WF-MTD: Evolutionary Decision Method for Moving Target Defense Based on Wright-Fisher Process

Abstract

The limitations of the professional knowledge and cognitive capabilities of both attackers and defenders mean that moving target attack-defense conflicts are not completely rational, which makes it difficult to select optimal moving target defense strategies difficult for use in real-world attack-defense scenarios. Starting from the imperfect rationality of both attack-defense, we construct a Wright-Fisher process-based moving target defense strategy evolution model called WF-MTD. In our method, we introduce rationality parameters to describe the strategy learning capabilities of both the attacker and the defender. By solving for the evolutionarily stable equilibrium, we develop a method for selecting the optimal defense strategy for moving targets and describe the evolution trajectories of the attack-defense strategies. Our experimental results in our example of a typical network information system show that WF-MTD selects appropriate MTD strategies in different states along different attack paths, with good effectiveness and broad applicability. In addition, compared with no hopping strategy, fixed periodic route hopping strategy, and random periodic route hopping strategy, the route hopping strategy based on WF-MTD increase defense payoffs by 58.7%, 27.6%, and 24.6%, respectively.

A data-driven ensemble technique for the detection of false data injection attacks in the smart grid framework

“…Historically, to discover irregular energy usage, technicians must examine consumer monthly consumption data collected over an extended period, and after that, they must physically visit each resident community to confirm the condition and connection of each meter (Cheng et al, 2017;Zhang et al, 2023a). Due to research into machine learning (ML) techniques, power utilities now have a new opportunity to identify unusual electricity usage patterns from a variety of energy data (Zhang et al, 2023b;Tan et al, 2023). By identifying anomalous patterns, these techniques can reduce the workload for system operators and increase detection accuracy (Guarda et al, 2023).…”

Efficient Graph Network Using Total Magic Labeling and Its Applications

“…In the realms of cybersecurity, cryptography and security analysis, an adversary model-often termed a threat model-is a conceptual framework designed to characterize and delineate potential attackers or threats that a system, protocol or application might face. This model assists in identifying and understanding the myriad strategies an adversary might employ to compromise a system's security [51][52][53].…”

DPW-RRM: Random Routing Mutation Defense Method Based on Dynamic Path Weight

“…After obtaining the three indicators of degree centrality, intermediate centrality and proximity centrality of the node, we weight them to obtain the centrality weight u C of the node, as shown in formula (8), where the weights of the three indicators are determined by the network administrator according to the network topology. The weight of the path set Paths is initialized using the centrality weight u C of the node.…”

“…As can be seen from the figure, since the routing path in the static network will not change once it is generated, the shortest path between host1 and server20 is obtained according to the shortest path algorithm as (1-4-5-8-9). Therefore, the attacker can monitor all communication data between host1 and server20 on any of the switches (4,5,8). In contrast, the random routing network will distribute the communication data on all switch nodes, however, the randomly generated forwarding path will cause some important nodes (such as node 5) to appear repeatedly in multiple paths, so that the attacker in important nodes can obtain most of the communication data and may cause link congestion of important nodes.…”