## 4 Markov Detection and Prediction (MDP) Model
### MDP Model
#### 4.2.2 Generating the Equilibrium Equations  
Since we have many notations in the following equations, we summarize them in Table 1. \begin{table}
\begin{tabular}{c c} \hline \hline
**Symbol** & **Description** \\ \hline \(C_{1}\) & The threshold of the Authentic phase \\ \(C_{2}\) & The threshold of the Suspicious phase \\ \(i\) & number of ongoing services for the Read Request (\(R_{R}\)) \\ \(j\) & number of ongoing services for the Modify Request (\(M_{R}\)) \\ \(\lambda_{i}\) & average arrival rate for \(R_{R}\) (\(i\)\(+\)) \\ \(\lambda_{j}\) & average arrival rate for \(M_{R}\) (\(j\)\(+\)) \\ \(\mu_{i}\) & completed service rate for \(R_{R}\) (\(i\)\(-\)) \\ \(\mu_{j}\) & completed service rate for \(M_{R}\) (\(j\)\(-\)) \\ S(\(i\),\(j\)) & The state with certain \(i\) and \(j\) requests \\ \(\pi_{(i,j)}\) & Steady-state probability \\ \(\Pi\) & Steady-state probability vector \\ \(D_{R}\) & number of ongoing Malicious for Delete Request (\(D_{R}\)) \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Symbols, values, and descriptions. Figure 4: Representation of the MDP model as a set of generic states, where “\(i\)” represents the number of ongoing services for Read Request (\(R_{R}\)), “\(j\)” is the number of ongoing services for Modify Requests (\(M_{R}\)), “\(C_{1}\)” is the threshold of the Authentic phase, “\(C_{2}\)” is the threshold of suspicious phase, and “\(D_{R}\)” is the number of ongoing Malicious Delete Requests. We will generate the equilibrium equations by considering new arrival events with an arrival rate \"\(\lambda\)\" and a service rate \"\(\mu\)\". In this paper, we assume that the time intervals for observation are sufficiently brief so that only one transition (\(i\)+, \(i\)\(--\), \(j\)+, \(j\)\(--\)) may occur during each period. Based on this assumption, the system might fall into one of the following four phases:  
1. Initial phase, where \(i=j=0\) includes one state S(0,0), as shown in Figure 6.  
Figure 5: Representation of the MDP model as a set of states (\(C_{1}=2\) and \(C_{2}=3\)), where “S(\(i\),\(j\))” is the state with certain \(i\) and \(j\) requests, “\(i\)” represents the number of ongoing services for Read Requests (\(R_{R}\)), “\(j\)” is the number of ongoing services for Modify Requests (\(M_{R}\)), “\(C_{1}=2\)” is the threshold of the Authentic phase, “\(C_{2}=3\)” is the threshold of the suspicious phase, and “\(D_{R}\)” is the number of ongoing Malicious Delete Requests. Figure 6: Transitioning from S(0,0) in the “Initial phase” to different states in the “Authentic phase”; “S(\(i\),\(j\))” represents different states, where “\(i\)” is the number of ongoing services for Read Requests (\(R_{R}\)) and “\(j\)” is the number of ongoing services for Modify Requests (\(M_{R}\)). S(0,0) can be represented with the following equilibrium equation:  
\[(\lambda_{i}+\lambda_{j})\pi_{(0,0)}=\mu_{i}\pi_{(1,0)}+\mu_{j}\pi_{(0,1)} \tag{1}\]  
(2) Authentic phase, where \(0<i+j\leq C_{1}\), as show in Figure 7:  
This phase can be represented with the following equilibrium equation:  
\[(\lambda_{i}+\lambda_{j}+\mu_{i}+\mu_{j})\pi_{(i,j)}=\lambda_{i}\pi_{(i-1,j)}+ \lambda_{j}\pi_{(i,j-1)}+\mu_{i}\pi_{(i+1,j)}+\mu_{j}\pi_{(i,j+1)} \tag{2}\]  
(3) Suspicious phases, where \(C_{1}<i+j\leq C_{2}\), as show in Figure 7.  
This phase can be represented with the equilibrium Equation (2). (4) Malicious phase, where \(C_{2}<i+j\), as shown in Figure 8:  
The Malicious phase can be represented with the following equilibrium equation:  
Figure 4:0  
Assuming that \(C_{1}=2\) and \(C_{2}=3\), and based on the generic balance Equations (1)-(3), we can generate ten balance equations that rule ten states:  
1. Balance Equation (1) for S(0,0) in the \"Initial phase\", where \(i=j=0\):  
Figure 4:1  
Figure 4:2 Transitioning from the “Malicious phase” to the “Suspicious phase”; “S(\(i\),\(j\))” represents different states, where “\(i\)” is the number of ongoing services for Read Requests (\(R_{R}\)) and “\(j\)” is the number of ongoing services for Modify Requests (\(M_{R}\)).