Moving Target Defense Research Articles

Automated benchmark network diversification for realistic attack simulation with application to moving target defense

With numbers of exploitable vulnerabilities and attacks on networks constantly increasing, it is important to employ defensive techniques to protect one’s systems. A wide range of defenses are available and new paradigms such as Moving Target Defense (MTD) rise in popularity. But to make informed decisions on which defenses to implement, it is necessary to evaluate their effectiveness first. In many cases, the full impact these techniques have on security is not well understood yet. In this paper we propose network defense evaluation based on detailed attack simulation. Using a flexible modeling language, networks, attacks, and defenses are described in high detail, yielding a fine-grained scenario definition. Based on this, an automated instantiator generates a wide range of realistic benchmark networks. These serve to perform simulations, allowing to evaluate the security impact of different defenses, both quantitatively and qualitatively. A case study based on a mid-sized corporate network scenario and different Moving Target Defenses illustrates the usefulness of this approach. Results show that virtual machine migration, a frequently suggested MTD technique, more often degrades than improves security. Hence, we argue that evaluation based on realistic attack simulation is a qualified approach to examine and verify claims of newly proposed defense techniques.

Optimal temporospatial strategy selection approach to moving target defense: A FlipIt differential game model

Decision-making on defense against moving targets largely focuses on selection of spatial strategies, which can lack consideration of optimal defense timing, lack comprehensive defense effectiveness, and affect the execution of a defense strategy. Current selection methods for defense timing are based on the decision-making model of a discrete time series structure, and they present problems such as inadequate real-time performance for continuous decision-making. Based on the dynamic temporospatial confrontation characteristics of network attack and defense, this paper proposes an improved moving target defense model based on the multidimensional transition of exploration-attack-detection surfaces, analyzes the characteristics of attack-defense games for moving target defense (MTD) and temporospatial strategies, and describes the characteristics of stealth interaction based on the FlipIt MTD system security state evolution. We use the game to analyze continuous network attack-defense processes to build an MTD temporospatial decision-making model. We quantify the attacker's and defender's utilities, design a saddle-point strategy solution, and develop an optimal temporospatial defense strategy selection algorithm. We use application examples and numerical analysis results to show that the model and algorithm are accurate and effective.

TOTP Moving Target Defense for sensitive network services

Edge computing is crucial for many of the new 5G business vertical use-cases, such as Industry 4.0 robots, safety-critical communications, and highly-efficient smart grids. However, the tighter integration of such impactful businesses into previously core network operations raises significant security, trustworthiness, and reliability issues. A business vertical must not compromise the Edge platform to other business verticals. Likewise, the vertical Network Services (NSs) entrusted to the Edge should not be compromisable by adversary action. Inspired by the existing Internet Services Two-Factor Authentication (2FA) systems, we propose a Moving Target Defense (MTD) mechanism that protects sensitive NSs using a port mutation akin to a seamless Time-based One-Time Password (TOTP) authentication. Our architecture leverages Software-Defined Networking (SDN) to perform the mutations, having the option of working exclusively as a Virtual Network Function (VNF) that can be instantiated on-demand, or in conjunction with OpenFlow hardware-accelerated switches for smarter resource usage. The straightforward Proof-of-Concept implementation showed the approach was viable, with good forwarding plane performance (exceeding the current Network Interface Controllers capabilities), and effective at stopping the unauthorized interactions with the NS being protected. Because the TOTP approach depends on time and there is commonly occurring jitter (e.g., network), the Threat Detection must make a trade-off between minimizing false-positives (too many alarms) and having false-negatives (attempts that go unreported). We have struck a balance that reduces the probability of a rogue probe reaching the NS to nearly 0.0045%, while the probability of stopping an attack but not generating the alarm is approximately 2%. Future work, such as adaptive delay compensation or the use of AI/ML, may further improve the effectiveness of the solution.

Systematic planning of moving target defence for maximising detection effectiveness against false data injection attacks in smart grid

Systematic planning of moving target defence for maximising detection effectiveness against false data injection attacks in smart grid

Network-based multidimensional moving target defense against false data injection attack in power system

Attackers against power grids need to collect sufficient information about the target system from accessible network communications before performing destructive activities. When the sophisticated cyberattacks like false data injection attacks (FDIA) are developed, they are typically stealthy and barely detectable for general passive defense approaches. In this paper, we propose a network-based multidimensional moving target defense (NMMTD) mechanism for power system, which focuses on disrupting the development of FDIA in the preparation stage. We extend the attack space into multiple dimensions by randomizing the data acquisition in multiple rounds. In each round, we increase apparent complexity and uncertainty in the network communications with controlled changes. To reduce the traffic burden, we design the packet random dropping policy included in NMMTD for end-to-end oblivious communications . We demonstrate the effectiveness of NMMTD in preventing the attacker from intercepting data packets and securing power system against FDIA with little impact on both the network and system performances.

Survey on Botnet Detection Techniques: Classification, Methods, and Evaluation

With the continuous evolution of the Internet, as well as the development of the Internet of Things, smart terminals, cloud platforms, and social platforms, botnets showing the characteristics of platform diversification, communication concealment, and control intelligence. This survey analyzes and compares the most important efforts in the botnet detection area in recent years. It studies the mechanism characteristics of botnet architecture, life cycle, and command and control channel and provides a classification of botnet detection techniques. It focuses on the application of advanced technologies such as deep learning, complex network, swarm intelligence, moving target defense (MTD), and software-defined network (SDN) for botnet detection. From the four dimensions of service, intelligence, collaboration, and assistant, a common bot detection evaluation system (CBDES) is proposed, which defines a new global capability measurement standard. Combing with expert scores and objective weights, this survey proposes quantitative evaluation and gives a visual representation for typical detection methods. Finally, the challenges and future trends in the field of botnet detection are summarized.

OSINT-Based LPC-MTD and HS-Decoy for Organizational Defensive Deception

This study aimed to alleviate the theoretical limitations of existing moving target defense (MTD) and decoy concepts and improve the efficiency of defensive deception technology within an organization. We present the concept of an open-source intelligence (OSINT)-based hierarchical social engineering decoy (HS-Decoy) strategy while considering the actual fingerprint of each organization. In addition, we propose a loosely proactive control-based MTD strategy that is based on the intended competitive exposure of OSINT between defenders and attackers. Existing MTDs and decoys are biased toward proactive prevention, in that they only perform structural mutation-based attack avoidance or induce static traps. They also have practical limitations, e.g., they do not consider security characterization of each organizational social engineering attack and related utilization plans, no quantitative deception modeling is performed for the attenuation of the attack surface through exposure to OSINT, and there is no operational plan for optimal MTD and decoy application within the organization. Through the applied deception concepts proposed here, the total attack efficiency was reduced by 287% compared to the existing MTD and decoys, while the artificial deception efficiency dominated by defenders was improved by 382%. In addition, the increase rate of deception overhead was also reduced by 174%, and an optimized deceptive trade-off was also presented. In order to enable an organization to utilize the OSINT concept, statistical error reduction, and MTD mutation cycle-based deceptive selectivity, it was introduced as a loose adaptive mutation rather than a preferential avoidance strategy, and an organization-specific optimization direction was introduced through a combination of HS-Decoy and LPC-MTD. In the future, in order to improve the operational reliability of the HS-Decoy and LPC-MTD-based combined model and standardize threat information for each organization, we intend to advance it into an international standard-based complex architecture and characterize it as game theory.

Intrinsic Security and Self-Adaptive Cooperative Protection Enabling Cloud Native Network Slicing

With the emergence of cloud native technology, the network slicing enables automatic service orchestration, flexible network scheduling and scalable network resource allocation, which profoundly affects the traditional security solution. Security is regarded as a technology independent of the cloud native architecture in the initial design, traditional passive defense such as “reinforced” and “stacked” is relied on to achieve system security protection. The lack of intrinsic security mechanisms makes the system capability insufficient when faces the uncertain threat brought by vulnerabilities and backdoors under the ecosystem of opening-up and sharing. The static nature of existing networks and computing systems makes them easy to be compromised and hard to defend, and thus it is urgent to provide intrinsic security and proactive protection against the unpredictable attacks. To this end, this paper proposes a novel paradigm named intrinsic cloud security (iCS) from the perspective of dynamic defense. The dynamic defense provides component-level security, and has complementary and consistency with the cloud native environment. In particular, iCS introduces mimic defense and moving target defense (MTD), and makes full use of the new features introduced by cloud native to implement an intrinsic and proactive defense mechanism with acceptable costs and efficiency. The iCS paradigm achieves seamless integration and symbiosis evolution between security and cloud native. We implement a trial of iCS based on 5GC commercial system and evaluate its performance on costs, efficiency and attack success. The result shows that the iCS enhanced mode always can provide a better and more stable defense effects.

Grid Cyber-Security Strategy in an Attacker-Defender Model

The progression of cyber-attacks on the cyber-physical system is analyzed by the Probabilistic, Learning Attacker, and Dynamic Defender (PLADD) model. Although our research does apply to all cyber-physical systems, we focus on power grid infrastructure. The PLADD model evaluates the effectiveness of moving target defense (MTD) techniques. We consider the power grid attack scenarios in the AND configurations and OR configurations. In addition, we consider, for the first time ever, power grid attack scenarios involving both AND configurations and OR configurations simultaneously. Cyber-security managers can use the strategy introduced in this manuscript to optimize their defense strategies. Specifically, our research provides insight into when to reset access controls (such as passwords, internet protocol addresses, and session keys), to minimize the probability of a successful attack. Our mathematical proof for the OR configuration of multiple PLADD games shows that it is best if all access controls are reset simultaneously. For the AND configuration, our mathematical proof shows that it is best (in terms of minimizing the attacker′s average probability of success) that the resets are equally spaced apart. We introduce a novel concept called hierarchical parallel PLADD system to cover additional attack scenarios that require combinations of AND and OR configurations.

A Two-Layer IP Hopping-Based Moving Target Defense Approach to Enhancing the Security of Mobile Ad-Hoc Networks.

Mobile ad-hoc networks (MANETs) have great potential applications in military missions or emergency rescue due to their no-infrastructure, self-organizing and multi hop capability characteristics. Obviously, it is important to implement a low-cost and efficient mechanism of anti-invasion, anti-eavesdropping and anti-attack in MANETs, especially for military scenarios. The purpose of intruding or attacking a MANET is usually different from that of wired Internet networks whose security mechanism has been widely explored and implemented. For MANETs, moving target defense (MTD) is a suitable mechanism to enhance the network security, whose basic idea is to continuously and randomly change the system parameters or configuration to create inaccessibility for intruders and attackers. In this paper, a two-layer IP hopping-based MTD approach is proposed, in which device IP addresses or virtual IP addresses change or hop according to the network security status and requirements. The proposed MTD scheme based on the two-layer IP hopping has two major advantages in terms of network security. First, the device IP address of each device is not exposed to the wireless physical channel at all. Second, the two-layer IP hops with individual interval and rules to obtain enhanced security of MANET while maintaining relatively low computational load and communication cost for network control and synchronization. The proposed MTD scheme is implemented in our developed MANET terminals, providing three level of network security: anti-intrusion in normal environment, intrusion detection in offensive environment and anti-eavesdropping in a hostile environment by combining the data encryption technology.

Modeling and Performance Analysis of Satellite Network Moving Target Defense System with Petri Nets

With the development of satellite communication networks and the increase of satellite services, security problems have gradually become some of the most concerning issues. Researchers have made great efforts, including conventional safety methods such as secure transmission, anti-jamming, secure access, and especially the new generation of active defense technology represented by MTD. However, few scholars have theoretically studied the influence of active defense technique on the performance of satellite networks. Formal modeling and performance analysis have not been given sufficient attention. In this paper, we focus on the performance evaluation of satellite network moving target defense system. Firstly, two Stochastic Petri Nets (SPN) models are constructed to analyze the performance of satellite network in traditional and active defense states, respectively. Secondly, the steady-state probability of each marking in SPN models is obtained by using the isomorphism relation between SPN and Markov Chains (MC), and further key performance indicators such as average time delay, throughput, and the utilization of bandwidth are reasoned theoretically. Finally, the proposed two SPN models are simulated based on the PIPE platform. In addition, the effect of parameters on the selected performance indexes is analyzed by varying the values of different parameters. The simulation results prove the correctness of the theoretical reasoning and draw the key factors affecting the performance of satellite network, which can provide an important theoretical basis for the design and performance optimization of the satellite network moving target defense system.

Context-Aware Adaptive Route Mutation Scheme: A Reinforcement Learning Approach

Moving target defense (MTD) is an emerging proactive defense technology, which can reduce the risk of vulnerabilities exploited by attacker. As a crucial component of MTD, route mutation (RM) faces a few fundamental problems defending against sophisticated Distributed-Denial of Service (DDoS) attacks: 1) it is unable to make optimal mutation selection due to insufficient learning in attack behaviors and 2) because network situation is time varying, RM also lacks self-adaptation in mutation parameters. In this article, we propose a context-aware Q-learning algorithm for RM (CQ-RM) that can learn attack strategies to optimize the selection of mutated routes. We first integrate four representative attack strategies into a unified mathematical model and formalize multiple network constraints. Then, taking above network constraints into considerations, we model RM process as a Markov decision process (MDP). To look for the optimal policy of MDP, we develop a context estimation mechanism and further propose the CQ-RM scheme, which can adjust learning rate and mutation period adaptively. Correspondingly, the optimal convergence of CQ-RM is proved theoretically. Finally, extensive experimental results highlight the effectiveness of our method compared to representative solutions.

Enhanced cyber‐physical security using attack‐resistant cyber nodes and event‐triggered moving target defence

A cyber-physical authentication strategy to protect power system infrastructure against false data injection (FDI) attacks is outlined. The authors demonstrate that it is feasible to use small, low-cost, yet highly attack-resistant security chips as measurement nodes, enhanced with an event-triggered moving target defence (MTD), to offer effective cyber-physical security. At the cyber layer, the proposed solution is based on the MULTOS Trust-Anchor chip, using an authenticated encryption protocol, offering cryptographically protected and chained reports at up to 12/s. The availability of the Trust-Anchors allows the grid controller to delegate aspects of passive anomaly detection, supporting local as well as central alarms. In this context, a distributed event-triggered MTD protocol is implemented at the physical layer to complement cyber side enhancement. This protocol applies a distributed anomaly detection scheme based on Holt-Winters seasonal forecasting in combination with MTD implemented via inductance perturbation. The scheme is shown to be effective at preventing or detecting a wide range of attacks against power system measurement system.

Reinforcement learning based self-adaptive moving target defense against DDoS attacks

In the research of moving target defense technology, the formulation and evaluation of network offensive and defensive game strategy have become a current research hotspot, but there are still some urgent problems to be solved, such as how to adjust the defense if the attacker’s strategy is constantly changing during the offensive and defensive game strategies to deal with its changes and how to balance system security and system performance when system resources are limited. Aiming at DDoS attacks, this paper proposes a moving target defense adaptive strategy based on reinforcement learning, which can adaptively adjust defense strategies according to changes in environmental conditions, while balancing system security and system performance through parameter adjustments to adapt to different scenarios. The simulation experiment results show that the proposed model and method are feasible and effective.

Moving target defense against adversarial attacks

Moving target defense against adversarial attacks

On Moving Target Techniques for Network Defense Security

The traditional technologies, tools and procedures of any network cannot be protected from attackers due to the unchanged services and configurations of the networks. To get rid of the asymmetrical feature, Moving Target Defense technique constantly changes the platform conformation which reduces success ratio of the cyberattack. Users are faced with realness with the increase of continual, progressive, and smart attacks. However, the defenders often follow the attackers in taking suitable action to frustrate expected attackers. The moving target defense idea appeared as a preemptive protect mechanism aimed at preventing attacks. This paper conducts a comprehensive study to cover the following aspects of moving target defense, characteristics of target attacks and its limitation, classifications of defense types, major methodologies, promising defense solutions, assessment methods and applications of defense. Finally, we conclude the study and the future concern proposals. The purpose of the study is to give general directions of research regarding critical features of defense techniques to scholars seeking to improve proactive and adaptive moving target defense mechanisms.

Cost-effective migration-based dynamic platform defense technique: a CTMDP approach

The fantastic growth in cybersecurity attack frequency and sophistication over the years advances the development of Moving Target Defense (MTD) technology. Migration-based dynamic platform technique (DPT), one of MTD techniques, is expected to significantly improve cyberspace security by migrating service across multiple platforms according to the predefined policy. However, the existing random migration policies cause unnecessary cost when the service platform is not under attack, which indicates the necessity of combining DPT with traditional detection-based defense mechanism to make migration decision. In this paper, we propose a Continuous-Time Markov Decision Process (CTMDP)-based dynamic platform defense model against multi-stage attacks, which can determine the optimal service migration timing based on the system reward. To maximize the expected total discounted reward of the system, we utilize the value iteration algorithm to determine the optimal policy which defines what action to be taken in a specific state. Experiments are carried out to demonstrate that our CTMDP-based dynamic platform defense model obtains higher expected total discounted reward than using random migration policies. We also investigate the effects of platform numbers and discount factors on the system reward.

Strategic Defense Against Stealthy Link Flooding Attacks: A Signaling Game Approach

With the increasing diversity of Distributed Denial-of-Service (DDoS) attacks, it is becoming extremely challenging to design a fully protected network. For instance, Stealthy Link Flooding Attack (SLFA) is a variant of DDoS attacks that strives to block access to a target area by flooding a small set of links, and it is shown that it can bypass traditional DDoS defense mechanisms. One potential solution to tackle such SLFAs is to apply Moving Target Defense (MTD) techniques in which network settings are dynamically changed to confuse/deceive attackers, thus making it highly expensive to launch a successful attack. However, since MTD comes with some overhead to the network, to find the best strategy (i.e., when and/or to what extent) of applying it has been a major challenge. The strategy is significantly influenced by the attacker's behavior that is often difficult to guess. In this work, we address the challenge of obtaining the optimal MTD strategy that effectively mitigates SLFAs while incurs a minimal overhead. We design the problem as a signaling game considering the network defender and the attacker as players. A belief function is established throughout the engagement of the attacker and the defender during this SLFA campaign, which is utilized to pick the best response/action for each player. We analyze the game model and derive a defense mechanism based on the equilibria of the game. We evaluate the technique on a Mininet-based network environment where an attacker is performing SLFAs and a defender applies MTD based on equilibria of the game. The results show that our signaling game-based dynamic defense mechanism can provide a similar level of protection against SLFAs like the extensive MTD solution, however, causing a significantly reduced overhead.

A layer-crossing multi-factor and dynamic security model over a moving target defence

Moving target defence mainly focus on the single parameter hopping and rarely refer to the hopping of multiple parameters in multiple layers. With the background of database security, this paper constructs a layer-crossing, multi-parameter and dynamic security model over moving target defence. Seven parameters which belong to different layers in the database application are defined, and two mathematical functions of successful attack probability and the reconnection time of the legitimate users are proposed. Then through mathematical analysis, this paper comes to the conclusion that it is impossible to let the successful attack probability and the average reconnection time take the minimum values at the same time. Finally, under specific scenarios, the specific expressions of the two functions and the optimal hopping interval of each parameter are present. The model proposed is not only applicable to the security of database system, but also to other information systems.

Towards Crossfire Distributed Denial of Service Attack Protection Using Intent-Based Moving Target Defense Over Software-Defined Networking

Crossfire is an indirect target area link-flooding Distributed Denial of Service (DDoS) attack determined to affect the neighbors of the real target. Currently, Crossfire DDoS attacks are acquiring impetus because of their indistinguishability and undetectability. SDN (Software Defined Networking) is a progressing technique because of its adaptability and programmability. Moving Target Defense (MTD) is an arising security strategy to counter attacks by progressively changing the attacked plane. IBN (Intent-based Networking) is another promising methodology for providing dynamic network management. IBN-based MTD can provide efficient MTD solutions because of the concentrated control and observing capacities of the intents when translated into rules inside the SDN control plane. In this paper, a framework for the security of Crossfire DDoS attacks is proposed by making use of Intent-based Traffic modifications through the Open Networking Operating System (ONOS) Rest API and Domain Name System (DNS) port redirection. In this paper, we exploited Intent-based MTD to divert traffic from the principal host to virtual shadow hosts to counter this attack. Traffic redirection helps in masquerading the attacker headed for shadow host and consequently getting the erroneous path towards the network and, hence, the Crossfire attack couldn’t be executed as expected. The proposed technique is simulated using Mininet and ONOS SDN controllers. The outcomes showed traffic is successfully redirected at a low computational expense. Therefore, Crossfire DDoS is efficiently mitigated as promising results are found.