## 4 Security Analysis
### Single-Step Attacks  
SRN improves on Stochastic Petri Nets (SPN) in terms of the ability to specify output measures as reward-based functions. It is a mathematical modeling language for a detailed description of current systems such as concurrency, synchronization, sequencing, and multiple resource possession. This section presents the proposed SRN model, consisting of two sub-models: Task Sub-model and Arbitrating Sub-model. The example in Figure 5 presents one of the \begin{table}
\begin{tabular}{c c l} \hline \hline  & **Variable** & **Description** \\ \hline \multirow{5}{*}{SRN model} & \(N\) & A positive integer denoting the number of online SCVs \\ \cline{2-3}  & \(M\) & A positive integer indicating the output threshold, \(M\in[\lceil N/2\rceil,N]\) \\ \cline{2-3}  & \(r_{i}\) & The being compromised probability of \(SCV_{i}\) \\ \cline{2-3}  & \(p_{A}\) & The probability of compromising one node by an attack \\ \cline{2-3}  & \(p_{W}\) & The working probability of a node \\ \hline \multirow{2}{*}{Poisson model} & \(r\) & Attack rate \\ \cline{2-3}  & \(\mu\) & The probability of compromising one node over each migration period \\ \hline \multirow{5}{*}{Markov Martingale} & \(T\) & Migration period \\ \cline{2-3}  & \(\omega\) & The probability for each node to be migrated in every migration period \\ \cline{2-3}  & \(L\) & The length of attack chain \\ \cline{2-3}  & \(\pi_{i}\) & The probability of \(i^{th}\) node being compromised \\ \cline{2-3}  & \(MTTA\) & Mean Time to Attack: the expected time until the attacker compromises his \\ \cline{2-3}  & \(MTTR\) & Mean Time to Repair: the expected time until the attacker is being returned \\ \cline{2-3}  & back to the entrance (\(\omega>\mu/(\mu+1)\)) \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Summary of Notations. configurations \(N~{}=~{}3\) and \(M=2\). In such an example, the RMS of an ACD node is mapped to three SCVs, and the output threshold is two. The proposed SRN model describes the execution process of a task by \(N\) SCVs. It has several possible results: either (1) the task is completed with a correct vector, (2) the task is tampered with by a compromised vector, or (3) the SCVs mistakenly return erroneous vectors even if they are not attacked. In the third case, it is challenging for these SCVs to generate an identical error. Similar to [22], we assume a negligible probability that an unexpected mistake and the compromised output designed by the attacker coincide. Additionally, we distinguish them with \(Error\) and \(Attacked\) states and assume that the corresponding \(error\) results and \(compromised\) results never match each other. Depending on the number of \(correct\), \(compromised\), and \(error\) results, the states of an ACD node are classified into three types. Working (W). SCVs finish with at least \(M\) correct results. In this state, the RMS takes the correct result as the output. Attacked (A). An attacker compromises at least \(M\) SCVs with a compromised result. RMS receives these consistent wrong results and votes them as the legal ones to output. The node is in a compromised state. Error (E). In \(N\) results from SCVs, there is no legal output received more than \(M\) times. In Figure 5, the Task sub-model represents a task executed in online SCVs, and Arbitrating Sub-model describes that the RMS votes on the received vectors. The notations, settings of transitions, and guard functions are defined in Tables 2-4 respectively. In these three tables, the index \(i\) represents the number identifying the selected SCV where \(i\in[1,3]\). The element \(x\) indicates different status and \(x\in w,a,e\) for transitions and \(x\in W,A,E\) for places. Using these graphs, the SRN model describes the intricate defensive processes in a more comprehensible way. In Figure 5, the \"place\" circles denote the system status. Filled rectangles denote immediate transitions, while open rectangles denote timed transitions. Both transitions describe \"behaviors\" during the defensive process.