# A Game-Theoretic Approach for Network Security Using Honeypots
## 4 Results
### Evaluating the System  
For the simulation, we focused on the game between the attacker and the defender; we used Gambit V15.1.1, which is a library of game theory software and tools for the analysis of finite extensive and strategic games [18], and MATLAB R2021b v9.11.0. The parameters used for running the simulation are defined in Table 3.  
Using Gambit to simulate one service/host and applying the payoff matrix in (23), we could observe that the attacker had a real advantage and predominance, suggesting that the defender could suffer great losses (Figure 3). We can notice from Figures 4-6 that when the number of servers or hosts increased and the resources available for honeypots were usable, the results showed that the dominance was transferring to the defender's side and the attacker could not easily access the network anymore. \begin{table}
\begin{tabular}{c c c c c} \hline \hline  & & **Attacker** & & **Defender** \\  & \(\lambda_{21}\) & \(\lambda_{20}\) & \(\lambda_{21}\) & \(\lambda_{20}\) \\ \hline \multirow{2}{*}{\(\lambda_{110}\)} & \(\lambda_{11}\) & \((-\gamma G^{d}/s,\gamma G^{d}/s-C^{a})\) & (0,0) & \((G^{d},G^{d})\) & (0,0) \\  & \(\lambda_{10}\) & \((0,-C^{a})\) & (0,0) & \((-G^{d},-G^{d})\) & (0,0) \\ \hline \multirow{2}{*}{\(\lambda_{111}\)} & \(\lambda_{11}\) & \((\eta G^{h}/s,-\eta G^{d}/s-C^{d})\) & (0,0) & \((0,-G^{d})\) & (0,0) \\  & \(\lambda_{10}\) & \((0,-C^{a})\) & (0,0) & \((0,-G^{d})\) & (0,0) \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Payoff matrix. Figure 3: Results of the dominance for \(N_{1}\). We can notice that when the number of services/hosts increased, the payoff of the defender decreased, being influenced by the honeypots' costs. Furthermore, the attacker's payoff decreased at the same time as the increase in the defender's payoff, and the cost of attacking the network rapidly grew to the point where it was very risky to be caught, or too much time was consumed. In a big network, there can be more than 1000 hosts or services, but applying our method of placing honeypots, we can conclude that 50 honeypots are enough for a defense strategy. There is no need to deploy more honeypots and all the data that are gathered can be used in order to mitigate an attacker's infiltration in the system. The purpose of the experiment was to show the use of honeypots to increase the security of a system, but the question was to know when a system administrator can be assured that the number of fake nodes can help them out in protecting the network with fewer costs. Using the extensive (tree) game from Gambit v15.1.1, we introduced the values obtained in Figures 3-6 and then calculated the Nash equilibrium and the results shown in Figures 7-10 demonstrate that our proposed method had a great output for the defender. The honeypots decreased the attacker's dominance and increased the chances that the defender would observe and stop their actions. Figure 4: Results of the dominance for \(N_{10}\). Figure 5: Results of the dominance for \(N_{10}\). Figure 6: Results of the dominance for \(N_{100}\). Figure 7: Results of the dominance for \(N_{1}\). The Nash equilibrium is the strategy with a high probability that an attacker would take into consideration, while the defender is trying to solve the imperfect game with less information. The defender places the honeypots based inside the network and the attacker tries to avoid them and not being spotted. Both players are paying some costs, the defender for placing the honeypots and the attacker for trying to evade them and access real hosts. We found out that the game could come to an idle phase when both attacker and defender responses \(resp(d)\) and \(resp(a)\) were equal to 0. This meant that both persons in that game were not making any moves and were in idle mode. In our case, the reward of the defender increased when the attacker was caught, and the capture cost also increased.