Security and Science of Agility

Abstract

Moving target defenses alter the environment in response to adversarial action and perceived threats. Such defenses are a specific example of a broader class of system management techniques called system agility. In its fullest generality, agility is any reasoned modification to a system or environment in response to a functional, performance, or security need. This paper details a recently launched 10-year Cyber-Security Collaborative Research Alliance effort focused in-part on the development of a new science of system agility, of which moving target defenses are a central theme. In this context, the consortium seeks to address the questions of when, what, and how to employ changes to improve the security of an environment, as well as consider how to measure and weigh the effectiveness of different approaches to agility. We discuss several fundamental challenges in developing and using MTD maneuvers, and outline several broad classes of mechanisms that can be used to implement them. We conclude by detailing specific MTD mechanisms used to adaptively quarantine vulnerable code in Android applications, and consider ways of comparing cost and payout of its use.

Metrics Towards Measuring Cyber Agility

“…It has been investigated in multiple domains [16], [17], [18], [19], [20], [21], [22]. In an enterprise system, agility is defined as the ability to deal with sudden changes in an environment (e.g., the latency of response to sudden or unexpected changes [1], [16], [17], [18], [22]). In the systems engineering domain, agility measures a system's capability of the reactive or proactive response to sudden environmental changes [23].…”

“…In the cybersecurity domain, agility often refers to reasoned changes to a system or environment in response to functional or security needs, but has not been paid due attention until very recently [15], [1], [2], [3], [4], [5]. While it would be intuitive to understand agility as how fast (e.g., response ability [23]) and how effective a system can adapt its configuration to unexpected attacks against it (e.g., considering the cost incurred by the degraded system performance or the cost incurred by response actions [1], [24]), the concept of agility is, like other metrics, elusive to formalize. Indeed, there is no rigorous or quantitative definition of agility in the cybersecurity domain and existing attempts to model agility have not been able to produce concrete measurements [2], [25], [26].…”

“…, D t17 . These 18 generations are made for 1,294 days, meaning that the time horizon for the defender is [t 0 , t 17 ] = [1,1294]. These Snort versions are tested on Virtual Machines (VMs) using the Ubuntu 14 operating system after making few changes on the default settings in the snort.conf file to best fit for this experiment.…”

“…9 plots the measured evolution metrics for the Honeypot dataset. Recall that the defender's time horizon is [t 0 , t 17 ] = [1,1294] and the attacker's time horizon is [t 0 , t 17 ] = [80,1108]. This means that there are missing attack generations in the defender's time horizon, for which some metrics cannot be measured.…”

Cyberspace Security Using Adversarial Learning and Conformal Prediction

“…Similar strategies also support system agility. This "[to engage] in any reasoned modification to a system or environment in response to a functional, performance, or security need" using MTD [73]. System agility is expected to be responsive to W5+ like questions (see Sect.…”