# Multi-Layer Attack Graph Analysis in the 5G Edge Network Using a Dynamic Hexagonal Fuzzy Method
## 5 The New Vulnerability Analysis Approach (VAA)
### Develop the VAA Using the Hexagonal Fuzzy TOPSIS Method  
The new proposed approach integrates the TOPSIS with the HFN approach. This approach uses the same attack Graph Generator (GG) and the three-layer hierarchical model that is based on the vulnerability and dynamic network factors described in Section 5.1. In the following, we describe the steps of the proposed approach. **Step 1: Construct the fuzzy decision matrix \(M\)**. The fuzzy decision matrix has each entry of the HFN as given below:  
\[M=\left( \begin{array}{cccc}X_{11}&X_{12}\cdots&X_{1m}\\ X_{21}&X_{22}&X_{2m}\\ \vdots&\ddots&\vdots\\ X_{n1}&X_{n2}\cdots&X_{nm}\\ \end{array} \right)\]  
where \(x_{\bar{y}}=(x_{\bar{y}1},\,x_{\bar{y}2},\,x_{\bar{y}3},\,x_{\bar{y}4},\,x_{ \bar{y}5},\,x_{\bar{y}6})\), \(i=1,2,3,\,\ldots,\,m;j=1,2,\,3,\ldots,\,n\), represents the number of alternatives and criteria, respectively. **Step 2: Construct the normalized decision matrix \(N^{-}{}_{\bar{y}}\)** using \(M\) entries as shown in Equation (13). \[N^{-}{}_{\bar{y}}=\frac{x_{\bar{y}1}\,x_{\bar{y}2}^{-}}{\sqrt{\sum_{j=1}^{n} \,x_{\bar{y}j}^{-2}}},\,\,i=1,2,\ldots,m \tag{13}\]  
**Step 3: Calculate the weighted normalized decision matrix. **  
The weighted normalized decision matrix \(E^{-}{}_{\bar{y}}=N^{-}{}_{\bar{y}}\times W^{-}{}_{\bar{y}}\), where \(i\)\(=1,2,\ldots,m\) and \(j\)\(=1,2,\ldots,n\). Where \(W^{-}{}_{\bar{y}}\) is the weight of the criterion which refers to the weight of the impact of each layer's dynamic factors, in the GG three-layer model, on the attacker decision. Unlike the classical TOPSIS method described in Section 5.1, which uses the \(\lambda_{max}\) (the largest eigenvalue of matrix \(M\)) to compute the weight of the criterion, we introduce a spe \begin{table}
\begin{tabular}{c c c c} \hline \hline  & \multicolumn{3}{c}{**Exploitation Starting Point**} \\ \cline{2-4}  & **CVE-2004-0417** & **CVE-2004-0415** & **CVE-2002-0392** \\ \cline{2-4}
**Attacker** & _I_: disruption for NFVI & A5 & A5 & A5 \\
**Goal** & _S_: illegitimate access & & & \\  & to Shared SDN & A12 & A0–A12, A12 & A12 \\ \cline{2-4}  & _P_: illegitimate access & & & \\  & to the RAN & A2 & A0–A2, A2 & A2 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Attacker Decision Matrix. cial structure of fuzzy numbers, Normalized Fuzzy Weight, that represents a fuzzification of crisp normalized weights that are defined as non-negative real numbers \(w_{1}\), \(w_{2}\),..., \(w_{n}\) such that \(\sum_{j=1}^{n},w_{j}=1\). Fuzzy numbers \(W_{1}\), \(W_{2}\),..., \(W_{n}\) defined on \([0,1]\) are called normalized fuzzy weights if for any \(\alpha\in(0,1]\) and all \(j\in N_{n}\) the following holds:  
For any \(w_{j}\in W_{j\mu}\) there exist \(w_{i}\in W_{i\mu}\), \(j\in N_{n}\), \(i\
eq j\), such that \(w_{j}+\sum_{j=1,\ j\
eq i}^{n}\)\(w_{j}=1\). Normalized fuzzy weights make it possible to model mathematically an uncertain division of a unit into \(n\) fractions. Figure 8 illustrates an example of normalized fuzzy weights. **Step 4: Calculate the fuzzy positive ideal alternative \(E^{-+}\) and the fuzzy negative ideal alternative \(E^{--}\)** as shown in Equations (14) and (15), respectively. \[E^{+}=\left(E^{+}{}_{1},\ E^{+}{}_{2},\ E^{+}{}_{3},\ \ldots,\ E^{+}{}_{n} \right)=\left\{\left(\max_{j}E_{ij}\middle|i\in B\right)\text{, }\left(\min_{j}E_{ij}\middle|i\in C\right)\right\} \tag{14}\]  
\[E^{-}=\left(E^{-}{}_{1},\ E^{-}{}_{2},\ E^{-}{}_{3},\ \ldots,\ E^{-}{}_{n} \right)=\left\{\left(\min_{j}E_{ij}\middle|i\in B\right)\text{, }\left(\max_{j}E_{ij}\middle|i\in C\right)\right\} \tag{15}\]  
where \(E^{-+}\)\(i\) is the max value of \(i\) for all the alternatives and \(E^{--}\) is the min value of \(i\) for all the alternatives. \(B\) and \(C\) represent the positive (based on the benefit criteria) and negative ideal solutions (based on the cost criteria), respectively. The benefit criteria from the attacker perspective include high exploitability, high latency, low speed... etc. The cost criteria include long exploit time, low latency, low speed... etc.