Moving Target Defense Research Articles

Attack Detection of Complex Cyber-Physical Networks via Set-Membership Theory

This paper investigates the attack detection of complex cyber-physical networks (CCPNs) based on the set-membership theory and moving-target defense strategy. Firstly, a moving-target defense (MTD) strategy is proposed to prevent attackers from stealing the system model, which can improve the security of systems. Secondly, a robust observer based on the MTD strategy is designed to estimate the system states without attacks. Meanwhile, we combine the set-membership and interval hull theorem to calculate the reachable set of the states and dynamic thresholds of the residual system in the absence of attacks. Then, an attack detector is established to give an alarm of false data injection (FDI) attacks by comparing the actual residual signal under attacks and the dynamic thresholds. Finally, two examples are given to illustrate the effectiveness of the proposed method.

Blending Data and Physics Against False Data Injection Attack: An Event-Triggered Moving Target Defence Approach

Blending Data and Physics Against False Data Injection Attack: An Event-Triggered Moving Target Defence Approach

A Comprehensive Architectural Framework of Moving Target Defenses Against DDoS Attacks

Distributed Denial-of-Service (DDoS) attacks are among the top toughest security threats in today’s cyberspace. The multitude, diversity, and variety of both the attacks and their countermeasures have the consequence that no optimal solutions exist. However, many mitigation techniques and strategies have been proposed among which is Moving Target Defense (MTD). MTD strategy keeps changing the system states and attack surface dynamically by continually applying various systems reconfigurations aiming at increasing the uncertainty and complexity for attackers. Current proposals of MTD fall into one of three strategies: shuffling, diversity, and redundancy, based on what to move? how to move? and when to move? Despite the existence of such strategies, a comprehensive Framework for MTD techniques against DDoS attacks that can be used for all types of DDoS attacks has not been proposed yet. In this paper, we propose a novel and comprehensive Framework of MTD techniques considering all stages, mechanisms, data sources, and criteria adopted by the research community, the Framework will apply to all DDoS attacks on different systems. To efficiently use our proposed model, a comprehensive taxonomy of MTD mitigation techniques and strategies is also provided and can be used as a reference guide for the best selection of the model’s parameters.

Proactive attack detection scheme based on watermarking and moving target defense

In this paper, the attack detection problem is investigated for cyber–physical systems (CPSs) with unknown-but-bounded (UBB) noises. A new hybrid proactive detection scheme is proposed to detect stealthy attacks by combining watermarking and moving target (MT). The designed abnormal detector is based on the residual of the zonotopic observer which can be utilized to estimate states of the system with UBB noises. We prove that the approach proposed in this work does not introduce any performance loss in the absence of attacks. The proposed active detection framework can be employed to detect various types of attacks, such as denial-of-service (DoS), replay and covert attacks. Finally, numerical examples are provided to demonstrate the effectiveness of the proposed methods.

ITC: Intrusion tolerant controller for multicontroller SDN architecture

Software-Defined Networking (SDN) is a novel paradigm where the data plane and the control plane are decoupled on network devices. This approach places the control plane in an external entity, rather than in each individual device as in the traditional networking architecture to conquer the latter weaknesses such as the lack of global visibility of the network state. SDN simplifies network management, offers flexibility, and makes communication networks easier. However, SDN faces several security challenges, since the controller is considered as a single point of failure that may return the whole network down in case of a security compromise. Indeed, the single point of failure is partially tackled by the use of multi-controller mechanisms. However, simply using these mechanisms cannot avoid compromising vulnerable controllers due to their visible nature. In fact, the attacker needs just much more time to compromise the whole system. In this paper, we propose to approach the issue of intrusion tolerance in the SDN control plane by first applying a Recovery Based model which assumes that as soon as a system comes online it is compromised; therefore, periodic restoration to a good state is necessary. Secondly, we aim to establish Moving Target Defense (MTD) that provides a proactive defense against adaptive adversaries. The goal of the MTD in the Dispatcher is to constantly shift between multiple controllers with diverse configurations in order to increase the uncertainty for the attacker, in effect, diminishing the information gathered from the control plan during the reconnaissance phase of a potential attack. Finally, We put in place probabilistic models that can contribute to the perception of the performance of self-cleansing intrusion tolerance in the SDN control plane.

Mitigation of DDoS Attack Using Moving Target Defense in SDN

Mitigation of DDoS Attack Using Moving Target Defense in SDN

Optimal Deployment in Moving Target Defense against Coordinated Cyber–Physical Attacks via Game Theory

This work proposes a method for the intelligent deployment of distributed flexible AC transmission system (D-FACTS) devices. In recent years, in the field of moving target defense (MTD) strategies to detect coordinated cyber–physical attacks (CCPAs), establishing how to deploy D-FACTS devices has become an important research point. Although some research results have been proposed, the obtained deployment solutions are unintelligent due to not carefully considering smart attackers’ behaviors. A method for achieving the intelligent deployment of D-FACTS devices is proposed in this paper. First, the basic concept of corrupting CCPAs is summarized; second, based on considering practical constraints and the basic concept, a protected transmission line set is confirmed; and third, a zero-sum game model is formulated, and a robust Nash equilibrium solution is computed. Due to the game’s characteristics, this solution reflects the smart attackers’ sense of action. Relying on the solution, those lines that are most likely to be tripped form a new protected transmission line set. Finally, a comprehensive algorithm using a metric proposed in previous studies is proposed for finding an intelligent solution for the deployment of D-FACTS devices. We validated our results through extensive simulations using IEEE 14-bus, 30-bus, and 118-bus power systems provided by MATPOWER and the real-world load profiles from New York State. Our work, in tracking the targets that attackers are most likely to attack, opens up new ideas for the intelligent deployment of D-FACTS devices.

CYBERSECURITY DECEPTION ENGINEERS: THE UNSEEN GUARDIANS OF CYBERSECURITY PROGRAMS AND THE UNSUNG HEROES IN THE BATTLE AGAINST CYBER THREATS

Deception engineers play a crucial role in cybersecurity by introducing sophisticated threat detection mechanisms and deceptive measures. Their work involves designing traps, decoys, and lures strategically placed within systems to confuse attackers and gather valuable intelligence. By leveraging tools like moving target defense, they create a dynamic cybersecurity landscape that hinders adversaries and strengthens the organization's proactive security measures. Collaboration with other cybersecurity professionals and conducting realistic simulations further enhances defenses. Overall, deception engineers bolster cybersecurity by detecting threats, gathering intelligence, and staying ahead of evolving attack vectors. This article discusses the profession of deception engineering.

Data Flooding against Ransomware: Concepts and Implementations

Ransomware is one of the most infamous kinds of malware, particularly the “crypto” subclass, which encrypts users’ files, asking for some monetary ransom in exchange for the decryption key. Recently, crypto-ransomware grew into a scourge for enterprises and governmental institutions. The most recent and impactful cases include an oil company in the US, an international Danish shipping company, and many hospitals and health departments in Europe. Attacks result in production lockdowns, shipping delays, and even risks to human lives.To contrast ransomware attacks (crypto, in particular), we propose a family of solutions, called Data Flooding against Ransomware, tackling the main phases of detection, mitigation, and restoration, based on a mix of honeypots, resource contention, and moving target defence. These solutions hinge on detecting and contrasting the action of ransomware by flooding specific locations (e.g., the attack location, sensible folders, etc.) of the victim’s disk with files. Besides the abstract definition of this family of solutions, we present an open-source tool that implements the mitigation and restoration phases, called Ranflood.In particular, Ranflood supports three flooding strategies, apt for different attack scenarios. At its core, Ranflood buys time for the user to counteract the attack, e.g., to access an unresponsive, attacked server and shut it down manually. We benchmark the efficacy of Ranflood by performing a thorough evaluation over 6 crypto-ransomware (e.g., WannaCry, LockBit) for a total of 78 different attack scenarios, showing that Ranflood consistently lowers the amount of files lost to encryption.

Security Enhancement of Power System State Estimation With an Effective and Low-Cost Moving Target Defense

Moving target defense (MTD) is a new defensive mechanism developed in power systems to thwart false data injection attacks (FDIAs). However, since the MTD works by perturbing the branch parameters with the distributed flexible ac transmission system (D-FACTS), it might cause additional infrastructure and operation costs and affect the system dynamics. This is a complicated problem because it is closely related to which branches should be perturbed and how much they are changed. In this article, we analyze the essentials of MTD and construct an effective and low-cost MTD. To begin with, we provide a sufficient and necessary condition for MTD to protect a bus from being affected by the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">intended FDIA</i> . Based on this result, we propose a new metric to quantify the protection level of MTD and an efficient algorithm to minimize the number of required D-FACTS devices for protecting a specific set of buses. To reduce the operation cost, we develop two strategies to make the increasing operation cost zero for activating the MTD. Furthermore, we analyze the impact of MTD on the system dynamics with a special emphasize on small signal stability. Finally, we conduct extensive simulations to validate our findings with the test cases of power systems in MATPOWER.

Extended Moving Target Defense for AC State Estimation in Smart Grids

The moving target defense (MTD) that proactively changes series reactance of transmission lines has recently been proposed as an effective defense approach to resist false data injection attacks in smart grids. However, the defense effectiveness analyses of MTD in existing research are mainly focused on linear DC state estimation. To bring the state-of-the-art research to practice, MTD for AC state estimation is investigated in this paper. Specifically, based on a thorough analysis, an extended MTD (EMTD) approach that coordinately changes series reactance and parallel susceptance of lines in smart grids is proposed to improve the traditional MTD. Moreover, the impact of EMTD on electricity market is analyzed. On this basis, the variation of locational marginal price, the variation of active power loss and the cost of devices for executing EMTD are treated as the cost of system defense. Furthermore, to find the trade-off between the defense effectiveness and the cost of EMTD, optimal construction of cost-minimization EMTD topology parameter scheme and defense time interval are also proposed. Finally, extensive simulations are conducted on the standard IEEE test system to demonstrate the effectiveness of the proposed approach.

A Survey on Moving Target Defense: Intelligently Affordable, Optimized and Self-Adaptive

Represented by reactive security defense mechanisms, cyber defense possesses a static, reactive, and deterministic nature, with overwhelmingly high costs to defend against ever-changing attackers. To change this situation, researchers have proposed moving target defense (MTD), which introduces the concept of an attack surface to define cyber defense in a brand-new manner, aiming to provide a dynamic, continuous, and proactive defense mechanism. With the increasing use of machine learning in networking, researchers have discovered that MTD techniques based on machine learning can provide omni-bearing defense capabilities and reduce defense costs at multiple levels. However, research in this area remains incomplete and fragmented, and significant progress is yet to be made in constructing a defense mechanism that is both robust and available. Therefore, we conducted a comprehensive survey on MTD research, summarizing the background, design mechanisms, and shortcomings of MTD, as well as relevant features of intelligent MTD that are designed to overcome these limitations. We aim to provide researchers seeking the future development of MTD with insight into building an intelligently affordable, optimized, and self-adaptive defense mechanism.

Hybrid cyber defense strategies using Honey-X: A survey

The development and adoption of network technologies reshape our daily life; however, network-connected devices have become popular targets of cybercrimes. Honey-X-based cyber defense technologies, like honeypots, honeynets, and honeytokens, can provide cyber threat intelligence and protect network users against various cyberattacks by leveraging deception techniques. The hybrid defense strategies of defensive cyber deception (DCD) and moving target defense (MTD) approaches while combining the advances of Machine Learning (ML) or Game Theory (GT), which have the potential to offer cyber security enhancement against malicious adversaries. This survey paper aims to comprehensively understand the defensive approaches based on honey-X for cyber defense. It analyses and categorizes the honey-X-based defense strategies, presents the security quantification of cyber defense, and outlines challenges and future directions for honey-X-based cyber defense strategies.

A Brief Survey of Recent Advances and Methodologies for the Security Control of Complex Cyber-Physical Networks.

Complex cyber-physical networks combine the prominent features of complex networks and cyber-physical systems (CPSs), and the interconnections between the cyber layer and physical layer usually pose significant impacts on its normal operation. Many vital infrastructures, such as electrical power grids, can be effectively modeled as complex cyber-physical networks. Given the growing importance of complex cyber-physical networks, the issue of their cybersecurity has become a significant concern in both industry and academic fields. This survey is focused on some recent developments and methodologies for secure control of complex cyber-physical networks. Besides the single type of cyberattack, hybrid cyberattacks are also surveyed. The examination encompasses both cyber-only hybrid attacks and coordinated cyber-physical attacks that leverage the strengths of both physical and cyber attacks. Then, special focus will be paid to proactive secure control. Reviewing existing defense strategies from topology and control perspectives aims to proactively enhance security. The topological design allows the defender to resist potential attacks in advance, while the reconstruction process can aid in reasonable and practical recovery from unavoidable attacks. In addition, the defense can adopt active switching-based control and moving target defense strategies to reduce stealthiness, increase the cost of attacks, and limit the attack impacts. Finally, conclusions are drawn and some potential research topics are suggested.

Design and modeling of moving target defense in workflow-based applications

Design and modeling of moving target defense in workflow-based applications

Moving Target Defense for Detecting Coordinated Cyber-Physical Attacks on Power Grids via a Modified Sensor Measurement Expression

This paper proposes a modified sensor measurement expression for a moving target defense (MTD) strategy to detect coordinated cyber-physical attacks (CCPAs). Essentially, the MTD defense characteristics for detecting false data injection attacks (FDIAs) differ from those used to detect CCPAs. In the first case, the MTD performance in detecting FDIAs at the attack-execution stage is mainly considered, which is generally denoted by the detection probability; however, whether the construction of undetectable CCPAs is disrupted via the MTD strategy used during the attack-preparation stage is the focus of the latter case. There has been little work on the detection of undetectable CCPAs in the context of MTD post-activation. In our work, a novel approach to detecting undetectable CCPAs via a modified sensor measurement expression is proposed. First, the production mechanism for undetectable CCPAs without the application of an MTD strategy is transferred to that which occurs after MTD activation; then, based on an in-depth analysis of the CCPAs’ production mechanism after MTD activation, a novel modified sensor measurement expression is presented to detect undetectable CCPAs. Extensive simulations were conducted on three standard power systems to verify the effectiveness and simplicity of our approach to detecting CCPAs.

Adversarial Decision-Making for Moving Target Defense: A Multi-Agent Markov Game and Reinforcement Learning Approach

Reinforcement learning has shown a great ability and has defeated human beings in the field of real-time strategy games. In recent years, reinforcement learning has been used in cyberspace to carry out automated and intelligent attacks. Traditional defense methods are not enough to deal with this problem, so it is necessary to design defense agents to counter intelligent attacks. The interaction between the attack agent and the defense agent can be modeled as a multi-agent Markov game. In this paper, an adversarial decision-making approach that combines the Bayesian Strong Stackelberg and the WoLF algorithms was proposed to obtain the equilibrium point of multi-agent Markov games. With this method, the defense agent can obtain the adversarial decision-making strategy as well as continuously adjust the strategy in cyberspace. As verified in experiments, the defense agent should attach importance to short-term rewards in the process of a real-time game between the attack agent and the defense agent. The proposed approach can obtain the largest rewards for defense agent compared with the classic Nash-Q and URS-Q algorithms. In addition, the proposed approach adjusts the action selection probability dynamically, so that the decision entropy of optimal action gradually decreases.

An Optimal Active Defensive Security Framework for the Container-Based Cloud with Deep Reinforcement Learning

Due to the complexity of attack scenarios in the container-based cloud environment and the continuous changes in the state of microservices, the effectiveness of active defense strategies decreases with the cloud environment and microservice change. To tackle it, the main focus is how to establish a comprehensive threat model and adaptive active defense deployment strategy. In this study, we present an optimal active defensive security framework (OADSF) for a container-based cloud with deep reinforcement learning. Firstly, based on the characteristics of container clouds and microservices, the security threats and attack paths of attackers are analyzed from the application layer and container layer. Then, we propose a Holistic System Attack Graph to quantitatively analyze the security gain, quality of service (QOS) and defense efficiency in the container-based cloud scenarios. Finally, the optimization of a moving target defense (MTD) strategy is modeled as a Markov decision process. Deep reinforcement learning is proposed to handle the state space explosion under large-scale cloud applications, thus solving the optimal defense configuration strategy for the orchestration platform. We use Kubernetes to build container-based clusters. The algorithm is implemented in Python 3.7 based on Tensorflow 1.14. Simulation results show that the proposed method can quickly converge under large-scale cloud applications and increase defensive efficiency. Compared with DSEOM and SmartSCR, the defense efficiency is increased by 35.19% and 12.09%, respectively.

Towards adding digital forensics capabilities in software defined networking based moving target defense

Towards adding digital forensics capabilities in software defined networking based moving target defense

Detection and Mitigation of IoT-Based Attacks Using SNMP and Moving Target Defense Techniques.

This paper proposes a solution for ensuring the security of IoT devices in the cloud environment by protecting against distributed denial-of-service (DDoS) and false data injection attacks. The proposed solution is based on the integration of simple network management protocol (SNMP), Kullback-Leibler distance (KLD), access control rules (ACL), and moving target defense (MTD) techniques. The SNMP and KLD techniques are used to detect DDoS and false data sharing attacks, while the ACL and MTD techniques are applied to mitigate these attacks by hardening the target and reducing the attack surface. The effectiveness of the proposed framework is validated through experimental simulations on the Amazon Web Service (AWS) platform, which shows a significant reduction in attack probabilities and delays. The integration of IoT and cloud technologies is a powerful combination that can deliver customized and critical solutions to major business vendors. However, ensuring the confidentiality and security of data among IoT devices, storage, and access to the cloud is crucial to maintaining trust among internet users. This paper demonstrates the importance of implementing robust security measures to protect IoT devices in the cloud environment and highlights the potential of the proposed solution in protecting against DDoS and false data injection attacks.