Moving target defense: state of the art and characteristics

Abstract

Moving target defense (MTD) has emerged as one of the game-changing themes to alter the asymmetric situation between attacks and defenses in cyber-security. Numerous related works involving several facets of MTD have been published. However, comprehensive analyses and research on MTD are still absent. In this paper, we present a survey on MTD technologies to scientifically and systematically introduce, categorize, and summarize the existing research works in this field. First, a new security model is introduced to describe the changes in the traditional defense paradigm and security model caused by the introduction of MTD. A function-and-movement model is provided to give a panoramic overview on different perspectives for understanding the existing MTD research works. Then a systematic interpretation of published literature is presented to describe the state of the art of the three main areas in the MTD field, namely, MTD theory, MTD strategy, and MTD evaluation. Specifically, in the area of MTD strategy, the common characteristics shared by the MTD strategies to improve system security and effectiveness are identified and extrapolated. Thereafter, the methods to implement these characteristics are concluded. Moreover, the MTD strategies are classified into three types according to their specific goals, and the necessary and sufficient conditions of each type to create effective MTD strategies are then summarized, which are typically one or more of the aforementioned characteristics. Finally, we provide a number of observations for the future direction in this field, which can be helpful for subsequent researchers.

Toward Proactive, Adaptive Defense: A Survey on Moving Target Defense

“…Cai et al [22] also conducted an extensive survey on the state-of-the-art MTD research by describing theoretical approaches, strategies based on key characteristics, and evaluation methods used in those existing MTD approaches. The authors provided a function-and-movement model categorizing MTD techniques in a systematic way in terms of (1) three layers of implementation including software, running platform, and physical network; (2) function and movement models; and (3) MTD, its strategies, and its evaluation.…”

“…The existing MTD survey papers [22,94,113,134,157,166] have provided different perspectives of MTD classifications and highly useful information overall. However, they missed some important information that may be highly needed for researchers who want to start conducting MTD research.…”

“…To effectively demonstrate the commonalities and differences between our survey paper and the existing survey papers, we created a table summarizing their comparisons in Table I. Furthermore, strictly speaking, MTD is different from deception in that it does not intentionally provide false information to deceive an attacker while deception does, even if these two approaches may lead to a similar outcome, such as confusing the attacker and misleading the attacker's decision making process. All the existing survey papers discussed above [22,94,113,157] treat deception techniques as a subset of MTD techniques. On the other hand, the deception research community treats MTD as a subset of deception techniques [119].…”

“…A change in the system configuration attributes must cause a change on the attack surface of the system leading to the loss of work and increased complexity for attackers. Additionally, the number of possible values the dynamic attribute can change to must be vast, thwarting the attacker's ability to simply brute-force the future value [22]. How to identify all potential system security vulnerabilities and eliminate them How to optimally execute MTD operations to continuously change attack surface while meeting multiple system objectives concerning security and performance Challenges…”

A Cost-effective Shuffling Method against DDoS Attacks using Moving Target Defense

“…It becomes inefficient and insufficient when facing more advanced attacks with unknown behavioral patterns, which is common in today's cyber attacks. To counterbalance the advantage of attackers by reconnaissance, Moving Target Defense (MTD) [2,3] has emerged as a good mitigation technique that alters the static nature of cyber systems. MTD regularly changes certain aspects of the system to decrease an attackers' understanding of the target system.…”