# A Game-Theoretic Analysis for Distributed Honeypots
## 3 System Model  
In this section, we introduce the distributed honeypots model. The notations used in this section are shown in Table 1. \begin{table}
\begin{tabular}{l l} \hline \hline
**Symbol** & **Description** \\ \hline \(t_{i}\) & A point of time \\ \(T_{i}\) & A period \\ \(Server_{i}\) & A server \\ \(Service_{fake}\) & honeypot \\ \(Service_{real}\) & Real service \\ \(Service_{null}\) & Closed service \\ \(Sum_{server}\) & Sum of servers \\ \(Sum_{service}\) & Sum of services \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Notations used in system model. Figure 1 demonstrates the system structure. There are several hosts in our system, which serve as servers for providing some necessary services. These services are installed in every server, such as a web service, a database service and a file service. There are two categories in each service: fake service (i.e., honeypot) and real service. Resources regarding a real service are in a specific folder. Besides, a different folder contains fake resources for a honeypot, which aims at luring, interacting, and identifying an attacker. A real service may be on one of the servers \(\{server_{1},server_{2},...,server_{sum_{server}}\}\). At the meantime, there exist some fake services among them, which serve as decoys for unexpected intruders. Next, we present formalization description regarding the distribution of services. A two-dimensional array is formed:  
\(serviceArr[Sum_{server},Sum_{service}]=\{\{0,1,\ldots,1,0\},\{1,0,\ldots,0,1\}, \ldots,\{0,1,\ldots,0,1\},\{0,1,\ldots,0,0\}\}\). The row illustrates all services in a server. As illustrated in Table 2, every two 01 codes indicate the state of one service. Figure 2 presents distribution of all services at \(t_{0}\). There are five servers and eight kinds of services. As illustrated in Table 3, the two-dimensional array at \(t_{0}\) is \(serviceArt_{t_{0}}[5,8]=\{\{1,0,0,1,0,0,0,1\},\{0,1,1,0,0,0,0,1\},\{0,0,0,1,0,0,1 \},\{0,0,0,1,0,0,0,0\},\{0,1,0,0,0,1,1,0\}\}\). \begin{table}
\begin{tabular}{l l l} \hline \hline
**Codes** & **Symbol** & **Description** \\ \hline
00 & \(Service_{null}\) & Service is closed \\
10 & \(Service_{real}\) & Real service is opened \\
01 & \(Service_{fake}\) & Honeypot is opened \\ \hline \hline \end{tabular}
\end{table} 
Table 2: The illustration of 01 codes. Figure 1: System model. As shown in Figure 3, all services are periodically changing. Traffic identification is done once an invasion of a honeypot occurs. Any intrusion records detected in honeypots are labeled as illegal traffic. There are three possible cases for an attacker:  
* Honeypot. The attacker intrudes into a honeypot. For example, Nginx is a honeypot at \(t_{0}\). Any access to Nginx will be labeled as illegal traffic. * Real service \(\Longrightarrow\) honeypot. The attacker gains access to a real service. However, it becomes a honeypot at \(t_{1}\) in the next period \(T_{1}\). For example, MySQL is a real service at \(t_{0}\) and becomes a honeypot at \(t_{1}\). Any access to MySQL will be identified as illegal traffic at \(t_{1}\). * Real service \(\Longrightarrow\) Real service \(\Longrightarrow...\Longrightarrow\) honeypot. The attacker intrudes into a real service for \(s\) times. Since the real services are always unpredictable for an attacker, the probability to meet a real service is \(\frac{1}{Sum_{server}\times Sum_{service}}\). In such case, the general probability is approximately equal to the minimum number \(\{\frac{1}{Sum_{server}\times Sum_{service}}\}^{s}\).