# A Game-Theoretic Analysis for Distributed Honeypots
## 4 Game Theory Analysis
### Game Model of the Distributed Honeypots  
Taking attack-defense countermeasure into consideration, there are two kinds of players (i.e., attacker and defender) participating in a game. Since both the real service and honeypot exist in the same server and the real one aims at providing real resources for legal users to access, there are three kinds of players \(\Theta=\{\textit{server},\textit{attacker},\textit{user}\}\). We model our proposed scheme as follows. There are \(n\) kinds of services \(\Theta_{1}=\{\theta_{11},\,\theta_{12},\,...,\,\theta_{1n}\}\). Because of the existence of honeypots, these services are changed to \(\Theta_{1}=\{\theta_{110},\,\theta_{111},\,\theta_{120},\,\theta_{121},\,..., \,\theta_{1n0},\,\theta_{1n1}\}\), and these parameters can be generalized into \(\Theta_{1}=\{\theta_{1i0},\,\theta_{1i1}\}\), \(i\in[1,\)n\(]\). Visitors \(\Theta_{2}=\{\theta_{21},\,\theta_{20}\}=\{\textit{Attacker},\textit{User}\}\) is a common name for the last two players mentioned in \(\Theta\). Therefore, players participating in the game are included in \(\Theta=\{\textit{Server},\,\textit{Visitors}\}\). They may take different activities in a game. However, they will only choose a relatively good strategy when they interact with each other under different circumstances. As mentioned above, there are several services provided in our system. Due to a variation characteristic, every server provides different kinds of services during different periods. Therefore, a server can turn on a service or turn off it. As for visitors, they can decide whether to access it or not. The strategy sets are composed of \(A_{1}=\{\pi_{11},\pi_{10}\}\) and \(A_{2}=\{\pi_{210},\,\pi_{211},\,...,\,\pi_{2n0},\,\pi_{2n1},\,\pi_{20}\}\) for a server and a visitor respectively. It is necessary to specify the basic parameters that reflect all players' payoffs, as shown in Table 5.  
Based on our system model, the payoffs are described for two cases as follows. * A real service \(\theta_{1n0}\) is provided by a server. If an attacker gains access to a real service (i.e., \(\pi_{2n0}\)), the payoffs are \((-\gamma a,\gamma a-b)\) for \(\{\textit{Server},\textit{Attacker}\}\). The server suffers from providing a real service to the attacker. If a user accesses a real service (i.e., \(\pi_{2n0}\)), the payoffs are \((a,a)\) for \(\{\textit{Server},\textit{User}\}\). Both have normal payoffs, which indicates that the server provides the legal user with a normal service. If visitors access other services, the payoffs are \((0,-b)\) for \(\{\textit{Server},\textit{Attacker}\}\) and \((-a,-a)\) for \(\{\textit{Server},\textit{User}\}\), which means that they are suffering a loss when they do not have access to real resources. * A fake service \(\theta_{1n1}\) is provided by a server. If an attacker visits a fake service (i.e., \(\pi_{2n1}\)), the payoffs are \((\eta c,-\eta c-b)\) for \(\{\textit{Server},\textit{Attacker}\}\). The attacker suffers a loss in attacking the honeypot and the server's payoff is an optimistic value. If a user accesses a fake service (i.e., \(\pi_{2n1}\)), the payoffs are \((0,-a)\) for \(\{\textit{Server},\textit{User}\}\). In this case, the fake resources are provided to the user who ought to access a real service, making it suffer losses. Besides, if visitors do not access any service (i.e., \(\pi_{20}\)), the payoff is 0 for all players. The corresponding payoff matrix is shown in Table 6. The simplified payoff matrix is shown in Table 7 and its game tree is illustrated in Figure 4. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Parameters** & **Conditions** & **Descriptions** \\ \hline \(a\) & \(a>0\) & the fundamental payoff of server \\ \(b\) & \(a\geq b>0\) & the attack cost of attacker \\ \(c\) & \(c>0\) & the basic payoff for honeypot \\ \(\gamma\) & \(\gamma\geq 1\) & the damage factor in a hack \\ \(\eta\) & \(\eta\geq 1\) & the decoy factor of honeypot \\ \hline \hline \end{tabular}
\end{table} 
Table 5: List of parameters of the players.