Scheduling Sequence Control Method Based on Sliding Window in Cyberspace Mimic Defense

Abstract

Cyberspace Mimic Defense (CMD) is a proactive defense theory proposed in recent years to deal with vulnerability and backdoor threats that are common in information systems. Different from moving target defense (MTD), CMD can obtain foundation by verifying multiple results from isolated, heterogeneous, and parallel running spaces, thus initiating a more targeted defensive action, such as scheduling and structure transformation. However, scheduling sequence control is a severe problem in this process, which needs to select a series of scheduling time and take into account security, efficiency, and robustness for variable attack situations. Inspired by the traffic and congestion control mechanism in computer networks, this paper proposed a sliding window-based scheduling sequence control method. By setting driver events to trigger the window ''sliding,'' the control parameters update and adapt to the current state accordingly. Then, considering internal resource constraints and external attack situations, a two-factor driver on variable period and exception threshold with their corresponding calculations are specified. Evaluations show that this method can maintain good performance under different scenarios, which proves to be an effective solution for scheduling sequence control in CMD.

An Optimal Seed Scheduling Strategy Algorithm Applied to Cyberspace Mimic Defense

“…The scheduling timing focuses on when to carry out dynamic scheduling, and the scheduling strategy focuses on how to carry out dynamic scheduling. As for the research on scheduling timing, there have been substantial academic results [17], [29], [30], so it is not the core issue of this article.…”

“…Assuming that the number of online executors is n (n is odd). According to [17], within time ∆t, the online executors change from normal state to abnormal state following a Poisson process with an intensity of λ. Besides, assuming that the probability of each executor returning from abnormal state to normal state in time ∆t is µ∆t+o(∆t).…”

“…However, with further research on MTD, the inherent problems of this mechanism have gradually emerged: it is difficult for MTD to meet the performance requirements of defense coverage, MTD is timeliness and uncontrolled [15], and the frequent changes may have a certain impact on the system performance at the same time [16]. In addition, [17] also pointed out that MTD may have the problem of blindness, inefficiency, and unverifiability.…”

“…By spending huge costs to continuously attack online executors, the network attackers can get enough information from the majority of online executors and finally breach the mimic defense system. This kind of attack method is called coordinated attacks by related researchers [17], [23], [27]. In addition, Advanced Persistent Threat (APT) [28] has always been a huge challenge for many active defense methods including MTD and CMD.…”

A Novel Model of Mimic Defense Based on Minimal L-Order Error Probability

“…Based on operation, MTD can be roughly divided into four types [16]: shuffling [17][18], diversity [19][20], redundancy [21][22][23] and hybrid [24][25]. Although different types of MTD have their own characteristics, it is still difficult to satisfy coverage, timeliness and unpredictability at the same time [26], and problems such as blindness, inefficiency and unverifiability may also arise [27].…”