A Survey of Moving Target Defenses for Network Security

Abstract

Network defense techniques based on traditional tools, techniques, and procedures (TTP) fail to account for the attacker's inherent advantage present due to static nature of network services and configurations. Moving Target Defense (MTD), on the other hand, provides an intelligent countermeasure by dynamically re-configuring the underlying systems, thereby reducing the effectiveness of cyber attacks. In this survey, we analyze the recent advancements made in the development of MTD tools, techniques and procedures (TTP) and highlight how these defenses can be made more effective with the use of artificial intelligence techniques for decision making. We first define a unified formal notation for MTDs that can capture different aspects of such defenses. We then categorize these defenses into different sub-classes depending on how they answer the three questions-what to move, when to move and how to moveshowcasing how game theoretic strategies can effectively answer the latter question. To understand the usefulness of these defense methods, we study the implementation of such MTD techniques. We find that (relatively) new networking technologies such as Software Defined Networking (SDN) and Network Function Virtualization (NFV) provide effective means for implementing these dynamic defense methods. To encourage researchers and industry experts in using such defenses, we highlight industry use-cases and discuss the practicality and maturity of these defenses. To aid readers who want to test or deploy MTD techniques, we highlight existing MTD test-beds. Our survey then performs both a qualitative and quantitative analysis to better understand the effectiveness of these MTDs in terms of security and performance. To that extent, we use well-defined metrics such as risk analysis, performance costs for qualitative evaluation and metrics based on Confidentiality, Integrity, Availability (CIA), attack representation, QoS impact, targeted threat models and defense cost for quantitative evaluation. Finally, we conclude by summarizing research opportunities that our survey elucidates.

Toward Proactive, Adaptive Defense: A Survey on Moving Target Defense

“…Very recently, Sengupta et al [134] conducted a substantial survey to study and categorize the proposed defensive MTD tools, techniques, and strategies. The authors categorized MTD approaches in a structured way and introduced MTD taxonomies based on the following technique formalism: designing key movements, implementation of MTD (e.g., testbeds), and evaluation of MTD effectiveness (e.g., qualitative and quantities metrics).…”

“…The existing MTD survey papers [22,94,113,134,157,166] have provided different perspectives of MTD classifications and highly useful information overall. However, they missed some important information that may be highly needed for researchers who want to start conducting MTD research.…”

MTD, Where Art Thou? A Systematic Review of Moving Target Defense Techniques for IoT

“…However, there is an increasing interest in general-purpose MTD Network techniques since 2015. We base this assertion on the rate of publications of the MTD Network techniques included in the 2020 survey of Sengupta et al [10]. Also, recent MTD surveys [11], [27] focus on Network MTD solutions, which indicates a growing interest in the research community.…”

Moving Target Defense Decision-Making Method

“…When the game process is in the G(k) stage, the attacker employs the means of active detection and public information gathering to obtain attack surface [15,16,17] information of the current target system and accordingly determines the attack strategy and builds the attack chain. The defender then selects the corresponding defense strategy to destroy the integrity of the attack chain and implements dynamic defense.…”