# Modeling Intruder Reconnaissance Behavior through State Diagrams to Support Defensive Deception
## 4 Modeling Reconnaissance Activity
### State Diagram Analysis Syntax  
The first building block of our methodology is a hierarchical set of state machines that enables the accurate and efficient representation of an intruder's actions. Specific syntax is used to model port scanning and host discovery activities as state diagrams. Specifically, the vertices of the state diagram represent the states which an intruder may be in, while the edges represent the transition between those states. States (vertices) are annotated by \"S\", while \"I\" indicates the incoming edges and \"O\" the outgoing ones. The set of vertices of the state diagram is denoted as \(V=\{s_{1},s_{2},...,s_{n}\}\) and the set of the edges of the state diagram is denoted as \(E=\{e_{1},e_{2},...,e_{n}\}\). Let \(\forall\) s \(\in\) V, then  
\[s_{i},\{i_{1}^{i},i_{2}^{i},...,i_{k}^{i}\},\{O_{1}^{i},O_{2}^{i},...,O_{m}^{i }\}\]  
where k is the number of incoming edges and m is the number of outgoing edges. The different types of state diagrams vertices to be used in the host discovery and port scanning analysis are defined in Table 1.  
The state diagram starts with an initial state and ends up with one or more final states, while it also includes a number of intermediate states. The simplest state type is the \"Simple\" type, which explicitly defines all required detail for the state where the intruder is. There is a more complex state type named \"Complex\", which represents the higher complexity functionality and includes another state diagram to model such functionality. In general, intermediate states have at least one input and one output, while initial states do not have any input, and final states do not have any outputs. There are two special sub-types for \"Simple\" states that serve the case when a state may have more than one output and according to specific parameters may lead to different subsequent states. Both can have more than one output. For Intruder-decision-driven states, the next state is decided according to the intruder's choice with regards to reconnaissance methodology, while for Network-input-driven states, the next state is decided upon the results of a scanning action on a specific network. In addition, each of the state diagram vertices may contain optional variables that provide details about the context in which each state takes place. For example, if a state represents host discovery activity, then it shall also include a variable holding the destination IP address, to which the host discovery is targeted. If this state is a \"Complex\" state, then it inherits this variable in the state diagram that further analyses the host discovery behavior. An example of the use of the proposed syntax is depicted in Figures 1 and 2. \begin{table}
\begin{tabular}{|c|c|c|} \hline
**State** & **Symbol** & **Properties** \\ \hline Simple & & initial: \(k=0,m=1\) \\  & final: \(k\geq 1,m=0\) \\  & intermediate: \(k\geq 1,m\geq 1\) \\ \hline Complex & & \(k\geq 1,m\geq 1\) \\ \hline Intruder decision driven & & k = 1, \(m\geq 2\) \\ \hline Network input driven & & k = 1, \(m\geq 2\) \\ \hline \end{tabular}
\end{table} 
Table 1: Types of state diagram vertices. Figure 1: Sample State Diagram. * State S1 in Figure 1 is a \"Simple\" state and acts as the initial state of the state diagram. * State S2 is a \"Complex\" state and the reconnaissance activity carried out during this state is further analyzed in another state diagram shown in Figure 2. What actually happens is that the intruder transits from state S1 in Figure 1 to state S2.1 of Figure 2. When the activity in Figure 2 is concluded, the intruder transits from state S2.5 of Figure 2 to state S3 of Figure 1.
* State S3 is an \"Intruder-Decision-driven\" state. The next state is decided upon the behavior of the intruder. The next state is going to be either S4 or S7 according to which methodology is preferable to the intruder.