PaperlayerView exact revision on arXiv

Source-linked AI summary

Toward Proactive, Adaptive Defense: A Survey on Moving Target Defense

Jin-Hee Cho, Dilli P. Sharma, Hooman Alavizadeh, Seunghyun Yoon, Noam Ben-Asher, Terrence J. Moore, Dong Seong Kim, Hyuk Lim, Frederica F. Nelson

arXiv:1909.08092v1cs.NIcs.GT

TL;DR

The survey examines how moving target defense can address limitations of conventional security mechanisms across diverse attack, design, and application settings. It synthesizes MTD classifications, methodologies, metrics, evaluation methods, and domains, then derives lessons and future research directions.

  • Problem

    Conventional security mechanisms have limited applicability in challenging environments such as IoT systems with large scale and severe resource constraints.

  • Method

    The paper conducts a comprehensive survey of MTD techniques, classifications, design dimensions, attack behaviors, application domains, metrics, algorithms, and evaluation methods.

  • Results

    The survey summarizes MTD insights and lessons learned and identifies future research directions.

  • Takeaways & Limitations

    MTD research spans proactive defense techniques and their evaluation across multiple attack behaviors and application domains.

  • Takeaways & Limitations

    Most MTD approaches assume attackers follow certain attack patterns rather than learning and launching adaptive attacks.

Abstract

from arXiv · show

Reactive defense mechanisms, such as intrusion detection systems, have made significant efforts to secure a system or network for the last several decades. However, the nature of reactive security mechanisms has limitations because potential attackers cannot be prevented in advance. We are facing a reality with the proliferation of persistent, advanced, intelligent attacks while defenders are often way behind attackers in taking appropriate actions to thwart potential attackers. The concept of moving target defense (MTD) has emerged as a proactive defense mechanism aiming to prevent attacks. In this work, we conducted a comprehensive, in-depth survey to discuss the following aspects of MTD: key roles, design principles, classifications, common attacks, key methodologies, important algorithms, metrics, evaluation methods, and application domains. We discuss the pros and cons of all aspects of MTD surveyed in this work. Lastly, we highlight insights and lessons learned from this study and suggest future work directions. The aim of this paper is to provide the overall trends of MTD research in terms of critical aspects of defense systems for researchers who seek for developing proactive, adaptive MTD mechanisms.

I. INTRODUCTION

This survey addresses limited comprehensive understanding of moving target defense (MTD) by organizing existing work around operations, attacks, methodologies, metrics, evaluation, applications, and limitations.

  • A. Motivation: MTD research has roots in fault tolerance, reconfigurable computing, and software or network diversity, but its overall trends have been less comprehensively studied.Earlier survey efforts examined selected architectural, operational, or strategic dimensions.
  • B. Comparison of Our Work and Existing MTD Survey Papers: Existing surveys differ in classifications and coverage, motivating a comparison of contributions, design dimensions, and principal research questions.The questions address attacks, techniques, methodologies, limitations, and unavailable effectiveness metrics.
  • C. Key Contributions & Scope: The survey classifies MTD techniques by three operation types: shuffling, diversity, and redundancy, across system and network layers.The operation-based classification groups techniques by common goals rather than deployment layer alone.
  • C. Key Contributions & Scope: It investigates attack behaviors addressed by existing MTD techniques and discusses limitations of current attack models.The survey frames attack analysis through the operation-based classification.
  • C. Key Contributions & Scope: The survey covers MTD methodologies, including game theory, genetic algorithms, and machine learning, together with analytical, simulation, emulation, and testbed evaluations.It also surveys metrics for performance and security from attacker and defender perspectives.
  • C. Key Contributions & Scope: It examines applications across enterprise networks, IoT, cyber-physical systems, software-defined networks, and cloud computing.The survey also discusses insights, limitations, and future research directions.

D. Paper Structure

The paper surveys MTD across classifications, attack behaviors, methodologies, metrics, evaluation methods, and application domains. It also explains MTD’s roles in prevention and attacker detection while emphasizing affordable, service-oriented defense.

  • Paper organization: The survey covers MTD classifications, addressed attacks, theoretical approaches, metrics, evaluation methods, and applications across five domains.Applications include enterprise networks, IoT, CPSs, SDNs, and cloud-based web services.
  • Paper organization: The paper includes dedicated sections on MTD principles, classifications, operation types, attacks, algorithms, metrics, evaluations, applications, limitations, and future directions.The structure spans Sections II–XI.
  • Key roles: MTD reduces intrusion risk by changing the attack surface, limiting attackers’ discovery of vulnerable components and penetration attempts.Examples include IP mutation, topology changes, platform migration, and software-stack shuffling.
  • Key roles: MTD also assists intrusion detection by increasing attack complexity and exposing attack patterns through monitoring activities such as scanning.This can provide IDSs with information for improving detection of potential attacks.
  • Design principles: MTD aims for affordable, service-oriented defense by minimizing defense cost, maximizing availability, and meeting required security levels.Its underlying idea is rearranging configurations while retaining existing security mechanisms.

B. Key Design Principles

MTD design is organized around what to move, how to move it, and when to move it. These choices balance attacker uncertainty and expired attack information against service availability, defense cost, and resource constraints.

  • What to move: MTD dynamically changes attack-surface attributes such as instruction sets, layouts, addresses, ports, virtual machines, operating systems, and software.The changed attribute should invalidate attacker progress and offer enough possible values to resist brute-force prediction.
  • How to move: How to move determines unpredictability through randomization or artificial diversity, corresponding to shuffling, diversity, and redundancy operations.These operations rearrange or diversify system and network attributes.
  • When to move: Proactive movement regularly expires attacker information but adds delay, whereas hybrid adaptation bounds adaptive intervals to address undetected threats.Reactive movement responds to suspicious-activity alerts under an assumption that attacker actions are detected.
  • Benefits: MTD can leverage legacy components and existing technologies to provide affordable defense alongside intrusion detection and defensive deception.MTD may migrate the platform after deception is recognized, invalidating vulnerabilities learned from the current configuration.
  • Caveats: Frequent MTD operations can reduce service availability, while non-adaptive execution may waste defense cost without meeting security or cost goals.These caveats make movement timing and adaptive resource allocation important design concerns.
  • Caveats: Executing MTD in decentralized, resource-constrained environments remains insufficiently studied because trusted infrastructure and lightweight operations may be unavailable.The issue is especially relevant to mobile ad hoc, wireless sensor, and IoT networks.
  • When to move: When to move uses time-based, event-based, or hybrid adaptation to determine when the system transitions to a new state.Time-based movement may use fixed or variable intervals; event-based movement responds to attacks or alerts; hybrid movement combines both.

B. Operation-based MTD

Operation-based MTD distinguishes shuffling, diversity, and redundancy, which can be combined and mutually reinforce security, resilience, and dependability. Their effectiveness depends on coordination and tradeoffs involving cost, availability, and attacker adaptation.

  • Shuffling: Shuffling rearranges configurations to increase attacker confusion and uncertainty by making collected information obsolete or wasting reconnaissance resources.It can prevent or delay access and give IDSs more time to monitor behavior and prepare responses.
  • Diversity: Diversity deploys different implementations with equivalent functionality to enhance resilience and fault tolerance.Examples include diverse routing paths and migration across software or hardware platforms.
  • Redundancy: Redundancy provides replicas or alternative paths and components to preserve reliability or availability when some components are compromised.It maintains equivalent services through multiple network or application-layer implementations.
  • SDR relationships: Shuffling can increase diversity, but its security benefit depends on the available variety of implementations and the cost or service interruption caused by rearrangement.Optimal shuffling can increase resilience, while limited software diversity constrains achievable performance.
  • SDR relationships: High diversity and effective shuffling increase redundancy and reliability, whereas high redundancy with low diversity can expose alternate attack paths.SDR types therefore affect one another rather than operating as isolated categories.
  • MTD and deception: MTD and deception share attacker-confusion goals, but deception intentionally provides false information whereas MTD changes the attack surface without necessarily doing so.Deception is treated as MTD here when dynamically deployed deception changes the attack surface.

3) Differences between MTD and Deception:

MTD differs from deception by changing system configurations rather than intentionally presenting false information, and its techniques can be classified by when or how they move. The survey covers shuffling and migration approaches across networks, clouds, and services, while emphasizing cost, security, and availability tradeoffs.

  • MTD changes system configurations to control the attack surface, whereas deception intentionally presents false information to form attackers’ false beliefs.
  • Timeliness-based classification answers when to move, while operation-based classification answers how to move.
  • Event-based MTD can trigger adaptations from intrusion alerts after defenders gain greater certainty about attack patterns, helping save defense cost.
  • Operation-based techniques include shuffling, diversity, redundancy, and hybrid combinations that may improve security but introduce cost or service-availability issues.
  • Surveyed applications include IP and port shuffling, route and topology changes, VM migration, proxy shuffling, and service-deployment strategies.
  • A proposed cloud MTD deployment strategy was more effective under dense service deployment and strong attacks, while awareness of attack-surface heterogeneity and dynamics helped determine when and how to act.

6) Software / Service Reconfiguration:

Software and service reconfiguration applies shuffling, diversity, and redundancy across operating systems, platforms, applications, and network components. These approaches reuse existing technologies, but their security remains bounded by underlying vulnerabilities and their effectiveness is not always evaluated.

  • Shuffling-based reconfiguration changes cryptosystems, firmware versions, HTML elements, or host platforms to vary exposed software and service configurations.
  • Platform-diversity frameworks can live-migrate critical applications across heterogeneous hardware and operating systems to create a cyber moving target.
  • MORE rotates virtual machines with different Linux distributions and web applications, limiting the duration of an OS exposure through a defined rotation window.
  • Shuffling and diversity can leverage existing technologies, making them compatible with legacy devices and immediately applicable without developing a new security mechanism.
  • MTD security gains remain bounded by vulnerabilities in the technologies being leveraged, which may persist even with a diverse software stack.
  • Redundancy provides multiple replicas with the same functionality, but one web-server approach did not investigate the effectiveness of its proposed MTD mechanism.

2) Redundancy of Network Sessions:

Redundancy-based MTD maintains multiple network or service paths to support availability and performance while contributing to defense. The survey finds that hybrid designs are promising, but their added cost, complexity, and tradeoffs require careful evaluation.

  • Traffic morphing protects CPS sessions by maintaining redundant network sessions whose inter-packet-delay distributions resemble normal sessions.
  • The traffic-morphing method showed low complexity and high adaptivity while sending each CPS message through one session to meet its time constraint.
  • Redundancy has a stronger connection to user service availability than shuffling or diversity, but creating replicas adds cost and can enlarge the attack surface if poorly executed.
  • Combining shuffling and redundancy was evaluated using System Risk and Reliability, while another combination used Risk, Attack Cost, and Return on Attack.
  • Shuffling plus diversity optimally met the stated multiple objectives, whereas either technique alone did not.
  • Hybrid MTD can maximize security while minimizing defense cost or maximizing service availability when properly implemented, but additional overhead and complexity remain unavoidable.
  • The survey identifies a large volume of shuffling-based work but says tradeoffs between reduced vulnerabilities, defense cost, and service availability remain insufficiently investigated.
  • Redundancy mainly supports service availability or reliability, while hybrid MTD requires careful examination before deployment to optimize multiple objectives.

B. Cyber Kill Chain

The survey examines attack behaviors addressed by MTD and identifies important gaps in current attack models. Existing approaches mainly target reconnaissance, DoS, and APT attacks, while intelligent and multi-strategy attackers remain underrepresented.

  • DoS attacks: Hidden proxies, IP/port shuffling, and address mapping are common countermeasures for flooding and related network attacks.NetHide changes path-tracing probes to obstruct advanced link-flooding attacks.
  • Attacks considered: Reconnaissance, DoS, and APT attacks are the three major attack types addressed by existing MTD techniques.The survey covers 36 papers published from 2010–2018, allowing multiple attacks or techniques per study.
  • Attacks considered: Most proposed approaches use shuffling-based MTD, often combined with diversity, whereas redundancy is rarely used for these attacks.Redundancy-based techniques are more commonly associated with dependability research and are often combined with other MTD approaches.
  • Limitations of attack models: Current attack models underconsider intelligent attackers that learn defense patterns and trigger MTD operations accordingly.The survey specifically notes that highly intelligent, learning attackers are rarely considered.
  • Limitations of attack models: Few studies model attackers and defenders using multiple strategies, leaving systems exposed when an attacker exploits an uncovered attack type.Most MTD approaches focus on a single attack or a small set of attacks.
  • Limitations of attack models: Attacker rationality and learning ability are also rarely incorporated into models of adaptive MTD.The survey highlights the limited study of attacker mental models and learning-based interaction with intelligent defenders.

VI. MODELING AND SOLUTION TECHNIQUES OF MTD

The survey reviews game theory, genetic algorithms, and machine learning as principal approaches for modeling and designing MTD. Game-theoretic methods dominate because they represent attacker–defender utilities and strategic interactions, but rely on assumptions that may not hold universally.

  • Core approaches: MTD modeling and solution techniques are organized around game theory, genetic algorithms, and machine learning.These approaches are surveyed as the main theoretical methods used to develop MTD techniques.
  • Game theory: Game-theoretic MTD models attacker–defender interactions using competing utilities, including security gains, reconfiguration costs, and service availability.The defender seeks to reduce risk and preserve availability while the attacker seeks to maximize system damage.
  • Game theory: General, Bayesian Stackelberg, and stochastic games are common frameworks for representing MTD interactions and probabilistic state transitions.Stackelberg games model leader–follower decisions, while stochastic games represent repeated actions across changing states.
  • Advantages: Game theory supports mature formulations of strategic choice, multi-objective utility, and adaptive behavior between attackers and defenders.These advantages explain why game-theoretic approaches are extensively used in MTD research.
  • Limitations: Game-theoretic MTD can be limited by unrealistic complete-information assumptions, attacker irrationality, and decision-making misperception.Incomplete-information models address some uncertainty, but attackers may not behave as rational utility maximizers.

B. Genetic Algorithm-based MTD

The survey describes genetic algorithms, evolutionary methods, and machine learning as tools for selecting configurations, optimizing shuffling, and adapting defenses. Their usefulness is constrained by fitness-function design, data requirements, computational cost, and scalability.

  • Genetic algorithms: Genetic algorithms identify secure or near-optimal system configurations by ranking candidate configurations according to attack resilience.Configurations are represented as chromosomes, with evolutionary operations generating alternatives.
  • Genetic algorithms: GA-based MTD has been applied to optimize network shuffling in SDN-based IoT networks using attack paths, mean time to security failure, and defense cost.The approach considers both real and decoy IoT nodes.
  • Trade-offs: Genetic algorithms can seek optimal solutions, but fitness functions must reconcile multiple conflicting MTD objectives and large search spaces can reduce scalability.Centralized decision-making may also be difficult to guarantee in fully distributed environments.
  • Machine learning: Machine-learning MTD can learn evolving attack patterns, hinder attacker learning, or select defense strategies when sufficient data and computation are available.Examples include predictive MTD, reinforcement learning, and game-theoretic switching among neural networks.
  • Trade-offs: ML-based MTD performs less effectively with limited data and may be impractical in resource-constrained environments because of computational demands and complexity.The survey identifies data availability and computational power as important deployment conditions.

VII. METRICS FOR MTD

The survey finds that MTD effectiveness lacks a standard measurement framework and therefore reviews attacker- and defender-oriented metrics. Attack success, game-theoretic utility, and system-level vulnerability or reliability are the dominant metric families.

  • Metric framework: No standard metrics have been proposed to measure the effectiveness or efficiency of MTD techniques.The survey organizes existing measures according to attacker and defender perspectives.
  • Attacker metrics: Attack success probability measures whether an attacker successfully performs an attack, compromises a component, or discovers a target.Attackability is a related measure of the probability that an attacker can access system states or components.
  • Attacker metrics: Attacker-oriented measures also include attack utility, attacker learning, mean time to compromise, unpredictability, and attack surface.These metrics capture attacker gain, learning, time to compromise, induced uncertainty, and exploitable system resources.
  • Defender metrics: Defender-oriented measures include defense success probability, mean time to failure, defense utility, defender learning, and system security properties.Security properties include confidentiality, integrity, availability, and degree of vulnerability.
  • Additional metrics: Additional measures cover controllability, worm propagation speed, vastness, periodicity, uniqueness, revocability, distinguishability, and deployment loss.Deployment loss compares an executed MTD operation with an optimal deployment.
  • Observed trends: Attack success probability, attacker or defender utility, and system-level vulnerability or reliability are the dominant metric trends across 27 surveyed papers.The survey notes that multiple metrics may appear in a single paper.

B. Metrics for Measuring MTD Efficiency

MTD efficiency is assessed from attacker and defender perspectives using cost, performance, security, and service-quality measures. Defender metrics emphasize system performance and defense cost, while QoS and multi-objective tradeoffs remain less studied.

  • Attacker Metrics: Attacker metrics quantify the resources or penalties required to achieve attack success, primarily through attack cost and penalty in attack payoff.Scanning overhead and abstract game-theoretic costs are common examples.
  • Defender Metrics: Defender metrics include QoS, system performance, defense cost, address-space overhead, flow-table size, integrated performance cost, strategy switching cost, and power consumption.These measures capture service quality, deployment overhead, resource requirements, and operational costs.
  • Defender Metrics: 25 papers published during 2011–2018 summarized defender-oriented MTD efficiency metrics, with metric counts differing from paper counts because studies may use multiple metrics.The survey presents these measures in Fig. 8.
  • Metric Coverage: Most defender-oriented metrics measure system performance or defense cost, whereas user QoS and seamless service availability receive significantly less attention.The survey frames this imbalance as a tradeoff among security, defense cost, and service availability.
  • Evaluation Methods: MTD evaluation uses analytical models, simulation models, emulation models, and real testbeds.These methods provide different ways to assess performance and security across deployment settings.

A. Analytical Model-based MTD Evaluation

MTD studies evaluate performance through analytical, simulation, emulation, and real-testbed methods. Analytical and probabilistic models provide low-cost insight into general behavior, while more realistic methods improve validity but introduce scale or usage constraints.

  • Analytical Models: Probabilistic models represent system, attacker, defender, and interaction behaviors through parameters and can estimate measures such as mean time to security failure and attack-surface probability.Examples vary network size, honeypot deployment, vulnerable nodes, or MTD diversity frequency.
  • Analytical Models: Probabilistic models provide general behavioral insights at low evaluation cost, but parameterization imposes abstraction that may omit deviations or unexpected real-world effects.This tradeoff limits how faithfully such models represent application scenarios.
  • Graph-Based Models: Graph-based security models use attack graphs and attack trees, including hierarchical models that represent network reachability and lower-layer vulnerabilities.They support visualization, vulnerability analysis, and computation of security metrics.
  • Simulation, Emulation, and Testbeds: Simulation models offer greater flexibility than analytical models for representing specific attack behaviors and environmental scenarios, and most MTD studies use simulation experiments.Emulation can improve validity and realism, while real testbeds provide realistic environments but are difficult to scale.
  • Simulation, Emulation, and Testbeds: Real testbeds verify MTD performance in realistic environments but usually remain limited to small or mid-sized networks.The principal constraint is difficulty evaluating MTD techniques in large-scale networks.

IX. APPLICATION DOMAINS OF MTD TECHNIQUES

MTD techniques are applied across enterprise networks, IoT, CPS, SDNs, and cloud-based web services. Across these domains, shuffling, mutation, diversity, migration, and related adaptive mechanisms are evaluated against domain-specific attacks and constraints.

  • Application Domains: The survey examines MTD applications in enterprise networks, IoT, CPS, SDNs, and cloud-based web services.It compares techniques, attacks, methodologies, and evaluation methods across these environments.
  • Enterprise Networks: Enterprise networks commonly use shuffling or diversity-based MTD because homogeneous, static configurations make attacks easier to plan.Game-theoretic attack-defense models and simulation experiments are common in this domain.
  • Attacks and Evaluation: MTD deployments in these domains address attacks including reconnaissance, code injection, eavesdropping, traffic analysis, scanning, brute-force login, zero-day exploitation, and DDoS.The specific attack mix varies across enterprise, IoT, and CPS settings.
  • Internet-of-Things (IoT): IoT MTD commonly mutates cryptosystem or firmware versions, randomizes IP addresses, rotates IPv6 addresses, or partitions and diversifies code.Resource constraints involving CPU, energy, memory, bandwidth, and packet loss limit effectiveness.
  • Cyber-Physical Systems: CPS applications include lightweight adaptive packet morphing, instruction-set randomization, and IP hopping for vehicular, SCADA, and power-grid systems.Evaluations span simulations, the PowerCyber testbed, and emulated large-scale networks.
  • Cyber-Physical Systems: SCADA-focused MTD adds a defense layer for geographically distributed infrastructure whose failure can affect national economic and safety interests.The survey highlights power grids, water distribution, pipelines, and transportation systems as relevant infrastructure contexts.

D. Software Defined Networks (SDNs)

SDN-based MTD exploits centralized control and programmability to mutate IP mappings, network topologies, flow tables, and packet headers. Its flexibility supports scalable defenses, but controller infrastructure and security-performance tradeoffs constrain deployment.

  • SDN Architecture: SDN separates the control plane from packet forwarding and uses a centralized controller to direct switch operations.This architecture provides flexibility, robustness, and programmability for MTD deployment.
  • MTD Techniques: IP shuffling or mutation is popular in SDN, with controllers updating OpenFlow switch flow tables as forwarding decisions change.Network topology shuffling and packet-header randomization are additional SDN MTD techniques.
  • MTD Techniques: An SDN IP multiplexing and demultiplexing deployment intercepts DNS responses, maps IP addresses, and updates OpenFlow switch flow tables.Fig. 13 depicts this centralized controller implementation.
  • Tradeoffs: Maintaining multiple SDN controllers can introduce extra overhead while improving scalability and potentially increasing MTD effectiveness.Deployment therefore requires tuning performance, defense cost, QoS, and security vulnerability together.
  • Open Problems: Across MTD research, few studies examine cooperation with IDS, IPS, deception, or firewalls beyond dynamically relocating detectors.The survey identifies broader integration and defense-cost reduction as underexplored.
  • Open Problems: Most existing MTD work focuses on reconnaissance-stage attacks, leaving effects against attacks beyond reconnaissance comparatively underinvestigated.This scope limits the demonstrated applicability of current techniques.
  • Open Problems: Optimal deployment of hybrid shuffling, diversity, and redundancy techniques remains unresolved across security, defense cost, and service availability objectives.The survey calls for multi-criteria optimization of combined MTD techniques.
  • Open Problems: Most MTD approaches rely on analytical or simulation models, while emulation and real testbeds are rarely used.The survey identifies a need for better experimental testbeds for verification and validation.

XI. CONCLUSIONS

The survey synthesizes MTD’s contributions, evaluation practices, and future research needs. It emphasizes proactive defense, cooperation with other mechanisms, multi-objective tradeoffs, and more adaptive, lightweight, comprehensive evaluation.

  • Insights & Lessons Learned: MTD can provide proactive, adaptive, and affordable defense by changing the attack surface while leveraging existing technologies.
  • Insights & Lessons Learned: MTD can complement other defenses by helping intrusion detection systems detect intrusions more effectively and providing an alternative when deception is detected.
  • Insights & Lessons Learned: MTD’s security benefits must be balanced against overhead and possible service interruptions for legitimate users.
  • Insights & Lessons Learned: The survey found diverse MTD solution techniques, with game-theoretic approaches dominant and genetic algorithms or machine learning also explored.
  • Insights & Lessons Learned: MTD effectiveness and efficiency are assessed with diverse attacker- and defender-oriented metrics, using simulations, analytical models, emulations, and real testbeds.
  • Future Research Directions: Future work should develop multidimensional classifications, more adaptive and lightweight mechanisms, user-availability metrics, and evaluation across security, performability, and economical cost.
Loading 1909.08092v1…