Secure Multipath Mutation SMPM in Moving Target Defense Based on SDN

Zkik, Karim; Sebbar, Anass; Baddi, Youssef; Boulmalf, Mohammed

doi:10.1016/j.procs.2019.04.137

Cited by 9 publications

(4 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…By now, the researchers have put more emphasis on changing static parameters of the data flow on the fly [16,17,18,19,20]. The IP address [21], the port [22], and the routing path of a flow [11,19,20,23,24,25] are the main objects of dynamic configuration.…”

Section: Related Workmentioning

confidence: 99%

Polymorphic Path Transferring for Secure Flow Delivery

2021

KSII TIIS

View full text Add to dashboard Cite

In most cases, the routing policy of networks shows a preference for a static one-to-one mapping of communication pairs to routing paths, which offers adversaries a great advantage to conduct thorough reconnaissance and organize an effective attack in a stress-free manner. With the evolution of network intelligence, some flexible and adaptive routing policies have already proposed to intensify the network defender to turn the situation. Routing mutation is an effective strategy that can invalidate the unvarying nature of routing information that attackers have collected from exploiting the static configuration of the network. However, three constraints execute press on routing mutation deployment in practical: insufficient route mutation space, expensive control costs, and incompatibility. To enhance the availability of route mutation, we propose an OpenFlow-based route mutation technique called Polymorphic Path Transferring (PPT), which adopts a physical and virtual path segment mixed construction technique to enlarge the routing path space for elevating the security of communication. Based on the Markov Decision Process, with considering flows distribution in the network, the PPT adopts an evolution routing path scheduling algorithm with a segment path update strategy, which relieves the press on the overhead of control and incompatibility. Our analysis demonstrates that PPT can secure data delivery in the worst network environment while countering sophisticated attacks in an evasion-free manner (e.g., advanced persistent threat). Case study and experiment results show its effectiveness in proactively defending against targeted attacks and its advantage compared with previous route mutation methods.

show abstract

Section: Related Workmentioning

confidence: 99%

Polymorphic Path Transferring for Secure Flow Delivery

2021

KSII TIIS

View full text Add to dashboard Cite

show abstract

“…us, network defense technique transforms from "passive defense" to "proactive defense" and networkbased MTD comes into being. Existing studies on path mutation technique mainly include multipath mutation [13][14][15] and random-path mutation [16][17][18].…”

Section: Related Workmentioning

confidence: 99%

“…RRM was extended by Jafarian et al [14] via optimizing the mutation strategy based on game theory and constraint satisfaction optimization to improve the defense capability of path mutation. To enhance the mutation efficiency and increase the complexity of attacks in scanning and poisoning, Zkik et al [15] focused on modeling software defined network (SDN) architectures, where two new modules were implemented to automatically calculate the suitable paths based on a pathfinder algorithm. However, owing to the deterministic nature of these multipath mutation techniques, the adversary who has acquired the routing algorithm can calculate the mutation path and hence endangers all packets forwarded over this path.…”

Section: Multipath Mutationmentioning

confidence: 99%

“…en, we construct network security capacity matrix Q[sc S,D ] n×n in step ( 9), and screen out the possible forwarding paths in Q[sc S,D ] n×n by the forwarding path delay constraint and the forwarding path accessibility constraint in steps ( 10)- (12). Finally, we rank the alternative combinations of mutation path and mutation period in steps ( 13) and ( 14), and return the optimal one to achieve the maximum defense benefits in step (15).…”

Section: Mutation Path Generation Algorithmmentioning

confidence: 99%

See 1 more Smart Citation

Moving Target Defense Based on Adaptive Forwarding Path Migration for Securing the SCADA Network

Xun

Zhu

et al. 2021

Security and Communication Networks

View full text Add to dashboard Cite

Static characteristics of supervisory control and data acquisition (SCADA) system are often exploited to perform malicious activities on smart grids. Most of the time, the success of cyberattacks begins with the profiling of the target system and follows by the analysis of the limited resources. To alleviate the asymmetry between attack and defense, network-based moving target defense (MTD) techniques have been applied in the network system to defend against cyberattacks by constructing a dynamic attack surface to the adversary. In this paper, we propose a novel MTD technique based on adaptive forwarding path migration (AFPM) that focuses on improving the defense capability and optimizing the network performance of path mutation. Considering the transient problems present in path mutation caused by the dynamic switching of the forwarding path, we formalize the mutation constraints based on the satisfiability modulo theory (SMT) to select the mutation path. Considering the limited defense capability of path mutation owing to the traditional mutation selection mechanism, we design the mutation path generation algorithm based on the network security capacity matrix to obtain an optimal combination of mutation path and mutation period. Finally, we compare and analyze various cyber defense techniques used in the SCADA network and demonstrate experimentally that our MTD technique can prevent more than 92% of passive monitoring under specified conditions while ensuring the quality of service (QoS) to be almost the same as the static network.

show abstract