PaperlayerView exact revision on arXiv

Source-linked AI summary

A Survey of Moving Target Defenses for Network Security

Sailik Sengupta, Ankur Chowdhary, Abdulhakim Sabur, Adel Alshamrani, Dijiang Huang, Subbarao Kambhampati

arXiv:1905.00964v2cs.CRcs.NI

TL;DR

Traditional static network defenses leave attackers opportunities to evade detection and prevention. This survey categorizes Moving Target Defenses by what, when, and how they move, examines implementation and evaluation practices, and identifies research directions including multi-surface shifting and broader metric coverage.

  • Problem

    Traditional network defenses rely on static services, configurations, and mechanisms that attackers can evade through techniques such as obfuscation, fragmentation, encryption, and adversarial attacks.

  • Method

    The survey categorizes MTDs by their moving surfaces, timing functions, and movement functions, while reviewing game-theoretic strategies, implementations, test-beds, and evaluation metrics.

  • Results

    The survey finds that AI and game-theoretic techniques help craft movement strategies, while SDN/NFV support practical implementation with limited network-performance impact.

  • Takeaways & Limitations

    The categorization identifies research opportunities in simultaneous multi-surface movement, scalable knowledge-based strategies, and defenses that incorporate broader security and performance metrics.

  • Takeaways & Limitations

    Proposed MTDs do not consider all the metrics identified by the survey for evaluating security and performance.

Abstract

from arXiv · show

Network defenses based on traditional tools, techniques, and procedures fail to account for the attacker's inherent advantage present due to the static nature of network services and configurations. To take away this asymmetric advantage, Moving Target Defense (MTD) continuously shifts the configuration of the underlying system, in turn reducing the success rate of cyberattacks. In this survey, we analyze the recent advancements made in the development of MTDs and define categorizations that capture the key aspects of such defenses. We first categorize these defenses into different sub-classes depending on what they move, when they move and how they move. In trying to answer the latter question, we showcase the use of domain knowledge and game-theoretic modeling can help the defender come up with effective and efficient movement strategies. Second, to understand the practicality of these defense methods, we discuss how various MTDs have been implemented and find that networking technologies such as Software Defined Networking and Network Function Virtualization act as key enablers for implementing these dynamic defenses. We then briefly highlight MTD test-beds and case-studies to aid readers who want to examine or deploy existing MTD techniques. Third, our survey categorizes proposed MTDs based on the qualitative and quantitative metrics they utilize to evaluate their effectiveness in terms of security and performance. We use well-defined metrics such as risk analysis and performance costs for qualitative evaluation and metrics based on Confidentiality, Integrity, Availability (CIA), attack representation, QoS impact, and targeted threat models for quantitative evaluation. Finally, we show that our categorization of MTDs is effective in identifying novel research areas and highlight directions for future research.

I. INTRODUCTION

Traditional network defenses leave attackers an advantage because static systems can be studied and exploited over time. This survey organizes MTD research by defense scope, implementation, evaluation, and future directions.

  • Motivation: Traditional defenses can be weakened by reconnaissance, imperfect deployment, delayed patching, QoS concerns, and zero-day attacks.Attackers can model defenses before acting, while operational constraints make routine changes difficult.
  • Motivation: MTD proactively shifts cyber-system configurations to increase attacker uncertainty and reduce the advantage gained through reconnaissance.Examples include changing open ports, network configurations, and software.
  • Survey scope: The survey categorizes MTDs by what they move, when they move, and how they move, while introducing terminology for comparing assumptions and threat models.It also relates MTDs to APT scenarios and attack and defense surfaces.
  • Implementation: The survey examines implementation maturity from analytic and simulation studies through research testbeds and commercial products, including SDN/NFV-enabled defenses.This implementation-oriented categorization was not considered in previous surveys.
  • Evaluation and future work: It organizes evaluation around security and performance metrics for individual configurations and ensembles, identifying underexplored research directions.The survey aims to establish common language that exposes considered and assumed-away aspects of MTD designs.

1) Reconnaissance:

The attack sequence progresses from reconnaissance and payload delivery through exploitation, persistence, lateral movement, and exfiltration. Different conventional defenses address different stages, while APTs add persistence and adaptation across a prolonged campaign.

  • Reconnaissance: During reconnaissance, attackers gather information about target environments using passive monitoring and network-probing tools such as traceroute and Nmap.
  • Weaponization and delivery: Attackers use phishing emails or malware-infected documents to create targeted payloads based on reconnaissance findings.
  • Exploitation: Exploitation involves detonating a crafted payload that abuses a known or zero-day vulnerability to gain elevated privileges.
  • Installation and actions: After gaining access, attackers may install malware, harvest data, maintain remote control, pivot, and move laterally toward additional systems.NIDS, outbound firewall rules, anti-malware, and HIDS are described as relevant detection or blocking tools across these activities.
  • Advanced Persistent Threats: APTs involve skilled, well-funded, persistent attackers who adapt to defensive efforts and pursue information exfiltration or service disruption through multiple vectors.The survey maps APT phases to corresponding Cyber Kill Chain stages.

D. Defense Methods

The survey reviews conventional defenses across Cyber Kill Chain phases and describes complementary tools for traffic analysis, access control, host protection, deception, and traffic slowing.

  • Overview: The survey uses the Cyber Kill Chain to relate existing defense mechanisms to different attack phases and provide building blocks for MTD techniques.
  • Information analysis: Threat intelligence methods support security-relevant information discovery, real-time situation awareness, and predictive analysis from web sources.
  • Detection: NIDS and HIDS detect malicious activity through network signature matching or host indicators of compromise, respectively.
  • Prevention: IPS complements firewalls by detecting traffic-based exploits and automatically dropping packets, blocking sources, resetting connections, or sending alarms.
  • Access and host protection: Proxies shield private networks, ACLs permit or deny traffic using network properties, and DEP prevents malicious code from running through expected-memory enforcement.Antivirus tools use either known signatures or behavior observed in sandbox environments.
  • Traffic management: Traffic segmentation enables bottleneck and threat analysis, while slowing or selectively dropping malicious traffic can increase the attack cost.

9) QoS:

Attack representation methods model network attacks using structures such as attack graphs and attack trees, but their construction becomes difficult to scale as networks grow. These scalability limits can affect the usefulness of attack representations for evaluating MTDs.

  • Purpose: Attack representations use vulnerability and reachability information to characterize known attacks and quantify attack and defense surfaces for MTDs.The survey presents attack graphs and attack trees as two widely used representation methods.
  • Attack Trees: Attack trees represent monotonic attack paths using AND nodes for combined conditions and OR nodes for alternative ways to reach a goal.The paper illustrates attack trees with a network scenario involving FTP and SSH vulnerabilities.
  • Attack Graphs: Attack graphs represent attack propagation from an attacker’s current privileges to a goal state such as data exfiltration or root privileges.Their nodes and edges encode exploit conditions and consequences.
  • Scalability: Construction time for attack representation methods grows exponentially with the number of hosts or known vulnerabilities.Proposed mitigations include monotonicity assumptions, logical representations, hierarchical structures, and distributed computation with semantic clustering.
  • Scalability: The effectiveness of hierarchical attack-representation methods on real-world networks remains uncertain.Table III highlights scalability as a major concern that can affect MTD effectiveness.

III. CATEGORIZING MOVING TARGET DEFENSES

The survey categorizes MTDs by what they move, when they move, and how they move. It uses configuration spaces, timing functions, and stochastic movement strategies to organize defenses across cyber-system surfaces.

  • MTD Model: An MTD is represented as ⟨M, T, C⟩, where M specifies how to move, T specifies when switching occurs, and C specifies what configurations can be switched.This notation provides a common framework for comparing MTD designs.
  • Movement Strategy: The movement function M should be stochastic because deterministic movement can be learned by an attacker over time.Configuration space C and timing function T are often selected by the system administrator according to the threat model.
  • Configuration Set: The survey groups movable system components into exploration, attack, detection, and prevention surfaces.In multistage attacks, adversaries may need to exploit these surfaces without following a predefined order.
  • Multiple Surfaces: Most existing MTDs shift one surface at a time and rarely shift multiple surfaces in conjunction.The survey identifies defenses that shift multiple surfaces as an area for further research.
  • APT Coverage: Shifting exploration and attack surfaces is effective against only some APT phases, whereas shifting detection and prevention surfaces applies throughout the APT life-cycle.Figure 3 maps APT phases to the surfaces targeted by MTDs.

1) Exploration Surface Shifting:

Exploration-surface MTDs make reconnaissance information noisy, inaccurate, or unreliable, limiting the attacker’s ability to construct a dependable view of the target. Approaches include address mutation, topology obfuscation, deceptive responses, and strategic honeynet placement.

  • Exploration Surface: Exploration-surface shifting aims to make reconnaissance about ports, topology, bandwidth, software, and vulnerabilities noisy or inaccurate.The attacker must then operate with a faulty view of the attack surface.
  • Address Mutation: Random Host Mutation assigns hosts unpredictable virtual IP addresses and changes the one-to-one host-to-address mapping at each switch.Its configuration space consists of bipartite graphs mapping virtual addresses to hosts.
  • Information Obfuscation: Topology-obfuscation methods create noisy and unreliable network views by changing possible paths between a crossfire attack’s source and destination.Other methods move host fingerprints, alter transmission schedules, or return incorrect information to network queries.
  • Deception: Strategically deploying selected honeynets introduces deception against noisy-rich attackers while reducing the expense of deploying every possible honeynet.The configuration space represents the possible honeynet placements.
  • Attack Surface Shifting: Attack-surface MTDs commonly invalidate an attack action by switching the underlying platform or system configuration.For example, an exploit targeting Linux is ineffective against a machine running Windows.
  • Design Trade-off: Selecting configurations involves a trade-off between minimizing similarity across consecutive configurations and limiting performance impact.The survey identifies this multi-objective trade-off as common across MTD research.

4) Prevention Surface Shifting:

Prevention-surface shifting makes attackers uncertain about deployed defenses, but remains comparatively scarce because it commonly assumes highly accurate attack identification. Hybrid defenses that shift multiple surfaces are also rare and face coordination challenges.

  • Prevention-surface MTDs increase attacker uncertainty by shifting the defense mechanism itself, forcing greater resources and more sophisticated exfiltration methods.
  • Prevention-surface shifting has been scarce in computer networks because administrators often need highly accurate attack identification before using these defenses.
  • Examples include changing bandwidth after malicious activity, varying reply latency, and switching among decoy nodes to hide the prevention surface.
  • Hybrid MTDs that shift multiple surfaces remain rare, although proxy replacement can reduce the value of attackers’ accumulated exploration and protect against proxy harvesting attacks.
  • Integrating multiple surface-shifting mechanisms is challenging because some surfaces suit centralized control while others are better managed decentrally.

2) Variable Period Switching (VPS):

Variable Period Switching varies move timing according to system conditions, events, beliefs, or strategic reasoning rather than using a uniform interval. The survey frames movement design through Markov games, including single-stage strategies and cost-aware rewards.

  • Variable Period Switching (VPS): Variable Period Switching changes the interval between moves according to the present system condition, with unequal residence times across configurations.
  • On-event Switching: On-event switching triggers movement after events such as attack detection, link unavailability, or server unavailability, often immediately.
  • Strategic: Strategic timing can represent discrete move times from 0 through tmax and choose between staying in the current configuration and switching to another.
  • Strategic: Adding time to the state can cause state-space explosion and time-intensive policy computation, motivating simpler potentially sub-optimal timing strategies.
  • Movement Function M: The survey maps MTDs to Markov games, where defender strategies over configurations induce a movement strategy M.
  • Single-Stage Modeling: Single-stage normal-form games produce stochastic movement policies from equilibrium mixed strategies over defender configurations.

2) Multi-Stage Modeling:

Multi-stage MTD models account for system history, future consequences, or both, using repeated games, attack representations, and Markov-game formulations. These models can improve security reasoning but may omit performance costs, reduce scalability, or rely on imperfect reward estimates.

  • Multi-Stage Modeling: Multi-stage models reason about the system’s history, future rewards, or both when selecting movement policies.
  • Multi-Stage Modeling: Repeated-game formulations can neutralize earlier attacker advantages by changing later defender actions, such as reducing bandwidth after packet-flooding attacks.
  • Multi-Stage Modeling: Attack graphs and partially observable models represent sequential attack paths while accounting for imperfect defender sensing.
  • Multi-Stage Modeling: Multi-element IP-hopping actions can increase defender reward more than static defense strategies, but the cited model omits hop costs and switching downtime.
  • Multi-Stage Modeling: Some Markov-game approaches encode security-performance trade-offs in rewards, while time- and attack-aware state modeling can become vulnerable to informed attackers and less scalable.
  • Multi-Stage Modeling: Deception-focused repeated interactions use Nash equilibrium for one problem and Stackelberg equilibrium for identifying decoy nodes, while optimization and scalability remain research opportunities.

A. Middleboxes for enabling Moving Target Defenses

Middleboxes offer a decentralized route to implementing MTDs, while SDN/NFV provide programmable and virtualized infrastructure for dynamic defenses. However, traditional middlebox deployments can increase misconfiguration, outage, and adoption risks, and most surveyed implementations remain below production maturity.

  • Middleboxes provide network functions such as web proxies, firewalls, and IDS that can support decentralized MTD strategies.
  • Traditional middlebox deployments face misconfiguration and overload failures, while MTD integration can increase network misconfiguration and outage risks.About 9% of administrators reported spending six to ten hours weekly handling middlebox failures, and enterprises update middleboxes every four years in the median case.
  • SDN decouples control and data planes, enabling centralized network visibility, control, and programmable forwarding.
  • NFV virtualizes hardware-based functions such as firewalls, routers, and IDSs through VMs or containers, reducing MTD implementation costs.
  • 34% of surveyed research works use SDN/NFV to implement MTD or cyber-deception techniques.
  • More than 50% of research works use simulations, approximately 34% use emulation, and approximately 13% reach commercial implementation.

1) SDN-based Network Mapping and Reconnaissance Protection:

SDN-based MTDs protect reconnaissance and attacks by obscuring services, altering responses, mutating addresses, modifying routes, and regulating malicious traffic. Case studies apply these mechanisms to host mutation, game-based rate limiting, and VM migration under denial-of-service attacks.

  • SDN-based Network Mapping and Reconnaissance Protection: Reconnaissance scans reveal connectivity, firewall configurations, hop counts, software versions, and operating-system information.
  • SDN-based Network Mapping and Reconnaissance Protection: SDN devices can return random responses and introduce TCP-handshake delays, increasing attacker effort and delaying attack propagation.
  • SDN-based Network Mapping and Reconnaissance Protection: SDN rate limiting uses flow-table instructions to reduce bandwidth for malicious nodes, countering flooding and loss-of-availability attacks such as DDoS.The cited game-based approach represents attacker-defender interaction across multiple rounds and reduces bandwidth after defection.
  • SDN-based Network Mapping and Reconnaissance Protection: SDN controllers can substitute bogus service and OS profiles for real versions, misleading scanning tools about vulnerable targets.
  • SDN-based Network Mapping and Reconnaissance Protection: SDN-based countermeasures include network shuffling, route modification, and IP or port obfuscation against targeted attacks such as SQL injection and DDoS.
  • SDN-based Network Mapping and Reconnaissance Protection: Frequency-minimal MTD selects VM migration timing using resource availability, QoS, and exploit probability, while migration location considers capacity and bandwidth.VM reputation is also used to assess migration suitability, and the mechanism is reported as highly effective against DoS attacks.
  • SDN-based Network Mapping and Reconnaissance Protection: OpenFlow Random Host Mutation links stable real IPs to short-lived virtual IPs and uses centralized mutation across the network.The scheme formulates a constraint satisfaction problem to maintain mutation rate and unpredictability, with higher mutation rates for sensitive hosts.
  • SDN-based Network Mapping and Reconnaissance Protection: 99% of information-gathering and external-scanning attempts were thwarted by OpenFlow Random Host Mutation in Mininet with the NOX controller.The framework is also reported as effective against worms and zero-day exploits.

D. MTD Testbeds: Research and Prototyping

MTD testbeds and platforms support experimentation from distributed virtual networking to cloud automation, VM migration, high-fidelity simulation, and SCADA IP hopping. Their implementations illustrate both research prototyping and operationally oriented deployment patterns.

  • MTD Testbeds: GENI provides an at-scale distributed environment with isolated virtual network slices and allocated computing resources for networking and security experiments.
  • MTD Testbeds: MTD CBITS automates cloud-system adaptations, including replacing running components, while recording parameters and changes in operational models.
  • MTD Testbeds: GENI supported a VM-migration MTD experiment on InstaGENI, where distributed users, controllers, services, and attacking VMs modeled DoS traffic.
  • MTD Testbeds: OpenStack provides compute, storage, and networking resources through graphical and API-based provisioning of isolated virtual networks.
  • MTD Testbeds: Mayflies uses VM introspection, checkpointing, and node reincarnation to respond quickly to attacks against inspected nodes.
  • MTD Testbeds: A SCADA IP-hopping platform uses gateway routers as dynamic proxies that mutate publicly exposed interface addresses while maintaining end-to-end communication.
  • MTD Testbeds: An OpenStack-based MTD testbed was proposed as future work for experiments involving pure-random and intelligent MTD strategies.
  • MTD Testbeds: CyberVAN uses ns-3 to model network latency, link capacities, routing, and wireless effects while allowing VM-based hosts to communicate over simulated networks.

5) MTD Commercial Domain Solutions:

Commercial and research MTD solutions span decoy networks, polymorphic software, and adaptive network mechanisms, but their evaluation must jointly consider security and performance. The survey finds that most defenses emphasize security while overlooking performance impacts and ensemble diversity.

  • MTD Commercial Domain Solutions: DeceptionGrid and CryptoTrap provide production-grade decoy networks that imitate assets, detect interaction, isolate compromised computers, and alert administrators.CryptoTrap masks replicated fake company data as SMB shares to counter ransomware propagation.
  • MTD Commercial Domain Solutions: Polyverse randomizes nearly every machine instruction while preserving semantic equivalence, producing polymorphic Linux software stacks against memory-based zero-day vulnerabilities.
  • MTD Commercial Domain Solutions: MorphiSec combines network-level route, address, and port changes with firewall-level policy changes to address evasive attacks.
  • MTD Commercial Domain Solutions: The survey evaluates MTD quality through security and performance considerations, including risk analysis, cost-benefit measures, and domain-informed metrics such as CVSS and attack graphs.
  • MTD Commercial Domain Solutions: Most proposed defenses emphasize security improvements while ignoring performance impacts on legitimate users.
  • MTD Commercial Domain Solutions: Ensemble-level evaluations often compare MTDs with static configurations without verifying that the static control is the most secure constituent defense.
  • MTD Commercial Domain Solutions: An effective MTD requires configurations sufficiently diverse that one attack cannot exploit the entire ensemble with minimal modification.The survey connects this concern to diversity measures and methods for generating diverse actions at low cost.

2) Performance Considerations:

MTD evaluation must account for both the performance costs of individual configurations and the costs of switching among them. The survey organizes quantitative evaluation around security, usability, and threat-model metrics.

  • Performance cost categories: MTD performance costs arise from both individual defense configurations and ensemble-level shuffling.Individual configurations may be intrinsically costly, while switching can introduce downtime, request-handling overhead, or the need to maintain multiple configurations.
  • Individual defense actions: Game-theoretic studies incorporate individual defense costs into defender utilities to favor low-cost configurations without sacrificing security.Equilibrium concepts can produce movement strategies that prioritize constituent defenses with lower performance costs.
  • Individual defense actions: Random path selection can increase packet-transfer time when an MTD chooses a highly sub-optimal route.This performance effect was observed in experiments against Crossfire attacks.
  • Ensemble performance: Ensemble-focused approaches minimize one-step switching costs or compare MTD usability against static configurations using latency and availability.These approaches may emphasize transition costs while omitting the performance impact of an intrinsically costly constituent configuration.
  • Quantitative evaluation: Quantitative MTD evaluation is categorized into security metrics and usability metrics, including CIA, attack representation, QoS, and threat-model measures.The survey also notes that quantitative measures are needed to relate movement levels to attack-success reduction and QoS or overhead changes.

2) Usability Metrics:

The survey treats usability as the operational cost of deploying MTDs, covering QoS, mission impact, deployment cost, and the effects of defense placement or adaptation. These measures expose trade-offs between security dynamics and system performance.

  • Usability dimensions: Usability metrics assess QoS, mission impact, and the cost of deploying MTD defenses.The survey specifically identifies network bandwidth, delay, existing mission metrics, and deployment cost as evaluation dimensions.
  • QoS metrics: Virtual-IP mutation studies constrain allocation and distribution to reduce collision-induced QoS impact while preserving unpredictability.These constraints target a balance between operational performance and the uncertainty produced by address mutation.
  • Mission metrics: Mission Success and Mission Productivity quantify QoS by measuring task completion and task success frequency under dynamic defenses.These measures were applied to ARCSYNE and SDNA alongside mission and adversary activity metrics.
  • Adaptability and strategy: Diversity-based MTD was identified as optimal against most attack scenarios, while uncertainty about adversary type reduced effectiveness.The comparison covered uniform, random, diversity-based, evolution-based, and optimal strategies against static and dynamic attacks.
  • Deployment cost: Cost-effective VM migration in an SDN-based network had limited impact on network performance.The analysis modeled availability, downtime, and downtime cost, using normalized CVSS scores to initiate migration.
  • Detection placement: Adding detection agents beyond 15 provided no additional intrusion-detection benefit, while throughput fell from 16 Gbps to approximately 6 Gbps.The result illustrates the usability cost of excessive IDS placement in the simulated cloud network.
  • Cost metrics: MTD cost-benefit analysis can combine adaptation cost, attack success probability, mission productivity, and hop-delay.The survey notes that DNAT reduced attack success probability but that frequent path calculations may create scalability challenges.

VI. RESEARCH OPPORTUNITIES

The survey identifies underexplored MTD surfaces, coordinated multi-surface movement, microsegmentation, and timing as research opportunities. It emphasizes that timing choices depend on the threat model and shifted elements, while theoretical timing models can face scalability limits.

  • Surface movement: MTD research has focused mainly on exploration, detection, and attack surfaces, leaving prevention-surface movement comparatively underinvestigated.Prevention surfaces include security modules such as firewalls and intrusion-prevention systems.
  • Surface movement: Next-Generation Firewall architectures are proposed as a direction for testing multi-layered, defense-in-depth MTDs.The survey names firewall, content-filter, and antivirus modules as components of such architectures.
  • Multi-surface movement: Coordinating multiple surfaces may provide greater security benefits, but requires compatible configuration sets to prevent strategy proliferation.The survey suggests using system-designer expertise to keep the number of strategies manageable.
  • New software surfaces: MTD formalism could be applied to microsegmentation, which creates secure zones to isolate and individually secure workloads.The survey presents microsegmentation as an example of another logical software-surface distinction.
  • Timing: 15-second switching periods were reasonable for jamming protection, whereas 60-second periods were needed for network-mapping defense.Feasible lower bounds also differ between changing a virtual IP address and changing the underlying virtual machine.
  • Timing: Empirical timing studies are incomplete, and theoretical timing models can become unscalable as time expands the state space.The survey calls for broader timing studies and improved modeling for larger networks.

C. The Movement Function (How to Move?)

The survey examines how MTD movement strategies are designed, modeled, implemented, and evaluated. It identifies randomization, AI and game-theoretic methods, implementation challenges, and open directions for more comprehensive defenses.

  • Movement strategies: Randomization is necessary for effective MTDs, while game-theoretic modeling can use system and attack information to improve security and performance.Uniform Random Strategy is common, but informed strategies may offer higher gains.
  • Movement strategies: Existing MTD approaches for Advanced Persistent Threats use attack graphs but do not scale well.
  • Research limitations: Realistic attacker behavior remains insufficiently modeled, because strong threat-model assumptions make reported defense effects questionable.
  • Evaluation: MTD evaluations do not yet cover all four proposed metric types, and real-world attacker testing remains scarce.This limits prioritization of which metrics defenders should emphasize.
  • Implementation and safety: MTD deployment requires policy verification and regression testing because movement can create conflicting security policies and a new attack surface.Safe movement policies can incorporate policy conflicts directly into the MTD model.
  • Future directions: The survey’s categorization supports designing novel MTDs by combining movement surfaces, timing, game models, reward functions, and testbed evaluation.Its broader synthesis also links software-surface movement to APTs and identifies simultaneous movement of multiple surfaces as an open direction.
Loading 1905.00964v2…