# Location-Aware Measurement for Cyber Mimic Defense: You Cannot Improve What You Cannot Measure
## 5 Simulation  
In this section, we conduct simulation experiments and comparative analysis to validate the effectiveness and rationality of the above metrics. Firstly, we use the NetworkX package in Python to generate a scale-free network structure with a large number of nodes and apply the Louvain algorithm to partition the network. After a limited number of iterations, the finite number of communities was successfully divided. We color different communities separately for visualization, and the example effect is shown in Figure 2.  
Secondly, we construct the vulnerability set by selecting n vulnerabilities from the open CVE database and then generate each component of the vulnerability vector corresponding to each node with probability \(p\). For nodes with CMD deployed, we add up the vulnerability  
Figure 2: The example effect of community division. vectors of each executor in the online executor set (assuming a total of \(2l+1\) online executors), and consider a component in the resulting sum vector as indicating the presence of a specific vulnerability if it is greater than \(l\). After completing the community partitioning and selecting the vulnerability set, we utilize the network topology structure, vulnerability information, and pre-defined asset values as inputs to calculate the metric values according to the formulas provided in Section 4. To validate the reasonableness of the proposed metrics, we conduct simulated attacks and compared the computed metric values with the results of the simulated attacks  
Since the location of the attack initiation in the network is generally unknown, it can be regarded as a random event [19]. We simulate the attacks from a probabilistic perspective, where each simulation involves multiple attacks, and each attack is considered independent. A simulated attack can be divided into the following three phases: initial attack, horizontal spread, and clearance. (1) Initial attack: The attacker randomly selects a node and a vulnerability \(v\) from the vulnerability set to attack. If the chosen node possesses vulnerability \(v\), the attack is considered successful; otherwise, it fails. (2) Horizontal spread: If the attacker successfully infiltrates the network in the initial attack, at each time step, it can attempt to spread to neighboring nodes. If a neighbor node lacks vulnerability \(v\), the success rate of spreading to it is denoted by \(p_{1}\); otherwise, it is set to \(p_{2}\) (where \(p_{1}<p_{2}\)). (3) Clearance: Considering that both regular nodes and CMD nodes have their own checking and clearing mechanisms, we assume that at each time step, there is a certain probability of the attacker being detected and cleared by the node's protection mechanism. For regular nodes, there is a probability of \(p_{r}ec\) to find and clear exploitable vulnerabilities at each time step (\(p_{r}ec\) is set based on the actual probability). For CMD nodes, if fewer than half of the executors have vulnerability \(v\) in the dynamic scheduling of each time step, the attacker will not achieve their goal under the CMD's ruling mechanism. This scenario is equivalent to the vulnerability being cleared. The simulated attack continues until it no longer spreads, and then this round of simulated attack is concluded. In the simulated attacks mentioned above, the number of simulated attacks on nodes or communities can reflect their actual vulnerability to some extent. Combining the calculated failure risk of nodes and communities (i.e., independent and comprehensive failure risk) with the number of attacks, we draw a scatter plot on the two-dimensional coordinate system, as shown in Figure 3. After fitting the scatter points, it can be seen that the number of attacks is roughly proportional to the calculated failure risk.