text:
\section{Acknowledgement}
This work was supported by the Army Research Office under award W911NF-17-1-0370.

\bibliographystyle{aaai}

\section{Background and Related Work}
\label{sec:Background}

Enterprise network administrators are increasingly concerned with Advanced Persistent Threats (APTs) where adversaries first obtain a small foothold within the network and then stealthily expand their penetration over the course of months, sometimes years.
The past decade has provided numerous examples of such targeted attacks, e.g., Carbanak~\cite{Carbanak}, OperationAurora~\cite{OperationAurora}.
Such attacks require significant planning.
Initially, adversaries identify attack vectors including 1)~vulnerable servers or hosts, 2)~poorly configured security protocols, 3)~unprotected credentials, and 4) vulnerable network configurations.
To do so, they leverage network protocol banner grabbing, active port scanning, and passive monitoring~\cite{kondo2014penetration,passiveactive:2007}.
Examples of different types of desired information and corresponding attacks are shown in Table~\ref{tab:attacks}.

Software Defined Networking (SDN) has the potential to address operational and security challenges large enterprise networks~\cite{Levin:2014:Panopticon}.
They provide flexibility to programmatically and dynamically re-configuring traffic forwarding within a network~\cite{McKeown:2008:OpenFlow}
and provide opportunities for granular policy enforcement~\cite{Kim:2013:SDN}.
However, these more functional network switches form a large target for attackers as they can provide a foothold to perform data plane attacks using advanced reconnaissance and data manipulation and redirection~\cite{Markku:2014:Spook}.
Using one or more compromised switches, an adversary can learn critical information to mount attacks, including network topology and software and hardware vulnerabilities~\cite{Benton:2013:OVA,jero2017researchBEADs}.

Deception is an important tactic against adversary reconnaissance, and there have been a variety of different approaches that apply game-theoretic analysis to cyber deception~\cite{pawlick2019game}. Many of these previous works have focused on how to effectively use honeypots (fake systems) as part of a network defense~\cite{carroll2011game,wagener2009self,pibil2012game,kiekintveld2015game}. This has included work on signaling games where the goal is to make real and fake systems hard to distinguish~\cite{miah2020concealing}.  Work on security games (including games modeling both physical and cybersecurity) focuses on deception to manipulate the beliefs of an attacker~\cite{yin2013optimal,an2011refinement,horak2017manipulating,thakoor2019general}.
Another research \cite{schlenker2018deceiving} proposes a game model of deception in the reconnaissance phase of an attack, though they do not consider honey flows. Stackelberg game models have been used to find optimal strategies for cyber-physical systems~\cite{feng2017stackelberg}.

\section{Scenerio}
\textbf{Linear Program}
\begin{equation}\label{eq:defender-EV-for-single-action}
\begin{equation}\label{eq:defmax}
\max_{a^* \in A} \;\sum_{j = \{0,\dots,H^i\}}X^i_j \;\; U_{d}^i(j,a^*) \;\\
\end{equation}
\begin{equation}
s.t.\sum_{j =\{0,\dots,H^i\}}X^i_j \;
U_{a}^i(j,a^*)  \geq
\sum_{j = \{0,\dots,H^i\}}X^i_j \;\; U_{a}^i(j,a)\\
\end{split}
\end{equation}
\begin{equation}\label{eq:total}
\sum_{X^i \in S\; j\in\{0,\dots,H^i\}} X^i_j = 1 \quad \forall X^i \in S \;
\end{equation}
\begin{equation}
    a=[0,1]
    \forall a^* \in A \;
\end{equation}
U^i_d(j)= ( P_j^i U_d^{R,i} + (1-P_j^i) U_d^{H,i} -jC)\;
\end{equation}

\begin{equation*}
P_j^i =  (R^i/(j+R^i))\\
\end{equation*}
\paragraph{Network Scenerio:}
Considering a small SDN network consists of two real hosts $H_o_1$ and $H_o_2$, two switches S1 and S2 and a controller.
Ho1 has vulnerability $V^1$  and corresponding number of real flow $R^1$=1,corresponding  fake flow representing $V^1$ passing through S1 and fake host& $W_f_o_1$.Similarly,
Ho2 has vulnerability $V^2$  and corresponding number of real flow $R^2$=1. Assigned value for Ho1 is 6 and Ho2 is 5 which are given based on the information each host carry.\\

RealFlow Set=$\{H_o_1,H_o_2\}$.\\
RealFlow Value=$\{W_H_o_1=6, W_H_o_2=5\}$ \\
 fake Hosts value=$\{W_f_o_1=4, W_f_o_2=3\}$ \\
Vulnerability Set=$\{V^1, V^2\}$\\
Honeyflow set for $V^1$=$\{H^V^1_0, H^V^1_1,H^V^1_1\}$\\
Honeyflow set for $V^2$=$\{H^V^2_0, H^V^2_1,H^V^2_1\}$\\
Cost of one honeyflow  representing  $V^1$={1 unit}\\
Cost of one honeyflow representing  $V^2$={1 unit}\\
\paragraph{Attacker's action}
Attacker can exploit either Vulnerability V1(action a1 or vulnerability 2 action 2
\paragraph{Defender's action}
Defender can deceive attacker by implementing honey flow  in the network.
He can deploy honeyflow which flaunt vulnerabilities $V^1$  and $V^2$.Considering ,in this example upper bound of  honey flows are 2 for each type against real flow representing real vulnerabilities .
Implementing honeyflow associated with cost, he would try different strategies to  observe  in what probabilities of implementing different honeyflow or different strategies will maximize his utility.
Defender can take 3 actions of protection against each type of vulnerability following for $V^1$ vulnerablity\\
1.	No honeyflow $H_o^V^1$\\
2.	One $V^1$ type honey flow $H^V^1_1$ \\
3.	Two $V^1$ type honeyflow $H^V^1_2$\\
Number of real flow={1}
\begin{figure}[h]
  \centering
 \includegraphics[scale=0.8]{projecthf2.png}
  \caption{Utilies}
  \label{fig:tags}
\end{figure}

Similar actions is  taken against $V^2$ vulnerability.

U^i_d(j)= ( P_j^i U_d^{R,i} + (1-P_j^i) U_d^{H,i} -jC)\;
\end{equation}

\begin{equation*}
P_j^i =  (R^i/(j+R^i))\\
\end{equation*}
\begin{equation*}
U_d^{R,i}= -W_h_O=-6 (When--attacked)\\
\end{equation*}

$R^i$= {number of real flow representing V^1 vulnerability}\\

j= number of honey flow representing $V^1$ vulnerability\\

If fake flow is 1 and cost of one honeyflow is 1 dollar and attacker playing best response on $V^1$\\

Defenders Utility in this case\\
\begin{equation*}
U_d^i = X^1_1 ((1/(1+1))*(-6)+(1-0.5)*4-1*1)\\
=-2X^1_1
\end{equation*}

Value of fake host=4\\

Similarly Attacker's Utility when implementing one honeyflow and playing best response
\begin{equation}\label{eq:attacker-EV}
U^i_a(j) = P_j^i U_a^{R,i} + (1-P_j^i) U_a^{H,i} \\
=0.5*6-0.5*4 =1
\end{equation}
\begin{table}[ht]
\caption{Utility of both players while defender implementing honeyflow on $H_o_1$ attacker playing action a_1}
\begin{tabular}{c|c|c|}
      actions & a_1\\
     \hline
      $\ X_0$ &-6,6 \\
     \hline
    $\ X_1$  & -2,1 \\
     \hline
     $\ X_2$ & -1.34,-0.66 \\
     \hline
\end{tabular}
\end{table}

\begin{equation}
X_0 + X_1+ X_2 = 1
\end{equation}
\\
\textbf{Defender's Utility when attacker playing action a1}\\

-6$X_0$-2$X1$-1.34$X2$
Our Linear Program finds out the Value for X_0,X_1,X_2

Similar calculation below apply for v2 vulnerability and attacker action a2
\begin{table}[ht]
\caption{Utility of both players attackers, playing action a2}
\label{tab:table}

\begin{tabular}{c|c|c|}

      Strategies& a_2\\
     \hline
      $\ X^0_0$  & -4,4 \\
     \hline
    $\ X^1_1$  & -1.5,0.5 \\
     \hline
     $\ X^2_2$ & 1.33,-0.67\\
     \hline
     \end{tabular}

\end{table}

\begin{equation}
a1+a2 =1\\

\end{equation}
[a1, a2] =[1,0] or [0,1]\\

Our linear program will calculate best possible probabilities to find out the distribution of honey flow.
Defender will evaluate which action attacker can possibily take  a1 or a2.
Defenders Linear Program will determine best possible strategies for each case and from the value. In a similar way  defender can determine which action will attacker choose first based on utility calculation of attacker.

\section{Experiments}
We also deploy of deception system in MiniNet. The test topology follows Figure 2. All the values of hosts (include real and fake hosts) are 20. If attacker successes to exploit inside any real host via correct vulnerability, it can obtain the value as rewards, and meanwhile, defender lose the host value. After defender injects honey flow via fake hosts, attacker loses value if it chooses to attack fake hosts. In order to represent the cost to generate honey flows, one honey flow costs 1 value of defender.

Figure 6 shows the result of our test. The percent of honey flow is calculated as \emph{amount of honey flow $/$ amount of real flow}.
\section{Experiments}
In a specific setup our experiment can findout the upperbound of honeyflow needed for defender to gain maximum utility \\
Consder a network with V1 and V2 type vulnerability, If realFlow Value, honeyFlow Value, costOfhoney Flow ,numOfReal EachType  respectively (3, 4),( 4, 3), (0.1, 0.1), (2,2)
and upperBoundOfHoneyFlow starting from (1, 1) to (5,5)
\begin{figure}[ht]
  \centering
 \includegraphics[scale=0.6]{Attacker.png}
  \caption{Honeyflow Determination}
  \label{fig:tags}
\end{figure}
\begin{figure}[htb]
  \centering
 \includegraphics[width=\linewidth]{ratio.png}
  \caption{Utility Vs HF/RF ratio}
  \label{fig:tags}
\end{figure}

From the above graph, it can be seen that after number of honeyflow is 4, defenders utility does not change in that case defenders optimal strategy is always choosing honeyflow 4 no matter how much honey flow given.\\
In the following graph for different vulnerabilities and real flow range from 5 to 35 and honey flow range from 5 to 150 and  considering  cost of honeyflow is 0.1 each, we get an optimal defender's utility f. Similarly by varying cost of honeflow from 0 to 0.1 we found when the ratio of real host and fake host is less 1.1 and ratio of honeyflowvalue and real flow value is greater that 0.9 and ratio of no of real flow and honey flow smaller than 0.75 and cost of honeyflow is less than 0.1  defender gets it's optimal payoff.
 attackers strategy base on honeyflow variation
\begin{figure}[ht]

  \centering
 \includegraphics[width=\linewidth]{Vulnerabilities.png}
  \caption{}
  \label{fig:tags}
\end{figure}

When number of honeyflow and real flow are equal and in a network scenerio and difference among realflow value is greater than 10 in our program  Defender's strategies were chosen in a way attacker always tend to attack the flow that has minimum value. However, ratio of  honeyflowvalue and real flow value is considered less 0.9.
For the following diffrent network setup of  different vulnerabilities with real host value  value(10,20,30,40), (20,40,60,80), (30,60,90,120),(40,80,120,160)
in 4 network setup attacker's best strategy is to choose 10,20,30,40 value of hosts respectively.
Below graph represent Defender's utility with cost variation
\begin{figure}[ht]
  \centering
 \includegraphics[width=\linewidth]{Cost1.png}
  \caption{Honeyflow Determination}
  \label{fig:tags}
\end{figure}
\begin{figure}[ht]
  \centering
 \includegraphics[width=\linewidth]{cost2.png}
  \caption{Honeyflow Determination}
  \label{fig:tags}
\end{figure}
\section{Framework}
\label{sec:Framework}
\ia{[Started editing this section]}
In this section we will discuss about the basic framework
\begin{figure}[htb]
  \centering
 \includegraphics[width=\linewidth]{images/scenario.png}
  \caption{Basic framework of \imph{Snaz}}
  \label{fig:framework}
\end{figure}

\subsection{Adversary}

As the discussion above, We assume the adversary already obtain one compromised OpenFlow switch at the beginning of the game. Via this compromised switch, attacker gathers information from the network flows as its belief. Meanwhile, the main goal of adversary is attack vulnerable hosts.
In order to construct the attack, adversary capabilities include:
\begin{itemize}

\item Identify a flow $\langle o, d, i\rangle\in F$ that passes through the compromised switch, which $o$ and $d$ represent the source and destination IP address, and $i$ represents all the information inside packet.
\item Via $o, d$ and $i$, identify a vulnerability $v_t$ of a certain host $t$.
\end{itemize}

We represent attacker's belief as a tuple $\langle T, V\rangle$, which $T$ represents target set, and $V$ is vulnerabilities set. Each $t \in T$ represents one target asset, and $v_t \in V$ is defined as one vulnerability of target $t$. Through the passive scanning, attacker keeps updating the belief of suspect targets.

\paragraph{Outcome of Attacker}
The outcome of a flow attack would be a compromise state, $C'$. If attackers trust the gathered information of a certain host, they can act on it to exploit further malicious actions.

\begin{itemize}

\item Success: the attacker applies the real vulnerabilities and gains control of the target. That is, $C' = C \cup \{t\}$ provided $v\in W_t$

\item Noop: the attacker's attempt fails and the asset remains uncompromised (but neither the attacker nor the defender's state changes in other respects). That is, $C' = C$ provided $v\not\in W_t$; the attacker acquires a belief that $v\not \in W_t$

\item Defeat: the attacker is detected and, as assumed, localized.  Thus the
attacker  loses control of the asset from which it launched the
attempt. That is, $C' = C \setminus \{l\}$ provided $\langle o, t, i\rangle\in H$
\end{itemize}

\subsection{Defender}
To defend the passive scanning attack, defender can apply honey flow as deception. As discussed above, the background information of hosts can be used to identify the vulnerabilities by attackers. However, via honey flow, defender can delay the processes of reconnaissance or mislead attackers when they try to analysis packets headers for banner grabbing.
\paragraph{Honey Flow:}
About honey flow generation, we define $HF = \langle o, d, i\rangle$ for each honey flow, which:
\begin{itemize}
\item Origin $o$ and destination $d$ of the honey flow.

\item Other header information in the packets is $i$. From $i$, adversary can obtain one or more vulnerabilities, which is $i \rightarrow (V_h \subseteq V)$
\end{itemize}

Besides, defender should not only consider how to confuse adversary, but also need to guarantee the availability of normal users, like avoiding congestion. For doing so, we apply $P_i$ as the number of packets passing through switch $i$, and $H_i$ is the number of honey packets go through the same switch at the same time. So $R_i=H_i/(P_i+H_i)$ is the honey traffic rate of switch $i$.
$R_i$ can be used to evaluate the overhead of honey traffic, as well as the probability of misleading attackers.

Figure 2 shows a scenario of defender and attacker movements. In this example, host 1 and host2 connect to each other with three OpenFlow switches (switch 1, switch 2 and switch 3) between them. Host 1 has vulnerability 1, which host 2 contains vulnerability 2. Switch 2 is compromised switch, and adversary has capability to scanning all traffic passing through switch 2. In order to protect hosts and disturb attacker reconnaissance processes, defender can deploy fake hosts(fake host 1 and 2) and create honey flows between them. Both of these two hosts can create TCP based honey flow and reveal any kind of fake vulnerability. For example, if these two hosts generate honey flow with vulnerability 1, attacker's belief includes four hosts information, and three of them own vulnerability 1.

\begin{figure}[htb]
  \centering
 \includegraphics[width=\linewidth]{scenario.png}
  \caption{Example of scenario}
  \label{fig:tags}
\end{figure}

\paragraph{Probabilistic representation:}

\begin{itemize}

\item Initial value of C. $P(s\in C) = \frac{1}{|S|}$

\end{itemize}

There is one defender and one attacker and these are different parties.

\begin{itemize}
\item A finite set of assets (nodes), $N$, each of type \emph{endpoint} (e.g., host) $E$ or switch $S$, with at least two hosts and at least one switch. That is, $E\cap S=\emptyset$ and $E\cup S = N$.

\item A defender's valuation is a function, $D: N\to \mb{R}$, specifying for each asset its valuation to the defender.  We may assume it is positive for the normal assets and zero for the honey assets---since the defender can discard any normal assets that are of zero or negative value. We write $D_n$ to refer to the defender's valuation of an asset $n$.

\item An attacker's valuation is a function, $A: N\to \mb{R}$, specifying for each asset its valuation to the attacker.  This value may be negative since the attacker's mission may be damaged due to false information (for example).  We write $A_n$ to refer to the defender's valuation of an asset $n$.

\item An attacker's goal is a set of endpoint assets, $G\subseteq E$, compromising \emph{any} of which would accomplish the attacker's mission. $G$ could be incorporated in $A$ but it is conceptually clearer to have it separate.

\item A nonempty, finite set of vulnerabilities, $V$.  Think of these as types or labels.

\item A network's weakness is a function, $W: N\to \wp(V)$. We write $W_n$ to refer to the weaknesses of an asset $n$.

\item A network's compromise state, $C\subseteq N$, is the set of assets that have been compromised.

\item A flow is a tuple, $\langle o, d, i\rangle$ \mz{change to $\langle o, d, i, S\rangle$}, where $o, d\in E$ are endpoints (origin and destination, respectively) and $i\in\mb{N}$ is a natural number (flow identifier). $F\subseteq E\times E\times\mb{N}$ is the set of flows from the beginning of time till the end of time. Some flows may be inactive but that status is not relevant to this model.\mz{And $S$ is is a switch set which includes all the switches that the honey flow passes through.}

\item A network's honey state, $H\subseteq F$, is the set of honey flows.

\item
\msm { A network's real state, $R\subseteq F$, is the set of real flows.}
\end{itemize}
\section{Simulations and Model Analysis}
\label{sec:Evaluation}
We now present some results of simulations based on our game-theoretic model, as well as with an initial implementation of honey flow generation in an emulated network environment. We show that the game theory model can produce solutions that improve over simple baselines, and can be calculated fast enough to provide solutions for realistic networks.  We also examine how the optimal solutions change based on the parameters of the model to better understand the structure of the solutions and the sensitivity to key parameters of the decision problem.

\subsection{Preliminary Testbed Evaluation}
\label{sec:Mininet}
We have constructed a preliminary honey flow system in the emulated environment of \emph{Mininet}~\cite{Mininet}.
We want to show the possibility of generating plausible \emph{honey traffic} in an emulated network.
And also want to evaluate the effects of the deception in a more realistic context.
We work on a small topology shown in Figure~\ref{fig:mininet_topo}.
As shown in the figure, we consider four real and two fake hosts.
Some additional parameters:
\begin{itemize}
    \item \emph{Client 1} connects with \emph{Server 1}, while \emph{Client 2} connects with \emph{Server 2}. In the simulation, each of these two clients send 500 packets to the servers and receive corresponding replies.
    \item The \emph{fake clients} are connected with the system and can send packets with fake vulnerabilities to each other.
    \item All the links in our simulation are 1 MBit/s bandwidth, 10ms delay and $2\%$ probability loss.
    \item The values assigned to the servers are $2$ and real clients have a value of $1$ for both of attacker and defender.
\end{itemize}

\begin{figure}[htb!]
\includegraphics[width=1.0\columnwidth,height=0.5\columnwidth]{images/mininet.png}
\centering
\caption{Simple Network Topology used for Mininet Simulation}
\label{fig:mininet_topo}
\end{figure}

We visualize the simulation results with two types of vulnerabilities in Figure~\ref{fig:cost_vul_2_2}. In this test, we increase the amount of honey flows from the fake clients from 0 to 500 packets. The honey flows from fake client 1 are with vulnerabilities type 1, while fake client 2 sends honey flows with vulnerabilities type 2. Besides, we experiment with different costs of honey flow generation. The dashed lines in Figure~\ref{fig:cost_vul_2_2} shows the expected utilities when generate 1 honey flow with cost 0.001 and solid lines represent that defender has to endure cost 0.0001 to generate each honey flow.

\begin{figure}[htb!]
\centering
\includegraphics[width=1.1\columnwidth,height=0.5\columnwidth]{subsections/two_vul.png}
\caption{Defender and attacker utility.}
\label{fig:cost_vul_2_2}
\end{figure}

This simulation does not use the game theoretic optimization.
However, we can still get the idea that increasing the number of honey flows remarkably reduces the effectiveness of adversarial efforts.
Meanwhile, we can also see that the cost of honey flow generation significantly affects the defender utility.

\subsection{\emph{Snaz} Game Theory Solution Quality}

Our next set of experiments focuses on evaluating the solution quality of the proposed Stackelberg game model for optimizing \emph{Snaz} honey flows compared to some plausible baselines, 1) not generating honey flows at all, 2) using a uniform random policy for generating honey flows.
We average the results over 100 randomly generated games, each with 5 types of vulnerabilities.
We set the number of real flows for each type to 500 and the upper bound on the number of honey flows for each type is uniform randomly generated from [500,1000]. Values are described in the caption, and we vary the costs of creating flows as shown in the Figure~\ref{fig:flow-cost}.

\begin{figure}[ht!]
\includegraphics[width=1.0\columnwidth,height=1.0\columnwidth]{images/exp_1_cost_ab.png}
\centering
\caption{Comparison of defender utility when the defender uses different values: a) the value of attacking a fake vulnerability is zero and a real is 1 \; b) the value of attacking a fake vulnerability is the same as real value and the values are randomly generated from [0.5, 1.0].}
\label{fig:flow-cost}
\end{figure}

The results in Figure~\ref{fig:flow-cost} show that the game theoretic solution significantly outperforms the two baselines in most settings, demonstrating the value of optimizing the honey flow generation based on the specific scenario.
We also note that the cost has a significant impact on the overall result; with a high cost the game theories solution is similar to not generating flows at all (since they are not very cost effective).
Random honey flow generation can be detrimental for the defender.
With a low cost, the performance of the game theoretic solution is similar to the uniform random policy; since flows are so cheap it is effective to create a very large number of them without much regard to strategy.
With intermediate costs the value of the strategic optimization is highest, which is the most likely scenario in real applications.

In our second experiment we consider vulnerabilities with different values and examine the variation in the optimal solution as we vary the number of real flows.  We use $5$ vulnerabilities with the values of the real systems ($0.8$, $0.5$, $0.9$, $0.6$, $1.0$) and attacking any fake system gives $0$.
The cost is $0.0005$ for all types. The results in Figure~\ref{fig:hf-rf-ratio} show that the defender's strategy is to create more honey flows for the high valued vulnerabilities. As the number of real flows increases the cost of adding flows to create a high ratio is substantial and the overall number created drops for all types.

\begin{figure}[ht]
\includegraphics[width=1.0\columnwidth,height=0.5\columnwidth]{images/HF_RF_ratio.png}
\centering
\caption{Defender's optimal strategy as number of real flows varies.}
\label{fig:hf-rf-ratio}
\end{figure}

\subsection{Solution Analysis}

We now analyze how the ratio of honey flows to real flows changes in the optimal solution as we change the number of real flows. In Figure~\ref{fig:util}, the network setup consists of four vulnerabilities with values of (10, 20, 30, 40) and fake flows with values of (9, 18, 27, 32). The cost of generating each honey flow is 0.1.  We show the defender's expected utility as we increase the ratio of honey flows to real flows. Each line represents a different number of real flows in the original game. We see that the defender utility increases as we add honey flows, but only up to a point; when the marginal value is less than the cost the optimal solution is to stop adding additional flows.  We see this in the shape of the curves.

We note that the point where these curves flatten out is similar across all of the different numbers of real flows.  We can also see this more clearly in Figure~\ref{fig:util2}.  This suggests that the optimal strategy is relatively insensitive to the number of real flows if we consider the ratio between honey and real flows as the solution. This means that our solutions are robust to changes in the number of real flows, and that we can approximate a solution very quickly without recomputing the full solution as the number of real flows changes.

\begin{figure}[htb!]
  \centering
\includegraphics[width=1\columnwidth,height=0.5\columnwidth]{images/nfff.png}
\caption{Utility with varying honey flow ratios}
\label{fig:util}
\end{figure}

\begin{figure}[htb]
\centering
\includegraphics[width=1\columnwidth,height=0.5\columnwidth]{images/UTIL.png}
\caption{Optimal ratios with varying real flow}
  \label{fig:util2}
\end{figure}

\subsection{Scalability Evaluation}

In a practical application of \emph{Snaz} we would need to be able to calculate the optimal strategy quickly, since the network may change frequently leading to different game parameters.
For example, the number of real flows will change over time, as will the hosts in the network.
The values of traffic and vulnerabilities, and the specific vulnerabilities we are most interested in can change also (e.g., due to the discovery of new vulnerabilities).
We evaluate the scalability of the basic LP solution for this game as we increase the size of the game in two key dimensions: 1) increasing the number of vulnerability types, and 2) increasing the number of flows.

\begin{figure}[htb!]
\includegraphics[width=1.0\columnwidth,height=1.1\columnwidth]{images/exp_4_time_vul_ab.png}
\centering
\caption{Comparison of computational time when a) varying the number of vulnerabilities; b) varying the number of honey flows}
\label{fig:time-complexity}
\end{figure}

We randomly generate games holding the other parameters constant to evaluate the solution time.
The results are shown in Figure~\ref{fig:time-complexity}.
Though the solution time increases significantly as we increase the complexity of the game, we were able to solve realistic size games with a large number of flows and vulnerability types of interest within just a couple of seconds using this solution algorithm.
This signifies that we can apply this to optimize honey flows in realistic size networks with a fast response rate; with further optimization we expect that the scalability could be improved significantly beyond this basic algorithm.

\section{Conclusion}
\label{sec:Conclusion}

We introduced \emph{Snaz}, a technique that uses deceptively crafted honey traffic to confound the knowledge gained by adversary through passive network reconnaissance.
We defined a Stackelberg game model for optimizing one of the key elements of \emph{Snaz}, the quantity and type of honey flows to create. This model balances cost and value trade-offs in the presence of a sophisticated attacker, but can still be solved fast enough to be used in a dynamic network environment.
We have evaluated this model in both a preliminary emulation, as well as in simulations that explore the properties of the game theory solutions.

There are a number of ways that this model could be improved, including incorporating network structure and variable host values into the analysis, and allowing for more overlap between vulnerabilities and flows (e.g., flows with more than one vulnerability). We can consider additional types of honey traffic, such as modifying real flows in deceptive ways. However, these may come with significantly increased computational costs for finding solutions, so we will need to develop faster algorithms to make solving these more complex models practical for a real implementation.

\section{Game Model}
\label{sec:Game}

An important question we must answer to deploy \emph{Snaz} effectively is how to optimize the honey traffic created by the system, including how much traffic to create of different types.  This decision must balance many factors, including the severity of different types of vulnerabilities, their prevalence on the network, and the costs of generating different types of honey flows (e.g., the added network congestion).
In addition, a sophisticated APT attacker may be aware of the possible use of this deception technique, so the decisions should robust against optimal responses to honey traffic by such attackers. Finally, we note that many aspects of the environment can change frequently; for example, new zero day vulnerabilities may be discovered that require an immediate response, or the characteristics of the real network traffic may change. Therefore, we require a method for making fast autonomous decisions that can be adjusted quickly.

We propose a game theoretic model to optimize the honey flow strategy for \emph{Snaz}. Our model captures several of the important factors that determine how flows should be deployed against a sophisticated adversary, but it remains simple enough that we can solve it for realistic problems in seconds (see Section~\ref{sec:Evaluation} for details) allowing us to rapidly adapt to changing conditions.  Specifically, we model the interaction as a two-player non-zero-sum Stackelberg game between the defender (leader) and an attacker (follower) where the defender (\emph{Snaz}) plays a mixed strategy and the attacker plays pure strategy. This builds on a large body of previous work that uses Stackelberg models for security~\cite{tambe2011security}, including cyber deception using honeypots~\cite{pibil2012game}.

\begin{table}[htb]
\centering
\caption{Game Notation}
\label{tab:notation}
\begin{tabular}{|l p{2.3in}|}\hline
$d$ & defender\\
$a$ & attacker\\
$V_i \in V$ & set of $i$ types of vulnerabilities in the network\\
$R_i$ & number of real flows indicating $V_i$\\
$H_i$ & upper bound on the number of honey flows indicating $V_i$\\
$\Phi_{ij}$ & action of selecting $j\in[0,H_i]$ honey flows for $V_i$\\
$\Phi$ & defender's mixed strategy as the marginal probabilities over $\{\Phi_{i0},\dots,\Phi_{iH_i}\}$\\
$C_i$ & cost of creating each honey flow that indicates $V_i$\\

$\upsilon_i^{a,r} \; \upsilon_i^{a,h}$  & the value the attacker gains from attacking a real or fake flow of type $V_i$\\
$\upsilon_i^{d,r} \; \upsilon_i^{d,h}$  & the value the defender loses from an attack against a real or fake flow of type $V_i$\\

$a_i$ & denotes the action of attacking a flow of type $V_i$ where $a_0$ is the no-attack action, yielding 0 payoff \\
     &\\
     \hline
     \end{tabular}
\end{table}

We now formally define the strategies and utilities of the players using the notation listed in Table~\ref{tab:notation}. We assume that the defender is using \emph{Snaz} as a mitigation for a specific set of $i$ vulnerabilities that we label $V_i$. Every flow on the network indicates the presence of at most one of these types of vulnerabilities in a specific host. The real network traffic is characterized by the number of real flows $R_i$ that indicate vulnerability type $V_i$. The pure strategies for \emph{Snaz} are vectors that represent the number of honey flows that are created that indicate each type of vulnerability $V_i$; we write $\Phi_{ij}$ to represent the marginal pure action of creating $j$ flows of type $V_i$. These fake flows do not need to interact with real hosts; they can advertise the existence of fake network assets (i.e., honeypots). The defender can play a mixed strategy that randomizes the number of flows of each type that are created, which we denote by $\Phi$. To keep the game finite we define the maximum number of flows that can be created of each type as $R_i$. The attacker's pure strategy $a_i$ represents choosing to attack a flow of type $V_i$, or not to attack. We assume the attacker cannot reliably distinguish real flow and honey flow, so an attack on a specific type corresponds to drawing a random flow from the set of all real and fake flows of this type.

The utilities for the players depend on which vulnerability type the attacker chooses, as well as on how many real and honey flows of that type are on the network. An attack on a real flow will result in a higher value for the attacker than on a honey flow of the same type, and vice versa for the defender. Specifically, if the attacker chooses type $V_i$, it gains a utility $\upsilon_i^{a,r}$, which is greater than or equal to the value for attacking a honey flow of the same type $\upsilon_i^{a,h}$ (which may be negative or 0). We assume that this component of the utility function is zero-sum, so the defender's values are $\upsilon_i^{d,r} = - \upsilon_i^{a,r} $ and $\upsilon_i^{d,h} = - \upsilon_i^{a,h}$. The defender's utility function includes a cost term $C_i$ that models the marginal cost of adding each additional flow of type $V_i$ (for example, the additional network congestion which can vary depending on the type of flow). If the defender plays strategy $\Phi$ and the attacker attacks the $V_i$, the defender's expected utility is defined as follows:

\begin{equation}\label{eq:defender-EV}
U^d(\Phi, i) = P_i^r \upsilon_i^{d,r} + (1-P_i^r) \upsilon_i^{d,h} - C^h\\
\end{equation}

Here, $P_i^r$ denotes the probability of attacking a vulnerability of type $V_i$ which can be calculated as follows:
\begin{equation*}
RSMN (mc, P) = \sum_{j \in \{0,\dots,H_i\}}\Phi_{ij}(R_i/(j+R_i))\\
\end{equation*}

The overall cost $C^h$ for playing $\Phi$ is given by Equation~\ref{eq:defender-EV}:
\begin{equation*}\label{eq:defender-cost}
C^h =  \sum_{i \in V} \sum_{j \in \{0,\dots,H_i\}}(\Phi_{ij} \times j \times C_i)\\
\end{equation*}

Analogously, for the attacker the expected utility is given by:
\begin{equation}\label{eq:attacker-EV}
U^a(\Phi, i) = P_i^r \upsilon_i^{a,r} + (1-P_i^r) \upsilon_i^{a,h}
\end{equation}

\subsection{\emph{Snaz} Game Example}
Consider a network with two types of vulnerabilities.
Let the values be $\rm \upsilon^{a,r} = (10, 20)$, and $\rm \upsilon^{a,h} = (-5, -10)$, and the cost of creating honey flow indicating each type of vulnerability is $\rm C = (1, 0.5)$.
The total number real flows indicating each type of real vulnerability is $\rm R = (5, 5)$, and the upper bound on honey flows is $\rm H = (2, 3)$.
Thus at most two honey flows of $1^{st}$ vulnerability type and three honey flows of $2^{nd}$ vulnerability type can be created.
Now, consider if the defender plays the following strategy $\Phi$:

\begin{figure}[h]
\includegraphics[width=0.7\columnwidth]{images/example.png}
\centering
\end{figure}

In $\Phi$ the defender creates one honey flow $50\%$ of the time and two honey flows $50\%$ of the time with type 1 vulnerability.
The defender also creates three honey flows $100\%$ of the time type 2 vulnerability.
The attacker's best response is to attack vulnerability type 2 with expected utility $\rm U^a(\Phi, 2) = 8.75$, and the defender utility is $\rm U^d(\Phi, 2) = - 11.75$.

\subsection{Optimal Defender's Linear Program}
Our objective is to compute a Stackelberg equilibrium that maximizes the defender's expected utility, assuming that the attacker will also play the best response.
To determine the equilibrium of the game,  we formulate a linear program (LP) where the attacker's pure strategy $a$ is a binary variable.
We create a variable for each defender's pure strategy $\Phi_{i,j}$, the action of creating  $\rm j$ honey flows for $V_i$.
The following LP computes the defender's optimal mixed strategy for each type of vulnerability under the constraint that the attacker plays a pure-strategy best response:

\begin{equation}\label{eq:defmax}
\max_{i \in V} \;\; U^{d}(\rm \Phi,  i) \;a_i
\end{equation}
\begin{equation*}\label{eq:range}\begin{split}
s.t.\;\;\;
a_i \in \{0,1\}, \;\; \Phi_{ij} \in [0,1]
\end{split}
\end{equation*}
\begin{equation} \label{eq:suchthat}
 U^{a}(\rm \Phi, i) \;a_i \geq
 U^{a}(\Phi, i')\; a_{i}
\quad \forall\;i,i' \in V \;
\end{equation}
\begin{equation}\label{eq:def-strategy}
\sum_{ j\in\{0,\dots,H_i\}} \Phi_{ij} = 1 \quad \forall \Phi_i \in \Phi \;
\end{equation}
\begin{equation}\label{eq:at_total}
\sum_{i \in V} a_i = 1
\end{equation}

In the above formulation the unknown variables are the defender's strategy $\{\rm \Phi_{i0}, \dots, \Phi_{iH_i}\}$ for each $\Phi_i \in \Phi$ and the attacker's action $a_i$.
Equation~\ref{eq:defmax} is the objective function of the LP that maximizes the defender's expected utility.
The inequality in Equation~\ref{eq:suchthat} ensures that the attacker plays a best response.
Finally, Equation~\ref{eq:def-strategy} forces the defender strategy to be a valid probability distribution.

\section{Introduction} \label{sec:intro}

Advanced Persistent Threats (APTs) are a significant concern for enterprises.
In such scenarios, advanced adversaries take slow and deliberate steps over months and even years to compromise critical resources (e.g., workstations and servers) in a network.
A key step in the kill chain of APTs is reconnaissance.
Historically, reconnaissance is largely active, for example using network port scanning to identify which hosts are running which services.
In response, many enterprises closely monitor their networks for scanning attacks.

Simultaneously, Software Defined Networking (SDN) technology is emerging as a powerful primitive for enterprise network security.
SDN offers a global perspective on network communications between hosts.
It can be used as an enhanced tool to identify network scanning, provide flexible access control to mitigate attackers bypassing defenses such as firewalls, and even prevent spoofing.
However, the increased functionality within network elements (e.g., switches) makes them a target for attack.
A compromised SDN switch is particularly dangerous, because it can perform reconnaissance passively.
As a result, defenders may have little to no signal that an APT is in process.

We propose \emph{Snaz} ("snag and zap") to address the threat of passive network reconnaissance.
\emph{Snaz} uses honey traffic: fake flows deceptively crafted to make a passive attacker think specific resources (e.g., workstations and servers) exist and have specific un-patched, vulnerable software.
\emph{Snaz} assumes the adversary knows about the possibility of honey traffic and uses game theory to characterize how best to send honey traffic.
For doing so, we demonstrate how a defender can either successfully deflect or deplete an adversary using optimal amount of honey traffic.

\emph{Snaz} models this defender-attacker interaction as a two-player non-zero-sum Stackelberg game.
In this game, the defender sends honey traffic to confound the adversary's knowledge.
However, if the defender sends too much honey traffic, the network may become overloaded.
In contrast, the adversary wishes to act on information obtained using passive reconnaissance (e.g., a banner string indicating a server is running a vulnerable version of Apache).
However, if the adversary acts on information in the honey traffic, it will unknowingly attack an intrusion detection node and be discovered.
Thus, the game presents an opportunity to design an optimal strategy for defense. We make the following primary contributions:

\input{tables/example_attacks}

\begin{itemize}
    \item \textit{We propose \emph{Snaz}, a technique of using honey traffic to mitigate the threat of passive network reconnaissance.}
    This honey traffic has the potential to dissuade an adversary from acting on evidence of real vulnerabilities or more quickly reveal its existence within the network.
    \item \textit{We model \emph{Snaz}'s deceptive defense using a two-player non-zero-sum Stackelberg game.} We present an algorithm for finding the optimal strategy for deploying honey flows that is fast enough to be used for realistic networks.
    \item \textit{We present an empirical evaluation} of the performance of our game model solutions under different conditions, as well as the scalability of the algorithm and some useful properties of the optimal solutions.
    \item \textit{We emulate \emph{Snaz} in Mininet\cite{de2014using}, also showing the network overhead that results from honey traffic.}
\end{itemize}

\section{OLD EXPERIMENT}
\section{Game-Theoretic Experimental Evaluation}
\label{sec:Evaluation}

We evaluate our proposed Stackaleberg game model with different experiments and compare the results with two other defender's strategies (uniform random strategy and no-deception). In uni from random strategy, the defender generates honey flows randomly where in no-deception, he does not create honey flows at all.

Most of the experiments are conducted on a system with a 1.99 GHz Core-i7 CPU and 16.0 GB memory. The game model is solved by using linear programming where we have used CPLEX (version 12.8.0) solver to solve the programs.
The parameters of the experiments are randomly generated, also, we run each experiment 100 times.
The final results of the experiments are averaged for the generality.
All random parameters are normalized to 1 except the numbers of \subsection{Optimal honey flow with fixed cost}
From the experiment analysis of game model, following conditions observed to get optimal Utility.

 The Analysis is true for any low cost between 0.001 to 0.1 and when the difference between different type of fake vulnerability hosts are not huge and ratio of no of hf/rf of different vulnerabilities are similar. if ratio of no of hf and no of rf for vulnerability V1 is 1 it works when ratio of no of hf and no of rf for vulnerability V2 is around 1 and less than 2.We are considering cost =0.1;
\begin{Observation}{1}
\textbf{Observation 1}
\textbf{[When the fake host value is low and cost is fixed]}\item When fake host value is very low around one-third  of real host, defender's utility will be optimal in following condition
\item  If number of honey flow implemented is 65 percent more than number of real flows.
\end{Observation}

\begin{Observation}{2}
\textbf{Observation 2}
\textbf{[When the fake host value is high and cost is fixed]}\item When fake host value is high around 85 percent of real vulnerability value or greater, defender's utility will be optimal in following condition
\item  If number of honey flow implemented is 30 percent more than number of real flows

\end{Observation}
When fake host value is less than one-third of real vulnerability value defender's get his optimal utility when given honey flow is more than twice
By observing value of real vulnerability host and value of fake vulnerability host and the number of real flow our program can assign optimal honey flow.

The interpretation of our game model outcome for defender's utility with fixed cost is presented with following Algorithm.Which is based on the observations 1,2,3.The algorithm is with fixed cost in between 0.001 to 0.1 and the differences among different fake vulnerability values are not large. Ratio difference of no of honey flow and real flow of different type vulnerabilities are very close.
Important observation ratio of no of hf/rf of different vulnerability has to be close.  Such that if ratio of no of hf and no of rf for vulnerability V1 is 1 it works when ratio of no of hf and no of rf for V2 is around 1 and less than 2.
Below algorithm are considered based on the ratio of fake vulnerability values and real vulnerabilities values.Ratio greater than 0.85 interpret when fake vulnerability value is high, smaller than 0.3 interprets when fake vulnerability value is low .
\begin{algorithm}
\caption{Optimal honey flow algorithm}\label{alg:HF}
\begin{algorithmic}[1]
\Procedure{optimalhf}{rv[],fv[],numrf[]
\State hf[]=[numrf.length];
\For{$i=0\ldots $numrf.length
\If{($fv[i]\geq0.85*rv[i]$ and $fv[i]\leq rv[i]$)}
   \State $hf[i]$$\approx$$0.3$*$numrf[i]+$numrf[i] \\
\ElsIf{($fv[i]\geq$0.5*$rv[i] and $fv[i]$<$0.85*rv[i])}
   \State $hf[i]\approx0.5*numrf[i]+numrf[i]$\\
\ElsIf{($fv[i]<0.5*rv[i]and $fv[i]$>$0.3*rv[i])}\\
   \State $hf[i]\approx0.65*numrf[i]+numrf[i]$\\
\State \textbf{else}
   \State $hf[i] \approx numrf[i]+numrf[i]$\\

\EndIf
\EndFor
\textbf{return hf[i]}
\EndProcedure
\end{algorithmic}
\end{algorithm}

\begin{itemize}
    \item rv[]=array of real vulnerability value
    \item fv[]=array of fake vulnerability value
    \item numrf[]=array of number of real flow of each real vulnerability type
    \item hf[]=array of optimal honey flow (output)
\end{itemize}

From the Algorithm It can be seen, if fake host value is too low implementing too many honey flow  might not be cost effective

\begin{Observation}{2}
\textbf{Observation 3}\\
\textbf{[Fake vulnerability value is around half of real value and cost is fixed]}\item When fake host value is half  real vulnerability value or greater, defender's utility will be optimal in following condition
\item  Defender gets his optimal utility when honey flow is doubled than the real flow

\end{Observation}

\subsection{Visualizing solution impact of parameter}

\textbf{Graphical representation of observation 2 and Proof of algorithm analysis }

The following case a network setup consist of five different vulnerabilities and five different fake vulnerabilities values.Which follows Algorithm line 4 and 5
\begin{figure}[htb]
  \centering
\includegraphics[width=1.1\columnwidth,height=0.7\columnwidth]{images/hon1.png}
  \caption{Utility Vs HF/RF ratio}
  \label{fig:util}
\end{figure}
\begin{table}[!ht]
\centering\footnotesize\caption{Fake vulnerability is low and cost is fixed}
\begin{tabular}{lll}\hline
Real value&	fake value& no of real flow \\\hline
{10,20,30,40}&{9,18,27,32}& {5,5,5,5,5}\\
{10,20,30,40}&{9,18,27,32}& {10,10,10,10,10}\\\hline
\end{tabular}

\end{table}
These condition is also true for different number of honey flow of different type vulnerabilities.However the difference number of real flow from each type were not considered very high

\begin{table}[!ht]
\centering\footnotesize\caption{Defender's optimal utility with HF/RF ratio}

\begin{tabular}{llllll}\hline
hf/rf(rf10)& Ud&hf/rf(rf15)&	Ud&hf/rf(30)
\\\hline
{0.5}&{-4.6}&{0.5}&{-4.6}&{0.5}&	{-5.1}
\\
{1}&{-1.5}&{1}&{-2}&{1}&	{-3.5}\\
{1.2}&{-1.1}&{1.2}&{-1.6}&{1.2}&{-3.3}\\
{1.3}&{-1.1}&{1.4}&{-1.6}&{1.4}&{-3.3}\\
{1.6}&{-1.1}&{1.6}&{-1.6}&{1.6}&{-3.3}\\
{2}&{-1.1}&{2}&	{-1.6}&{2}&{-3.3}
\\\hline
\end{tabular}
\end{table}

\item As  fake  host  value  is  high  almost 90 percent of real vulnerability value or greater

\item Defender gets his optimal utility when honey flow is one-third more than the real flow.

Figure 2 shows when ratio of honey flow (HF) and real flow (RF) is 1.3 defender gets his optimal utility, analyzed for 5 different vulnerabilities
hf/rf(rf10)= ratio of number of honey flow and number of real flow when number real flow is 10

\item\textbf{Graphical representation of observation 1 and Proof of algorithm analysis }\\
The  following  case  a  network  setup  consist  of  three different vulnerabilities and three different fake vulnerabilities values.\\

RV=Real Vulnerability set,FV=fake host set, rf(N)=number of real flow,
hf(N)=number of honey flow,Ud=Utility

\begin{table}[!ht]
\centering\footnotesize\caption{Fake vulnerability is high and cost is fixed}
\begin{tabular}{lllll}\hline
RV&FV& # rf(N) & hf(N)&Ud \\\hline
{10, 11,30}&{3, 4, 9}& {10, 20, 30}&{5,10,9}&-21.9\\
{10, 11,30}&{3, 4, 9}& {10, 20, 30}&{10,20,30}&-10.57\\
{10, 11,30}&{3, 4, 9}& {10, 20, 30}&{15,30,45}&-6.95
\\
{10, 11,30}&{3, 4, 9}& {10, 20, 30}&{17,34,50}&-6.13\\
{10, 11,30}&{3, 4, 9}& {10, 20, 30}&{20,40,50}&-6.13\\
\\\hline
\end{tabular}
\end{table}

Important observation ratio of no of hf/rf of different vulnerability has to be close. if ratio of no of hf and no of rf for V1 is 1 it works when ratio of no of hf and no of rf for V1 is around 1 and less than 2.
\begin{figure}[htb]
  \centering
\includegraphics[width=1.1\columnwidth,height=0.7\columnwidth]{images/vulnnew.png}
  \caption{Utility Vs HF/RF ratio}
  \label{fig:util}
\end{figure}
\item\textbf{ Relation between fake host value and Honey flow}
\item Defender' can get optimal utility fast if fake value host and no of honey flow is high.
However those could be costly.Based on a real network with assigned value defender can find optimized value for both component. By changing
\begin{figure}[htb]
  \centering
 \includegraphics[width=\linewidth]{images/Op.png}
  \caption{Relation between fake vul and honey flow}
  \label{fig:util}
\end{figure}
Defender can get an optimal utility by applying high fake vulnerability value and low honey flow value or vice-versa also he can get an optimal value with by taking optimized value
 \subsection{Impact of Honey Flow Cost}
 Our first experiment investigates the impact of cost associated with generating  honey flow in defender's utility.
 We run this experiment with 5 types of vulnerabilities also.
 For Figure ~\ref{fig:flow-cost}, the number of real-flow is 500 and the honey flow are generated uniform randomly from [500,1000].
\begin{figure}[ht]
\includegraphics[width=1.0\columnwidth,height=1.1\columnwidth]{images/exp_1_cost_ab.png}
\centering
\caption{Comparison of defender utility when the defender uses different cost of generating an honey-flow a) the value of attacking a fake vulnerability is zero and a real is 1 \; b)  the value of attacking a fake vulnerability is exact same as real value and the values are randomly generate from[0.5, 1.0].}
\label{fig:flow-cost}
\end{figure}

 The results indicate that the Stackleberg model out performs than other models especially when the attacking penalty is high

\subsection{Deception with Unsophisticated Attackers }
In our previous experiments, we assumed that the attackers are always rational, but in the real world network scenarios, we can not always assume that the adversaries are all-time cautious. Thus, in this experiment investigates how the honey flow game models perform with the naive attackers. Here we consider two naive attackers ( Uniform Random and Greedy).
In the uniform random model, the attacker's strategy is to attack all types of vulnerability uniformly where the defender's strategy is to generates optimal honey-flow against the attacker's strategy.
On the other hand, in the greedy model, attacker calculates the expected payoffs for all types of vulnerabilities by considering the maximum honey-flow that the defender can generate for a type of vulnerability.
Based on the calculation, he selects a vulnerability type to attack that gives him the maximum expected payoff.
In both models, the attacker does not consider the defender's optimal strategies.

We also run this experiment with 5 types of vulnerabilities.
For Figure~\ref{fig:flow_ratio}, we investigate the defender utility when the defender sets a different upper bound of honey-flow compare to the real-flow numbers.
The number of real-flow is generated randomly from [500,1000], and the cost of a honey-flow is 0.0001 .
We depict effect on defender's utility with different percent the honey-flows to the real-flows in this graph.

\begin{figure}[htb!]
\includegraphics[width=1.0\columnwidth,height=1.1\columnwidth]{images/exp_1_zero_vs_same.png}
\centering
\caption{Comparison of defender utility when a)  the value of attacking a fake vulnerability is exact same as real value  b) the value of attacking a fake vulnerability is zero and real one is 1.}
\label{fig:flow_ratio}
\end{figure}

The results show that creating fake flow provides significant defense against all mentioned attackers, especially when the attacker's choice is greedy but not rational. That is because the defender needs to create only that type of fake vulnerable flow in which the attacker is more biased

\subsection{ Scalability}
We evaluate the scalability of our LP solution. The results show in ~\ref{fig:time-complexity} where the game instances are randomly generated. For (b),  we set fix honey flow numbers.
\begin{figure}[htb!]
\includegraphics[width=1.0\columnwidth,height=1.1\columnwidth]{images/exp_4_time_vul_ab.png}
\centering
\caption{Comparison of computational time when a)  the number of vulnerability is variable;  b)  the number of honey flow is variable}
\label{fig:time-complexity}
\end{figure}
The results show that the computational time grows exponentially either in increasing the number of vulnerabilities or the number of honey flows. However,  the graph of increasing vulnerability grows faster than the other one. That is because the best response constraints increase proportionally with the increasing number of vulnerabilities.

\section{Mininet Testbed Evaluation}
\label{sec:Mininet}

To understand the applicability of above game model in real network scenario, we use the emulated environment of Mininet. The topology in Mininet follows figure 8. Other settings include:
\begin{figure}[htb!]
\includegraphics[width=1.0\columnwidth,height=0.5\columnwidth]{images/mininet.png}
\centering
\caption{Topology of Mininet Simulation}
\label{fig:mininet_topo}
\end{figure}
\begin{itemize}
    \item Client 1 connects with server 1, while client 2 connects with server 2.
    For simplification, in the simulation, both of these two clients send 500 packets based on TCP channel and receive replies.
    \item All the links in our simulation is 1 MBit/s bandwidth, 2ms delay and $2\%$ probability loss.
    \item The values of all the hosts are 1 and the cost to generate 1 honey flow is 0.0001.
\end{itemize}
\begin{figure}[htb!]
\includegraphics[width=1.0\columnwidth,height=0.7\columnwidth]{images/one_vul.png}
\centering
\caption{Comparison of defender utility and attacker utility.}
\label{fig:cost_vul_2}
\end{figure}
In the first simulation, defender generates honey flow with fake vulnerability 1. The amount of honey flow increase from 1 to 500. The two fake clients send request and reply to each other and both of these two direction flows contain fake vulnerability 1.  Figure 8 shows the payoff of defender and attacker if attacker tries to deploy malicious actions based on vulnerability 1. The result shows that the payoff of attacker can be significant reduced if defender increase the ratio of honey flow.

Figure 10 shows the result when defender generate two kinds of fake vulnerabilities. In this simulation, the values of two clients are 2 and values of two servers are 1. Fake client 1 send request messages to fake client 2 with vulnerability 1 embedded, while the reply messages from fake client 2 to fake client 1 contain fake vulnerability 2.

\begin{figure}[htb!]
\includegraphics[width=1.0\columnwidth,height=0.7\columnwidth]{images/two_vul.png}
\centering
\caption{Comparison of defender utility and attacker utility.}
\label{fig:cost_vul_2}
\end{figure}
\section{Overview}
\label{sec:Assumptions}

This paper proposes \emph{Snaz}, a deception system designed to mislead or delay the passive reconnaissance by an adversary.
Snaz provides this deception using \emph{honey traffic} that is precisely controlled by the defender.
We now give a high level overview of the system and threat model.

\subsection{Snaz}

Snaz uses honey traffic to mislead adversaries using passive network reconnaissance.
This deception consists of network flows with fake information, which we call \emph{honey flows}.
Traditionally, a network flow is defined as a 5-tuple: source IP, source port, destination IP, destination port, and protocol (e.g., TCP).
For simplicity, we assume honey flows include network flows in both directions to simulate real network communication.

Honey flows can fake information in network flow identifiers.
For example, a honey flow can attempt to make the adversary believe a non-existent host has a specific IP address, or a host is running a server on a specific port.
Due to the flexible packet forwarding capabilities of SDN, the defender can route honey flows through any path it chooses, e.g., to tempt an adversary that has compromised a switch on a non-standard path.
Honey flows can fake information in the packet payload itself.
For example, network servers often respond with a banner string indicating the version of the software, and sometimes even the OS version of the host.
Attackers often use this banner information to identify unpatched vulnerabilities on the network.
Honey flows can simulate servers with known vulnerabilities, making it appear as if there are easy targets.
If at any point the adversary acts on this information (i.e., connects to a fake IP address), Snaz will redirect the traffic to an intrusion detection node.
Since the intrusion detection node does not normally receive network connections, the existence of any traffic directed towards it indicates the presence of an adversary on the network.

Figure~\ref{example1} shows a simplified example of honey flows causing an adversary to update its belief.
The figure shows two real hosts: $Host~1$ with vulnerability type $V1$, and $Host~2$ is with vulnerability type $V2$.
The adversary has compromised $Switch~2$ and observes all packets passing through it.
Without honey traffic, the adversary can easily identify the vulnerabilities on the hosts (e.g., via banner strings) and attack them.
In the figure, Snaz simulates the existence of two fake hosts ($Host~3$ and $Host~4$) using honey traffic.
If the adversary is unaware of Snaz, it will probabilistically attack either $Host~3$ or $Host~4$ and be quickly detected.
However, if the adversary \emph{is} aware of Snaz (the scenario we consider in this paper), it must keep track of what it believes is real verses fake information.
How the defender and attacker act is the crux of our game-theoretic model in Section~\ref{sec:Game}.

\begin{figure}[t]
  \centering
 \includegraphics[width=\linewidth]{images/scenario.png}
  \caption{Snaz uses honey traffic to mislead adversaries.}
  \label{example1}
\end{figure}

\subsection{Threat Model and Assumptions}

The adversary's goal is to compromise networked resources, e.g., workstations and servers, without detection.
The adversary does not know what hosts are on the network or which hosts have vulnerabilities.
It must discover vulnerable hosts using network reconnaissance.
The adversary assumes the defender has deployed state-of-the-art intrusion detection systems that can identify active network reconnaissance such as network port scanning.
However, we assume the adversary has gained a foothold on one or more network switches (an upper-bound of which is defined by the model).
Using this vantage point, the adversary is able to inspect all packets that flow through the compromised switches.
In doing so, it can learn (1) network topology and which ports servers are listening to by observing network flow identifiers, (2) about the installed software versions by observing server and client banner strings.
We assume the adversary can map between banner strings and known vulnerabilities and their corresponding exploits.
We conservatively assume this mapping can occur on the switch, or can be done without the knowledge of the defender.
The adversary also has the capability to initiate new network flows from the switch while forging the source IP address, as response traffic will flow back through the compromised switch and terminate as if it was delivered to the real host.
Finally, we assume the adversary is rational and is aware of the existence of Snaz and that honey traffic may be sent to fake hosts.
However, the adversary does not know the specific configuration of Snaz, such as the distribution of honey traffic.

We assume the defender's network contains real hosts with exploitable vulnerabilities.
The defender is aware of some, but not all of these vulnerabilities.
For example, the defender's inventory system may indicate the existence of an unpatched and vulnerable server, but due to production requirements, the server is not yet patched.
We further assume the defender can identify valuations of each network asset and approximate the valuation of the assets to the attacker (e.g., domain controllers that authenticate users are valuable targets).
We assume that the SDN controller and the applications running on the controller are part of the trusted computing base (TCB).
We further assume that the communication between the SDN controller and uncompromised switches is protected and not observable to the adversary (e.g., via SSL or an out-of-band control network).
As a result, the adversary cannot alter the controller configuration or forwarding logic of uncompromised switches.
Finally, we assume that the network utilization is not near maximum capacity during normal operation.
However, exceeding honey traffic may cause congestion and cause network degradation.

redpajama_set_name: RedPajamaArXiv


text:
International integration serves the nation's development
A Party Central Committee member has affirmed the value of proactive international integration to serve the country's industrialisation, modernisation, construction and defence in the new stage while speaking at the ongoing 11th National Party Congress in Hanoi on Jan. 14.
Pham Binh Minh, who is also Permanent Deputy Foreign Minister, said external activities over the past five years were synchronously carried out, harnessing the strength of the Party's foreign affairs, State and people-to-people diplomacy.
International integration linked foreign activities with the expansion of political, economic and cultural ties, harvesting great achievements and contributing to maintaining peace and stability, taking advantage of favourable international conditions for national construction and unceasingly raising Vietnam's international position.
"We moved international relations into a new depth, stability and sustainability by developing a comprehensive strategic partnership with China, increasing the significance of the strategic partnership with Russia and establishing strategic partnerships with Japan, India, the Republic of Korea, the United Kingdom and Spain," he said.
Vietnam also continued to strengthen and intensify comprehensive cooperation with Laos and Cambodia, as well as improve the multifaceted relations with ASEAN member countries, he added.
Regarding relations with other major partners like the United States and the European Union (EU), Vietnam 's external affairs saw new steps of development.
The relations with Cuba and other traditional friendly countries were also renewed and promoted.
Vietnam was extremely proactive in international economic integration, becoming a member the World Trade Organisation (WTO) – the largest economic and trade organisation in the world – and accomplished a new level of participation in regional and international organisations.
Vietnam also participated in bilateral economic and trade agreements, he said, adding these ties increased the country's participation in international economic cooperation forums and frameworks.
Over the past five years, total registered Foreign Direct Investment (FDI) exceeded 150 billion USD, seven times higher than that in the 2001-05 period. Committed Official Development Assistance (ODA) was over 31 billion USD, three times higher than the previous period. Exports continued growing.
"We obtained outstanding achievements in multilateral diplomacy, fulfilling the role as a non-permanent member of the UN Security Council for the 2008-09 term with Vietnam-imprinted contributions," he said.
Vietnam successfully played a proactive and responsible role as ASEAN Chair in 2010.
The country gained historical achievements in ensuring territorial security. Regarding border issues, Vietnam completed the demarcation and planting of markers along the common land borderline with China .
With the signing of a protocol on demarcation and planting of border-markers, agreements on border management regulations and border gates and border gate management, Vietnam and China ended 35 years of negotiations on the issue, creating a basis for building a borderline of long-lasting peace, friendship and stability.
"We exerted efforts to carry out projects on the upgrade of national border markers with Laos , and closely work with Cambodia in demarcating and planting of border markers, striving to accomplish the issues by 2012."
On the East Sea, Vietnam submitted to the UN its report on the outer limits of its continental shelf, actively implemented cooperation agreements with countries on joint anti-piracy patrols in the Tonkin Gulf and reached an agreement on fisheries as well as an agreement on demarcation of the Tonkin Gulf with China . The country accelerated the implementation of the Declaration on the Conduct of Parties in the East Sea (DOC) and fought activities violating sovereignty, borders and territorial waters.
"These results made positive contributions to defending the country's sovereignty, territorial security and interests," he affirmed.
Outstanding achievements in foreign affairs over the past five years originated from the soundness of an external policy of independence, self-reliance, peace, cooperation and development, advocating openness, diversification and multilateralisation of international ties, with orientations to bring relations into a deep, stable and sustainable manner, proactive international integration for economic cooperation and expand ties to other fields.
These achievements were results from joint efforts of the Party, State, National Assembly, ministries, agencies and localities under the leadership of the Party.
He highlighted the foreign affairs thinking development, saying that they are orientations on "active and proactive international integration" and guideline on "synchronous and comprehensive implementation" of external activities, performing the task of maintaining a peaceful and stable environment, conducive to the country's sustainable development in order to turn Vietnam into a modern industrialised country by 2020.
To implement the external policy of the 11th National Party Congress, Minh mentioned the following proposals:
First, grasp thoroughly the guidance on international integration in a proactive and responsible manner, focusing on actively and proactively catching opportunity, effectively creating and taking advantages and dealing with challenges from the process of integration.
Promptly develop a comprehensive strategy on international integration with specific goals and roadmaps for each stage, particularly until 2020 in the immediate term and in the areas of economic development, defence, security and social culture.
Quickly raise the nation's overall strength, an essential condition for the success of international integration. This requires good performance of the Party-building work and consolidation of the national unity and solidarity, including the community of more than 4 million overseas Vietnamese. This task also means to raise competitiveness and the resilience of the economy in face of international upheavals, increase defence and security potential, gradually achieving international cooperation in security-defence and regional and international security mechanisms.
Secondly, carry out the guideline on "synchronous and comprehensive implementation" of external affairs orientations adopted by the 11th Congress, stepping up the unified management of external activities. Improve coordinating efficiency of external activities of the Party, State, National Assembly, localities and people-to-people diplomacy, as well as coordination between branches, channels and agencies at all levels involved in external affairs.
During the process, diplomacy should work as a comprehensive sector with three pillars – political diplomacy, economic diplomacy plus cultural diplomacy and oversea Vietnamese-related affairs. Defence and security diplomacy needs to be developed extensively and intensively.
Thirdly, along with the implementation of new diplomatic orientations and guidelines, it is necessary to carry out major orientations of the external policy in the renewal stage, especially the direction on "upgrading established diplomatic ties to a profound, stable and sustainable plane".
"Looking back on the great achievements of the renewal process in general and diplomacy in particular in recent years, we firmly trust in the intelligence and political firmness of our Party," he said./.
Source VN plus
Citizen protection measures taken to protect Vietnamese abroad
Hanoi's first metro train to go on public display in February
MAUR to carry out pre-feasibility study report on HCMC-Can Tho railway project
Book features leader's articles on preparations for 13th National Party Congress
Efforts under way to develop waterway transport infrastructure in Mekong Delta
Vietnam-EU relations to grow further in coming years
The Ministry of Transport (MoT) yesterday said that the upgrade and expansion project of Ho Chi Minh City- Long Thanh- Dau Giay Expressway and project of Dong Nai- Lam Dong Expressway is being speeded up the construction.

redpajama_set_name: RedPajamaCommonCrawl


Love him or hate him, Detroit Lions' quarterback Matthew Stafford's latest move off the field is earning him fans across the nation.
After Detroit Police Corporal Myron Jarrett was killed by hit-and-run driver during a traffic stop on Oct. 28th, his fellow officers stepped up to help his family, organizing a fundraiser to help his wife Sacha and their four children.
On Wednesday morning, Stafford and his wife played "Mr. and Mrs. Claus", bringing gifts to the Jarrett home before Christmas.
"This is just an indication of the family that we have in the DPD. Corporal Jarrett was a part of our family and this is also a way of saying that we never forget," Police Chief James Craig said.
"I have a daughter that's a senior in high school so she's really taking it hard and her father won't be there for her graduation so it's very difficult for her. So this is going to be double for her not having him for the holidays as well as not being at her graduation in June," his wife, Sacha Jarrett, said.
"I really want to let them know that I appreciate everything, the outpouring of support for my kids has been overwhelming and I'm just so happy," Sacha said.


The perfect introduction to La Boîte Spice Blends. Consisting of four amazing blends from spice master Lior Lev Sercarz. This set is sure to make you look like a gourmet chef as these spice blends are delicious on anything and everything.
Comes as 4 jars totaling approximately 10 oz.


text:
Q: When does one get the error message "jobs : not found"? When does the jobs command issue the message jobs : not found?
Also, why does the command man jobs refuse to show any entry for the command jobs?
P.S. : I am able to successfully execute the jobs command on the terminal

A: jobs is not a real command, but a command that is builtin to the shell that you're using:
martin@dogmeat:~$ type jobs
jobs is a shell builtin

When you try to run it without a shell, you'll get an error message, because there is no binary executable called jobs.
It also doesn't have a manpage because it's just a builtin. Look in man builtins as Marco said, in man bash or in the manpage of the respective shell that you're using if you're not using bash.

EDIT: to explain what running a program without a shell means: when a process in Linux wants to launch another process (fork and exec), it can either wrap this process in a shell or launch it directly without a shell. For example, in perl you can use the system function to launch a new process. This works fine with a real program files like echo (I've loaded the warnings module here too so we can see error messages):
martin@martin ~ % ll /bin/echo
-rwxr-xr-x 1 root root 31K Jan 17  2013 /bin/echo*
martin@martin ~ % perl -Mwarnings -e 'system "echo", "test"'
test

But this does not work with a shell builtin like jobs, because there is no binary file jobs:
martin@martin ~ % perl -Mwarnings -e 'system "jobs"'
Can't exec "jobs": No such file or directory at -e line 1.

Of course when you're already working inside an interactive shell, you probably won't stumble over this issue. But this is relevant in some other situations, for example when you're using the Gnome Alt+F2 run dialog. It doesn't wrap your command in a shell, and therefore real binaries, work fine, while trying to run jobs will just show an error message.
From your original error message jobs : not found I had assumed that you're somehow not in a shell, because inside a shell jobs should of course work fine.

A: I can get that error message with:
$ ash -c $'Steve\rjobs\\ '
jobs : not found

ash actually outputs:
ash: 1: Steve\rjobs : not found

But on a terminal, that \r moves the cursor to the beginning of the line, and the jobs: not found overwrites the ash: 1: Steve.
Other than that, your error message may suggest that whatever tried to execute the jobs command could not find it.
There's a jobs builtin command in all shells of the csh (where it originated), POSIX and fish families. It lists the jobs currently maintained by an interactive shell, so it has no meaning outside a shell and is implemented as a builtin command of the shell (see a given shell documentation for the corresponding jobs documentation, or the POSIX specification).
There is often no jobs command as an executable file (though POSIX does require that there be), and where there is like on Solaris, it does nothing (as jobs is a ksh script there that calls the ksh jobs builtin, it just reports the jobs (so none) of that new ksh shell that interprets the script).
On those systems that have no jobs command in the file system, commands that try to execute jobs without invoking a shell to parse a command line would report an error:
$ perl -le 'exec "jobs" or die "jobs: $!"'
jobs: No such file or directory at -e line 1.
$ env jobs
env: jobs: No such file or directory
$ find . -prune -exec jobs \;
find: `jobs': No such file or directory
$ rc -c jobs
jobs not found

Those that do call a shell would succeed, but because they would start a new shell, that shell would have no job to report:
$ awk 'BEGIN {system("jobs")}'
$ expect -c 'system jobs'
$ perl -le 'exec "jobs || :" or die "jobs: $!"'
$ python -c 'import os; os.system("jobs")'
$

A: How old is that book? Unix shells haven't always had job control. The original Bourne shell didn't, and for a while it was common for the 2 choices to be sh (Bourne, no job control) and csh (job control). The book's answer might be that jobs will be not found when you're using Bourne shell.
The only shell I can easily find now without a jobs command is posh.
In zsh you can run disable jobs first, and then jobs will be not found.

redpajama_set_name: RedPajamaStackExchange


text:
Advice Home > Relationships > I Broke Up With My Boyfriend But Question My Decision
I Broke Up With My Boyfriend But Question My Decision
By: Mary Elizabeth Dean
Medically Reviewed By: April Brewer , DBH, LPC
Couples break up for many reasons. Sometimes the reasons are clear, such as frequent arguments, lack of interest, and abuse. Other times, breakups are not so obvious, and that can leave you questioning your decision. You may think your partner was a good person, but that something was missing in the relationship. In those cases, it can be difficult to watch the person you care about suffer after you leave them. That doesn't, however, mean your decision was wrong. You deserve to live life with someone who makes you happy.
Are You Having Second Thoughts After A Breakup?
Guidance From A Licensed Professional Can Help
I Broke Up with My Boyfriend
The truth is that breaking up with someone can be a kind thing to do for them, even if they are sad afterward. Staying with someone you don't feel satisfied with could lead you to develop resentment towards them, and that can build up over time, which could lead to a big conflict in the future.
Although your partner may think they want to be with you now, breaking up can save them from being in a miserable relationship in which they are unfulfilled and unappreciated down the road. If you find you're still questioning your decision, consider what caused you to break up with them. If you both wanted different things and the relationship was just not compatible, you may have made the right decision, and the best course is to press on.
On the other hand, if you still feel you can make the relationship work, and the relationship is worth saving, you can try to reach out to your ex and talk things out. You should discuss if the differences or disagreements could be compromised and if you can both commit to resolving the issues. This will help provide insight into whether your relationship can be reconciled.
What Are Your Relationship Ingredients?
People get into and stay in relationships for various reasons. It helps to identify your "relationship ingredients," and then determine if you're willing to compromise with your ex if certain ingredients are missing. Your relationship ingredients may not include the ones listed below, but here are some possible examples:
Freedom to have outside friends or other relationships
Source: pexels.com
How to Cope with Regret and Guilt
Consider that the breakup may be better for you as well. Overcoming the guilt now opens the possibility of finding a better life later. That may mean a different kind of partner, or it may mean dedicating yourself to single life and your pursuits. After a relationship ends, it's easy to remember the good and forget the bad, especially if you're feeling lonely. But getting back together with someone you broke up with is rarely a good idea. That's not to say it never works, but be prepared for hurt feelings.
It's okay for you to feel sad after initiating a breakup. Sadness and guilt do not mean you made the wrong decision. If you felt the need to break up, there was a reason. Here are some ways to make regret or guilt easier:
Ask yourself if things would be different a second time around or if you'd be dealing with the same problems. In a relationship, you take a person at their best and their worst. Are you comfortable being with your ex at their worst? Or do you want a fantasy version of them?
Ask yourself if returning to your ex would mean settling for less. You should not enter a relationship because you don't think you can do any better. You can. The best path is to fill your life with the most fulfilling relationships you can, and that doesn't always mean a romantic partner.
Remind yourself that life is not about the search for a romantic partner. Pursue all the other things that bring you meaning and happiness.
Avoid talking to your ex. It's better to just to let it go. If a friendship remains, it can be reconnected later, after you've both had a chance to heal.
If your regret is fleeting, such as brief longings when you need a date for a party, then it's a good sign you're just feeling lonely. You can feel lonely even in the presence of others. If you think you've misunderstood your feelings of loneliness, here are a few pointers:
Feeling lonely is natural. It's normal to feel lonely after a breakup because your life is experiencing a change. It's better to acknowledge the feeling of loneliness rather than fight it. Avoid the urge to eliminate that feeling by getting prematurely involved in a new relationship or returning to your ex.
Process and accept your emotions. Sometimes expressing your emotions is perceived as weak or disruptive. People will encourage you to "stay strong." This isn't healthy. You're human and it's normal to feel. Somehow it seems to have become the normal expectation that we should "be happy" or "be strong" all the time. This perspective is unrealistic. Understand your feelings, don't reject them. Reach out to friends who will support you expressing your honest feelings. If you find you can't progress emotionally and don't feel comfortable being honest with friends, understand that you don't have to go it alone. The credentialed counselors at BetterHelp can help you move forward. A counselor can help you understand why you feel so alone and what you can do to change.
Love yourself first. The idea of being alone may sound a bit scary. However, being okay with being alone is an important element of one's happiness. Learning to be alone allows you to develop happiness that isn't dependent on a romantic relationship.
Explore new interests and engage in hobbies. Identify past hobbies and activities you once enjoyed. Find new ones. This will help distract you from negative thoughts and may offer the opportunity to meet new people.
Try to journal. Expressing your thoughts, feelings, and plans in writing often brings a sense of relief and fulfillment. Also, expressing your thoughts and feelings about your ex in a journal could allow you to review the entries at a later date and provide deeper insight.
Seek help. Often we turn to our family, friends, colleagues, or even strangers to discuss sensitive or pressing thoughts. Other times we hold our feelings inside until we feel we'll spill over. A professional counselor offers a nonjudgmental ear and a sense of clarity and guidance. Instead of causing more problems by seeking out your ex, talk to a professional counselor who can help you cope with loneliness, regret, and guilt. By connecting with a counselor at BetterHelp, you can have a qualified counselor at your fingertips via your mobile phone, tablet, laptop, or desktop computer. Read below for some reviews of BetterHelp counselors, from people experiencing similar issues.
Counselor Reviews
"I've tried other counselors that I liked but didn't seem right for me but Margaret has been amazing! I love her honesty, compassion, and realness! It was really easy to open up to her and she's helped me get through a very tough breakup that nobody else could seem to get me through. I would recommend her to anyone! She makes it so comfortable to talk to her as if you've known her for forever!"
"Sabrina is helping me so much through my breakup and I am so excited for her to help me along my journey of self love and discovery. Thank you for helping me detangle my inner problems, and guiding me to the end of each and every string!"
Having second thoughts after a breakup is normal. Once you identify the problem and decide to solve it, you'll be able to rest easy. With the right tools, you'll be on your way to reaching a place of closure and comfort. You can request a confidential consultation with a board-certified therapist online. Take the first step today.
How do I deal with a breakup with my boyfriend?
Separating from someone a girlfriend or boyfriend you love is never easy. The first step to dealing with the breakup is to be easy on yourself. Regardless of whose fault the breakup is, you've both experienced a separation and loss. Be honest about your feelings and chat with a professional if needed.
How do you deal with breaking up with someone?
Start by being honest with yourself and honoring your feelings. Allow yourself to cry and experience the emotions of the breakup when you're in a safe space. Seeking guidance and counseling from a licensed professional can help you develop new coping skills to heal.
How do you know when a relationship is really over?
At first, it may be difficult to realize that a relationship is in trouble or that your partner feels like the relationship should end. Letting problems persist or go unresolved can lead to what many refer to as the point of no return, in which a split may become the next step.
Therefore, if your partner begins showing signs of dissatisfaction with the relationship, or if you are struggling with your feelings, it's important to take the time to address the issues as soon as possible. Some signs that a relationship is over may include your partner avoiding alone time with you, canceling plans or making excuses for why they don't have time for things that are important to you. If the time you spend together is more stressful than peaceful, this is an indication that things are not moving in a positive long-term direction.
How do you get over a breakup with someone you still love?
Time really does heal all wounds. Allow yourself the time to grieve the loss of this close relationship. Remember that losing the relationship isn't the end of the world. This is a new opportunity to find someone who is a better match for who you are.
What percentage of breakups get back together?
This is tricky to say. Many couples break up and get back together several times before they officially call it quits. The majority of couples who have broken up for good -- rarely get back together.
Is it normal to miss your ex after 2 years?
Yes, missing your ex from time-to-time after the relationship has ended is normal. Memories of your relationship are like memories of any other important events, friendships, and milestones in your life. Just because you broke up, doesn't mean you'll never miss your ex again. On the flip side, just because you miss them -- doesn't mean you should get back together. There is no timeline for getting over a breakup.
Can breaking up save a relationship?
Taking a break and allowing each other some space can work wonders for a relationship that is going through a rocky period. The two of you may see a different side of each other after taking time to explore new interests on your own. In some cases, this breath of fresh air leads wayward couples back to each other. In others, it leads them out of the relationship completely.
How long should a relationship break last?
No two relationships are alike. There have been cases where a lover stated "I knew in my heart the time was right."There are no hard and fast rules for how long a relationship break should last. This is up to the discretion of the couple. Whatever time frame you and your partner decide on -- make sure that the rules for the break are clear, understood, and agreed upon by both parties to prevent new issues in the future.
What should you do when you've just broken up with your boyfriend?
Going through a breakup can leave you feeling uncertain and wondering what next. If you've just broken up with your boyfriend, there are some things you can do that will may make the breakup easier to deal with.
Let yourself grieve the loss of the relationship. Even if the relationship didn't last a long time, you need to have time to adjust to the change.
Unfriend your boyfriend from social media accounts so that you don't have to see his posts. This will really help your feelings when he moves on to a new relationship.
Try a new hairstyle. As simple as this may sound, a simple thing like a haircut or color can make you feel like a new person.
Change your email address or create a new one and change social media passwords. If he has your email address, you don't want him to use that to contact you. Create a new email address or change your settings to flag his emails as inappropriate. Also, if he had access to your social media accounts, change your passwords right away.
If you aren't exercising and being active, start! Exercise promotes the release of endorphins, also referred to as the "happy hormones" of the body. By being active on a consistent basis, you can have a steady stream of endorphins released into your blood stream which will help keep your mood happy.
Seek counseling, if needed. Depending on the circumstances of your breakup, you may be dealing with some unresolved feelings or emotional scars. If you feel overwhelmed and aren't sure how to handle the stress of the breakup, it's important to acknowledge that. It may be helpful to reach out to a counselor or therapist to learn effective coping mechanisms.
Why do I miss him after breaking up with him?
Just because you are the one who broke up with your boyfriend, that doesn't mean you are not allowed to miss him. The amount of time you spent with him, the memories you still have, and the circumstances that led to the breakup will all an impact on your emotions afterward. It is okay to miss him after breaking up. It is okay to cry if you feel sad. In fact, it is important to acknowledge your feelings and allow yourself to process the breakup.
Should I call him after I broke up with him?
Perhaps the more important question is, why would you want to call him after you broke up with him? If your breakup was on good terms and you both feel comfortable with communicating, a phone call may not be a bad thing. However, if you broke up with him and he was unhappy about it or acted angry or hurt, you may want to ask yourself what good calling him will do. If you feel you've made a mistake and want to discuss it, that's one thing. On the other hand, if you feel guilty for the way you ended the relationship, it may be best to leave the situation alone and give him his space.
Does a guy feel bad after a breakup?
Yes, some guys do feel bad after a breakup. Of course, the circumstances that led to the breakup will have an impact on how he feels and/or responds to you. Some guys feel guilty after breaking up with a girl. Others may second-guess their decision to end the relationship and wonder if they should try to reconcile the relationship. If he didn't want the relationship to end and you did, he may feel hurt after the breakup and question what he could have done differently.
Who hurts more after a breakup?
Whether a man or woman hurts more after a breakup may vary from one relationship to another. If the relationship was long-term, chances are the hurt that the parties experience may be worse. In some studies, women reported higher levels of emotional pain after a breakup and may experience more physical symptoms. Men may not show obvious signs of emotional pain or trauma, but they do feel it. Additionally, in most cases men seem to move on to relationships with new partners more quickly.
What are the 5 stages of break up?
The five stages of a breakup are the same as the five stages of grief model. The stages are as follows:
Denial: During this time, you may try to reconcile the relationship with your ex because you can't accept that the relationship is over. The pain of having someone leave your life can feel very intense and you may find it difficult to move on.
Anger: Feeling anger toward your ex is not uncommon. Also, during this difficult time, you may find that you feel anger or frustration toward others, even if they have nothing to do with the breakup. You may feel anger because of all the time you spent devoted to the relationship, angry because you can't fix the situation, or angry because you feel like you were done wrong.
Bargaining: After a breakup, some people try to bargain with God. They may tell God that if their ex comes back, they will be a better person or live a better life. It is during this stage that you may feel desperate or helpless.
Depression: This stage of a breakup is usually the most difficult to get through. You may feel sad about the breakup or feel worried that falling in love again is out of your reach. Take your time to let yourself health emotionally. Spending time with a friend or loved one may help relieve some of the symptoms of depression. Also, you may need to seek the help of a counselor if depression symptoms persist.
Acceptance: The final stage of a breakup is the acceptance stage. After a period of dealing with the hurt, anger and frustration that you felt, you will begin to feel like you can accept the breakup and move on with your life.
Do guys miss you after breakup?
Of course, guys may miss you after a breakup. No matter how difficult a relationship was or how happy he may seem that the relationship has ended, there are times when he may miss you.
Who moves faster after breakup?
It's not always easy to determine who may move on faster after a breakup. The person who wanted the breakup, is typically the one who finds it easier to move on, while the partner who wanted to continue the relationship may experience feelings of disbelief and hope for the relationship to be mended.
Do guys regret breaking up?
There really is not a cookie cutter outline of how a guy will respond after a breakup. Do some guys regret breaking up? Sure, they do. Do all guys regret breaking up? Probably not. The reason for a breakup is a main factor regarding whether a person has regrets afterward. If a guy breaks up with you and then misses you, he may regret the decision. If the breakup happened in the heat of an argument, he may have regrets. If a guy has broken up with you, it's best to not try and make him feel guilty or tell him he will regret it. Let him work out his feelings on his own.
How do you make him chase you after breakup?
The first rule to follow if you want to make a guy chase you after a breakup is, no contact! Reaching out to him makes it look like you are chasing him, and you obviously want him to chase you. When he does reach out, don't fall all over yourself to make yourself available to him. When you are too available, it makes it easier to take you for granted. Yes, you can talk or text. You can even go out to dinner now and then. Just don't make it look like all you have to do is sit around and wait for his call.
If he texts you, wait a while before you answer him. This will leave him wondering what you could be doing that is more important than him and that's what you want him to think! Have you ever heard someone make a comment like, "Why would I check a book out of the library if someone already told me how it ended?" The same logic can be applied to a relationship or a breakup. If you want to make a guy chase you, don't make yourself an open book.
Will no contact make him forget me?
Typically, when you go no contact an ex will not forget you. If you truly go radio silent where your ex is concerned, he will usually begin to wonder what you're doing, will think about things you did together and may even begin to wonder if a breakup was the right choice. In fact, instead of making him forget you, no contact may make him think of you and want to be with you more.
How long after a breakup will I feel better?
There really is no guarantee of how long it will take you to feel better after a breakup. It will typically be easier to move on and feel better if you stay busy. Cultivate a healthy social life. Go out to dinner with some of your best friends. Spending time with loved ones that you haven't seen in a while and meeting new people will help to fill the void and ease the pain of a breakup. If you and your ex worked together, you may even consider finding a new job. Making a fresh start that is separate from things the two of you shared or had in common (as much as possible) can remove the temptation to stay involved in what is going on in his life and can give you a new outlook on life.
Still In Love With Ex, But They Don't Know
Should I Contact My Ex: 5 Questions To Ask Yourself First
For Additional Help & Support With Your Concerns
Speak with a Licensed Counselor Today
Get The Support You Need From One Of Our Counselors
What Is Online Therapy? About Online Counseling
Abuse ADHD Adolescence Alzheimer's Ambition Anger Anxiety Attachment Attraction Behavior Bipolar Body Dysmorphic Disorder Body Language Bullying Careers Chat Childhood Counseling Dating Defense Mechanisms Dementia Depression Domestic Violence Eating Disorders Family Friendship General Grief Guilt Happiness How To Huntington's Disease Impulse Control Disorder Intimacy Loneliness Love Marriage Medication Memory Menopause MidLife Crisis Mindfulness Monogamy Morality Motivation Neuroticism Optimism Panic Attacks Paranoia Parenting Personality Personality Disorders Persuasion Pessimism Pheromones Phobias Pornography Procrastination Psychiatry Psychologists Psychopathy Psychosis Psychotherapy PTSD Punishment Rejection Relationships Resilience Schizophrenia Self Esteem Sleep Sociopathy Stage Fright Stereotypes Stress Success Stories Synesthesia Teamwork Teenagers Temperament Tests Therapy Time Management Trauma Visualization Willpower Wisdom Worry
How To Feel Confident In Awkward Social Situations 10 Signs That You Might Be In A Negative Relationship How To Move On From A Relationship And Start Healing The Importance Of Communication In A Relationship Is It Time To Seek Relationship Therapy? What To Do In A Relationship When You're Not Happy How To Know When Your Romantic Relationship Is Over - And 3 Real-Life Ways To Cope
The information on this page is not intended to be a substitution for diagnosis, treatment, or informed professional advice. You should not take any action or avoid taking any action without consulting with a qualified mental health professional. For more information, please read our terms of use.


Earlier this month, I&B Minister of State Rajyavardhan Rathore had told Parliament that the government was considering a proposal to prohibit live media coverage of counter terrorism operations by security forces.
Channels have come up with special counting day coverage programme.
The analysis of the election results and the party's next step kept the news channels busy.