# Location-Aware Measurement for Cyber Mimic Defense: You Cannot Improve What You Cannot Measure
## 1 Introduction  
The increasingly widespread application of the Internet in various social and economic sectors is leading to an increasingly severe challenge for cyberspace. Network security threats are becoming more diverse, complex, frequent, and widespread. In the current online environment, there exists a significant asymmetry between network attacks and defenses [1], often favoring the attackers. From the defensive perspective, it is generally difficult to anticipate when and how attacks will occur, making it challenging to deploy targeted defense strategies. Traditional defense techniques, such as firewalls and intrusion detection techniques [2; 3], typically rely on known attack signatures to identify and match target behaviors, leaving them at a disadvantage against unknown vulnerabilities and backdoors in cyber warfare. A series of novel proactive defense technologies are proposed to address this issue, such as honeypots [4] and Moving Target Defense (MTD) [5; 6; 7]. These methods effectively improved the situation and significantly increased the difficulty and cost for attackers to launch their attacks. However, they still have limitations: honeypot technology requires a significant amount of prior knowledge from attackers [8], and MTD possesses time sensitivity and uncontrollability, and the high-frequency variability, particularly, leads to a decline in system performance [7]. In fact, there is no defense strategy that can achieve absolute security. Due to the stage-specific nature of technological development and the level of awareness, vulnerabilities orbackdoor issues in software and hardware design cannot be completely avoided. In the absence of the ability to eliminate inherent flaws and lack of prior knowledge, addressing the threat of unknown vulnerabilities and backdoors remains a significant challenge in cybersecurity. The emergence of the Cyber Mimic Defense (CMD) theory [9] provided a new idea and paradigm to tackle this problem and demonstrated effective defense capabilities in areas such as Software-Defined Networking (SDN) [10], cloud computing [11], distributed systems [12], etc. The core framework of Cyber Mimic Defense (CMD) is \"Dynamic Heterogeneous Redundancy\" (DHR) [9], which is characterized by the following: (1) Dynamic: selecting a set of functional executors based on scheduling policies at the current moment and continuously changing this set to conceal the internal structure. (2) Heterogeneous: utilizing multiple heterogeneous executors with significantly different implementation methods to achieve the same functionality. (3) Redundancy: employing multiple executors and using an adjudication mechanism to determine the final system output. Through its structural effects, CMD achieves endogenous defense effects that are independent of attack characteristics, effectively countering various attacks and unknown threats. However, there is currently a lack of universal metrics to directly measure the effectiveness of cyber mimic defense technology when applied to modern networks. We cannot improve what we cannot measure [13], and this principle applies to cyber mimic defense technology as well. The vast scale of real-world networks and the complexity of their topology pose challenges for evaluating the effectiveness of the cyber mimic defense. Therefore, there is an urgent need to develop general quantitative evaluation metrics for cyber mimic defense systems. It is widely recognized that no single metric is powerful enough to fully reflect the impact of all relevant behaviors and defense strategies on the network. Therefore, we establish multi-dimensional evaluation metrics to assess the effectiveness of cyber mimic defense technology from various perspectives. We also found that most existing security strategies are typically evaluated based on the entire network. However, in many cases, even the best defense strategy may not necessarily extend security uniformly across the entire network, especially in large networks with hundreds or thousands of nodes.