# Modeling Intruder Reconnaissance Behavior through State Diagrams to Support Defensive Deception
## 4 Modeling Reconnaissance Activity
### Metrics
#### 4.6.5 Metrics Calculation Example  
In the present subsection, we will present a calculation of the above metrics for a given network topology with and without deception measures applied. The initial calculation is performed for a network topology that consists of 15 Workstations, 2 Web servers, 2 Database servers, and 1 File Server. Next, we present a calculation of the metrics for the same network topology given that 20 deception hosts have been added to the network. In both cases, the node for which the metrics are calculated is the File server since it is considered the most critical node of the network.  
The calculation of the metrics aims at showcasing their usability with respect to quantifying the overhead induced to the attacker by using a given defensive deception mechanism.  
Figure 5 shows the \"Average hops to a node\" metric. Specifically, the requested node is \"port 445 of the File server is Open\" using TCP SYN Scan. As shown, the average hops to reach this node is lower in the initial network topology than in the deception network topology.  
Figure 6 shows the \"Node Occurrence Probability\" metric. Specifically, the requested node is \"port 445 of the File server is Open\" using TCP SYN Scan. As shown, the occurrence probability of this node is lower in the deception network topology than in the network topology before the deception.  
In the specific scenario, we assume a number of different knowledge levels for the intruder's behavior which leads to varying numbers of paths. For each one of these scenarios, we take into account a specific deception strategy (adding 20 deception hosts) and we calculate the proposed metrics before and after applying the defensive deception mechanism.  
The results for the metrics (Node occurrence probability and the Average hops to a node) of the node that represent the event \"port 445 of the File server is found Open using TCP SYN scan\" are given in Figures 5 and 6.  
For the \"Average hops between nodes\" metric, the distance between the node \"File Server is UP\" using ICMP Echo Request and \"port 445 of the File server is Open\" using TCP SYN Scan is calculated. This corresponds to the time required for the intruder to determine the existence of a service on the host after the discovery of the host itself. This is independent of the number of paths. Initially, this distance is 121 hops and after the use of the deception mechanism, this distance is increased to 237 hops.  
In general, it has to be noted that in scenarios with a high level of knowledge of the intruder's behavior (and thus a low number of total paths), the effect of the occurrence  
Figure 5: Average hops to a node.  
of a single node (corresponding to a single action) in a path is stronger with respect to the aforementioned metrics. On the other hand, when the level of knowledge is lower, the effect of the occurrence of a node is less evident. As the number of paths increases in Figures 5 and 6, the values of the metrics tend to be less affected by the occurrence of a node in a single path.