Cyber defense in breadth: Modeling and analysis of integrated defense systems

Abstract

Cybersecurity is one of most critical concerns for any organization, as frequency and severity of cyber attacks constantly increase, resulting in loss of vital assets and/or services. To preserve key security goals such as confidentiality, integrity, and availability, a variety of defense techniques have been introduced. While intrusion detection system (IDS) has played a key role in cybersecurity for a long time, recently new proactive defense techniques, called intrusion prevention techniques, have emerged, aiming to resolve the known IDS limitations. The intrusion prevention techniques have been introduced to control actions of attackers as a proactive defense that can be deployed independently or combined with other defense techniques that have the purpose of achieving ''Defense in Breadth.'' In this work, we develop a probability model using Stochastic Petri Nets that describes an integrated defense system with the defense techniques of both intrusion detection (i.e., IDS) and intrusion prevention (i.e., honeypots and platform migration) and analyze its performance compared to single defense or partially integrated defense approaches. Our result shows that the integrated defense system outperforms the compared approaches by minimizing attack success while maximizing system lifetime (i.e., mean time to security failure). Further, we investigate the effect of the interplay between different defense techniques in terms of the defense cost and attack cost. Keywords Defense in breadth, integrated defense systems, moving target defense, deception, intrusion detection, intrusion prevention, attack, defense, mean time to security failure proactive approach aiming to prevent intrusions by controlling the courses of an attacker's actions before the attacker performs any malicious activities. Cybersecurity cannot be achieved or maintained by a single, silver-bullet solution. Instead, there is a need for a collection of defense techniques that can work together and complete one another to deal with sophisticated attacks. This type of defense is termed as Defense in Breadth, which refers to the defense based on multiple mechanisms across sophisticated multiple attack classes.

Toward Proactive, Adaptive Defense: A Survey on Moving Target Defense

“…Evaluation Methods: As seen in Section VIII, most MTD approaches have used simulation-based experiments for the performance validation. The similar trends are observed in evaluating MTD techniques for enterprise networks , which are mainly validated based on simulation models [20,34,49,51,83,158,161] while the use of a model-based probability/analytical models was not common [30]. Fig.…”

“…The examples include platform migrations or system diversity [20,30,46,49], server location migrations [51,158], software stack diversity [161], proxy shuffling [83], or IP mutation [34]. Main Attacks: Most MTD approaches developed for enterprise networks countermeasured worm attacks [51], DDoS [51,83,158], abstracted attacks in an attack-defense game [49], scanning attacks [20,30,34], APT attacks [161], or more sophisticated, multi-stage attacks, including circumvention attacks, deputy attacks, entropy reducing attacks, probing attacks, and incremental attacks [46]. Key Methodologies: Since majority of existing MTD approaches have used game theoretic approaches, many MTD techniques for enterprise networks have used in an attackdefense game where the MTD techniques are used as defense strategies.…”

DIVERGENCE: Deep Reinforcement Learning-Based Adaptive Traffic Inspection and Moving Target Defense Countermeasure Framework

“…MTD is designed to increase uncertainty and/or confusion to attackers attempting to penetrate into a system by identifying vulnerabilities of the target system. The main functions of MTD are to change the attack surfaces (i.e., system or network configurations), consequently invalidating the intelligence gathered by the attackers and wasting their resources and time [17]. The MTD techniques can be categorized in terms of shuffling, diversity, and redundancy [7].…”

“…In line 8, the IP shuffling-based MTD countermeasure according to the probability in (9) for security enhancement of devices in the network. In lines 9 -12, Based on the randomly sampled mini batch from B, θ Q and θ µ are updated according to (17) and (18), and targets θ Q and θ µ are updated softly.…”

Optimal Strategy for Cyberspace Mimic Defense Based on Game Theory

“…Rahman et al [18] combine the degree of the system vulnerability and perform an attack based on resource level to quantify the probability that attacks are successfully performed. Cho et al [19] use Stochastic Petri Nets to create a model that describes an integrated defense system. They used the probability of a successful attack to quantify the meantime to security failure.…”