# A Game-Theoretic Approach for Network Security Using Honeypots
## 3 Materials and Methods
### Attack Graph Framework  
The attack graph framework is simply designed to collect information about the network such as topology, vulnerabilities, configuration and connectivity so that the information collected is used to generate the attack graph. To acquire network information, there is a need to have network access from a source to a destination. In this way, a reachability matrix can be modeled which is a two-dimensional matrix where the source IP is the first dimension, and the destination IP is the second dimension. The reachability network's matrix described in Table 1 defines the VM as a virtual machine that is hosted on a server, the IP that is allocated to the VM, and the services that are running on a VM which allow interaction with other services running on different VMs. Large networks which contain different platforms, operating systems, and several types of connectivity have security issues that inevitably are not noticed by the security admins. The model we propose is a Stackelberg game model where the defender takes the first action and the attacker follows. Adding honeypots helps the defenders secure the network and creates a complex environment for the attacker. Assuming the attacker is using a scanning tool, the real host cannot be identified from the honeypots and has to search for an optimal attack plan. For simplicity, we must consider that two hosts are identical if they run the same services and are equal in terms of connectivity. Notations:  
\(N\)--represents a network with services/hosts;  
\(s\)--represents a service/host;  
\(T\)--represents types of services/hosts;  
\(T=[t_{1},t_{2},t_{3},\ldots,t_{n}]\), where \(t\) represents a type of service/host;  
\(S=[s_{1},s_{2},s_{3},\ldots,s_{n}]\)--hosts/services of type \(t\) in network \(N\);  
\(H=[h_{1},h_{2},h_{3},\ldots,h_{n}]\)--honeypots of type \(t\) in network \(N\), where \(H\subset N\);  
\(A=[a_{1},a_{2},a_{3},\ldots,a_{n}]\) represents the attacker's actions;  
\(D=[d_{1},d_{2},d_{3},\ldots,d_{n}]\) represents the defender's actions. Placing several honeypots into our network can represent the defender's actions and the network is represented by:  
\[d(t)=h(t)+s(t) \tag{1}\]  
The probability that an attacker chooses a honeypot increases with the number of honeypots deployed in the network. If the attacker has access to a honeypot, the defender can be alerted, and the attack should be blocked with 0 second of network downtime. Everything resumes to costs and success probabilities so we must define the following: \begin{table}
\begin{tabular}{c c c c c} \hline \hline  & & \multicolumn{3}{c}{**Destinations**} \\ \hline  & & \(\mathbf{VM_{x}}\) & \(\mathbf{VM_{y}}\) & \(\mathbf{VM_{z}}\) \\  & & \(\mathbf{IP_{x}}\) & \(\mathbf{IP_{y}}\) & \(\mathbf{IP_{z}}\) \\ \hline \multirow{2}{*}{Sources} & \(\mathrm{VM_{a}}\) & \(\mathrm{IP_{a}}\) & \(\mathrm{Service_{m}}\) & \multirow{2}{*}{\(\mathrm{Service_{o}}\)} \\  & \(\mathrm{VM_{b}}\) & \(\mathrm{IP_{b}}\) & & \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Reachability matrix. \(c(s)\)--the cost of the service/host which is duplicated with a honeypot;  
\(l(s)\)--the loss of the service and data;  
\(c(a)\)--the cost of the attacker;  
\(c(d)\)--the cost of the defender. \(p(a)\)--the attacker's success probability;  
\(resp(a)\)--the attacker's response to the defender's action;  
\(resp(d)\)--the defender's response to the attacker's action;  
The honeypots are defined in our work as fake host that resembles real hosts, running services that resemble the real ones. The necessity of using honeypots is to create a more complex environment where the defender has more time and can gather more information about an attack. The work is focused on the defender as the first player in our game. The cost of installing and maintaining a honeypot depends on the type of real host. [PERSON] et al. stated in their work [PERSON] et al.