# Location-Aware Measurement for Cyber Mimic Defense: You Cannot Improve What You Cannot Measure
## 6 Related Works  
**Security Strategy Measurement. ** The importance of evaluation metrics in evaluating the effectiveness of new security strategies that are constantly emerging cannot be overstated. [PERSON] et al. proposed a theoretical model based on zero-day security, combining the value of target assets and the shortest attack sequence to obtain k-zero-day security metrics [21]. [PERSON] et al. classified and proposed a series of performance metric definitions based on different characteristics of attack and defense behaviors, including attack cost, attack path exposure time, defense deployment cost, and downtime [22]. [PERSON] et al. also used the hierarchical attack representation model and the importance \begin{table}
\begin{tabular}{c c c c c} \hline \hline \begin{tabular}{c} **Number of** \\ **Trials** \\ \end{tabular} & \begin{tabular}{c} **Number of** \\ **Nodes** \\ \end{tabular} & \begin{tabular}{c} **Number of** \\ **Simulated Attacks** \\ \end{tabular} & **Models** & \
\begin{tabular}{c} **Average Coefficient of** \\ **Correlation for Nodes** \\ \end{tabular} &
\begin{tabular}{c} **Average Coefficient of** \\ **Correlation for Communities** \\ \end{tabular} \\ \hline \multirow{4}{*}{100} & \multirow{4}{*}{100} & \multirow{4}{*}{100} & \multirow{4}{*}{10,000} & Our model & 0.73 & 0.91 \\ \cline{3-5}  & & & Model 1 & 0.35 & 0.66 \\ \cline{3-5}  & & & Model 2 & 0.65 & 0.98 \\ \hline \multirow{4}{*}{100} & \multirow{4}{*}{200} & \multirow{4}{*}{20,000} & Our model & 0.71 & 0.94 \\ \cline{3-5}  & & & Model 1 & 0.39 & 0.72 \\ \cline{3-5}  & & & Model 2 & 0.60 & 0.98 \\ \cline{3-5}  & & & Our model & 0.71 & 0.97 \\ \cline{3-5}  & & & Model 1 & 0.48 & 0.82 \\ \cline{3-5}  & & & Model 2 & 0.52 & 0.97 \\ \cline{3-5}  & & & Our model & 0.70 & 0.97 \\ \cline{3-5}
20 & 1000 & 100,000 & Model 1 & 0.56 & 0.88 \\ \cline{3-5}  & & & Model 2 & 0.58 & 0.95 \\ \hline \multirow{4}{*}{20} & \multirow{4}{*}{200} & \multirow{4}{*}{200,000} & Our model & 0.69 & 0.98 \\ \cline{3-5}  & & & Model 1 & 0.55 & 0.92 \\ \cline{3-5}  & & & Model 2 & 0.52 & 0.96 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Average coefficient of correlation for nodes and communities for different models. \begin{table}
\begin{tabular}{c c c c c c c c c c c c} \hline \hline \begin{tabular}{c} **Coefficient** \\ **of Correlation** \\ **Estimated** \\ **Deviation of \(p_{1}\)** \\ \end{tabular}  & \multirow{4}{*}{\(-\)5\%} & \multirow{4}{*}{\(-\)4\%} & \multirow{4}{*}{\(-\)3\%} & \multirow{4}{*}{\(-\)2\%} & \multirow{4}{*}{\(-\)1\%} & \multirow{4}{*}{\(\emptyset\)\%} & \multirow{4}{*}{\(\boldsymbol{1\%}\)} & \multirow{4}{*}{\(\boldsymbol{2\%}\)} & \multirow{4}{*}{\(\boldsymbol{3\%}\)} & \multirow{4}{*}{\(\boldsymbol{4\%}\)} & \multirow{4}{*}{\(\boldsymbol{5\%}\)} \\ \cline{3-5}  & & & & & & & & & & & \\ \hline \hline \(-\)4\% & 0.72 & 0.72 & 0.80 & 0.77 & 0.76 & 0.78 & 0.81 &  
measure to evaluate the effectiveness and scalability of MTD technology [23]. [PERSON] et al. proposed a security framework that automatically senses and updates in container-based cloud environments and builds a multidimensional attack graph model to analyze attack behavior [11]. [PERSON] et al. proposed a maximizing utility function approach to capture the trade off between security and performance [24]. [PERSON] et al. modeled attack graphs and used Bayesian inference to perform static and dynamic analysis [25]. [PERSON] et al. also proposed a Bayesian-based probabilistic graphical model to estimate the vulnerability and interconnection of system components and calculate the attack probability of target nodes to determine security [26]. [PERSON] et al. evaluated the network diversity based on the effective quantity of different resources, and the minimum and average attack effort, respectively [27]. These studies typically conduct evaluations from a global perspective. However, due to the significant asymmetry in network attacks and defenses, especially in complex networks, they are unable to identify specific regions where security benefits can be obtained.