Model-based evaluation of combinations of Shuffle and Diversity MTD techniques on the cloud

Alavizadeh, Hooman; Kim, Dong-Seong; Jang-Jaccard, Julian

doi:10.1016/j.future.2019.10.009

Cited by 18 publications

(14 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Yet, only looking at rmax does not capture cases where a defense cannot prevent an attack, but slows it down. Many proposed MTD techniques do not claim to fully prevent attacks, but making them more costly in terms of required effort and time [2,3,5]. This is what ravg j is for.…”

Section: Metricsmentioning

confidence: 99%

“…In consequence, Hong and Kim conclude that VM migration is effective to improve security. Further defense evaluation conducted using HARM [4,5] revealed that migration may increase the number of attack paths, yet not leading to any security degradation as VM migration would still fend these off. Instead, results indicate that the overall risk and the "return on attack" was ultimately lowered.…”

Section: Related Workmentioning

confidence: 99%

“…As a result, the typical information asymmetry between an attacker who may take as much time as needed to prepare an attack, and the defender who must be prepared at all times, shifts in favor of the defender, which is why MTD is frequently introduced as a "game changer" in IT security [12,16,18,43]. Frequently cited MTD techniques are, for example, IP address randomization [11,20,26,28,33], suggesting to repeatedly alter addresses of connected nodes, as well as virtual machine (VM) migration [1,3,5,18,24], a technique that has been proposed in different forms and suggests repeated relocation of VMs across hypervisors to move them out of the attacker's reach. A comprehensive overview of MTD techniques can be found in the recent survey from Cho et al [13].…”

Section: Introductionmentioning

confidence: 99%

“…To put findings into perspective, the same defenses as in prior research [8] are investigated. These comprise IP address randomization [11,20,26,28,33] (short: IP shuffling), state-preserving VM migration [1,5,24] which we denote as live migration, stateresetting VM migration [3,18] denoted as cold migration, as well as sole VM resetting. The first three are frequently proposed and discussed MTD techniques for which even prototypical implementations have been suggested.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Automated benchmark network diversification for realistic attack simulation with application to moving target defense

Bajic

Becker²

2021

Int. J. Inf. Secur.

View full text Add to dashboard Cite

With numbers of exploitable vulnerabilities and attacks on networks constantly increasing, it is important to employ defensive techniques to protect one’s systems. A wide range of defenses are available and new paradigms such as Moving Target Defense (MTD) rise in popularity. But to make informed decisions on which defenses to implement, it is necessary to evaluate their effectiveness first. In many cases, the full impact these techniques have on security is not well understood yet. In this paper we propose network defense evaluation based on detailed attack simulation. Using a flexible modeling language, networks, attacks, and defenses are described in high detail, yielding a fine-grained scenario definition. Based on this, an automated instantiator generates a wide range of realistic benchmark networks. These serve to perform simulations, allowing to evaluate the security impact of different defenses, both quantitatively and qualitatively. A case study based on a mid-sized corporate network scenario and different Moving Target Defenses illustrates the usefulness of this approach. Results show that virtual machine migration, a frequently suggested MTD technique, more often degrades than improves security. Hence, we argue that evaluation based on realistic attack simulation is a qualified approach to examine and verify claims of newly proposed defense techniques.

show abstract

Section: Metricsmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Automated benchmark network diversification for realistic attack simulation with application to moving target defense

Bajic

Becker²

2021

Int. J. Inf. Secur.

View full text Add to dashboard Cite

show abstract

“…By increasing the unpredictability of the system, MTD greatly increases the cost of the attacker while ensuring the normal operation of the system [15]. Based on operation, MTD can be roughly divided into four types [16]: shuffling [17][18], diversity [19][20], redundancy [21][22][23] and hybrid [24][25]. Although different types of MTD have their own characteristics, it is still difficult to satisfy coverage, timeliness and unpredictability at the same time [26], and problems such as blindness, inefficiency and unverifiability may also arise [27].…”

Section: Introductionmentioning

confidence: 99%

A Novel Model of Mimic Defense Based on Minimal L-Order Error Probability

et al. 2020

View full text Add to dashboard Cite

Mimic defense is an active defense theory, which aims to fundamentally change the "easy to attack and difficult to defend" situation of network security. In this paper, we propose an evaluation method based on the minimum probability of successful attack, and improve the evaluation scheme of historical confidence. We combine the two evaluation schemes with the TOPSIS (technique for order performance by similarity to ideal solution) algorithm, and finally form a complete heterogeneous variant dynamic scheduling model. Different from traditional multi-mode voting algorithm, the effect of heterogeneous degree in voting is considered, and we use Bayesian estimation to obtain the optimal result in the probabilistic sense. Finally, simulation results show that the proposed algorithm can effectively enhance the dynamic and security of the mimic defense model, and give full play to the characteristics of mimic defense.

show abstract

An Automated Security Analysis Framework and Implementation for MTD Techniques on Cloud

Alavizadeh

Kim

et al. 2020

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Cloud service providers offer their customers with on-demand and cost-effective services, scalable computing, and network infrastructures. Enterprises migrate their services to the cloud to utilize the benefit of cloud computing such as eliminating the capital expense of their computing need. There are security vulnerabilities and threats in the cloud. Many researches have been proposed to analyze the cloud security using Graphical Security Models (GSMs) and security metrics. In addition, it has been widely researched in finding appropriate defensive strategies for the security of the cloud. Moving Target Defense (MTD) techniques can utilize the cloud elasticity features to change the attack surface and confuse attackers. Most of the previous work incorporating MTDs into the GSMs are theoretical and the performance was evaluated based on the simulation. In this paper, we realized the previous framework and designed, implemented and tested a cloud security assessment tool in a real cloud platform named UniteCloud. Our security solution can (1) monitor cloud computing in real-time, (2) automate the security modeling and analysis and visualize the GSMs using a Graphical User Interface via a web application, and (3) deploy three MTD techniques including Diversity, Redundancy, and Shuffle on the real cloud infrastructure. We analyzed the automation process using the APIs and showed the practicality and feasibility of automation of deploying all the three MTD techniques on the UniteCloud.

show abstract

Model-based evaluation of combinations of Shuffle and Diversity MTD techniques on the cloud

Cited by 18 publications

References 22 publications

Automated benchmark network diversification for realistic attack simulation with application to moving target defense

Automated benchmark network diversification for realistic attack simulation with application to moving target defense

A Novel Model of Mimic Defense Based on Minimal L-Order Error Probability

An Automated Security Analysis Framework and Implementation for MTD Techniques on Cloud

Contact Info

Product

Resources

About