Skip to main content

Minimize Malware Spread II - Solution & Explanation

HardArrayHash TableDepth-First SearchBreadth-First Search25 min readAsked at: Uber, Dropbox
Practice this problem

Problem Statement

You are given a network of n nodes represented as an n x n adjacency matrix graph, where the ith node is directly connected to the jth node if graph[i][j] == 1.

Some nodes initial are initially infected by malware. Whenever two nodes are directly connected, and at least one of those two nodes is infected by malware, both nodes will be infected by malware. This spread of malware will continue until no more nodes can be infected in this manner.

Suppose M(initial) is the final number of nodes infected with malware in the entire network after the spread of malware stops.

We will remove exactly one node from initial, completely removing it and any connections from this node to any other node.

Return the node that, if removed, would minimize M(initial). If multiple nodes could be removed to minimize M(initial), return such a node with the smallest index.

 

Example 1:

Input: graph = [[1,1,0],[1,1,0],[0,0,1]], initial = [0,1]
Output: 0

Example 2:

Input: graph = [[1,1,0],[1,1,1],[0,1,1]], initial = [0,1]
Output: 1

Example 3:

Input: graph = [[1,1,0,0],[1,1,1,0],[0,1,1,1],[0,0,1,1]], initial = [0,1]
Output: 1

 

Constraints:

  • n == graph.length
  • n == graph[i].length
  • 2 <= n <= 300
  • graph[i][j] is 0 or 1.
  • graph[i][j] == graph[j][i]
  • graph[i][i] == 1
  • 1 <= initial.length < n
  • 0 <= initial[i] <= n - 1
  • All the integers in initial are unique.

Approach Overview

Problem Overview: You are given an undirected network represented by an adjacency matrix where some nodes are initially infected with malware. If two nodes are connected, infection spreads between them. You must remove exactly one initially infected node so the final number of infected nodes after the spread is minimized. If multiple choices give the same result, return the smallest index.

Approach 1: Brute Force Infection Simulation (O(k * n^2) time, O(n) space)

Try removing each node from the initial infected list one at a time. For every candidate removal, run a depth-first search or breadth-first search starting from the remaining infected nodes and simulate malware spread through the adjacency matrix. Count how many nodes end up infected. Track the removal that produces the smallest infected count. This approach directly models the spread but repeatedly traverses the graph, making it expensive when the number of infected nodes grows.

Approach 2: DFS Connected Components Analysis (O(n^2) time, O(n) space)

Instead of simulating spread repeatedly, analyze the structure of the graph. First identify connected components consisting only of clean nodes using DFS on the graph. For each component, track which infected nodes can reach it. If exactly one infected node connects to that component, removing that node prevents infection for the entire component. Sum the sizes of components uniquely controlled by each infected node and choose the node that saves the most vertices. This converts repeated spread simulation into a single component analysis pass.

Approach 3: Union-Find with Infected Tracking (O(n^2 * α(n)) time, O(n) space)

Use Union-Find to group all non-infected nodes into connected components. Iterate through the adjacency matrix and union clean nodes that share edges. Then examine edges between infected nodes and these clean components. For each component, count how many infected nodes can reach it. Components connected to exactly one infected node are "saved" if that infected node is removed. Accumulate the component sizes saved by each infected node and pick the best candidate. Union-Find keeps component size queries and merges efficient.

Recommended for interviews: The connected-component strategy (DFS or Union-Find) is the expected direction. Brute force simulation demonstrates understanding of the spread process, but interviewers typically look for the insight that only components uniquely infected by one node can be saved. Using DFS or Union-Find reduces repeated graph traversals and cleanly models the problem.

Approach 1: DFS Connected Components

In this approach, we utilize Depth-First Search (DFS) to determine connected components in the graph. We simulate the infection spread by considering how each initial node's removal would affect the overall spread of malware. The goal is to find the node whose removal results in the minimal spread of malware.

This C implementation uses a DFS helper function to traverse the graph for each initial infected node's removal. We iterate over each node in initial and attempt removing it, then calculate the total spread using DFS on the remaining nodes. The node with the smallest spread is identified as the optimal node to remove.

Code

C

C++

Java

Python

C#

JavaScript

Complexity

Time Complexity: O(n^2 + k*n), where n is the number of nodes and k is the length of the initial array.
Space Complexity: O(n).

Try this approach in the editor →

Approach 2: Union-Find with Infected Tracking

In this approach, a Union-Find (or Disjoint Set Union) structure is used to maintain sets of nodes, helping to track connected components efficiently. We account for each component's size and how interconnected infected nodes influence the choice of node to remove.

The C solution implements Union-Find to track components and their sizes, while counting infected membership. A node's removal is optimal if it saves the largest unique component from infection or is smallest among ties.

Code

C

C++

Java

Python

C#

JavaScript

Complexity

Time Complexity: O(n^2), primarily driven by union operations over the graph.
Space Complexity: O(n), requiring storage for union, rank, and infectious component tracking data.

Try this approach in the editor →

Approach 3: Union-Find

We can use the union-find data structure to merge all nodes that are not in initial and satisfy graph[i][j] = 1.

Next, we create a hash table g, where g[i] represents the root node of the connected component that is connected to node i. We also need a counter cnt to count how many initial nodes each root node is infected by.

For each initially infected node i, we traverse all nodes j connected to node i. If node j is not in initial, we add the root node of node j to the set g[i]. At the same time, we count how many initial nodes each root node is infected by and save the result in the counter cnt.

Then, we use a variable ans to record the answer, and mx to record the maximum number of infected nodes that can be reduced. Initially, ans = 0, mx = -1.

We traverse all initially infected nodes. For each node i, we traverse all root nodes in g[i]. If a root node is only infected by one initial node, we add the size of the connected component where the root node is located to t. If t > mx or t = mx and i < ans, we update ans = i, mx = t.

Finally, we return ans.

The time complexity is O(n^2 times \alpha(n)), and the space complexity is O(n^2). Where n is the number of nodes, and \alpha(n) is the inverse Ackermann function.

Code

Python

Java

C++

Go

TypeScript

Try this approach in the editor →

Complexity Comparison

ApproachComplexity
DFS Connected Components

Time Complexity: O(n^2 + k*n), where n is the number of nodes and k is the length of the initial array.
Space Complexity: O(n).

Union-Find with Infected Tracking

Time Complexity: O(n^2), primarily driven by union operations over the graph.
Space Complexity: O(n), requiring storage for union, rank, and infectious component tracking data.

Union-Find

Detailed Complexity Analysis

ApproachTimeSpaceWhen to Use
Brute Force Infection SimulationO(k * n^2)O(n)Good for understanding malware spread mechanics or small graphs
DFS Connected ComponentsO(n^2)O(n)Preferred when using graph traversal to analyze clean components
Union-Find with Infected TrackingO(n^2 α(n))O(n)Best when managing connected components efficiently with repeated merges

Video Solution

LeetCode 928. Minimize Malware Spread II Explanation and Solutionhappygirlzt1,850 views views

Watch 9 more video solutions →

Frequently Asked Questions

Is Minimize Malware Spread II easy or hard?
Minimize Malware Spread II is classified as Hard on LeetCode. The challenge is recognizing that brute-force infection simulation is inefficient and that analyzing connected components of clean nodes reveals which infected node removal minimizes total spread.
How to solve Minimize Malware Spread II in O(n^2)?
First isolate connected components of non-infected nodes using DFS or Union-Find. For each component, count how many infected nodes have edges to it. If exactly one infected node reaches that component, removing that node prevents infection of the entire component. Choose the infected node that uniquely infects the largest number of nodes.
What is the best approach for Minimize Malware Spread II?
Connected component analysis using DFS or Union-Find is the most effective approach. Group clean nodes into components and track which infected nodes can reach each component. If a component is connected to exactly one infected node, removing that node prevents the entire component from getting infected. This reduces repeated spread simulations and runs in about O(n^2) time.
Is Minimize Malware Spread II asked at Google/Amazon/Meta?
Graph infection and component analysis problems appear frequently in interviews at companies like Google, Amazon, and Meta. Variants involving Union-Find, BFS, or DFS over adjacency matrices are common in system modeling and graph reasoning questions.
What data structure is used in Minimize Malware Spread II?
The problem relies on graph data structures represented by an adjacency matrix. Typical solutions use depth-first search (DFS), breadth-first search (BFS), or the Union-Find (Disjoint Set Union) structure to track connected components and infection reachability.
What is the time complexity of Minimize Malware Spread II?
The optimal solutions run in O(n^2) time because the graph is represented as an n x n adjacency matrix. DFS-based component analysis scans the matrix once, while Union-Find performs near-constant merges with α(n) overhead. Space complexity is O(n) for component tracking and bookkeeping.
Minimize Malware Spread II Python or Java solution approach?
Python and Java implementations usually build connected components using DFS or Union-Find. After grouping clean nodes, maintain counts of infected neighbors for each component and compute how many nodes each infected vertex uniquely infects. The node saving the most vertices is returned.

Ready to solve this problem?

Practice Minimize Malware Spread II with our built-in code editor and test cases.

Practice on FleetCode