# Modeling and Performance Analysis of Satellite Network Moving Target Defense System with Petri Nets
## 4 SPN-Based Modeling and Performance Analysis
### Modeling and Analysis of Active Defense-Based Satellite Network with SPN  
From Section 2.3, we know that the research on MTD based on the change of network attack surface is the most common and mature. Therefore, this paper focuses on the modeling and analysis of the satellite network moving target defense system based on the change of network attack surface. The communication scenario is shown in Figure 7.  
When there is a communication demand between two user segments A and B, the MTD-based satellite network communication process is as follows:  
1. The ground user terminal in user segment A sends a synchronization authentication request to satellite L1 according to the established rules;
2. L1 responds to the user with authentication and turns on the synchronization service to ensure the legitimacy of the access entity and to resist spoofing by unauthorized users;
3. The authenticated trusted user terminal sends a service request to L1 and waits for the service response;
4. Both parties obtain link bandwidth resources and L1 responds to the service request;  
Figure 7: Communication scenario for the satellite network security protection system based on Moving Target Defense. Both parties switch to Moving Target Defense communication mode, and the client transmits data to L1 through the uplink. Whenever the current satellite service time slot ends, the service provider performs hopping (IP Address, Port) and data migration, then both parties continue the unfinished communication until this uplink message transmission is completed;
6. L1 forwards the received data via the inter-satellite link to satellite L2, which is responsible for the communication of user segment B;
7. L2 transmits the data to B via the downlink, thus completing the communication between A and B. Based on the above analysis and the study in [42], the corresponding SPN model is obtained as shown in Figure 8. The meaning of each place and transition as well as the corresponding number of tokens is shown in Table 4. We denote \(\lambda=\{\lambda_{1},\lambda_{2},\lambda_{3},\lambda_{4},\lambda_{5},\lambda_ {6},\lambda_{7},\lambda_{8}\}\) as the average transition firing time rate and \(\tau=\{\tau_{1},\tau_{2},\tau_{3},\tau_{4},\tau_{5},\tau_{6},\tau_{7},\tau_{8}\}\) as the average implementation delay. From Table 4, we can see that the corresponding relationship between the transition and the above two parameters is consistent with those described in Section 4.1. Compared with the model in Figure 5, the SPN model based on Moving Target Defense adds a synchronization place (\(P_{syn}\)) and a migration place (\(P_{swap}\)). Different from the traditional satellite network communication process, the user needs to send a synchronous authentication request (\(t_{syn}\)) before the communication is established, and only after the authentication is successful can the connection, service, and other processes be carried out. During the service process, when the satellite time slot (\(\tau_{4}\)) of the current service is exhausted, service hopping, and data migration will be conducted, this process will consume additional bandwidth resources. After all the messages from client have been received for this communication, the uplink transmission ends and the system enters a new state \(P_{rec1}\). Through analysis, we can easily get the reachable set of markings as shown in Table 5, and, furthermore, we can construct its isomorphic MC as shown in Figure 9.  
Figure 8: SPN model for satellite networks based on Moving Target Defense. The isomorphic MC contains seven markings: \(M_{0}(1000001)\), \(M_{1}(01000001)\), \(M_{2}(00100001)\), \(M_{3}(00010001)\), \(M_{4}(00001000)\), \(M_{5}(00000100)\), \(M_{6}(00000010)\), the corresponding transition matrix \(Q\) of this SPN model is:  
\[Q=\left[