## 3 System and Model Description
### Attacking Model  
We use the attacking model combining scenarios from [7; 14; 22]. In Figure 1, the system hardware is assumed to be trusted, and only vulnerabilities of SCVs are taken into consideration as in [7]. We also assume that online SCVs are attacked independently, and the attacker is located outside the virtualized system. Based on the severity of the damage, the attacks can be (a) passive attacks or (b) active attacks [61; 62]. In the former case, attackers are interested in eavesdropping on the communication between users to reconnoiter some information without meddling in the database, such as traffic analysis and wiretapping. In these scenarios, attackers achieve their goal without compromising all SCVs. Interested in disrupting, intercepting, or modifying network communications, the latter case always generates false data and tampers with clean data, such as tampering, forgery, and Denial of Service (DoS). In these scenarios, attackers need to compromise a certain number of executors. The first scenario can be seen as a particular case of the second one when \(M=1\). Hence, in this paper, we concentrate on the second case, which is more intricate whereas the proposed model can be adjusted to suit the first case. To launch a 51% attack that threatens the system security, attackers only need 25% of the computing power [63]. Hence, nodes with more computing power are easier to be targeted by attackers. For instance, for an active attack scenario, an outsider attacker intrudes into the ACD network from the internet through a blockchain node (entrance) towards another target node. As in [14; 22], the RMS manages the locations of nodes it needs to communicate with and defines communication patterns between them. As a result, even if a node is compromised, the attacker must follow the exact communication pattern to hide and keep their privileges. So, for this attacker, a legitimate path of nodes between an entrance and the target makes up an attack chain. We assume that attacks outside the attack chain will be identified and captured by the defender, so only attacks inside the chain will be analyzed. On the way to approach the target, the attacker needs to compromise each node one by one throughout the attack chain. For every movement forward, the attacker must compromise connective SCVs to detect the following location to attack before the node is migrated. When attacking each node, the attacker tends to compromise a certain amount of SCVs with a specific wrong output out of expectation for the defenders and obtain sensitive information about the subsequent nodes. An example. Before we present the three-layer analytical model, we introduce an example to illustrate the attacking process, as shown in Figure 2. As Figure 1 shows, the attacker has crushed two nodes and is attacking the third node (i.e., the online SCVs of the first two nodes are all compromised drawn in red cold, and part of the SCVs of the third node is drawn in red). The attacking process can be divided into three layers. The whole attacking process contains many migration periods according to the adopted defensive mechanism. Each migration period consists of many repetitive attacks on a single node. Repetitive attacks involve many single-step attacks. Firstly, to compromise an ACD node, the attacker sends requests with malware to the node's RMS after obtaining the host information. RMS is unable to distinguish a malicious request from the arriving requests. So, all requests are allocated to the VMs together. By co-residing with VMs, attackers can obtain and tamper with sensitive information. When the attacker compromises at least \(M\) VMs, corresponding to the threshold required to pass in the N-version verification, it successfully corrupts the ACD node. At this time, the attacker can obtain all sensitive information related to traffic between nodes and the necessary privileges to advance towards the destination nodes, such as the locations of the following hosts and the communication pattern between them.