MTD CBITS: Moving Target Defense for Cloud-Based IT Systems

Bardas, Alexandru G.; Sundaramurthy, Sathya Chandran; Ou, Xinming; DeLoach, Scott A.

doi:10.1007/978-3-319-66402-6_11

Cited by 13 publications

(12 citation statements)

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…On similar lines, authors in [118] notice that creating an entire file system replica takes two more minutes in the case of an MTD system when compared to a non-MTD enabled system refresh. On the contrary, [143] does not notice negligible performance overhead for instance replacements in a 14 node system (where one is a controller node and the others are compute nodes). Although, they do notice a larger number of HTTP error packets on the wire when using the MTD.…”

Section: A) Considers Only Security Of Individual Defenses: Mostmentioning

confidence: 94%

“…[62], [58], [59], [146], [61], [78], [79], [80], [94], [148], [147] [75], [69], [70], [107], [76], [71] [7], [68], [65], [66], [91], [131], [118], [143] Fig . 11: A Moving Target Defense is more effective if it considers the security and performance impacts of the system configurations, both in unison and also when placed in an ensemble of system configurations that the MTD leverages.…”

Section: A Qualitative Evaluationmentioning

confidence: 99%

“…In [64], the general level at which they define the utility values, one can capture the security risks associated with an individual defense action in terms of attack surface features and attack surface measurements while the security risks associated with an ensemble can be captured via the utility variable for attack surface shifting. In [143], the security for individual defense actions is trivial for their settings, where defending a node that is not a stepping stone is not beneficial at all for the defender.…”

Section: A) Considers Only Security Of Individual Defenses: Mostmentioning

confidence: 99%

See 2 more Smart Citations

A Survey of Moving Target Defenses for Network Security

Sengupta

Chowdhary

Sabur

et al. 2020

IEEE Commun. Surv. Tutorials

182

View full text Add to dashboard Cite

Network defense techniques based on traditional tools, techniques, and procedures (TTP) fail to account for the attacker's inherent advantage present due to static nature of network services and configurations. Moving Target Defense (MTD), on the other hand, provides an intelligent countermeasure by dynamically re-configuring the underlying systems, thereby reducing the effectiveness of cyber attacks. In this survey, we analyze the recent advancements made in the development of MTD tools, techniques and procedures (TTP) and highlight how these defenses can be made more effective with the use of artificial intelligence techniques for decision making. We first define a unified formal notation for MTDs that can capture different aspects of such defenses. We then categorize these defenses into different sub-classes depending on how they answer the three questions-what to move, when to move and how to moveshowcasing how game theoretic strategies can effectively answer the latter question. To understand the usefulness of these defense methods, we study the implementation of such MTD techniques. We find that (relatively) new networking technologies such as Software Defined Networking (SDN) and Network Function Virtualization (NFV) provide effective means for implementing these dynamic defense methods. To encourage researchers and industry experts in using such defenses, we highlight industry use-cases and discuss the practicality and maturity of these defenses. To aid readers who want to test or deploy MTD techniques, we highlight existing MTD test-beds. Our survey then performs both a qualitative and quantitative analysis to better understand the effectiveness of these MTDs in terms of security and performance. To that extent, we use well-defined metrics such as risk analysis, performance costs for qualitative evaluation and metrics based on Confidentiality, Integrity, Availability (CIA), attack representation, QoS impact, targeted threat models and defense cost for quantitative evaluation. Finally, we conclude by summarizing research opportunities that our survey elucidates.

show abstract

Section: A) Considers Only Security Of Individual Defenses: Mostmentioning

confidence: 94%

Section: A Qualitative Evaluationmentioning

confidence: 99%

Section: A) Considers Only Security Of Individual Defenses: Mostmentioning

confidence: 99%

See 1 more Smart Citation

A Survey of Moving Target Defenses for Network Security

Sengupta

Chowdhary

Sabur

et al. 2020

IEEE Commun. Surv. Tutorials

182

View full text Add to dashboard Cite

show abstract

“…Bardas et al [18] proposed an MTD platform for cloudbased IT system and analyzed security benefits to verify its performance with an e-commerce scenario. The authors studied how the MTD approach can be applied to the entire IT system and demonstrated its practicality in cloud-based environment using Automated eNterprise network COmpileR (AN-COR) [151].…”

Section: E Cloud-based Web Servicesmentioning

confidence: 99%

Toward Proactive, Adaptive Defense: A Survey on Moving Target Defense

Cho

Sharma

Alavizadeh

et al. 2020

IEEE Commun. Surv. Tutorials

221

View full text Add to dashboard Cite

Reactive defense mechanisms, such as intrusion detection systems, have made significant efforts to secure a system or network for the last several decades. However, the nature of reactive security mechanisms has limitations because potential attackers cannot be prevented in advance. We are facing a reality with the proliferation of persistent, advanced, intelligent attacks while defenders are often way behind attackers in taking appropriate actions to thwart potential attackers. The concept of moving target defense (MTD) has emerged as a proactive defense mechanism aiming to prevent attacks. In this work, we conducted a comprehensive, in-depth survey to discuss the following aspects of MTD: key roles, design principles, classifications, common attacks, key methodologies, important algorithms, metrics, evaluation methods, and application domains. We discuss the pros and cons of all aspects of MTD surveyed in this work. Lastly, we highlight insights and lessons learned from this study and suggest future work directions. The aim of this paper is to provide the overall trends of MTD research in terms of critical aspects of defense systems for researchers who seek for developing proactive, adaptive MTD mechanisms.

show abstract

“…Zhuang et al [31] presented a preliminary design of a network moving-target defense system and conducted simulation-based experiments on an existing network security simulator called NeSSi2 to study the effects of randomly changing one aspect of the system in reducing attacker's success likelihood. Bardas et al [32] analyzes the costs and security benefits of MTD in cloud based IT systems (CBITS) using a practical attack window model and show how a system managed using MTD CBITS will increase attack difficulty.…”

Section: B Evaluation Models For Mtdmentioning

confidence: 99%

Effectiveness Evaluation Model of Moving Target Defense Based on System Attack Surface

2019

View full text Add to dashboard Cite

Evaluation of moving target defense (MTD) effectiveness has become one of the fundamental problems in current studies. In this paper, an evaluation model of MTD effectiveness based on system attack surface (SAS) is proposed to extend this model covering enterprise-class topology and multi-layered moving target (MT) techniques. The model is focused on the problem of incorrect performance assessment caused by inaccurately characterizing the process of attacking and defending. Existing evaluation models often fail to describe MTD dynamically in a process. To deal with this static view, offensive and defensive process based on a player's move is presented. Besides, it converts all the attack and defense actions into the process, and interactivities are evaluated by system view extended attack surface model. Previously, the proposed attack surface models are not concerned about the links between nodes and vulnerabilities affected by topologies. After comprehensively analyzing the impact of interactions in the system, a SAS model is proposed to demonstrate how resources of the system are affected by the actions of attackers and defenders, thus ensuring the correctness of parameters for SAS in measuring MT technology. Moreover, by generating a sequence of those shifting parameters, a nonhomogeneous hierarchical hidden Markov model is used to find the possible sequence of attacking states by introducing the partial Viterbi algorithm. Also, a sequence of attacking states is defined to illustrate how adversaries are handled by MT technologies and how much additional consumption costs are increased by the system resource reconfiguration. Finally, the simulation of the proposed approach is given in a case study to demonstrate the feasibility and validity of the proposed effectiveness evaluation model in a systematic and dynamic view. INDEX TERMS Information security, moving target defense, nonhomogeneous hidden Markov processes, performance evaluation.

show abstract

MTD CBITS: Moving Target Defense for Cloud-Based IT Systems

Cited by 13 publications

References 29 publications

A Survey of Moving Target Defenses for Network Security

A Survey of Moving Target Defenses for Network Security

Toward Proactive, Adaptive Defense: A Survey on Moving Target Defense

Effectiveness Evaluation Model of Moving Target Defense Based on System Attack Surface

Contact Info

Product

Resources

About