# Hydrakon, a Framework for Measuring Indicators of Deception in Emulated Monitoring Systems
## 6 Proposed Method
### Results  
We ran several experiments and applied cosine similarity on real machines, virtual machines and sandboxes using the following Windows 10 groups: processes, services, devices, Windows files and applications. The real machines formed the ground truth of what artifacts a real system should contain. We performed experiments on clients that represent real machines, several types of virtual machines and sandboxes. The results are displayed below in table format and a bar chart.  
The provided data in Table 2 and Figure 7 show cosine similarity scores for various comparisons between different machine types across five categories: processes, services, devices, Windows files and applications. Here is a detailed analysis of the results:  
Real Machine vs. Real Machine  
* Highest overall similarity across all categories.
* Processes (0.969231), services (0.929368), and Windows files (0.996811) show very high similarity.
* Devices (0.894675) and applications (0.673466) show lower, but still significant similarity.  
Real Machine vs. Virtual Machines  
* High similarity in Windows files (0.992366) and services (0.911567).
* Lower similarity in processes (0.861892) and devices (0.507519).
* Very low similarity in applications (0.370091).
* Real Machine 1 vs. VMware VM 1:
* Similar pattern to VirtualBox, but with even lower similarity in processes (0.751921).
* Devices (0.478306) and applications (0.384610) show very low similarity.
* Real Machine 1 vs. KVM VM 1:
* Slightly higher similarities compared to other VMs, especially in processes (0.824435).
* Still low similarity in devices (0.536543) and applications (0.420891).  
Virtual Machine Comparisons  
* VirtualBox VM 1 vs. VMware VM 1:
* High similarity in Windows (0.997278) and services (0.918421).
* Moderate similarity in processes (0.790805) and devices (0.713197).
* Low similarity in applications (0.538860).
* VirtualBox VM 1 vs. KVM VM 1:
* Higher similarities across all categories compared to VirtualBox vs. VMware.  
\begin{table}
\begin{tabular}{l l l l l l} \hline \hline
**Artifacts for Bare Metal, Virtual Machine, Sandbox** & & & & & \\  & **Processes** & **Services** & **Devices** & **Windows Files** & **Applications** \\ \hline
**Real Machine 1 vs. Real Machine 2** & 0.969231 & 0.929368 & 0.894675 & 0.996811 & 0.673466 \\
**Real Machine 1 vs. VirtualBox VM 1** & 0.861892 & 0.911567 & 0.507519 & 0.992366 & 0.370091 \\
**Real Machine 1 vs. VMware VM 1** & 0.751921 & 0.906392 & 0.478306 & 0.992389 & 0.384610 \\
**Real Machine 1 vs. KVM VM 1** & 0.824435 & 0.913312 & 0.536543 & 0.994722 & 0.420891 \\
**VirtualBox VM 1 vs. VMware VM 1** & 0.790805 & 0.918421 & 0.713197 & 0.997278 & 0.538860 \\
**VirtualBox VM 1 vs. KVM VM 1** & 0.869318 & 0.925432 & 0.649151 & 0.994651 & 0.771136 \\
**Real Machine 1 vs. Custom Sandbox 1** & 0.851874 & 0.911567 & 0.487833 & 0.994930 & 0.433623 \\
**Real Machine 1 vs. Flarevm Sandbox 1** & 0.727281 & 0.892733 & 0.487316 & 0.609858 & 0.094538 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Display cosine similarity results from comparing real machines, virtual machines and sandboxes against each other, using the five categorial artifacts.  
Real Machine vs. Sandboxes  
1. Real Machine 1 vs. Custom Sandbox 1: * Similar pattern to VM comparisons, with high similarity in Windows files (0.994930) and services (0.911567). * Low similarity in devices (0.487833) and applications (0.433623).
2. Real Machine 1 vs. Flarevm Sandbox 1: * Lowest similarities across most categories, especially in applications (0.094538). * Significantly lower Windows files similarity (0.609858) compared to all other comparisons.  
Figure 7: Display cosine similarity of bare metal, virtual machine and sandbox artifacts in graph format.