# Modeling Intruder Reconnaissance Behavior through State Diagrams to Support Defensive Deception
## 6 Experiments  
In the previous sections, we presented the processes of creating attack graphs, creating attack paths, and calculating metrics. It is important to execute these processes as fast as possible, as the information produced can enable the mitigation of the attack in real time. To find out how fast the mechanism described in Section 5 produces its results, we performed a series of experiments. The main goal of the experiments was to understand the hardware requirements with respect to the parameters of the experiment (such as the network size or knowledge of the intruder's behavior) in order to produce the aforementioned results with a bearable time overhead. As the main hardware resource that may limit performance is processing, we opted for using a host with an Intel(r) Xeon(r) Silver 4210 Processor and measured the dedicated CPU resources through the number of threads used in each scenario. The parameters of the experiments were:  
* The number of CPU threads;
* The size of the network;
* The level of knowledge of the intruder's decisions. In order to quantify the network size with respect to reconnaissance effort, the number of distinct actions an intruder has to go through is calculated by Equation (18). \[size_{net}=|hosts^{up}|+|hosts^{up}|*ports^{open}_{avg} \tag{18}\]  
where \(|hosts^{up}|\) is the number of hosts in the network, while \(ports^{open}_{avg}\) is the average number of open ports on these hosts. The \(size_{net}\) metric is used to describe the size of the network in the experiments presented in the rest of this section. In regard to the level of knowledge of the intruder's decisions, the number of combinations of open intruder's preferences for host discovery and port scanning is used as a metric. If, for example, there are three techniques for host discovery and four techniques for port scanning, then twelve different combinations are possible and thus twelve attack paths are expected as output. The experiments were performed for a series of different values for the parameters described. These values are listed in Table 2.  
A total of 750 experiments were performed for the above cases. In this section, we present the time required to complete the described steps. Specifically, we present the time required for the initial process carried out by the first two components (the attack graph extractor and the path extractor), which has to be completed once per combination of network topology and knowledge of the intruder's behavior. On top of that, we also present the time required for the calculation of metrics for a random node input by the metric extractor component. This is a process that may be required to be completed multiple times after completing the initial process. Figure 11 shows the completion time for attack path extraction for all the combinations of thread numbers, network sizes, and levels of knowledge of the intruder's behavior. We can observe in the results of the above experiments that for a small network size, it is feasible to export attack paths from an attack graph quite quickly and with low processing resource requirements. Conversely, for a fairly large network and/or insufficient knowledge about the tactics that the intruder will follow, more computing resources are required to obtain the desired results. \begin{table}
\begin{tabular}{|c c|} \hline
**Parameter** & **Values** \\ \hline Number of Attack Paths & \(1\times 1,2\times 2,2\times 4,2\times 8,4\times 8,7\times 8\) \\ \hline CPU Threads & 1, 2, 4, 8, 12 \\ \hline Computers & 20, 40, 60, 80, 100 \\ \hline Open Ports & 2, 4, 6, 8, 10 \\ \hline \end{tabular}
\end{table} 
Table 2: Parameters and values of experiments. In addition, Figure 12 shows the time required to calculate the metrics, as described in Section 4. The figures depict the results for 100 hosts and 2, 4, 6, 8, and 10 open ports per host in 1, 4, 8, 16, 32, and 56 attack paths. As expected, the time required to calculate the metrics increases with the size of the network and the intruder behavior combinations.