population with different security characteristics is considered, that is, a heterogeneous population. Depending on the case study, the population can carry the same or different OS (Android, iOS).

· The size of the population remains constant over time.

· The size of each compartment or type of population, according to its state before the disease at each instant of time, is considered a whole quantity, not a fraction.

· Every second the transition function will be applied.

· It is considered that there is only one worm mounted on the server, so it affects devices with the same OS as the worm.

· Once a phone is recovered, that is, it was in an infected or inactive state and a vaccine was applied due to antivirus, or the user of the device took some action that reset it, the device will be protected against the worm so cannot be re-infected.

· Devices in states: Recovered, Immune and Latent, will remain in the same state respectively at the next time state, since they are terminal states.

· The initial number of infected devices is only one.

The dynamics of the worm spread is executed as follows:

1) Devices are assigned to the cellular space G and their attributes are initialized, as well as individual and global parameters of each device in the cellular space, such as: the telephone directory, the registry of messages sent between devices, security awareness of the devices, among others.

2) The transition function of the automaton is executed, each device must collect the information of its neighbors in order to apply the transition function and obtain its next state after evaluating the function.

3) Variables for each device are updated for use in the next time state.

Steps 2 and 3 are executed in each evolution of the system until the criterion for stopping or ending the simulation is met. For our model, the stopping criterion is defined when the system is in an equilibrium state, that is, the number of devices in each compartment does not vary.

For the different case studies, a population | V | of 10,000 nodes, the population remains constant for all cases and with an initial number of infected nodes I ( 0 ) = 1 . To establish the telephone directory of each node, that is, the way in which they will be connected in the network, a Power Law is followed, in such a way that the majority of the nodes will be highly connected, while the minority of them will be connected. with very few, thus building an SFN. To build the SFN, the Barabási Albert Graph algorithm was used, which is implemented in the Networks module [35] in Python.

The values of degrees of trust between nodes are obtained by filling out a message log, which indicates how many messages have been sent between two nodes in a period of one week, considering that the maximum number of messages that a node can send in one week is 30 and that this does not vary in subsequent weeks, in accordance with [36] [37] . Regarding cybersecurity awareness, to find out how aware the user is of the existence of malware, a normal distribution was used to establish its value. The risk threshold is set to a fixed value of 0.70.

The probability that a device goes to an inactive state is set to 0.01, this is considering that most devices remain mostly active over time. In the event that a device goes into the inactive state, it will return to the infected state again if a probability of 0.95 is met, since the user will do everything possible to keep the cell phone working in its entirety, as it happens in reality.

For the rest of the model parameters, the values used are specified in each case study. The dynamics of the system evolves in time steps of one second. For all the case studies presented, the results are the average of 10 simulations, which correspond to an average behavior of the system under study. In addition, the accumulated number of infected is considered as the sum of the devices in an Infected state and those in an Inactive state; since both are devices infected by the worm.

Table 3, describes the values of the parameters used for the simulations carried out by varying the infection rate. In particular, four values for the infection rate are considered: 0.25, 0.50, 0.75 and 1.0. The results obtained from the different simulations, taking into account the mentioned values, are shown in Figure 3. As can be seen in the image, as the value of the infection rate is higher, the malware infection spreads faster, as is to be expected since the probability of contagion is also.

According to [38] , when SMS messages are transmitted there are different types of delay, which affect their delivery time. Table 4 , describes the values of the parameters used for the simulations carried out, varying the TL message delivery latency time in three values: 1, 2, and 3. The results obtained from the different simulations taking into account the mentioned values are shown in Figure 4. As can be seen in the image, the message latency time, as its name indicates, generates a delay in the time required to infect the population; in such a way that the

greater the latency time, the time to infect the population of devices will also be greater. This is because a greater delay in the delivery of SMS messages will cause the propagation to be slower.

According to [38] , there is a minimum loss of messages between a range of 5% to 20%. Table 5, describes the values of the parameters used for the simulations carried out, varying the message delivery failure P_F in four values: 0.05, 0.10, 0.15, and 0.20. The results obtained from the different simulations, taking into account the mentioned values, are shown in Figure 5. As can be seen in the image, as the probability of message delivery failure increases, the speed of propagation is lower, and therefore, the time required to infect the population is increased.

According to Statista [39] , on average 56% of people are aware that malware exists and, therefore, are aware of the risk of clicking on a link. Table 6, describes the values of the parameters used for the simulations carried out, varying the risk awareness of the users, the following values are considered: 0.25, 0.50, 0.56 and 0.75. The results obtained from the different simulations, taking into account the values mentioned, are shown in Figure 6. As a higher percentage of the population is aware of the risk involved in clicking on a link, the population that can be infected by it is smaller. malware, even when there is no antivirus or other measure to prevent contagion. This implies that the spread of malware is slower. Particularly, when considering the case where 25% of the population is aware of the risk, the speed of spread is higher. On the contrary, when it is

considered that 75% of the population is aware, the speed of spread is reduced, as well as the number of devices to be infected. On the other hand, a risk threshold UR is considered, such that if a risk-aware user i has a CR_i is greater than the threshold, it means that user i is highly aware, so he will not open links to malicious messages he receives. Therefore, if the user reaches or exceeds the UR, the person will not perform any action that puts their device atrisk. With greater risk awareness, the number of immune devices will grow, as seen in Figure 7.

According to Tatango, 90% of users read a received text message within the first 3 minutes (180 seconds). Table 7, describes the values of the parameters used for the simulations carried out, varying the average reading time TR in four values: 90, 180, 270 and 360 seconds. The results obtained from the different simulations, taking into account the mentioned values, are shown in Figure 8. As can be seen in the Figure 8, a lower reading frequency implies a higher propagation speed, since users check their device more constantly. checking if there are new messages so the risk of infection increases.

Table 8, describes the values of the parameters used for the simulations carried out, varying the probability of recovery P_R in four values: 0.00025, 0.00050, 0.00075 and 0.0010. The results obtained from the different simulations, taking into account the mentioned values, are shown in Figure 9 and Figure 10 (infection and recovery curves). As can be seen in the figures, the lower the probability of recovery, the maximum number of devices to infect is greater and the speed of

spread is higher, since the time required to infect the entire maximum possible population increases depending on the number of devices to be infected. of this probability of recovery. As a consequence, also the recovery process of a device will be slower.

The Degree of confidence (DC) or relationship indicates how much one user trusts another. Table 9, describes the values of the parameters used for the simulations carried out, considering four values of the probability of the degree of confidence: 0.20, 0.40, 0.60 and 0.80. The results obtained from the different simulations, taking into account the mentioned values, are shown in Figure 11. As can be seen, if users have a higher degree of trust among themselves, they will click on the malicious link sent more quickly, for therefore, the speed of propagation

will be higher. This behavior is justified because users depend on the degree of trust to decide whether or not to read any message received from a contact. It is important to point out that although the network topology is formed by an SFN, the DC implies how many SMS messages were sent between two devices in a given period.

According to [40] [41] , on average 84.4% of devices purchased between 2019 and 2020 have an Android-type OS, while on average 15.5 have an iOS-type OS, and less than 0.1% have a different OS than the previous ones. Table 10, describes the values of the parameters used for the simulations carried out, considering two types of device populations (Android and iOS). The results obtained from the different simulations, taking into account the mentioned values, are shown in Figure 12 and Figure 13. As can be seen in Figure 11, the number of

infected Android devices is close to 8000 devices, while the number of latent devices remains below 2000. In Figure 12, it can be seen that the number of infected iOS devices is minimal, since most of the infected devices are of another type of OS, in addition to the fact that the number of latent devices is higher than the number of infected ones, so it is significantly reduced that users with this OS can infect others of the same type.