# Research on SWIM Services Dynamic Migration Method +
## 4 SWIM Service Dynamic Migration Method  
The malicious attacker's malicious attack behavior can be divided into two stages. The first stage is the infiltration stage, which mainly performs the detection behavior such as vulnerability scanning, finds exploitable vulnerabilities of SWIM service providers, and formulates relevant attack strategies. The second phase is the attack phase. According to the previous detection results, the SWIM service provider launches a malicious attack, obtains the control of the SWIM service provider, or makes some destructive behaviors such as stealing and destroying. The attack process of a malicious attacker is shown in Figure 4.  
The exposure time refers to the difference between the time stamp provided by the SWIM service provider and the time when the service is stopped. If the SWIM service provider is exposed to the network for a long time, it will increase the probability of successful detection by the malicious attacker. As shown in Figure 4, the system exposure time of the SWIM service provider A is shorter than the penetration time of the malicious attacker, and the attacker's early penetration has not been completed, and the complete attack cannot be launched. If SWIM service provider A self-repairs during the offline phase and changes its characteristics, the early infiltration work of the malicious attacker will be invalid. The SWIM service provider B's system exposure time is sufficient for a malicious attacker to launch a complete attack, which will seriously threaten the security of the SWIM service. Assume that the time required for the infiltration phase is \(PSt\), the time required for the attack phase is \(APt\), and the exposure time of the SWIM service provider is \(E_{t}\). In order to ensure the safe and reliable operation of the SWIM service provider, it is necessary to ensure that the SWIM service provider exposure time meets the Formula (1). \[E_{t}<PS_{t}+AP_{t}. \tag{1}\]  
There are two ways to ensure that the SWIM service provider meets the requirements of Equation (1). The first is to prolong the detection time of malicious attackers, mainly by fixing vulnerabilities, detecting attacks, building firewalls, etc. The second way is to shorten the exposure time of SWIM service providers. SWIM is a distributed large-scale information network, and the distributed SWIM domain manages the SWIM service registration information of the whole network. In the SWIM network,  
Figure 4: The attack process of a malicious attacker. multiple heterogeneous SWIM service providers can provide SWIM services of the same service topic externally. The diversity of SWIM service providers creates innate conditions for the migration of SWIM services. From the perspective of increasing the survivability of SWIM services, this paper randomly selects different SPs to provide services to SWIMs based on the idea that \"mobile targets are more secure\", so that SWIM service data sources achieve random dynamic migration between different databases. By continuously and dynamically migrating to hide the service node, the exposure time of the SWIM service provider is shortened, the attack success rate is reduced, and the attack cost of the malicious attacker is increased. Then, how to guarantee the time randomness and spatial randomness of the mechanism are two key issues. Time randomness refers to the randomness of the trigger time of the SWIM service dynamic migration mechanism. If the trigger mechanism uses a fixed-cycle trigger, the trigger period will be detected by the attacker, which will increase the probability of successful attack by the malicious attacker. In the process of providing services to SWIM, only the service migration mechanism is guaranteed to be trigged randomly, so that the service time window of each SP is different to achieve the purpose of confusing the attacker. Spatial randomness refers to the randomness of the SWIM service dynamic migration method to select the destination node.