Effectiveness Evaluation Model of Moving Target Defense Based on System Attack Surface

Abstract

Evaluation of moving target defense (MTD) effectiveness has become one of the fundamental problems in current studies. In this paper, an evaluation model of MTD effectiveness based on system attack surface (SAS) is proposed to extend this model covering enterprise-class topology and multi-layered moving target (MT) techniques. The model is focused on the problem of incorrect performance assessment caused by inaccurately characterizing the process of attacking and defending. Existing evaluation models often fail to describe MTD dynamically in a process. To deal with this static view, offensive and defensive process based on a player's move is presented. Besides, it converts all the attack and defense actions into the process, and interactivities are evaluated by system view extended attack surface model. Previously, the proposed attack surface models are not concerned about the links between nodes and vulnerabilities affected by topologies. After comprehensively analyzing the impact of interactions in the system, a SAS model is proposed to demonstrate how resources of the system are affected by the actions of attackers and defenders, thus ensuring the correctness of parameters for SAS in measuring MT technology. Moreover, by generating a sequence of those shifting parameters, a nonhomogeneous hierarchical hidden Markov model is used to find the possible sequence of attacking states by introducing the partial Viterbi algorithm. Also, a sequence of attacking states is defined to illustrate how adversaries are handled by MT technologies and how much additional consumption costs are increased by the system resource reconfiguration. Finally, the simulation of the proposed approach is given in a case study to demonstrate the feasibility and validity of the proposed effectiveness evaluation model in a systematic and dynamic view. INDEX TERMS Information security, moving target defense, nonhomogeneous hidden Markov processes, performance evaluation.

Automated benchmark network diversification for realistic attack simulation with application to moving target defense

“…A large part of this work is based on game theory and attempts to find equilibria in the presence of attackers and defenders of a certain skill or optimize defense and attack strategies. These approaches comprise Stackelberg Games [1,38], Zero-Determinant Theory [40], empirical game-theoretic analysis [36], Markov modeling [18,27,30,41,42], as well as stochastic petri nets [7,14]. However, none of them attempt to determine a given technique's real effects.…”

G-BDP-ADC Model for Effectiveness Evaluation of Low Orbit Satellite Communication System in the Context of Poor Information

“…As one of the core issues of effectiveness evaluation, evaluation method is the basis of effectiveness evaluation. Main evaluation methods include ADC, data envelopment method [16], fuzzy comprehensive evaluation [17], heuristic algorithm [18], [19], analytic hierarchy process and simulation method [20], [21]. Dong et al [22] constructed a combat effectiveness evaluation method for satellite navigation systems based on rough set and fuzzy set theory.…”

AID Shuffling Mechanism Based on Group-Buying Auction for Identifier Network Security

“…Connell et al [29] present a quantitative analytic model to assess the resource availability and MTD performance. More recently, Xiong et al [30] extend the attack surface model and propose an effectiveness assessment model based on the offensive and defensive process to dynamically describe the MTD.…”