# Location-Aware Measurement for Cyber Mimic Defense: You Cannot Improve What You Cannot Measure
## 4 Metrics in the Objective Space
### Relationship between Nodes  
**Definition 7** (Executor set).: _The set of executors in the CMD system, each capable of independently implementing service functions, is denoted as \(A=\{A_{1},A_{2},\ldots\}\), where \(A_{i}\) represents a specific executor._  
**Definition 8** (Higher-order symbiotic vulnerability).: _Exploitable vulnerabilities that can achieve the same attack effect for \(m\) executors in executor set \(A\) (\(m\geqslant 3\))._  
**Definition 9** (Adjacency matrix).: _The adjacency matrix represents the adjacency between nodes (We assume undirected edges in the community, so it is a symmetric matrix)._  
\[\mathbf{Adj}=(a_{ij})_{n\times n},\]  
\[a_{ij}=\begin{cases}1&edge_{ij}\in E\\ 0&edge_{ij}\
otin E\end{cases}.\]  
Common-mode index.When multiple nodes share similar vulnerabilities, attackers can rapidly exploit these vulnerabilities on one node, potentially affecting multiple nodes in a similar or identical manner. This leads to the rapid horizontal spread of the attack's impact, resulting in irreversible consequences. Nodes within the same network community are closely interconnected and often exhibit similar or identical component structures in the real environment, such as accessory modules purchased from the same batch of manufacturers. Therefore, we introduce the concept of the common-mode index to measure the similarity within a community, thereby revealing potential security risks.  
We define the common-mode index between node \(N_{s}\) and node \(N_{t}\) (\(N_{s},N_{t}\in N\)) as follows.  
\[I_{(N_{s},N_{t})}=\frac{\sum_{\textit{owl}_{k}\in(VUL_{s}\cap VUL_{t})}CVSS_{ \textit{owl}_{k}}}{\sum_{\textit{owl}_{k}\in(VUL_{s}\cup VUL_{t})}CVSS_{ \textit{owl}_{k}}}, \tag{4}\]  
where \(CVSS_{\textit{owl}_{k}}\) indicates the CVSS score of the vulnerability \(\textit{owl}_{k}\) to characterize the magnitude of the vulnerability's harm.  
Considering the particularity of the CMD system, we need to make another consideration for the node where CMD is deployed. In CMD, multiple redundant executors independently run the output results and obtain the final results through adjudication, and the online executors are in a state of dynamic transformation. Due to these characteristics, the cognition of the vulnerability set of the node where CMD is deployed needs to be changed. After deploying CMD on the node, its vulnerability set is in a dynamic state. Accordingly, we give the definition of the common-mode index between the node \(N_{cmd}\) where CMD is deployed and the ordinary node \(N_{x}\).  
\[I_{(N_{CMD},N_{x})}=\sum I_{(N_{CMD},N_{x}),t_{i}}\times\frac{t_{i}}{T}, \tag{5}\]  
where \(I_{(N_{cmd},N_{x}),t_{i}}\) denotes the common-mode index in a period \(t_{i}\) for a dynamically updated CMD vulnerability set and \(T\) denotes a period as long as possible to show the possible states of the executor set.  
Based on the above definition, we integrate the common-mode index between nodes into matrix form, as shown below.  
\[\mathbf{CM}=(c_{ij})_{n\times n},\]  
\[c_{ij}=I_{(N_{i},N_{j})}. \tag{6}\]