Moving Target Defense Techniques: A Survey

Abstract

As an active defense technique to change asymmetry in cyberattack-defense confrontation, moving target defense research has become one of the hot spots. In order to gain better understanding of moving target defense, background knowledge and inspiration are expounded at first. Based on it, the concept of moving target defense is analyzed. Secondly, literature analysis method is adopted to explain the design principles and system architecture of moving target defense. In addition, some relevant key techniques are introduced from the aspects of strategy generation, shuffling implementation, and performance evaluation. After that, the applications of moving target defense in different network architectures are illustrated. Finally, existing problems and future trend in this field are elaborated so as to provide a basis for further study.

Toward Proactive, Adaptive Defense: A Survey on Moving Target Defense

“…Recently, Lei et al [94] published a survey paper on MTD techniques. Although the authors conducted extensive surveys of the existing MTD techniques in terms of strategy generation, shuffling implementation, and performance evaluation, this work missed many MTD taxonomies to categorize and understand the existing MTD techniques.…”

“…The existing MTD survey papers [22,94,113,134,157,166] have provided different perspectives of MTD classifications and highly useful information overall. However, they missed some important information that may be highly needed for researchers who want to start conducting MTD research.…”

“…To effectively demonstrate the commonalities and differences between our survey paper and the existing survey papers, we created a table summarizing their comparisons in Table I. Furthermore, strictly speaking, MTD is different from deception in that it does not intentionally provide false information to deceive an attacker while deception does, even if these two approaches may lead to a similar outcome, such as confusing the attacker and misleading the attacker's decision making process. All the existing survey papers discussed above [22,94,113,157] treat deception techniques as a subset of MTD techniques. On the other hand, the deception research community treats MTD as a subset of deception techniques [119].…”

Analyzing the Effect of Moving Target Defense for a Web System

“…Moving target defense was pioneered by private industry, military research, and academic study; it is actively researched in the field of security innovation today. Studies on MTD technology are broadly classified into four categories: theory-based, strategy-based, diversification-based, and evaluation-based studies [2,3,4,5]. Table 1 is the overview of these four studies and the relevant existing methods on each study.…”

Ghost-MTD: Moving Target Defense via Protocol Mutation for Mission-Critical Cloud Systems

“…To overcome this limitation, there is a need for an MTD technique that more effectively delays the system analysis by increasing the variation of system properties. Additionally, in terms of practicality, minimizing the computational overhead arising by the MTD technology and solving the compatibility problem with the existing communication protocols are critical issues that cannot be overlooked [16,17]. In this study, we propose a technology called Ghost-MTD (gMTD) that allows only the user who is aware of protocol mutation patterns to correctly communicate with the service modules of the server system through protocol mutation using the pre-shared one-time bit sequence (OTBS).…”