An Adaptive IP Hopping Approach for Moving Target Defense Using a Light-Weight CNN Detector

Abstract

Scanning attack is normally the first step of many other network attacks such as DDoS and propagation worm. Because of easy implementation and high returns, scanning attack especially cooperative scanning attack is widely used by hackers, which has become a serious threat to network security. In order to defend against scanning attack, this paper proposes an adaptive IP hopping in software defined network for moving target defense (MTD). In order to accurately respond to attacker’s behavior in real time, a light-weight convolutional neural network (CNN) detector composed of three convolutional modules and a judgment module is proposed to sense scanning attack. Input data of the detector is generated via designed packets sampling and data preprocess. The detection result of the detector is used to trigger IP hopping. In order to provide some fault tolerance for the CNN detector, IP hopping can also be triggered by a preset timer. The CNN driving adaptability is applied to a three-level hopping strategy to make the MTD system optimize its behavior according to real time attack. Experiments show that compared with existing technologies, our proposed method can significantly improve the defense effect to mitigate scanning attack and its subsequent attacks which are based on hit list. Hopping frequency of the proposed method is also lower than that of other methods, so the proposed method shows lower system overhead.

A Survey on Moving Target Defense for Networks: A Practical View

“…The MTD technique presented in [72] is based on IP hopping triggered by a timer or a detector, utilizing a lightweight convolutional neural network to detect threats. The architecture takes a multistep process to decide its strategy.…”

“…Out of the architectures utilizing SDN, by far the most popular choice to implement them was by using Mininet [124], although the choice of SDN controllers varied greatly. Among the most popular controllers used throughout the surveyed literature were POX [125], used by [94,101,109,112] and Ryu [59] used in [72,74,79,84]. Other choices of controllers include ONOS [55], which appeared in [73,86,120].…”

A Survey on Moving Target Defense: Intelligently Affordable, Optimized and Self-Adaptive

“…Hence, it is not a favorable way to categorize intelligent MTD techniques according to SDR/Five layers for the introduction. RL [34] Towards optimized RL [60][61][62][63][64][65][66][67][68] Towards self-adaptive DL [69] CNN [19] Neuro-evolution [14] Clustering [48] RL [36] RNN [70] 3.2.1. Towards Affordable One of the primary goals of MTD is to provide an affordable defense.…”

“…As a feasible solution to the IP hopping issue proposed in Section 2.3.4. Xu et al [19] proposed a CNN-based adaptive IP hopping approach to defending against scanning attacks. To achieve lightweight defense, they first compressed the CNN detector deployed in the control plane using deep compression techniques to reduce its storage and computational resource usage, improve its forward computational efficiency, and release its dependence on GPU computation cards in its usage phase.…”

“…In Section 3.2.1, we presented how Xu et al [19] proposed an adaptive IP hopping approach that not only performed a lightweight implementation in terms of system cost but also accomplished the adaptive processing of attacks. Their approach consists of a lightweight Convolutional Neural Network detector composed of three convolutional modules and a judgment module to sense scanning attacks and provide a CNN-based three-stage jumping strategy to achieve self-adaptation, which allows the MTD system to optimize its behavior in real-time according to the attacks.…”