A moving-target defense strategy for Cloud-based services with heterogeneous and dynamic attack surfaces

Toward Proactive, Adaptive Defense: A Survey on Moving Target Defense

“…Main Attacks: The common attacks considered in the existing cloud-based MTD approaches are DDoS [82], VM colocation attacks based on side channel attacks that can leak out private information of users [165], eavesdropping and message forgery / modification / dropping [41], VM probing attacks [120], database / script / mainstream hackers [132], or exploitation / data exfiltration attacks [25]. Since cloud-based web services may deal with a large volume of users' private information, it is noticeable that attacks leaking out the private information is also one of key concerns MTD needs to counteract.…”

“…Danev et al [41] proposed a key structure to allow secure migration of virtual Trusted Platform Modules (vTPMs) in private clouds. Peng et al [120] formulated a service security model in clouds that can allow optimal configurations of VM migration / snapshotting and diversity / compatibility of migration. Sengupta et al [132] adopted a repeated Bayesian Stackelberg game to model a web-application stack shuffling MTD.…”

“…Evaluation Methods: Like the validation trends observed in other domains, most cloud-based MTD approaches are also evaluated based on simulation and analytical models [82,120,165], concerning the effectiveness of MTD in terms of security and cost. Jia et al [82] used both simulation-based and prototype-based evaluations (i.e., using Amazon EC) to validate server shuffling-based MTD on clouds.…”

Frequency-minimal moving target defense using software-defined networking

“…RELATED WORK MTD based works are gaining momentum in tackling cloud based threats and among them [7][8][9][10][11] are notable. In [7], authors propose a shuffling technique of static IP addresses of attacked VMs.…”

“…Authors in [8] propose a scheme to move around proxy servers to an application server in order to thwart attacks. Another notable work that applies MTD against cyber attacks on VMs is [9] where authors proactively copy the same service into multiple VMs with the consumers redirected to new VM whenever the current VMs running the critical application are attacked. In [10], the authors propose a MTD strategy to marginalize the attackers within a small pool of decoy VMs.…”