## 5 Simulation and Analysis
### The Defensive Ability of an ACD Network  
Based on the result of the first part, for the Equation (31) and (32), we take three kinds of ACD nodes picked from Table 7 as the examples, including \(BL_{8}\), \((N=4,M=3)\), and \((N=8,M=6)\). The corresponding probability of each node being compromised is \(\overline{p_{A8}}=0.2994\), \(P_{A(4,3)}=0.0951\), and \(P_{A(8,6)}=0.0106\), as shown in Table 7. \(BL_{8}\) is taken as the Baseline (BL) value. In the BL scenario, only VM migration is adopted, and \(\overline{p_{A8}}\) indicates the original defensive ability of the SCVs. In the other two scenarios, NVP and VM migration are adopted in combination. We do not discuss the cases where only NVP  
Figure 10: Steady-state probability of compromising target node \(\pi_{L}(\mu,\omega)\), where \(\omega\in(\mu/(\mu+1),1))\). technology is deployed and where no ACD technology is deployed, because the defensive abilities of these two cases have been shown in Table 7.  
There are two ways to prevent the spread of attacks within the network: First, increasing the frequency of migrations (i.e., decreasing \(T\)) and second expanding the range of migrations (i.e., increasing \(\omega\)). However, if we use each of these ways independently (alone), it may result in consuming more network and defensive resources. For this reason, it should be better to adopt both ways together. Therefore, to guarantee security at a lower cost, the configuration is optimized by balancing the parameter pair \((T,\omega)\). As analyzed in Section 4.3, depending on the relative strength of the attacker and defender, the attacker may move closer to the target or be removed from the system over time. Hence, we discuss two typical scenarios defined in the last subsection according to the relationship between the defensive strength \((T,\omega)\) and the attacking strength \(\mu\). (1) Ordinary scenario: the attacker can get close to the target, then the attack time is described as \(MTTA\). (2) Worst-case scenario: migrations will exile the attacker who eventually loses all the obtained illegal privileges by improving the cost, then the time to exile the attacker is \(MTTR\). Figure 11 compares \(MTTA\) for several parameter pairs \((T,\omega)\), when \(\omega<\mu/(\mu+1)\). Figure 12 compares \(MTTR\) under \(\omega>\mu/(\mu+1)\). Baseline represents the system that only adopts the VM migration without NVP. Contour lines represent the contour of the upper corresponding \(MTTA\) or \(MTTR\) curves. The same contour line represents the parameter pairs \((T,\omega)\) that bring the same \(MTTA\) or \(MTTR\) value. Observing Equation (31), starting from \(LT/\mu\), the theoretical attack time increases as \(\omega\) increases. When \(\omega\) approaches \(\mu/(\mu+1)\), the time tends to infinity, which indicates the extreme hardness for attackers to approach the target. Compared with the Baseline, the NVP node achieves the same security level with a smaller \(\omega\) or a larger \(T\), providing a lower cost. In addition, comparing NVP nodes (8,6) and (4,3), providing the same level of security, a smaller \(\omega\) or a larger \(T\) can be used in the (8,6) node. In other words, if each NVP node has a stronger defensive ability, the VM migration technology will have less pressure, then it will spend less defensive cost on the upper network layer. When \(\omega\) exceeds \(\mu/(\mu+1)\), Figure 12 describes the time for the network to reach a self-repair after having \(L\) compromised nodes. The time decreases from infinity to \(LT\) with increasing \(\omega\). Similar to the last scenario depicted by Figure 11, the NVP node needs a smaller \(\omega\) or a larger \(T\) than the Baseline to exile the attacker simultaneously. Observing contours of the ACD systems and the baseline system, the \((T,\omega)\) value needs to be adjusted to guarantee the same defensive ability for different value pairs of \((N,M)\). When the security gain brought by NVP is weaker, we should pay more cost on VM migration and vice versa.