# Secure Partitioning of Cloud Applications, with Cost Look-Ahead
## 6 Partitioning with a Look Ahead on Migration Costs
### A Refined Probabilistic Cost Model
#### 6.1.2 The Probabilistic Model  
To estimate the probability of a migration from a partitioning \(P_{1}\) to a partitioning \(P_{2}\) we define a probabilistic model. For every data type and characteristic \(dc\), we introduce a discrete random variable  
\[X_{dc}=l\in L\]  
representing the event that the data or characteristic \(dc\) has the label \(l\) of the security lattice, forming the element of a labelling \(\langle dc,l\rangle\). Every variable \(X_{dc}\) has its probability mass function \(p_{X_{dc}}\) defined in Equation (11):  
\[p_{X_{dc}}(l_{i})=P(X_{dc}=l_{i})=p_{i}\quad\forall l_{i}\in L \tag{11}\]  
representing the probability \(p_{i}\) that the data or characteristic \(dc\) has label \(l_{i}\). The following holds:  
\[\sum_{i}p_{i}=1\]  
We now introduce a second random variable  
\[Y_{i}=\mathcal{L}_{i}\]  
representing the probability that the labelling is the labelling \(\mathcal{L}_{i}\); thus, every  
\[\langle data,l\rangle\]  
and  
\[\langle characteristic,l\rangle\]  
has \(l\) specified and contained in the security lattice \(L\). Every variable \(Y_{i}\) has its probability mass function defined in Equation (12)  
\[p_{Y_{i}}(\mathcal{L}_{i})=P(Y_{i}=\mathcal{L}_{i})=\prod_{dc}P(X_{dc}=\bar{l}),\langle dc,\bar{l}\rangle\in\mathcal{L}_{i} \tag{12}\]  
which represents that the probability of a specific labelling is given by the joint probabilities of its labelled data and characteristics. Finally, we introduce the random variable  
\[Z^{k}_{se}=\mathcal{L}_{s}\rightarrow_{k}\mathcal{L}_{e}\]  
representing the event that the application starts with the labelling \(\mathcal{L}_{s}\) and evolves into the labelling \(\mathcal{L}_{e}\) with at most \(k\) labels changed (considering that \(0\leq k\leq|\mathcal{L}|\)) and the number of labels changed is given by \(\mathcal{L}_{s}\setminus\mathcal{L}_{e}\). Having the limit \(k\) to the number of possible changes admitted during the evolution of a labelling is not unrealistic. Considering the components' characteristics, a label change can represent a bug found in a library and waiting for a bug in another library to change the deployment is implausible. If we consider the data, it can happen that a group of data can be classified (or declassified) by new privacy laws or by changes in the agreement with clients. However, it is unlikely that all the data change labels, and it is more unlikely that this happens simultaneously with a bug discovery. For those reasons, having the parameter \(k\) decided from the start is reasonable and the probabilistic model takes into account every \(k\) from 1 (one label change admitted) to the number of data types and characteristics (every label can change). The probability mass function for every variable \(Z^{k}_{se}\) is defined in Equation (13). \[ \begin{array}{c}p_{Z^{k}_{se}}(\mathcal{L}_{0},\mathcal{L}_{i},k)=P(Z^{k}_ {se}=\mathcal{L}_{0}\rightarrow_{k}\mathcal{L}_{i})=\\ P(\mathcal{L}_{s}=\mathcal{L}_{0})\ \ \cdot\ \ P(\mathcal{L}_{e}=\mathcal{L}_{i} \mid\mathcal{L}_{s}=\mathcal{L}_{0}\ \ \wedge\ \ |\mathcal{L}_{0}\setminus\mathcal{L}_{i}|\leq k)\end{array}  \tag{13}\]  
In this setting the initial labelling is given; thus, for every labelling \(\mathcal{L}_{j}\) the first term has the probability  
\[P(\mathcal{L}_{s}=\mathcal{L}_{j})= \begin{cases}1&\text{if }\mathcal{L}_{j}= \mathcal{L}_{0}\\ 0&\text{if }\mathcal{L}_{j}\
eq\mathcal{L}_{0}\end{cases} \]  
To define the probability of the final labelling from the starting one and given \(k\)  
\[P(\mathcal{L}_{e}=\mathcal{L}_{i}\mid\mathcal{L}_{s}=\mathcal{L}_{0}\ \wedge\ \ | \mathcal{L}_{0}\setminus\mathcal{L}_{i}|\leq k)\]  
we, first of all, discriminate the case of remaining in the starting labelling \(\mathcal{L}_{0}\) from all the others  
\[P(\mathcal{L}_{e}=\mathcal{L}_{0}\mid\mathcal{L}_{s}=\mathcal{L}_{0}\ \ \wedge\ \ |\mathcal{L}_{0}\setminus\mathcal{L}_{0}|\leq k)=P(Y_{0}=\mathcal{L}_{0})\]  
This represents the probability that a labelling does not change and it is independent of the value of \(k\).