On the Resilience of Network-based Moving Target Defense Techniques Against Host Profiling Attacks

Piskozub, Michal; Spolaor, Riccardo; Conti, Mauro; Martinovic, Ivan

doi:10.1145/3338468.3356825

Cited by 3 publications

(5 citation statements)

References 41 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…[159], [160], [161], [162], [163], [164], [165], [166], [167], [168], [169], [170] [185], [186], [187], [188], [189], [190], [191], [192], [193], [194], [195], [196], [197], [198], [199], [200] Usability, HCI, and Visualization (3 the latter two fields generally work on other data (often images or text), or focus more on sophisticated methodologies themselves (AI/ML algorithms, visualization techniques, etc.). Only a small fraction of these papers proposes NIDS and utilizes network traffic data.…”

Section: Publication Venuesmentioning

confidence: 99%

The Missing Link in Network Intrusion Detection: Taking AI/ML Research Efforts to Users

Dietz,

Mühlhauser,

Kögel

et al. 2024

IEEE Access

View full text Add to dashboard Cite

Intrusion Detection Systems (IDS) tackle the challenging task of detecting network attacks as fast as possible. As this is getting more complex in modern enterprise networks, Artificial Intelligence (AI) and Machine Learning (ML) have gained substantial popularity in research. However, their adoption into real-world IDS solutions remains poor. Academic research often overlooks the interconnection of users and technical aspects. This leads to less explainable AI/ML models that hinder trust among AI/ML non-experts. Additionally, research often neglects secondary concerns such as usability and privacy. If IDS approaches conflict with current regulations or if administrators cannot deal with attacks more effectively, enterprises will not adopt the IDS in practice. To identify those problems systematically, our literature survey takes a user-centric approach; we examine IDS research from the perspective of stakeholders by applying the concept of personas. Further, we investigate multiple factors limiting the adoption of AI/ML in security and suggest technical, non-technical, and user-related considerations to enhance the adoption in practice. Our key contributions are threefold. (i) We derive personas from realistic enterprise scenarios, (ii) we provide a set of relevant hypotheses in the form of a review template, and (iii), based on our reviews, we derive design guidelines for practical implementations. To the best of our knowledge, this is the first paper that analyzes practical adoption barriers of AI/ML-based intrusion detection solutions concerning appropriateness of data, reproducibility, explainability, practicability, usability, and privacy. Our guidelines may help researchers to holistically evaluate their AI/ML-based IDS approaches to increase practical adoption.

show abstract

Section: Publication Venuesmentioning

confidence: 99%

The Missing Link in Network Intrusion Detection: Taking AI/ML Research Efforts to Users

Dietz,

Mühlhauser,

Kögel

et al. 2024

IEEE Access

View full text Add to dashboard Cite

show abstract

“…Even if one of NMTD approaches on real host identifiers, such SSCM [5] and MT6D [7], is applied, attackers can capture packets communicated between two unknown hosts. If hopping fre-Copyright c 2022 The Institute of Electronics, Information and Communication Engineers quency is low, the attackers can profile the two hosts [6]. If hopping frequency is higher than a certain value, the attackers may not exactly profile the two hosts, but they can acquire the currently active IP and port combinations of the two hosts.…”

Section: Threat Modelmentioning

confidence: 99%

“…An important distinction in NMTD is whether the changing affects the real or virtual host identifiers [6]. NMTD approaches, such as Scalable and Seamless Connection Migration (SSCM) [5] and Moving Target IPv6 Defense (MT6D) [7], perform hopping on real host identifiers.…”

Section: Introductionmentioning

confidence: 99%

“…NMTD approaches, such as Scalable and Seamless Connection Migration (SSCM) [5] and Moving Target IPv6 Defense (MT6D) [7], perform hopping on real host identifiers. On the other hand, other approaches, such as OpenFlow Random Host Mutation (OF-RHM) [8] and RHM [9] relying on Software Defined Networking (SDN) or gateways, perform hopping only on virtual host identifiers and maintain the real ones hidden from outside of the network [6].…”

Section: Introductionmentioning

confidence: 99%

“…Although NMTD is sufficient to defeat automated and naive attackers, it is ineffective against skilled human attack-ers [10], and it has weaknesses against passive host profiling attacks that passively profile hosts from their flow-level traffic [6]. For example, it is possible for an attacker to acquire the currently active IP and port combination of a protected host through skilled scanning or passive host profiling.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Strengthening Network-Based Moving Target Defense with Disposable Identifiers

PARK

KIM

2022

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

In this paper, we propose a scheme to strengthen networkbased moving target defense with disposable identifiers. The main idea is to change disposable identifiers for each packet to maximize unpredictability with large hopping space and substantially high hopping frequency. It allows network-based moving target defense to defeat active scanning, passive scanning, and passive host profiling attacks. Experimental results show that the proposed scheme changes disposable identifiers for each packet while requiring low overhead.

show abstract