Moving Target Defense Research Articles

Performance Modeling of Moving Target Defenses with Reconfiguration Limits

Moving Target Defense (MTD) has recently emerged as a game changer in the security landscape due to its proven potential to introduce asymmetric uncertainty that gives the defender a tactical advantage over the attacker. Many different MTD techniques have been developed, but, despite the huge progress made in this area, critical gaps still exist with respect to the problem of studying and quantifying the cost and benefits of deploying MTDs. In fact, all existing techniques address a very narrow set of attack vectors, and, due to the lack of shared metrics, it is difficult to quantify and compare multiple techniques. Building on our preliminary work in this field, we propose a quantitative analytic model for assessing the resource availability and performance of MTDs, and a method for maximizing a utility function that captures the tradeoffs between security and performance. The proposed model generalizes our previous model and can be applied to a wider range of MTDs and operational scenarios to improve availability and performance by imposing limits on the maximum number of resources that can be in the process of being reconfigured. The analytic results are validated by simulation and experimentation, confirming the accuracy of our model.

Securing Control and Data Planes From Reconnaissance Attacks Using Distributed Shadow Controllers, Reactive and Proactive Approaches

Moving Target Defense (MTD) is an emerging proactive Cyber Security approach. MTD constantly changes the attack surface for making cyber-attacks difficult for the invaders. Software Defined Networking(SDN) provides dynamic network design capabilities with its centralized control plane. In this paper, SMCDS (SDN based Moving Target Defense for control and data planes Security) has been proposed. The SMCDS framework safeguards against the reconnaissance attacks targeted at both data and control planes. The concept of distributed shadow controllers is introduced for securing the control plane. The MTD effect is created through the use of shadow controllers that respond to the malicious probing traffic in place of the actual controller. The availability of the distributed control plane is enhanced through the used of these shadow controllers as well. The proposed framework adopts the reactive and proactive approaches for securing the servers connected at the data plane. The reactive approach capitalizes the technique of shadow servers for providing defense against reconnaissance attacks. The proactive approach provides security enhancement through the technique of IP and port shuffling. The novelty of SMCDS framework is its capability to provide protection of both data and control planes by exploiting SDN based MTD approach. The SMCDS framework was evaluated in terms of the attacker effort, defender cost. From the results, it can be observed that the proposed framework provides security against reconnaissance attacks at a low computational cost. The prototype of the proposed SMCDS was implemented using Mininet emulator and ONOS controller.

A layer-crossing multi-factor and dynamic security model over a moving target defence

Moving target defence mainly focus on the single parameter hopping and rarely refer to the hopping of multiple parameters in multiple layers. With the background of database security, this paper co...

Performance assessment of hybrid MTD for DoS mitigation in public cloud

The massive features of cloud computing makes it as an attractive target in today's business community. Public cloud draws immediate attention among individuals, organizations due to its pay-as-you-go model. Security, reliability, and regulatory compliance are the principal key concerns in the public cloud environment as its success relies merely on addressing those concerns. Denial of Service (DoS) attack is one of the major attack categories in the cloud. Despite the emergence of automated and advanced attack control measures in place, the blooming and morphing nature of DoS attacks are truly devastative in disrupting the service availability. Moving Target Defense (MTD) is an emerging technique to achieve the diversity criterion for improving the network resiliency against DoS. The prominent solution against DoS mitigation could be achieved using a combination of MTD strategies for increased uncertainty. Hence, the proposed technique combines the shuffle, diversity, and redundancy strategies of MTD which yields increased uncertainty, reduced attack probability values, and early attack detection with Access Control List (ACL) rules. 0.1% is the attack probability value achieved based on experimental simulations in the Amazon Web Service (AWS) environment.

A Moving Target Defense Strategy for Internet of Things Cybersecurity

Internet of Things (IoT) systems are becoming more common and present in our daily lives. The increase of Internet-connected devices has caused attackers to focus their attention more on these devices. Therefore, new and more sophisticated attacks on IoT systems are discovered every day. Currently, to ensure reliability and operability, most IoT systems are designed to operate in a relatively static configuration in a highly heterogeneous environment. However, a system that does not continuously change its configurations, i.e., a static system, gives an advantage to attackers; with enough time and resources, an attacker will eventually find and exploit the vulnerabilities of any static target. This work proposes a Moving Target Defense (MTD) strategy that randomly shuffles the communication protocols through which a node communicates to a gateway in an IoT network. The system’s configuration changes have an associated cost. The objective of the proposed MTD strategy in this work is to balance the increase in system performance overhead, the increase in business impact (system unavailability), and, at the same time, the decrease in the probability of success of a given attack. A framework is proposed to design this strategy; this framework can guide any MTD strategy for IoT systems. The framework’s objective is to find, after several iterations, the MTD strategy parameters that achieve a balance between five different measurable variables of an IoT system.

Runtime Randomized Relocation of Crypto Libraries for Mitigating Cache Attacks

Crypto libraries such as OpenSSL and Libgcrypt are essential building blocks for implementing secure cloud services. Unfortunately, these libraries are subject to cache side-channel attacks, which are more devastating in cloud environments where inevitable cache contention among different tenants occurs. Previous approaches for mitigating cache side-channel attacks have limitations in terms of the deployability and security; these hinder utilization in cloud services. In this paper, we propose an R2-relocator, a novel library protection technique based on moving target defence. When injected into a running process, the R2-relocator performs randomized relocation of the library during runtime. By doing this, it transforms a vulnerable crypto library into one that randomly changes its memory (cache) location, thereby preventing the delivery of cache side-channel attacks against the library. The proposed technique achieves robust protection against cache side-channel attacks for all crypto libraries, even those containing unpatched critical vulnerabilities, without the need for reconfiguration of the library. Extensive evaluations of security, performance, and deployability of the R2-relocator demonstrate its effectiveness for secure cloud services.

Network Attack Surface: Lifting the Concept of Attack Surface to the Network Level for Evaluating Networks’ Resilience Against Zero-Day Attacks

The concept of attack surface has seen many applications in various domains, e.g., software security, cloud security, mobile device security, Moving Target Defense (MTD), etc. However, in contrast to the original attack surface metric, which is formally and quantitatively defined for a software, most of the applications at higher abstraction levels, such as the network level, are limited to an intuitive and qualitative notion, losing the modeling power of the original concept. In this paper, we lift the attack surface concept to the network level as a formal security metric for evaluating the resilience of networks against zero day attacks. Specifically, we first develop novel models for aggregating the attack surface of different network resources. We then design heuristic algorithms to estimate the network attack surface while reducing the effort spent on calculating attack surface for individual resources. Finally, the proposed methods are evaluated through experiments.

Research on Cyberspace Mimic Defense Based on Dynamic Heterogeneous Redundancy Mechanism

With the rapid growth of network technology, the methods and types of cyber-attacks are increasing rapidly. Traditional static passive defense technologies focus on external security and known threats to the target system and cannot resist advanced persistent threats. To solve the situation that cyberspace security is easy to attack and difficult to defend, Chinese experts on cyberspace security proposed an innovative theory called mimic defense, it is an active defense technology that employs “Dynamic, Heterogeneous, Redundant” architecture to defense attacks. This article first briefly describes the classic network defense technology and Moving Target Defense (MTD). Next, it mainly explains in detail the principles of the mimic defense based on the DHR architecture and analyzes the attack surface of DHR architecture. This article also includes applications of mimic defense technology, such as mimic routers, and mimic web defense systems. Finally, it briefly summarizes the existing research on mimic defense, expounds the problems that need to be solved in mimic defense, and looks forward to the future development of mimic defense.

An SDN-Enabled Proactive Defense Framework for DDoS Mitigation in IoT Networks

The Internet of Things (IoT) is becoming truly ubiquitous in every domain of human lives, and a large number of objects can be connected and enabled to communicate with cloud servers at any time. However, complex connections and vulnerabilities of IoT devices introduce inevitable security threats, in which distributed denial-of-service (DDoS) attacks usually incur catastrophic results. Unfortunately, the existing DDoS mitigation methods cannot provide effective protection. Moreover, the amplifying complexity and increasing delay incurred by defense greatly affect the stability of IoT networks. To tackle these problems, we present a novel framework that can proactively adapt the attack surface of IoT networks, dynamically optimize defense strategies, and rapidly deploy the corresponding defense mechanisms. In particular, we establish hybrid proactive defense mechanisms combining Moving Target Defense (MTD) techniques with cyber deception to spread camouflage information to confuse attackers. Based on these mechanisms, we introduce a defender-led signaling game model to formalize defense scenarios and depict the interactions between the defender and the attacker. Besides, we present an optimal algorithm to solve decision problems and optimize defense implementation in a cost-effective manner. Our extensive experiments demonstrate that the proposed approach can effectively mitigate DDoS attacks and maintain a high level of performance in IoT networks with acceptable overhead.

DESOLATER: Deep Reinforcement Learning-Based Resource Allocation and Moving Target Defense Deployment Framework

The recent development of autonomous driving technologies has led to the proliferation of research on sensors and electronic equipment inside a vehicle. To deal with security concerns of in-vehicle networks, various deep learning (DL) and reinforcement learning (RL) have been developed to enhance in-vehicle security. However, the DL/RL agents are vulnerable to adversarial perturbation, where an attacker can perform a manipulation attack to interfere with the agent’s operation. In this work, we aim to develop two key mechanisms to build secure in-vehicle networks: (1) RL-based proactive defense mechanism to achieve multiple objectives of minimizing system security vulnerabilities while maximizing service availability; and (2) a resilient RL method that allows an agent to operate in the presence of adversarial disturbances that neutralize the system security. To this end, we propose, DESOLATER ( D rl-based r ESO urce a L location A nd m T d d E ployment f R amework), which is a multi-agent deep reinforcement learning (mDRL)-based network slicing technique that can help determine two key network management decisions: (1) link bandwidth allocation to meet quality-of-service (QoS) requirements; and (2) the frequency of triggering IP shuffling as a proactive defense mechanism not to hinder service availability by maintaining normal system operations. We also introduce an anomaly detection mechanism with a memory-based RL technique to enhance the resiliency of the RL agents in a partially observable environment under the situation that adversarial attackers manipulating observation information. Through extensive simulation experiments, we validate that the proposed robust mDRL algorithm can help the deployed proactive security mechanism achieve both security and network performance improvement in the presence of adversarial attacks.

Smart Grid Cyber-Physical Attack and Defense: A Review

Recent advances in the cyber-physical smart grid (CPSG) have enabled a broad range of new devices based on the information and communication technology (ICT). However, these ICT-enabled devices are susceptible to a growing threat of cyber-physical attacks. This paper performs a thorough review of the state-of-the-art cyber-physical security of the smart grid. By focusing on the physical layer of the CPSG, this paper provides an abstracted and unified state-space model, in which cyber-physical attack and defense models can be effectively generalized. The existing cyber-physical attacks are categorized in terms of their target components. We then discuss several operational and informational defense approaches that present the current state-of-the-art in the field, including moving target defense, watermarking, and data-driven approaches. Finally, we discuss challenges and future opportunities associated with the smart grid cyber-physical security.

MTD, Where Art Thou? A Systematic Review of Moving Target Defense Techniques for IoT

Context: Internet-of-Things (IoT) systems are increasingly deployed in the real world, but their security lags behind the state of the art of non-IoT systems. Moving target defense (MTD) is a cyberdefense paradigm, successfully implemented in conventional systems, that could improve IoT security. Objective: Identify and synthesize existing MTD techniques for IoT and validate the feasibility of MTD as a cybersecurity paradigm suitable for IoT systems. Method: We use a systematic literature review method to search and analyze existing MTD for IoT techniques up to July 2020. We evaluated the existing techniques in terms of security foundations and real-world deployability using the evidence they provide. We define and use entropy-related metrics to categorize them. This is the first MTD survey to use Shannon's entropy metric empirically. Results: Thirty-two distinct MTD for IoT techniques exist: 54% are Network-layer-based, 50% present strong evidence about their real-world deployment, and 64% have weak security foundations. Conclusion: MTD for IoT is a feasible cyberdefense approach. A variety of proposals exist, with evidence about their implementation and evaluation. Nevertheless, the MTD for IoT state of the art is still immature: the security foundations of most existing proposals are weak. Novel techniques should prioritize providing convincing security foundations and real-world deployment evidence.

Physical resilience to insider attacks in IoT networks: Independent cryptographically secure sequences for DSSS anti-jamming

Wireless communication is a key technology for the Internet of Things (IoT). Due to its open nature, the physical layer of wireless systems is a high-priority target for an adversary whose goal is to disrupt the normal behavior of the system. In particular, jamming attacks are one of the most straightforward and effective types of attacks: information flow of the system is stopped or severely disturbed. In this paper, we propose a method to improve the jamming resilience of IoT systems based on Direct-Sequence Spread-Spectrum (DSSS) techniques. Our proposal is inspired by the Moving Target Defense (MTD) paradigm. MTD strategies randomize components of a system, increasing the effort an attacker needs to compromise the system. We use state-of-the-art Cryptographically Secure Pseudo-Random Number Generators outputs as spreading sequences for DSSS. The sequences of the proposed system are generated in an ad-hoc, independent, and distributed way. We show probabilistically that the generated sequences have robust cross-correlation properties. We define a multi-user system model to evaluate the Bit-Error-Rate of our proposal in the presence of two types of jammers: a classical band-limited Gaussian noise jammer, and an insider smart jammer with knowledge of one spreading sequence used in the system. Our proposal proactively mitigates the insider jammer attack. We quantify the insider smart jammer resilience of a system implementing our proposal, as a function of the length of the spreading sequences and the jammer power.

Data-based and secure switched cyber–physical systems

In this paper, we develop a completely model-free moving target defense framework for the detection and mitigation of sensor and/or actuator attacks in cyber–physical systems with dynamics that evolve in discrete-time. We incorporate an intrusion detection mechanism based on an approximate dynamic programming technique that learns the policies for optimal regulation and optimal tracking while simultaneously defending against actuator and sensor attacks in a model-free fashion. Switching rules are leveraged to force proactive and reactive defense mechanisms as well as, guarantee the stability of the equilibrium point. Finally, as a case study, we apply the proposed moving target defense framework to a DC–DC converter that is used in electric vehicles.

EVHS - Elastic Virtual Honeypot System for SDNFV-Based Networks

The SDNFV-based network has leveraged the advantages of software-defined networking (SDN) and network-function virtualization (NFV) to become the most prominent network architecture. However, with the advancement of the SDNFV-based network, more attack types have emerged. This research focuses on one of the methods (use of the honeypot system) of preventing these attacks on the SDNFV-based network. We introduce an SDNFV-based elastic virtual honeypot system (EVHS), which not only resolves problems of other current honeypot systems but also employs a new approach to efficiently manage and control honeypots. It uses a network-intrusion-detection system (NIDS) at the border of the network to detect attacks, leverages the advantages of SDN and NFV to flexibly generate honeypots, and connects attackers to these honeypots by using a moving-target defense mechanism. Furthermore, we optimize the system to efficiently reuse the available honeypots after the attacks are handled. Experimental results validate that the proposed system is a flexible and efficient approach to manage and provide virtual honeypots in the SDNFV-based network; the system can also resolve the problems encountered by current honeypot systems.

SD-CPC: SDN Controller Placement Camouflage based on Stochastic Game for Moving-target Defense

The modern paradigm of Software Defined Network (SDN) inspired the research community to develop more innovative and transformative solutions for large scale and complex crucial Cyber Physical Systems (CPS). However, the recent destructive attacks targeting such CPS applications, raised the need to initially secure and scale the core SDN network. These attacks may target the heart of SDN networks itself formed by the controllers. Therefore, recent research works discussed the Controller Placement Problem (CPP) to determine the required number of SDN controller(s) and their optimal locations in synonyms wide area networks. A few of the presented solutions discussed the network security aspect to solve this problem. In addition, none of them addressed the need to secure and dynamically change SDN controller location to confuse attackers. Therefore, in this paper, we introduce a new concept of Controller Placement Camouflage (CPC) to dynamically change the attack surface (SDN controller placements) for Moving-target Defense (MTD). The new paradigm of MTD imposes various asymmetric offensive and defensive modes against cyber-adversaries. We relied on the Zero-Sum game as a stochastic game between the system defender and the attacker to guide our MTD solution. In addition, our presented solution is adapted to consider the network vulnerabilities, evaluate the risk level of the system in real-time using Bayesian Attack Graph (BAG), to frequently shift the SDN controller(s) location. Furthermore, we used the Smart Grid as a case study for a mission critical CPS application. We conducted a scenario of UK Bulk Demand Points (BDP), 50MVA generation network capacity map to simulate a real mini-grid network topology. To the best of our knowledge, this research work may be considered the first introduction for SD-CPC for MTD.

Software-Defined Cyber–Energy Secure Underwater Wireless Power Transfer

Underwater wireless power transfer (UWPT) is a critical infrastructure for supplying power to underwater devices, such as underwater sensors and autonomous underwater vehicles. Enabling a software-defined architecture for UWPT promises to build a flexible and programmable underwater energy network. Although it is crucial that UWPT be made more resilient to cyberattacks and energy stealing, this remains an open challenge. In this article, we propose a software-defined UWPT (SD-UWPT) system that is both cyber and energy secure. A moving target defense approach and an active synchronous detection method are developed to protect the SD-UWPT against scanning-based attacks and power bot attacks. To enable energy-secure UWPT, an impedance measurement based approach is further established to prevent energy stealing. Through comprehensive evaluations, we validate the benefits of SD-UWPT and demonstrate the effectiveness of the proposed cyber–energy secure strategies against various attacks.

SOCMTD: Selecting Optimal Countermeasure for Moving Target Defense Using Dynamic Game

SOCMTD: Selecting Optimal Countermeasure for Moving Target Defense Using Dynamic Game

Deeply Hidden Moving-Target-Defense for Cybersecure Unbalanced Distribution Systems Considering Voltage Stability

A recent proactive defense mechanism, named as moving-target-defense (MTD), has been proposed as a prevailing topic that is capable of actively changing transmission line reactance to preclude cyberattacks. However, the MTD strategy has seldom been studied for the unbalanced AC distribution system in the existing literature. Towards the end, this paper proposes a deeply-hidden MTD (DH-MTD) to elaborately hide both the self and mutual reactance of each phase at the transmission line installed with D-FACTS devices. Both the branch and injection power phasor measurement functions are integrated into DH-MTD in the cyberattack scenario and under the normal operating condition, while the system voltage stability is ensured. The proposed DH-MTD model is solved using a nonlinear least square (NLS) method based on the trust-region algorithm due to the non-Gaussian noise assumption. Also, we cope with the MTD allocation (MTDA) problem using a data-driven normalized PDF peak residual (NPPR) index. The effectiveness of the proposed DH-MTD method is demonstrated in the unbalanced IEEE 123-bus distribution system against both branch and node cyberattacks.

Mimic Encryption Box for Network Multimedia Data Security

With the rapid development of the Internet, the security of network multimedia data has attracted increasingly more attention. The moving target defense (MTD) and cyber mimic defense (CMD) approaches provide a new way to solve this problem. To enhance the security of network multimedia data, this paper proposes a mimic encryption box for network multimedia data security. The mimic encryption box can directly access the network where the multimedia device is located, automatically complete the negotiation, provide safe and convenient encryption services, and effectively prevent network attacks. According to the principles of dynamization, diversification, and randomization, the mimic encryption box uses a reconfigurable encryption algorithm to encrypt network data and uses IP address hopping, port number hopping, protocol camouflage, and network channel change to increase the attack threshold. Second, the mimic encryption box has a built-in pseudorandom number generator and key management system, which can generate an initial random key and update the key with the hash value of the data packet to achieve “one packet, one key.” Finally, through the cooperation of the ARM and the FPGA, an access control list can be used to filter illegal data and monitor the working status of the system in real time. If an abnormality is found, the feedback reconstruction mechanism is used to “clean” the FPGA to make it work normally again. The experimental results and analysis show that the mimic encryption box designed in this paper has high network encryption performance and can effectively prevent data leakage. At the same time, it provides a mimic security defense mechanism at multiple levels, which can effectively resist a variety of network attacks and has high security.