Structural colors produced by light manipulating at subwavelength dimensions have been widely studied. In this work, a metasurface-based subtractive color filter (SCF) is demonstrated. The color display of the SCF is confirmed by finding the complementary color of colors filtered by SCF within the color wheel. In addition, two artificial neural network (ANN) models are utilized to accelerate the metasurface forward prediction, and the long short-term memory (LSTM) shows much better performance than traditional multilayer perceptron (MLP). Meanwhile, we train an inverse ANN model established with LSTM to recover the optimal geometric parameter combinations of the meta-atoms. With the variation of the geometric parameters of meta-atoms, versatile color displays of structural colors are realized. The metasurface we propose exhibits good performance of transmissive-type structural color in visible range. The work provides a method for high-efficiency geometric parameter prediction, and paves the way to nanostructure-based color design for display and anticounterfeiting applications. In the entire electromagnetic wave spectrum, only the light in a narrow wavelength band from 380 nm to 780 nm can be captured and recognized by the human eye . TraditiIn the past two decades, structural colors produced by light manipulating at subwavelength dimensions have been widely studied ,8. The cPrevious reports mainly focus on the investigation of additive color filters (ACF), which work in either transmission mode or reflection mode in a narrow wavelength band ,18,19. TThe traditional strategy for structural color design heavily relies on the full electromagnetic (EM) simulation, such as finite difference time domain (FDTD) or finite element method (FEM). The target optical spectrum is obtained by tuning the geometries of nanorods. However, as the complexity of the nanostructures and the scale of the metasurface increase, it may take several days or weeks to design such devices via conventional methods, which will have a large cost in time and computational power. In addition, a simple picture contains millions of pixels; it is impossible to acquire the structures corresponding to the colors in every single pixel by the EM simulation-based trial-and-error method. Thus, the conventional methods are hardly satisfying for the real color display application.By emulating the biological neural network, the artificial neural network (ANN) can learn the hidden relationships between input and output data. So far, this advanced technology has made remarkable achievements from computer vision to natural language processing . In receThe multilayer perceptron (MLP) is an ordinary type of ANN that has been widely used in many scientific fields such as modeling ultrasonic welding of polymers  and the In this work, we demonstrate SCFs based on a silicon-on-insulator system. A larger coverage area of the CIE 1931 chromaticity diagram than the previous report is illustrated in the field of SCFs, especially for the color green ,39. In a2 was chosen as the substrate of SCFs. As is shown in The schematic of the metasurface-based transmission-mode SCFs is illustrated in Taking the variation of all the three geometric parameters into account, the complexity of the metasurface design will inevitably increase. It becomes difficult to obtain the geometric parameters for the target optical response by using the traditional EM simulation. In recent years, ANN has been introduced into the field of micro–nano photonic device design, which is supposed to solve the problem of time and computational power consumption. At the very beginning, we trained the forward ANN to predict the optical response corresponding to the specific combination of geometric parameters. We started with a traditional MLP network as the forward model for predicting the Si colors accurately and instantly. TensorFlow and Keras were used to establish the basic architecture of MLP. Although MLP shows good performance for color prediction with the given geometric parameters, a more accurate color design is still in high demand. It can be seen in Similarly, we input the geometric parameters  into the LSTM model and output the color values . Utilizing ANN, the accurate forward metasurface design is achieved. The well-trained ANN enables the EM simulations to be replaced to accelerate the optical response prediction, which greatly reduces the time and computational power cost. However, the forward neural network can only accelerate the forward metasurface design, and a large amount of trial and error is still needed to obtain the appropriate geometric parameter combination. In the real applications, one pattern may contain tens of thousands of pixels, and the color of each single pixel might differ from others. In order to further reduce the design time, ANN is expected to realize the metasurface inverse design. The inverse ANN outputs the corresponding geometric parameters directly by taking the target values  as the input data.The inverse design is more complicated than the forward design. Directly taking the colors as the input data and the geometric parameters as the output data will cause nonconvergence of the ANN. Different combinations of geometric parameters may produce the same  values, which is known as the non-uniqueness problem. To deal with this challenging task, we use the LSTM to construct a tandem model to accomplish the inverse design of metasurface-based structural colors. The architecture of our inverse neural network is proposed in We take an example to demonstrate the superior performance of the inverse ANN; the details are shown in To exhibit the universality of our inverse model, 100 groups of colors are selected randomly as the test data to realize the Si-structure inverse design. Finally, to demonstrate the superiority of our inverse design approach in real applications, we chose a painting, “Sun Yat-sen University-Xing Pavilion” by Lin Xiwang and Lan Tian from Sun Yat-sen University. The colors of all of the 500 × 354 pixels on the picture are extracted and inputted into the inverse ANN as the target colors, which are shown in Generally, our method described above enables the design of the corresponding geometric parameters by absorbing tens of thousands of target colors in an exceedingly short time. In practice, according to the designed parameters, versatile metasurface-based structural color devices can be fabricated by CMOS technology, which greatly promotes the development of anticounterfeiting, color displays and other applications. At present, the precision of advanced lithography technology can reach 5 nm or even 3 nm, which means that more and more structural colors can be realized.In this work, we designed a metasurface-based SCF, which achieves a larger coverage of the CIE 1931 chromatic diagram than previous studies. In addition, by using the MLP and LSTM neural networks, the acceleration of the metasurface forward design is realized, which greatly reduces the computational power and time cost of the metasurface design. The results prove that the performance of LSTM is much better than that of the MLP network, which also shows that ANN has the potential to replace the traditional EM simulation method. More importantly, we construct an inverse neural network model, which outputs the corresponding geometric parameters by inputting the target color. The inverse ANN enables the inverse design for tens of thousands of different colors to be realized simultaneously. This work will greatly promote the development of anticounterfeiting, color display, sensing and other applications based on structural color, and paves the way for the practical application of silicon color inverse design based on ANN. A new idea has been provided for the research of the rapid and accurate design of micro–nano photonic devices. With help of the CMOS-compatible process, the devices in real applications of structural color should be investigated and fabricated in the future.


In this work, we outline the development of a thermodynamically consistent microscopic model for a suspension of aggregating particles under arbitrary, inertia-less deformation. As a proof-of-concept, we show how the combination of a simplified population-balance-based description of the aggregating particle microstructure along with the use of the single-generator bracket description of nonequilibrium thermodynamics, which leads naturally to the formulation of the model equations. Notable elements of the model are a lognormal distribution for the aggregate size population, a population balance-based model of the aggregation and breakup processes and a conformation tensor-based viscoelastic description of the elastic network of the particle aggregates. The resulting example model is evaluated in steady and transient shear forces and elongational flows and shown to offer predictions that are consistent with observed rheological behavior of typical systems of aggregating particles. Additionally, an expression for the total entropy production is also provided that allows one to judge the thermodynamic consistency and to evaluate the importance of the various dissipative phenomena involved in given flow processes. Unstable colloidal suspensions exhibit aggregation due to interparticle attraction, which plays a key role in their complex physical properties. This aggregation often results in the formation of fractal agglomerates than can span several orders of magnitude in terms of length scale ,2,3 ill and whicHistorically, a variety of models have been developed ,17,18,19Several models, following the work of de Souza Mendes ,31, atteDespite the success of the structural kinetics modeling approach in terms of prediction and ease of implementation, there remain significant areas for improvement. The associated governing equations are purely phenomenological and constructed to satisfy the rheometrically observed transient and steady-state shear flow features without a direct connection to an experimentally identifiable internal microstructure. In addition, recent studies have called into question the thermodynamic consistency of structural kinetics models. Larson  has poinAlternatively, Stephanou and Georgiou  have offEver since its inception, the development of better models to describe mesoscale dynamics has always been a significant thrust of inquiry among the nonequilibrium thermodynamics community ,54,55,56The manuscript is organized as follows. In the next section , the derWithin the SGBF-NET model presented by Beris and Edwards , there aF[x_] as :(1)dFdt=Application of the above relationships and a comparison with the expression obtained through differentiation of the following parts:s (as in ).Macroscopic fluid properties, such as viscosity, elastic moduli and relaxation times, depend on the agglomerate size distribution. Under deformation, the evolution of the agglomerate size distribution results in complex rheological signatures, such as shear thinning, thixotropy and viscoelasticity. Capturing these dynamics requires an appropriate choice of state variables.It is critically important to select state variables that compactly but accurately represent this size distribution, because the aggregating suspensions generally consist of a distribution of time- or rate-dependent agglomerate sizes. Other than directly tracking the size distribution function, one common method to obtain a more compact, closed-form description for continuous probability density functions is by using a finite number of moments:eserving ,64. The A common challenge in using a moment distribution is the need for a closure approximation to enable the calculation of any arbitrary properties of the distribution, including moments not explicitly represented  stored in the agglomerate network and the Helmholtz free energy of mixing (mixing-entropy-driven) involved in the formation of flocs or agglomerates, shown as follows:M) model ,44,45 asfined as :(11)ΔsmiWe can use the lognormal distribution function, as defined in Equation (4), to calculate the entropy of mixing as stated above from the equivalent form:Using the aforementioned expressions, the full Hamiltonian can now be constructed as:F, G, as:Once the system variables are specified and their physical and tensorial characteristics have been identified, we can construct the Poisson bracket, as each system variable contributes according to its physical nature and tensorial character . The PoiF, G, involving Volterra derivatives of those with respect to the state variable—see Note that for convenience, here and in the following, we use Einstein’s repeated indices summation convention, i.e., whenever repeated Greek letter subscripts appear, those also imply a summation from 1 to 3. The Poisson bracket is an antisymmetric bilinear functional with respect to the functionals F, G in terms of the variables involved. Keeping the lowest order terms while also respecting the symmetries involved and the physical meaning of the variables involved  gives:The primitive part of the dissipation bracket  is defined here as a symmetric bilinear form of functionals F and using the definitions provided in Equations (16) and (17), the governing equations for the evolution in time of the system variables can now be derived. The dissipation bracket contains the symmetric contributions signifying the coupled dynamics of various system-state variables. There can potentially be additional terms arising from the coupling between In the above expression, the fourth-order transport properties of the viscosity matrix, Following the four steps outlined above, the governing equations for the time evolution of the state variables are determined by requiring the equivalence of Equations (1) and (2) for an arbitrary functional tion—see  for furtFirst, the momentum equation is obtained using both elastic and viscous stress contributions to the extra stress Similarly, the evolution of conformation tensor is given as follows:Note that from our selection of the Poisson bracket, Equation (16), the upper-convected derivative naturally emerges. This corresponds to the most natural description of polymeric viscoelasticity  and is tThe Volterra functional derivatives that appear in the above expressions are summarized in Using entropy maximization, the static (no flow) equilibrium values for the zeroths and second moment of the distribution can be evaluated as:It is useful now to construct a dimensionless parameter, At equilibrium, The transport coefficients appearing in this model offer quite a bit of flexibility regarding their functional form and dependence on other state variables. In our case, using the extended White–Metzner model ,72 a desThis choice represents the simplest one able to describe the Maxwell-based shear thinning viscoelasticity. More involved expressions are also available ,44,45. WIn physical terms, the relaxation parameters Finally, the fourth-order viscous dissipation tensor is assumed to correspond to that of an isotropic Newtonian viscous fluid  with a dAfter substituting the above expressions for the transport coefficients, we can obtain the final form of the governing equations as:For the relaxation time n tensor ,72:(36)τThe evolution equation for the conformation tensor, Equation (32), describes the upper-convected derivative of the conformation tensor in terms of two primary contributions, with the first one (first bracket in Equation (32)) arising from the last (fourth) integral contribution to the dissipation bracket, Equation (17), coupling structural moments with the viscoelasticity, while the second one arises from the White–Metzner relaxation time weighting of the deviation from the equilibrium configuration, o et al. , which ao et al. .The structural moment evolution equations, Equations (33) and (34), have similar forms in their right hand sides consisting of aggregation and breakage terms that depend on the moments as well as on the conformation tensor. The first term (involving a bracket) is weighted by a time constant It is important to note here that in Equations (33) and (34), the breakage terms are scaled with  studies ,16,22. I. Larson  has show. Larson ). The elThe governing equations involve nonlinear dependences that may prove difficult to resolve for all parameter values. Therefore, to simplify our analysis, we chose simple relationships for the elastic modulus and viscosity functions. The elastic modulus is established in the literature to be related to the concentration of primary particles in the agglomerates, and for a fractal structure, numerous scaling laws have been proposed in the literature, depending on the nature of interactions between the flocs. More commonly, the scaling law proposed by Shih et al.  is used.equation :(38)η establishing the theoretical foundation in NET for modeling a distribution of agglomerate sizes and (b) providing a route to independently incorporate developed models in a thermodynamically consistent manner. For a homogeneous system, the model has a total of 10 parameters: five time constants, The model parameters are selected to illustrate behavior that aligns with physically observable systems. For simplicity, we fix the fractal dimension to that commonly observed for reaction limited aggregation, df=2.1 . We alsoode23s is for the steady state following a shear start-up transient, simultaneously confirming the stability of the presented results.The governing equations, Equations (32)–(35), are solved by assuming homogenous flow under simple shear conditions, with flow kinematics given by The shear stress and first normal stress difference are shown in fference . Howeverfference ,62. Indes et al. , althougThe changes in the agglomerate distribution with increasing steady shear rate are plotted in k. By changing the exponent Of further interest is how the results change with a systematic change of one of the three main parameters of the model. r stress a, but a Similar observations regarding changes in the model predictions with the model parameter Transient features of the model behavior help to distinguish thixotropy from pure shear thinning and time-dependent viscoelasticity. Therefore, transients are also important from a modeling standpoint. The present model predictions follow expected trends for typical transient experiments . Plottedion rate b. The evion rate c. The seWi = 3. This phenomenon has been reported experimentally by Hendricks et al. [The next investigation is the opposite of shear start-up, stress relaxation. As shown in s et al.  shown tos et al. . It is tAnother transient feature that distinguishes thixotropy is the hysteresis observed in shear stress when the fluid is subjected to a ramp-up in deformation rate, followed by a ramp down at the same rate, such that:Wi) with an orange line in The simplest evidence we can provide for thixotropy in the model is by performing an intermittent shear rate step test, where a shear rate is applied as depicted  to the flow, such that Wi, which is defined here as The uniaxial elongation corresponds .In the SGBF-NET model, the entropy correction g manner :(40)[F,HCalculation of the entropy production allows an illustration of the thermodynamic consistency of the proposed model. Following the notations shown in Equation (41), the first term, Because the conformation tensor is always a positive semi-definite, the resulting expression is always non-negative . Similarly, the third and fourth terms, The numerical evidence shows that these terms are indeed non-negative for the choice of the transport coefficients made here in the start-up of shear flows for all For a more general investigation of the non-negative character of the entropy production, applicable for general flows or more general expressions of the Hamiltonian function, the SGBF allows one to examine the primitive dissipation bracket, and in particular the character of the two matrices that define it, namely the coupling Volterra derivatives of the viscous tensor rinciple ); therefFor the order of magnitude analysis, the elastic modulus can be assumed to be Far from equilibrium, The entropy expression can also be used to judge the evolution and the importance of various dissipative phenomena during transients. The entropy production rates corresponding to the six terms in the Equation (41) are shown for a simple shear flow start-up case in A thermodynamically consistent modeling approach was applied to a particle-level physical description of an aggregating suspension that systematically extracts the macroscopic rheological behavior from the underlying physics of the aggregation and breakage. The approach relates the entropy and free energy change involved in the evolution of agglomerate sizes with the rate equation of aggregation and breakage, which is in turn used to describe the evolution of elasticity, plasticity and thixotropy. The approach uses the SGBF-NET developed by Beris and Edwards  and the The framework is applied to a simplified set of independent system variables for a suspension of agglomerates described by a lognormal distribution to generate a set of closed equations that describe the stress and agglomerate structure valid for arbitrary, noninertial flows. The resultant equations have a total of 10 parameters that can be related to the physical properties of the system. Although developed here based on a generic simplified physical picture for illustration purposes, these model equations can be readily extended to include more complex underlying physical processes beyond the aggregation and breakage processes considered here, as well as more complex distributions for any specific system of interest based on available relevant experimental data. Inversely, one can possibly simplify the present model by assuming a uniform distribution that only involves the zeroth-order moment of the distribution. This will lead to only one differential equation for the particle size distribution that may be simpler to solve; however, the important thing to note is that such simplicity may be at the expense of a more appropriate and physically meaningful description of the system.The examples of model behavior for a highly simplified set of parameter values show the rich behavior in qualitative agreement with general trends and key signatures observed in thixotropic elasto-viscoplastic materials via experimentation. Another benefit of this approach is that because it uses physically achievable measures of structure , it allows one to incorporate independently derived structural models and relationships instead of relying on phenomenology. Moreover, it potentially allows for an independent verification of the structural modeling characteristics, as they are in principle experimentally testable. The functional forms and scaling in the rate equation can be directly paired with population balance models for thermodynamically consistent modeling of mesoscale aggregation and breakage dynamics ,3. This There are additional phenomena such as dynamic arrest  and anis


The intelligence of energy storage devices has led to a sharp increase in the amount of detection data generated. Data sharing among distributed energy storage networks can realize collaborative control and comprehensive analysis, which effectively improves the clustering and intelligence. However, data security problems have become the main obstacle for energy storage devices to share data for joint modeling and analysis. The security issues caused by information leakage far outweigh property losses. In this article, we first proposed a blockchain-based machine learning scheme for secure data sharing in distributed energy storage networks. Then, we formulated the data sharing problem into a machine-learning problem by incorporating secure federated learning. Innovative verification methods and consensus mechanisms were used to encourage participants to act honestly, and to use well-designed incentive mechanisms to ensure the sustainable and stable operation of the system. We implemented the scheme of SFedChain and experimented on real datasets with different settings. The numerical results show that SFedChain is promising. In this regard, the traditional privacy protection strategy can be mainly divided into the privacy protection of input data and output data. The privacy protection of input data is mainly based on publishing anonymous data, such as k-anonymity, l-diversity, t-closeness, and differential privacy. k-anonymity, l-diversity and t-closeness , Y(Y ≤ X) task collaborators selected according to SFedChain’s task-related parties retrieval strategy, and Y collaborators related to the task from the X data holders through the blockchain. The collaborators use their local data set to train to obtain the local model, and use blockchain to record the parameters of each local model. The global model (GM) is obtained using SFedChain’s aggregation strategy. After continuous iterative training. Finally, the joint modeling model GM is eventually recorded in the blockchain, and the task requester obtains the result Req(GM) through the blockchain.In this article, we assume a joint modeling scenario involving multiple collaborators. Each collaborator has a dataset that can train a local model, multiple collaborators work together to jointly model the requested task. We used the “Three-in-One” blockchain network to archive, retrieve, and audit the joint modeling process to ensure its safety, and the consortium blockchain as the infrastructure for the distributed energy storage network. An illustration of data protection among various devices is shown in Before we introduce SFedChain, we will outline the relevant concepts and keyword definitions in SFedChain.MasterChain: MasterChain is used to register new sites and new users, records the main configuration information of the site, manage user data access control, and store the joint modeling model. We use MasterChain to publish the requested task.RetrievalChain: RetrievalChain is used to record the summary of site document information and the Unified Retrieval Graph that is regularly established, and it is mainly responsible for the retrieval of task-related parties.ArgChain: The upload of local model parameters by each party and the update of the aggregated model are recorded in ArgChain in the form of transactions.DataHolder: DataHolder is a energy storage device registered with MasterChain. It has private local data and can rely on its own local dataset to train to participate in the joint modeling.TaskRequester: TaskRequester is the user who publishes the requested task. It needs to pay the corresponding coin for the requested task to start the joint modeling.Worker: In SFedChain, Worker is the task-related DataHolder obtained from RetrievalChain according to the requested task. It is similar to the role of participant in traditional distributed deep learning, but it can’t train alone to obtain a joint modeling model, and can only use its limited dataset for local training to participate in joint modeling tasks.Z Workers with higher CreditCoin are selected from the Y Workers participating in the joint modeling to form Committee Members. The Worker with the highest CreditCoin is selected as the Leader of the committee.Committee Members: In each round of local model parameter aggregation, CreditCoin: At the beginning of the joint modeling process, SFedChain allocates the same amount of CreditCoin to the Workers participating in the joint modeling process to represent the initial credit of each Worker in the joint modeling process.In the scenario of distributed energy storage networks, we designed the system model of SFedChain. We combined blockchain technology with traditional federated learning technology to achieve secure and efficient distributed data sharing. MasterChain was mainly responsible for issuing requested tasks and recording joint modeling models, which can improve the efficiency of the system in processing tasks. RetrievalChain was used to record the Unified Retrieval Graph that as generated regularly, and realized the quick retrieval of Workers. Workers uses its dataset to train local models, we combined the federated learning technology and use the parameter entry method to ensure the safety of parameter sharing in the joint modeling process. Committee Members and Leader in the committee were selected for aggregation of local model parameters through SFedChain’s novel aggregation strategy. Therefore, the system does not require a reliable third party for parameter aggregation, which further ensures the security of the joint modeling process. At the same time, the system introduces an incentive mechanism to encourage the active participation of DataHolder by rewarding honest participants. Eventually, TaskRequester will obtain the result of the request through MasterChain.Y Workers related to the requested task among the X data providers to complete a joint modeling task. In a real-world industrial environment, task requesters and co-modeling participants are usually considered dishonest. They do not want to pay for the requested task or deliberately sabotage the joint modeling process and steal confidential information from other participants. From the above analysis, we can see that the proposed system model may face the following three threats:We paid attention to the secure data sharing between distributed multiple parties, and selected  1.Quality of the locally trained model: Workers may provide poorly trained model parameters due to local data set quality problems, or malicious Workers want to get rewards but do not participate in training, so they directly provide incorrect local models. 2.Instability of the parameter aggregation service: A dishonest parameter aggregation server may provide incorrect aggregation models, which will result in a serious degradation of the quality of the joint modeling model, or the parameter aggregation service may suffer malicious attacks and cause the joint modeling process to be interrupted. 3.Privacy protection in the data sharing: Workers and DataHolders participating in the joint modeling process want to obtain the parameter information of other participants through inference attacks or other methods, thereby causing user privacy leakage.The SFedChain architecture we proposed consists of three parts: MasterChain module, RetrievalChain module, and ArgChain module based on federated learning. MasterChain module establishes a secure connection between all participants, and records the joint modeling model of each requested task to achieve a rapid response to the same requested task of other users. RetrievalChain module uses the regularly generated Unified Retrieval Graph to achieve efficient retrieval of the relevant DataHolders of the requested task, and uses the retrieved Workers to implement joint modeling. ArgChain module combines with traditional federated learning to realize the secure sharing of local model parameters, and uses novel smart contract and consensus mechanism to improve the quality and efficiency of the joint modeling model. We use the “three-chain-in-one” architecture to achieve secure joint modeling without the original data coming out of the local situation, and maintain the system’s lasting operation through all DataHolders.DataHolderReq site server, DataHolderReq first searches MasterChain whether the joint modeling model of the same requested task has been recorded. If found, the system will download the joint modeling model GMi recorded in MasterChain, and then return the result of the requested task Req(GMi) to the TaskRequester. Otherwise, for a new task, the task-related information is sent to RetrievalChain to retrieve the task-related DataHolders, and then, the system will use the retrieved Workers to perform the joint modeling process through ArgChain. In each iteration, the new CreditCoin owned by each Worker is calculated based on the CreditCoin owned by each task-related parties and the local model accuracy, and then new Leader in committee and Committee Members are elected to aggregate and agree on the joint model. Finally, the result Req(GMReq) of the requested task is returned to the TaskRequester in the form of a transaction through MasterChain. The coin paid by TaskRequester are distributed in the same proportion according to the proportion of CreditCoin ultimately owned by Workers participating in the joint modeling, in this way, more data holders will be attracted to join the system.Before a new user initiates a requested task or a new DataHolder participates in joint modeling, both should first register through MasterChain. TaskRequester publishes the requested task to MasterChain through its nearby In this section, we design and analyze the SFedChain scheme. Firstly, we design the Unified Retrieval Graph to realize the efficient retrieval of the task-related parties and protect the privacy of the DataHolder. Furthermore, we described in detail the data sharing process of our proposed model SFedChain. Finally, this article adopts the verify upload mechanism of encrypted parameters and the dynamic weight consensus protocol based on CreditCoin to improve the accuracy of the joint modeling model.As a classic image data information extraction technology, CNN has been applied in many fields such as image segmentation, video classification, and target recognition . For traFor the processing of text data, the use of pre-trained language models  for texti − th DataHolder, we used In order to continue to simplify the calculation of data similarity between DataHolders, we further processed the sparsity expression of data of each DataHolder. For the distance represents the actual physical distance between DataHolderi and DataHolderj and α is a hyperparameter, which is used to adjust the holding ratio of the actual physical distance.where NODE is the sparse representation matrix of DataHolder, In order to improve the efficiency of calculation and processing, we used graphs to express the relationship between DataHolders, as shown in the following definition 1:G = {V, E} consists of a series of nodes and edges. Each vertex Vi represents a DataHolder, and its weight represents the identity information of DataHolder, such as ID, data type, data size, etc. Each edge Eij connects vertices Vi and Vj, and its weight WEij represents the ratio of the similarity between the two vertices to the maximum vertex similarity value  information of nearby nodes through IDTR (the ID of the TaskRequester). According to the coin paid by TaskRequester, the ratio of retrieving the number of DataHolders is VDH representing IDDH, retrieve its adjacent edges. If the weight WEi,j of the adjacent edge Ei,j is less than ratioretrieval, the vertex Vi connected by the adjacent edge Ei,j will be included in the task-related parties set SETDH are the Workers participating in the joint modeling. At the same time, the equal number of CreditCoins are equally divided among Workers to identify the initial credit of each participant.RetrievalChain obtains DataHolderreq, and then initialize the requested task DataHolderreq submits the requested task to MasterChain in the form of a transaction. MasterChain queries its recorded historical joint model, if there is a joint model GMi for the same request task and the coin paid by TaskRequester is less than or equal to the coin spent on establishment of GMi, DataHolderreq will download the model GMi and return the result Req(GM) to TaskRequester. Finally, the coin paid by the TaskRequester are distributed according to the proportion of CreditCoin owned by each Worker after GMi is jointly modeled. On the contrary, If the joint modeling model GM that matches the requested task is not found, or the GM is hit but the coin paid by the TaskRequester is more than the coin paid by the user when the GMi is established, the system will retrain the model for the requested task. During joint modeling, the system first uses the Unified Retrieval Graph to perform task-related parties retrieval through RetrievalChain, and then performs joint modeling using the retrieved Workers. After multiple iterations of training through ArgChain, the system finally obtains the joint modeling model GMReq that satisfies the requested task, and then uploads GMReq to MasterChain in the form of a transaction, and returns the result Req(GMReq) to TaskRequester, finally the system performs the remuneration distribution of coin paid by TaskRequester.In distributed energy storage networks, the first energy storage device to join the system is responsible for the deployment of the blockchain network. Subsequent devices need to register their own nodes through MasterChain, and then use their site servers to jointly maintain the operation of the blockchain network. Before publishing the requested task, the new TaskRequester should first register as a user through the nearby device The detailed steps of our data sharing scheme are as follows,  1.System deployment: The first DataHolder to join the system is responsible for the deployment of the system. First, it will create MasterChain, RetrievalChain and ArgChain, and then register its node information in MasterChain. There are two main types of transactions in MasterChain: registration records of new users and new nodes, and release records of joint models.The main transaction forms in RetrievalChain include: update records of Unified Retrieval Graph and retrieval records of task-related parties. The transaction forms in ArgChain mainly include: the upload record of local training models and aggregate model. 2.IDDH through MasterChain , and then it will work with other DataHolder to maintain the operation of the system. Similarly, a new user should first register with the nearby DataHolder before posting the requested task to obtain its unique IDuser.System Initialization: When a new DataHolder applies to join the system, the system distributes  3.Req, and pays the corresponding coin according to the expected model effect. MasterChain checks whether the TaskRequester has been registered. If the check passes, the nearby energy storage deivce DataHolder Req uploads the task to MasterChain as a transaction.Otherwise, the system performs a new user registration operation.Task Request: Task Requester submits the requested task  4.GMi of the same requested task, the coin paid by TaskRequester is less than or equal to the coin i spent on establishment of GMi, and greater than the minimum payment fee αcoin i. Then, the result ReqGMi is returned to TaskRequester, and the coins paid by it are distributed according to the proportion of CreditCoin owned by each worker after GMi joint modeling. On the contrary, if the joint model GM that matches the task is not found, or GMi is queried but TaskRequester paid more coins than GMi was created, retrain the joint model.Historical joint model query: Once the task submitted by TaskRequester is accepted by MasterChain, the system will query the historical union model. If there is a joint model  5.Req through the requested task, and then sends the obtained IDDH to RetrievalChain for task related party retrieval and make the distribution of CreditCoin. Finally, RetriavalChain sends the retrieved Workers to ArgChain for joint modeling.Retrieval task-related parties: MasterChain obtains the relevant information of the nearby energy storage device DataHolder 6.GMReq for local model training. After the local model training is over, ArgChain’s smart contract algorithm will verify the local model parameters, and then upload the W(W ≤ Y) local model parameters that have passed the verification to the ArgChain. At the same time, the CreditCoin owned by each worker will also be adjusted according to the training quality of its local model.Model training: ArgChain obtains Y Workers participating in joint modeling from RetrievalChain. Each Worker uses its local dataset and initial model  7.Z(Z = μY) Workers with the highest accuracy from W honest workers to form Committee Members. At the same time, we select the Worker with the highest accuracy as the Leader of the committee for local model parameter aggregation, and send the aggregation results to the committee members for consensus. If the consensus is passed, the Leader of the committee will release the aggregation model GMReq and upload it to AgrChain, which can facilitate the Workers participating in the joint modeling process to download and update their local models.Consensus process: We select  8.Complete the requested task:After several iterations of training, the joint modeling model For a DataHolder, it is difficult to guarantee the training quality of the local model due to its limited resources, and to effectively protect the privacy of users by sharing the original data information of all parties for centralized training. As a result, the aggregation strategy of SFecChain not only expands the amount of data required but also protects data privacy of users by integrating multiparty DataHolders’ local model parameters for joint model training without the original data being local.In the local model parameter aggregation stage, dishonest Workers may upload incorrect local model parameters, and it is difficult to guarantee the reliability of the Leader in committee responsible for local model parameter aggregation. Therefore, it is difficult to establish an accurate and efficient joint model. Existing consensus protocols, such as PoW, etc. miner requires huge computational overhead to solve cumbersome data problems, and its long consensus process seriously affects the efficiency of system modeling, so it is not suitable for scenarios with frequent transactions. To solve these problems, inspired by In order to ensure the secure sharing of local model parameters during the joint modeling, we integrate the differential privacy mechanism into SFedChain. The privacy of Workers is protected by adding noise to local model parameters. We use smart contract of ArgChain to filter the malicious behavior of dishonest participants in the joint modeling, which effectively guarantees the quality of the joint training model, and combined with the distributed ledger technology of ArgChain to further ensure the security of local model parameter sharing.LMi and LMj participating in joint modeling, we make them satisfy:After the local training of the Workers participating in the joint model training is completed, we add noise that conforms to the Laplace distribution to it, and then upload it to ArgChain. The privacy of users is protected through a differential privacy mechanism. We use the selected random algorithm LMi and LMj satisfying ɛ. Specifically, we add random noise with a density function of LMi and LMj, and select a suitable differential privacy budget ɛ to obtain the processed local model parameters The system provides differential privacy protection for the local model parameters Since Workers participating in joint modeling may upload local model parameters of poor quality, or dishonest Workers maliciously upload incorrect local model parameters, these behaviors will seriously affect the quality of the final joint training model. Therefore, it is particularly important to screen non-compliant local model parameters. In response to the above problems, we propose a differential privacy protection mechanism for local model parameters and a parameter verification mechanism based on ArgChain’s smart contracts. Algorithm 1 illustrates the verification process of the smart contract algorithm of ArgChain.Y in each round will be aggregated by the miners. A conventional idea is that the Worker with the highest accuracy of local model training in each round has high credibility and can be used to aggregate local model parameters. This is considered a greedy strategy. The training accuracy of local model is not necessarily related to whether it is honest or not, and the reliability of the aggregation process cannot be guaranteed. In order to ensure the accuracy of local model parameter aggregation, we propose a credit-based dynamic weight consensus protocol.After the local model parameters of Y Workers participating in the joint modeling are verified by the smart contract of ArgChain. Package the verified local model parameters We comprehensively consider the historical credit of the Y Workers participating in the joint modeling and the training accuracy of each round of local model, and then we calculate the new credit value of the Y Workers in the new round. The Leader in committee and Z Committee Members are elected through the new credit value for the aggregation of local model parameters and the consensus of the aggregation results. Algorithm 2 illustrates the overall process of credit-based dynamic weight parameter aggregation.We have established a multi-party data security sharing and privacy protection mechanism in distributed energy storage networks by applying blockchain technology. By integrating into the traditional federated learning mechanism, the “Three Chains in One” structure has been established. We solved the threat model proposed in the “Threat model” section. 1.Security proof for SFedChain: The traditional single chain structure of blockchain is difficult to meet the requirements of data retrieval, calculation and privacy protection at the same time. Therefore, we propose a “three chains in one” architecture including MasterChain, RetrievalChain, and ArgChain. MasterChain is mainly responsible for the publication of events of requested task and the quick query of historical aggregation models. RetrievalChain is mainly responsible for regular update of the Unified Retrieval Graph. ArgChain mainly carries out the secure sharing of parameters of the federated learning. They perform their respective duties to improve the network performance of the system to achieve data security sharing and privacy protection. 2.Smart contract verification mechanism of ArgChain combined with differential privacy: Before uploading the trained local model parameters to ArgChain, the real data can be hidden by perturbing the local model parameters and adding noise that conforms to the Laplace distribution. Attacks with background knowledge can be avoided to obtain the original data information of the DataHolder. The trained local model parameters are verified through smart contract of ArgChain. Since DataHolder may train poor quality model parameters or dishonest DataHolder maliciously upload incorrect local model parameters, these factors will lead to lower quality of the joint model. Filtering the uploaded local model parameters through ArgChain’s smart contract can guarantee the training quality of the joint model. 3.No fixed aggregation server: In the aggregation phase of the local model parameters. A dishonest parameter aggregation server generates incorrect aggregation parameters, or the parameter aggregation server is attacked by a malicious attacker, which may cause the interruption of the parameter aggregation process. We propose a method of dynamically selecting parameter aggregation server and Committee Members based on the credit of Workers to perform parameter aggregation services, and to agree on the result of parameter aggregation to ensure the safety and accuracy of the parameter aggregation process. 4.The quality of the joint training model: In order to obtain a higher-quality joint training model, we propose a local model parameter aggregation algorithm based on dynamic weight allocation. Specifically, the new CreditCoin owned by each Worker is calculated by using the CreditCoin owned by the Worker and the accuracy of each round of local training. Perform softmax on the new CreditCoin, and perform a weighted summation of its local model parameters according to its different proportions to obtain the joint model parameters for each round. 5.Incentive mechanism: In order to ensure the durable operation of SFedChain and attract more DataHolders to participate in the joint modeling of the requested task. We propose to pay rewards for participating in joint modeling workers to attract more DataHolders to join. TaskRequester pays Coin for its requested task. According to the performance of Workers’ joint modeling process, different amounts of rewards are allocated to improve the enthusiasm of DataHolder to participate.We used 20 Newsgroups and AG News to simulate the adaptability and high efficiency of SFedChain, which are international standard datasets that are often used to evaluate text-related machine learning algorithms. The 20 newsgroup dataset is a collection newsgroup documents. This dataset collected about 20,000 newsgroup documents, which were evenly divided into 20 newsgroup collections with different topics. It has become a popular data set for experiments in text applications of machine learning techniques. The AG news is a collection of more than one million news articles. News articles were gathered from more than 2,000 news sources by ComeToMyHead in more than one year of activity. The dataset includes 120,000 training samples and 7,600 test samples. Each sample was a short text with four types of labels. We used these two datasets to simulate the text data generated by the equipment operation and monitoring of each device.We simulated different numbers of energy storage devices, which have their own local dataset and can be independently modeled. We used the selected dataset to split the data entries, and regroup according to the number of groups set in each experiment, to simulate DataHolders in SFedChain. We used text topic classification analysis to simulate the requested task of the TaskRequester, and implemented our improved attention mechanism on text data to perform the joint modeling process of the SFedChain scheme in the process of distributed multi-party data sharing.We perform a lot of simulations on Linux ubuntu 4.15.0-45-generic, and the hardware conguration is as follows: Intel(R) Xeon(R) Gold 5218 CPU @ 2.30 GHz, 251G, 10TB hard drive, interpreter Python 3.8.10, and pytorch 1.7.0, We analyzed and evaluated the performance of the SFedChain scheme, and gave the following experimental results.We use 20 Newsgroup and AG News benchmark datasets to evaluate the accuracy of our proposed model. In order to ensure the accuracy of the experimental results, we conducted 10 experiments and took the average of the results. The performance comparison between our proposed model and the benchmark method text graph convolutional networks  on varioHowever, the time to build a model is also a key factor to measure the performance of the model. Therefore, we evaluated the time for each DataHolder to build the local model and the joint model, and compared it with the benchmark method text graph convolutional networks model. Through the above evaluation, we can observe that with the addition of the new data holder, the accuracy of the joint modeling model can be continuously improved without significantly increasing the time spent in the joint modeling process. So our scheme can attract more data holders to join to improve the joint modeling effect of the request task. As the number of data holders participating in joint modeling increases, the system needs to perform more local model aggregation and updates, which causes a slight increase in system overhead. However, with the addition of more data holders, the data scale of joint modeling is further improved, and SFedChain’s secure data sharing mechanism brings a significant increase in the performance of joint modeling models, which effectively improves the quality of service in distributed energy storage networks.In this article, we proposed a blockchain-based machine learning scheme for privacy data sharing in distributed energy storage networks. A series of security analysis and simulation experiments show that our proposed scheme not only protects data privacy, but also further improves the accuracy of the joint modeling model in energy storage device applications through a secure data sharing mechanism. The combination of blockchain and machine learning is an effective way to realize the safe sharing of data. However, the question of how to use blockchain technology to further ensure privacy protection in the data sharing process is still worthy of attention, as is determining how to gather more valuable data information from distributed multi-party data holders. Therefore, machine learning algorithms suitable for joint modeling scenarios still need further research. In addition, due to the limitation of communication bandwidth, determining how to further reduce the communication overhead of the joint model modeling process remains to be further discussed.


Federated clouds are interconnected cooperative cloud infrastructures offering vast hosting capabilities, smooth workload migration and enhanced reliability. However, recent devastating attacks on such clouds have shown that such features come with serious security challenges. The oblivious heterogeneous construction, management, and policies employed in federated clouds open the door for attackers to induce conflicts to facilitate pervasive coordinated attacks. In this paper, we present a novel proactive defense that aims to increase attacker uncertainty and complicate target tracking, a critical step for successful coordinated attacks. The presented systemic approach acts as a VM management platform with an intrinsic multidimensional hierarchical attack representation model (HARM) guiding a dynamic, self and situation-aware VM live-migration for moving-target defense (MtD). The proposed system managed to achieve the proposed goals in a resource-, energy-, and cost-efficient manner. The growth in demand for cloud services presents considerable challenges for cloud providers to meet the requirements of end users and satisfy their expectations . AccordiA good example is cross side-channel attacks that exploit isolation vulnerabilities to cross the logical boundaries separating VMs sharing the same physical host resources. Attackers usually exploit their presence on the same host hosting the victim’s virtual machine, construct a side-channel attack and access sensitive data ,4.Literature reports indicate that even modern clouds are exposed to different vulnerabilities that could attract attackers , with stResearchers have categorized MtD techniques into three types according to the change induced during the defense-provisioning process . These cMany researchers have proposed effective security solutions that rely on one of the MtD categories mentioned above. Others have presented enhanced solutions by combining different MtD categories, including shuffle and diversity MtD techniques, to improve the VMs’ security level on the cloud. Based on , most ofConsequently, this paper presents an adaptive MtD modeL(AML), a novel virtual machine mobility framework to enable live cross-cloud migrations of running machines for moving-target defense (MtD). The AML MtD strategy design relies on real-time quantification of risk presented as a multi-objective optimization problem. The presented MtD model represents a risk motive for change which depends on real-time risk calculations of the hosts and VMs deployed in the federated cloud. As VM migration is costly and consumes time, AML triggers VM migration decisions based on their risk level, indicating the presence of threats.VM risk calculation depends on the exploitability and impact of targeted vulnerabilities on the VM operation. The AML prefers to migrate VMs with high-risk values vs. those with lower-risk values. The AML real-time VM risk calculations will guide the AML to find a suitable host with a low risk to host the migrated VMs. Cloud users’ applications are deployed in a distributed or centralized manner. Highly dependent distributed applications might result in whole-system failure if one of the applications’ VMs stops working. To tackle this problem, the cloud environment allows users to request replication of these critical VMs in different clouds when registering the cloud services. The VM criticality level is an indicator used to reflect the implemented level of module diversity and the number of application replicas. Furthermore, for VMs with low tolerance to failures, such as those hosting sensitive applications, including real-time applications, migrating these VMs could cause a stop in the whole application, with loss of power and time until it resumes working normally.Consequently, the AML considers the critical nature of VM-hosted applications in migration decision-making. The AML prompts the migration when it detects a VM with high-risk and low criticality factors. The AML builds the migration strategy for VMs, taking into consideration the high-risk and criticality factors of the VM, neighbouring VMs, and the underlying host. The AML will consider migrating the neighbour VMs of a critical target, if they are considered high-risk, to maintain the total risk value of the host under a certain threshold. For time-sensitive applications, the AML considers using containers instead of VMs. Containers offer an alternative virtualization method, making them more lightweight and portable. The migration duration depends on the application characteristics and the memory footprint of the application hosted on the container ,14. HoweTo ensure the privacy of hosted VMs and cloud data, blockchain technology is used to support the AML’s operation. The blockchain enables transparency and immutability and offers an additional layer of security to the migration strategy metadata.In the AML, security is not the only targeted objective during migration strategy design. Maximizing resource utilization is one of the vital objectives that impact the cloud quality of the service and the operational cost. The AML aims to maximize resource utilization within a federated environment by enabling cross-cloud VM/container consolidation during the migration strategy design.However, VM consolidation can easily increase the risk level of the cloud hosts. The AML seeks to balance the targeted objectives towards minimizing the risk of attacks and failures, while maximizing cloud resource utilization.Presenting an adaptive moving-target defense model relying on a self- and situation-aware decision-making mechanism.Enabling security-aware, virtual machine consolidation for efficient resource utilization and improved energy harvesting.The main contributions of the paper are summarized as follows:The remainder of this paper is organized as follows: Cloud computing technology in the field of high-performance distributed computing represents a milestone as it provides shared computing and storage resources as a service upon a user’s request . A serviConventional cloud computing systems possess limitations. It is difficult for users to switch between various cloud providers due to the lack of a standard architecture. There is no standard metering system for cloud computing services. Metering systems collect metrics about users’ access level to the cloud, their use of computing resources, and specific information about the apps and processes that users run. Some researchers have proposed metering modules for system metric calculations to ensure the end user’s transparent and easy access to cloud computing resources ,17.Cloud providers find it difficult to maintain performance transparency due to changing user requirements, varying loads and limited resources, especially for small and medium providers. A federation of clouds is a possible solution to these problems .Federated cloud computing expands the scope of cloud services by pooling together resources from related cloud infrastructures .Although cloud computing has many advantages, security threats can prevent cloud users from making use of them. In , many ofThe authors of  surveyedIn , a blockTo evaluate the effectiveness of different MTD techniques, including shuffle, diversity, redundancy, or combinations of these, we modeled MTD techniques using a graphical security model named the hierarchical attack representation model (HARM). The HARM model is used to evaluate the overall security of the MtD system. It is used to evaluate how the security metric values change when MTD techniques are applied. MtD techniques can be used independently or combined to obtain more effective results. A diversity technique is used to replace the systems’ components  with different components. In comparison, the shuffle technique changes the reachability of the VMs in the cloud. At the same time, redundancy enables replication of the system components.The authors of  studied In addition, the results were applied to the E-health cloud model to evaluate the cost of security against the security measurements. Only OS vulnerabilities were investigated to perform the security analysis. However, for the AML system, we investigated both OS vulnerabilities and co-resident attacks by evaluating the security effect of MtD on each to show the effect of applying MtD on different types of attacks. Moreover, we did not combine more than one MtD as this would have increased the cost of the solution and required more time for its application. However, we applied the best MtD technique for each attack. In ,24, a coMost current research has focused on investigating MtD techniques and combining them to assess the enhancement in security after applying this combination. However, suitable criteria for applying the MtD decision have not been used, rather, evaluation has been based on abitrary judgements.Continuous change in the cloud consumes much power and increases service downtime, which may waste users’ time and increase service costs for users and service providers. In AML, we trigger VM migration decisions based on their risk security level, reflecting the presence of threats. In addition, the migration decision is based on host utilization.For AML, we investigated co-resident side-channel attacks and attacks that target operating system (OS) specific vulnerabilities. The co-resident side-channel attacks only target machines deployed on the same host. The OS attacks affect VMs through a specific attack path that can reach the target machine by exploiting a vulnerability in another VM connected to the target VM. The details of system vulnerabilities leading to the above attacks can be found in the CVE database. The CVE  list is The deployment process starts when a user requests a new hosting for their application with a specific requirement. According to the sensitivity level of the user application shown in The risk calculation module calculates the security measurement values, including the risk value, CVSS and other metrics for all hosts and VMs, as described in The migration sub-module analyzes the results of the risk calculation module and resource-utilization checker and determines the target host with a low-risk level and high utilization capacity. Then, the deployment module sends the results to the cloud sub-module to host the new machine.As described in the deployment process, the migration sub-module receives the results of the risk calculation module and resource utilization checker and compares them with the predetermined threshold values. The security measurement threshold value is determined based on the CVSS severity rating shown in In the event that there are no hosts with a high risk level, the migration sub-module starts to analyze the host utilization levels and selects the host with a resource utilization level lower than a threshold value. The hosts’ utilization threshold value is determined based on the percentage of used resource capacity. We assume that a resource utilization threshold value of 30% can be easily distributed to the rest of the hosts to maximize cloud resource utilization. The VMs deployed on this selected host are considered to be migrated.The migration sub-module will consider the criticality level of the selected VM for migration. The criticality level is assumed to be between one and four, as shown in The proposed system, the adaptive MtD model (AML), proactively mitigates the impact of a known set of attacks that it is challenging to tackle using common defense tools. The AML is a risk-aware model that uses shuffle and diversity MtD techniques to mitigate the impact of different attacks, such as co-residency and attacks that target operating system (OS)-specific vulnerabilities. It applies the MtD by shuffling to the VMs that might be vulnerable to co-residency attacks. Further, the AML applies an MtD strategy based on diversity and shuffle techniques to those exposed to OS attacks.The presented model aims to keep the hosted machines secure while maximizing the hosts’ resource utilization. Consequently, the AML triggers the VMs’ migration decision, relying on the hosts’ risk calculations and resource utilization levels. Moreover, the presented model considers the critical nature of the VMs during the migration process.The proposed system consists of five main modules: a registration module, a blockchain-based anonymity module, a deployment management module, a risk calculation module and, finally, cloud modules, as shown in The user registers to the cloud asking for a new VM/container with certain specifications and provides sufficient metadata regarding their application’s sensitivity and criticality to begin the VM/container deployment process. The registration module receives the user’s request and assigns a public/private key pair to the new user. Then, it sends the users’ requests to the blockchain-based anonymity module to hide their real identities before starting the VM/container deployment process.Blockchain is a fault-tolerant decentralized technology with no single point of failure. Using blockchain with the presented system preserves the privacy of all the hosted VMs’ metadata. After receiving the users’ requests, the blockchain-based anonymity module assigns a pseudonym identification (PID) for each VM deployment request. A pseudonym identification (PID) is a fake name used to conceal the real identity of the VM. Using a PID instead of real identities ensures the privacy of the hosted VMs and of the cloud data.After that, the AML system generates the users’ transactions containing their public keys, PIDs, and the required specifications that fit their applications. Then, the user transactions are signed with their private key. According to the sensitivity level of the user application, the deployment management module decides to deploy the user application on a VM or a container.The real identity of the VMs is known to the deployment module only for managing the overall VM deployment and the migration processes.The deployment management module orchestrates the system interaction process, from receiving the required machine specifications to deploying or migrating the VM/container. Depending on the users’ application, the deployment management module will deploy the application on a VM or a container. Real-time applications are downtime-sensitive applications. Consequently, the deployment module will deploy the application on a container instead of a VM to minimize downtime during migration.The deployment management module consists of two sub-modules: the resource utilization checker and the migration sub-module. The resource utilization checker captures the hosts’ utilization level in each cloud module to ensure tracking of the host resource usage, which helps in the migration decision. The migration sub-module is responsible for the VMs/containers migration decision. It examines and checks all the risk calculations and criticality values of the VMs along with the host resource usage level. It selects the VM that needs to be migrated and the target cloud host based on its analysis after receiving the results from the risk-calculation module and the resource-utilization checker. The VMs detected with high risk and low criticality factor values will be triggered for migration. However, for VMs found with high risk and high criticality factor values, we can consider migrating the neighbours’ VMs with high risk values to minimize the total risk value of the host. The VM to be migrated will be hosted in a cloud host with a low risk value and high resource-usage levels.The migration sub-module then sends the pseudonym ID of the current VM to be migrated to the deployment management module to start the actual deployment/migration process. The deployment module will start communications with the target cloud module to begin the VM deployment process. In the case of VM migration, it first communicates with the source cloud module to start transferring the VM data to the new cloud.The risk-calculation module performs all the security measurement calculations, including risk value, CVSS, attack cost, and return-on-attack (RoA) for all VMs and hosts. These security measurement values are calculated based on knowledge of the exploitability indicators and the impact of existing vulnerabilities in the VM environment. The exploitability values represent the characteristics of the vulnerabilities, whereas the impact values indicate the attackers’ ability to exploit VM vulnerabilities to violate security requirements. The exploitability and the impact values of different vulnerabilities can be found in the CVE databases . The risThe cloud module represents the clouds in the federation. Each cloud in the federation is represented by a cloud sub-module hosting the set of VMs/containers. The cloud module hosts the VMs based on the deployment/migration decisions received from the deployment-management module. Each cloud sub-module is responsible for reserving required resources for launching the VMs/containers and assigning these resources to them. To check the resource availability of every host in the federated cloud, the resource utilization checker captures all the used resources from each cloud sub-module.In this paper, we investigated two types of attacks, co-residency and OS attacks, and their impact on VM operation. In a co-residency attack, the attackers exploit their presence on the same host hosting the victim’s virtual machine and start their search for potential vulnerabilities to exploit. For this attack, we used a shuffle-based strategy MtD to minimize the risk values of the VM and the whole host.OS attacks depend on the vulnerabilities that are exposed within an OS. Attackers track the victim’s VM based on a specific attack path cross-cloud VM allowing attackers to cause damage to the victim VMs. For this attack, we proposed a strategy based on both a shuffle and a diversity MtD minimizing the VM’s risk values.The presented system AML relies on the HARM model  to analyThe attack graph (AG) represents a clear picture of the system risk. It determines if an attacker can reach the final goal state by penetrating the system’s security holes, assuming an initial starting point. For example, if a network consists of two hosts and both have access to the internet, one of the hosts wants to gain access to the other. So, the attacker will try to create a trusted relationship with the target host to gain root access.The attack tree (AT) is an approach to model an information systems’ security vulnerabilities. It analyzes different security threats, identifies different paths to achieve the goal, and builds a tree structure that describes how a threat helps malicious users to reach their goals. For example, if HostB tries to gain root access to HostA, this would be represented by a multi-stage attack tree. The root of the attack tree is the goal of the attacker. To get root access to HostA, the attacker first needs remote access to the system; therefore, this will be at the next level of the attack tree. The final level of the attack tree will consist of the actions, such as a remote login operation .The AML utilizes HARM to capture the connectivities of VMs on the cloud and OS vulnerabilities existing on each VM to perform the security analysis and compute the security metrics. Such security metrics are the cloud risk (Risk), attack cost (AC), base score (CVSS BS) and return-on-attack (RoA) ,29.1Cloud Risk: The risk of each VM is calculated by knowing the values of exploitability Equation .(1)RiskImpact (I) shows the exact result that an attacker can cause due to exploiting its vulnerability. Impact metrics are composed of three sub-metrics: confidentiality, integrity and availability.Exploitability (E) depends on the characteristics of the vulnerability. Exploitability is composed of four main sub-components: attack vector, attack complexity, privileges required and user interaction.In the case of OS attacks, the total risk value on a single VM 2Base Score (CVSS BS): The base score represents the characteristics of a vulnerability that rely on its impact and exploitability, as shown in Equation (Equation . The CVS3Attack Cost (AC): The AC shows the levels of difficulty of attackers in attacking a system. It represents the cost of exploiting a VM in the cloud for an attacker by considering the attacker’s knowledge of vulnerabilities in the VM. It is calculated as below [as below :(3)ACvmIn the case of OS attacks, the total attack cost on each VM 4Return-on-attack (ROA): ROA shows the readiness of the attacker to use the same components, attack paths and vulnerabilities to penetrate the network. The ROA is defined as the ratio of the cloud risk and the attack cost, as shown in Equation (Equation .(4)RoAvThen, the value of the total RoA on a single VM The computational results show the impact of applying an adaptive moving-target defense model (AML) relying on a self- and situation-aware decision-making mechanism to enhance security measurement levels. A Python-based simulation is used to evaluate the effectiveness of the presented approach to enable security-aware and virtual machine consolidation for efficient resource utilization in the federation. The cloud example model in the evaluation results section assumes two clouds working as a federation; the first has three hosts , while the second has two hosts . On these hosts, ten different VMs  are distributed, as shown in To investigate side-channel attacks, we assumed that the CVE-2021-0425 vulnerability  was founEach vulnerability is represented by its impact (I) and exploitability (E) values that depend on the VM environment. These values are constant across the same user environment, but the values vary among the different VMs as each machine is exposed to different external factors from its operational environment. The values of I and E for each VM are shown in First, we calculated the security metrics; the risk, attack cost, CVSS base score and ROA values for each VM and host, as shown in As discussed, the migration decision is based on the CVSS base score threshold value described in The VM with the highest base score value will be selected to be migrated after checking its criticality level. After running all security calculations, VM3 has the highest base score value and the least criticality value. The AML will select the host with minor security metrics to host the migrated VM (VM3). Host1 is found to have the least risk calculation values.The risk values for VM0 and VM9 hosted on Host2 are also affected and decreased because of the VM3 migration from Host2, as illustrated in If the AML system does not find a host with a low risk level to host the migrated VM, it will select the host with a high resource utilization level. The selection of this host depends on the first in-first out approach (FIFO), meaning that the first host found with a low security risk will be selected.There is a trade-off between the host security measurement and the resource utilization values. Although Host1 has a lower CVSS base score value, it has a low utilization value.Consequently, the AML system selects the host that will host the migrated VMs based on a multi-objective optimization problem. The multi-objective optimization problem (MOO) refers to finding a set of optimum solutions, known as the Pareto-optimal front, depending on two or more different objectives.We started by collecting all non-dominated solution sets, which contain all solutions that are not dominated by any other solution. The non-dominated set of solutions is called the Pareto-optimal front.After applying MOO, the selected host will be Host3 instead of Host1, which achieves both objectives by achieving high security measurements and better resource utilization value.We then carried out the same calculation steps to study the impact of OS vulnerability. We assumed that each application is distributed on two machines and that the attack can only come from outside these machines. The application distribution is as follows: VM0 with VM1, VM2 with VM9, VM3 with VM6, VM4 with VM7, and VM5 with VM8.The system starts by calculating all security metrics for all hosts and VMs. For the host exceeding the security metrics threshold, its VMs will be selected for migration. The system will apply OS diversity on VM with the highest base score value. In addition, it will be migrated to another host with lower risk. In this scenario, the migrated VM is VM1 with the highest CVSS base score and will be migrated to Host1. As shown in For the VM migration, we carried out the actual migration of VMs from the OpenStack cloud to OpenNubella. The migration started by taking a snapshot of the migrated machine as an image and then sharing this snapshot with OpenNubella. After that, OpenNubella begins to create a new VM with this image. We carried the migration on a small VM of size 1 GB and it took around three minutes to be operated successfully on the target host.In order not to cause too many downtimes when repeating the migration process randomly, the AML system takes VM migration decisions depending on any external factors from the VM operational environment, leading to different impact or exploitability values. So, the AML system will repeat the security calculations and trigger the migration decision if any VM has exceeded the threshold values.This paper presented an adaptive MtD model (AML), a novel virtual machine mobility framework to enable live cross-cloud migrations of running machines for moving-target defense (MtD). The AML relies on the HARM model for cloud security analysis and evaluation. The AML can potentially enhance the cloud’s resource utilization. The AML enables host load-balancing from the perspective of cloud consolidation, which prevents the hosts from operating with limited resource utilization without increasing the risk level on the VMs. The results indicate that the security evaluation of the system was enhanced after applying different MtD techniques, depending on the exposed vulnerability, while efficiently utilizing the host resources. In future work, we intend to generalize the security model to address cloud attacks to enable trustworthy cloud operations in the presence of advanced persistent threats.