Proactive Defense for Internet-of-Things: Integrating Moving Target Defense with Cyberdeception

Abstract

Resource constrained Internet-of-Things (IoT) devices are highly likely to be compromised by attackers because strong security protections may not be suitable to be deployed. This requires an alternative approach to protect vulnerable components in IoT networks. In this paper, we propose an integrated defense technique to achieve intrusion prevention by leveraging cyberdeception (i.e., a decoy system) and moving target defense (i.e., network topology shuffling). We verify the effectiveness and efficiency of our proposed technique analytically based on a graphical security model in a software defined networking (SDN)based IoT network. We develop four strategies (i.e., fixed/random and adaptive/hybrid) to address "when" to perform network topology shuffling and three strategies (i.e., genetic algorithm/decoy attack pathbased optimization/random) to address "how" to perform network topology shuffling on a decoy-populated IoT network, and analyze which strategy can best achieve a system goal such as prolonging the system lifetime, maximizing deception effectiveness, maximizing service availability, or minimizing defense cost. Our results demonstrate that a software defined IoT network running our intrusion prevention technique at the optimal parameter setting prolongs system lifetime, increases attack complexity of compromising critical nodes, and maintains superior service availability compared with a counterpart IoT network without running our intrusion prevention technique. Further, when given a single goal or a multi-objective goal (e.g., maximizing the system lifetime and service availability while minimizing the defense cost) as input, the best combination of "when" and "how" strategies is identified for executing our proposed technique under which the specified goal can be best achieved.

Deception Technology Based Intrusion Protection and Detection Mechanism for Digital Substations: A Game Theoretical Approach

“…An adaptive honeynets based on Partially Observable MDP (POMDP) was discussed in [17]. An integrated defense technique for Internet-of-Things (IOT) to achieve intrusion prevention using decoy system with moving target defense was presented in [18]. An adaptive deception technology for APT29 and APT3 scenario descriptions in the MITRE ATT&CK was proposed in [19].…”

A Comprehensive Architectural Framework of Moving Target Defenses Against DDoS Attacks

“…Many research efforts have been devoted to developing efficient MTD mechanisms, architectures, and strategies. Existing efforts target specific technologies such as Cloud [43], Software Defined Networks (SDN) [42,[44][45][46], SCADA systems, and IoT [47]. Despite this diversity, most developed technologies share common procedural guidelines and stages.…”

“…In proactive defense, the move is carried out based on periodic time intervals or random selection of the time interval that might be done using either periodic or random time series [45], this method depends on the time interval and might degrade the performance if the time interval is short [46]. In the hybrid approach, both reactive and proactive approaches might be used together, this will allow the change upon some time interval and will also carry out the change based on an alert from the IDS or firewall that might enhance the security [51].…”

OSINT-Based LPC-MTD and HS-Decoy for Organizational Defensive Deception

“…Existing MTD and N-MTD have been studied to avoid invasion attempts proactively or to improve metrics and variables with a focus on the attenuation of the defender's diversified attack and exploration surface, and then apply it in applied domains, such as IoT [44], cloud [45], and cyber physical systems [46]. Our reason for selecting an MTD mutation cycle using LPC-MTD was to ease the operational deceptive limitations of existing MTD, and to enhance the lack of reactive responses.…”