Modeling and Analysis of Integrated Proactive Defense Mechanisms for Internet of Things

Abstract

As a solution to protect and defend a system against inside attacks, many intrusion detection systems (IDSs) have been developed to identify and react to them for protecting a system. However, the core idea of an IDS is a reactive mechanism in nature even though it detects intrusions which have already been in the system. Hence, the reactive mechanisms would be way behind and not effective for the actions taken by agile and smart attackers. Due to the inherent limitation of an IDS with the reactive nature, intrusion prevention systems (IPSs) have been developed to thwart potential attackers and/or mitigate the impact of the intrusions before they penetrate into the system. In this chapter, we introduce an integrated defense mechanism to achieve intrusion prevention in a software-defined Internetof-Things (IoT) network by leveraging the technologies of cyberdeception (i.e., a decoy system) and moving target defense, namely MTD (i.e., network topology shuffling). In addition, we validate their effectiveness and efficiency based on the devised graphical security model (GSM)-based evaluation framework. To develop an adaptive, proactive intrusion prevention mechanism, we employed fitness functions based on the genetic algorithm in order to identify an optimal network topology where a network topology can be shuffled based on the detected level of the system vulnerability. Our simulation results show that GA-based shuffling schemes outperform random shuffling schemes in terms of the number of attack paths toward decoy targets. In addition, we observe that there exists a tradeoff between the system lifetime (i.e., mean time to security failure) and the defense cost introduced by the proposed MTD technique for fixed and adaptive shuffling schemes. That is, a fixed GA-based shuffling can achieve higher MTTSF with more cost while an adaptive GA-based shuffling obtains less MTTSF with less cost. Introduction Research Goal & ContributionsThis work aims to propose an integrated proactive defense based on intrusion preventive mechanisms, such as cyberdeception and MTD techniques, to minimize the impact of potential attackers trying to penetrate into IoT systems via multiple entries. We make the following key contributions in this book chapter:  We developed an integrated proactive defense system by proposing an adaptive MTD technique by shuffling a network topology where a network consists of both decoy nodes and real nodes. As decoy nodes are the part of a decoy system,

A Hierarchical Modeling and Analysis Framework for Availability and Security Quantification of IoT Infrastructures

“…The assessment mainly relies on the involvement of failure modes and recovery strategies for availability evaluation while attack intensities along with recovery of attack damage are the main focus being taken into account for security-aware assessment. Further considerations on security attack methods, security risks, and the effectiveness of different security countermeasures (for instance, Moving Target Defense (MTD) [68,69]) are of our future works. In addition, another extension can be the consideration of both performance and availability assessment (which is roughly called, perform-ability).…”

Toward Proactive, Adaptive Defense: A Survey on Moving Target Defense

“…Recently, Ge et al [54] discussed a GA-based approach for optimizing the network shuffling in an SDN-based IoT network. In this work, the authors considered two types of the IoT nodes (e.g., decoy and real nodes), and designed three metrics, including the number of attack paths towards the decoy targets, mean time to security failure, and defense cost.…”

Turning the Hunted into the Hunter via Threat Hunting: Life Cycle, Ecosystem, Challenges and the Great Promise of AI

“…In addition to having sufficient knowledge of malware, exploits and network protocols, they need to be able to navigate the vast quantities of data, including logs, metadata, and packet capture (PCAP) data. Proactive defence has received a research focus in recent years [2] [3].…”

“…As a result, reactive mechanisms are far behind and are not be able to handle actions taken by clever adversaries. However, there is proactive defense that has been designed to detect potential attackers and/or mitigate the impact of intrusions ahead of their penetration like IPSs [3].…”