Scaling IPv6 address bindings in support of a moving target defense

Morrell, Christopher; Ransbottom, J. Scot; Marchany, Randy; Tront, Joseph G.

doi:10.1109/icitst.2014.7038852

Cited by 14 publications

(8 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Previous work done by Morrell et al [20] showed that a server can successfully bind up to 60000 randomly generated addresses, with each bound address communicating with an individual client. Based on these observations, the CN should be able to bind and listen on a large number of discarded MT6D addresses.…”

Section: Resultsmentioning

confidence: 99%

Strengthening MT6D Defenses with LXC-Based Honeypot Capabilities

Basam

Ransbottom

Marchany

et al. 2016

Journal of Electrical and Computer Engineering

Self Cite

View full text Add to dashboard Cite

Moving Target IPv6 Defense (MT6D) imparts radio-frequency hopping behavior to IPv6 networks by having participating nodes periodically hop onto new addresses while giving up old addresses. Our previous research efforts implemented a solution to identify and acquire these old addresses that are being discarded by MT6D hosts on a local network besides being able to monitor and visualize the incoming traffic on these addresses. This was essentially equivalent to forming a darknet out of the discarded MT6D addresses, but the solution presented in the previous research effort did not include database integration for it to scale and be extended. This paper presents a solution with a new architecture that not only extends the previous solution in terms of automation and database integration but also demonstrates the ability to deploy a honeypot on a virtual LXC (Linux Container) on-demand based on any interesting traffic pattern observed on a discarded address. The proposed architecture also allows an MT6D host to query the solution database for network activity on its relinquished addresses as a JavaScript Object Notation (JSON) object. This allows an MT6D host to identify suspicious activity on its discarded addresses and strengthen the MT6D scheme parameters accordingly. We have built a proof-of-concept for the proposed solution and analyzed the solution’s feasibility and scalability.

show abstract

Section: Resultsmentioning

confidence: 99%

Strengthening MT6D Defenses with LXC-Based Honeypot Capabilities

Basam

Ransbottom

Marchany

et al. 2016

Journal of Electrical and Computer Engineering

Self Cite

View full text Add to dashboard Cite

show abstract

“…Existing SDN-based NDD methods 14,15 mainly concentrate on the study of network address transformation method. However, in practical applications, the failure generation of hopping endpoint information often occurs caused by the conflict of hopping endpoint address generation and high implementation consumption of transformation update.…”

Section: The Overall Design Of the Ndd Systemmentioning

confidence: 99%

Network dynamic defense system based on holographic transformation

Jian-cheng

Cheng

Zhang

et al. 2020

International Journal of Distributed Sensor Networks

View full text Add to dashboard Cite

Aimed at the problem of the boundary defense easily being out of availability caused by the static network structure, a novel dynamic enterprise network defense system based on holographic transformation is designed and implemented. To increase the uncertainty of network structure and the position of target nodes, the network view is dynamically changed by constantly transforming endpoint information. Virtual endpoint mutation and hopping period selection are achieved by the hopping address generation module. It takes the advantages of anti-collision and good randomicity of the Chinese national SM3 hash algorithm. The full-cycle hopping period is managed and controlled by the hopping period management mechanism based on the ciphertext policy attribute-based broadcast holographic transformation. Experiments show that the system achieves expected security goals and has good interactivity and high stability.

show abstract

“…Existing researches [4][5][6][7][8][9][10][11][12][13][14][15][16][17][18][19][20][21][22] have proved that IP hopping technology is an effective method to defend against scanning attack which is normally the first step of many other network attacks such as DDoS [23] and propagation worm [24]. e game between scanning attacker and IP hopping defender is shown in Figure 1.…”

Section: Introductionmentioning

confidence: 99%

“…IP hopping technology is firstly proposed and deployed in legacy network [2,[4][5][6][7][8][9][10][11][12] and proved to be an excellent defensive means. In recent years, software defined network (SDN) [25] has been widely studied and considered as the next network technology.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

An Adaptive IP Hopping Approach for Moving Target Defense Using a Light-Weight CNN Detector

Liu

et al. 2021

Security and Communication Networks

View full text Add to dashboard Cite

Scanning attack is normally the first step of many other network attacks such as DDoS and propagation worm. Because of easy implementation and high returns, scanning attack especially cooperative scanning attack is widely used by hackers, which has become a serious threat to network security. In order to defend against scanning attack, this paper proposes an adaptive IP hopping in software defined network for moving target defense (MTD). In order to accurately respond to attacker’s behavior in real time, a light-weight convolutional neural network (CNN) detector composed of three convolutional modules and a judgment module is proposed to sense scanning attack. Input data of the detector is generated via designed packets sampling and data preprocess. The detection result of the detector is used to trigger IP hopping. In order to provide some fault tolerance for the CNN detector, IP hopping can also be triggered by a preset timer. The CNN driving adaptability is applied to a three-level hopping strategy to make the MTD system optimize its behavior according to real time attack. Experiments show that compared with existing technologies, our proposed method can significantly improve the defense effect to mitigate scanning attack and its subsequent attacks which are based on hit list. Hopping frequency of the proposed method is also lower than that of other methods, so the proposed method shows lower system overhead.

show abstract

Scaling IPv6 address bindings in support of a moving target defense

Cited by 14 publications

References 4 publications

Strengthening MT6D Defenses with LXC-Based Honeypot Capabilities

Strengthening MT6D Defenses with LXC-Based Honeypot Capabilities

Network dynamic defense system based on holographic transformation

An Adaptive IP Hopping Approach for Moving Target Defense Using a Light-Weight CNN Detector

Contact Info

Product

Resources

About