Moving Target Defense Research Articles

Evaluating the effectiveness of shuffle and redundancy MTD techniques in the cloud

Moving Target Defense (MTD) is a defensive strategy to thwart adversaries by continuously shifting the attack surface. The MTD techniques can be applied to the cloud computing to make the cloud more unpredictable, hence more difficult to exploit. There are many MTD techniques proposed, and various metrics are used to measure their effectiveness. However, it is difficult to assess when MTD techniques are used in combinations. In this paper, we propose a formal security assessment approach to evaluate the effectiveness of combined MTD techniques using security modeling. We use security metrics, such as System Risk and Reliability, to evaluate those MTD techniques. In particular, we investigate how the security of the cloud change when two categories of MTD techniques, Shuffle and Redundancy, are used in combinations. We also explore approaches to find important components in the cloud using Network Centrality Measures and the size of the cloud and evaluate the trade-off between security and dependability in terms of the system Risk and Reliability, respectively. We show that combining the shuffle and redundancy MTD techniques could enhance the security of the cloud with the trade-off between the Risk and Reliability, which can be managed using the proposed security assessment approach.

A Hybrid Cyber Defense Mechanism to Mitigate the Persistent Scan and Foothold Attack

As the prerequisite for the attacker to invade the target network, Persistent Scan and Foothold Attack (PSFA) is becoming progressively more subtle and complex. Even worse, the static and predictable characteristics of traditional systems provide an asymmetric advantage for attackers in launching the PSFA. To reverse this asymmetric advantage and resist the PSFA, two new defense ideas, called moving target defense (MTD) and deception-based cyber defense (DCD), have been suggested to provide the proactive selectable measures to complement traditional defense. However, MTD is unable to defeat the sophisticated attacker with fingerprint tracking ability. Meanwhile, DCD is easy to be marked by the attacker, which will result in a great waste of defense resources and poor defense effectiveness. To address this shortcoming, we propose the hybrid cyber defense mechanism that combines the address mutation (belonging to MTD) and fingerprint camouflage (belonging to DCD) strategies. More specifically, we first introduce and formalize the attacker model of PSFA based on the cyber kill chain. Afterwards, the traffic direction technology is designed to realize the coordination between the strategy of address mutation and the strategy of fingerprint camouflage. Furthermore, we construct the fine-grained quantitative modeling of the attacker’s behaviors through an in-depth observation of actual network confrontation. Based on this, a dynamic defense strategy generation algorithm is presented to maximize the effectiveness of our hybrid mechanism. Finally, the experimental results show that our hybrid mechanism can greatly improve the time required for a successful attack and achieve a better defense effect than the single strategy.

DES Based Dynamic Encryption Scheme for Moving Target Defense in Network

DES Based Dynamic Encryption Scheme for Moving Target Defense in Network

An adaptive defense mechanism to prevent advanced persistent threats

The expansion of information technology infrastructure is encountered with Advanced Persistent Threats (APTs), which can launch data destruction, disclosure, modification, and/or Denial of Service attacks by drawing upon vulnerabilities of software and hardware. Moving Target Defense (MTD) is a promising risk mitigation technique that replies to APTs via implementing randomisation and dynamic strategies on compromised assets. However, some MTD techniques adopt the blind random mutation, which causes greater performance overhead and worse defense utility. In this paper, we formulate the cyber-attack and defense as a dynamic partially observable Markov process based on dynamic Bayesian inference. Then we develop an Inference-Based Adaptive Attack Tolerance (IBAAT) system , which includes two stages. In the first stage, a forward–backward algorithm with a time window is employed to perform a security risk assessment. To select the defense strategy, in the second stage, the attack and defense process is modelled as a two-player general-sum Markov game and the optimal defense strategy is acquired by quantitative analysis based on the first stage. The evaluation shows that the proposed algorithm has about 10% security utility improvement compared to the state-of-the-art.

Defending Hardware-Based Malware Detectors Against Adversarial Attacks

In the era of Internet of Things (IoT), Malware has been proliferating exponentially over the past decade. Traditional anti-virus software are ineffective against modern complex Malware. In order to address this challenge, researchers have proposed hardware-assisted Malware detection (HMD) using hardware performance counters (HPCs). The HPCs are used to train a set of machine learning (ML) classifiers, which in turn, are used to distinguish benign programs from Malware. Recently, adversarial attacks have been designed by introducing perturbations in the HPC traces using an adversarial sample predictor to misclassify a program for specific HPCs. These attacks are designed with the basic assumption that the attacker is aware of the HPCs being used to detect Malware. Since modern processors consist of hundreds of HPCs, restricting to only a few of them for Malware detection aids the attacker. In this article, we propose a moving target defense (MTD) for this adversarial attack by designing multiple ML classifiers trained on different sets of HPCs. The MTD randomly selects a classifier; thus, confusing the attacker about the HPCs or the number of classifiers applied. We have developed an analytical model which proves that the probability of an attacker to guess the perfect HPC-classifier combination for MTD is extremely low (in the range of $10^{-1864}$ for a system with 20 HPCs). Our experimental results prove that the proposed defense is able to improve the classification accuracy of HPC traces that have been modified through an adversarial sample generator by up to 31.5%, for a near perfect (99.4%) restoration of the original accuracy.

Attack Graph-Based Moving Target Defense in Software-Defined Networks

Moving target defense (MTD) has emerged as a proactive defense mechanism aiming to thwart a potential attacker. The key underlying idea of MTD is to increase uncertainty and confusion for attackers by changing the attack surface (i.e., system or network configurations) that can invalidate the intelligence collected by the attackers and interrupt attack execution; ultimately leading to attack failure. Recently, the significant advance of software-defined networking (SDN) technology has enabled several complex system operations to be highly flexible and robust; particularly in terms of programmability and controllability with the help of SDN controllers. Accordingly, many security operations have utilized this capability to be optimally deployed in a complex network using the SDN functionalities. In this paper, by leveraging the advanced SDN technology, we developed an attack graph-based MTD technique that shuffles a host’s network configurations (e.g., MAC/IP/port addresses) based on its criticality, which is highly exploitable by attackers when the host is on the attack path(s). To this end, we developed a hierarchical attack graph model that provides a network’s vulnerability and network topology, which can be utilized for the MTD shuffling decisions in selecting highly exploitable hosts in a given network, and determining the frequency of shuffling the hosts’ network configurations. The MTD shuffling with a high priority on more exploitable, critical hosts contributes to providing adaptive, proactive, and affordable defense services aiming to minimize attack success probability with minimum MTD cost. We validated the out performance of the proposed MTD in attack success probability and MTD cost via both simulation and real SDN testbed experiments.

Stealthy MTD Against Unsupervised Learning-Based Blind FDI Attacks in Power Systems

This paper examines how moving target defenses (MTD) implemented in power systems can be countered by unsupervised learning-based false data injection (FDI) attack and how MTD can be combined with physical watermarking to enhance the system resilience. A novel intelligent attack, which incorporates dimensionality reduction and density-based spatial clustering, is developed and shown to be effective in maintaining stealth in the presence of traditional MTD strategies. In resisting this new type of attack, a novel implementation of MTD combining with physical watermarking is proposed by adding Gaussian watermark into physical plant parameters to drive detection of traditional and intelligent FDI attacks, while remaining hidden to the attackers and limiting the impact on system operation and stability.

Dynamic Security Metrics for Software-Defined Network-based Moving Target Defense

We propose a suite of dynamic security metrics that timely, dynamically, and adaptively assess the effectiveness of the software-defined network (SDN)-based moving target defense (MTD) techniques. The security metrics are developed to measure the dynamics of a network and a host state's information (e.g., IP address, port, software stacks, vulnerabilities, or network topology) introduced by various types of MTD techniques shuffling them. The key aspect of our proposed metrics is to capture variability that keeps track of changing patterns of the network and the host states upon every MTD triggering event. In this work, we propose the following security metrics capturing the variability based on the changes made by the MTD: (1) Network and host address-based metrics measuring variability of the network and host addresses based on a degree of uncertainty and unpredictability on the assigned IP address to the hosts in a network; (2) Attack path-based metrics measuring variability of attack paths using graphical models estimated based on the network state transitions from one topology to another topology upon triggering a network topology and/or IP shuffling MTD; and (3) Attack stage-based success metrics measuring the chances of discovering a vulnerable target host's information, exploiting the target host's vulnerability, and compromising the target host. Via extensive simulation study, we investigated the key parameters that can significantly affect the MTD performance based on the proposed security metrics. Our simulation results show that the metrics are viable to measure the effectiveness of deploying the MTD techniques.

A schedule randomization policy to mitigate timing attacks in WirelessHART networks

Industrial control systems consist of large-scale wireless sensor-actuator networks (WSAN) that control the physical plant. The communications between the sensors and the actuators need to be reliable and guaranteed within strict deadlines for safe operation of all the system components in industrial setups. WirelessHART is the most suitable and widely adopted WSAN standard that serves as the medium of communication in industries. To satisfy deadlines of real-time flows in WirelessHART networks, the centralized network manager decides the communication schedule during network initialization. The same schedule repeats every hyperperiod. The repetitive nature of the communication slots over every hyperperiod makes the system vulnerable to timing attacks which can eventually disrupt the safety of the system. To mitigate such attacks, we propose SlotSwapper, a moving target defense mechanism that randomizes the communication slots over a hyperperiod schedule without violating the feasibility constraints of real-time flows in WirelessHART networks. We show that SlotSwapper is optimal for single-channel WirelessHART network with real-time harmonic flows. We extensively evaluated our algorithm with $$\varvec{4800}$$ flow sets over $$\varvec{100}$$ Tmote sky motes in Cooja simulator. We use Prediction Probability of slots of a schedule to measure the security provided by SlotSwapper. We use Kullback–Leibler divergence to measure the divergence of our solution w.r.t. a truly random solution.

A Moving Target Defense for Securing Cyber-Physical Systems

This article considers the design and analysis of multiple moving target defenses for recognizing and isolating attacks on cyber-physical systems. We consider attackers who perform integrity attacks on a set of sensors and actuators in a control system. In such cases, a model aware adversary can carefully design attack vectors to bypass bad data detection and identification filters while causing damage to the control system. To counter such an attacker, we propose the moving target defense which introduces stochastic, time-varying parameters in the control system. The underlying random dynamics of the system limit an attacker's model knowledge and inhibits his/her ability to construct stealthy attack sequences. Moreover, the time-varying nature of the dynamics thwarts adaptive adversaries. We explore three main designs. First, we consider a hybrid system where parameters within the existing plant are switched among multiple modes. We demonstrate how such an approach can enable both the detection and identification of malicious nodes. Next, we investigate the addition of an extended system with dynamics that are coupled to the original plant but do not affect system performance. An attack on the original system will affect the authenticating subsystem and in turn be revealed by a set of sensors measuring the extended plant. Lastly, we propose the use of sensor nonlinearities to enhance the effectiveness of the moving target defense. The nonlinear dynamics act to conceal normal operational behavior from an attacker who has tampered with the system state, further hindering an attacker's ability to glean information about the time-varying dynamics. In all cases mechanisms for analysis and design are proposed. Finally, we analyze attack detectability for each moving target defense by investigating expected lower bounds on the detection statistic. Our contributions are tested via simulation.

Assessing DER network cybersecurity defences in a power‐communication co‐simulation environment

Increasing penetrations of interoperable distributed energy resources (DER) in the electric power system are expanding the power system attack surface. Maloperation or malicious control of DER equipment can now cause substantial disturbances to grid operations. Fortunately, many options exist to defend and limit adversary impact on these newly-created DER communication networks, which typically traverse the public internet. However, implementing these security features will increase communication latency, thereby adversely impacting real-time DER grid support service effectiveness. In this work, a collection of software tools called SCEPTRE was used to create a co-simulation environment where SunSpec-compliant photovoltaic inverters were deployed as virtual machines and interconnected to simulated communication network equipment. Network segmentation, encryption, and moving target defence security features were deployed on the control network to evaluate their influence on cybersecurity metrics and power system performance. The results indicated that adding these security features did not impact DER-based grid control systems but improved the cybersecurity posture of the network when implemented appropriately.

A Client Bootstrapping Protocol for DoS Attack Mitigation on Entry Point Services in the Cloud

This paper presents a client bootstrapping protocol for proxy-based moving target defense system for the cloud. The protocol establishes the identity of prospective clients who intend to connect to web services behind obscure proxy servers in a cloud-based network. In client bootstrapping, a set of initial line of defense services receive new client requests, execute an algorithm to assign them to a proxy server, and reply back with the address of the chosen proxy server. The bootstrapping protocol only reveals one proxy address to each client, maintaining the obscurity of the addresses for other proxy servers. Hiding the addresses of proxy servers aims to lower the likelihood that a proxy server becomes the victim of a denial-of-service (DoS) attack. Existing works address this problem by requiring the solution of computationally intensive puzzles from prospective clients. This solution slows the progression of attacks as well as new clients. This paper presents an alternative idea by observing that limited capacity of handling initial network requests is the primary cause of denial-of-service attacks. Thus, the suggested alternative is to utilize cost-effective high-capacity networks to handle client bootstrapping, thus thwarting attacks on the initial line of defense. The prototype implementation of the protocol using Google’s firebase demonstrates the proof of concept for web services that receive network requests from clients on mobile devices.

Cost-effective moving target defense against DDoS attacks using trilateral game and multi-objective Markov decision processes

Moving Target Defense (MTD) has emerged as a game changer to reverse the asymmetric situation between attackers and defenders, and as one of the most effective countermeasures to mitigate DDoS attacks, shuffling-based MTD has gained ever-growing attention in cyber security. Despite the increased security, frequent shuffles would significantly bring heavy burden to the system. Moreover, most existing work has not adequately considered the impact of MTD techniques on the defender, and especially ignored that on legitimate users. Due to the lack of cost-effective shuffling methods, it is difficult to reach the optimal balance between the performance and overhead associated with the MTD deployment. Building on our preliminary work in this field, we propose a novel cost-effective shuffling method, which involves common users as a trilateral game for strategy generation and resists DDoS attacks with several MTD mechanisms. The novel game model extends our previous work to further describe the interaction among the attacker, the defender and users in detail, and we exploit Multi-Objective Markov Decision Processes to find the optimal MTD strategy by solving the trade-off problem between the effectiveness and cost of shuffling. By designing a trilateral game cost-effective shuffling algorithm, we capture the best MTD strategy and reach a balance between them in a given shuffling scenario. Simulation and experiments on an experimental software-defined network (SDN) indicate that our approach can effectively mitigate DDoS attacks with an acceptable overload, and exhibit better performance than other related and state of the art approaches.

Cost-Benefit Analysis of Moving-Target Defense in Power Grids

We study moving-target defense (MTD) that actively perturbs transmission line reactances to thwart stealthy false data injection (FDI) attacks against state estimation in a power grid. Prior work on this topic lacks an analysis of the relationship between MTD's effectiveness (in detecting FDI attacks) and the associated cost of the perturbations (incurred by the grid operator). To address the issue, we present formal design criteria to select MTD reactance perturbations that are truly effective. Based on a key optimal power flow (OPF) formulation, we find that the effective MTD may incur a non-trivial operational cost. We show that MTD's detection capability and the associated cost depend on the separation between the column spaces of measurement matrices before and after the MTD perturbation. We use the metric of smallest principal angles between the subspaces to characterize the separation. We show that different degrees of the separation provide a spectrum of tradeoffs between the MTD's detection capability and its cost. Furthermore, we present closed-form expressions in the case of a two-bus system to illustrate the tradeoffs. While our analysis is primarily based on a direct current (dc) power flow model, we show that the perturbations designed using this model are also effective in detecting FDI attacks against ac power flows. Similarly, the cost-benefit tradeoff still holds under the ac power model. Extensive simulations, using the MATPOWER simulator and benchmark IEEE bus systems, verify and illustrate the proposed design approach that for the first time addresses both key aspects of cost and effectiveness of the MTD.

MTD to set network slice security as a KPI

Key Performance Indicators (KPIs) are a higher‐level characterization of the performance of a network slice, meant to be assessable at any time. Bodies such as the GSM Alliance have proposed the use of KPIs, including, but not limited to, latency, throughput, power consumption, and security. However, while latency, throughput, and power consumption are mensurable universally, security is much harder to measure. In this article, we propose using a Moving Target Defense (MTD) approach and measurable network properties to establish a new straightforward network security metric for underlying resilience against network‐centric attacks. We called it DynSec, a comprehensive model for basic network security within the network slice. Monte Carlo experimentation showed that DynSec is accurate and suitable as a KPI.

On-Off Adversarially Robust Q-Learning

This letter, presents an “on-off” learning-based scheme to expand the attacker's surface, namely a moving target defense (MTD) framework, while optimally stabilizing an unknown system. We leverage Q-learning to learn optimal strategies with “on-off” actuation to promote unpredictability of the learned behavior against physically plausible attacks. We provide rigorous, theoretical guarantees on the stability of the equilibrium point even when switching. Finally, we develop two adversarial threat models to evaluate the learning agent's ability to generate robust policies based on a distance to uncontrollability.

CANeleon: Protecting CAN Bus With Frame ID Chameleon

The Controller Area Network (CAN) has been widely used in the automotive and industrial automation for over two decades. However, due to the lack of security mechanisms, CAN is vulnerable to attacks. In this paper, we propose a novel protection scheme called CANeleon . It can defend CAN against a smart attacker who might inject malicious frames with legitimate frame IDs, which cannot be mitigated by existing countermeasures. Inspired by the idea of moving target defense technologies, CANeleon equips each legitimate CAN node with the ability to shift the spoofed frame ID. In this way, the IDs of malicious frames are exposed and can be further filtered by legitimate nodes. Moreover, CANeleon neither inserts new information to the frame, nor requires any modification to the CAN protocol, so it is in compliance with the existing standards. CANeleon is a decentralized mechanism guaranteeing that the protection could be done simultaneously without additional communication. Experiments on a CAN bus prototype and a real self-driving vehicle prove the effectiveness of CANeleon .

Optimal Timing Selection Approach to Moving Target Defense: A FlipIt Attack-Defense Game Model

The centralized control characteristics of software-defined networks (SDNs) make them susceptible to advanced persistent threats (APTs). Moving target defense, as an effective defense means, is constantly developing. It is difficult to effectively characterize an MTD attack and defense game with existing game models and effectively select the defense timing to balance SDN service quality and MTD decision-making benefits. From the hidden confrontation between the actual attack and defense sides, existing attack-defense scenarios are abstractly characterized and analyzed. Based on the APT attack process of the Cyber Kill Chain (CKC), a state transition model of the MTD attack surface based on the susceptible-infective-recuperative-malfunctioned (SIRM) infectious disease model is defined. An MTD attack-defense timing decision model based on the FlipIt game (FG-MTD) is constructed, which expands the static analysis in the traditional game to a dynamic continuous process. The Nash equilibrium of the proposed method is analyzed, and the optimal timing selection algorithm of the MTD is designed to provide decision support for the selection of MTD timing under moderate security. Finally, the application model is used to verify the model and method. Through numerical analysis, the timings of different types of attack-defense strategies are summarized.

Moving target defence: Economics and asymmetry

In cyberspace, warfare is asymmetric. It takes only a small army of well-trained hackers to inflict major damage on a much larger adversary. Ironically, the inequity stems from standardisation. When bad actors find a vulnerability in a popular application or operating system, they can exploit it on millions of systems, yielding exponential reward for linear effort. The hacker’s advantage, then, is economic rather than technical. Unless and until we reverse this dynamic, the adversary will have the advantage. Moving target defence (MTD), also called polymorphic defence, has the potential to diminish the enemy’s asymmetric advantage. This paper surveys the major MTD technologies currently on the market and under development, with special attention to dynamic runtime environments. In particular, it explores how each technology might reverse, or at least mitigate, the economic leverage the enemy now exerts when discovering and exploiting vulnerabilities.

Moving target defense controller of mobile system based on Openflow sensor security scheme

This paper introduces a sensor security and defense scheme based on Openflow in mobile Internet of Things system. Adopting the flexible network characteristics of the Openflow network structure, at the network level of the mobile internet of things system, the goal of protecting the sensor devices, routers, switches and other devices in the mobile internet of things system is achieved by simultaneously carrying out the double random digital transformation of the network IP address and the data transmission ports of the cross-region Openflow exchange equipment through each sensor device in the mobile internet of things system and each router device in the data transmission process. Compared with the existing security defense technology of mobile IoT system, this technical solution is compatible and relatively easy to deploy, and can protect the whole system data transmission of mobile IOT system. In the initial stage of network system sniffing, such as hacker attack, the maximum extent of active security protection is provided to the mobile Internet of Things system carrying public network data by hiding sensor information.