# A Game-Theoretic Approach for Network Security Using Honeypots
## 4 Results
### Evaluating the System
However, for a large network with more than 50 services/hosts, the cost of deploying honeypots is very high, but it forces the attacker to step back to avoid high-risk actions; therefore, the defender's reward decreases, but the network is safe. The comparison between our algorithm and a fixed policy for honeypot allocation shows that this last one does not recognize the dynamics of the game and is not flexible because all the information is gathered at the beginning of the game. Figure 8: Results of the dominance for \(N_{10}\). Figure 10: Results of the dominance for \(N_{100}\). Figure 9: Results of the dominance for \(N_{50}\). Now, using the values from Table 3, we can calculate the optimal strategy using (23)  
\[ \begin{bmatrix}-100&10&0&0\\ 0&-40&0&0\\ 40&-90&0&0\\ 0&-40&0&0\end{bmatrix}  \tag{24}\]  
To solve this payoff matrix and use the algorithm developed in [19], we must convert the matrix to have no negative entries by adding a suitable fixed number to all the entries in the matrix. Let us add \(110\), and the new matrix is  
\[ \begin{bmatrix}10&120&110&110\\ 110&70&110&110\\ 150&20&110&110\\ 110&70&110&110\end{bmatrix}  \tag{25}\]  
Thus, solving two linear programming problems determines the optimal strategies  
\[min(x_{1}+x_{2}+x_{3}+x_{4}) \tag{26}\]  
\[ \begin{cases}10x_{1}+110x_{2}+150x_{3}+110x_{4}\geq 1\\ 120x_{1}+\ \ 70x_{2}+\ \ 20x_{3}+\ \ 70x_{4}\geq 1\\ 110x_{1}+110x_{2}+110x_{3}+110x_{4}\geq 1\\ 110x_{1}+110x_{2}+110x_{3}+110x_{4}\geq 1\\ \end{cases} \]  
and  
\[max(y_{1}+y_{2}+y_{3}+y_{4}) \tag{27}\]  
\[ \begin{cases}10y_{1}+120y_{2}+110y_{3}+110y_{4}\leq 1\\ 110y_{1}+\ \ 70y_{2}+110y_{3}+110y_{4}\leq 1\\ 150y_{1}+\ \ 20y_{2}+110y_{3}+110y_{4}\leq 1\\ 110y_{1}+\ \ 70y_{2}+110y_{3}+110y_{4}\leq 1\\ \end{cases} \]  
To calculate in Matlab the optimal strategy, we translated the linear program function into the format  
\[min(x_{1}+x_{2}+x_{3}+x_{4})\]  
\[ \begin{cases}-10x_{1}-110x_{2}-150x_{3}-110x_{4}\leq-1\\ -120x_{1}-\ \ 70x_{2}-\ \ 20x_{3}-\ \ 70x_{4}\leq-1\\ -110x_{1}-110x_{2}-110x_{3}-110x_{4}\leq-1\\ -110x_{1}-110x_{2}-110x_{3}-110x_{4}\leq-1\\ \end{cases} \]  
To find the solution, we used the _linprog_ function from the optimization toolbox in Matlab so  
\[ \begin{array}{c}\text{c}=[1,\,1,\,1,\,1];\\ \text{a}=[-10,\,-110,\,-150,\,-110;\,-120,\,-70,\,-20,\,-70;\,-110,\,-110,\,- 110,\,-110];\\ \text{b}=[-1,\,-1,\,-1,\,-1];\\ \text{lb}=[0,\,0,\,0,\,0]\\ \end{array} \]  
Applying the formula \(x=linprog(c,a,b,[],[],lb)\), we found the optimal solution as  
\[x_{r}=(0.0032,0,0,0.0088) \tag{28}\]and for the second LP, we used the translation of (25) and obtained  
\[min(-y_{1}-y_{2}-y_{3}-y_{4})\]  
\[ \begin{cases}10y_{1}+120y_{2}+110y_{3}+110y_{4}\leq 1\\ 110y_{1}+\ 70y_{2}+110y_{3}+110y_{4}\leq 1\\ 150y_{1}+\ 20y_{2}+110y_{3}+110y_{4}\leq 1\\ 110y_{1}+\ 70y_{2}+110y_{3}+110y_{4}\leq 1\\ \end{cases} \]  
\[\text{c = }[-1,\,-1,\,-1,-1];\]  
a = [10, 120, 110, 110; 110, 70, 110, 110; 110; 150, 20, 110, 110; 70, 110, 110];  
b = [1, 1, 1, 1];  
lb = [0, 0, 0, 0]  
so after applying in Matlab the command \(y=linprog(c,a,b,[],[],lb)\), we obtained  
\[y_{r}=(0.004,0.008,0,0) \tag{29}\]  
After applying the _linprog_ function in Matlab for 1, 10, 50, and 100 service(s)/host(s) in our environment using the method described earlier, we calculated the payoff matrix. The Matlab simulation results presented in Figure 11 show that the costs for both players increased significantly with N increasing. With more than 50 honeypots, the costs for both players increase and the probability of the attacker being caught is extremely high, so using a defense strategy with only 50 honeypots can be applied successfully.