Performance impact analysis of services under a time-based moving target defense mechanism

Mendonca, Julio; Cho, Jin-Hee; Moore, Terrence J.; Nelson, Frederica F.; Lim, Hyuk; Kim, Dong-Seong

doi:10.1177/15485129211036937

Cited by 2 publications

(1 citation statement)

References 36 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The study by [18] introduced a novel method for detecting attacks through MTD by creating a defense mechanism aimed at misleading adversaries and making the attacks detectable from the defender's standpoint. Another research by [19] employed a SPN model to assess the impact of periodic MTD operations on system performance, specifically looking at response time, performance degradation, and Quality of Service (QoS).…”

Section: Related Workmentioning

confidence: 99%

Event-Based Moving Target Defense in Cloud Computing with VM Migration: A Performance Modeling Approach

Santos,

Brito,

Fé

et al. 2024

IEEE Access

View full text Add to dashboard Cite

The domain of information security is undergoing significant evolution to address the increasingly complex challenges aimed at bolstering system resilience against attacks. The Moving Target Defense (MTD) methodology, which entails altering the system's configuration-for instance, by relocating virtual machines (VM) or modifying IP addresses-serves to dynamically modify vulnerable components of a system. This strategy effectively disorients potential attackers, complicating their efforts to comprehend or anticipate the system's configuration. Moreover, MTD can be proactively utilized by, for example, relocating VMs from a network segment that has been compromised. Consequently, MTD emerges as a viable approach for mitigating security concerns, particularly within cloud computing frameworks. A critical facet of MTD involves the system migration across different hardware, presenting logistical and strategic challenges that necessitate a thorough evaluation of factors such as operational downtime and the impact on system performance. Analytical models, particularly those based on stochastic Petri nets (SPN), offer a methodological advantage in strategizing MTD implementations by facilitating the assessment of potential outcomes in a non-live environment. This paper proposes an advanced model that extends prior research through the integration of an event-based MTD mechanism, which encompasses both the probability of intrusion detection and the ability to discern potential threats. Through the application of diverse migration initiation policies, this study aims to identify more efficacious strategies under specific conditions. The findings indicate that reliance on event-detection policies is advantageous when the system possesses a detection accuracy exceeding 50%, underscoring the critical role of precise intrusion detection in the efficacy of MTD strategies.

show abstract

Section: Related Workmentioning

confidence: 99%

Event-Based Moving Target Defense in Cloud Computing with VM Migration: A Performance Modeling Approach

Santos,

Brito,

Fé

et al. 2024

IEEE Access

View full text Add to dashboard Cite

show abstract

Simulating cyberattacks with extended Petri nets

Petty,

Bland,

Whitaker

et al. 2024

SIMULATION

View full text Add to dashboard Cite

Cybersecurity is an urgent concern. Cybersecurity simulation is an important part of the response to it. This article describes a research program consisting of several interconnected cybersecurity simulation research projects. Cyberattacks are modeled using Petri nets extended with features designed for modeling cyberattacks, including representations of the attacker’s and defender’s strategies, their actions, and their actions’ cost. A database of known attack patterns is automatically processed to generate cyberattack component models, one for each attack pattern. The models are verified and validated using multiple application-relevant methods that consider both Petri nets’ theoretical properties and cyberattacks’ practical characteristics. Because the source attack pattern database is attacker-centric, the cyberattack component models are enhanced to include defender actions and responses, as well as representations of normal user activities on the computer system being attacked. Cyberattack component models stored in a repository are selected and composed into complete models of target computer systems. Metadata associated with each model guides the selection and composition. The cyberattack models are executed to simulate cyberattacks. Multiple simulation iterations are used to train reinforcement learning algorithms that automatically learn improved attacker or defender strategies.

show abstract

Performance impact analysis of services under a time-based moving target defense mechanism

Cited by 2 publications

References 36 publications

Event-Based Moving Target Defense in Cloud Computing with VM Migration: A Performance Modeling Approach

Event-Based Moving Target Defense in Cloud Computing with VM Migration: A Performance Modeling Approach

Simulating cyberattacks with extended Petri nets

Contact Info

Product

Resources

About