Let G=<V, E> be a simple graph. A subset S of V is a dominating set of G if every vertex in V\S is adjacent to at least a vertex in S. A dominating set S of a graph G is called a secure dominating set if for each v ε V\S, there exists u ε S such that v is adjacent to u and S₁=(S\{u}) ∪ {v} is a dominating set. Further, if the induced subgraph of such dominating set (secure dominating set) S of G is connected, then S is said to be a connected dominating set (secure connected dominating set). The minimum cardinality of such dominating set (connected dominating set, secure connected dominating set) of G is called the domination number (connected domination number, secure connected domination number) of G and is denoted by γ(G)( γ_c (G),γ_sc (G)). Let C(n, 1) be a Cycle graph with one chord. By a graph G=<V, E> we mean a finite, undirected graph without loops (or) multiple edges. For graph terminology [1,2]. The domination in graph has been introduced by O. Ore [3] in 1962, the protection of graph was introduced by E. J. Cockayne et al. [4], the connected domination in graph was introduced by Sampathkumar et al. [5] in 1979 and the secure connected domination in graph was introduced by Amerkhan et al. [6] in 2014. Dominating sets in a graph provides applications both in the position (or location) and the protection strategies.

Let C_n:{v₁, v₂,…, v_n} be any cycle of order n and v₁ be apex, by adding a new edge (chord) v₁ v_i ∉ E(C_n) for 3 ≤ i ≤ n–1 is called a cycle with a chord and is denoted by C(n, 1). Observe that, there are n–3 such possibilities of chords. Note that, C(n, 1) with a chord v₁ v_i is isomorphic to C(n, 1) with a chord v₁ v_(n–1). Hence, we have ⌈(n−3)/2⌉ non-isomorphic graph possibilities in C(n, 1). Therefore, finding the above domination parameters for a cycle with one chord is dynamic in nature [7].

In this research, a graph theory based approach is used to centre the security preserving context of events generated by the honeypots [8]. These events are considered to be the breaking down components of total observables in the centralised utilities like Security Information and Event monitoring. This helps in accounting the whole security events from the past and present data. Further, it also helps to preserve and visualize the relationship across all of the data elements. Finally a classification model is applied to surface the informative relationships [9].

Ransomware is a kind of malware which is designed to compromise the victim’s system and blackmailing the victim for ransom. The most common known types of ransomwares are screen lockers and encryptors. Screen lockers, as the name implies block access to the system data with lock screen. Encryptors are type of ransomware which can encrypt the data and replicating themselves. Encryptors are used to threaten victim’s data. The content cannot view without decryption key. A ransomware is noxious program, which encodes the casualty report and limit casualties from getting to their own framework with the exception of if a measure of ransomware is paid. Amounts of ransomwares which are available working at a benefit publicize are not exactly equivalent to one another. Regardless, these varieties utilize an external relationship for getting the best approach to begin encryption measure. Thus recognizing and separating the ransomware correspondence can prevent the presentation of encryption measure [10]. To resolve this issue, this work proposes an original traffic assessment model. This proposed scheme uses an intelligent parcel examination plot using gathering of classifiers for ransomware traffic course of action. The introduction of the proposed system is penniless down using a safe testbed. In this investigation, we show how ransomware multiplies and defiles the devices. Through this, live traffic request of ransomware has been critically inspected. Further, the clever methodology has acquainted with bunch the ransomware traffic by using significant learning procedures. Considering request, acknowledgment of ransomware is moved nearer with the traits of the framework traffic and its exchanges. A honeypot makes distinguishing pernicious traffic dead basic. That is on the grounds that any traffic to a honeypot, after some underlying speedy blocking to preclude bogus up-sides, is dubious. A honeypot is a phony PC resource that exists possibly to alarm its proprietor in case it is contacted. No one ought to be contacting it or endeavoring to sign on. Since all movement is ill-conceived, no investigation is expected to tell great traffic from awful. Honeypots are a kind of trickiness innovation that permits you to comprehend assailant personal conduct standards. Security groups can utilize honeypots to explore network safety breaks to gather intel on how cybercriminals work. They likewise diminish the danger of bogus up-sides, when contrasted with conventional network safety measures, since they are probably not going to draw in real action.

An interruption avoidance framework (IPS), involving a firewall additionally an IDS, can assess the traffic and square pernicious information. It goes about as a safeguard against assaults, however it can’t recognize if an application-layer demand is ordinary. This drawback might actually bring about assaults pervading the safeguard without being distinguished, e.g., a social designing aggressor may acquire touchy data by utilizing a compromised real username and secret phrase. In the event that an IPS coordinates with a honeypot, the entire framework would then be able to catch all assaulting exercises regardless of whether they are performed by inside or outside adversaries. Additionally, the information caught by honeypots can be utilized to make countermeasures, e.g., the mechanized interruption reaction frameworks frequently utilizes honeypots as the information catch framework. Honeypots are regularly used to research as of now obscure assaults. The Black hat people group is adequately canny to make new-obscure dangers. A decent method to examine new dangers is to catch the malevolent action bit by bit as it compromises a framework. Honeypots in this way can increase the value of research by giving a conciliatory framework to be assaulted.

Zaki et al. 2016. proposed the model to diagnosis the head and neck cancer by cloud service image processing. Authors use the Graphics processing Unit (GPU) acceleration technic with the combination of computed tomography with cone-beam (CBCT) to extracting the significant information from the image and registered that information in cloud environment. From that information doctors diagnosis patients by radiation therapy. This model reduces the complexity of the early diagnosis. Baliga et al. 2011 proposed the model to improve the performance of the cloud computing power consumption. The author describes the energy consumption of the network based cloud infrastructure, how the conventional cloud services to overcome the existing cloud drawbacks [11]. This model balances the energy consumption especially for personal computer cloud services. Taleb et al. 2017 [12] analyze the implementation of the 5G technology in the cloud computing environment. The authors examine the multi-access computing with edge 5G network infrastructure to provide the reliable service to mobile user to store the resource in the cloud and explain the various challenges in the implementation.

Mershad et al. 2017 analyse the performance of cloud data-center services. The authors describe the previous system model and examine cloud structure based on the usage of memory, network interface and CPU performance [13]. Yan et al. 2016 proposed the cost efficient method to archive the scalable cloud environment. Authors create a model to ensure the utilization of the cloud deployment and improve the migration of the cloud resource to another vendor at low cost [14]. They use aliyun’s cloud computing service for testing and implementation purpose. Manikandan et al. 2021 [15] proposed the model to improve the cloud gaming service performance. The authors create a model with Ad-hoc network to provide the quality of services to the gamers. They use cloud environment for large storage and high performance gaming environments. A. T. Lo’ai et al. [16] proposed the model for improve the healthcare application. The authors use the mobile computing technology with big data analysis model improves the performance of the healthcare field. They use cloud based environment to store the resource and access them is efficient time to diagnosis the patients and improve immunity of the patients.

Chiang et al. 2015 [17] proposed the algorithm to improve the cost efficiency in cloud services. The authors use the green cloud algorithm to demonstrate proposed model and improve the N-policy of the cloud environment. The results ensure the performance and power saving polices in the cloud environment. Neelakandan proposed the model to optimise the cloud environment by customer requirements. Authors use the multi-server environment cloud environment for testing and implementation of the model [18]. This model algorithm uses the customer feedbacks to improve the cloud infrastructure and also improves the energy consumption, service agreement and maximizes the profit. Subramani et al. proposed the scheduling approach for hybrid clouds. The authors use the model for bag of tasks on clouds to process the resources in the scheduling manner [19]. This model improves the performance, integrity of the cloud and also reduces the complexity in the algorithm implementation.

B. Li et al. [20] proposed the model to deceptive attacks in the honeypot based IoT attacks. Authors use the Bayesian algorithm to analysis the threshold accuracy in deceptive action in the system. It reduce the attacker’s success rate. Jain et al. presented survey on the anatomic view of investigate honeypot system. They analysis both novel decoy and captor to validate the taxonomy and predict the honeypot trends [21]. Neelakandan et al. proposed the ransomware detection model using the machine learning algorithms. The authors describe the various ransomware detection technics and study the machine learning algorithm to reduce the probability of network intrusion detection [22]. They use bitflow method to reduce the data packet size and transfer ratio. Moore proposed the ransomware detection model using the honeypot techniques. They authors analysis the honeypot folder if its monitors the changes, it helps the accuracy of detection changes in the network [23]. Almashhadani et al. proposed the ransomware model to detect the network based crypto ransomware. The authors describe the network based activities in the crypto ransomware and build a test bed model to detect the ransom malware in the network [24]. The proposed model analysis the network packet flow rates and evaluate the system detection rate.

Petri et al. proposed the classification method for data mining technics. The authors use the data mining clustering algorithms to classify the remotely sensed imaged data. This model clustering the sensed image into 6 part [25]. Kamalraj et al. presented the Artificial Neural Networks (ANN) model to predict the student performance from the student profile. They trained the algorithm to cross validate the classified data set of the student profile [26]. Bahrami et al. presented the medical data stream distribution pattern for the rule mining algorithm. The authors use the traditional data mining methods to classify the medical data sets in the association rule manner. They also use density estimation method to predict the data set accuracy [27].

Bansal et al. proposed the model to predict the decision of the student enrolment in subject wise. They use the advance data mining method to predict the student growth in academic success radio. This model also uses the decision tree and support vector system to reduce the dropout rate of the data [28]. Ravichandran. proposed the knowledge system to mining the student data in educational institution. They use the knowledge graph education method to automate the knowledge training for data [29]. These models improve the precision average of the data set.

Zhang et al. Proposed the model to improve the cloud environment cost efficient and more reliable to computing the resource. They handle the service agreement issues in the cloud and improve the cost based parameters in terms of reliability and security [30]. The solution to manage the large amount of resource in the cloud services. They introduce the cloud based system called credit unit cloud model (cucloud) to avoid resource center mechanism and improve the store approach effectively. This model configuration supports for both organization/group and individual purpose. It consists of various components handle the various operations in the cloud environment. Bahrami et al. analysis the reliability and utilization of the cloud based system. The authors describe the cloud processing and issues faced to setup cloud environment. They handle basic issues in the cloud setup and give solution to avoid or overcome those issues in the cloud computing [31–33].

(1) Theorem 1:γ[C(n,1)]=  {⌈n3⌉,    i≡1(mod 3)⌈n−13⌉,   otherwise

Proof: C(n, 1) is a cycle graph with one chord. Let V[C(n, 1)] = {v₁, v₂, …, v_n} with v₁ as apex and v₁v_i be the chord  3≤i≤n−1 . We observe that, there are vertex disjoint subgraphs such as a Cycle C_i and a Path P_n−i in C(n, 1) as Illustrated in the graph below:

Let V(C_i) = {v₁, v₂, …, v_i} and V(P_n−i) = {v_i+1, v_i+2, …, v_n}. It is clear that, V(C(n,1))=V(Ci)∪⁡V(Pn−i) . We know that, in C_i, a vertex v_j:1 ≤ j ≤ i is in any one of the minimum dominating sets of C_i. Without loss of generality, let v₁ ∈ S, where S is one of the minimum dominating sets of C_i. We know that, γ[Cn]=⌈n3⌉, n≥3 and γ[Pn]=⌈n3⌉, n≥2 from [4].

Case (i) : i≡0,2(mod 3).

Clearly, γ[Ci]=⌈i3⌉ . Without loss of generality, v1∈S, where S is the minimum dominating set. Here, v₁ dominates  vn . Hence, minimum dominating set of C(n, 1) is the union of the dominating set of C_i and the dominating set of  Pn−i−1 .

when i≡0(mod 3), let i = 3t, t ∈ Z, then

(2) γ[C(n,1)]=γ[Ci]+γ[Pn−i−1]=⌈i3⌉+⌈n−i−13⌉=⌈3t3⌉+⌈n−13−3t3⌉=t+⌈n−13⌉−t =⌈n−13⌉

when i≡2(mod 3), let i = 3t + 2, t ∈ Z, then

(3)  γ[C(n,1)]=γ[Ci]+γ[Pn−i−1]=⌈i3⌉+⌈n−i−33⌉=⌈3t+23⌉+⌈n−3t−2−13⌉=⌈3t3+23⌉+⌈n−13−(3t+2)3⌉=⌈t+23⌉+⌈n−13−3t3−23⌉=t+1+⌈n−13⌉−t−1=⌈n−13⌉

Case (ii): i≡1(mod 3).

Since i≡1(mod 3) , let {v₁, v_i} ∈ S. Here, v₁v_n ∈ E(C(n, 1)), Also, v₁ dominates v_n and v_iv_i+1 ∈ E(C(n, 1)), vi dominates vi+1. Hence, minimum dominating set of C(n, 1) is the union of the dominating set of C_i and the dominating set of P_n−i−2.

When i≡1(mod 3), let i = 3t + 1, t ∈ Z, then

(4) γ[C(n,1)]=γ[Ci]+γ[Pn−i−2]=⌈i3⌉+⌈n−i−23⌉=⌈3t+13⌉+⌈n−(3t+1)−23⌉=⌈3t3+13⌉+⌈n3−3t3−33⌉=⌈t+13⌉+⌈n3−t−1⌉=t+1+⌈n3⌉−t−1=⌈n3⌉.

(5) Therefore,γ[C(n,1)]={⌈n3⌉,i≡1(mod 3)⌈n−13⌉,otherwise

(6) Theorem 2: γc[C(n,1)]={n−3,ifC3isasubgraphofC(n,1)n−4,otherwise

Proof: Let C(n, 1) be any Cycle with a chord where v₁ is the apex and v₁v_i is the chord such that 3 ≤ i ≤ n − 1. From [5], we have γ_c(P_n) = n − 2, for all n ≥ 3 and γ_c(P_n) = n − 2, for all n ≥ 3. We observe that, a Cycle with a chord will yield a non-empty vertex disjoint of a Cycle (C_i) and a Path (P_n−i) as in Fig. 1.

The Cycle  Ci:[v1,v2,…,vi] and P_n−i:[v_i+1, v_i+2, …, v_n] are vertex disjoint graphs such that V(Ci)∪⁡V(Pn−i)=V[C(n,1)] . Let S be the required connected dominating set for the graph C(n, 1).

Case (i) : C₃ is a subgraph of C(n, 1).

Without loss of generality, let v₁ ∈ S. Hence, v₁ dominates v₁, v₃ and v_n. By γ_c[P_n−4] = n − 6, with {v₅, v₆, …, v_n−2} as a minimum connected dominating set of P_n−4. However, the set {v1}∪⁡{v5,v6,…,vn−2} is not a connected dominating set of C(n, 1). Hence, we get S={v1}∪⁡{v5,v6,…,vn−2}∪⁡{vn−1,vn} (or) S={v1}∪⁡{v3,v4}∪⁡{v5,…,vn−2} is a minimum connected dominating set for C(n, 1).

Case (ii) : C₃ is not a subgraph of C(n, 1).

Here, v₁v_i is the chord of C(n, 1) where i ∈ {4, …, n − 2}. By γ_c(C_i) = i − 2, without loss of generality, let {v1}∪⁡{v4,v5,…,vi} be the minimum connected dominating set for C_i. Here, v₁ dominates v₂, v_n and v_i dominates v_i−1, v_i+1. Hence, by γ_c(P_n−i−2) = n − i − 4, without loss of generality, {v_i+3, v_i+4, …, v_n−2} be the minimum connected dominating set for P_n−i−2. However, the set {v1}∪⁡{v4,v5,…,vi}∪⁡{vi+3,vi+4,…,vn−2} is not a minimum connected dominating set of C(n, 1). Hence, the set S={v1}∪⁡{v4,v5,…,vi}∪⁡{vi+1,vi+2}∪⁡{vi+3,…,vn−2} (or) S={v1}∪⁡{v4,v5,…,vi}∪⁡{vi+3,…,vn−2}∪⁡{vn−1,vn} is a minimum connected dominating set for C(n, 1). Hence, γ_c[C(n, 1)] = n − 4, whenever C₃ is not a subgraph of C(n, 1).

(7) Therefore,γc[C(n,1)]={n−3,ifC3isasubgraphofC(n,1)n−4,otherwise

(8) Theorem3:γsc[C(n,1)]={n−3,ifC3isasubgraphofC(n,1)n−4,otherwise

Proof: Let C(n, 1) be any Cycle with a chord where v₁ is the apex and v₁v_i is the chord such that 3 ≤ i ≤ n − 1. From [6], we have, γ_sc(P_n) = n, for all n ≥ 3 and γ_sc(C_n) = n − 1, for all n ≥ 4. We observe that, a Cycle of order n with a chord will yield two subcycles of order n₁ and n₂ such that Cn1: v1,v2,…,vi and Cn2: v1,vi,…,vn→n=n1+n2−2 . Let S₁ and S₂ be the secure connected dominating set for Cn1 and Cn2 respectively. And, S be the required secure connected dominating set of C(n, 1). We know that, γ_sc(C_n) = n − 1, for all n ≥ 4. Without loss of generality, let v₁ ∈ S₁ and S₂ also v₂ ∈ S₁ and S₂. Therefore, S=S1∪⁡S2 . Here, |S|=|S1|+|S2|−2 → |S|=n−2 .

Claim: S is the minimum secure dominating set of C(n, 1).

Without loss of generality, let S = {v₁, v₃, …, v_i, v_i+1, …, v_n−1}. By previous theorem, we know that, γ_c(C(n, 1)) is at most n − 3. We get, γ_sc(C(n, 1)) ≥ n − 3. Suppose if, γ_sc(C(n, 1)) = n − 3, then V(C(n,1))∖S={v2,vj,vn} , where j:3, 4, …, i − 1, i + 1, …, n − 1. Here, if v_j is adjacent to v₂ (or) v_n, then secure domination fails. If not, then connectedness fails. This is a contradiction to our assumption. And so, γ_sc(C(n, 1)) ≠ n − 3.

Therefore, γ_sc(C(n, 1)) = n − 2, for all n ≥ 5

The proposed the IoT based hybrid honeypot system is used to monitor the malicious activity in the system. The proposed system clustering into three honeypot modules, first module is detecting the medium to high interaction in honeypot. Second is high interactive honeypot which can analysis the real services in the network. Finally last one is hybrid module to simulating the interaction in the system with real time devices [34–36]. Last part is also protecting the most exposed layer in the honeypot is Simple Object Access Protocol (SOAP) [37–39]. This module analysis the vulnerabilities of the protocol and detect the malicious activity. This module can deployed in independent way to connect the nodes with centralized control centres to transfer the collected data from different honeypot devices with secured manner. This can be moved to DOCKER framework easy deployment and simulations [40].

The self learning honeypots have been deployed and collected the results and traces have been monitored with time events and the differentiation between normal traffic and attack traffic has clearly stated with Figs. 10–12. The resultant graphs have been generated with continuous time frame event which consists of five minutes interval in between them. Through Tabs. 1–3 shows the detection of packets which flows in a particular time event. The difference between the time frame and packet flow is calculated. It clearly indicates that abnormal traffic can be detected through our graph based self learning honeypot.

The honeypots are mostly used in cyber defence strategies, especially in reconnaissance for finding the information about the attacker. The honeypots deployed for this work is under the environment of honeynet system, so the entire applications are controlled by this honeynet system including self learning honeypots. In this paper, the proposed self learning honeypot which is completely based on graph theorems, the strategies employed for this self learning honeypot is routed from connected dominating set graphs, theorems are proposed results γ(C(n,1)), γc(C(n,1)), γsc(C(n,1)) solely for honeypot discovery. Self Learning honeypot is setup with honeynet systems which has behaviour understanding and model analysis with reluctant priority based application. It is evident from the obtained results over the figures and tables our proposed graph theory based algorithm detects the attack traffic and its pattern with the detection accuracy of 98.2%.