## 4 Security Analysis  
We summarize the main notations as in Table 1. Figure 4 describes the framework of the SPM model. Generally, the proposed model is made up of three interconnected layers. On the bottom layer, we built an SRN model for evaluating the security of each node that is guaranteed by NVP technology, whereas a Markov model that analyzes the effectiveness of VM migration was presented at the top layer. Both layers are connected through the Poisson-based model (middle layer).  
It should be mentioned that although the bottom layer's SRN is a Markovian formalism, it has no direct relevance to the Markov-based evaluation computations performed on the top layer. While the steady-state of the SRN model describes the possible result of attacking an ACD node once, the steady-state of the Markov model describes the total number of the compromised nodes within the attack chain (i.e., the attacker location). Each layer focuses on an attacking phase in a way that the output of each layer is used as an input to the upper layer. Each evaluation method, be it SRN, Poisson process, or Markov and Martingale, was selected based on the features of the corresponding defensive process (NVP and VM migration). The reasons for selecting each of these methods for each layer are given below.  
First, for the single-step attacking process against a node, we focus on the internal structure of an ACD node by adopting NVP. Such a defensive process by nature includes  
Figure 4: SPM model framework.  
Figure 3: Attack Timeline.  
many detailed behaviors and interactions between the attacker and the defender. This makes it complicated to be described by Markov or the probabilistic method. We use SRN for its ability to model a system in a form that is closer to the system designer's intuition about what a model should look like [23]. Consequently, for the bottom layer, we suggest an SRN-based model to evaluate the single-step attacking process with graphical expression. The defensive capability is quantitatively measured by the success rate of each one-step attack as in [18; 53; 65]. The details are shown in Section 4.1.  
Then, because the repetitive attacks during a migration period are memoryless, we adopt the Poisson distribution for describing the number of attacks in each migration period similar to [23; 60]. The Poisson distribution is most appropriate for modeling the times of occurrence of critical memoryless events. We demonstrate how the success rate of repetitive one-step attacks over each migration is obtained, as shown in Section 4.2.  
The position of an attacker on an attacking chain is identified by the corresponding attacked node's position. Compared with the last migration period, the attacker moves along the attack chain in three possible directions: going to attack the next node, going back to the previous node, or staying at the same node. Regardless of how an attacker reaches his current position on the attack chain, his next position depends solely on his current position. Therefore, in the third layer, a homogeneous discrete-time Markov chain (DTMC) is built to describe this process and calculate the steady-state probability of compromising the target. This analysis forms the foundation for Martingale theory whereby we further develop a Martingale model for calculating the time of compromising the whole network. The details are shown in Section 4.3.