Effective Proactive and Reactive Defense Strategies against Malicious Attacks in a Virtualized Honeynet

Table 3

Verbal notations.

Notation	Description
𝐺core𝑖	Loading of each residual core node 𝑖, where 𝑖∈𝐶
𝑈link𝑖	Link utilization of each link 𝑖, where 𝑖∈𝐿
𝐾effect	Negative effect caused by applying fake traffic adjustment
𝐼effect	Negative effect caused by applying dynamic topology reconfiguration
𝐽effect	Negative effect caused by applying local defense
𝑂tocore	The number of hops legitimate users experienced from one boundary node to core nodes
𝑌	The total compromise events
𝑊threshold	The predefined threshold about QoS
𝑊final	The QoS level at the end of attack
𝑊(⋅)	The value of QoS determined by 𝐺core𝑖, 𝑈link𝑗, 𝐾effect, 𝐼effect, 𝐽effect, and 𝑂tocore, where 𝑖∈𝐶, 𝑗∈𝐿
𝜌defense𝑖	The total defense resource of the shortest path from compromised nodes detected to core node 𝑖 divided by total defense resource, where 𝑖∈𝐶
𝜏hops𝑖	The number of hops from compromised nodes detected to core node 𝑖 divided by the number of hops from attacker’s starting point, where 𝑖∈𝐶
𝜔degree𝑖	The linking number of core node 𝑖 divided by the maximum number in the topology, where 𝑖∈𝐶
𝑠^𝑖priority𝑗	The priority of service 𝑗 provided by core node 𝑖 divided by the maximum service priority in the topology, where 𝑖∈𝑆, 𝑗∈𝐶
𝛽threshold	The risk threshold of core nodes
𝛽(⋅)	The risk status of each core node, which is the aggregation of defense resource, number of hops, link degree, and service priority