# Location-Aware Measurement for Cyber Mimic Defense: You Cannot Improve What You Cannot Measure
## 4 Metrics in the Objective Space
### Relationship between Nodes
#### Transfer probability.  
When an adversary breaks through a host, they often use this host as a base and then launch attacks on other hosts to expand the control range and spread worms and viruses. Typically, the attack spreads from the compromised host to neighboring hosts, gradually infecting the entire network. Considering the attack transfer between neighboring nodes, we propose the concept of transfer probability.  
We construct the transfer matrix to represent the single-step transfer probability.  
\[\mathbf{P}=\left[\begin{array}{cccc}p_{11}&p_{12}&\cdots&p_{1n}\\ p_{21}&p_{22}&\cdots&p_{2n}\\ \vdots&\vdots&\ddots&\vdots\\ p_{n1}&p_{n2}&\cdots&p_{nn}\end{array}\right], \tag{7}\]  
where \(n\) represents the number of nodes in the community and \(p_{ij}\) denotes the probability of an attacker moving from node \(i\) to node \(j\) in a single step, which is defined as follows.  
\[p_{ij}=\left\{\begin{array}{ll}0&a_{ij}=0\\ \frac{p_{1}}{d_{i}}&a_{ij}=1\ and\ t_{ij}=0\\ \frac{p_{2}}{d_{i}}&a_{ij}=1\ and\ t_{ij}=1\end{array}\right. \tag{8}\]  
where \(p_{1}\), and \(p_{2}\), respectively, represent the success rate of transfer from node \(i\) to node \(j\) with or without common-mode vulnerability (prior knowledge is needed for machine learning in practical application), \(d_{i}\) denotes the degree of the i-th node, and \(a_{ij}\) is an element in the adjacency matrix \(\mathbf{A}\). If \(a_{ij}=1\) then it means there is an edge between node \(i\) and node \(j\), \(a_{ij}=0\) means there is no edge between node \(i\) and node \(j\), and \(t_{ij}\) is an element in \(\mathbf{T_{n\cdot n}}\), which is defined as follows.  
\[\mathbf{T}=(t_{ij})_{n\ast n},\]  
\[t_{ij}=\left\{\begin{array}{ll}1&VUL_{s}\cap VUL_{t}\
eq\varnothing\\ 0&VUL_{s}\cap VUL_{t}=\varnothing\end{array}\right.\]  
From the above definition, we can know:  
1. \(0\leqslant p_{1}\leqslant p_{2}\leqslant 1\)
2. \(\mathbf{P}=\mathbf{P}^{\mathbf{T}}\)  
Before starting the definition of transfer probability, a related lemma and a theorem are given.  
Lemma 1: \(\left\|P\right\|_{1}<1\)_, where \(\left\|\cdot\right\|_{1}\) is the 1-norm of the matrix._  
_We know that \(\left\|P\right\|_{1}=\max\limits_{1\leqslant i\leqslant n}\sum_{j=1}^{n}\left| p_{ij}\right|\), so to prove \(\left\|P\right\|_{1}<1\), we have to prove \(\max\limits_{1\leqslant i\leqslant n}\sum_{j=1}^{n}\left|p_{ij}\right|<1\), that is, to prove \(\forall i\), \(\sum_{j=1}^{n}\left|p_{ij}\right|<1\)._  
\(\forall i\)_, we can prove that \(\sum_{j=1}^{n}\left|p_{ij}\right|=\sum_{j=1}^{n}p_{ij}=\sum_{j=1}^{n}a_{ij}p_ {ij}\leqslant\sum_{j=1}^{n}a_{ij}\frac{p_{2}}{d_{i}}=\frac{p_{2}}{d_{i}}\sum_ {j=1}^{n}a_{ij}=\frac{p_{2}}{d_{i}}d_{i}=p_{2}\)._  
_Therefore, \(\left\|P\right\|_{1}\leqslant p_{2}<1\). The lemma is proved._  
Theorem 1: _If \(\left\|P\right\|<1\), then \(I+P+P^{2}+\cdots P^{n}+\cdots\) converges, and \(I+P+P^{2}+\cdots P^{n}+\cdots=\left(I-P\right)^{-1}\)._  
_Since \(\left\|P\right\|<1\), then \(\left\|I\right\|+\left\|P\right\|+\left\|P\right\|^{2}+\cdots+\left\|P\right\|^ {n}+\cdots\) converges. And since the completeness of \(\left(P_{n\ast n},\left\|\cdot\right\|\right)\), then \(I+P+P^{2}+\cdots P^{n}+\cdots\) converges._\[\left(I-P\right)\left(I+P+P^{2}+\cdots P^{n}+\cdots\right)\] \[= \left(I+P+P^{2}+\cdots P^{n}+\cdots\right)\] \[-\left(P+P^{2}+\cdots P^{n}+\cdots\right)\] \[= I.\]  
_Therefore, \(I+P+P^{2}+\cdots P^{n}+\cdots=\left(I-P\right)^{-1}\). The theorem is proved._  
Combining the basic transfer factor \(\varepsilon_{0}\) and the multi-step transfer case, we define the transfer probability matrix as follows.  
\[\mathbf{TP} =\varepsilon_{0}\mathbf{Adj}+(\mathbf{P})+(\mathbf{P})^{2}+( \mathbf{P})^{3}+\cdots\] \[=\varepsilon_{0}\mathbf{Adj}+(\mathbf{I}-\mathbf{P})^{-1}- \mathbf{I}. \tag{9}\]