Context-Aware Adaptive Route Mutation Scheme: A Reinforcement Learning Approach

Xu, Changqiao; Zhang, Tao; Kuang, Xiaohui; Zhou, Zan; Yu, Shui

doi:10.1109/jiot.2021.3065680

Cited by 23 publications

(13 citation statements)

References 52 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Based on the game results, the authors proposed an improvement upon random route mutation (RRM) [120], viz., strategic RRM. It is a multipath routing algorithm that periodically changes routing to avoid passing through some compromised links or nodes [121]. Similarly, Xu et al in [121] also proposed an improvement over route mutation algorithm for MTD.…”

Section: Sdn-enabledmentioning

confidence: 99%

Moving Target Defense-Based Denial-of-Service Mitigation in Cloud Environments: A Survey

Nguyen

Debroy

2022

Security and Communication Networks

View full text Add to dashboard Cite

With the increased frequency and intensity of denial-of-service (DoS) attacks on critical cloud-hosted services, resource adaptation schemes adopted by the cloud service providers (CSPs) need to be intelligent. Specifically, they need to be adaptable to attack behavior and be dynamic to curb resource over-utilization. The concept of moving target defense (MTD) has recently emerged as an effective and agile defense mechanism against DoS attacks that particularly target cloud-hosted applications. However, the existing surveys that seek to explore this space either focus more on MTD for generic cyberattack mitigation or on DoS attack defense on cloud systems. In this survey, we particularly provide an in-depth analysis on how MTD can help recover critical cloud assets in the face of DoS attacks and how emerging programmable technologies such as software-defined networking (SDN) can be leveraged to achieve that goal. Unlike existing surveys, we categorize DoS attacks on cloud platforms based on their working mechanism. We also discuss the non-MTD-based DoS defense strategies for both cloud and non-cloud infrastructures in order to highlight the pros and cons of MTD-based strategies. We introduce MTD working mechanisms and present how existing research is envisioning MTD’s application in mitigating DoS attacks, both with and without SDN. We also take an in-depth look at the testbed implementations and resilience and performance evaluations of MTD approaches. Finally, we articulate the existing challenges in MTD for DoS mitigation in cloud systems and how these challenges are shaping the future research in this domain.

show abstract

Section: Sdn-enabledmentioning

confidence: 99%

Moving Target Defense-Based Denial-of-Service Mitigation in Cloud Environments: A Survey

Nguyen

Debroy

2022

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…proposed an algorithm to mutate the routes related to a link or a host under the DDoS attack [36]. Te mutation is taken by diverging the routes to optional ones with a context-aware Qlearning algorithm to adaptively adjust the mutation period and learning rate.…”

Section: Mtdmentioning

confidence: 99%

“…(a) Defenses in VANET [37,38] are designed based on ad hoc routes that are suitable for general networks. (b) Te solutions [36][37][38] have not mentioned how to identify the links or hosts under attack. (c) For all of them [36][37][38], fnding the link-disjoint path or the route mutation is impossible for the critical PRs in general networks.…”

Section: Mtdmentioning

confidence: 99%

“…(b) Te solutions [36][37][38] have not mentioned how to identify the links or hosts under attack. (c) For all of them [36][37][38], fnding the link-disjoint path or the route mutation is impossible for the critical PRs in general networks. Later, Gupta et al developed a defense mechanism to change interdomain paths and performed address hopping for setting up a honey pot [13].…”

Section: Mtdmentioning

confidence: 99%

See 1 more Smart Citation

A Persistent Route Diversification Mechanism for Defending against Stealthy Crossfire Attack

Zhou

Yang

et al. 2022

Security and Communication Networks

View full text Add to dashboard Cite

Computer networks are facing the challenge of stealthy crossfire attacks that flood through persistent routes (PRs) towards their decoys at a low rate for disrupting end-to-end connectivity of the target. At first, the PRs can be stealthily probed at the initial stage of the attack. Later, some undefended and vulnerable PRs can be speculated at the renaissance stage of the attack, which yet remains unconcerned. To achieve an effective defense against the two-stage attacks, this paper investigates a new persistent route diversification defense (PRDD) mechanism to mitigate each identified PR under the attacks. The PRDD effectively stops the flooding on the PRs to mitigate their congestion. Meanwhile, it makes the adversary unable to probe or speculate the PRs under their corresponding attack stages. Thus, it disables every flooding choice for the adversary, avoiding the attacks. The PRDD is designed with scalable algorithmic complexity in computation and overhead. The PRDD is extensively assessed using NS-3 and Mininet, and the results show the following. (a) It is more effective in mitigating more attacked PRs compared with the existing solutions. (b) The defense performance of the PRDD remains highly scalable in computation, while maintaining an acceptable overhead.

show abstract

“…These schemes all consider the attack strategies of adversaries in deciding when to mutate. Some papers [7,8,30] have adopted Deep Reinforcement Learning to optimal routing mutation. The results show evidence effective on the optimal routing path selection and mutation time.…”

Section: Related Workmentioning

confidence: 99%

Polymorphic Path Transferring for Secure Flow Delivery

2021

KSII TIIS

View full text Add to dashboard Cite

In most cases, the routing policy of networks shows a preference for a static one-to-one mapping of communication pairs to routing paths, which offers adversaries a great advantage to conduct thorough reconnaissance and organize an effective attack in a stress-free manner. With the evolution of network intelligence, some flexible and adaptive routing policies have already proposed to intensify the network defender to turn the situation. Routing mutation is an effective strategy that can invalidate the unvarying nature of routing information that attackers have collected from exploiting the static configuration of the network. However, three constraints execute press on routing mutation deployment in practical: insufficient route mutation space, expensive control costs, and incompatibility. To enhance the availability of route mutation, we propose an OpenFlow-based route mutation technique called Polymorphic Path Transferring (PPT), which adopts a physical and virtual path segment mixed construction technique to enlarge the routing path space for elevating the security of communication. Based on the Markov Decision Process, with considering flows distribution in the network, the PPT adopts an evolution routing path scheduling algorithm with a segment path update strategy, which relieves the press on the overhead of control and incompatibility. Our analysis demonstrates that PPT can secure data delivery in the worst network environment while countering sophisticated attacks in an evasion-free manner (e.g., advanced persistent threat). Case study and experiment results show its effectiveness in proactively defending against targeted attacks and its advantage compared with previous route mutation methods.

show abstract

Context-Aware Adaptive Route Mutation Scheme: A Reinforcement Learning Approach

Cited by 23 publications

References 52 publications

Moving Target Defense-Based Denial-of-Service Mitigation in Cloud Environments: A Survey

Moving Target Defense-Based Denial-of-Service Mitigation in Cloud Environments: A Survey

A Persistent Route Diversification Mechanism for Defending against Stealthy Crossfire Attack

Polymorphic Path Transferring for Secure Flow Delivery

Contact Info

Product

Resources

About