ChameleonSoft: A Moving Target Defense System

Abstract

Ubiquitous cyber systems and their supporting infrastructure impact productivity and quality of life immensely. Their penetration in our daily life increases the need for their enhanced resilience and for means to secure and protect them. One major threat is the software monoculture. Latest research work illustrated the danger of software monoculture and introduced diversity to reduce the attack surface. In this paper, we propose a biologically-inspired defense system, ChameleonSoft, that employs multidimensional software diversity to, in effect, induce spatiotemporal software behavior encryption and a moving target defense. The key principles are decoupling functional roles and runtime role players; devising intrinsically-resilient composable online programmable building blocks; separating logic, state and physical resources; and employing functionally-equivalent, behaviorally-different code variants. Given, our construction, ChameleonSoft is also equipped with an autonomic failure recovery mechanism for enhanced resilience. Nodes employing ChameleonSoft autonomously and cooperatively change their recovery and encryption policy both proactively and reactively according to the continual change in context and environment. In order to test the applicability of the proposed approach, we present a prototype of the ChameleonSoft Behavior Encryption (CBE) and recovery mechanisms. Further, using analysis and simulation, we study the performance and security aspects of the proposed system. This study aims to evaluate the provisioned level of security by measuring the level of induced confusion and diffusion to quantify the strength of the CBE mechanism. Further, we compute the computational cost of security provisioning and enhancing system resilience. A brief attack scenario is also included to illustrate the complexity of attacking ChameleonSoft.

Moving Target Defense Techniques: A Survey

“…It maximizes the unpredictability by solving the optimal graph-coloring problem. Azab et al [91] proposed bionics-based software diversification for complex applications. It segments complex software into smaller tasks.…”

Moving target defense: state of the art and characteristics

“…To be more effective and practical, an MTD system should also be equipped with the reactive ability, which responds to an anomalous event observed or perceived (Carvalho et al, 2012). Currently, some existing mechanisms have been designed with active and reactive abilities simultaneously, such as ChameleonSoft (Azab et al, 2011) and moving attack surface (MAS) (Huang and Ghosh, 2011). In other words, the operation mode of MTDs is no longer consistent with the traditional PPDRR security model; i.e., the introduction of MTD changes the general defense process of traditional defense mechanisms and approaches, and produces a new security model accordingly.…”

“…Selection means choosing a new parameter with its value or assigning a new value to the previous moving parameter(s) from its(their) domain(s) through various ways, such as choosing randomly (Roeder and Schneider, 2010;Azab et al, 2011;Jafarian et al, 2012), choosing according to the game theory (Manadhata, 2013; Zhu and Başar, 2013;Carter et al, 2014), and choosing according to the attack behavior observed or the situation of cyber-security (Azab et al, 2011;Huang and Ghosh, 2011;Jia et al, 2013). Replacement is using the selected new parameter with its value or the selected new value to replace the old one.…”

“…In ChameleonSoft (Azab et al, 2011), large missions of a huge software program are divided into small tasks, and each task is assigned to one or more cells that would manually or automatically generate several variants for the task. The variants have different objectives targeting different Zhuang et al (2012) The system resources exposed to attackers (e.g., software, ports) as well as the compromised network resources a Zhu and Başar 2013The set of vulnerabilities exhibited by the system a Peng et al 2014The totality of the target system's externally accessible resources b Huang and Ghosh 2011Taking a virtual server pool with diversity as an example to graphically show the meaning and process of attack surface shifting b Manadhata 2013Defining the notion of attack surface shifting graphically and formally, in which the resources' contribution to the attack surface or the resources' shifting is crucial c Zhuang et al (2014b) (1) Putting forward a vast number of basic definitions to represent what is MTD;…”

“…As mentioned in Section 3, attack surface can be viewed as a set of all the properties of the system that can be used for attack. Attack surface reduction means reducing some of the properties, and the usual way to achieve attack surface reduction is to repair some vulnera- (Azab et al, 2011), end-to-end software randomly chosen to replace the current candidate) diversity (Christodorescu et al, 2011), practical software diversification (Pappas et al, 2013), SEM (Cui and Stolfo, 2011), proactive obfuscation (Roeder and Schneider, 2010), HMS (le Goues et al, 2013), NOMAD (Vikram et al, 2013), adaptive JIT code diversification (Jangda et al, 2015), OF-RHM (Jafarian et al, 2012), spatio-temporal address mutation (Jafarian et al, 2014), and MOTAG (Jia et al, 2013) Choosing by rotation (the next candidate is chosen SCIT (Bangalore and Sood, 2009), MAS (Huang and Ghosh, by turns) 2011), and MORE (Thompson et al, 2014) Choosing according to function (the next MT6D (Dunlop et al, 2011), RHM (Al-Shaer et al, 2013), candidate is calculated by a function) MTD-MANETs (Albanese et al, 2013), the SDN shuffle approach (MacFarland and Shue, 2015), the SDN-based frequency-minimal MTD approach (Debroy et al, 2016), and RPAH (Luo et al, 2015) Choosing according to game theory (this method Manadhata (2013), Zhu and Başar (2013), is used to provide a general method for attack and Carter et al (2014) surface shifting, and there can be multiple specific strategies under the guidance of this method) Choosing according to the attack behavior observed Spatio-temporal address mutation (Jafarian et al, 2014), and or perceived (the next candidate is chosen to TALENT (Okhravi et al, 2011b) meet some specific security requirements) * (The next candidate is chosen based on an MTD MTD strategy for cloud-based services (Peng et al, 2014) service deployment strategy proposed by authors) * (The selection probability for each candidate OF-RHM (Jafarian et al, 2012) directly relates to the weight that is associated with each candidate based on a certain criterion) * (The next candidate (new configuration) is chosen…”