Hindawi Publishing CorporationJournal of Applied MathematicsVolume 2013 Article ID 518213 11 pageshttpdxdoiorg1011552013518213

Research ArticleEffective Proactive and Reactive Defense Strategies againstMalicious Attacks in a Virtualized Honeynet

Frank Yeong-Sung Lin Yu-Shun Wang and Ming-Yang Huang

Department of Information Management National Taiwan University Taipei Taiwan

Correspondence should be addressed to Yu-Shun Wang yushunwangtwgmailcom

Received 11 April 2013 Accepted 22 July 2013

Academic Editor Anyi Chen

Copyright copy 2013 Frank Yeong-Sung Lin et al This is an open access article distributed under the Creative Commons AttributionLicense which permits unrestricted use distribution and reproduction in any medium provided the original work is properlycited

Virtualization plays an important role in the recent trend of cloud computing It allows the administrator to manage and allocatehardware resources flexibly However it also causes some security issues This is a critical problem for service providers whosimultaneously strive to defend against malicious attackers while providing legitimate users with high quality service In this paperthe attack-defense scenario is formulated as a mathematical model where the defender applies both proactive and reactive defensemechanisms against attackers with different attack strategies In order to simulate real-world conditions the attackers are assumedto have incomplete information and imperfect knowledge of the target network This raises the difficulty of solving the modelgreatly by turning the problem nondeterministic After examining the experiment results effective proactive and reactive defensestrategies are proposed This paper finds that a proactive defense strategy is suitable for dealing with aggressive attackers underldquowinner takes allrdquo circumstances while a reactive defense strategy works better in defending against less aggressive attackers underldquofight to win or dierdquo circumstances

1 Introduction

The vision for most service providers is to provide high-quality service and improve customer satisfaction thusmaximizing profit From an infrastructure perspective theevolution of computing architecture has shifted from main-frame cluster computing distributed computing and gridcomputing to cloud computing As a recent and increasinglynoteworthy trend in information technology (IT) cloudcomputing describes a new service model based on theInternet From a managerial perspective one of the keysuccess factors of cloud computing is its ability to promiseand achieve high quality and availability of service

Applying virtualization technology makes the job ofproviding enterprise security more difficult As observed inthe IBMX-ForceMid Year Trend and Risk Report conductedin August 2010 [1] attackers continue to take advantage ofsecurity flaws The rate of vulnerability disclosures in 2010is higher than any point from 2000 to 2009 The numberof virtualization vulnerability disclosures from 1999 throughthe end of 2009 ascended rapidly peaking in 2008 at 100

While this number fell by 12 percent to 88 in 2009 thisdrop indicates that virtualization vendors have recognizedthe threat these flaws pose and have increased their attentionto security Although the ratio of virtualization vulnerabilitydisclosures increased by only 1 percent from 2007 through2009 these vulnerabilities still represent a notable securitythreat Therefore it is increasingly important to understandthe security implications of virtualization technology

In addition to external malicious attackers another weakcomponent of networks is insidersThey insensibly assist peo-ple with bad intentions in their legal use of computer systemsor networks Such insider-assisted malicious attacks adoptsocial engineering as a method to exploit common humanbehavior These attacks require a lower degree of technicalability than standard malicious attacks but can cause higherdegrees of damage As a result organizations emphasize theimportance of policy enforcement and increase employeeeducation to mitigate the risks posed by social engineering

In response to these problems this paper considers bothproactive defense resources such as firewalls IDS IPS andreactive defense techniques All types of resources considered

2 Journal of Applied Mathematics

Table 1 Given parameters

Notation Description119873 The index set of all nodes119862 The index set of all core nodes119871 The index set of all links

119872The index set of all levels of virtual machine monitors(VMMs)

119867 The index set of all types of honeypots

119875The index set of candidate nodes equipped with falsetarget function

119876The index set of candidate nodes equipped with faketraffic generating function

119877The index set of candidate nodes equipped with falsetarget and fake traffic generating function

119878 The index set of all kinds of services119861 The defenderrsquos total budget119908 The cost of constructing one intermediate node119900 The cost of constructing one core node119875 The cost of each virtual machine (VM)

119896119894

Themaximum number of virtual machines on VMMlevel 119894 where 119894 isin 119872

120572119894 The weight of 119894th service where 119894 isin 119878

119864All possible defense configurations including resourcesallocation and defending strategies

119885All possible attack configurations including attackerattributes strategies and transition rules

997888997888119860119894119895

An attack configuration including the attributesstrategies and transition rules of the attacker launches119895th attack on 119894th service where 119894 isin 119878 1 le 119895 le 119865

119894

119865119894

The total attacking times on 119894th service for all attackerswhere 119894 isin 119878

120574The cost of constructing a reconfiguration function toone node

120582Theminimum number of hops from core nodeattackers can start to compromise

119888119894

The number of hops from core node category i attackersstarts to compromise where 119894 isin 119885

in this work one is quantified not only by monetary but alsoby time labor and other possible factors As defenders seekout an appropriate defense resource allocation within budgetlimitations and observe the Quality of Service (QoS) require-ment it becomes increasingly important to best determinehow to find a defense mechanism that can detect risky attackbehavior early and mislead attackers to routes distant fromthe server before attackers are at the gates

In this paper we assume that organizations mayencounter a great diversity of threats Whether these threatsare external or internal they can bring about vast loss tofinances and reputation However budgets for securityand training are often inadequate Hence it is much moreimportant for a system or network to enhance robustness inorder to satisfy QoS requirements for service users than toprevent all categories of malicious attacks This symbioticconcept to security is called survivability which is widelydefined and applied in previous works [2ndash6]

Table 2 Decision variables

Notation Description

997888119863119894

A defense configuration including resourceallocation and defending strategies on 119894th servicewhere 119894 isin 119878

119879119894119895(997888119863119894997888997888119860119894119895)

1 if the attacker achieves his goal successfully and0 otherwise where 119894 isin 119878 1 le 119895 le 119865

119894

119899119894

The proactive defense resource allocated to node 119894where 119894 isin 119873

119897119894

The number of VMM level 119894 purchased where119894 isin 119872

120575119894

The number of services that honeypot 119894 cansimulate where 119894 isin 119867

120576119894

The interactive capability of false target honeypot119894 where 119894 isin 119875

120579119894

Themaximum throughput of fake traffic ofhoneypot 119894 where 119894 isin 119876

119881(119897119894)

The cost of VMM level 119894 with 119897119894VMMs where

119894 isin 119872

ℎ(120575119894 120576119894)

The cost of constructing a false target honeypotwhere 119894 isin 119875

119891(120575119894 120579119894)

The cost of constructing a fake traffic generatorhoneypot where 119894 isin 119876

119905(120575119894 120576119894 120579119894)

The cost of constructing a honeypot equippedwith false target and fake traffic functions where119894 isin 119877

119861NL The budget of constructing nodes and links119861proactive The budget of proactive defense resource119861special The budget of reactive defense resource119861virtualized The budget of virtualization119861honeypot The budget of honeypots119861reconfig The budget of reconfiguration functions119890 The total number of intermediate nodes

119902119894119895

The capacity of direct link between nodes 119894 and 119895where 119894 isin 119873 119895 isin 119873

119892(119902119894119895)

The cost of constructing a link from node 119894 tonode 119895 with capacity 119902

119894119895 where 119894 isin 119873 119895 isin 119873

119909119894

1 if node 119894 is equipped with false target functionand 0 otherwise where 119894 isin 119873

119910119894

1 if node 119894 is equipped with fake traffic generatingfunction and 0 otherwise where 119894 isin 119873

119911119894

1 if node 119894 is equipped with reconfigurationfunction and 0 otherwise where 119894 isin 119873

Survivability is a typical metric that measures networkperformance under intentional attacks or other failures Tra-ditionally network security status is divided into two discretetypes compromised and safe Typically when providingservices the evaluation criterion is the quality of servicebut applying this dichotomy of compromise and safetyignores the intermediate status For instance while underan attack the performance level of each service continuallydeclines Therefore network status should be represented ina continuous form [2] Hence in this paper survivability ischosen as themetric for describing network status Accordingto [2] survivability is defined as ldquoThe capability of a systemto fulfill its mission in a timely manner in the presence of

Journal of Applied Mathematics 3

Table 3 Verbal notations

Notation Description119866core119894 Loading of each residual core node 119894 where 119894 isin 119862

119880link119894 Link utilization of each link 119894 where 119894 isin 119871

119870effectNegative effect caused by applying fake trafficadjustment

119868effectNegative effect caused by applying dynamictopology reconfiguration

119869effect Negative effect caused by applying local defense

119874tocoreThe number of hops legitimate users experiencedfrom one boundary node to core nodes

119884 The total compromise events119882threshold The predefined threshold about QoS119882final The QoS level at the end of attack

119882(sdot)The value of QoS determined by 119866core119894 119880link119895 119870effect 119868effect 119869effect and 119874tocore where 119894 isin 119862 119895 isin 119871

120588defense119894

The total defense resource of the shortest pathfrom compromised nodes detected to core node 119894

divided by total defense resource where 119894 isin 119862

120591hops119894

The number of hops from compromised nodesdetected to core node 119894 divided by the number ofhops from attackerrsquos starting point where 119894 isin 119862

120596degree119894

The linking number of core node 119894 divided by themaximum number in the topology where 119894 isin 119862

119904119894

priority119895

The priority of service 119895 provided by core node 119894

divided by the maximum service priority in thetopology where 119894 isin 119878 119895 isin 119862

120573threshold The risk threshold of core nodes

120573(sdot)

The risk status of each core node which is theaggregation of defense resource number of hopslink degree and service priority

Table 4 Environment Parameters

Testing platformProgramming language CCompiler GNU GCC 462Total evaluation times 60000Distributions applied to describe attackersrsquoattributes Normal distribution

attacks failure or accidents including networks and large-scale systems of systemsrdquo

Along with the concept of survivability the vulnerabilityof each node is determined by the Contest Success Function(CSF) which is also applied in [7ndash10] CSF originates fromthe economic rent seeking problem found in EconomicTheory This method also applies a continuous approach tothe problem The form of the CSF is success probability =

119879119898

(119879119898

+ 119905119898

) when applied to attack and defense scenarioswhere 119879 represents the resources invested by the attacker and119905 stands for resources deployed by the defender Further 119898

is known as contest intensity which illustrates the nature ofthe battle while success probability is the probability of anode being compromised When the value 119898 is between 0and 1 it represents ldquofight to win or dierdquo circumstance [11]

Table 5 Parameters for defender

Parameters ValueTopology type Scale-free networkNumber of nodes 49Number of core nodes (each service) 6 (1 2 3)Number of terminal nodes 5Number of services 3Weight of each service 1 2 3Number of users 30Defender total budget 1700000Topology construction budget 700000Proactive defense budget 400000Reactive defense budget 600000

Table 6 Parameters for attacker

Parameters Value

Total attack budget A normal distribution with lower bound300000 and upper bound 1500000

Capability A normal distribution with lower bound120576 and upper bound 1

Aggressiveness A normal distribution with lower bound01 and upper bound 09

Attackerrsquos objective Service disruption or steal confidentialinformation

which means the effectiveness of resources is insignificantFor 119898 ge 1 the effectiveness of resources invested by bothsides is exponentially increasing If 119898 closes to infin it standsfor a ldquowinner takes allrdquo circumstance significant advantage isgranted to the stronger side even if that side is stronger byonly one invested resource [12]

There are many popular methodologies applied for solv-ing survivability problems In recent years game theory is awidely used one Nevertheless in [3] the authors point outthat this solution approach is limited for deterministic sce-narios Even the emerging branch of game theory stochasticgame is still confined with this assumption that all valuesof probabilistic variables have to be determined before theattack and defense starts This feature has a negative effecton creating cyber attack and defense scenario since in realworld decisions made during attack and defense dependon current status Given all values of variables makes thescenario far from reality

For example when choosing a victim from candidatenodes an attacker should apply information like the loadingof each node traffic amount on each link andor number ofusers on each node to evaluate the importance of all candi-dates Then choosing the most appropriate one as the targetyet the restriction of game theory enforces the choosingprobability which should be determined at the beginning ofthe cyber warfare In other words those variations happenedduring attack and defense like traffic reroute link statusnode conditions are ignored Consequently in this workMonte Carlo simulation is applied to consider hopefully andcover every angle in the attack and defense scenario

4 Journal of Applied Mathematics

2 Problem Formulation

21 Problem Description In order to improve system sur-vivability the defender deploys both proactive and reactivedefense resources to confront different attacks Proactivedefense resources are deployed before an attack is launchedIn this paper proactive resources include a firewall systemantivirus software detection techniques such as IntrusionDetection System (IDS) and Intrusion Protection System(IPS)

Alternatively reactive defense resources are activatedduring an attack as an immediate action for the defenderThe mechanisms considered in this paper can strengthendefenses provide deception and provide resource concentra-tion

For strengthening defenses since the scenario consideredin this paper is constructed in a virtualized environment anumber of Virtual Machines (VMs) are governed by a Vir-tual Machine Monitor (VMM) that controls all informationdetails for all VMs When an attack event is detected localdefense functions for each VMM are activated automaticallyto raise the defense capability of the virtualized nodes belong-ing to the same VMM However this mechanism does notalways create positive effects Once an attacker determinesthat the target network is a virtualized environment anddiscovers the existence of a VMM he can compromise theVMM through vulnerabilities in APIs [13] If the VMMis compromised all VMs belonging to this VMM are alsocompromised

Deceptionmechanisms are widely applied in defense andin this paper honeypots are considered to distract attackersAccording to [14ndash17] honeypots not only serve as a passivedecoy fooling attackers into believing they have achievedtheir goal and preemptively terminating the attack but alsoas an active lure that acts as a service-providing node toattract attackers The former is known as a false target andthe latter can be implemented by a fake core node thatspreads service-like traffic to attract attackers When facingdifferent attackers the deceiving probability of each honeypotis differentThis probability is jointly determined by attackersrsquocapability and the interaction level of a honeypot

As for resource concentration by modifying the con-cept of ldquorotationrdquo discussed in [18ndash20] and adapting it toour scenario the defender can adopt dynamic responsivestrategies to improve system survivability Hence whileunder an attack the defender can apply dynamic topologyreconfiguration to exchange the neighbor of one core nodewhich has the strongest defensive resources with a node thatis close to the attackerrsquos current location

However since dynamic topology reconfigurationrequires node rotation it negatively impacts QoS Thereforeunless the risk level of a core node exceeds a predefinedthreshold the defender will not activate this mechanismFurthermore false positive and false negative situations forevery defense mechanism are considered

In addition to the defense mechanisms described abovethe following attributes are also considered for creating arealistic attack-defense scenario

211 Goal Generally attackers target a network to eitherdisrupt services or to compromise servers and steal sensitiveinformation Therefore in this paper an attackerrsquos goal maybe service disruption or the theft of confidential informationService disruption is achieved by ensuring that the minimallevel of service quality is not fulfilled In the case of infor-mation theft attackers usually establish their target beforelaunching an attack and once core nodes with the desiredinformation are compromised the defenders lose

212 Budget Budget stands for the primary resources for anattack including money manpower computing effort timeand other important factors Without sacrificing generalityan attackersrsquo budget follows a general distribution Whendetermining the result of a compromising event for exampleone attacker invests a certain amount of attack resources oncompromising the target node and the CSF is applied todecide the compromised probability In contrast with [21] and[22] if an attacker invests more resources than the defenderon a given target node it is not guaranteed that the attackerwins it only raises the compromised probability

213 Capability This criterion depicts an attackersrsquo profi-ciency and is also described by a general distribution Forhighly proficient attackers there is a high probability thatthey will see through reactive defense mechanisms such ashoneypots

214 Attack Type In general a malicious attacker launchesan attack from one of the boundary nodes which is com-monly considered an external attack In contrast otherattacks can be launched by malicious insiders and causemore severe consequences [13] Malicious insiders are ableto choose an internal node as their starting position forcompromising the network

In the real world external attackers may apply socialengineering to escalate their access privileges This mecha-nism allows the attacker to bypass some proactive defensefacilitates like a firewall As a result attackers have an edgeon compromising the network

In order to best mimic real-world conditions all attacktypes discussed above are considered in this paper

215 Aggressiveness This metric describes the preferredcompromised probability of an attacker when attacking atarget node This attribute is highly dependent on budgetsince the compromised probability is the left-hand side of theCSF In other words the attack resources required for com-promising a target node are calculated by the given defenseresources contest intensity (119898) and attackerrsquos aggressivenessHighly aggressive attackers prefer a high success probabilityand like to spend a larger amount of resources to compromisethe target node than less aggressive attackers An attackerrsquosaggressiveness is determined by a general distribution

216 NextHop SelectionCriterion In this paper the attackersare assumed to have incomplete information and imperfectknowledge Since they can only gather local information

Journal of Applied Mathematics 5

(1) Attackers only have incomplete information(2) The defender only has incomplete information regarding the network since there are unaware vulnerabilities(3) A service is provided by multiple core nodes(4) Each service has different weights(5) One virtual machine only provides one service(6) Only malicious nodal attacks are considered(7) The compromise probability of a target node is determined by the Contest Success Function (CSF)

Box 1 Problem assumptions

such as the defense level of one hop neighbors link trafficor link utilization attackers must use available informationwisely to choose a proper strategy to select the next victimInspired by the seminal work of [23] possible attack strategiesmay be developed based on the quantity of proactive defenseresources link utilization or a portion of the target servicetraffic of each candidate node Additionally this paper alsoconsiders a more irrational strategy of a blind attack

By applying general distributions to describe attacker-related attributes the total number of attacker categories isnearly infinite This feature increases the generalizability ofour model The detailed assumptions are described in Box 1

To describe the attack procedures in more detail wedevelop the following idea to explain the interaction betweenthe defender and attackers The following figures are drawnfrom the attackerrsquos view for clarity In other words all figuresare a logical topology that has been already virtualizedsince one physical machine may represent many VMs Theexplanations of components are listed in Figure 1

First the defender deploys proactive defense resource oneach node and the attacker starts to compromise the networkfrom the edge nodes (119878) Before launching an attack theattacker probes all the candidate nodes to gather sufficientinformation and determine the next hop selection criterionfor this compromise event By applying the next hop selectioncriterion the victim is chosen The result of this compromiseevent is determined by the CSF If the target is compromisedit becomes a spring board for attackers to assault otheruncompromised neighbors Corresponding information isshown in Figure 2 The topology demonstrated in Figures 2and 3 for presentation purposes the topology structureimplemented in the simulations is a scale-free network

The risk level of each core node is evaluated by minimumdefense resources the number of hops the link degree andservice priority Minimum defense resource stands for theshortest path from compromised nodes to one core nodedivided by total defense resources The number of hops isdetermined by the minimum number of hops from com-promised nodes to one core node divided by the maximumnumber of hops from the attackersrsquo starting point to one corenode Link degree is the linking number of each core nodedivided by the maximum linking number in the topologyService priority is the weight of the service that is providedby the target core node divided by the highest weight ofservice in the topology If any of the core nodes is in dangerthe defender can activate defense mechanisms such as afake traffic generator and a dynamic topology reconfigurationunder QoS limitations

S

Reconfiguration

Reconfiguration

Reconfiguration

VM

Reconfiguration

VM

Figure 1 Explanations of Components

Reconfiguration

VMReconfiguration iiiiiiionnoooooooooonnnooooonnn

S

Reconfiguration

Reconfiguration

VM

Figure 2 Sample network and resource allocation scheme

When the defender activates a dynamic topology recon-figuration only nodes implemented with the reconfigurationfunction are considered First the defender chooses theleast proactively defended neighbor with the reconfigurationfunction of a risky core node The defender then selectsanother node that is both not a neighbor of the core nodeand the most proactively defended nearby the node selectedfrom the previous step If there is a fake traffic generatinghoneypot the defender is also able to activate the mechanismfor influencing an attackerrsquos next hop selecting criterion

In the event that attackers attack the virtualized nodesand this malicious event is detected by the defender the local

6 Journal of Applied Mathematics

Given(1) all possible defense configurations set including defense resource allocation and defending strategies(2) all possible attack configurations set including attacker attributes strategies and selection criterion(3) the total attack times on each serviceObjectiveto minimize the service compromised probability of the target networkSubject to(1) budget constrain for both the defender and attackers(2) the minimum QoS requirement for legitimate usersTo determinethe effective defense strategies to allocate resources

Box 2 Problem description

078

079

08

081

082

083

084

1000 2000 3000 4000 5000 6000 7000 8000 9000 10000

Serv

ice c

ompr

omise

d pr

obab

ility

Evaluation times

m = 01

m = 03

m = 05

m contest intensity

Figure 3 A possible result of an attack and defense scenario

defense mechanism is activated automatically Consequentlythe defense level increases for the attacked node the VMMand the rest of this virtualized group If attackers see that thenode is under a virtualized environment they may continueto compromise the VMM

When a core node is compromised the defender mustevaluate whether the performance level still fulfills theminimum QoS requirement and update the degree of riskregarding each core node If an attacker targets multipleservices once they compromise a false target honeypot andare deceived by it they will change their target to the nextservice Finally if attackers exhaust their budget the attackis terminated and the defender wins the battle One possibleresult is shown in Figure 3 A structural description of theproblem is presented in Box 2

22 Mathematical Formulation The scenario discussed pre-viously is modeled as a minimization problem given theparameters and decision variables shown in Tables 1 and2 respectively Furthermore since the high amount ofrandomness involved renders the nature of this problemnondeterministic it is quite difficult to formulate this prob-lem purely through mathematics To explain the nondeter-ministic nature the following example is used considering

two adversaries with the same attack strategy since theproblem is nondeterministic the consequences can be totallydifferent One may be distracted by a honeypot and the othermay successfully achieve the goal This feature dramaticallyexpands the width in survivability studies Further the sce-nario considered in this work gives the defender the averagesurvivability analysis of a network

There are three major reasons that an average surviv-ability analysis is more meaningful for the defender Firstin the real world there are only few adversaries holdingldquocompleterdquo information regarding the target network Thiskind of ldquoworst caserdquo rarely happen Secondly analyzing theworst case though gives a defender the lower bound of net-work survivability Nevertheless it overestimates the budgetrequired for defending a network An average survivabilityanalysis makes conclusions closer to reality Last but not theleast in average case analysis if the defenderwants to evaluatethe survivability when facing a stronger adversary it canbe achieved by simply tuning the parameter Average caseanalysis is flexible and adjustable according to the demandof a defender

Thus to well describe the problem some verbal notationsand constraints are included which are shown in Table 3

Objective function

min997888119863119894

sum119894isin119878

[120572119894times sum119865119894

119895=1119879119894119895

(997888119863119894997888997888119860119894119895)]

sum119894isin119878

(120572119894times 119865119894)

(IP 1)

subject tomathematical constraints

997888119863119894isin 119864 forall119894 isin 119878 (IP 11)

997888997888119860119894119895

isin 119885 forall119894 isin 119878 1 le 119895 le 119865119894 (IP 12)

119902119894119895

ge 0 forall119894 119895 isin 119873 (IP 13)

119909119894+ 119910119895

ge 1 forall119894 119895 isin 119867 (IP 14)

119888119894ge 120582 forall119894 isin 119885 (IP 15)

119861NL + 119861proactive + 119861reactive le 119861 (IP 16)

119861virtualized + 119861honeypot + 119861reconfig le 119861reactive (IP 17)

Journal of Applied Mathematics 7

119908 times 119890 + 119900 times 119862 +

sum119894isin119873

sum119895isin119873

119892 (119902119894119895)

2le 119861NL (IP 18)

sum

119894isin119873

119899119894le 119861proactive (IP 19)

sum

119894isin119872

V (119897119894) + 119901 times sum

119894isin119872

119897119894times 119896119894le 119861virtualized (IP 110)

sum

119894isin119875

119909119894times ℎ (120575

119894 120576119894) + sum

119895isin119876

119910119895

times 119891 (120575119895 120579119895)

+ sum

119894isin119873

sum

119895isin119873

119909119894times 119910119895

times 119905 (120575119894 120576119894 120579119895) le 119861honeypot

(IP 111)

sum

119894isin119873

119911119894times 119903 le 119861reconfig (IP 112)

119908 times 119890 ge 0 (IP 113)

119892 (119902119894119895) ge 0 forall119894 119895 isin 119873 (IP 114)

119899119894ge 0 forall119894 isin 119873 (IP 115)

V (119897119894) ge 0 forall119894 isin 119872 (IP 116)

ℎ (120575119894 120576119894) ge 0 forall119894 isin 119875 (IP 117)

119891 (120575119895 120579119895) ge 0 forall119895 isin 119876 (IP 118)

119905 (120575119894 120576119894 120579119895) ge 0 forall119894 isin 119873 (IP 119)

119909119894= 0 or 1 forall119894 isin 119873 (IP 120)

119910119894= 0 or 1 forall119894 isin 119873 (IP 121)

119911119894= 0 or 1 forall119894 isin 119873 (IP 122)

verbal constraints

int119884

119910=1[119882 (119866core119894 119880link119895 119870effect 119868effect 119869effect 119874tocore)] 119889119910

119884

ge 119882threshold where 119894 isin 119862 119895 isin 119871

(IP 123)

119882final ge 119882threshold (IP 124)

For each core node when

120573 (120588defense 120591hops 120596degree 119904priority119894

) ge 120573threshold

where 119894 isin 119878

(IP 125)

the defender can activate the reactive defense mechanismsThe goal of the objective function is to minimize the

compromised service probability which is modeled as theweighted total of successful attacks divided by the totalweighted number of attacks The result of an attack is deter-mined by 119879

119894119895(997888119863119894997888997888119860119894119895) For each service the defender con-

structs a defense configuration including defense resource

allocation anddefending strategies to oppose attackers target-ing the service with different attack configurations includingattacker attributes strategies and transition rules Not onlymalicious attacks but also QoS issues are taken into consider-ation

Equation (IP 11) stands for the feasibility of the defenseconfiguration of each service For the attacking side (IP 12)

denotes that the attack configuration should be feasibleEquation (IP 16) denotes that the summation of defenseresources spent should not exceed total budget 119861 Equations(IP 17)sim(IP 119) jointly restrain the budget of each type ofdefense resource individually Equations (IP 120)sim(IP 122)

impose binary restrictions on decision variables Finally(IP 123)sim(IP 125) jointly represent that the performancereduction caused by either malicious attacks or activatingreactive defense mechanisms should not violate the QoSrequirement

3 Numerical Analysis

In this paper a scale-free network is constructed for evalua-tion since this structure is similar to real-world forms suchas the Internet The implementation algorithm is referencedfrom [24]

31 Simulation Environment Table 4 presents the systemexperiment parameters Defender-related parameters areillustrated in Table 5 The unit of budget is dollar Forattackers the parameters are shown in Table 6

The value of each attackerrsquos budget capability and aggres-siveness is governed by a normal distribution with differentlower and upper bounds

32 Numerical Result As mentioned previously the ContestSuccess Function is applied for quantifying vulnerabilityThevalue of contest intensity is classified into two groups scoresgreater than 1 and scores smaller than 1

321 Convergence The first issue to address before con-structing meaningful simulations is convergence In thispaper the convergence of data is considered as numericalstability While the magnitude of data vibrations is withinthe acceptable interval for example 02 the correspondingnumber of simulation times (119872) is set as the number ofevaluations for each attack and defense scenario

For rigorousness in convergence experiments the effectof contest intensity is jointly consideredThree different mag-nitudes are simulated on a 49 node scale-free network Forthe following experiments in this subsection the horizontalaxis represents the evaluation of the number of attacks andthe vertical axis stands for the network system compromisedprobability which is the objective function of the proposedmathematical model

Figures 4 and 5 show the result of 10000 simulations withdifferent contest intensity Here it is clear that the value ofservice compromised probability is unstable In Figures 6 and7 the vibration becomes alleviative but is still not convergentWhen the number of simulations is raised to 100000 as

8 Journal of Applied Mathematics

078

079

08

081

082

083

084

1000 2000 3000 4000 5000 6000 7000 8000 9000 10000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m contest intensity

Figure 4 Convergence test on 119898 lt 1 group for 10000 simulations

075076077078079

08081082083084

1000

4000

7000

1000

013

000

1600

019

000

2200

025

000

2800

031

000

3400

037

000

4000

043

000

4600

049

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 01

m = 03

m = 05

m contest intensity

Figure 5 Convergence test on 119898 gt 1 group for 10000 simulations

shown in Figures 8 and 9 there is a stable trend after 60000among all different values of contest intensity

From Figures 4 to 9 it is clear that the 60000 simulationsare a large enough number to give converging results amongall values of contest intensityTherefore 119872 is set to be 60000

322 Analysis of Key Factors Influencing Service CompromisedProbability Contest intensity has great influence on thenature of network attack and defense However as shown inFigure 10 there is no consistent tendency between contestintensity and service compromised probability The sameconclusions also appear in [8ndash10]

If the effects of contest intensity and attackerrsquos aggressive-ness are jointly considered there are some meaningful andexplainable results

In Figure 11 three value intervals of aggressivenessincluding 01 to 09 (average) 01 to 05 (less aggressive) and05 to 09 (aggressive) are simulated among different values ofcontest intensity It is clear that when both the effect of contestintensity and an attackrsquos aggressiveness are considered thereare consistent trends For aggressive attackers it is more

078

079

08

081

082

083

084

1000

4000

7000

1000

013

000

1600

019

000

2200

025

000

2800

031

000

3400

037

000

4000

043

000

4600

049

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m contest intensity

Figure 6 Convergence test on 119898 lt 1 group for 50000 simulations

075076077078079

08081082

1000

6000

1100

016

000

2100

026

000

3100

036

000

4100

046

000

5100

056

000

6100

066

000

7100

076

000

8100

086

000

9100

096

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 01

m = 03

m = 05

m contest intensity

Figure 7 Convergence test on 119898 gt 1 group for 50000 simulations

advantageous to have higher values of contest intensityAlternatively less aggressive attackers have leverage whenthe value of contest intensity is small However for averageattacks there is no clear tendency

The value of contest intensity is separated into high-valueand low-value groups Here Figure 12 illustrates the variationof service compromised probability in low-level contestintensity groups when facing less aggressive attackers Whilein Figure 12 the objective function value presents a lineardecreasing form Figure 13 demonstrates an exponentiallydecreasing from

Figures 14 and 15 also present a similar phenomenonwhen facing aggressive attackers the variation of servicecompromised probability shows an exponentially increasingtrend for contest intensity belonging to the low-level groupFor the high-level group the tendency is more linear

According to the previous results the key factors influ-encing service compromised probability include contestintensity and attack aggressivenessThese results are summa-rized in Figure 16

Journal of Applied Mathematics 9

075076077078079

08081082083

1000

6000

1100

016

000

2100

026

000

3100

036

000

4100

046

000

5100

056

000

6100

066

000

7100

076

000

8100

086

000

9100

096

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m contest intensity

Figure 8 Convergence test on119898 lt 1 group for 100000 simulations

076

077

078

079

08

081

082

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m = 01

m = 03

m = 05

Aggressiveness = 01sim09

m contest intensity

Figure 9 Convergence test on 119898 gt 1 group for 100000 simula-tions

4 Discussion of Results

Based on the simulation results some interesting and mean-ingful arguments are presented in this section

41 The Effectiveness of Resources Invested by the Defenderand Attackers Is Highly Dependent on the Nature of BattleThe objective function value shown in Figure 12 presents alinear decreasing form when the contest intensity belongsto a low-level group and the defender is dealing with lessaggressive attackers The reason is that the effectiveness ofresources invested by both players is insignificant Thus theservice compromised probability is less sensitive with contestintensity under ldquofight to win or dierdquo circumstances

Furthermore less aggressive attackers only invest fewresources into compromising a target With the same totalbudget they are capable of launching more attacks thanaggressive attackers Therefore the service compromisedprobability of less aggressive attackers is much higher thanmore aggressive attackers

00102030405

06

07

0809

1

Contest intensity m

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15 m = 17 m = 19m = 01 m = 03 m = 05

Aggressiveness = 01sim09Aggressiveness = 05sim09Aggressiveness = 01sim05

Figure 10 Service compromised probability under different contestintensity

075076077078079

08081082083084085086087

m = 01

m = 03

m = 05

Aggressiveness = 01sim05

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 11 Effect of Aggressiveness among Different Contest Inten-sity

In the case of ldquowinner takes allrdquo Figure 13 illustrates anexponentially decreasing trend among service compromisedprobability this is because the effectiveness of resourcesinvested is significant to the result of a battle With a largervalue of contest intensity the vantage of a defender againstless aggressive attackers is more obvious

On the contrary for aggressive attackers there is anexponentially increasing tendency under ldquofight to win ordierdquo circumstances Since the contest intensity serves asthe exponent of the Contest Success Function when thevalue increases the effectiveness of resources invested growsexponentially This is further shown in Figure 14

Nevertheless the exponential tendency does not appearthrough all values of contest intensity For the ldquowinner takesallrdquo circumstance in Figure 15 the increasing rate of service

10 Journal of Applied Mathematics

063064065066067068069

07071072073074075

m = 15

m = 17

m = 19

Aggressiveness = 01sim05

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 12 Service compromised probability of less aggressive at-tacker under 119898 lt 1 circumstance

0

01

02

03

04

05

06

07

m = 01

m = 03

m = 05

Aggressiveness = 05sim09

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 13 Service compromised probability of less aggressive at-tacker under 119898 gt 1 circumstance

085

086

087

088

089

09

m = 15

m = 17

m = 19

Aggressiveness = 05sim09

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 14 Service compromised probability of aggressive attackerunder 119898 lt 1 circumstance

0

02

04

06

08

1

Prob

abili

ty

Contest intensity mm = 15 m = 17 m = 19

m = 01 m = 03 m = 05

Aggressiveness = 01sim05Aggressiveness = 05sim09

Figure 15 Service compromised probability of aggressive attackerunder 119898 gt 1 circumstance

0

02

04

06

08

1

Prob

abili

ty

Contest intensity mm = 15 m = 17 m = 19

m = 01 m = 03 m = 05

Aggressiveness = 01sim05Aggressiveness = 05sim09

Figure 16 Comparison of service compromised probability underdiverse contest intensity and aggressiveness

compromised probability slows down when contest intensitybecomes higherThis is because although aggressive attackersprefer to gain an edge by spending more attack resourcesto compromise a target each compromise costs significantresources Thus aggressive attackers run out of budget veryquickly and the increasing trend is not exponential

42 Proactive Defense Is Advantageous under ldquoWinner TakesAllrdquo Circumstance According to previous discussions theeffectiveness of resources invested is significant under ldquowin-ner takes allrdquo circumstances For less aggressive attackers theperformance is poor since they only invest few resources onan attack Aggressive attackers tend to spend a larger quantityto compromise a target If a defender raises the quantity ofdefense resources on important nodes it effectively weakensattackers

Consequently regardless of whether defenders face eitheraggressive or less aggressive attackers a proactive defenseperforms better in deterring attackers

43 Reactive Defense Is Advantageous under ldquoFight to Winor Dierdquo Circumstance Similarly under the ldquofight to win

Journal of Applied Mathematics 11

or dierdquo circumstance the effectiveness of defense resourcesis insignificant No matter how many proactive defenseresources are invested there is only limited influence onthe objective function value In other words less aggressiveattackers can compromise a target even by only investingscarce attack resources For aggressive attackers since theyprefer spending a large quantity of resources on compromis-ing a victim they easily run out of resources before a targetservice is compromised

Based on this analysis it is advantageous for the defenderto apply reactive defense mechanisms against maliciousattackers under ldquofight to win or dierdquo circumstance

5 Conclusions

This paper models an attack and defense scenario thatinvolves high amounts of randomness as mathematical for-mulations where attackers are assumed to have incompleteinformation It further considers a virtualization environ-ment for helping relate these results to recent trends in cloudcomputing

According to the simulation results the outcome of acontest is influenced not only by the quantity of defenseresources invested on each node but also by the contestintensity An attackerrsquos aggressiveness is introduced as a newdimension and meaningful results are discovered Effectivedefense strategies are proposed in the discussion of theresults

For future works collaborative attacks should be takeninto consideration since the attack strategy discussed in thispaper is for individual attacks In other words there is onlyone attack targeting a victimrsquos network at a time Thus nosynergy is considered A more complicated collaborativeattack pattern is worth further study

Acknowledgment

This work was supported by the National Science CouncilTaiwan (Grant nos NSC 102-2221-E-002-104 and NSC 101-2218-E-011-009)

References

[1] IBM Internet Security Systems X-Force research and devel-opment team ldquoIBM X-Force 2010 Mid-Year Trend and RiskReportrdquo IBM August 2010

[2] R J Ellison D A Fisher R C Linger H F Lipson T Longstaffand N R Mead ldquoSurvivable network systems an emergingdisciplinerdquo Tech Rep CMUSEI-97-TR-013 1997

[3] S Roy C Ellis S Shiva D Dasgupta V Shandilya and Q WuldquoA survey of game theory as applied to network securityrdquo inProceedings of the 43rd Annual Hawaii International Conferenceon System Sciences (HICSS rsquo10) January 2010

[4] M N Lima A L D Santos and G Pujolle ldquoA survey of sur-vivability in mobile Ad hoc Networksrdquo IEEE CommunicationsSurveys and Tutorials vol 11 no 1 pp 66ndash77 2009

[5] Z Ma ldquoTowards a unified definition for reliability survivabilityand resilience (I) the conceptual framework inspired by thehandicap principle and ecological stabilityrdquo in Proceedings of theIEEE Aerospace Conference pp 1ndash12 March 2010

[6] F Xing and W Wang ldquoOn the survivability of wireless adHOC networks with node misbehaviors and failuresrdquo IEEETransactions on Dependable and Secure Computing vol 7 no3 pp 284ndash299 2010

[7] S Skaperdas ldquoContest success functionsrdquo EconomicTheory vol7 no 2 pp 283ndash290 1996

[8] G Levitin and K Hausken ldquoFalse targets efficiency in defensestrategyrdquo European Journal of Operational Research vol 194 no1 pp 155ndash162 2009

[9] K Hausken and G Levitin ldquoProtection vs false targets in seriessystemsrdquo Reliability Engineering and System Safety vol 94 no5 pp 973ndash981 2009

[10] G Levitin and K Hausken ldquoPreventive strike vs false targetsand protection in defense strategyrdquo Reliability Engineering andSystem Safety vol 96 no 8 pp 912ndash924 2011

[11] J Hirshleifer ldquoConflict and rent-seeking success functions ratiovs difference models of relative successrdquo Public Choice vol 63no 2 pp 101ndash112 1989

[12] J Hirshleifer ldquoThe paradox of powerrdquo Economics and Politicsvol 3 pp 177ndash200 1993

[13] J Archer A Boehme D Cullinane P Kurtz N Puhlmannand J Reavis ldquoTop Threats to Cloud Computing V 10rdquo CloudSecurity Alliance March 2010

[14] H Debar F Pouget and M Dacier ldquoWhite paper lsquoHoney-pot Honeynet Honeytoken Terminological issuesrsquordquo InstitutEurecom Research Report RR-03-081 2003

[15] B Cheswick ldquoAn evening with berferd in which a cracker islured endured and studiedrdquo in Proceedings of the USENIXConference pp 163ndash174 USENIX 1992

[16] C Seifert I Welch and P Komisarczuk ldquoTaxonomy of honey-potsrdquo Tech Rep CS-TR-0612 2006

[17] M H y Lopez and C F L Resendez ldquoHoneypots basicconcepts classification and educational use as resources ininformation security education and coursesrdquo in Proceedings ofthe Informing Science and IT Education Conference 2008

[18] Y Huang D Arsenault and A Sood ldquoClosing cluster attackwindows through server redundancy and rotationsrdquo in Pro-ceedings of the 6th IEEE International Symposium on ClusterComputing and the Grid (CCGRID rsquo06) May 2006

[19] YHuang D Arsenault andA Sood ldquoIncorruptible self-cleans-ing intrusion tolerance and its application to DNS securityrdquoJournal of Networks vol 1 no 5 pp 21ndash30 2006

[20] M Smith C Schridde and B Freisleben ldquoSecuring stateful gridservers through virtual server rotationrdquo in Proceedings of the17th International Symposium on High Performance DistributedComputing (HPDC rsquo08) pp 11ndash22 June 2008

[21] F Y-S Lin Y-S Wang and P-H Tsang ldquoEfficient defensestrategies to minimize attackersrsquo success probabilities in hon-eynetrdquo in Proceedings of the 6th International Conference onInformation Assurance and Security (IAS rsquo10) pp 80ndash85 August2010

[22] F Y-S Lin Y-S Wang P-H Tsang and J-P Lo ldquoRedundancyand defense resource allocation algorithms to assure servicecontinuity against natural disasters and intelligent attacksrdquo inProceedings of the 5th International Conference on BroadbandWireless Computing Communication andApplications (BWCCArsquo10) pp 206ndash213 November 2010

[23] F Cohen ldquoManaging network security attack and defencestrategiesrdquo Network Security vol 1999 no 7 pp 7ndash11 1999

[24] S Nagaraja and R Anderson ldquoDynamic topologies for robustscale-free networksrdquo Bio-Inspired Computing and Communica-tion vol 5151 pp 411ndash426 2008

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

2 Journal of Applied Mathematics

Table 1 Given parameters

Notation Description119873 The index set of all nodes119862 The index set of all core nodes119871 The index set of all links

119872The index set of all levels of virtual machine monitors(VMMs)

119867 The index set of all types of honeypots

119875The index set of candidate nodes equipped with falsetarget function

119876The index set of candidate nodes equipped with faketraffic generating function

119877The index set of candidate nodes equipped with falsetarget and fake traffic generating function

119878 The index set of all kinds of services119861 The defenderrsquos total budget119908 The cost of constructing one intermediate node119900 The cost of constructing one core node119875 The cost of each virtual machine (VM)

119896119894

Themaximum number of virtual machines on VMMlevel 119894 where 119894 isin 119872

120572119894 The weight of 119894th service where 119894 isin 119878

119864All possible defense configurations including resourcesallocation and defending strategies

119885All possible attack configurations including attackerattributes strategies and transition rules

997888997888119860119894119895

An attack configuration including the attributesstrategies and transition rules of the attacker launches119895th attack on 119894th service where 119894 isin 119878 1 le 119895 le 119865

119894

119865119894

The total attacking times on 119894th service for all attackerswhere 119894 isin 119878

120574The cost of constructing a reconfiguration function toone node

120582Theminimum number of hops from core nodeattackers can start to compromise

119888119894

The number of hops from core node category i attackersstarts to compromise where 119894 isin 119885

in this work one is quantified not only by monetary but alsoby time labor and other possible factors As defenders seekout an appropriate defense resource allocation within budgetlimitations and observe the Quality of Service (QoS) require-ment it becomes increasingly important to best determinehow to find a defense mechanism that can detect risky attackbehavior early and mislead attackers to routes distant fromthe server before attackers are at the gates

In this paper we assume that organizations mayencounter a great diversity of threats Whether these threatsare external or internal they can bring about vast loss tofinances and reputation However budgets for securityand training are often inadequate Hence it is much moreimportant for a system or network to enhance robustness inorder to satisfy QoS requirements for service users than toprevent all categories of malicious attacks This symbioticconcept to security is called survivability which is widelydefined and applied in previous works [2ndash6]

Table 2 Decision variables

Notation Description

997888119863119894

A defense configuration including resourceallocation and defending strategies on 119894th servicewhere 119894 isin 119878

119879119894119895(997888119863119894997888997888119860119894119895)

1 if the attacker achieves his goal successfully and0 otherwise where 119894 isin 119878 1 le 119895 le 119865

119894

119899119894

The proactive defense resource allocated to node 119894where 119894 isin 119873

119897119894

The number of VMM level 119894 purchased where119894 isin 119872

120575119894

The number of services that honeypot 119894 cansimulate where 119894 isin 119867

120576119894

The interactive capability of false target honeypot119894 where 119894 isin 119875

120579119894

Themaximum throughput of fake traffic ofhoneypot 119894 where 119894 isin 119876

119881(119897119894)

The cost of VMM level 119894 with 119897119894VMMs where

119894 isin 119872

ℎ(120575119894 120576119894)

The cost of constructing a false target honeypotwhere 119894 isin 119875

119891(120575119894 120579119894)

The cost of constructing a fake traffic generatorhoneypot where 119894 isin 119876

119905(120575119894 120576119894 120579119894)

The cost of constructing a honeypot equippedwith false target and fake traffic functions where119894 isin 119877

119861NL The budget of constructing nodes and links119861proactive The budget of proactive defense resource119861special The budget of reactive defense resource119861virtualized The budget of virtualization119861honeypot The budget of honeypots119861reconfig The budget of reconfiguration functions119890 The total number of intermediate nodes

119902119894119895

The capacity of direct link between nodes 119894 and 119895where 119894 isin 119873 119895 isin 119873

119892(119902119894119895)

The cost of constructing a link from node 119894 tonode 119895 with capacity 119902

119894119895 where 119894 isin 119873 119895 isin 119873

119909119894

1 if node 119894 is equipped with false target functionand 0 otherwise where 119894 isin 119873

119910119894

1 if node 119894 is equipped with fake traffic generatingfunction and 0 otherwise where 119894 isin 119873

119911119894

1 if node 119894 is equipped with reconfigurationfunction and 0 otherwise where 119894 isin 119873

Survivability is a typical metric that measures networkperformance under intentional attacks or other failures Tra-ditionally network security status is divided into two discretetypes compromised and safe Typically when providingservices the evaluation criterion is the quality of servicebut applying this dichotomy of compromise and safetyignores the intermediate status For instance while underan attack the performance level of each service continuallydeclines Therefore network status should be represented ina continuous form [2] Hence in this paper survivability ischosen as themetric for describing network status Accordingto [2] survivability is defined as ldquoThe capability of a systemto fulfill its mission in a timely manner in the presence of

Journal of Applied Mathematics 3

Table 3 Verbal notations

Notation Description119866core119894 Loading of each residual core node 119894 where 119894 isin 119862

119880link119894 Link utilization of each link 119894 where 119894 isin 119871

119870effectNegative effect caused by applying fake trafficadjustment

119868effectNegative effect caused by applying dynamictopology reconfiguration

119869effect Negative effect caused by applying local defense

119874tocoreThe number of hops legitimate users experiencedfrom one boundary node to core nodes

119884 The total compromise events119882threshold The predefined threshold about QoS119882final The QoS level at the end of attack

119882(sdot)The value of QoS determined by 119866core119894 119880link119895 119870effect 119868effect 119869effect and 119874tocore where 119894 isin 119862 119895 isin 119871

120588defense119894

The total defense resource of the shortest pathfrom compromised nodes detected to core node 119894

divided by total defense resource where 119894 isin 119862

120591hops119894

The number of hops from compromised nodesdetected to core node 119894 divided by the number ofhops from attackerrsquos starting point where 119894 isin 119862

120596degree119894

The linking number of core node 119894 divided by themaximum number in the topology where 119894 isin 119862

119904119894

priority119895

The priority of service 119895 provided by core node 119894

divided by the maximum service priority in thetopology where 119894 isin 119878 119895 isin 119862

120573threshold The risk threshold of core nodes

120573(sdot)

The risk status of each core node which is theaggregation of defense resource number of hopslink degree and service priority

Table 4 Environment Parameters

Testing platformProgramming language CCompiler GNU GCC 462Total evaluation times 60000Distributions applied to describe attackersrsquoattributes Normal distribution

attacks failure or accidents including networks and large-scale systems of systemsrdquo

Along with the concept of survivability the vulnerabilityof each node is determined by the Contest Success Function(CSF) which is also applied in [7ndash10] CSF originates fromthe economic rent seeking problem found in EconomicTheory This method also applies a continuous approach tothe problem The form of the CSF is success probability =

119879119898

(119879119898

+ 119905119898

) when applied to attack and defense scenarioswhere 119879 represents the resources invested by the attacker and119905 stands for resources deployed by the defender Further 119898

is known as contest intensity which illustrates the nature ofthe battle while success probability is the probability of anode being compromised When the value 119898 is between 0and 1 it represents ldquofight to win or dierdquo circumstance [11]

Table 5 Parameters for defender

Parameters ValueTopology type Scale-free networkNumber of nodes 49Number of core nodes (each service) 6 (1 2 3)Number of terminal nodes 5Number of services 3Weight of each service 1 2 3Number of users 30Defender total budget 1700000Topology construction budget 700000Proactive defense budget 400000Reactive defense budget 600000

Table 6 Parameters for attacker

Parameters Value

Total attack budget A normal distribution with lower bound300000 and upper bound 1500000

Capability A normal distribution with lower bound120576 and upper bound 1

Aggressiveness A normal distribution with lower bound01 and upper bound 09

Attackerrsquos objective Service disruption or steal confidentialinformation

which means the effectiveness of resources is insignificantFor 119898 ge 1 the effectiveness of resources invested by bothsides is exponentially increasing If 119898 closes to infin it standsfor a ldquowinner takes allrdquo circumstance significant advantage isgranted to the stronger side even if that side is stronger byonly one invested resource [12]

There are many popular methodologies applied for solv-ing survivability problems In recent years game theory is awidely used one Nevertheless in [3] the authors point outthat this solution approach is limited for deterministic sce-narios Even the emerging branch of game theory stochasticgame is still confined with this assumption that all valuesof probabilistic variables have to be determined before theattack and defense starts This feature has a negative effecton creating cyber attack and defense scenario since in realworld decisions made during attack and defense dependon current status Given all values of variables makes thescenario far from reality

For example when choosing a victim from candidatenodes an attacker should apply information like the loadingof each node traffic amount on each link andor number ofusers on each node to evaluate the importance of all candi-dates Then choosing the most appropriate one as the targetyet the restriction of game theory enforces the choosingprobability which should be determined at the beginning ofthe cyber warfare In other words those variations happenedduring attack and defense like traffic reroute link statusnode conditions are ignored Consequently in this workMonte Carlo simulation is applied to consider hopefully andcover every angle in the attack and defense scenario

4 Journal of Applied Mathematics

2 Problem Formulation

21 Problem Description In order to improve system sur-vivability the defender deploys both proactive and reactivedefense resources to confront different attacks Proactivedefense resources are deployed before an attack is launchedIn this paper proactive resources include a firewall systemantivirus software detection techniques such as IntrusionDetection System (IDS) and Intrusion Protection System(IPS)

Alternatively reactive defense resources are activatedduring an attack as an immediate action for the defenderThe mechanisms considered in this paper can strengthendefenses provide deception and provide resource concentra-tion

For strengthening defenses since the scenario consideredin this paper is constructed in a virtualized environment anumber of Virtual Machines (VMs) are governed by a Vir-tual Machine Monitor (VMM) that controls all informationdetails for all VMs When an attack event is detected localdefense functions for each VMM are activated automaticallyto raise the defense capability of the virtualized nodes belong-ing to the same VMM However this mechanism does notalways create positive effects Once an attacker determinesthat the target network is a virtualized environment anddiscovers the existence of a VMM he can compromise theVMM through vulnerabilities in APIs [13] If the VMMis compromised all VMs belonging to this VMM are alsocompromised

Deceptionmechanisms are widely applied in defense andin this paper honeypots are considered to distract attackersAccording to [14ndash17] honeypots not only serve as a passivedecoy fooling attackers into believing they have achievedtheir goal and preemptively terminating the attack but alsoas an active lure that acts as a service-providing node toattract attackers The former is known as a false target andthe latter can be implemented by a fake core node thatspreads service-like traffic to attract attackers When facingdifferent attackers the deceiving probability of each honeypotis differentThis probability is jointly determined by attackersrsquocapability and the interaction level of a honeypot

As for resource concentration by modifying the con-cept of ldquorotationrdquo discussed in [18ndash20] and adapting it toour scenario the defender can adopt dynamic responsivestrategies to improve system survivability Hence whileunder an attack the defender can apply dynamic topologyreconfiguration to exchange the neighbor of one core nodewhich has the strongest defensive resources with a node thatis close to the attackerrsquos current location

However since dynamic topology reconfigurationrequires node rotation it negatively impacts QoS Thereforeunless the risk level of a core node exceeds a predefinedthreshold the defender will not activate this mechanismFurthermore false positive and false negative situations forevery defense mechanism are considered

In addition to the defense mechanisms described abovethe following attributes are also considered for creating arealistic attack-defense scenario

211 Goal Generally attackers target a network to eitherdisrupt services or to compromise servers and steal sensitiveinformation Therefore in this paper an attackerrsquos goal maybe service disruption or the theft of confidential informationService disruption is achieved by ensuring that the minimallevel of service quality is not fulfilled In the case of infor-mation theft attackers usually establish their target beforelaunching an attack and once core nodes with the desiredinformation are compromised the defenders lose

212 Budget Budget stands for the primary resources for anattack including money manpower computing effort timeand other important factors Without sacrificing generalityan attackersrsquo budget follows a general distribution Whendetermining the result of a compromising event for exampleone attacker invests a certain amount of attack resources oncompromising the target node and the CSF is applied todecide the compromised probability In contrast with [21] and[22] if an attacker invests more resources than the defenderon a given target node it is not guaranteed that the attackerwins it only raises the compromised probability

213 Capability This criterion depicts an attackersrsquo profi-ciency and is also described by a general distribution Forhighly proficient attackers there is a high probability thatthey will see through reactive defense mechanisms such ashoneypots

214 Attack Type In general a malicious attacker launchesan attack from one of the boundary nodes which is com-monly considered an external attack In contrast otherattacks can be launched by malicious insiders and causemore severe consequences [13] Malicious insiders are ableto choose an internal node as their starting position forcompromising the network

In the real world external attackers may apply socialengineering to escalate their access privileges This mecha-nism allows the attacker to bypass some proactive defensefacilitates like a firewall As a result attackers have an edgeon compromising the network

In order to best mimic real-world conditions all attacktypes discussed above are considered in this paper

215 Aggressiveness This metric describes the preferredcompromised probability of an attacker when attacking atarget node This attribute is highly dependent on budgetsince the compromised probability is the left-hand side of theCSF In other words the attack resources required for com-promising a target node are calculated by the given defenseresources contest intensity (119898) and attackerrsquos aggressivenessHighly aggressive attackers prefer a high success probabilityand like to spend a larger amount of resources to compromisethe target node than less aggressive attackers An attackerrsquosaggressiveness is determined by a general distribution

216 NextHop SelectionCriterion In this paper the attackersare assumed to have incomplete information and imperfectknowledge Since they can only gather local information

Journal of Applied Mathematics 5

(1) Attackers only have incomplete information(2) The defender only has incomplete information regarding the network since there are unaware vulnerabilities(3) A service is provided by multiple core nodes(4) Each service has different weights(5) One virtual machine only provides one service(6) Only malicious nodal attacks are considered(7) The compromise probability of a target node is determined by the Contest Success Function (CSF)

Box 1 Problem assumptions

such as the defense level of one hop neighbors link trafficor link utilization attackers must use available informationwisely to choose a proper strategy to select the next victimInspired by the seminal work of [23] possible attack strategiesmay be developed based on the quantity of proactive defenseresources link utilization or a portion of the target servicetraffic of each candidate node Additionally this paper alsoconsiders a more irrational strategy of a blind attack

By applying general distributions to describe attacker-related attributes the total number of attacker categories isnearly infinite This feature increases the generalizability ofour model The detailed assumptions are described in Box 1

To describe the attack procedures in more detail wedevelop the following idea to explain the interaction betweenthe defender and attackers The following figures are drawnfrom the attackerrsquos view for clarity In other words all figuresare a logical topology that has been already virtualizedsince one physical machine may represent many VMs Theexplanations of components are listed in Figure 1

First the defender deploys proactive defense resource oneach node and the attacker starts to compromise the networkfrom the edge nodes (119878) Before launching an attack theattacker probes all the candidate nodes to gather sufficientinformation and determine the next hop selection criterionfor this compromise event By applying the next hop selectioncriterion the victim is chosen The result of this compromiseevent is determined by the CSF If the target is compromisedit becomes a spring board for attackers to assault otheruncompromised neighbors Corresponding information isshown in Figure 2 The topology demonstrated in Figures 2and 3 for presentation purposes the topology structureimplemented in the simulations is a scale-free network

The risk level of each core node is evaluated by minimumdefense resources the number of hops the link degree andservice priority Minimum defense resource stands for theshortest path from compromised nodes to one core nodedivided by total defense resources The number of hops isdetermined by the minimum number of hops from com-promised nodes to one core node divided by the maximumnumber of hops from the attackersrsquo starting point to one corenode Link degree is the linking number of each core nodedivided by the maximum linking number in the topologyService priority is the weight of the service that is providedby the target core node divided by the highest weight ofservice in the topology If any of the core nodes is in dangerthe defender can activate defense mechanisms such as afake traffic generator and a dynamic topology reconfigurationunder QoS limitations

S

Reconfiguration

Reconfiguration

Reconfiguration

VM

Reconfiguration

VM

Figure 1 Explanations of Components

Reconfiguration

VMReconfiguration iiiiiiionnoooooooooonnnooooonnn

S

Reconfiguration

Reconfiguration

VM

Figure 2 Sample network and resource allocation scheme

When the defender activates a dynamic topology recon-figuration only nodes implemented with the reconfigurationfunction are considered First the defender chooses theleast proactively defended neighbor with the reconfigurationfunction of a risky core node The defender then selectsanother node that is both not a neighbor of the core nodeand the most proactively defended nearby the node selectedfrom the previous step If there is a fake traffic generatinghoneypot the defender is also able to activate the mechanismfor influencing an attackerrsquos next hop selecting criterion

In the event that attackers attack the virtualized nodesand this malicious event is detected by the defender the local

6 Journal of Applied Mathematics

Given(1) all possible defense configurations set including defense resource allocation and defending strategies(2) all possible attack configurations set including attacker attributes strategies and selection criterion(3) the total attack times on each serviceObjectiveto minimize the service compromised probability of the target networkSubject to(1) budget constrain for both the defender and attackers(2) the minimum QoS requirement for legitimate usersTo determinethe effective defense strategies to allocate resources

Box 2 Problem description

078

079

08

081

082

083

084

1000 2000 3000 4000 5000 6000 7000 8000 9000 10000

Serv

ice c

ompr

omise

d pr

obab

ility

Evaluation times

m = 01

m = 03

m = 05

m contest intensity

Figure 3 A possible result of an attack and defense scenario

defense mechanism is activated automatically Consequentlythe defense level increases for the attacked node the VMMand the rest of this virtualized group If attackers see that thenode is under a virtualized environment they may continueto compromise the VMM

When a core node is compromised the defender mustevaluate whether the performance level still fulfills theminimum QoS requirement and update the degree of riskregarding each core node If an attacker targets multipleservices once they compromise a false target honeypot andare deceived by it they will change their target to the nextservice Finally if attackers exhaust their budget the attackis terminated and the defender wins the battle One possibleresult is shown in Figure 3 A structural description of theproblem is presented in Box 2

22 Mathematical Formulation The scenario discussed pre-viously is modeled as a minimization problem given theparameters and decision variables shown in Tables 1 and2 respectively Furthermore since the high amount ofrandomness involved renders the nature of this problemnondeterministic it is quite difficult to formulate this prob-lem purely through mathematics To explain the nondeter-ministic nature the following example is used considering

two adversaries with the same attack strategy since theproblem is nondeterministic the consequences can be totallydifferent One may be distracted by a honeypot and the othermay successfully achieve the goal This feature dramaticallyexpands the width in survivability studies Further the sce-nario considered in this work gives the defender the averagesurvivability analysis of a network

There are three major reasons that an average surviv-ability analysis is more meaningful for the defender Firstin the real world there are only few adversaries holdingldquocompleterdquo information regarding the target network Thiskind of ldquoworst caserdquo rarely happen Secondly analyzing theworst case though gives a defender the lower bound of net-work survivability Nevertheless it overestimates the budgetrequired for defending a network An average survivabilityanalysis makes conclusions closer to reality Last but not theleast in average case analysis if the defenderwants to evaluatethe survivability when facing a stronger adversary it canbe achieved by simply tuning the parameter Average caseanalysis is flexible and adjustable according to the demandof a defender

Thus to well describe the problem some verbal notationsand constraints are included which are shown in Table 3

Objective function

min997888119863119894

sum119894isin119878

[120572119894times sum119865119894

119895=1119879119894119895

(997888119863119894997888997888119860119894119895)]

sum119894isin119878

(120572119894times 119865119894)

(IP 1)

subject tomathematical constraints

997888119863119894isin 119864 forall119894 isin 119878 (IP 11)

997888997888119860119894119895

isin 119885 forall119894 isin 119878 1 le 119895 le 119865119894 (IP 12)

119902119894119895

ge 0 forall119894 119895 isin 119873 (IP 13)

119909119894+ 119910119895

ge 1 forall119894 119895 isin 119867 (IP 14)

119888119894ge 120582 forall119894 isin 119885 (IP 15)

119861NL + 119861proactive + 119861reactive le 119861 (IP 16)

119861virtualized + 119861honeypot + 119861reconfig le 119861reactive (IP 17)

Journal of Applied Mathematics 7

119908 times 119890 + 119900 times 119862 +

sum119894isin119873

sum119895isin119873

119892 (119902119894119895)

2le 119861NL (IP 18)

sum

119894isin119873

119899119894le 119861proactive (IP 19)

sum

119894isin119872

V (119897119894) + 119901 times sum

119894isin119872

119897119894times 119896119894le 119861virtualized (IP 110)

sum

119894isin119875

119909119894times ℎ (120575

119894 120576119894) + sum

119895isin119876

119910119895

times 119891 (120575119895 120579119895)

+ sum

119894isin119873

sum

119895isin119873

119909119894times 119910119895

times 119905 (120575119894 120576119894 120579119895) le 119861honeypot

(IP 111)

sum

119894isin119873

119911119894times 119903 le 119861reconfig (IP 112)

119908 times 119890 ge 0 (IP 113)

119892 (119902119894119895) ge 0 forall119894 119895 isin 119873 (IP 114)

119899119894ge 0 forall119894 isin 119873 (IP 115)

V (119897119894) ge 0 forall119894 isin 119872 (IP 116)

ℎ (120575119894 120576119894) ge 0 forall119894 isin 119875 (IP 117)

119891 (120575119895 120579119895) ge 0 forall119895 isin 119876 (IP 118)

119905 (120575119894 120576119894 120579119895) ge 0 forall119894 isin 119873 (IP 119)

119909119894= 0 or 1 forall119894 isin 119873 (IP 120)

119910119894= 0 or 1 forall119894 isin 119873 (IP 121)

119911119894= 0 or 1 forall119894 isin 119873 (IP 122)

verbal constraints

int119884

119910=1[119882 (119866core119894 119880link119895 119870effect 119868effect 119869effect 119874tocore)] 119889119910

119884

ge 119882threshold where 119894 isin 119862 119895 isin 119871

(IP 123)

119882final ge 119882threshold (IP 124)

For each core node when

120573 (120588defense 120591hops 120596degree 119904priority119894

) ge 120573threshold

where 119894 isin 119878

(IP 125)

the defender can activate the reactive defense mechanismsThe goal of the objective function is to minimize the

compromised service probability which is modeled as theweighted total of successful attacks divided by the totalweighted number of attacks The result of an attack is deter-mined by 119879

119894119895(997888119863119894997888997888119860119894119895) For each service the defender con-

structs a defense configuration including defense resource

allocation anddefending strategies to oppose attackers target-ing the service with different attack configurations includingattacker attributes strategies and transition rules Not onlymalicious attacks but also QoS issues are taken into consider-ation

Equation (IP 11) stands for the feasibility of the defenseconfiguration of each service For the attacking side (IP 12)

denotes that the attack configuration should be feasibleEquation (IP 16) denotes that the summation of defenseresources spent should not exceed total budget 119861 Equations(IP 17)sim(IP 119) jointly restrain the budget of each type ofdefense resource individually Equations (IP 120)sim(IP 122)

impose binary restrictions on decision variables Finally(IP 123)sim(IP 125) jointly represent that the performancereduction caused by either malicious attacks or activatingreactive defense mechanisms should not violate the QoSrequirement

3 Numerical Analysis

In this paper a scale-free network is constructed for evalua-tion since this structure is similar to real-world forms suchas the Internet The implementation algorithm is referencedfrom [24]

31 Simulation Environment Table 4 presents the systemexperiment parameters Defender-related parameters areillustrated in Table 5 The unit of budget is dollar Forattackers the parameters are shown in Table 6

The value of each attackerrsquos budget capability and aggres-siveness is governed by a normal distribution with differentlower and upper bounds

32 Numerical Result As mentioned previously the ContestSuccess Function is applied for quantifying vulnerabilityThevalue of contest intensity is classified into two groups scoresgreater than 1 and scores smaller than 1

321 Convergence The first issue to address before con-structing meaningful simulations is convergence In thispaper the convergence of data is considered as numericalstability While the magnitude of data vibrations is withinthe acceptable interval for example 02 the correspondingnumber of simulation times (119872) is set as the number ofevaluations for each attack and defense scenario

For rigorousness in convergence experiments the effectof contest intensity is jointly consideredThree different mag-nitudes are simulated on a 49 node scale-free network Forthe following experiments in this subsection the horizontalaxis represents the evaluation of the number of attacks andthe vertical axis stands for the network system compromisedprobability which is the objective function of the proposedmathematical model

Figures 4 and 5 show the result of 10000 simulations withdifferent contest intensity Here it is clear that the value ofservice compromised probability is unstable In Figures 6 and7 the vibration becomes alleviative but is still not convergentWhen the number of simulations is raised to 100000 as

8 Journal of Applied Mathematics

078

079

08

081

082

083

084

1000 2000 3000 4000 5000 6000 7000 8000 9000 10000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m contest intensity

Figure 4 Convergence test on 119898 lt 1 group for 10000 simulations

075076077078079

08081082083084

1000

4000

7000

1000

013

000

1600

019

000

2200

025

000

2800

031

000

3400

037

000

4000

043

000

4600

049

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 01

m = 03

m = 05

m contest intensity

Figure 5 Convergence test on 119898 gt 1 group for 10000 simulations

shown in Figures 8 and 9 there is a stable trend after 60000among all different values of contest intensity

From Figures 4 to 9 it is clear that the 60000 simulationsare a large enough number to give converging results amongall values of contest intensityTherefore 119872 is set to be 60000

322 Analysis of Key Factors Influencing Service CompromisedProbability Contest intensity has great influence on thenature of network attack and defense However as shown inFigure 10 there is no consistent tendency between contestintensity and service compromised probability The sameconclusions also appear in [8ndash10]

If the effects of contest intensity and attackerrsquos aggressive-ness are jointly considered there are some meaningful andexplainable results

In Figure 11 three value intervals of aggressivenessincluding 01 to 09 (average) 01 to 05 (less aggressive) and05 to 09 (aggressive) are simulated among different values ofcontest intensity It is clear that when both the effect of contestintensity and an attackrsquos aggressiveness are considered thereare consistent trends For aggressive attackers it is more

078

079

08

081

082

083

084

1000

4000

7000

1000

013

000

1600

019

000

2200

025

000

2800

031

000

3400

037

000

4000

043

000

4600

049

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m contest intensity

Figure 6 Convergence test on 119898 lt 1 group for 50000 simulations

075076077078079

08081082

1000

6000

1100

016

000

2100

026

000

3100

036

000

4100

046

000

5100

056

000

6100

066

000

7100

076

000

8100

086

000

9100

096

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 01

m = 03

m = 05

m contest intensity

Figure 7 Convergence test on 119898 gt 1 group for 50000 simulations

advantageous to have higher values of contest intensityAlternatively less aggressive attackers have leverage whenthe value of contest intensity is small However for averageattacks there is no clear tendency

The value of contest intensity is separated into high-valueand low-value groups Here Figure 12 illustrates the variationof service compromised probability in low-level contestintensity groups when facing less aggressive attackers Whilein Figure 12 the objective function value presents a lineardecreasing form Figure 13 demonstrates an exponentiallydecreasing from

Figures 14 and 15 also present a similar phenomenonwhen facing aggressive attackers the variation of servicecompromised probability shows an exponentially increasingtrend for contest intensity belonging to the low-level groupFor the high-level group the tendency is more linear

According to the previous results the key factors influ-encing service compromised probability include contestintensity and attack aggressivenessThese results are summa-rized in Figure 16

Journal of Applied Mathematics 9

075076077078079

08081082083

1000

6000

1100

016

000

2100

026

000

3100

036

000

4100

046

000

5100

056

000

6100

066

000

7100

076

000

8100

086

000

9100

096

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m contest intensity

Figure 8 Convergence test on119898 lt 1 group for 100000 simulations

076

077

078

079

08

081

082

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m = 01

m = 03

m = 05

Aggressiveness = 01sim09

m contest intensity

Figure 9 Convergence test on 119898 gt 1 group for 100000 simula-tions

4 Discussion of Results

Based on the simulation results some interesting and mean-ingful arguments are presented in this section

41 The Effectiveness of Resources Invested by the Defenderand Attackers Is Highly Dependent on the Nature of BattleThe objective function value shown in Figure 12 presents alinear decreasing form when the contest intensity belongsto a low-level group and the defender is dealing with lessaggressive attackers The reason is that the effectiveness ofresources invested by both players is insignificant Thus theservice compromised probability is less sensitive with contestintensity under ldquofight to win or dierdquo circumstances

Furthermore less aggressive attackers only invest fewresources into compromising a target With the same totalbudget they are capable of launching more attacks thanaggressive attackers Therefore the service compromisedprobability of less aggressive attackers is much higher thanmore aggressive attackers

00102030405

06

07

0809

1

Contest intensity m

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15 m = 17 m = 19m = 01 m = 03 m = 05

Aggressiveness = 01sim09Aggressiveness = 05sim09Aggressiveness = 01sim05

Figure 10 Service compromised probability under different contestintensity

075076077078079

08081082083084085086087

m = 01

m = 03

m = 05

Aggressiveness = 01sim05

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 11 Effect of Aggressiveness among Different Contest Inten-sity

In the case of ldquowinner takes allrdquo Figure 13 illustrates anexponentially decreasing trend among service compromisedprobability this is because the effectiveness of resourcesinvested is significant to the result of a battle With a largervalue of contest intensity the vantage of a defender againstless aggressive attackers is more obvious

On the contrary for aggressive attackers there is anexponentially increasing tendency under ldquofight to win ordierdquo circumstances Since the contest intensity serves asthe exponent of the Contest Success Function when thevalue increases the effectiveness of resources invested growsexponentially This is further shown in Figure 14

Nevertheless the exponential tendency does not appearthrough all values of contest intensity For the ldquowinner takesallrdquo circumstance in Figure 15 the increasing rate of service

10 Journal of Applied Mathematics

063064065066067068069

07071072073074075

m = 15

m = 17

m = 19

Aggressiveness = 01sim05

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 12 Service compromised probability of less aggressive at-tacker under 119898 lt 1 circumstance

0

01

02

03

04

05

06

07

m = 01

m = 03

m = 05

Aggressiveness = 05sim09

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 13 Service compromised probability of less aggressive at-tacker under 119898 gt 1 circumstance

085

086

087

088

089

09

m = 15

m = 17

m = 19

Aggressiveness = 05sim09

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 14 Service compromised probability of aggressive attackerunder 119898 lt 1 circumstance

0

02

04

06

08

1

Prob

abili

ty

Contest intensity mm = 15 m = 17 m = 19

m = 01 m = 03 m = 05

Aggressiveness = 01sim05Aggressiveness = 05sim09

Figure 15 Service compromised probability of aggressive attackerunder 119898 gt 1 circumstance

0

02

04

06

08

1

Prob

abili

ty

Contest intensity mm = 15 m = 17 m = 19

m = 01 m = 03 m = 05

Aggressiveness = 01sim05Aggressiveness = 05sim09

Figure 16 Comparison of service compromised probability underdiverse contest intensity and aggressiveness

compromised probability slows down when contest intensitybecomes higherThis is because although aggressive attackersprefer to gain an edge by spending more attack resourcesto compromise a target each compromise costs significantresources Thus aggressive attackers run out of budget veryquickly and the increasing trend is not exponential

42 Proactive Defense Is Advantageous under ldquoWinner TakesAllrdquo Circumstance According to previous discussions theeffectiveness of resources invested is significant under ldquowin-ner takes allrdquo circumstances For less aggressive attackers theperformance is poor since they only invest few resources onan attack Aggressive attackers tend to spend a larger quantityto compromise a target If a defender raises the quantity ofdefense resources on important nodes it effectively weakensattackers

Consequently regardless of whether defenders face eitheraggressive or less aggressive attackers a proactive defenseperforms better in deterring attackers

43 Reactive Defense Is Advantageous under ldquoFight to Winor Dierdquo Circumstance Similarly under the ldquofight to win

Journal of Applied Mathematics 11

or dierdquo circumstance the effectiveness of defense resourcesis insignificant No matter how many proactive defenseresources are invested there is only limited influence onthe objective function value In other words less aggressiveattackers can compromise a target even by only investingscarce attack resources For aggressive attackers since theyprefer spending a large quantity of resources on compromis-ing a victim they easily run out of resources before a targetservice is compromised

Based on this analysis it is advantageous for the defenderto apply reactive defense mechanisms against maliciousattackers under ldquofight to win or dierdquo circumstance

5 Conclusions

This paper models an attack and defense scenario thatinvolves high amounts of randomness as mathematical for-mulations where attackers are assumed to have incompleteinformation It further considers a virtualization environ-ment for helping relate these results to recent trends in cloudcomputing

According to the simulation results the outcome of acontest is influenced not only by the quantity of defenseresources invested on each node but also by the contestintensity An attackerrsquos aggressiveness is introduced as a newdimension and meaningful results are discovered Effectivedefense strategies are proposed in the discussion of theresults

For future works collaborative attacks should be takeninto consideration since the attack strategy discussed in thispaper is for individual attacks In other words there is onlyone attack targeting a victimrsquos network at a time Thus nosynergy is considered A more complicated collaborativeattack pattern is worth further study

Acknowledgment

This work was supported by the National Science CouncilTaiwan (Grant nos NSC 102-2221-E-002-104 and NSC 101-2218-E-011-009)

References

[1] IBM Internet Security Systems X-Force research and devel-opment team ldquoIBM X-Force 2010 Mid-Year Trend and RiskReportrdquo IBM August 2010

[2] R J Ellison D A Fisher R C Linger H F Lipson T Longstaffand N R Mead ldquoSurvivable network systems an emergingdisciplinerdquo Tech Rep CMUSEI-97-TR-013 1997

[3] S Roy C Ellis S Shiva D Dasgupta V Shandilya and Q WuldquoA survey of game theory as applied to network securityrdquo inProceedings of the 43rd Annual Hawaii International Conferenceon System Sciences (HICSS rsquo10) January 2010

[4] M N Lima A L D Santos and G Pujolle ldquoA survey of sur-vivability in mobile Ad hoc Networksrdquo IEEE CommunicationsSurveys and Tutorials vol 11 no 1 pp 66ndash77 2009

[5] Z Ma ldquoTowards a unified definition for reliability survivabilityand resilience (I) the conceptual framework inspired by thehandicap principle and ecological stabilityrdquo in Proceedings of theIEEE Aerospace Conference pp 1ndash12 March 2010

[6] F Xing and W Wang ldquoOn the survivability of wireless adHOC networks with node misbehaviors and failuresrdquo IEEETransactions on Dependable and Secure Computing vol 7 no3 pp 284ndash299 2010

[7] S Skaperdas ldquoContest success functionsrdquo EconomicTheory vol7 no 2 pp 283ndash290 1996

[8] G Levitin and K Hausken ldquoFalse targets efficiency in defensestrategyrdquo European Journal of Operational Research vol 194 no1 pp 155ndash162 2009

[9] K Hausken and G Levitin ldquoProtection vs false targets in seriessystemsrdquo Reliability Engineering and System Safety vol 94 no5 pp 973ndash981 2009

[10] G Levitin and K Hausken ldquoPreventive strike vs false targetsand protection in defense strategyrdquo Reliability Engineering andSystem Safety vol 96 no 8 pp 912ndash924 2011

[11] J Hirshleifer ldquoConflict and rent-seeking success functions ratiovs difference models of relative successrdquo Public Choice vol 63no 2 pp 101ndash112 1989

[12] J Hirshleifer ldquoThe paradox of powerrdquo Economics and Politicsvol 3 pp 177ndash200 1993

[13] J Archer A Boehme D Cullinane P Kurtz N Puhlmannand J Reavis ldquoTop Threats to Cloud Computing V 10rdquo CloudSecurity Alliance March 2010

[14] H Debar F Pouget and M Dacier ldquoWhite paper lsquoHoney-pot Honeynet Honeytoken Terminological issuesrsquordquo InstitutEurecom Research Report RR-03-081 2003

[15] B Cheswick ldquoAn evening with berferd in which a cracker islured endured and studiedrdquo in Proceedings of the USENIXConference pp 163ndash174 USENIX 1992

[16] C Seifert I Welch and P Komisarczuk ldquoTaxonomy of honey-potsrdquo Tech Rep CS-TR-0612 2006

[17] M H y Lopez and C F L Resendez ldquoHoneypots basicconcepts classification and educational use as resources ininformation security education and coursesrdquo in Proceedings ofthe Informing Science and IT Education Conference 2008

[18] Y Huang D Arsenault and A Sood ldquoClosing cluster attackwindows through server redundancy and rotationsrdquo in Pro-ceedings of the 6th IEEE International Symposium on ClusterComputing and the Grid (CCGRID rsquo06) May 2006

[19] YHuang D Arsenault andA Sood ldquoIncorruptible self-cleans-ing intrusion tolerance and its application to DNS securityrdquoJournal of Networks vol 1 no 5 pp 21ndash30 2006

[20] M Smith C Schridde and B Freisleben ldquoSecuring stateful gridservers through virtual server rotationrdquo in Proceedings of the17th International Symposium on High Performance DistributedComputing (HPDC rsquo08) pp 11ndash22 June 2008

[21] F Y-S Lin Y-S Wang and P-H Tsang ldquoEfficient defensestrategies to minimize attackersrsquo success probabilities in hon-eynetrdquo in Proceedings of the 6th International Conference onInformation Assurance and Security (IAS rsquo10) pp 80ndash85 August2010

[22] F Y-S Lin Y-S Wang P-H Tsang and J-P Lo ldquoRedundancyand defense resource allocation algorithms to assure servicecontinuity against natural disasters and intelligent attacksrdquo inProceedings of the 5th International Conference on BroadbandWireless Computing Communication andApplications (BWCCArsquo10) pp 206ndash213 November 2010

[23] F Cohen ldquoManaging network security attack and defencestrategiesrdquo Network Security vol 1999 no 7 pp 7ndash11 1999

[24] S Nagaraja and R Anderson ldquoDynamic topologies for robustscale-free networksrdquo Bio-Inspired Computing and Communica-tion vol 5151 pp 411ndash426 2008

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

Journal of Applied Mathematics 3

Table 3 Verbal notations

Notation Description119866core119894 Loading of each residual core node 119894 where 119894 isin 119862

119880link119894 Link utilization of each link 119894 where 119894 isin 119871

119870effectNegative effect caused by applying fake trafficadjustment

119868effectNegative effect caused by applying dynamictopology reconfiguration

119869effect Negative effect caused by applying local defense

119874tocoreThe number of hops legitimate users experiencedfrom one boundary node to core nodes

119884 The total compromise events119882threshold The predefined threshold about QoS119882final The QoS level at the end of attack

119882(sdot)The value of QoS determined by 119866core119894 119880link119895 119870effect 119868effect 119869effect and 119874tocore where 119894 isin 119862 119895 isin 119871

120588defense119894

The total defense resource of the shortest pathfrom compromised nodes detected to core node 119894

divided by total defense resource where 119894 isin 119862

120591hops119894

The number of hops from compromised nodesdetected to core node 119894 divided by the number ofhops from attackerrsquos starting point where 119894 isin 119862

120596degree119894

The linking number of core node 119894 divided by themaximum number in the topology where 119894 isin 119862

119904119894

priority119895

The priority of service 119895 provided by core node 119894

divided by the maximum service priority in thetopology where 119894 isin 119878 119895 isin 119862

120573threshold The risk threshold of core nodes

120573(sdot)

The risk status of each core node which is theaggregation of defense resource number of hopslink degree and service priority

Table 4 Environment Parameters

Testing platformProgramming language CCompiler GNU GCC 462Total evaluation times 60000Distributions applied to describe attackersrsquoattributes Normal distribution

attacks failure or accidents including networks and large-scale systems of systemsrdquo

Along with the concept of survivability the vulnerabilityof each node is determined by the Contest Success Function(CSF) which is also applied in [7ndash10] CSF originates fromthe economic rent seeking problem found in EconomicTheory This method also applies a continuous approach tothe problem The form of the CSF is success probability =

119879119898

(119879119898

+ 119905119898

) when applied to attack and defense scenarioswhere 119879 represents the resources invested by the attacker and119905 stands for resources deployed by the defender Further 119898

is known as contest intensity which illustrates the nature ofthe battle while success probability is the probability of anode being compromised When the value 119898 is between 0and 1 it represents ldquofight to win or dierdquo circumstance [11]

Table 5 Parameters for defender

Parameters ValueTopology type Scale-free networkNumber of nodes 49Number of core nodes (each service) 6 (1 2 3)Number of terminal nodes 5Number of services 3Weight of each service 1 2 3Number of users 30Defender total budget 1700000Topology construction budget 700000Proactive defense budget 400000Reactive defense budget 600000

Table 6 Parameters for attacker

Parameters Value

Total attack budget A normal distribution with lower bound300000 and upper bound 1500000

Capability A normal distribution with lower bound120576 and upper bound 1

Aggressiveness A normal distribution with lower bound01 and upper bound 09

Attackerrsquos objective Service disruption or steal confidentialinformation

which means the effectiveness of resources is insignificantFor 119898 ge 1 the effectiveness of resources invested by bothsides is exponentially increasing If 119898 closes to infin it standsfor a ldquowinner takes allrdquo circumstance significant advantage isgranted to the stronger side even if that side is stronger byonly one invested resource [12]

There are many popular methodologies applied for solv-ing survivability problems In recent years game theory is awidely used one Nevertheless in [3] the authors point outthat this solution approach is limited for deterministic sce-narios Even the emerging branch of game theory stochasticgame is still confined with this assumption that all valuesof probabilistic variables have to be determined before theattack and defense starts This feature has a negative effecton creating cyber attack and defense scenario since in realworld decisions made during attack and defense dependon current status Given all values of variables makes thescenario far from reality

For example when choosing a victim from candidatenodes an attacker should apply information like the loadingof each node traffic amount on each link andor number ofusers on each node to evaluate the importance of all candi-dates Then choosing the most appropriate one as the targetyet the restriction of game theory enforces the choosingprobability which should be determined at the beginning ofthe cyber warfare In other words those variations happenedduring attack and defense like traffic reroute link statusnode conditions are ignored Consequently in this workMonte Carlo simulation is applied to consider hopefully andcover every angle in the attack and defense scenario

4 Journal of Applied Mathematics

2 Problem Formulation

21 Problem Description In order to improve system sur-vivability the defender deploys both proactive and reactivedefense resources to confront different attacks Proactivedefense resources are deployed before an attack is launchedIn this paper proactive resources include a firewall systemantivirus software detection techniques such as IntrusionDetection System (IDS) and Intrusion Protection System(IPS)

Alternatively reactive defense resources are activatedduring an attack as an immediate action for the defenderThe mechanisms considered in this paper can strengthendefenses provide deception and provide resource concentra-tion

For strengthening defenses since the scenario consideredin this paper is constructed in a virtualized environment anumber of Virtual Machines (VMs) are governed by a Vir-tual Machine Monitor (VMM) that controls all informationdetails for all VMs When an attack event is detected localdefense functions for each VMM are activated automaticallyto raise the defense capability of the virtualized nodes belong-ing to the same VMM However this mechanism does notalways create positive effects Once an attacker determinesthat the target network is a virtualized environment anddiscovers the existence of a VMM he can compromise theVMM through vulnerabilities in APIs [13] If the VMMis compromised all VMs belonging to this VMM are alsocompromised

Deceptionmechanisms are widely applied in defense andin this paper honeypots are considered to distract attackersAccording to [14ndash17] honeypots not only serve as a passivedecoy fooling attackers into believing they have achievedtheir goal and preemptively terminating the attack but alsoas an active lure that acts as a service-providing node toattract attackers The former is known as a false target andthe latter can be implemented by a fake core node thatspreads service-like traffic to attract attackers When facingdifferent attackers the deceiving probability of each honeypotis differentThis probability is jointly determined by attackersrsquocapability and the interaction level of a honeypot

As for resource concentration by modifying the con-cept of ldquorotationrdquo discussed in [18ndash20] and adapting it toour scenario the defender can adopt dynamic responsivestrategies to improve system survivability Hence whileunder an attack the defender can apply dynamic topologyreconfiguration to exchange the neighbor of one core nodewhich has the strongest defensive resources with a node thatis close to the attackerrsquos current location

However since dynamic topology reconfigurationrequires node rotation it negatively impacts QoS Thereforeunless the risk level of a core node exceeds a predefinedthreshold the defender will not activate this mechanismFurthermore false positive and false negative situations forevery defense mechanism are considered

In addition to the defense mechanisms described abovethe following attributes are also considered for creating arealistic attack-defense scenario

211 Goal Generally attackers target a network to eitherdisrupt services or to compromise servers and steal sensitiveinformation Therefore in this paper an attackerrsquos goal maybe service disruption or the theft of confidential informationService disruption is achieved by ensuring that the minimallevel of service quality is not fulfilled In the case of infor-mation theft attackers usually establish their target beforelaunching an attack and once core nodes with the desiredinformation are compromised the defenders lose

212 Budget Budget stands for the primary resources for anattack including money manpower computing effort timeand other important factors Without sacrificing generalityan attackersrsquo budget follows a general distribution Whendetermining the result of a compromising event for exampleone attacker invests a certain amount of attack resources oncompromising the target node and the CSF is applied todecide the compromised probability In contrast with [21] and[22] if an attacker invests more resources than the defenderon a given target node it is not guaranteed that the attackerwins it only raises the compromised probability

213 Capability This criterion depicts an attackersrsquo profi-ciency and is also described by a general distribution Forhighly proficient attackers there is a high probability thatthey will see through reactive defense mechanisms such ashoneypots

214 Attack Type In general a malicious attacker launchesan attack from one of the boundary nodes which is com-monly considered an external attack In contrast otherattacks can be launched by malicious insiders and causemore severe consequences [13] Malicious insiders are ableto choose an internal node as their starting position forcompromising the network

In the real world external attackers may apply socialengineering to escalate their access privileges This mecha-nism allows the attacker to bypass some proactive defensefacilitates like a firewall As a result attackers have an edgeon compromising the network

In order to best mimic real-world conditions all attacktypes discussed above are considered in this paper

215 Aggressiveness This metric describes the preferredcompromised probability of an attacker when attacking atarget node This attribute is highly dependent on budgetsince the compromised probability is the left-hand side of theCSF In other words the attack resources required for com-promising a target node are calculated by the given defenseresources contest intensity (119898) and attackerrsquos aggressivenessHighly aggressive attackers prefer a high success probabilityand like to spend a larger amount of resources to compromisethe target node than less aggressive attackers An attackerrsquosaggressiveness is determined by a general distribution

216 NextHop SelectionCriterion In this paper the attackersare assumed to have incomplete information and imperfectknowledge Since they can only gather local information

Journal of Applied Mathematics 5

(1) Attackers only have incomplete information(2) The defender only has incomplete information regarding the network since there are unaware vulnerabilities(3) A service is provided by multiple core nodes(4) Each service has different weights(5) One virtual machine only provides one service(6) Only malicious nodal attacks are considered(7) The compromise probability of a target node is determined by the Contest Success Function (CSF)

Box 1 Problem assumptions

such as the defense level of one hop neighbors link trafficor link utilization attackers must use available informationwisely to choose a proper strategy to select the next victimInspired by the seminal work of [23] possible attack strategiesmay be developed based on the quantity of proactive defenseresources link utilization or a portion of the target servicetraffic of each candidate node Additionally this paper alsoconsiders a more irrational strategy of a blind attack

By applying general distributions to describe attacker-related attributes the total number of attacker categories isnearly infinite This feature increases the generalizability ofour model The detailed assumptions are described in Box 1

To describe the attack procedures in more detail wedevelop the following idea to explain the interaction betweenthe defender and attackers The following figures are drawnfrom the attackerrsquos view for clarity In other words all figuresare a logical topology that has been already virtualizedsince one physical machine may represent many VMs Theexplanations of components are listed in Figure 1

First the defender deploys proactive defense resource oneach node and the attacker starts to compromise the networkfrom the edge nodes (119878) Before launching an attack theattacker probes all the candidate nodes to gather sufficientinformation and determine the next hop selection criterionfor this compromise event By applying the next hop selectioncriterion the victim is chosen The result of this compromiseevent is determined by the CSF If the target is compromisedit becomes a spring board for attackers to assault otheruncompromised neighbors Corresponding information isshown in Figure 2 The topology demonstrated in Figures 2and 3 for presentation purposes the topology structureimplemented in the simulations is a scale-free network

The risk level of each core node is evaluated by minimumdefense resources the number of hops the link degree andservice priority Minimum defense resource stands for theshortest path from compromised nodes to one core nodedivided by total defense resources The number of hops isdetermined by the minimum number of hops from com-promised nodes to one core node divided by the maximumnumber of hops from the attackersrsquo starting point to one corenode Link degree is the linking number of each core nodedivided by the maximum linking number in the topologyService priority is the weight of the service that is providedby the target core node divided by the highest weight ofservice in the topology If any of the core nodes is in dangerthe defender can activate defense mechanisms such as afake traffic generator and a dynamic topology reconfigurationunder QoS limitations

S

Reconfiguration

Reconfiguration

Reconfiguration

VM

Reconfiguration

VM

Figure 1 Explanations of Components

Reconfiguration

VMReconfiguration iiiiiiionnoooooooooonnnooooonnn

S

Reconfiguration

Reconfiguration

VM

Figure 2 Sample network and resource allocation scheme

When the defender activates a dynamic topology recon-figuration only nodes implemented with the reconfigurationfunction are considered First the defender chooses theleast proactively defended neighbor with the reconfigurationfunction of a risky core node The defender then selectsanother node that is both not a neighbor of the core nodeand the most proactively defended nearby the node selectedfrom the previous step If there is a fake traffic generatinghoneypot the defender is also able to activate the mechanismfor influencing an attackerrsquos next hop selecting criterion

In the event that attackers attack the virtualized nodesand this malicious event is detected by the defender the local

6 Journal of Applied Mathematics

Given(1) all possible defense configurations set including defense resource allocation and defending strategies(2) all possible attack configurations set including attacker attributes strategies and selection criterion(3) the total attack times on each serviceObjectiveto minimize the service compromised probability of the target networkSubject to(1) budget constrain for both the defender and attackers(2) the minimum QoS requirement for legitimate usersTo determinethe effective defense strategies to allocate resources

Box 2 Problem description

078

079

08

081

082

083

084

1000 2000 3000 4000 5000 6000 7000 8000 9000 10000

Serv

ice c

ompr

omise

d pr

obab

ility

Evaluation times

m = 01

m = 03

m = 05

m contest intensity

Figure 3 A possible result of an attack and defense scenario

defense mechanism is activated automatically Consequentlythe defense level increases for the attacked node the VMMand the rest of this virtualized group If attackers see that thenode is under a virtualized environment they may continueto compromise the VMM

When a core node is compromised the defender mustevaluate whether the performance level still fulfills theminimum QoS requirement and update the degree of riskregarding each core node If an attacker targets multipleservices once they compromise a false target honeypot andare deceived by it they will change their target to the nextservice Finally if attackers exhaust their budget the attackis terminated and the defender wins the battle One possibleresult is shown in Figure 3 A structural description of theproblem is presented in Box 2

22 Mathematical Formulation The scenario discussed pre-viously is modeled as a minimization problem given theparameters and decision variables shown in Tables 1 and2 respectively Furthermore since the high amount ofrandomness involved renders the nature of this problemnondeterministic it is quite difficult to formulate this prob-lem purely through mathematics To explain the nondeter-ministic nature the following example is used considering

two adversaries with the same attack strategy since theproblem is nondeterministic the consequences can be totallydifferent One may be distracted by a honeypot and the othermay successfully achieve the goal This feature dramaticallyexpands the width in survivability studies Further the sce-nario considered in this work gives the defender the averagesurvivability analysis of a network

There are three major reasons that an average surviv-ability analysis is more meaningful for the defender Firstin the real world there are only few adversaries holdingldquocompleterdquo information regarding the target network Thiskind of ldquoworst caserdquo rarely happen Secondly analyzing theworst case though gives a defender the lower bound of net-work survivability Nevertheless it overestimates the budgetrequired for defending a network An average survivabilityanalysis makes conclusions closer to reality Last but not theleast in average case analysis if the defenderwants to evaluatethe survivability when facing a stronger adversary it canbe achieved by simply tuning the parameter Average caseanalysis is flexible and adjustable according to the demandof a defender

Thus to well describe the problem some verbal notationsand constraints are included which are shown in Table 3

Objective function

min997888119863119894

sum119894isin119878

[120572119894times sum119865119894

119895=1119879119894119895

(997888119863119894997888997888119860119894119895)]

sum119894isin119878

(120572119894times 119865119894)

(IP 1)

subject tomathematical constraints

997888119863119894isin 119864 forall119894 isin 119878 (IP 11)

997888997888119860119894119895

isin 119885 forall119894 isin 119878 1 le 119895 le 119865119894 (IP 12)

119902119894119895

ge 0 forall119894 119895 isin 119873 (IP 13)

119909119894+ 119910119895

ge 1 forall119894 119895 isin 119867 (IP 14)

119888119894ge 120582 forall119894 isin 119885 (IP 15)

119861NL + 119861proactive + 119861reactive le 119861 (IP 16)

119861virtualized + 119861honeypot + 119861reconfig le 119861reactive (IP 17)

Journal of Applied Mathematics 7

119908 times 119890 + 119900 times 119862 +

sum119894isin119873

sum119895isin119873

119892 (119902119894119895)

2le 119861NL (IP 18)

sum

119894isin119873

119899119894le 119861proactive (IP 19)

sum

119894isin119872

V (119897119894) + 119901 times sum

119894isin119872

119897119894times 119896119894le 119861virtualized (IP 110)

sum

119894isin119875

119909119894times ℎ (120575

119894 120576119894) + sum

119895isin119876

119910119895

times 119891 (120575119895 120579119895)

+ sum

119894isin119873

sum

119895isin119873

119909119894times 119910119895

times 119905 (120575119894 120576119894 120579119895) le 119861honeypot

(IP 111)

sum

119894isin119873

119911119894times 119903 le 119861reconfig (IP 112)

119908 times 119890 ge 0 (IP 113)

119892 (119902119894119895) ge 0 forall119894 119895 isin 119873 (IP 114)

119899119894ge 0 forall119894 isin 119873 (IP 115)

V (119897119894) ge 0 forall119894 isin 119872 (IP 116)

ℎ (120575119894 120576119894) ge 0 forall119894 isin 119875 (IP 117)

119891 (120575119895 120579119895) ge 0 forall119895 isin 119876 (IP 118)

119905 (120575119894 120576119894 120579119895) ge 0 forall119894 isin 119873 (IP 119)

119909119894= 0 or 1 forall119894 isin 119873 (IP 120)

119910119894= 0 or 1 forall119894 isin 119873 (IP 121)

119911119894= 0 or 1 forall119894 isin 119873 (IP 122)

verbal constraints

int119884

119910=1[119882 (119866core119894 119880link119895 119870effect 119868effect 119869effect 119874tocore)] 119889119910

119884

ge 119882threshold where 119894 isin 119862 119895 isin 119871

(IP 123)

119882final ge 119882threshold (IP 124)

For each core node when

120573 (120588defense 120591hops 120596degree 119904priority119894

) ge 120573threshold

where 119894 isin 119878

(IP 125)

the defender can activate the reactive defense mechanismsThe goal of the objective function is to minimize the

compromised service probability which is modeled as theweighted total of successful attacks divided by the totalweighted number of attacks The result of an attack is deter-mined by 119879

119894119895(997888119863119894997888997888119860119894119895) For each service the defender con-

structs a defense configuration including defense resource

allocation anddefending strategies to oppose attackers target-ing the service with different attack configurations includingattacker attributes strategies and transition rules Not onlymalicious attacks but also QoS issues are taken into consider-ation

Equation (IP 11) stands for the feasibility of the defenseconfiguration of each service For the attacking side (IP 12)

denotes that the attack configuration should be feasibleEquation (IP 16) denotes that the summation of defenseresources spent should not exceed total budget 119861 Equations(IP 17)sim(IP 119) jointly restrain the budget of each type ofdefense resource individually Equations (IP 120)sim(IP 122)

impose binary restrictions on decision variables Finally(IP 123)sim(IP 125) jointly represent that the performancereduction caused by either malicious attacks or activatingreactive defense mechanisms should not violate the QoSrequirement

3 Numerical Analysis

In this paper a scale-free network is constructed for evalua-tion since this structure is similar to real-world forms suchas the Internet The implementation algorithm is referencedfrom [24]

31 Simulation Environment Table 4 presents the systemexperiment parameters Defender-related parameters areillustrated in Table 5 The unit of budget is dollar Forattackers the parameters are shown in Table 6

The value of each attackerrsquos budget capability and aggres-siveness is governed by a normal distribution with differentlower and upper bounds

32 Numerical Result As mentioned previously the ContestSuccess Function is applied for quantifying vulnerabilityThevalue of contest intensity is classified into two groups scoresgreater than 1 and scores smaller than 1

321 Convergence The first issue to address before con-structing meaningful simulations is convergence In thispaper the convergence of data is considered as numericalstability While the magnitude of data vibrations is withinthe acceptable interval for example 02 the correspondingnumber of simulation times (119872) is set as the number ofevaluations for each attack and defense scenario

For rigorousness in convergence experiments the effectof contest intensity is jointly consideredThree different mag-nitudes are simulated on a 49 node scale-free network Forthe following experiments in this subsection the horizontalaxis represents the evaluation of the number of attacks andthe vertical axis stands for the network system compromisedprobability which is the objective function of the proposedmathematical model

Figures 4 and 5 show the result of 10000 simulations withdifferent contest intensity Here it is clear that the value ofservice compromised probability is unstable In Figures 6 and7 the vibration becomes alleviative but is still not convergentWhen the number of simulations is raised to 100000 as

8 Journal of Applied Mathematics

078

079

08

081

082

083

084

1000 2000 3000 4000 5000 6000 7000 8000 9000 10000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m contest intensity

Figure 4 Convergence test on 119898 lt 1 group for 10000 simulations

075076077078079

08081082083084

1000

4000

7000

1000

013

000

1600

019

000

2200

025

000

2800

031

000

3400

037

000

4000

043

000

4600

049

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 01

m = 03

m = 05

m contest intensity

Figure 5 Convergence test on 119898 gt 1 group for 10000 simulations

shown in Figures 8 and 9 there is a stable trend after 60000among all different values of contest intensity

From Figures 4 to 9 it is clear that the 60000 simulationsare a large enough number to give converging results amongall values of contest intensityTherefore 119872 is set to be 60000

322 Analysis of Key Factors Influencing Service CompromisedProbability Contest intensity has great influence on thenature of network attack and defense However as shown inFigure 10 there is no consistent tendency between contestintensity and service compromised probability The sameconclusions also appear in [8ndash10]

If the effects of contest intensity and attackerrsquos aggressive-ness are jointly considered there are some meaningful andexplainable results

In Figure 11 three value intervals of aggressivenessincluding 01 to 09 (average) 01 to 05 (less aggressive) and05 to 09 (aggressive) are simulated among different values ofcontest intensity It is clear that when both the effect of contestintensity and an attackrsquos aggressiveness are considered thereare consistent trends For aggressive attackers it is more

078

079

08

081

082

083

084

1000

4000

7000

1000

013

000

1600

019

000

2200

025

000

2800

031

000

3400

037

000

4000

043

000

4600

049

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m contest intensity

Figure 6 Convergence test on 119898 lt 1 group for 50000 simulations

075076077078079

08081082

1000

6000

1100

016

000

2100

026

000

3100

036

000

4100

046

000

5100

056

000

6100

066

000

7100

076

000

8100

086

000

9100

096

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 01

m = 03

m = 05

m contest intensity

Figure 7 Convergence test on 119898 gt 1 group for 50000 simulations

advantageous to have higher values of contest intensityAlternatively less aggressive attackers have leverage whenthe value of contest intensity is small However for averageattacks there is no clear tendency

The value of contest intensity is separated into high-valueand low-value groups Here Figure 12 illustrates the variationof service compromised probability in low-level contestintensity groups when facing less aggressive attackers Whilein Figure 12 the objective function value presents a lineardecreasing form Figure 13 demonstrates an exponentiallydecreasing from

Figures 14 and 15 also present a similar phenomenonwhen facing aggressive attackers the variation of servicecompromised probability shows an exponentially increasingtrend for contest intensity belonging to the low-level groupFor the high-level group the tendency is more linear

According to the previous results the key factors influ-encing service compromised probability include contestintensity and attack aggressivenessThese results are summa-rized in Figure 16

Journal of Applied Mathematics 9

075076077078079

08081082083

1000

6000

1100

016

000

2100

026

000

3100

036

000

4100

046

000

5100

056

000

6100

066

000

7100

076

000

8100

086

000

9100

096

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m contest intensity

Figure 8 Convergence test on119898 lt 1 group for 100000 simulations

076

077

078

079

08

081

082

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m = 01

m = 03

m = 05

Aggressiveness = 01sim09

m contest intensity

Figure 9 Convergence test on 119898 gt 1 group for 100000 simula-tions

4 Discussion of Results

Based on the simulation results some interesting and mean-ingful arguments are presented in this section

41 The Effectiveness of Resources Invested by the Defenderand Attackers Is Highly Dependent on the Nature of BattleThe objective function value shown in Figure 12 presents alinear decreasing form when the contest intensity belongsto a low-level group and the defender is dealing with lessaggressive attackers The reason is that the effectiveness ofresources invested by both players is insignificant Thus theservice compromised probability is less sensitive with contestintensity under ldquofight to win or dierdquo circumstances

Furthermore less aggressive attackers only invest fewresources into compromising a target With the same totalbudget they are capable of launching more attacks thanaggressive attackers Therefore the service compromisedprobability of less aggressive attackers is much higher thanmore aggressive attackers

00102030405

06

07

0809

1

Contest intensity m

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15 m = 17 m = 19m = 01 m = 03 m = 05

Aggressiveness = 01sim09Aggressiveness = 05sim09Aggressiveness = 01sim05

Figure 10 Service compromised probability under different contestintensity

075076077078079

08081082083084085086087

m = 01

m = 03

m = 05

Aggressiveness = 01sim05

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 11 Effect of Aggressiveness among Different Contest Inten-sity

In the case of ldquowinner takes allrdquo Figure 13 illustrates anexponentially decreasing trend among service compromisedprobability this is because the effectiveness of resourcesinvested is significant to the result of a battle With a largervalue of contest intensity the vantage of a defender againstless aggressive attackers is more obvious

On the contrary for aggressive attackers there is anexponentially increasing tendency under ldquofight to win ordierdquo circumstances Since the contest intensity serves asthe exponent of the Contest Success Function when thevalue increases the effectiveness of resources invested growsexponentially This is further shown in Figure 14

Nevertheless the exponential tendency does not appearthrough all values of contest intensity For the ldquowinner takesallrdquo circumstance in Figure 15 the increasing rate of service

10 Journal of Applied Mathematics

063064065066067068069

07071072073074075

m = 15

m = 17

m = 19

Aggressiveness = 01sim05

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 12 Service compromised probability of less aggressive at-tacker under 119898 lt 1 circumstance

0

01

02

03

04

05

06

07

m = 01

m = 03

m = 05

Aggressiveness = 05sim09

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 13 Service compromised probability of less aggressive at-tacker under 119898 gt 1 circumstance

085

086

087

088

089

09

m = 15

m = 17

m = 19

Aggressiveness = 05sim09

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 14 Service compromised probability of aggressive attackerunder 119898 lt 1 circumstance

0

02

04

06

08

1

Prob

abili

ty

Contest intensity mm = 15 m = 17 m = 19

m = 01 m = 03 m = 05

Aggressiveness = 01sim05Aggressiveness = 05sim09

Figure 15 Service compromised probability of aggressive attackerunder 119898 gt 1 circumstance

0

02

04

06

08

1

Prob

abili

ty

Contest intensity mm = 15 m = 17 m = 19

m = 01 m = 03 m = 05

Aggressiveness = 01sim05Aggressiveness = 05sim09

Figure 16 Comparison of service compromised probability underdiverse contest intensity and aggressiveness

compromised probability slows down when contest intensitybecomes higherThis is because although aggressive attackersprefer to gain an edge by spending more attack resourcesto compromise a target each compromise costs significantresources Thus aggressive attackers run out of budget veryquickly and the increasing trend is not exponential

42 Proactive Defense Is Advantageous under ldquoWinner TakesAllrdquo Circumstance According to previous discussions theeffectiveness of resources invested is significant under ldquowin-ner takes allrdquo circumstances For less aggressive attackers theperformance is poor since they only invest few resources onan attack Aggressive attackers tend to spend a larger quantityto compromise a target If a defender raises the quantity ofdefense resources on important nodes it effectively weakensattackers

Consequently regardless of whether defenders face eitheraggressive or less aggressive attackers a proactive defenseperforms better in deterring attackers

43 Reactive Defense Is Advantageous under ldquoFight to Winor Dierdquo Circumstance Similarly under the ldquofight to win

Journal of Applied Mathematics 11

or dierdquo circumstance the effectiveness of defense resourcesis insignificant No matter how many proactive defenseresources are invested there is only limited influence onthe objective function value In other words less aggressiveattackers can compromise a target even by only investingscarce attack resources For aggressive attackers since theyprefer spending a large quantity of resources on compromis-ing a victim they easily run out of resources before a targetservice is compromised

Based on this analysis it is advantageous for the defenderto apply reactive defense mechanisms against maliciousattackers under ldquofight to win or dierdquo circumstance

5 Conclusions

This paper models an attack and defense scenario thatinvolves high amounts of randomness as mathematical for-mulations where attackers are assumed to have incompleteinformation It further considers a virtualization environ-ment for helping relate these results to recent trends in cloudcomputing

According to the simulation results the outcome of acontest is influenced not only by the quantity of defenseresources invested on each node but also by the contestintensity An attackerrsquos aggressiveness is introduced as a newdimension and meaningful results are discovered Effectivedefense strategies are proposed in the discussion of theresults

For future works collaborative attacks should be takeninto consideration since the attack strategy discussed in thispaper is for individual attacks In other words there is onlyone attack targeting a victimrsquos network at a time Thus nosynergy is considered A more complicated collaborativeattack pattern is worth further study

Acknowledgment

This work was supported by the National Science CouncilTaiwan (Grant nos NSC 102-2221-E-002-104 and NSC 101-2218-E-011-009)

References

[1] IBM Internet Security Systems X-Force research and devel-opment team ldquoIBM X-Force 2010 Mid-Year Trend and RiskReportrdquo IBM August 2010

[2] R J Ellison D A Fisher R C Linger H F Lipson T Longstaffand N R Mead ldquoSurvivable network systems an emergingdisciplinerdquo Tech Rep CMUSEI-97-TR-013 1997

[3] S Roy C Ellis S Shiva D Dasgupta V Shandilya and Q WuldquoA survey of game theory as applied to network securityrdquo inProceedings of the 43rd Annual Hawaii International Conferenceon System Sciences (HICSS rsquo10) January 2010

[4] M N Lima A L D Santos and G Pujolle ldquoA survey of sur-vivability in mobile Ad hoc Networksrdquo IEEE CommunicationsSurveys and Tutorials vol 11 no 1 pp 66ndash77 2009

[5] Z Ma ldquoTowards a unified definition for reliability survivabilityand resilience (I) the conceptual framework inspired by thehandicap principle and ecological stabilityrdquo in Proceedings of theIEEE Aerospace Conference pp 1ndash12 March 2010

[6] F Xing and W Wang ldquoOn the survivability of wireless adHOC networks with node misbehaviors and failuresrdquo IEEETransactions on Dependable and Secure Computing vol 7 no3 pp 284ndash299 2010

[7] S Skaperdas ldquoContest success functionsrdquo EconomicTheory vol7 no 2 pp 283ndash290 1996

[8] G Levitin and K Hausken ldquoFalse targets efficiency in defensestrategyrdquo European Journal of Operational Research vol 194 no1 pp 155ndash162 2009

[9] K Hausken and G Levitin ldquoProtection vs false targets in seriessystemsrdquo Reliability Engineering and System Safety vol 94 no5 pp 973ndash981 2009

[10] G Levitin and K Hausken ldquoPreventive strike vs false targetsand protection in defense strategyrdquo Reliability Engineering andSystem Safety vol 96 no 8 pp 912ndash924 2011

[11] J Hirshleifer ldquoConflict and rent-seeking success functions ratiovs difference models of relative successrdquo Public Choice vol 63no 2 pp 101ndash112 1989

[12] J Hirshleifer ldquoThe paradox of powerrdquo Economics and Politicsvol 3 pp 177ndash200 1993

[13] J Archer A Boehme D Cullinane P Kurtz N Puhlmannand J Reavis ldquoTop Threats to Cloud Computing V 10rdquo CloudSecurity Alliance March 2010

[14] H Debar F Pouget and M Dacier ldquoWhite paper lsquoHoney-pot Honeynet Honeytoken Terminological issuesrsquordquo InstitutEurecom Research Report RR-03-081 2003

[15] B Cheswick ldquoAn evening with berferd in which a cracker islured endured and studiedrdquo in Proceedings of the USENIXConference pp 163ndash174 USENIX 1992

[16] C Seifert I Welch and P Komisarczuk ldquoTaxonomy of honey-potsrdquo Tech Rep CS-TR-0612 2006

[17] M H y Lopez and C F L Resendez ldquoHoneypots basicconcepts classification and educational use as resources ininformation security education and coursesrdquo in Proceedings ofthe Informing Science and IT Education Conference 2008

[18] Y Huang D Arsenault and A Sood ldquoClosing cluster attackwindows through server redundancy and rotationsrdquo in Pro-ceedings of the 6th IEEE International Symposium on ClusterComputing and the Grid (CCGRID rsquo06) May 2006

[19] YHuang D Arsenault andA Sood ldquoIncorruptible self-cleans-ing intrusion tolerance and its application to DNS securityrdquoJournal of Networks vol 1 no 5 pp 21ndash30 2006

[20] M Smith C Schridde and B Freisleben ldquoSecuring stateful gridservers through virtual server rotationrdquo in Proceedings of the17th International Symposium on High Performance DistributedComputing (HPDC rsquo08) pp 11ndash22 June 2008

[21] F Y-S Lin Y-S Wang and P-H Tsang ldquoEfficient defensestrategies to minimize attackersrsquo success probabilities in hon-eynetrdquo in Proceedings of the 6th International Conference onInformation Assurance and Security (IAS rsquo10) pp 80ndash85 August2010

[22] F Y-S Lin Y-S Wang P-H Tsang and J-P Lo ldquoRedundancyand defense resource allocation algorithms to assure servicecontinuity against natural disasters and intelligent attacksrdquo inProceedings of the 5th International Conference on BroadbandWireless Computing Communication andApplications (BWCCArsquo10) pp 206ndash213 November 2010

[23] F Cohen ldquoManaging network security attack and defencestrategiesrdquo Network Security vol 1999 no 7 pp 7ndash11 1999

[24] S Nagaraja and R Anderson ldquoDynamic topologies for robustscale-free networksrdquo Bio-Inspired Computing and Communica-tion vol 5151 pp 411ndash426 2008

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

4 Journal of Applied Mathematics

2 Problem Formulation

21 Problem Description In order to improve system sur-vivability the defender deploys both proactive and reactivedefense resources to confront different attacks Proactivedefense resources are deployed before an attack is launchedIn this paper proactive resources include a firewall systemantivirus software detection techniques such as IntrusionDetection System (IDS) and Intrusion Protection System(IPS)

Alternatively reactive defense resources are activatedduring an attack as an immediate action for the defenderThe mechanisms considered in this paper can strengthendefenses provide deception and provide resource concentra-tion

For strengthening defenses since the scenario consideredin this paper is constructed in a virtualized environment anumber of Virtual Machines (VMs) are governed by a Vir-tual Machine Monitor (VMM) that controls all informationdetails for all VMs When an attack event is detected localdefense functions for each VMM are activated automaticallyto raise the defense capability of the virtualized nodes belong-ing to the same VMM However this mechanism does notalways create positive effects Once an attacker determinesthat the target network is a virtualized environment anddiscovers the existence of a VMM he can compromise theVMM through vulnerabilities in APIs [13] If the VMMis compromised all VMs belonging to this VMM are alsocompromised

Deceptionmechanisms are widely applied in defense andin this paper honeypots are considered to distract attackersAccording to [14ndash17] honeypots not only serve as a passivedecoy fooling attackers into believing they have achievedtheir goal and preemptively terminating the attack but alsoas an active lure that acts as a service-providing node toattract attackers The former is known as a false target andthe latter can be implemented by a fake core node thatspreads service-like traffic to attract attackers When facingdifferent attackers the deceiving probability of each honeypotis differentThis probability is jointly determined by attackersrsquocapability and the interaction level of a honeypot

As for resource concentration by modifying the con-cept of ldquorotationrdquo discussed in [18ndash20] and adapting it toour scenario the defender can adopt dynamic responsivestrategies to improve system survivability Hence whileunder an attack the defender can apply dynamic topologyreconfiguration to exchange the neighbor of one core nodewhich has the strongest defensive resources with a node thatis close to the attackerrsquos current location

However since dynamic topology reconfigurationrequires node rotation it negatively impacts QoS Thereforeunless the risk level of a core node exceeds a predefinedthreshold the defender will not activate this mechanismFurthermore false positive and false negative situations forevery defense mechanism are considered

In addition to the defense mechanisms described abovethe following attributes are also considered for creating arealistic attack-defense scenario

211 Goal Generally attackers target a network to eitherdisrupt services or to compromise servers and steal sensitiveinformation Therefore in this paper an attackerrsquos goal maybe service disruption or the theft of confidential informationService disruption is achieved by ensuring that the minimallevel of service quality is not fulfilled In the case of infor-mation theft attackers usually establish their target beforelaunching an attack and once core nodes with the desiredinformation are compromised the defenders lose

212 Budget Budget stands for the primary resources for anattack including money manpower computing effort timeand other important factors Without sacrificing generalityan attackersrsquo budget follows a general distribution Whendetermining the result of a compromising event for exampleone attacker invests a certain amount of attack resources oncompromising the target node and the CSF is applied todecide the compromised probability In contrast with [21] and[22] if an attacker invests more resources than the defenderon a given target node it is not guaranteed that the attackerwins it only raises the compromised probability

213 Capability This criterion depicts an attackersrsquo profi-ciency and is also described by a general distribution Forhighly proficient attackers there is a high probability thatthey will see through reactive defense mechanisms such ashoneypots

214 Attack Type In general a malicious attacker launchesan attack from one of the boundary nodes which is com-monly considered an external attack In contrast otherattacks can be launched by malicious insiders and causemore severe consequences [13] Malicious insiders are ableto choose an internal node as their starting position forcompromising the network

In the real world external attackers may apply socialengineering to escalate their access privileges This mecha-nism allows the attacker to bypass some proactive defensefacilitates like a firewall As a result attackers have an edgeon compromising the network

In order to best mimic real-world conditions all attacktypes discussed above are considered in this paper

215 Aggressiveness This metric describes the preferredcompromised probability of an attacker when attacking atarget node This attribute is highly dependent on budgetsince the compromised probability is the left-hand side of theCSF In other words the attack resources required for com-promising a target node are calculated by the given defenseresources contest intensity (119898) and attackerrsquos aggressivenessHighly aggressive attackers prefer a high success probabilityand like to spend a larger amount of resources to compromisethe target node than less aggressive attackers An attackerrsquosaggressiveness is determined by a general distribution

216 NextHop SelectionCriterion In this paper the attackersare assumed to have incomplete information and imperfectknowledge Since they can only gather local information

Journal of Applied Mathematics 5

(1) Attackers only have incomplete information(2) The defender only has incomplete information regarding the network since there are unaware vulnerabilities(3) A service is provided by multiple core nodes(4) Each service has different weights(5) One virtual machine only provides one service(6) Only malicious nodal attacks are considered(7) The compromise probability of a target node is determined by the Contest Success Function (CSF)

Box 1 Problem assumptions

such as the defense level of one hop neighbors link trafficor link utilization attackers must use available informationwisely to choose a proper strategy to select the next victimInspired by the seminal work of [23] possible attack strategiesmay be developed based on the quantity of proactive defenseresources link utilization or a portion of the target servicetraffic of each candidate node Additionally this paper alsoconsiders a more irrational strategy of a blind attack

By applying general distributions to describe attacker-related attributes the total number of attacker categories isnearly infinite This feature increases the generalizability ofour model The detailed assumptions are described in Box 1

To describe the attack procedures in more detail wedevelop the following idea to explain the interaction betweenthe defender and attackers The following figures are drawnfrom the attackerrsquos view for clarity In other words all figuresare a logical topology that has been already virtualizedsince one physical machine may represent many VMs Theexplanations of components are listed in Figure 1

First the defender deploys proactive defense resource oneach node and the attacker starts to compromise the networkfrom the edge nodes (119878) Before launching an attack theattacker probes all the candidate nodes to gather sufficientinformation and determine the next hop selection criterionfor this compromise event By applying the next hop selectioncriterion the victim is chosen The result of this compromiseevent is determined by the CSF If the target is compromisedit becomes a spring board for attackers to assault otheruncompromised neighbors Corresponding information isshown in Figure 2 The topology demonstrated in Figures 2and 3 for presentation purposes the topology structureimplemented in the simulations is a scale-free network

The risk level of each core node is evaluated by minimumdefense resources the number of hops the link degree andservice priority Minimum defense resource stands for theshortest path from compromised nodes to one core nodedivided by total defense resources The number of hops isdetermined by the minimum number of hops from com-promised nodes to one core node divided by the maximumnumber of hops from the attackersrsquo starting point to one corenode Link degree is the linking number of each core nodedivided by the maximum linking number in the topologyService priority is the weight of the service that is providedby the target core node divided by the highest weight ofservice in the topology If any of the core nodes is in dangerthe defender can activate defense mechanisms such as afake traffic generator and a dynamic topology reconfigurationunder QoS limitations

S

Reconfiguration

Reconfiguration

Reconfiguration

VM

Reconfiguration

VM

Figure 1 Explanations of Components

Reconfiguration

VMReconfiguration iiiiiiionnoooooooooonnnooooonnn

S

Reconfiguration

Reconfiguration

VM

Figure 2 Sample network and resource allocation scheme

When the defender activates a dynamic topology recon-figuration only nodes implemented with the reconfigurationfunction are considered First the defender chooses theleast proactively defended neighbor with the reconfigurationfunction of a risky core node The defender then selectsanother node that is both not a neighbor of the core nodeand the most proactively defended nearby the node selectedfrom the previous step If there is a fake traffic generatinghoneypot the defender is also able to activate the mechanismfor influencing an attackerrsquos next hop selecting criterion

In the event that attackers attack the virtualized nodesand this malicious event is detected by the defender the local

6 Journal of Applied Mathematics

Given(1) all possible defense configurations set including defense resource allocation and defending strategies(2) all possible attack configurations set including attacker attributes strategies and selection criterion(3) the total attack times on each serviceObjectiveto minimize the service compromised probability of the target networkSubject to(1) budget constrain for both the defender and attackers(2) the minimum QoS requirement for legitimate usersTo determinethe effective defense strategies to allocate resources

Box 2 Problem description

078

079

08

081

082

083

084

1000 2000 3000 4000 5000 6000 7000 8000 9000 10000

Serv

ice c

ompr

omise

d pr

obab

ility

Evaluation times

m = 01

m = 03

m = 05

m contest intensity

Figure 3 A possible result of an attack and defense scenario

defense mechanism is activated automatically Consequentlythe defense level increases for the attacked node the VMMand the rest of this virtualized group If attackers see that thenode is under a virtualized environment they may continueto compromise the VMM

When a core node is compromised the defender mustevaluate whether the performance level still fulfills theminimum QoS requirement and update the degree of riskregarding each core node If an attacker targets multipleservices once they compromise a false target honeypot andare deceived by it they will change their target to the nextservice Finally if attackers exhaust their budget the attackis terminated and the defender wins the battle One possibleresult is shown in Figure 3 A structural description of theproblem is presented in Box 2

22 Mathematical Formulation The scenario discussed pre-viously is modeled as a minimization problem given theparameters and decision variables shown in Tables 1 and2 respectively Furthermore since the high amount ofrandomness involved renders the nature of this problemnondeterministic it is quite difficult to formulate this prob-lem purely through mathematics To explain the nondeter-ministic nature the following example is used considering

two adversaries with the same attack strategy since theproblem is nondeterministic the consequences can be totallydifferent One may be distracted by a honeypot and the othermay successfully achieve the goal This feature dramaticallyexpands the width in survivability studies Further the sce-nario considered in this work gives the defender the averagesurvivability analysis of a network

There are three major reasons that an average surviv-ability analysis is more meaningful for the defender Firstin the real world there are only few adversaries holdingldquocompleterdquo information regarding the target network Thiskind of ldquoworst caserdquo rarely happen Secondly analyzing theworst case though gives a defender the lower bound of net-work survivability Nevertheless it overestimates the budgetrequired for defending a network An average survivabilityanalysis makes conclusions closer to reality Last but not theleast in average case analysis if the defenderwants to evaluatethe survivability when facing a stronger adversary it canbe achieved by simply tuning the parameter Average caseanalysis is flexible and adjustable according to the demandof a defender

Thus to well describe the problem some verbal notationsand constraints are included which are shown in Table 3

Objective function

min997888119863119894

sum119894isin119878

[120572119894times sum119865119894

119895=1119879119894119895

(997888119863119894997888997888119860119894119895)]

sum119894isin119878

(120572119894times 119865119894)

(IP 1)

subject tomathematical constraints

997888119863119894isin 119864 forall119894 isin 119878 (IP 11)

997888997888119860119894119895

isin 119885 forall119894 isin 119878 1 le 119895 le 119865119894 (IP 12)

119902119894119895

ge 0 forall119894 119895 isin 119873 (IP 13)

119909119894+ 119910119895

ge 1 forall119894 119895 isin 119867 (IP 14)

119888119894ge 120582 forall119894 isin 119885 (IP 15)

119861NL + 119861proactive + 119861reactive le 119861 (IP 16)

119861virtualized + 119861honeypot + 119861reconfig le 119861reactive (IP 17)

Journal of Applied Mathematics 7

119908 times 119890 + 119900 times 119862 +

sum119894isin119873

sum119895isin119873

119892 (119902119894119895)

2le 119861NL (IP 18)

sum

119894isin119873

119899119894le 119861proactive (IP 19)

sum

119894isin119872

V (119897119894) + 119901 times sum

119894isin119872

119897119894times 119896119894le 119861virtualized (IP 110)

sum

119894isin119875

119909119894times ℎ (120575

119894 120576119894) + sum

119895isin119876

119910119895

times 119891 (120575119895 120579119895)

+ sum

119894isin119873

sum

119895isin119873

119909119894times 119910119895

times 119905 (120575119894 120576119894 120579119895) le 119861honeypot

(IP 111)

sum

119894isin119873

119911119894times 119903 le 119861reconfig (IP 112)

119908 times 119890 ge 0 (IP 113)

119892 (119902119894119895) ge 0 forall119894 119895 isin 119873 (IP 114)

119899119894ge 0 forall119894 isin 119873 (IP 115)

V (119897119894) ge 0 forall119894 isin 119872 (IP 116)

ℎ (120575119894 120576119894) ge 0 forall119894 isin 119875 (IP 117)

119891 (120575119895 120579119895) ge 0 forall119895 isin 119876 (IP 118)

119905 (120575119894 120576119894 120579119895) ge 0 forall119894 isin 119873 (IP 119)

119909119894= 0 or 1 forall119894 isin 119873 (IP 120)

119910119894= 0 or 1 forall119894 isin 119873 (IP 121)

119911119894= 0 or 1 forall119894 isin 119873 (IP 122)

verbal constraints

int119884

119910=1[119882 (119866core119894 119880link119895 119870effect 119868effect 119869effect 119874tocore)] 119889119910

119884

ge 119882threshold where 119894 isin 119862 119895 isin 119871

(IP 123)

119882final ge 119882threshold (IP 124)

For each core node when

120573 (120588defense 120591hops 120596degree 119904priority119894

) ge 120573threshold

where 119894 isin 119878

(IP 125)

the defender can activate the reactive defense mechanismsThe goal of the objective function is to minimize the

compromised service probability which is modeled as theweighted total of successful attacks divided by the totalweighted number of attacks The result of an attack is deter-mined by 119879

119894119895(997888119863119894997888997888119860119894119895) For each service the defender con-

structs a defense configuration including defense resource

allocation anddefending strategies to oppose attackers target-ing the service with different attack configurations includingattacker attributes strategies and transition rules Not onlymalicious attacks but also QoS issues are taken into consider-ation

Equation (IP 11) stands for the feasibility of the defenseconfiguration of each service For the attacking side (IP 12)

denotes that the attack configuration should be feasibleEquation (IP 16) denotes that the summation of defenseresources spent should not exceed total budget 119861 Equations(IP 17)sim(IP 119) jointly restrain the budget of each type ofdefense resource individually Equations (IP 120)sim(IP 122)

impose binary restrictions on decision variables Finally(IP 123)sim(IP 125) jointly represent that the performancereduction caused by either malicious attacks or activatingreactive defense mechanisms should not violate the QoSrequirement

3 Numerical Analysis

In this paper a scale-free network is constructed for evalua-tion since this structure is similar to real-world forms suchas the Internet The implementation algorithm is referencedfrom [24]

31 Simulation Environment Table 4 presents the systemexperiment parameters Defender-related parameters areillustrated in Table 5 The unit of budget is dollar Forattackers the parameters are shown in Table 6

The value of each attackerrsquos budget capability and aggres-siveness is governed by a normal distribution with differentlower and upper bounds

32 Numerical Result As mentioned previously the ContestSuccess Function is applied for quantifying vulnerabilityThevalue of contest intensity is classified into two groups scoresgreater than 1 and scores smaller than 1

321 Convergence The first issue to address before con-structing meaningful simulations is convergence In thispaper the convergence of data is considered as numericalstability While the magnitude of data vibrations is withinthe acceptable interval for example 02 the correspondingnumber of simulation times (119872) is set as the number ofevaluations for each attack and defense scenario

For rigorousness in convergence experiments the effectof contest intensity is jointly consideredThree different mag-nitudes are simulated on a 49 node scale-free network Forthe following experiments in this subsection the horizontalaxis represents the evaluation of the number of attacks andthe vertical axis stands for the network system compromisedprobability which is the objective function of the proposedmathematical model

Figures 4 and 5 show the result of 10000 simulations withdifferent contest intensity Here it is clear that the value ofservice compromised probability is unstable In Figures 6 and7 the vibration becomes alleviative but is still not convergentWhen the number of simulations is raised to 100000 as

8 Journal of Applied Mathematics

078

079

08

081

082

083

084

1000 2000 3000 4000 5000 6000 7000 8000 9000 10000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m contest intensity

Figure 4 Convergence test on 119898 lt 1 group for 10000 simulations

075076077078079

08081082083084

1000

4000

7000

1000

013

000

1600

019

000

2200

025

000

2800

031

000

3400

037

000

4000

043

000

4600

049

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 01

m = 03

m = 05

m contest intensity

Figure 5 Convergence test on 119898 gt 1 group for 10000 simulations

shown in Figures 8 and 9 there is a stable trend after 60000among all different values of contest intensity

From Figures 4 to 9 it is clear that the 60000 simulationsare a large enough number to give converging results amongall values of contest intensityTherefore 119872 is set to be 60000

322 Analysis of Key Factors Influencing Service CompromisedProbability Contest intensity has great influence on thenature of network attack and defense However as shown inFigure 10 there is no consistent tendency between contestintensity and service compromised probability The sameconclusions also appear in [8ndash10]

If the effects of contest intensity and attackerrsquos aggressive-ness are jointly considered there are some meaningful andexplainable results

In Figure 11 three value intervals of aggressivenessincluding 01 to 09 (average) 01 to 05 (less aggressive) and05 to 09 (aggressive) are simulated among different values ofcontest intensity It is clear that when both the effect of contestintensity and an attackrsquos aggressiveness are considered thereare consistent trends For aggressive attackers it is more

078

079

08

081

082

083

084

1000

4000

7000

1000

013

000

1600

019

000

2200

025

000

2800

031

000

3400

037

000

4000

043

000

4600

049

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m contest intensity

Figure 6 Convergence test on 119898 lt 1 group for 50000 simulations

075076077078079

08081082

1000

6000

1100

016

000

2100

026

000

3100

036

000

4100

046

000

5100

056

000

6100

066

000

7100

076

000

8100

086

000

9100

096

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 01

m = 03

m = 05

m contest intensity

Figure 7 Convergence test on 119898 gt 1 group for 50000 simulations

advantageous to have higher values of contest intensityAlternatively less aggressive attackers have leverage whenthe value of contest intensity is small However for averageattacks there is no clear tendency

The value of contest intensity is separated into high-valueand low-value groups Here Figure 12 illustrates the variationof service compromised probability in low-level contestintensity groups when facing less aggressive attackers Whilein Figure 12 the objective function value presents a lineardecreasing form Figure 13 demonstrates an exponentiallydecreasing from

Figures 14 and 15 also present a similar phenomenonwhen facing aggressive attackers the variation of servicecompromised probability shows an exponentially increasingtrend for contest intensity belonging to the low-level groupFor the high-level group the tendency is more linear

According to the previous results the key factors influ-encing service compromised probability include contestintensity and attack aggressivenessThese results are summa-rized in Figure 16

Journal of Applied Mathematics 9

075076077078079

08081082083

1000

6000

1100

016

000

2100

026

000

3100

036

000

4100

046

000

5100

056

000

6100

066

000

7100

076

000

8100

086

000

9100

096

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m contest intensity

Figure 8 Convergence test on119898 lt 1 group for 100000 simulations

076

077

078

079

08

081

082

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m = 01

m = 03

m = 05

Aggressiveness = 01sim09

m contest intensity

Figure 9 Convergence test on 119898 gt 1 group for 100000 simula-tions

4 Discussion of Results

Based on the simulation results some interesting and mean-ingful arguments are presented in this section

41 The Effectiveness of Resources Invested by the Defenderand Attackers Is Highly Dependent on the Nature of BattleThe objective function value shown in Figure 12 presents alinear decreasing form when the contest intensity belongsto a low-level group and the defender is dealing with lessaggressive attackers The reason is that the effectiveness ofresources invested by both players is insignificant Thus theservice compromised probability is less sensitive with contestintensity under ldquofight to win or dierdquo circumstances

Furthermore less aggressive attackers only invest fewresources into compromising a target With the same totalbudget they are capable of launching more attacks thanaggressive attackers Therefore the service compromisedprobability of less aggressive attackers is much higher thanmore aggressive attackers

00102030405

06

07

0809

1

Contest intensity m

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15 m = 17 m = 19m = 01 m = 03 m = 05

Aggressiveness = 01sim09Aggressiveness = 05sim09Aggressiveness = 01sim05

Figure 10 Service compromised probability under different contestintensity

075076077078079

08081082083084085086087

m = 01

m = 03

m = 05

Aggressiveness = 01sim05

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 11 Effect of Aggressiveness among Different Contest Inten-sity

In the case of ldquowinner takes allrdquo Figure 13 illustrates anexponentially decreasing trend among service compromisedprobability this is because the effectiveness of resourcesinvested is significant to the result of a battle With a largervalue of contest intensity the vantage of a defender againstless aggressive attackers is more obvious

On the contrary for aggressive attackers there is anexponentially increasing tendency under ldquofight to win ordierdquo circumstances Since the contest intensity serves asthe exponent of the Contest Success Function when thevalue increases the effectiveness of resources invested growsexponentially This is further shown in Figure 14

Nevertheless the exponential tendency does not appearthrough all values of contest intensity For the ldquowinner takesallrdquo circumstance in Figure 15 the increasing rate of service

10 Journal of Applied Mathematics

063064065066067068069

07071072073074075

m = 15

m = 17

m = 19

Aggressiveness = 01sim05

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 12 Service compromised probability of less aggressive at-tacker under 119898 lt 1 circumstance

0

01

02

03

04

05

06

07

m = 01

m = 03

m = 05

Aggressiveness = 05sim09

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 13 Service compromised probability of less aggressive at-tacker under 119898 gt 1 circumstance

085

086

087

088

089

09

m = 15

m = 17

m = 19

Aggressiveness = 05sim09

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 14 Service compromised probability of aggressive attackerunder 119898 lt 1 circumstance

0

02

04

06

08

1

Prob

abili

ty

Contest intensity mm = 15 m = 17 m = 19

m = 01 m = 03 m = 05

Aggressiveness = 01sim05Aggressiveness = 05sim09

Figure 15 Service compromised probability of aggressive attackerunder 119898 gt 1 circumstance

0

02

04

06

08

1

Prob

abili

ty

Contest intensity mm = 15 m = 17 m = 19

m = 01 m = 03 m = 05

Aggressiveness = 01sim05Aggressiveness = 05sim09

Figure 16 Comparison of service compromised probability underdiverse contest intensity and aggressiveness

compromised probability slows down when contest intensitybecomes higherThis is because although aggressive attackersprefer to gain an edge by spending more attack resourcesto compromise a target each compromise costs significantresources Thus aggressive attackers run out of budget veryquickly and the increasing trend is not exponential

42 Proactive Defense Is Advantageous under ldquoWinner TakesAllrdquo Circumstance According to previous discussions theeffectiveness of resources invested is significant under ldquowin-ner takes allrdquo circumstances For less aggressive attackers theperformance is poor since they only invest few resources onan attack Aggressive attackers tend to spend a larger quantityto compromise a target If a defender raises the quantity ofdefense resources on important nodes it effectively weakensattackers

Consequently regardless of whether defenders face eitheraggressive or less aggressive attackers a proactive defenseperforms better in deterring attackers

43 Reactive Defense Is Advantageous under ldquoFight to Winor Dierdquo Circumstance Similarly under the ldquofight to win

Journal of Applied Mathematics 11

or dierdquo circumstance the effectiveness of defense resourcesis insignificant No matter how many proactive defenseresources are invested there is only limited influence onthe objective function value In other words less aggressiveattackers can compromise a target even by only investingscarce attack resources For aggressive attackers since theyprefer spending a large quantity of resources on compromis-ing a victim they easily run out of resources before a targetservice is compromised

Based on this analysis it is advantageous for the defenderto apply reactive defense mechanisms against maliciousattackers under ldquofight to win or dierdquo circumstance

5 Conclusions

This paper models an attack and defense scenario thatinvolves high amounts of randomness as mathematical for-mulations where attackers are assumed to have incompleteinformation It further considers a virtualization environ-ment for helping relate these results to recent trends in cloudcomputing

According to the simulation results the outcome of acontest is influenced not only by the quantity of defenseresources invested on each node but also by the contestintensity An attackerrsquos aggressiveness is introduced as a newdimension and meaningful results are discovered Effectivedefense strategies are proposed in the discussion of theresults

For future works collaborative attacks should be takeninto consideration since the attack strategy discussed in thispaper is for individual attacks In other words there is onlyone attack targeting a victimrsquos network at a time Thus nosynergy is considered A more complicated collaborativeattack pattern is worth further study

Acknowledgment

This work was supported by the National Science CouncilTaiwan (Grant nos NSC 102-2221-E-002-104 and NSC 101-2218-E-011-009)

References

[1] IBM Internet Security Systems X-Force research and devel-opment team ldquoIBM X-Force 2010 Mid-Year Trend and RiskReportrdquo IBM August 2010

[2] R J Ellison D A Fisher R C Linger H F Lipson T Longstaffand N R Mead ldquoSurvivable network systems an emergingdisciplinerdquo Tech Rep CMUSEI-97-TR-013 1997

[3] S Roy C Ellis S Shiva D Dasgupta V Shandilya and Q WuldquoA survey of game theory as applied to network securityrdquo inProceedings of the 43rd Annual Hawaii International Conferenceon System Sciences (HICSS rsquo10) January 2010

[4] M N Lima A L D Santos and G Pujolle ldquoA survey of sur-vivability in mobile Ad hoc Networksrdquo IEEE CommunicationsSurveys and Tutorials vol 11 no 1 pp 66ndash77 2009

[5] Z Ma ldquoTowards a unified definition for reliability survivabilityand resilience (I) the conceptual framework inspired by thehandicap principle and ecological stabilityrdquo in Proceedings of theIEEE Aerospace Conference pp 1ndash12 March 2010

[6] F Xing and W Wang ldquoOn the survivability of wireless adHOC networks with node misbehaviors and failuresrdquo IEEETransactions on Dependable and Secure Computing vol 7 no3 pp 284ndash299 2010

[7] S Skaperdas ldquoContest success functionsrdquo EconomicTheory vol7 no 2 pp 283ndash290 1996

[8] G Levitin and K Hausken ldquoFalse targets efficiency in defensestrategyrdquo European Journal of Operational Research vol 194 no1 pp 155ndash162 2009

[9] K Hausken and G Levitin ldquoProtection vs false targets in seriessystemsrdquo Reliability Engineering and System Safety vol 94 no5 pp 973ndash981 2009

[10] G Levitin and K Hausken ldquoPreventive strike vs false targetsand protection in defense strategyrdquo Reliability Engineering andSystem Safety vol 96 no 8 pp 912ndash924 2011

[11] J Hirshleifer ldquoConflict and rent-seeking success functions ratiovs difference models of relative successrdquo Public Choice vol 63no 2 pp 101ndash112 1989

[12] J Hirshleifer ldquoThe paradox of powerrdquo Economics and Politicsvol 3 pp 177ndash200 1993

[13] J Archer A Boehme D Cullinane P Kurtz N Puhlmannand J Reavis ldquoTop Threats to Cloud Computing V 10rdquo CloudSecurity Alliance March 2010

[14] H Debar F Pouget and M Dacier ldquoWhite paper lsquoHoney-pot Honeynet Honeytoken Terminological issuesrsquordquo InstitutEurecom Research Report RR-03-081 2003

[15] B Cheswick ldquoAn evening with berferd in which a cracker islured endured and studiedrdquo in Proceedings of the USENIXConference pp 163ndash174 USENIX 1992

[16] C Seifert I Welch and P Komisarczuk ldquoTaxonomy of honey-potsrdquo Tech Rep CS-TR-0612 2006

[17] M H y Lopez and C F L Resendez ldquoHoneypots basicconcepts classification and educational use as resources ininformation security education and coursesrdquo in Proceedings ofthe Informing Science and IT Education Conference 2008

[18] Y Huang D Arsenault and A Sood ldquoClosing cluster attackwindows through server redundancy and rotationsrdquo in Pro-ceedings of the 6th IEEE International Symposium on ClusterComputing and the Grid (CCGRID rsquo06) May 2006

[19] YHuang D Arsenault andA Sood ldquoIncorruptible self-cleans-ing intrusion tolerance and its application to DNS securityrdquoJournal of Networks vol 1 no 5 pp 21ndash30 2006

[20] M Smith C Schridde and B Freisleben ldquoSecuring stateful gridservers through virtual server rotationrdquo in Proceedings of the17th International Symposium on High Performance DistributedComputing (HPDC rsquo08) pp 11ndash22 June 2008

[21] F Y-S Lin Y-S Wang and P-H Tsang ldquoEfficient defensestrategies to minimize attackersrsquo success probabilities in hon-eynetrdquo in Proceedings of the 6th International Conference onInformation Assurance and Security (IAS rsquo10) pp 80ndash85 August2010

[22] F Y-S Lin Y-S Wang P-H Tsang and J-P Lo ldquoRedundancyand defense resource allocation algorithms to assure servicecontinuity against natural disasters and intelligent attacksrdquo inProceedings of the 5th International Conference on BroadbandWireless Computing Communication andApplications (BWCCArsquo10) pp 206ndash213 November 2010

[23] F Cohen ldquoManaging network security attack and defencestrategiesrdquo Network Security vol 1999 no 7 pp 7ndash11 1999

[24] S Nagaraja and R Anderson ldquoDynamic topologies for robustscale-free networksrdquo Bio-Inspired Computing and Communica-tion vol 5151 pp 411ndash426 2008

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

Journal of Applied Mathematics 5

(1) Attackers only have incomplete information(2) The defender only has incomplete information regarding the network since there are unaware vulnerabilities(3) A service is provided by multiple core nodes(4) Each service has different weights(5) One virtual machine only provides one service(6) Only malicious nodal attacks are considered(7) The compromise probability of a target node is determined by the Contest Success Function (CSF)

Box 1 Problem assumptions

such as the defense level of one hop neighbors link trafficor link utilization attackers must use available informationwisely to choose a proper strategy to select the next victimInspired by the seminal work of [23] possible attack strategiesmay be developed based on the quantity of proactive defenseresources link utilization or a portion of the target servicetraffic of each candidate node Additionally this paper alsoconsiders a more irrational strategy of a blind attack

By applying general distributions to describe attacker-related attributes the total number of attacker categories isnearly infinite This feature increases the generalizability ofour model The detailed assumptions are described in Box 1

To describe the attack procedures in more detail wedevelop the following idea to explain the interaction betweenthe defender and attackers The following figures are drawnfrom the attackerrsquos view for clarity In other words all figuresare a logical topology that has been already virtualizedsince one physical machine may represent many VMs Theexplanations of components are listed in Figure 1

First the defender deploys proactive defense resource oneach node and the attacker starts to compromise the networkfrom the edge nodes (119878) Before launching an attack theattacker probes all the candidate nodes to gather sufficientinformation and determine the next hop selection criterionfor this compromise event By applying the next hop selectioncriterion the victim is chosen The result of this compromiseevent is determined by the CSF If the target is compromisedit becomes a spring board for attackers to assault otheruncompromised neighbors Corresponding information isshown in Figure 2 The topology demonstrated in Figures 2and 3 for presentation purposes the topology structureimplemented in the simulations is a scale-free network

The risk level of each core node is evaluated by minimumdefense resources the number of hops the link degree andservice priority Minimum defense resource stands for theshortest path from compromised nodes to one core nodedivided by total defense resources The number of hops isdetermined by the minimum number of hops from com-promised nodes to one core node divided by the maximumnumber of hops from the attackersrsquo starting point to one corenode Link degree is the linking number of each core nodedivided by the maximum linking number in the topologyService priority is the weight of the service that is providedby the target core node divided by the highest weight ofservice in the topology If any of the core nodes is in dangerthe defender can activate defense mechanisms such as afake traffic generator and a dynamic topology reconfigurationunder QoS limitations

S

Reconfiguration

Reconfiguration

Reconfiguration

VM

Reconfiguration

VM

Figure 1 Explanations of Components

Reconfiguration

VMReconfiguration iiiiiiionnoooooooooonnnooooonnn

S

Reconfiguration

Reconfiguration

VM

Figure 2 Sample network and resource allocation scheme

When the defender activates a dynamic topology recon-figuration only nodes implemented with the reconfigurationfunction are considered First the defender chooses theleast proactively defended neighbor with the reconfigurationfunction of a risky core node The defender then selectsanother node that is both not a neighbor of the core nodeand the most proactively defended nearby the node selectedfrom the previous step If there is a fake traffic generatinghoneypot the defender is also able to activate the mechanismfor influencing an attackerrsquos next hop selecting criterion

In the event that attackers attack the virtualized nodesand this malicious event is detected by the defender the local

6 Journal of Applied Mathematics

Given(1) all possible defense configurations set including defense resource allocation and defending strategies(2) all possible attack configurations set including attacker attributes strategies and selection criterion(3) the total attack times on each serviceObjectiveto minimize the service compromised probability of the target networkSubject to(1) budget constrain for both the defender and attackers(2) the minimum QoS requirement for legitimate usersTo determinethe effective defense strategies to allocate resources

Box 2 Problem description

078

079

08

081

082

083

084

1000 2000 3000 4000 5000 6000 7000 8000 9000 10000

Serv

ice c

ompr

omise

d pr

obab

ility

Evaluation times

m = 01

m = 03

m = 05

m contest intensity

Figure 3 A possible result of an attack and defense scenario

defense mechanism is activated automatically Consequentlythe defense level increases for the attacked node the VMMand the rest of this virtualized group If attackers see that thenode is under a virtualized environment they may continueto compromise the VMM

When a core node is compromised the defender mustevaluate whether the performance level still fulfills theminimum QoS requirement and update the degree of riskregarding each core node If an attacker targets multipleservices once they compromise a false target honeypot andare deceived by it they will change their target to the nextservice Finally if attackers exhaust their budget the attackis terminated and the defender wins the battle One possibleresult is shown in Figure 3 A structural description of theproblem is presented in Box 2

22 Mathematical Formulation The scenario discussed pre-viously is modeled as a minimization problem given theparameters and decision variables shown in Tables 1 and2 respectively Furthermore since the high amount ofrandomness involved renders the nature of this problemnondeterministic it is quite difficult to formulate this prob-lem purely through mathematics To explain the nondeter-ministic nature the following example is used considering

two adversaries with the same attack strategy since theproblem is nondeterministic the consequences can be totallydifferent One may be distracted by a honeypot and the othermay successfully achieve the goal This feature dramaticallyexpands the width in survivability studies Further the sce-nario considered in this work gives the defender the averagesurvivability analysis of a network

There are three major reasons that an average surviv-ability analysis is more meaningful for the defender Firstin the real world there are only few adversaries holdingldquocompleterdquo information regarding the target network Thiskind of ldquoworst caserdquo rarely happen Secondly analyzing theworst case though gives a defender the lower bound of net-work survivability Nevertheless it overestimates the budgetrequired for defending a network An average survivabilityanalysis makes conclusions closer to reality Last but not theleast in average case analysis if the defenderwants to evaluatethe survivability when facing a stronger adversary it canbe achieved by simply tuning the parameter Average caseanalysis is flexible and adjustable according to the demandof a defender

Thus to well describe the problem some verbal notationsand constraints are included which are shown in Table 3

Objective function

min997888119863119894

sum119894isin119878

[120572119894times sum119865119894

119895=1119879119894119895

(997888119863119894997888997888119860119894119895)]

sum119894isin119878

(120572119894times 119865119894)

(IP 1)

subject tomathematical constraints

997888119863119894isin 119864 forall119894 isin 119878 (IP 11)

997888997888119860119894119895

isin 119885 forall119894 isin 119878 1 le 119895 le 119865119894 (IP 12)

119902119894119895

ge 0 forall119894 119895 isin 119873 (IP 13)

119909119894+ 119910119895

ge 1 forall119894 119895 isin 119867 (IP 14)

119888119894ge 120582 forall119894 isin 119885 (IP 15)

119861NL + 119861proactive + 119861reactive le 119861 (IP 16)

119861virtualized + 119861honeypot + 119861reconfig le 119861reactive (IP 17)

Journal of Applied Mathematics 7

119908 times 119890 + 119900 times 119862 +

sum119894isin119873

sum119895isin119873

119892 (119902119894119895)

2le 119861NL (IP 18)

sum

119894isin119873

119899119894le 119861proactive (IP 19)

sum

119894isin119872

V (119897119894) + 119901 times sum

119894isin119872

119897119894times 119896119894le 119861virtualized (IP 110)

sum

119894isin119875

119909119894times ℎ (120575

119894 120576119894) + sum

119895isin119876

119910119895

times 119891 (120575119895 120579119895)

+ sum

119894isin119873

sum

119895isin119873

119909119894times 119910119895

times 119905 (120575119894 120576119894 120579119895) le 119861honeypot

(IP 111)

sum

119894isin119873

119911119894times 119903 le 119861reconfig (IP 112)

119908 times 119890 ge 0 (IP 113)

119892 (119902119894119895) ge 0 forall119894 119895 isin 119873 (IP 114)

119899119894ge 0 forall119894 isin 119873 (IP 115)

V (119897119894) ge 0 forall119894 isin 119872 (IP 116)

ℎ (120575119894 120576119894) ge 0 forall119894 isin 119875 (IP 117)

119891 (120575119895 120579119895) ge 0 forall119895 isin 119876 (IP 118)

119905 (120575119894 120576119894 120579119895) ge 0 forall119894 isin 119873 (IP 119)

119909119894= 0 or 1 forall119894 isin 119873 (IP 120)

119910119894= 0 or 1 forall119894 isin 119873 (IP 121)

119911119894= 0 or 1 forall119894 isin 119873 (IP 122)

verbal constraints

int119884

119910=1[119882 (119866core119894 119880link119895 119870effect 119868effect 119869effect 119874tocore)] 119889119910

119884

ge 119882threshold where 119894 isin 119862 119895 isin 119871

(IP 123)

119882final ge 119882threshold (IP 124)

For each core node when

120573 (120588defense 120591hops 120596degree 119904priority119894

) ge 120573threshold

where 119894 isin 119878

(IP 125)

the defender can activate the reactive defense mechanismsThe goal of the objective function is to minimize the

compromised service probability which is modeled as theweighted total of successful attacks divided by the totalweighted number of attacks The result of an attack is deter-mined by 119879

119894119895(997888119863119894997888997888119860119894119895) For each service the defender con-

structs a defense configuration including defense resource

allocation anddefending strategies to oppose attackers target-ing the service with different attack configurations includingattacker attributes strategies and transition rules Not onlymalicious attacks but also QoS issues are taken into consider-ation

Equation (IP 11) stands for the feasibility of the defenseconfiguration of each service For the attacking side (IP 12)

denotes that the attack configuration should be feasibleEquation (IP 16) denotes that the summation of defenseresources spent should not exceed total budget 119861 Equations(IP 17)sim(IP 119) jointly restrain the budget of each type ofdefense resource individually Equations (IP 120)sim(IP 122)

impose binary restrictions on decision variables Finally(IP 123)sim(IP 125) jointly represent that the performancereduction caused by either malicious attacks or activatingreactive defense mechanisms should not violate the QoSrequirement

3 Numerical Analysis

In this paper a scale-free network is constructed for evalua-tion since this structure is similar to real-world forms suchas the Internet The implementation algorithm is referencedfrom [24]

31 Simulation Environment Table 4 presents the systemexperiment parameters Defender-related parameters areillustrated in Table 5 The unit of budget is dollar Forattackers the parameters are shown in Table 6

The value of each attackerrsquos budget capability and aggres-siveness is governed by a normal distribution with differentlower and upper bounds

32 Numerical Result As mentioned previously the ContestSuccess Function is applied for quantifying vulnerabilityThevalue of contest intensity is classified into two groups scoresgreater than 1 and scores smaller than 1

321 Convergence The first issue to address before con-structing meaningful simulations is convergence In thispaper the convergence of data is considered as numericalstability While the magnitude of data vibrations is withinthe acceptable interval for example 02 the correspondingnumber of simulation times (119872) is set as the number ofevaluations for each attack and defense scenario

For rigorousness in convergence experiments the effectof contest intensity is jointly consideredThree different mag-nitudes are simulated on a 49 node scale-free network Forthe following experiments in this subsection the horizontalaxis represents the evaluation of the number of attacks andthe vertical axis stands for the network system compromisedprobability which is the objective function of the proposedmathematical model

Figures 4 and 5 show the result of 10000 simulations withdifferent contest intensity Here it is clear that the value ofservice compromised probability is unstable In Figures 6 and7 the vibration becomes alleviative but is still not convergentWhen the number of simulations is raised to 100000 as

8 Journal of Applied Mathematics

078

079

08

081

082

083

084

1000 2000 3000 4000 5000 6000 7000 8000 9000 10000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m contest intensity

Figure 4 Convergence test on 119898 lt 1 group for 10000 simulations

075076077078079

08081082083084

1000

4000

7000

1000

013

000

1600

019

000

2200

025

000

2800

031

000

3400

037

000

4000

043

000

4600

049

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 01

m = 03

m = 05

m contest intensity

Figure 5 Convergence test on 119898 gt 1 group for 10000 simulations

shown in Figures 8 and 9 there is a stable trend after 60000among all different values of contest intensity

From Figures 4 to 9 it is clear that the 60000 simulationsare a large enough number to give converging results amongall values of contest intensityTherefore 119872 is set to be 60000

322 Analysis of Key Factors Influencing Service CompromisedProbability Contest intensity has great influence on thenature of network attack and defense However as shown inFigure 10 there is no consistent tendency between contestintensity and service compromised probability The sameconclusions also appear in [8ndash10]

If the effects of contest intensity and attackerrsquos aggressive-ness are jointly considered there are some meaningful andexplainable results

In Figure 11 three value intervals of aggressivenessincluding 01 to 09 (average) 01 to 05 (less aggressive) and05 to 09 (aggressive) are simulated among different values ofcontest intensity It is clear that when both the effect of contestintensity and an attackrsquos aggressiveness are considered thereare consistent trends For aggressive attackers it is more

078

079

08

081

082

083

084

1000

4000

7000

1000

013

000

1600

019

000

2200

025

000

2800

031

000

3400

037

000

4000

043

000

4600

049

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m contest intensity

Figure 6 Convergence test on 119898 lt 1 group for 50000 simulations

075076077078079

08081082

1000

6000

1100

016

000

2100

026

000

3100

036

000

4100

046

000

5100

056

000

6100

066

000

7100

076

000

8100

086

000

9100

096

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 01

m = 03

m = 05

m contest intensity

Figure 7 Convergence test on 119898 gt 1 group for 50000 simulations

advantageous to have higher values of contest intensityAlternatively less aggressive attackers have leverage whenthe value of contest intensity is small However for averageattacks there is no clear tendency

The value of contest intensity is separated into high-valueand low-value groups Here Figure 12 illustrates the variationof service compromised probability in low-level contestintensity groups when facing less aggressive attackers Whilein Figure 12 the objective function value presents a lineardecreasing form Figure 13 demonstrates an exponentiallydecreasing from

Figures 14 and 15 also present a similar phenomenonwhen facing aggressive attackers the variation of servicecompromised probability shows an exponentially increasingtrend for contest intensity belonging to the low-level groupFor the high-level group the tendency is more linear

According to the previous results the key factors influ-encing service compromised probability include contestintensity and attack aggressivenessThese results are summa-rized in Figure 16

Journal of Applied Mathematics 9

075076077078079

08081082083

1000

6000

1100

016

000

2100

026

000

3100

036

000

4100

046

000

5100

056

000

6100

066

000

7100

076

000

8100

086

000

9100

096

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m contest intensity

Figure 8 Convergence test on119898 lt 1 group for 100000 simulations

076

077

078

079

08

081

082

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m = 01

m = 03

m = 05

Aggressiveness = 01sim09

m contest intensity

Figure 9 Convergence test on 119898 gt 1 group for 100000 simula-tions

4 Discussion of Results

Based on the simulation results some interesting and mean-ingful arguments are presented in this section

41 The Effectiveness of Resources Invested by the Defenderand Attackers Is Highly Dependent on the Nature of BattleThe objective function value shown in Figure 12 presents alinear decreasing form when the contest intensity belongsto a low-level group and the defender is dealing with lessaggressive attackers The reason is that the effectiveness ofresources invested by both players is insignificant Thus theservice compromised probability is less sensitive with contestintensity under ldquofight to win or dierdquo circumstances

Furthermore less aggressive attackers only invest fewresources into compromising a target With the same totalbudget they are capable of launching more attacks thanaggressive attackers Therefore the service compromisedprobability of less aggressive attackers is much higher thanmore aggressive attackers

00102030405

06

07

0809

1

Contest intensity m

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15 m = 17 m = 19m = 01 m = 03 m = 05

Aggressiveness = 01sim09Aggressiveness = 05sim09Aggressiveness = 01sim05

Figure 10 Service compromised probability under different contestintensity

075076077078079

08081082083084085086087

m = 01

m = 03

m = 05

Aggressiveness = 01sim05

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 11 Effect of Aggressiveness among Different Contest Inten-sity

In the case of ldquowinner takes allrdquo Figure 13 illustrates anexponentially decreasing trend among service compromisedprobability this is because the effectiveness of resourcesinvested is significant to the result of a battle With a largervalue of contest intensity the vantage of a defender againstless aggressive attackers is more obvious

On the contrary for aggressive attackers there is anexponentially increasing tendency under ldquofight to win ordierdquo circumstances Since the contest intensity serves asthe exponent of the Contest Success Function when thevalue increases the effectiveness of resources invested growsexponentially This is further shown in Figure 14

Nevertheless the exponential tendency does not appearthrough all values of contest intensity For the ldquowinner takesallrdquo circumstance in Figure 15 the increasing rate of service

10 Journal of Applied Mathematics

063064065066067068069

07071072073074075

m = 15

m = 17

m = 19

Aggressiveness = 01sim05

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 12 Service compromised probability of less aggressive at-tacker under 119898 lt 1 circumstance

0

01

02

03

04

05

06

07

m = 01

m = 03

m = 05

Aggressiveness = 05sim09

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 13 Service compromised probability of less aggressive at-tacker under 119898 gt 1 circumstance

085

086

087

088

089

09

m = 15

m = 17

m = 19

Aggressiveness = 05sim09

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 14 Service compromised probability of aggressive attackerunder 119898 lt 1 circumstance

0

02

04

06

08

1

Prob

abili

ty

Contest intensity mm = 15 m = 17 m = 19

m = 01 m = 03 m = 05

Aggressiveness = 01sim05Aggressiveness = 05sim09

Figure 15 Service compromised probability of aggressive attackerunder 119898 gt 1 circumstance

0

02

04

06

08

1

Prob

abili

ty

Contest intensity mm = 15 m = 17 m = 19

m = 01 m = 03 m = 05

Aggressiveness = 01sim05Aggressiveness = 05sim09

Figure 16 Comparison of service compromised probability underdiverse contest intensity and aggressiveness

compromised probability slows down when contest intensitybecomes higherThis is because although aggressive attackersprefer to gain an edge by spending more attack resourcesto compromise a target each compromise costs significantresources Thus aggressive attackers run out of budget veryquickly and the increasing trend is not exponential

42 Proactive Defense Is Advantageous under ldquoWinner TakesAllrdquo Circumstance According to previous discussions theeffectiveness of resources invested is significant under ldquowin-ner takes allrdquo circumstances For less aggressive attackers theperformance is poor since they only invest few resources onan attack Aggressive attackers tend to spend a larger quantityto compromise a target If a defender raises the quantity ofdefense resources on important nodes it effectively weakensattackers

Consequently regardless of whether defenders face eitheraggressive or less aggressive attackers a proactive defenseperforms better in deterring attackers

43 Reactive Defense Is Advantageous under ldquoFight to Winor Dierdquo Circumstance Similarly under the ldquofight to win

Journal of Applied Mathematics 11

or dierdquo circumstance the effectiveness of defense resourcesis insignificant No matter how many proactive defenseresources are invested there is only limited influence onthe objective function value In other words less aggressiveattackers can compromise a target even by only investingscarce attack resources For aggressive attackers since theyprefer spending a large quantity of resources on compromis-ing a victim they easily run out of resources before a targetservice is compromised

Based on this analysis it is advantageous for the defenderto apply reactive defense mechanisms against maliciousattackers under ldquofight to win or dierdquo circumstance

5 Conclusions

This paper models an attack and defense scenario thatinvolves high amounts of randomness as mathematical for-mulations where attackers are assumed to have incompleteinformation It further considers a virtualization environ-ment for helping relate these results to recent trends in cloudcomputing

According to the simulation results the outcome of acontest is influenced not only by the quantity of defenseresources invested on each node but also by the contestintensity An attackerrsquos aggressiveness is introduced as a newdimension and meaningful results are discovered Effectivedefense strategies are proposed in the discussion of theresults

For future works collaborative attacks should be takeninto consideration since the attack strategy discussed in thispaper is for individual attacks In other words there is onlyone attack targeting a victimrsquos network at a time Thus nosynergy is considered A more complicated collaborativeattack pattern is worth further study

Acknowledgment

This work was supported by the National Science CouncilTaiwan (Grant nos NSC 102-2221-E-002-104 and NSC 101-2218-E-011-009)

References

[1] IBM Internet Security Systems X-Force research and devel-opment team ldquoIBM X-Force 2010 Mid-Year Trend and RiskReportrdquo IBM August 2010

[2] R J Ellison D A Fisher R C Linger H F Lipson T Longstaffand N R Mead ldquoSurvivable network systems an emergingdisciplinerdquo Tech Rep CMUSEI-97-TR-013 1997

[3] S Roy C Ellis S Shiva D Dasgupta V Shandilya and Q WuldquoA survey of game theory as applied to network securityrdquo inProceedings of the 43rd Annual Hawaii International Conferenceon System Sciences (HICSS rsquo10) January 2010

[4] M N Lima A L D Santos and G Pujolle ldquoA survey of sur-vivability in mobile Ad hoc Networksrdquo IEEE CommunicationsSurveys and Tutorials vol 11 no 1 pp 66ndash77 2009

[5] Z Ma ldquoTowards a unified definition for reliability survivabilityand resilience (I) the conceptual framework inspired by thehandicap principle and ecological stabilityrdquo in Proceedings of theIEEE Aerospace Conference pp 1ndash12 March 2010

[6] F Xing and W Wang ldquoOn the survivability of wireless adHOC networks with node misbehaviors and failuresrdquo IEEETransactions on Dependable and Secure Computing vol 7 no3 pp 284ndash299 2010

[7] S Skaperdas ldquoContest success functionsrdquo EconomicTheory vol7 no 2 pp 283ndash290 1996

[8] G Levitin and K Hausken ldquoFalse targets efficiency in defensestrategyrdquo European Journal of Operational Research vol 194 no1 pp 155ndash162 2009

[9] K Hausken and G Levitin ldquoProtection vs false targets in seriessystemsrdquo Reliability Engineering and System Safety vol 94 no5 pp 973ndash981 2009

[10] G Levitin and K Hausken ldquoPreventive strike vs false targetsand protection in defense strategyrdquo Reliability Engineering andSystem Safety vol 96 no 8 pp 912ndash924 2011

[11] J Hirshleifer ldquoConflict and rent-seeking success functions ratiovs difference models of relative successrdquo Public Choice vol 63no 2 pp 101ndash112 1989

[12] J Hirshleifer ldquoThe paradox of powerrdquo Economics and Politicsvol 3 pp 177ndash200 1993

[13] J Archer A Boehme D Cullinane P Kurtz N Puhlmannand J Reavis ldquoTop Threats to Cloud Computing V 10rdquo CloudSecurity Alliance March 2010

[14] H Debar F Pouget and M Dacier ldquoWhite paper lsquoHoney-pot Honeynet Honeytoken Terminological issuesrsquordquo InstitutEurecom Research Report RR-03-081 2003

[15] B Cheswick ldquoAn evening with berferd in which a cracker islured endured and studiedrdquo in Proceedings of the USENIXConference pp 163ndash174 USENIX 1992

[16] C Seifert I Welch and P Komisarczuk ldquoTaxonomy of honey-potsrdquo Tech Rep CS-TR-0612 2006

[17] M H y Lopez and C F L Resendez ldquoHoneypots basicconcepts classification and educational use as resources ininformation security education and coursesrdquo in Proceedings ofthe Informing Science and IT Education Conference 2008

[18] Y Huang D Arsenault and A Sood ldquoClosing cluster attackwindows through server redundancy and rotationsrdquo in Pro-ceedings of the 6th IEEE International Symposium on ClusterComputing and the Grid (CCGRID rsquo06) May 2006

[19] YHuang D Arsenault andA Sood ldquoIncorruptible self-cleans-ing intrusion tolerance and its application to DNS securityrdquoJournal of Networks vol 1 no 5 pp 21ndash30 2006

[20] M Smith C Schridde and B Freisleben ldquoSecuring stateful gridservers through virtual server rotationrdquo in Proceedings of the17th International Symposium on High Performance DistributedComputing (HPDC rsquo08) pp 11ndash22 June 2008

[21] F Y-S Lin Y-S Wang and P-H Tsang ldquoEfficient defensestrategies to minimize attackersrsquo success probabilities in hon-eynetrdquo in Proceedings of the 6th International Conference onInformation Assurance and Security (IAS rsquo10) pp 80ndash85 August2010

[22] F Y-S Lin Y-S Wang P-H Tsang and J-P Lo ldquoRedundancyand defense resource allocation algorithms to assure servicecontinuity against natural disasters and intelligent attacksrdquo inProceedings of the 5th International Conference on BroadbandWireless Computing Communication andApplications (BWCCArsquo10) pp 206ndash213 November 2010

[23] F Cohen ldquoManaging network security attack and defencestrategiesrdquo Network Security vol 1999 no 7 pp 7ndash11 1999

[24] S Nagaraja and R Anderson ldquoDynamic topologies for robustscale-free networksrdquo Bio-Inspired Computing and Communica-tion vol 5151 pp 411ndash426 2008

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

6 Journal of Applied Mathematics

Given(1) all possible defense configurations set including defense resource allocation and defending strategies(2) all possible attack configurations set including attacker attributes strategies and selection criterion(3) the total attack times on each serviceObjectiveto minimize the service compromised probability of the target networkSubject to(1) budget constrain for both the defender and attackers(2) the minimum QoS requirement for legitimate usersTo determinethe effective defense strategies to allocate resources

Box 2 Problem description

078

079

08

081

082

083

084

1000 2000 3000 4000 5000 6000 7000 8000 9000 10000

Serv

ice c

ompr

omise

d pr

obab

ility

Evaluation times

m = 01

m = 03

m = 05

m contest intensity

Figure 3 A possible result of an attack and defense scenario

defense mechanism is activated automatically Consequentlythe defense level increases for the attacked node the VMMand the rest of this virtualized group If attackers see that thenode is under a virtualized environment they may continueto compromise the VMM

When a core node is compromised the defender mustevaluate whether the performance level still fulfills theminimum QoS requirement and update the degree of riskregarding each core node If an attacker targets multipleservices once they compromise a false target honeypot andare deceived by it they will change their target to the nextservice Finally if attackers exhaust their budget the attackis terminated and the defender wins the battle One possibleresult is shown in Figure 3 A structural description of theproblem is presented in Box 2

22 Mathematical Formulation The scenario discussed pre-viously is modeled as a minimization problem given theparameters and decision variables shown in Tables 1 and2 respectively Furthermore since the high amount ofrandomness involved renders the nature of this problemnondeterministic it is quite difficult to formulate this prob-lem purely through mathematics To explain the nondeter-ministic nature the following example is used considering

two adversaries with the same attack strategy since theproblem is nondeterministic the consequences can be totallydifferent One may be distracted by a honeypot and the othermay successfully achieve the goal This feature dramaticallyexpands the width in survivability studies Further the sce-nario considered in this work gives the defender the averagesurvivability analysis of a network

There are three major reasons that an average surviv-ability analysis is more meaningful for the defender Firstin the real world there are only few adversaries holdingldquocompleterdquo information regarding the target network Thiskind of ldquoworst caserdquo rarely happen Secondly analyzing theworst case though gives a defender the lower bound of net-work survivability Nevertheless it overestimates the budgetrequired for defending a network An average survivabilityanalysis makes conclusions closer to reality Last but not theleast in average case analysis if the defenderwants to evaluatethe survivability when facing a stronger adversary it canbe achieved by simply tuning the parameter Average caseanalysis is flexible and adjustable according to the demandof a defender

Thus to well describe the problem some verbal notationsand constraints are included which are shown in Table 3

Objective function

min997888119863119894

sum119894isin119878

[120572119894times sum119865119894

119895=1119879119894119895

(997888119863119894997888997888119860119894119895)]

sum119894isin119878

(120572119894times 119865119894)

(IP 1)

subject tomathematical constraints

997888119863119894isin 119864 forall119894 isin 119878 (IP 11)

997888997888119860119894119895

isin 119885 forall119894 isin 119878 1 le 119895 le 119865119894 (IP 12)

119902119894119895

ge 0 forall119894 119895 isin 119873 (IP 13)

119909119894+ 119910119895

ge 1 forall119894 119895 isin 119867 (IP 14)

119888119894ge 120582 forall119894 isin 119885 (IP 15)

119861NL + 119861proactive + 119861reactive le 119861 (IP 16)

119861virtualized + 119861honeypot + 119861reconfig le 119861reactive (IP 17)

Journal of Applied Mathematics 7

119908 times 119890 + 119900 times 119862 +

sum119894isin119873

sum119895isin119873

119892 (119902119894119895)

2le 119861NL (IP 18)

sum

119894isin119873

119899119894le 119861proactive (IP 19)

sum

119894isin119872

V (119897119894) + 119901 times sum

119894isin119872

119897119894times 119896119894le 119861virtualized (IP 110)

sum

119894isin119875

119909119894times ℎ (120575

119894 120576119894) + sum

119895isin119876

119910119895

times 119891 (120575119895 120579119895)

+ sum

119894isin119873

sum

119895isin119873

119909119894times 119910119895

times 119905 (120575119894 120576119894 120579119895) le 119861honeypot

(IP 111)

sum

119894isin119873

119911119894times 119903 le 119861reconfig (IP 112)

119908 times 119890 ge 0 (IP 113)

119892 (119902119894119895) ge 0 forall119894 119895 isin 119873 (IP 114)

119899119894ge 0 forall119894 isin 119873 (IP 115)

V (119897119894) ge 0 forall119894 isin 119872 (IP 116)

ℎ (120575119894 120576119894) ge 0 forall119894 isin 119875 (IP 117)

119891 (120575119895 120579119895) ge 0 forall119895 isin 119876 (IP 118)

119905 (120575119894 120576119894 120579119895) ge 0 forall119894 isin 119873 (IP 119)

119909119894= 0 or 1 forall119894 isin 119873 (IP 120)

119910119894= 0 or 1 forall119894 isin 119873 (IP 121)

119911119894= 0 or 1 forall119894 isin 119873 (IP 122)

verbal constraints

int119884

119910=1[119882 (119866core119894 119880link119895 119870effect 119868effect 119869effect 119874tocore)] 119889119910

119884

ge 119882threshold where 119894 isin 119862 119895 isin 119871

(IP 123)

119882final ge 119882threshold (IP 124)

For each core node when

120573 (120588defense 120591hops 120596degree 119904priority119894

) ge 120573threshold

where 119894 isin 119878

(IP 125)

the defender can activate the reactive defense mechanismsThe goal of the objective function is to minimize the

compromised service probability which is modeled as theweighted total of successful attacks divided by the totalweighted number of attacks The result of an attack is deter-mined by 119879

119894119895(997888119863119894997888997888119860119894119895) For each service the defender con-

structs a defense configuration including defense resource

allocation anddefending strategies to oppose attackers target-ing the service with different attack configurations includingattacker attributes strategies and transition rules Not onlymalicious attacks but also QoS issues are taken into consider-ation

Equation (IP 11) stands for the feasibility of the defenseconfiguration of each service For the attacking side (IP 12)

denotes that the attack configuration should be feasibleEquation (IP 16) denotes that the summation of defenseresources spent should not exceed total budget 119861 Equations(IP 17)sim(IP 119) jointly restrain the budget of each type ofdefense resource individually Equations (IP 120)sim(IP 122)

impose binary restrictions on decision variables Finally(IP 123)sim(IP 125) jointly represent that the performancereduction caused by either malicious attacks or activatingreactive defense mechanisms should not violate the QoSrequirement

3 Numerical Analysis

In this paper a scale-free network is constructed for evalua-tion since this structure is similar to real-world forms suchas the Internet The implementation algorithm is referencedfrom [24]

31 Simulation Environment Table 4 presents the systemexperiment parameters Defender-related parameters areillustrated in Table 5 The unit of budget is dollar Forattackers the parameters are shown in Table 6

The value of each attackerrsquos budget capability and aggres-siveness is governed by a normal distribution with differentlower and upper bounds

32 Numerical Result As mentioned previously the ContestSuccess Function is applied for quantifying vulnerabilityThevalue of contest intensity is classified into two groups scoresgreater than 1 and scores smaller than 1

321 Convergence The first issue to address before con-structing meaningful simulations is convergence In thispaper the convergence of data is considered as numericalstability While the magnitude of data vibrations is withinthe acceptable interval for example 02 the correspondingnumber of simulation times (119872) is set as the number ofevaluations for each attack and defense scenario

For rigorousness in convergence experiments the effectof contest intensity is jointly consideredThree different mag-nitudes are simulated on a 49 node scale-free network Forthe following experiments in this subsection the horizontalaxis represents the evaluation of the number of attacks andthe vertical axis stands for the network system compromisedprobability which is the objective function of the proposedmathematical model

Figures 4 and 5 show the result of 10000 simulations withdifferent contest intensity Here it is clear that the value ofservice compromised probability is unstable In Figures 6 and7 the vibration becomes alleviative but is still not convergentWhen the number of simulations is raised to 100000 as

8 Journal of Applied Mathematics

078

079

08

081

082

083

084

1000 2000 3000 4000 5000 6000 7000 8000 9000 10000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m contest intensity

Figure 4 Convergence test on 119898 lt 1 group for 10000 simulations

075076077078079

08081082083084

1000

4000

7000

1000

013

000

1600

019

000

2200

025

000

2800

031

000

3400

037

000

4000

043

000

4600

049

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 01

m = 03

m = 05

m contest intensity

Figure 5 Convergence test on 119898 gt 1 group for 10000 simulations

shown in Figures 8 and 9 there is a stable trend after 60000among all different values of contest intensity

From Figures 4 to 9 it is clear that the 60000 simulationsare a large enough number to give converging results amongall values of contest intensityTherefore 119872 is set to be 60000

322 Analysis of Key Factors Influencing Service CompromisedProbability Contest intensity has great influence on thenature of network attack and defense However as shown inFigure 10 there is no consistent tendency between contestintensity and service compromised probability The sameconclusions also appear in [8ndash10]

If the effects of contest intensity and attackerrsquos aggressive-ness are jointly considered there are some meaningful andexplainable results

In Figure 11 three value intervals of aggressivenessincluding 01 to 09 (average) 01 to 05 (less aggressive) and05 to 09 (aggressive) are simulated among different values ofcontest intensity It is clear that when both the effect of contestintensity and an attackrsquos aggressiveness are considered thereare consistent trends For aggressive attackers it is more

078

079

08

081

082

083

084

1000

4000

7000

1000

013

000

1600

019

000

2200

025

000

2800

031

000

3400

037

000

4000

043

000

4600

049

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m contest intensity

Figure 6 Convergence test on 119898 lt 1 group for 50000 simulations

075076077078079

08081082

1000

6000

1100

016

000

2100

026

000

3100

036

000

4100

046

000

5100

056

000

6100

066

000

7100

076

000

8100

086

000

9100

096

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 01

m = 03

m = 05

m contest intensity

Figure 7 Convergence test on 119898 gt 1 group for 50000 simulations

advantageous to have higher values of contest intensityAlternatively less aggressive attackers have leverage whenthe value of contest intensity is small However for averageattacks there is no clear tendency

The value of contest intensity is separated into high-valueand low-value groups Here Figure 12 illustrates the variationof service compromised probability in low-level contestintensity groups when facing less aggressive attackers Whilein Figure 12 the objective function value presents a lineardecreasing form Figure 13 demonstrates an exponentiallydecreasing from

Figures 14 and 15 also present a similar phenomenonwhen facing aggressive attackers the variation of servicecompromised probability shows an exponentially increasingtrend for contest intensity belonging to the low-level groupFor the high-level group the tendency is more linear

According to the previous results the key factors influ-encing service compromised probability include contestintensity and attack aggressivenessThese results are summa-rized in Figure 16

Journal of Applied Mathematics 9

075076077078079

08081082083

1000

6000

1100

016

000

2100

026

000

3100

036

000

4100

046

000

5100

056

000

6100

066

000

7100

076

000

8100

086

000

9100

096

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m contest intensity

Figure 8 Convergence test on119898 lt 1 group for 100000 simulations

076

077

078

079

08

081

082

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m = 01

m = 03

m = 05

Aggressiveness = 01sim09

m contest intensity

Figure 9 Convergence test on 119898 gt 1 group for 100000 simula-tions

4 Discussion of Results

Based on the simulation results some interesting and mean-ingful arguments are presented in this section

41 The Effectiveness of Resources Invested by the Defenderand Attackers Is Highly Dependent on the Nature of BattleThe objective function value shown in Figure 12 presents alinear decreasing form when the contest intensity belongsto a low-level group and the defender is dealing with lessaggressive attackers The reason is that the effectiveness ofresources invested by both players is insignificant Thus theservice compromised probability is less sensitive with contestintensity under ldquofight to win or dierdquo circumstances

Furthermore less aggressive attackers only invest fewresources into compromising a target With the same totalbudget they are capable of launching more attacks thanaggressive attackers Therefore the service compromisedprobability of less aggressive attackers is much higher thanmore aggressive attackers

00102030405

06

07

0809

1

Contest intensity m

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15 m = 17 m = 19m = 01 m = 03 m = 05

Aggressiveness = 01sim09Aggressiveness = 05sim09Aggressiveness = 01sim05

Figure 10 Service compromised probability under different contestintensity

075076077078079

08081082083084085086087

m = 01

m = 03

m = 05

Aggressiveness = 01sim05

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 11 Effect of Aggressiveness among Different Contest Inten-sity

In the case of ldquowinner takes allrdquo Figure 13 illustrates anexponentially decreasing trend among service compromisedprobability this is because the effectiveness of resourcesinvested is significant to the result of a battle With a largervalue of contest intensity the vantage of a defender againstless aggressive attackers is more obvious

On the contrary for aggressive attackers there is anexponentially increasing tendency under ldquofight to win ordierdquo circumstances Since the contest intensity serves asthe exponent of the Contest Success Function when thevalue increases the effectiveness of resources invested growsexponentially This is further shown in Figure 14

Nevertheless the exponential tendency does not appearthrough all values of contest intensity For the ldquowinner takesallrdquo circumstance in Figure 15 the increasing rate of service

10 Journal of Applied Mathematics

063064065066067068069

07071072073074075

m = 15

m = 17

m = 19

Aggressiveness = 01sim05

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 12 Service compromised probability of less aggressive at-tacker under 119898 lt 1 circumstance

0

01

02

03

04

05

06

07

m = 01

m = 03

m = 05

Aggressiveness = 05sim09

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 13 Service compromised probability of less aggressive at-tacker under 119898 gt 1 circumstance

085

086

087

088

089

09

m = 15

m = 17

m = 19

Aggressiveness = 05sim09

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 14 Service compromised probability of aggressive attackerunder 119898 lt 1 circumstance

0

02

04

06

08

1

Prob

abili

ty

Contest intensity mm = 15 m = 17 m = 19

m = 01 m = 03 m = 05

Aggressiveness = 01sim05Aggressiveness = 05sim09

Figure 15 Service compromised probability of aggressive attackerunder 119898 gt 1 circumstance

0

02

04

06

08

1

Prob

abili

ty

Contest intensity mm = 15 m = 17 m = 19

m = 01 m = 03 m = 05

Aggressiveness = 01sim05Aggressiveness = 05sim09

Figure 16 Comparison of service compromised probability underdiverse contest intensity and aggressiveness

compromised probability slows down when contest intensitybecomes higherThis is because although aggressive attackersprefer to gain an edge by spending more attack resourcesto compromise a target each compromise costs significantresources Thus aggressive attackers run out of budget veryquickly and the increasing trend is not exponential

42 Proactive Defense Is Advantageous under ldquoWinner TakesAllrdquo Circumstance According to previous discussions theeffectiveness of resources invested is significant under ldquowin-ner takes allrdquo circumstances For less aggressive attackers theperformance is poor since they only invest few resources onan attack Aggressive attackers tend to spend a larger quantityto compromise a target If a defender raises the quantity ofdefense resources on important nodes it effectively weakensattackers

Consequently regardless of whether defenders face eitheraggressive or less aggressive attackers a proactive defenseperforms better in deterring attackers

43 Reactive Defense Is Advantageous under ldquoFight to Winor Dierdquo Circumstance Similarly under the ldquofight to win

Journal of Applied Mathematics 11

or dierdquo circumstance the effectiveness of defense resourcesis insignificant No matter how many proactive defenseresources are invested there is only limited influence onthe objective function value In other words less aggressiveattackers can compromise a target even by only investingscarce attack resources For aggressive attackers since theyprefer spending a large quantity of resources on compromis-ing a victim they easily run out of resources before a targetservice is compromised

Based on this analysis it is advantageous for the defenderto apply reactive defense mechanisms against maliciousattackers under ldquofight to win or dierdquo circumstance

5 Conclusions

This paper models an attack and defense scenario thatinvolves high amounts of randomness as mathematical for-mulations where attackers are assumed to have incompleteinformation It further considers a virtualization environ-ment for helping relate these results to recent trends in cloudcomputing

According to the simulation results the outcome of acontest is influenced not only by the quantity of defenseresources invested on each node but also by the contestintensity An attackerrsquos aggressiveness is introduced as a newdimension and meaningful results are discovered Effectivedefense strategies are proposed in the discussion of theresults

For future works collaborative attacks should be takeninto consideration since the attack strategy discussed in thispaper is for individual attacks In other words there is onlyone attack targeting a victimrsquos network at a time Thus nosynergy is considered A more complicated collaborativeattack pattern is worth further study

Acknowledgment

This work was supported by the National Science CouncilTaiwan (Grant nos NSC 102-2221-E-002-104 and NSC 101-2218-E-011-009)

References

[1] IBM Internet Security Systems X-Force research and devel-opment team ldquoIBM X-Force 2010 Mid-Year Trend and RiskReportrdquo IBM August 2010

[2] R J Ellison D A Fisher R C Linger H F Lipson T Longstaffand N R Mead ldquoSurvivable network systems an emergingdisciplinerdquo Tech Rep CMUSEI-97-TR-013 1997

[3] S Roy C Ellis S Shiva D Dasgupta V Shandilya and Q WuldquoA survey of game theory as applied to network securityrdquo inProceedings of the 43rd Annual Hawaii International Conferenceon System Sciences (HICSS rsquo10) January 2010

[4] M N Lima A L D Santos and G Pujolle ldquoA survey of sur-vivability in mobile Ad hoc Networksrdquo IEEE CommunicationsSurveys and Tutorials vol 11 no 1 pp 66ndash77 2009

[5] Z Ma ldquoTowards a unified definition for reliability survivabilityand resilience (I) the conceptual framework inspired by thehandicap principle and ecological stabilityrdquo in Proceedings of theIEEE Aerospace Conference pp 1ndash12 March 2010

[6] F Xing and W Wang ldquoOn the survivability of wireless adHOC networks with node misbehaviors and failuresrdquo IEEETransactions on Dependable and Secure Computing vol 7 no3 pp 284ndash299 2010

[7] S Skaperdas ldquoContest success functionsrdquo EconomicTheory vol7 no 2 pp 283ndash290 1996

[8] G Levitin and K Hausken ldquoFalse targets efficiency in defensestrategyrdquo European Journal of Operational Research vol 194 no1 pp 155ndash162 2009

[9] K Hausken and G Levitin ldquoProtection vs false targets in seriessystemsrdquo Reliability Engineering and System Safety vol 94 no5 pp 973ndash981 2009

[10] G Levitin and K Hausken ldquoPreventive strike vs false targetsand protection in defense strategyrdquo Reliability Engineering andSystem Safety vol 96 no 8 pp 912ndash924 2011

[11] J Hirshleifer ldquoConflict and rent-seeking success functions ratiovs difference models of relative successrdquo Public Choice vol 63no 2 pp 101ndash112 1989

[12] J Hirshleifer ldquoThe paradox of powerrdquo Economics and Politicsvol 3 pp 177ndash200 1993

[13] J Archer A Boehme D Cullinane P Kurtz N Puhlmannand J Reavis ldquoTop Threats to Cloud Computing V 10rdquo CloudSecurity Alliance March 2010

[14] H Debar F Pouget and M Dacier ldquoWhite paper lsquoHoney-pot Honeynet Honeytoken Terminological issuesrsquordquo InstitutEurecom Research Report RR-03-081 2003

[15] B Cheswick ldquoAn evening with berferd in which a cracker islured endured and studiedrdquo in Proceedings of the USENIXConference pp 163ndash174 USENIX 1992

[16] C Seifert I Welch and P Komisarczuk ldquoTaxonomy of honey-potsrdquo Tech Rep CS-TR-0612 2006

[17] M H y Lopez and C F L Resendez ldquoHoneypots basicconcepts classification and educational use as resources ininformation security education and coursesrdquo in Proceedings ofthe Informing Science and IT Education Conference 2008

[18] Y Huang D Arsenault and A Sood ldquoClosing cluster attackwindows through server redundancy and rotationsrdquo in Pro-ceedings of the 6th IEEE International Symposium on ClusterComputing and the Grid (CCGRID rsquo06) May 2006

[19] YHuang D Arsenault andA Sood ldquoIncorruptible self-cleans-ing intrusion tolerance and its application to DNS securityrdquoJournal of Networks vol 1 no 5 pp 21ndash30 2006

[20] M Smith C Schridde and B Freisleben ldquoSecuring stateful gridservers through virtual server rotationrdquo in Proceedings of the17th International Symposium on High Performance DistributedComputing (HPDC rsquo08) pp 11ndash22 June 2008

[21] F Y-S Lin Y-S Wang and P-H Tsang ldquoEfficient defensestrategies to minimize attackersrsquo success probabilities in hon-eynetrdquo in Proceedings of the 6th International Conference onInformation Assurance and Security (IAS rsquo10) pp 80ndash85 August2010

[22] F Y-S Lin Y-S Wang P-H Tsang and J-P Lo ldquoRedundancyand defense resource allocation algorithms to assure servicecontinuity against natural disasters and intelligent attacksrdquo inProceedings of the 5th International Conference on BroadbandWireless Computing Communication andApplications (BWCCArsquo10) pp 206ndash213 November 2010

[23] F Cohen ldquoManaging network security attack and defencestrategiesrdquo Network Security vol 1999 no 7 pp 7ndash11 1999

[24] S Nagaraja and R Anderson ldquoDynamic topologies for robustscale-free networksrdquo Bio-Inspired Computing and Communica-tion vol 5151 pp 411ndash426 2008

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

Journal of Applied Mathematics 7

119908 times 119890 + 119900 times 119862 +

sum119894isin119873

sum119895isin119873

119892 (119902119894119895)

2le 119861NL (IP 18)

sum

119894isin119873

119899119894le 119861proactive (IP 19)

sum

119894isin119872

V (119897119894) + 119901 times sum

119894isin119872

119897119894times 119896119894le 119861virtualized (IP 110)

sum

119894isin119875

119909119894times ℎ (120575

119894 120576119894) + sum

119895isin119876

119910119895

times 119891 (120575119895 120579119895)

+ sum

119894isin119873

sum

119895isin119873

119909119894times 119910119895

times 119905 (120575119894 120576119894 120579119895) le 119861honeypot

(IP 111)

sum

119894isin119873

119911119894times 119903 le 119861reconfig (IP 112)

119908 times 119890 ge 0 (IP 113)

119892 (119902119894119895) ge 0 forall119894 119895 isin 119873 (IP 114)

119899119894ge 0 forall119894 isin 119873 (IP 115)

V (119897119894) ge 0 forall119894 isin 119872 (IP 116)

ℎ (120575119894 120576119894) ge 0 forall119894 isin 119875 (IP 117)

119891 (120575119895 120579119895) ge 0 forall119895 isin 119876 (IP 118)

119905 (120575119894 120576119894 120579119895) ge 0 forall119894 isin 119873 (IP 119)

119909119894= 0 or 1 forall119894 isin 119873 (IP 120)

119910119894= 0 or 1 forall119894 isin 119873 (IP 121)

119911119894= 0 or 1 forall119894 isin 119873 (IP 122)

verbal constraints

int119884

119910=1[119882 (119866core119894 119880link119895 119870effect 119868effect 119869effect 119874tocore)] 119889119910

119884

ge 119882threshold where 119894 isin 119862 119895 isin 119871

(IP 123)

119882final ge 119882threshold (IP 124)

For each core node when

120573 (120588defense 120591hops 120596degree 119904priority119894

) ge 120573threshold

where 119894 isin 119878

(IP 125)

the defender can activate the reactive defense mechanismsThe goal of the objective function is to minimize the

compromised service probability which is modeled as theweighted total of successful attacks divided by the totalweighted number of attacks The result of an attack is deter-mined by 119879

119894119895(997888119863119894997888997888119860119894119895) For each service the defender con-

structs a defense configuration including defense resource

allocation anddefending strategies to oppose attackers target-ing the service with different attack configurations includingattacker attributes strategies and transition rules Not onlymalicious attacks but also QoS issues are taken into consider-ation

Equation (IP 11) stands for the feasibility of the defenseconfiguration of each service For the attacking side (IP 12)

denotes that the attack configuration should be feasibleEquation (IP 16) denotes that the summation of defenseresources spent should not exceed total budget 119861 Equations(IP 17)sim(IP 119) jointly restrain the budget of each type ofdefense resource individually Equations (IP 120)sim(IP 122)

impose binary restrictions on decision variables Finally(IP 123)sim(IP 125) jointly represent that the performancereduction caused by either malicious attacks or activatingreactive defense mechanisms should not violate the QoSrequirement

3 Numerical Analysis

In this paper a scale-free network is constructed for evalua-tion since this structure is similar to real-world forms suchas the Internet The implementation algorithm is referencedfrom [24]

31 Simulation Environment Table 4 presents the systemexperiment parameters Defender-related parameters areillustrated in Table 5 The unit of budget is dollar Forattackers the parameters are shown in Table 6

The value of each attackerrsquos budget capability and aggres-siveness is governed by a normal distribution with differentlower and upper bounds

32 Numerical Result As mentioned previously the ContestSuccess Function is applied for quantifying vulnerabilityThevalue of contest intensity is classified into two groups scoresgreater than 1 and scores smaller than 1

321 Convergence The first issue to address before con-structing meaningful simulations is convergence In thispaper the convergence of data is considered as numericalstability While the magnitude of data vibrations is withinthe acceptable interval for example 02 the correspondingnumber of simulation times (119872) is set as the number ofevaluations for each attack and defense scenario

For rigorousness in convergence experiments the effectof contest intensity is jointly consideredThree different mag-nitudes are simulated on a 49 node scale-free network Forthe following experiments in this subsection the horizontalaxis represents the evaluation of the number of attacks andthe vertical axis stands for the network system compromisedprobability which is the objective function of the proposedmathematical model

Figures 4 and 5 show the result of 10000 simulations withdifferent contest intensity Here it is clear that the value ofservice compromised probability is unstable In Figures 6 and7 the vibration becomes alleviative but is still not convergentWhen the number of simulations is raised to 100000 as

8 Journal of Applied Mathematics

078

079

08

081

082

083

084

1000 2000 3000 4000 5000 6000 7000 8000 9000 10000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m contest intensity

Figure 4 Convergence test on 119898 lt 1 group for 10000 simulations

075076077078079

08081082083084

1000

4000

7000

1000

013

000

1600

019

000

2200

025

000

2800

031

000

3400

037

000

4000

043

000

4600

049

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 01

m = 03

m = 05

m contest intensity

Figure 5 Convergence test on 119898 gt 1 group for 10000 simulations

shown in Figures 8 and 9 there is a stable trend after 60000among all different values of contest intensity

From Figures 4 to 9 it is clear that the 60000 simulationsare a large enough number to give converging results amongall values of contest intensityTherefore 119872 is set to be 60000

322 Analysis of Key Factors Influencing Service CompromisedProbability Contest intensity has great influence on thenature of network attack and defense However as shown inFigure 10 there is no consistent tendency between contestintensity and service compromised probability The sameconclusions also appear in [8ndash10]

If the effects of contest intensity and attackerrsquos aggressive-ness are jointly considered there are some meaningful andexplainable results

In Figure 11 three value intervals of aggressivenessincluding 01 to 09 (average) 01 to 05 (less aggressive) and05 to 09 (aggressive) are simulated among different values ofcontest intensity It is clear that when both the effect of contestintensity and an attackrsquos aggressiveness are considered thereare consistent trends For aggressive attackers it is more

078

079

08

081

082

083

084

1000

4000

7000

1000

013

000

1600

019

000

2200

025

000

2800

031

000

3400

037

000

4000

043

000

4600

049

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m contest intensity

Figure 6 Convergence test on 119898 lt 1 group for 50000 simulations

075076077078079

08081082

1000

6000

1100

016

000

2100

026

000

3100

036

000

4100

046

000

5100

056

000

6100

066

000

7100

076

000

8100

086

000

9100

096

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 01

m = 03

m = 05

m contest intensity

Figure 7 Convergence test on 119898 gt 1 group for 50000 simulations

advantageous to have higher values of contest intensityAlternatively less aggressive attackers have leverage whenthe value of contest intensity is small However for averageattacks there is no clear tendency

The value of contest intensity is separated into high-valueand low-value groups Here Figure 12 illustrates the variationof service compromised probability in low-level contestintensity groups when facing less aggressive attackers Whilein Figure 12 the objective function value presents a lineardecreasing form Figure 13 demonstrates an exponentiallydecreasing from

Figures 14 and 15 also present a similar phenomenonwhen facing aggressive attackers the variation of servicecompromised probability shows an exponentially increasingtrend for contest intensity belonging to the low-level groupFor the high-level group the tendency is more linear

According to the previous results the key factors influ-encing service compromised probability include contestintensity and attack aggressivenessThese results are summa-rized in Figure 16

Journal of Applied Mathematics 9

075076077078079

08081082083

1000

6000

1100

016

000

2100

026

000

3100

036

000

4100

046

000

5100

056

000

6100

066

000

7100

076

000

8100

086

000

9100

096

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m contest intensity

Figure 8 Convergence test on119898 lt 1 group for 100000 simulations

076

077

078

079

08

081

082

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m = 01

m = 03

m = 05

Aggressiveness = 01sim09

m contest intensity

Figure 9 Convergence test on 119898 gt 1 group for 100000 simula-tions

4 Discussion of Results

Based on the simulation results some interesting and mean-ingful arguments are presented in this section

41 The Effectiveness of Resources Invested by the Defenderand Attackers Is Highly Dependent on the Nature of BattleThe objective function value shown in Figure 12 presents alinear decreasing form when the contest intensity belongsto a low-level group and the defender is dealing with lessaggressive attackers The reason is that the effectiveness ofresources invested by both players is insignificant Thus theservice compromised probability is less sensitive with contestintensity under ldquofight to win or dierdquo circumstances

Furthermore less aggressive attackers only invest fewresources into compromising a target With the same totalbudget they are capable of launching more attacks thanaggressive attackers Therefore the service compromisedprobability of less aggressive attackers is much higher thanmore aggressive attackers

00102030405

06

07

0809

1

Contest intensity m

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15 m = 17 m = 19m = 01 m = 03 m = 05

Aggressiveness = 01sim09Aggressiveness = 05sim09Aggressiveness = 01sim05

Figure 10 Service compromised probability under different contestintensity

075076077078079

08081082083084085086087

m = 01

m = 03

m = 05

Aggressiveness = 01sim05

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 11 Effect of Aggressiveness among Different Contest Inten-sity

In the case of ldquowinner takes allrdquo Figure 13 illustrates anexponentially decreasing trend among service compromisedprobability this is because the effectiveness of resourcesinvested is significant to the result of a battle With a largervalue of contest intensity the vantage of a defender againstless aggressive attackers is more obvious

On the contrary for aggressive attackers there is anexponentially increasing tendency under ldquofight to win ordierdquo circumstances Since the contest intensity serves asthe exponent of the Contest Success Function when thevalue increases the effectiveness of resources invested growsexponentially This is further shown in Figure 14

Nevertheless the exponential tendency does not appearthrough all values of contest intensity For the ldquowinner takesallrdquo circumstance in Figure 15 the increasing rate of service

10 Journal of Applied Mathematics

063064065066067068069

07071072073074075

m = 15

m = 17

m = 19

Aggressiveness = 01sim05

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 12 Service compromised probability of less aggressive at-tacker under 119898 lt 1 circumstance

0

01

02

03

04

05

06

07

m = 01

m = 03

m = 05

Aggressiveness = 05sim09

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 13 Service compromised probability of less aggressive at-tacker under 119898 gt 1 circumstance

085

086

087

088

089

09

m = 15

m = 17

m = 19

Aggressiveness = 05sim09

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 14 Service compromised probability of aggressive attackerunder 119898 lt 1 circumstance

0

02

04

06

08

1

Prob

abili

ty

Contest intensity mm = 15 m = 17 m = 19

m = 01 m = 03 m = 05

Aggressiveness = 01sim05Aggressiveness = 05sim09

Figure 15 Service compromised probability of aggressive attackerunder 119898 gt 1 circumstance

0

02

04

06

08

1

Prob

abili

ty

Contest intensity mm = 15 m = 17 m = 19

m = 01 m = 03 m = 05

Aggressiveness = 01sim05Aggressiveness = 05sim09

Figure 16 Comparison of service compromised probability underdiverse contest intensity and aggressiveness

compromised probability slows down when contest intensitybecomes higherThis is because although aggressive attackersprefer to gain an edge by spending more attack resourcesto compromise a target each compromise costs significantresources Thus aggressive attackers run out of budget veryquickly and the increasing trend is not exponential

42 Proactive Defense Is Advantageous under ldquoWinner TakesAllrdquo Circumstance According to previous discussions theeffectiveness of resources invested is significant under ldquowin-ner takes allrdquo circumstances For less aggressive attackers theperformance is poor since they only invest few resources onan attack Aggressive attackers tend to spend a larger quantityto compromise a target If a defender raises the quantity ofdefense resources on important nodes it effectively weakensattackers

Consequently regardless of whether defenders face eitheraggressive or less aggressive attackers a proactive defenseperforms better in deterring attackers

43 Reactive Defense Is Advantageous under ldquoFight to Winor Dierdquo Circumstance Similarly under the ldquofight to win

Journal of Applied Mathematics 11

or dierdquo circumstance the effectiveness of defense resourcesis insignificant No matter how many proactive defenseresources are invested there is only limited influence onthe objective function value In other words less aggressiveattackers can compromise a target even by only investingscarce attack resources For aggressive attackers since theyprefer spending a large quantity of resources on compromis-ing a victim they easily run out of resources before a targetservice is compromised

Based on this analysis it is advantageous for the defenderto apply reactive defense mechanisms against maliciousattackers under ldquofight to win or dierdquo circumstance

5 Conclusions

This paper models an attack and defense scenario thatinvolves high amounts of randomness as mathematical for-mulations where attackers are assumed to have incompleteinformation It further considers a virtualization environ-ment for helping relate these results to recent trends in cloudcomputing

According to the simulation results the outcome of acontest is influenced not only by the quantity of defenseresources invested on each node but also by the contestintensity An attackerrsquos aggressiveness is introduced as a newdimension and meaningful results are discovered Effectivedefense strategies are proposed in the discussion of theresults

For future works collaborative attacks should be takeninto consideration since the attack strategy discussed in thispaper is for individual attacks In other words there is onlyone attack targeting a victimrsquos network at a time Thus nosynergy is considered A more complicated collaborativeattack pattern is worth further study

Acknowledgment

This work was supported by the National Science CouncilTaiwan (Grant nos NSC 102-2221-E-002-104 and NSC 101-2218-E-011-009)

References

[1] IBM Internet Security Systems X-Force research and devel-opment team ldquoIBM X-Force 2010 Mid-Year Trend and RiskReportrdquo IBM August 2010

[2] R J Ellison D A Fisher R C Linger H F Lipson T Longstaffand N R Mead ldquoSurvivable network systems an emergingdisciplinerdquo Tech Rep CMUSEI-97-TR-013 1997

[3] S Roy C Ellis S Shiva D Dasgupta V Shandilya and Q WuldquoA survey of game theory as applied to network securityrdquo inProceedings of the 43rd Annual Hawaii International Conferenceon System Sciences (HICSS rsquo10) January 2010

[4] M N Lima A L D Santos and G Pujolle ldquoA survey of sur-vivability in mobile Ad hoc Networksrdquo IEEE CommunicationsSurveys and Tutorials vol 11 no 1 pp 66ndash77 2009

[5] Z Ma ldquoTowards a unified definition for reliability survivabilityand resilience (I) the conceptual framework inspired by thehandicap principle and ecological stabilityrdquo in Proceedings of theIEEE Aerospace Conference pp 1ndash12 March 2010

[6] F Xing and W Wang ldquoOn the survivability of wireless adHOC networks with node misbehaviors and failuresrdquo IEEETransactions on Dependable and Secure Computing vol 7 no3 pp 284ndash299 2010

[7] S Skaperdas ldquoContest success functionsrdquo EconomicTheory vol7 no 2 pp 283ndash290 1996

[8] G Levitin and K Hausken ldquoFalse targets efficiency in defensestrategyrdquo European Journal of Operational Research vol 194 no1 pp 155ndash162 2009

[9] K Hausken and G Levitin ldquoProtection vs false targets in seriessystemsrdquo Reliability Engineering and System Safety vol 94 no5 pp 973ndash981 2009

[10] G Levitin and K Hausken ldquoPreventive strike vs false targetsand protection in defense strategyrdquo Reliability Engineering andSystem Safety vol 96 no 8 pp 912ndash924 2011

[11] J Hirshleifer ldquoConflict and rent-seeking success functions ratiovs difference models of relative successrdquo Public Choice vol 63no 2 pp 101ndash112 1989

[12] J Hirshleifer ldquoThe paradox of powerrdquo Economics and Politicsvol 3 pp 177ndash200 1993

[13] J Archer A Boehme D Cullinane P Kurtz N Puhlmannand J Reavis ldquoTop Threats to Cloud Computing V 10rdquo CloudSecurity Alliance March 2010

[14] H Debar F Pouget and M Dacier ldquoWhite paper lsquoHoney-pot Honeynet Honeytoken Terminological issuesrsquordquo InstitutEurecom Research Report RR-03-081 2003

[15] B Cheswick ldquoAn evening with berferd in which a cracker islured endured and studiedrdquo in Proceedings of the USENIXConference pp 163ndash174 USENIX 1992

[16] C Seifert I Welch and P Komisarczuk ldquoTaxonomy of honey-potsrdquo Tech Rep CS-TR-0612 2006

[17] M H y Lopez and C F L Resendez ldquoHoneypots basicconcepts classification and educational use as resources ininformation security education and coursesrdquo in Proceedings ofthe Informing Science and IT Education Conference 2008

[18] Y Huang D Arsenault and A Sood ldquoClosing cluster attackwindows through server redundancy and rotationsrdquo in Pro-ceedings of the 6th IEEE International Symposium on ClusterComputing and the Grid (CCGRID rsquo06) May 2006

[19] YHuang D Arsenault andA Sood ldquoIncorruptible self-cleans-ing intrusion tolerance and its application to DNS securityrdquoJournal of Networks vol 1 no 5 pp 21ndash30 2006

[20] M Smith C Schridde and B Freisleben ldquoSecuring stateful gridservers through virtual server rotationrdquo in Proceedings of the17th International Symposium on High Performance DistributedComputing (HPDC rsquo08) pp 11ndash22 June 2008

[21] F Y-S Lin Y-S Wang and P-H Tsang ldquoEfficient defensestrategies to minimize attackersrsquo success probabilities in hon-eynetrdquo in Proceedings of the 6th International Conference onInformation Assurance and Security (IAS rsquo10) pp 80ndash85 August2010

[22] F Y-S Lin Y-S Wang P-H Tsang and J-P Lo ldquoRedundancyand defense resource allocation algorithms to assure servicecontinuity against natural disasters and intelligent attacksrdquo inProceedings of the 5th International Conference on BroadbandWireless Computing Communication andApplications (BWCCArsquo10) pp 206ndash213 November 2010

[23] F Cohen ldquoManaging network security attack and defencestrategiesrdquo Network Security vol 1999 no 7 pp 7ndash11 1999

[24] S Nagaraja and R Anderson ldquoDynamic topologies for robustscale-free networksrdquo Bio-Inspired Computing and Communica-tion vol 5151 pp 411ndash426 2008

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

8 Journal of Applied Mathematics

078

079

08

081

082

083

084

1000 2000 3000 4000 5000 6000 7000 8000 9000 10000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m contest intensity

Figure 4 Convergence test on 119898 lt 1 group for 10000 simulations

075076077078079

08081082083084

1000

4000

7000

1000

013

000

1600

019

000

2200

025

000

2800

031

000

3400

037

000

4000

043

000

4600

049

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 01

m = 03

m = 05

m contest intensity

Figure 5 Convergence test on 119898 gt 1 group for 10000 simulations

shown in Figures 8 and 9 there is a stable trend after 60000among all different values of contest intensity

From Figures 4 to 9 it is clear that the 60000 simulationsare a large enough number to give converging results amongall values of contest intensityTherefore 119872 is set to be 60000

322 Analysis of Key Factors Influencing Service CompromisedProbability Contest intensity has great influence on thenature of network attack and defense However as shown inFigure 10 there is no consistent tendency between contestintensity and service compromised probability The sameconclusions also appear in [8ndash10]

If the effects of contest intensity and attackerrsquos aggressive-ness are jointly considered there are some meaningful andexplainable results

In Figure 11 three value intervals of aggressivenessincluding 01 to 09 (average) 01 to 05 (less aggressive) and05 to 09 (aggressive) are simulated among different values ofcontest intensity It is clear that when both the effect of contestintensity and an attackrsquos aggressiveness are considered thereare consistent trends For aggressive attackers it is more

078

079

08

081

082

083

084

1000

4000

7000

1000

013

000

1600

019

000

2200

025

000

2800

031

000

3400

037

000

4000

043

000

4600

049

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m contest intensity

Figure 6 Convergence test on 119898 lt 1 group for 50000 simulations

075076077078079

08081082

1000

6000

1100

016

000

2100

026

000

3100

036

000

4100

046

000

5100

056

000

6100

066

000

7100

076

000

8100

086

000

9100

096

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 01

m = 03

m = 05

m contest intensity

Figure 7 Convergence test on 119898 gt 1 group for 50000 simulations

advantageous to have higher values of contest intensityAlternatively less aggressive attackers have leverage whenthe value of contest intensity is small However for averageattacks there is no clear tendency

The value of contest intensity is separated into high-valueand low-value groups Here Figure 12 illustrates the variationof service compromised probability in low-level contestintensity groups when facing less aggressive attackers Whilein Figure 12 the objective function value presents a lineardecreasing form Figure 13 demonstrates an exponentiallydecreasing from

Figures 14 and 15 also present a similar phenomenonwhen facing aggressive attackers the variation of servicecompromised probability shows an exponentially increasingtrend for contest intensity belonging to the low-level groupFor the high-level group the tendency is more linear

According to the previous results the key factors influ-encing service compromised probability include contestintensity and attack aggressivenessThese results are summa-rized in Figure 16

Journal of Applied Mathematics 9

075076077078079

08081082083

1000

6000

1100

016

000

2100

026

000

3100

036

000

4100

046

000

5100

056

000

6100

066

000

7100

076

000

8100

086

000

9100

096

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m contest intensity

Figure 8 Convergence test on119898 lt 1 group for 100000 simulations

076

077

078

079

08

081

082

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m = 01

m = 03

m = 05

Aggressiveness = 01sim09

m contest intensity

Figure 9 Convergence test on 119898 gt 1 group for 100000 simula-tions

4 Discussion of Results

Based on the simulation results some interesting and mean-ingful arguments are presented in this section

41 The Effectiveness of Resources Invested by the Defenderand Attackers Is Highly Dependent on the Nature of BattleThe objective function value shown in Figure 12 presents alinear decreasing form when the contest intensity belongsto a low-level group and the defender is dealing with lessaggressive attackers The reason is that the effectiveness ofresources invested by both players is insignificant Thus theservice compromised probability is less sensitive with contestintensity under ldquofight to win or dierdquo circumstances

Furthermore less aggressive attackers only invest fewresources into compromising a target With the same totalbudget they are capable of launching more attacks thanaggressive attackers Therefore the service compromisedprobability of less aggressive attackers is much higher thanmore aggressive attackers

00102030405

06

07

0809

1

Contest intensity m

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15 m = 17 m = 19m = 01 m = 03 m = 05

Aggressiveness = 01sim09Aggressiveness = 05sim09Aggressiveness = 01sim05

Figure 10 Service compromised probability under different contestintensity

075076077078079

08081082083084085086087

m = 01

m = 03

m = 05

Aggressiveness = 01sim05

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 11 Effect of Aggressiveness among Different Contest Inten-sity

In the case of ldquowinner takes allrdquo Figure 13 illustrates anexponentially decreasing trend among service compromisedprobability this is because the effectiveness of resourcesinvested is significant to the result of a battle With a largervalue of contest intensity the vantage of a defender againstless aggressive attackers is more obvious

On the contrary for aggressive attackers there is anexponentially increasing tendency under ldquofight to win ordierdquo circumstances Since the contest intensity serves asthe exponent of the Contest Success Function when thevalue increases the effectiveness of resources invested growsexponentially This is further shown in Figure 14

Nevertheless the exponential tendency does not appearthrough all values of contest intensity For the ldquowinner takesallrdquo circumstance in Figure 15 the increasing rate of service

10 Journal of Applied Mathematics

063064065066067068069

07071072073074075

m = 15

m = 17

m = 19

Aggressiveness = 01sim05

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 12 Service compromised probability of less aggressive at-tacker under 119898 lt 1 circumstance

0

01

02

03

04

05

06

07

m = 01

m = 03

m = 05

Aggressiveness = 05sim09

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 13 Service compromised probability of less aggressive at-tacker under 119898 gt 1 circumstance

085

086

087

088

089

09

m = 15

m = 17

m = 19

Aggressiveness = 05sim09

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 14 Service compromised probability of aggressive attackerunder 119898 lt 1 circumstance

0

02

04

06

08

1

Prob

abili

ty

Contest intensity mm = 15 m = 17 m = 19

m = 01 m = 03 m = 05

Aggressiveness = 01sim05Aggressiveness = 05sim09

Figure 15 Service compromised probability of aggressive attackerunder 119898 gt 1 circumstance

0

02

04

06

08

1

Prob

abili

ty

Contest intensity mm = 15 m = 17 m = 19

m = 01 m = 03 m = 05

Aggressiveness = 01sim05Aggressiveness = 05sim09

Figure 16 Comparison of service compromised probability underdiverse contest intensity and aggressiveness

compromised probability slows down when contest intensitybecomes higherThis is because although aggressive attackersprefer to gain an edge by spending more attack resourcesto compromise a target each compromise costs significantresources Thus aggressive attackers run out of budget veryquickly and the increasing trend is not exponential

42 Proactive Defense Is Advantageous under ldquoWinner TakesAllrdquo Circumstance According to previous discussions theeffectiveness of resources invested is significant under ldquowin-ner takes allrdquo circumstances For less aggressive attackers theperformance is poor since they only invest few resources onan attack Aggressive attackers tend to spend a larger quantityto compromise a target If a defender raises the quantity ofdefense resources on important nodes it effectively weakensattackers

Consequently regardless of whether defenders face eitheraggressive or less aggressive attackers a proactive defenseperforms better in deterring attackers

43 Reactive Defense Is Advantageous under ldquoFight to Winor Dierdquo Circumstance Similarly under the ldquofight to win

Journal of Applied Mathematics 11

or dierdquo circumstance the effectiveness of defense resourcesis insignificant No matter how many proactive defenseresources are invested there is only limited influence onthe objective function value In other words less aggressiveattackers can compromise a target even by only investingscarce attack resources For aggressive attackers since theyprefer spending a large quantity of resources on compromis-ing a victim they easily run out of resources before a targetservice is compromised

Based on this analysis it is advantageous for the defenderto apply reactive defense mechanisms against maliciousattackers under ldquofight to win or dierdquo circumstance

5 Conclusions

This paper models an attack and defense scenario thatinvolves high amounts of randomness as mathematical for-mulations where attackers are assumed to have incompleteinformation It further considers a virtualization environ-ment for helping relate these results to recent trends in cloudcomputing

According to the simulation results the outcome of acontest is influenced not only by the quantity of defenseresources invested on each node but also by the contestintensity An attackerrsquos aggressiveness is introduced as a newdimension and meaningful results are discovered Effectivedefense strategies are proposed in the discussion of theresults

For future works collaborative attacks should be takeninto consideration since the attack strategy discussed in thispaper is for individual attacks In other words there is onlyone attack targeting a victimrsquos network at a time Thus nosynergy is considered A more complicated collaborativeattack pattern is worth further study

Acknowledgment

This work was supported by the National Science CouncilTaiwan (Grant nos NSC 102-2221-E-002-104 and NSC 101-2218-E-011-009)

References

[1] IBM Internet Security Systems X-Force research and devel-opment team ldquoIBM X-Force 2010 Mid-Year Trend and RiskReportrdquo IBM August 2010

[2] R J Ellison D A Fisher R C Linger H F Lipson T Longstaffand N R Mead ldquoSurvivable network systems an emergingdisciplinerdquo Tech Rep CMUSEI-97-TR-013 1997

[3] S Roy C Ellis S Shiva D Dasgupta V Shandilya and Q WuldquoA survey of game theory as applied to network securityrdquo inProceedings of the 43rd Annual Hawaii International Conferenceon System Sciences (HICSS rsquo10) January 2010

[4] M N Lima A L D Santos and G Pujolle ldquoA survey of sur-vivability in mobile Ad hoc Networksrdquo IEEE CommunicationsSurveys and Tutorials vol 11 no 1 pp 66ndash77 2009

[5] Z Ma ldquoTowards a unified definition for reliability survivabilityand resilience (I) the conceptual framework inspired by thehandicap principle and ecological stabilityrdquo in Proceedings of theIEEE Aerospace Conference pp 1ndash12 March 2010

[6] F Xing and W Wang ldquoOn the survivability of wireless adHOC networks with node misbehaviors and failuresrdquo IEEETransactions on Dependable and Secure Computing vol 7 no3 pp 284ndash299 2010

[7] S Skaperdas ldquoContest success functionsrdquo EconomicTheory vol7 no 2 pp 283ndash290 1996

[8] G Levitin and K Hausken ldquoFalse targets efficiency in defensestrategyrdquo European Journal of Operational Research vol 194 no1 pp 155ndash162 2009

[9] K Hausken and G Levitin ldquoProtection vs false targets in seriessystemsrdquo Reliability Engineering and System Safety vol 94 no5 pp 973ndash981 2009

[10] G Levitin and K Hausken ldquoPreventive strike vs false targetsand protection in defense strategyrdquo Reliability Engineering andSystem Safety vol 96 no 8 pp 912ndash924 2011

[11] J Hirshleifer ldquoConflict and rent-seeking success functions ratiovs difference models of relative successrdquo Public Choice vol 63no 2 pp 101ndash112 1989

[12] J Hirshleifer ldquoThe paradox of powerrdquo Economics and Politicsvol 3 pp 177ndash200 1993

[13] J Archer A Boehme D Cullinane P Kurtz N Puhlmannand J Reavis ldquoTop Threats to Cloud Computing V 10rdquo CloudSecurity Alliance March 2010

[14] H Debar F Pouget and M Dacier ldquoWhite paper lsquoHoney-pot Honeynet Honeytoken Terminological issuesrsquordquo InstitutEurecom Research Report RR-03-081 2003

[15] B Cheswick ldquoAn evening with berferd in which a cracker islured endured and studiedrdquo in Proceedings of the USENIXConference pp 163ndash174 USENIX 1992

[16] C Seifert I Welch and P Komisarczuk ldquoTaxonomy of honey-potsrdquo Tech Rep CS-TR-0612 2006

[17] M H y Lopez and C F L Resendez ldquoHoneypots basicconcepts classification and educational use as resources ininformation security education and coursesrdquo in Proceedings ofthe Informing Science and IT Education Conference 2008

[18] Y Huang D Arsenault and A Sood ldquoClosing cluster attackwindows through server redundancy and rotationsrdquo in Pro-ceedings of the 6th IEEE International Symposium on ClusterComputing and the Grid (CCGRID rsquo06) May 2006

[19] YHuang D Arsenault andA Sood ldquoIncorruptible self-cleans-ing intrusion tolerance and its application to DNS securityrdquoJournal of Networks vol 1 no 5 pp 21ndash30 2006

[20] M Smith C Schridde and B Freisleben ldquoSecuring stateful gridservers through virtual server rotationrdquo in Proceedings of the17th International Symposium on High Performance DistributedComputing (HPDC rsquo08) pp 11ndash22 June 2008

[21] F Y-S Lin Y-S Wang and P-H Tsang ldquoEfficient defensestrategies to minimize attackersrsquo success probabilities in hon-eynetrdquo in Proceedings of the 6th International Conference onInformation Assurance and Security (IAS rsquo10) pp 80ndash85 August2010

[22] F Y-S Lin Y-S Wang P-H Tsang and J-P Lo ldquoRedundancyand defense resource allocation algorithms to assure servicecontinuity against natural disasters and intelligent attacksrdquo inProceedings of the 5th International Conference on BroadbandWireless Computing Communication andApplications (BWCCArsquo10) pp 206ndash213 November 2010

[23] F Cohen ldquoManaging network security attack and defencestrategiesrdquo Network Security vol 1999 no 7 pp 7ndash11 1999

[24] S Nagaraja and R Anderson ldquoDynamic topologies for robustscale-free networksrdquo Bio-Inspired Computing and Communica-tion vol 5151 pp 411ndash426 2008

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

Journal of Applied Mathematics 9

075076077078079

08081082083

1000

6000

1100

016

000

2100

026

000

3100

036

000

4100

046

000

5100

056

000

6100

066

000

7100

076

000

8100

086

000

9100

096

000

Evaluation times

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m contest intensity

Figure 8 Convergence test on119898 lt 1 group for 100000 simulations

076

077

078

079

08

081

082

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15

m = 17

m = 19

m = 01

m = 03

m = 05

Aggressiveness = 01sim09

m contest intensity

Figure 9 Convergence test on 119898 gt 1 group for 100000 simula-tions

4 Discussion of Results

Based on the simulation results some interesting and mean-ingful arguments are presented in this section

41 The Effectiveness of Resources Invested by the Defenderand Attackers Is Highly Dependent on the Nature of BattleThe objective function value shown in Figure 12 presents alinear decreasing form when the contest intensity belongsto a low-level group and the defender is dealing with lessaggressive attackers The reason is that the effectiveness ofresources invested by both players is insignificant Thus theservice compromised probability is less sensitive with contestintensity under ldquofight to win or dierdquo circumstances

Furthermore less aggressive attackers only invest fewresources into compromising a target With the same totalbudget they are capable of launching more attacks thanaggressive attackers Therefore the service compromisedprobability of less aggressive attackers is much higher thanmore aggressive attackers

00102030405

06

07

0809

1

Contest intensity m

Serv

ice c

ompr

omise

d pr

obab

ility

m = 15 m = 17 m = 19m = 01 m = 03 m = 05

Aggressiveness = 01sim09Aggressiveness = 05sim09Aggressiveness = 01sim05

Figure 10 Service compromised probability under different contestintensity

075076077078079

08081082083084085086087

m = 01

m = 03

m = 05

Aggressiveness = 01sim05

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 11 Effect of Aggressiveness among Different Contest Inten-sity

In the case of ldquowinner takes allrdquo Figure 13 illustrates anexponentially decreasing trend among service compromisedprobability this is because the effectiveness of resourcesinvested is significant to the result of a battle With a largervalue of contest intensity the vantage of a defender againstless aggressive attackers is more obvious

On the contrary for aggressive attackers there is anexponentially increasing tendency under ldquofight to win ordierdquo circumstances Since the contest intensity serves asthe exponent of the Contest Success Function when thevalue increases the effectiveness of resources invested growsexponentially This is further shown in Figure 14

Nevertheless the exponential tendency does not appearthrough all values of contest intensity For the ldquowinner takesallrdquo circumstance in Figure 15 the increasing rate of service

10 Journal of Applied Mathematics

063064065066067068069

07071072073074075

m = 15

m = 17

m = 19

Aggressiveness = 01sim05

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 12 Service compromised probability of less aggressive at-tacker under 119898 lt 1 circumstance

0

01

02

03

04

05

06

07

m = 01

m = 03

m = 05

Aggressiveness = 05sim09

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 13 Service compromised probability of less aggressive at-tacker under 119898 gt 1 circumstance

085

086

087

088

089

09

m = 15

m = 17

m = 19

Aggressiveness = 05sim09

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 14 Service compromised probability of aggressive attackerunder 119898 lt 1 circumstance

0

02

04

06

08

1

Prob

abili

ty

Contest intensity mm = 15 m = 17 m = 19

m = 01 m = 03 m = 05

Aggressiveness = 01sim05Aggressiveness = 05sim09

Figure 15 Service compromised probability of aggressive attackerunder 119898 gt 1 circumstance

0

02

04

06

08

1

Prob

abili

ty

Contest intensity mm = 15 m = 17 m = 19

m = 01 m = 03 m = 05

Aggressiveness = 01sim05Aggressiveness = 05sim09

Figure 16 Comparison of service compromised probability underdiverse contest intensity and aggressiveness

compromised probability slows down when contest intensitybecomes higherThis is because although aggressive attackersprefer to gain an edge by spending more attack resourcesto compromise a target each compromise costs significantresources Thus aggressive attackers run out of budget veryquickly and the increasing trend is not exponential

42 Proactive Defense Is Advantageous under ldquoWinner TakesAllrdquo Circumstance According to previous discussions theeffectiveness of resources invested is significant under ldquowin-ner takes allrdquo circumstances For less aggressive attackers theperformance is poor since they only invest few resources onan attack Aggressive attackers tend to spend a larger quantityto compromise a target If a defender raises the quantity ofdefense resources on important nodes it effectively weakensattackers

Consequently regardless of whether defenders face eitheraggressive or less aggressive attackers a proactive defenseperforms better in deterring attackers

43 Reactive Defense Is Advantageous under ldquoFight to Winor Dierdquo Circumstance Similarly under the ldquofight to win

Journal of Applied Mathematics 11

or dierdquo circumstance the effectiveness of defense resourcesis insignificant No matter how many proactive defenseresources are invested there is only limited influence onthe objective function value In other words less aggressiveattackers can compromise a target even by only investingscarce attack resources For aggressive attackers since theyprefer spending a large quantity of resources on compromis-ing a victim they easily run out of resources before a targetservice is compromised

Based on this analysis it is advantageous for the defenderto apply reactive defense mechanisms against maliciousattackers under ldquofight to win or dierdquo circumstance

5 Conclusions

This paper models an attack and defense scenario thatinvolves high amounts of randomness as mathematical for-mulations where attackers are assumed to have incompleteinformation It further considers a virtualization environ-ment for helping relate these results to recent trends in cloudcomputing

According to the simulation results the outcome of acontest is influenced not only by the quantity of defenseresources invested on each node but also by the contestintensity An attackerrsquos aggressiveness is introduced as a newdimension and meaningful results are discovered Effectivedefense strategies are proposed in the discussion of theresults

For future works collaborative attacks should be takeninto consideration since the attack strategy discussed in thispaper is for individual attacks In other words there is onlyone attack targeting a victimrsquos network at a time Thus nosynergy is considered A more complicated collaborativeattack pattern is worth further study

Acknowledgment

This work was supported by the National Science CouncilTaiwan (Grant nos NSC 102-2221-E-002-104 and NSC 101-2218-E-011-009)

References

[1] IBM Internet Security Systems X-Force research and devel-opment team ldquoIBM X-Force 2010 Mid-Year Trend and RiskReportrdquo IBM August 2010

[2] R J Ellison D A Fisher R C Linger H F Lipson T Longstaffand N R Mead ldquoSurvivable network systems an emergingdisciplinerdquo Tech Rep CMUSEI-97-TR-013 1997

[3] S Roy C Ellis S Shiva D Dasgupta V Shandilya and Q WuldquoA survey of game theory as applied to network securityrdquo inProceedings of the 43rd Annual Hawaii International Conferenceon System Sciences (HICSS rsquo10) January 2010

[4] M N Lima A L D Santos and G Pujolle ldquoA survey of sur-vivability in mobile Ad hoc Networksrdquo IEEE CommunicationsSurveys and Tutorials vol 11 no 1 pp 66ndash77 2009

[5] Z Ma ldquoTowards a unified definition for reliability survivabilityand resilience (I) the conceptual framework inspired by thehandicap principle and ecological stabilityrdquo in Proceedings of theIEEE Aerospace Conference pp 1ndash12 March 2010

[6] F Xing and W Wang ldquoOn the survivability of wireless adHOC networks with node misbehaviors and failuresrdquo IEEETransactions on Dependable and Secure Computing vol 7 no3 pp 284ndash299 2010

[7] S Skaperdas ldquoContest success functionsrdquo EconomicTheory vol7 no 2 pp 283ndash290 1996

[8] G Levitin and K Hausken ldquoFalse targets efficiency in defensestrategyrdquo European Journal of Operational Research vol 194 no1 pp 155ndash162 2009

[9] K Hausken and G Levitin ldquoProtection vs false targets in seriessystemsrdquo Reliability Engineering and System Safety vol 94 no5 pp 973ndash981 2009

[10] G Levitin and K Hausken ldquoPreventive strike vs false targetsand protection in defense strategyrdquo Reliability Engineering andSystem Safety vol 96 no 8 pp 912ndash924 2011

[11] J Hirshleifer ldquoConflict and rent-seeking success functions ratiovs difference models of relative successrdquo Public Choice vol 63no 2 pp 101ndash112 1989

[12] J Hirshleifer ldquoThe paradox of powerrdquo Economics and Politicsvol 3 pp 177ndash200 1993

[13] J Archer A Boehme D Cullinane P Kurtz N Puhlmannand J Reavis ldquoTop Threats to Cloud Computing V 10rdquo CloudSecurity Alliance March 2010

[14] H Debar F Pouget and M Dacier ldquoWhite paper lsquoHoney-pot Honeynet Honeytoken Terminological issuesrsquordquo InstitutEurecom Research Report RR-03-081 2003

[15] B Cheswick ldquoAn evening with berferd in which a cracker islured endured and studiedrdquo in Proceedings of the USENIXConference pp 163ndash174 USENIX 1992

[16] C Seifert I Welch and P Komisarczuk ldquoTaxonomy of honey-potsrdquo Tech Rep CS-TR-0612 2006

[17] M H y Lopez and C F L Resendez ldquoHoneypots basicconcepts classification and educational use as resources ininformation security education and coursesrdquo in Proceedings ofthe Informing Science and IT Education Conference 2008

[18] Y Huang D Arsenault and A Sood ldquoClosing cluster attackwindows through server redundancy and rotationsrdquo in Pro-ceedings of the 6th IEEE International Symposium on ClusterComputing and the Grid (CCGRID rsquo06) May 2006

[19] YHuang D Arsenault andA Sood ldquoIncorruptible self-cleans-ing intrusion tolerance and its application to DNS securityrdquoJournal of Networks vol 1 no 5 pp 21ndash30 2006

[20] M Smith C Schridde and B Freisleben ldquoSecuring stateful gridservers through virtual server rotationrdquo in Proceedings of the17th International Symposium on High Performance DistributedComputing (HPDC rsquo08) pp 11ndash22 June 2008

[21] F Y-S Lin Y-S Wang and P-H Tsang ldquoEfficient defensestrategies to minimize attackersrsquo success probabilities in hon-eynetrdquo in Proceedings of the 6th International Conference onInformation Assurance and Security (IAS rsquo10) pp 80ndash85 August2010

[22] F Y-S Lin Y-S Wang P-H Tsang and J-P Lo ldquoRedundancyand defense resource allocation algorithms to assure servicecontinuity against natural disasters and intelligent attacksrdquo inProceedings of the 5th International Conference on BroadbandWireless Computing Communication andApplications (BWCCArsquo10) pp 206ndash213 November 2010

[23] F Cohen ldquoManaging network security attack and defencestrategiesrdquo Network Security vol 1999 no 7 pp 7ndash11 1999

[24] S Nagaraja and R Anderson ldquoDynamic topologies for robustscale-free networksrdquo Bio-Inspired Computing and Communica-tion vol 5151 pp 411ndash426 2008

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

10 Journal of Applied Mathematics

063064065066067068069

07071072073074075

m = 15

m = 17

m = 19

Aggressiveness = 01sim05

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 12 Service compromised probability of less aggressive at-tacker under 119898 lt 1 circumstance

0

01

02

03

04

05

06

07

m = 01

m = 03

m = 05

Aggressiveness = 05sim09

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 13 Service compromised probability of less aggressive at-tacker under 119898 gt 1 circumstance

085

086

087

088

089

09

m = 15

m = 17

m = 19

Aggressiveness = 05sim09

Serv

ice c

ompr

omise

d pr

obab

ility

m contest intensity

Figure 14 Service compromised probability of aggressive attackerunder 119898 lt 1 circumstance

0

02

04

06

08

1

Prob

abili

ty

Contest intensity mm = 15 m = 17 m = 19

m = 01 m = 03 m = 05

Aggressiveness = 01sim05Aggressiveness = 05sim09

Figure 15 Service compromised probability of aggressive attackerunder 119898 gt 1 circumstance

0

02

04

06

08

1

Prob

abili

ty

Contest intensity mm = 15 m = 17 m = 19

m = 01 m = 03 m = 05

Aggressiveness = 01sim05Aggressiveness = 05sim09

Figure 16 Comparison of service compromised probability underdiverse contest intensity and aggressiveness

compromised probability slows down when contest intensitybecomes higherThis is because although aggressive attackersprefer to gain an edge by spending more attack resourcesto compromise a target each compromise costs significantresources Thus aggressive attackers run out of budget veryquickly and the increasing trend is not exponential

42 Proactive Defense Is Advantageous under ldquoWinner TakesAllrdquo Circumstance According to previous discussions theeffectiveness of resources invested is significant under ldquowin-ner takes allrdquo circumstances For less aggressive attackers theperformance is poor since they only invest few resources onan attack Aggressive attackers tend to spend a larger quantityto compromise a target If a defender raises the quantity ofdefense resources on important nodes it effectively weakensattackers

Consequently regardless of whether defenders face eitheraggressive or less aggressive attackers a proactive defenseperforms better in deterring attackers

43 Reactive Defense Is Advantageous under ldquoFight to Winor Dierdquo Circumstance Similarly under the ldquofight to win

Journal of Applied Mathematics 11

or dierdquo circumstance the effectiveness of defense resourcesis insignificant No matter how many proactive defenseresources are invested there is only limited influence onthe objective function value In other words less aggressiveattackers can compromise a target even by only investingscarce attack resources For aggressive attackers since theyprefer spending a large quantity of resources on compromis-ing a victim they easily run out of resources before a targetservice is compromised

Based on this analysis it is advantageous for the defenderto apply reactive defense mechanisms against maliciousattackers under ldquofight to win or dierdquo circumstance

5 Conclusions

This paper models an attack and defense scenario thatinvolves high amounts of randomness as mathematical for-mulations where attackers are assumed to have incompleteinformation It further considers a virtualization environ-ment for helping relate these results to recent trends in cloudcomputing

According to the simulation results the outcome of acontest is influenced not only by the quantity of defenseresources invested on each node but also by the contestintensity An attackerrsquos aggressiveness is introduced as a newdimension and meaningful results are discovered Effectivedefense strategies are proposed in the discussion of theresults

For future works collaborative attacks should be takeninto consideration since the attack strategy discussed in thispaper is for individual attacks In other words there is onlyone attack targeting a victimrsquos network at a time Thus nosynergy is considered A more complicated collaborativeattack pattern is worth further study

Acknowledgment

This work was supported by the National Science CouncilTaiwan (Grant nos NSC 102-2221-E-002-104 and NSC 101-2218-E-011-009)

References

[1] IBM Internet Security Systems X-Force research and devel-opment team ldquoIBM X-Force 2010 Mid-Year Trend and RiskReportrdquo IBM August 2010

[2] R J Ellison D A Fisher R C Linger H F Lipson T Longstaffand N R Mead ldquoSurvivable network systems an emergingdisciplinerdquo Tech Rep CMUSEI-97-TR-013 1997

[3] S Roy C Ellis S Shiva D Dasgupta V Shandilya and Q WuldquoA survey of game theory as applied to network securityrdquo inProceedings of the 43rd Annual Hawaii International Conferenceon System Sciences (HICSS rsquo10) January 2010

[4] M N Lima A L D Santos and G Pujolle ldquoA survey of sur-vivability in mobile Ad hoc Networksrdquo IEEE CommunicationsSurveys and Tutorials vol 11 no 1 pp 66ndash77 2009

[5] Z Ma ldquoTowards a unified definition for reliability survivabilityand resilience (I) the conceptual framework inspired by thehandicap principle and ecological stabilityrdquo in Proceedings of theIEEE Aerospace Conference pp 1ndash12 March 2010

[6] F Xing and W Wang ldquoOn the survivability of wireless adHOC networks with node misbehaviors and failuresrdquo IEEETransactions on Dependable and Secure Computing vol 7 no3 pp 284ndash299 2010

[7] S Skaperdas ldquoContest success functionsrdquo EconomicTheory vol7 no 2 pp 283ndash290 1996

[8] G Levitin and K Hausken ldquoFalse targets efficiency in defensestrategyrdquo European Journal of Operational Research vol 194 no1 pp 155ndash162 2009

[9] K Hausken and G Levitin ldquoProtection vs false targets in seriessystemsrdquo Reliability Engineering and System Safety vol 94 no5 pp 973ndash981 2009

[10] G Levitin and K Hausken ldquoPreventive strike vs false targetsand protection in defense strategyrdquo Reliability Engineering andSystem Safety vol 96 no 8 pp 912ndash924 2011

[11] J Hirshleifer ldquoConflict and rent-seeking success functions ratiovs difference models of relative successrdquo Public Choice vol 63no 2 pp 101ndash112 1989

[12] J Hirshleifer ldquoThe paradox of powerrdquo Economics and Politicsvol 3 pp 177ndash200 1993

[13] J Archer A Boehme D Cullinane P Kurtz N Puhlmannand J Reavis ldquoTop Threats to Cloud Computing V 10rdquo CloudSecurity Alliance March 2010

[14] H Debar F Pouget and M Dacier ldquoWhite paper lsquoHoney-pot Honeynet Honeytoken Terminological issuesrsquordquo InstitutEurecom Research Report RR-03-081 2003

[15] B Cheswick ldquoAn evening with berferd in which a cracker islured endured and studiedrdquo in Proceedings of the USENIXConference pp 163ndash174 USENIX 1992

[16] C Seifert I Welch and P Komisarczuk ldquoTaxonomy of honey-potsrdquo Tech Rep CS-TR-0612 2006

[17] M H y Lopez and C F L Resendez ldquoHoneypots basicconcepts classification and educational use as resources ininformation security education and coursesrdquo in Proceedings ofthe Informing Science and IT Education Conference 2008

[18] Y Huang D Arsenault and A Sood ldquoClosing cluster attackwindows through server redundancy and rotationsrdquo in Pro-ceedings of the 6th IEEE International Symposium on ClusterComputing and the Grid (CCGRID rsquo06) May 2006

[19] YHuang D Arsenault andA Sood ldquoIncorruptible self-cleans-ing intrusion tolerance and its application to DNS securityrdquoJournal of Networks vol 1 no 5 pp 21ndash30 2006

[20] M Smith C Schridde and B Freisleben ldquoSecuring stateful gridservers through virtual server rotationrdquo in Proceedings of the17th International Symposium on High Performance DistributedComputing (HPDC rsquo08) pp 11ndash22 June 2008

[21] F Y-S Lin Y-S Wang and P-H Tsang ldquoEfficient defensestrategies to minimize attackersrsquo success probabilities in hon-eynetrdquo in Proceedings of the 6th International Conference onInformation Assurance and Security (IAS rsquo10) pp 80ndash85 August2010

[22] F Y-S Lin Y-S Wang P-H Tsang and J-P Lo ldquoRedundancyand defense resource allocation algorithms to assure servicecontinuity against natural disasters and intelligent attacksrdquo inProceedings of the 5th International Conference on BroadbandWireless Computing Communication andApplications (BWCCArsquo10) pp 206ndash213 November 2010

[23] F Cohen ldquoManaging network security attack and defencestrategiesrdquo Network Security vol 1999 no 7 pp 7ndash11 1999

[24] S Nagaraja and R Anderson ldquoDynamic topologies for robustscale-free networksrdquo Bio-Inspired Computing and Communica-tion vol 5151 pp 411ndash426 2008

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

Journal of Applied Mathematics 11

or dierdquo circumstance the effectiveness of defense resourcesis insignificant No matter how many proactive defenseresources are invested there is only limited influence onthe objective function value In other words less aggressiveattackers can compromise a target even by only investingscarce attack resources For aggressive attackers since theyprefer spending a large quantity of resources on compromis-ing a victim they easily run out of resources before a targetservice is compromised

Based on this analysis it is advantageous for the defenderto apply reactive defense mechanisms against maliciousattackers under ldquofight to win or dierdquo circumstance

5 Conclusions

This paper models an attack and defense scenario thatinvolves high amounts of randomness as mathematical for-mulations where attackers are assumed to have incompleteinformation It further considers a virtualization environ-ment for helping relate these results to recent trends in cloudcomputing

According to the simulation results the outcome of acontest is influenced not only by the quantity of defenseresources invested on each node but also by the contestintensity An attackerrsquos aggressiveness is introduced as a newdimension and meaningful results are discovered Effectivedefense strategies are proposed in the discussion of theresults

For future works collaborative attacks should be takeninto consideration since the attack strategy discussed in thispaper is for individual attacks In other words there is onlyone attack targeting a victimrsquos network at a time Thus nosynergy is considered A more complicated collaborativeattack pattern is worth further study

Acknowledgment

This work was supported by the National Science CouncilTaiwan (Grant nos NSC 102-2221-E-002-104 and NSC 101-2218-E-011-009)

References

[1] IBM Internet Security Systems X-Force research and devel-opment team ldquoIBM X-Force 2010 Mid-Year Trend and RiskReportrdquo IBM August 2010

[2] R J Ellison D A Fisher R C Linger H F Lipson T Longstaffand N R Mead ldquoSurvivable network systems an emergingdisciplinerdquo Tech Rep CMUSEI-97-TR-013 1997

[3] S Roy C Ellis S Shiva D Dasgupta V Shandilya and Q WuldquoA survey of game theory as applied to network securityrdquo inProceedings of the 43rd Annual Hawaii International Conferenceon System Sciences (HICSS rsquo10) January 2010

[4] M N Lima A L D Santos and G Pujolle ldquoA survey of sur-vivability in mobile Ad hoc Networksrdquo IEEE CommunicationsSurveys and Tutorials vol 11 no 1 pp 66ndash77 2009

[5] Z Ma ldquoTowards a unified definition for reliability survivabilityand resilience (I) the conceptual framework inspired by thehandicap principle and ecological stabilityrdquo in Proceedings of theIEEE Aerospace Conference pp 1ndash12 March 2010

[6] F Xing and W Wang ldquoOn the survivability of wireless adHOC networks with node misbehaviors and failuresrdquo IEEETransactions on Dependable and Secure Computing vol 7 no3 pp 284ndash299 2010

[7] S Skaperdas ldquoContest success functionsrdquo EconomicTheory vol7 no 2 pp 283ndash290 1996

[8] G Levitin and K Hausken ldquoFalse targets efficiency in defensestrategyrdquo European Journal of Operational Research vol 194 no1 pp 155ndash162 2009

[9] K Hausken and G Levitin ldquoProtection vs false targets in seriessystemsrdquo Reliability Engineering and System Safety vol 94 no5 pp 973ndash981 2009

[10] G Levitin and K Hausken ldquoPreventive strike vs false targetsand protection in defense strategyrdquo Reliability Engineering andSystem Safety vol 96 no 8 pp 912ndash924 2011

[11] J Hirshleifer ldquoConflict and rent-seeking success functions ratiovs difference models of relative successrdquo Public Choice vol 63no 2 pp 101ndash112 1989

[12] J Hirshleifer ldquoThe paradox of powerrdquo Economics and Politicsvol 3 pp 177ndash200 1993

[13] J Archer A Boehme D Cullinane P Kurtz N Puhlmannand J Reavis ldquoTop Threats to Cloud Computing V 10rdquo CloudSecurity Alliance March 2010

[14] H Debar F Pouget and M Dacier ldquoWhite paper lsquoHoney-pot Honeynet Honeytoken Terminological issuesrsquordquo InstitutEurecom Research Report RR-03-081 2003

[15] B Cheswick ldquoAn evening with berferd in which a cracker islured endured and studiedrdquo in Proceedings of the USENIXConference pp 163ndash174 USENIX 1992

[16] C Seifert I Welch and P Komisarczuk ldquoTaxonomy of honey-potsrdquo Tech Rep CS-TR-0612 2006

[17] M H y Lopez and C F L Resendez ldquoHoneypots basicconcepts classification and educational use as resources ininformation security education and coursesrdquo in Proceedings ofthe Informing Science and IT Education Conference 2008

[18] Y Huang D Arsenault and A Sood ldquoClosing cluster attackwindows through server redundancy and rotationsrdquo in Pro-ceedings of the 6th IEEE International Symposium on ClusterComputing and the Grid (CCGRID rsquo06) May 2006

[19] YHuang D Arsenault andA Sood ldquoIncorruptible self-cleans-ing intrusion tolerance and its application to DNS securityrdquoJournal of Networks vol 1 no 5 pp 21ndash30 2006

[20] M Smith C Schridde and B Freisleben ldquoSecuring stateful gridservers through virtual server rotationrdquo in Proceedings of the17th International Symposium on High Performance DistributedComputing (HPDC rsquo08) pp 11ndash22 June 2008

[21] F Y-S Lin Y-S Wang and P-H Tsang ldquoEfficient defensestrategies to minimize attackersrsquo success probabilities in hon-eynetrdquo in Proceedings of the 6th International Conference onInformation Assurance and Security (IAS rsquo10) pp 80ndash85 August2010

[22] F Y-S Lin Y-S Wang P-H Tsang and J-P Lo ldquoRedundancyand defense resource allocation algorithms to assure servicecontinuity against natural disasters and intelligent attacksrdquo inProceedings of the 5th International Conference on BroadbandWireless Computing Communication andApplications (BWCCArsquo10) pp 206ndash213 November 2010

[23] F Cohen ldquoManaging network security attack and defencestrategiesrdquo Network Security vol 1999 no 7 pp 7ndash11 1999

[24] S Nagaraja and R Anderson ldquoDynamic topologies for robustscale-free networksrdquo Bio-Inspired Computing and Communica-tion vol 5151 pp 411ndash426 2008

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of

Submit your manuscripts athttpwwwhindawicom

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical Problems in Engineering

Hindawi Publishing Corporationhttpwwwhindawicom

Differential EquationsInternational Journal of

Volume 2014

Applied MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Probability and StatisticsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Mathematical PhysicsAdvances in

Complex AnalysisJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

OptimizationJournal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

CombinatoricsHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Operations ResearchAdvances in

Journal of

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Function Spaces

Abstract and Applied AnalysisHindawi Publishing Corporationhttpwwwhindawicom Volume 2014

International Journal of Mathematics and Mathematical Sciences

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

The Scientific World JournalHindawi Publishing Corporation httpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Algebra

Discrete Dynamics in Nature and Society

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Decision SciencesAdvances in

Discrete MathematicsJournal of

Hindawi Publishing Corporationhttpwwwhindawicom

Volume 2014 Hindawi Publishing Corporationhttpwwwhindawicom Volume 2014

Stochastic AnalysisInternational Journal of