# Location-Aware Measurement for Cyber Mimic Defense: You Cannot Improve What You Cannot Measure
## 4 Metrics in the Objective Space
### Single Node  
**Definition 1** (Network topology).: _We represent the network community as a binary group \(NC_{i}=(N,E)\), where \(N\) is the set of all nodes (hosts) in the network, including switches, routers, firewalls, etc., and \(E\) is the set of connection relationships between these nodes._  
**Definition 2** (Vulnerability set).: _A collection of all possible vulnerabilities, especially zero-day vulnerabilities._  
\[VUL=VUL_{1}\cup VUL_{2}\cup\cdots\cup VUL_{n},\]  
_where \(VUL_{i}\) represents the set of all vulnerabilities on node Ni (suppose n nodes in the community) and \(VUL_{i}=\{vul_{j}|vul_{j}\) is a certain vulnerability on node \(V_{i}\}\)._In CMD systems, the adjudication algorithm generally follows the \"majority voting\" principle. Consequently, when more than half of the executors possess the same symbiotic vulnerabilities and are successfully exploited by an attacker, they can potentially deceive the arbiter and allow the attack to evade detection, similar to an environment where CMD is not deployed. As a result, we propose the following hypothesis.  
**Assumption 1**.: _For a CMD system with (21 + 1) online executors, when there exists an (1 + 1) order symbiotic vulnerability \(\mathit{vul}_{t}\), it is considered that the node where the CMD system is deployed has vulnerability \(\mathit{vul}_{t}\)._  
**Definition 3** (Vulnerability vector).: _Construct vulnerability vector \(V_{i}\) for each node._  
\[\mathbf{V_{i}}=(v_{1},v_{2},\ldots,v_{m})^{T},m=|VUL|,\]  
\[v_{k}=\begin{cases}1&\mathit{vul}_{k}\in VUL_{i}\\ 0&\mathit{vul}_{k}\
ot\in VUL_{i}\end{cases},\;k=1,2,\cdots,m.\]  
**Definition 4** (Node-vulnerability matrix).: _The indication of the corresponding relationship between nodes and vulnerabilities._  
\[\mathbf{NV_{n*m}}=(\mathbf{V_{1}},\mathbf{V_{2}},\ldots\mathbf{V_{n}})^{T}.\]  
**Definition 5** (CVSS vector).: _Construct vulnerability score vector CVSS for each vulnerability._  
\[\mathbf{CVSS}=(c\text{vss}_{1},c\text{vss}_{2},\ldots,c\text{vss}_{m})^{T},\]  
_where \(c\text{vss}_{i}(i=1,2,\ldots,m)\) represents one-tenth (For normalization) of the Common Vulnerability Scoring System (CVSS) score for the corresponding vulnerability._  
**Definition 6** (Importance vector).: _Construct importance vector IM for each node considering the centrality (location of nodes in the community) and value (value of resources owned by nodes)._  
\[\mathbf{IM}=(im_{1},im_{2},\ldots,im_{n})^{T},\]  
\[im_{k}=w_{1}\times centrality+w_{2}\times value,\;k=1,2,\ldots,n.\]  
_where \(w_{i}(i=1,2)\) represents the weight of the corresponding factors, \(\sum w_{i}=1\). Here, the weights and factors can be appropriately adjusted according to the actual situation._  
In Definitions 2-5, the vulnerability set and CVSS score can be obtained from the open CVE vulnerability database. In Definition 6, the value depends on the property and resources owned by the nodes, and the centrality calculation method needs to be selected according to the actual network situation from degree centrality, betweenness centrality, closeness centrality, etc., and all of these concepts are defined.  
_Independent failure risk._  
In CMD systems, the heterogeneity among different executors within the redundant structure is crucial and directly impacts the overall performance of the model. When multiple executors share the same vulnerability, it can lead to attacks escaping detection, rendering the cyber mimic defense strategy ineffective. From the perspective of individual nodes, we define the independent failure risk based on vulnerabilities, represented as an n-dimensional vector, where the i-th component represents the independent failure risk of node \(N_{i}\). In the formula, the importance vector \(\mathbf{IM}\) represents the likelihood of an attacker choosing to target a node, while \(\mathbf{NV}\times\mathbf{CVSS}\) represents the likelihood of successfully compromising a node if targeted in an attack.  
\[\mathbf{RI}=\mathbf{IM}^{T}\times\mathbf{NV}\times\mathbf{CVSS}. \tag{3}\]