Abstract:Moving Target Defense and Cyber Deception emerged in recent years as two key proactive cyber defense approaches, contrasting with the static nature of the traditional reactive cyber defense. The key insight behind these approaches is to impose an asymmetric disadvantage for the attacker by using deception and randomization techniques to create a dynamic attack surface. Moving Target Defense typically relies on system randomization and diversification, while Cyber Deception is based on decoy nodes and fake systems to deceive attackers. However, current Moving Target Defense techniques are complex to manage and can introduce high overheads, while Cyber Deception nodes are easily recognized and avoided by adversaries. This paper presents DOLOS, a novel architecture that unifies Cyber Deception and Moving Target Defense approaches. DOLOS is motivated by the insight that deceptive techniques are much more powerful when integrated into production systems rather than deployed alongside them. DOLOS combines typical Moving Target Defense techniques, such as randomization, diversity, and redundancy, with cyber deception and seamlessly integrates them into production systems through multiple layers of isolation. We extensively evaluate DOLOS against a wide range of attackers, ranging from automated malware to professional penetration testers, and show that DOLOS is highly effective in slowing down attacks and protecting the integrity of production systems. We also provide valuable insights and considerations for the future development of MTD techniques based on our findings.

What problem does this paper attempt to address?

The paper primarily aims to address two key issues in network security defense: 1. **Improving traditional passive defense mechanisms**: Traditional network security defense techniques are mostly based on the detect-and-respond paradigm, where intrusions are blocked upon detection and relevant alerts are forwarded to the Computer Security Incident Response Team (CSIRT) for handling. This passive defense approach has an asymmetric disadvantage because the defense measures are usually static and fixed, making it difficult to effectively counter evolving attack methods and emerging vulnerabilities. 2. **Integrating Moving Target Defense (MTD) and network deception technologies**: The paper proposes a new architecture called D OLOS, which aims to combine Moving Target Defense (by making system configurations unpredictable through randomization and diversification, thus increasing the difficulty for attackers to conduct reconnaissance and exploitation) with network deception technologies (by setting up fake systems and honeypots to mislead attackers away from real targets) to overcome their respective limitations. MTD technologies may bring significant system overhead and management complexity, while network deception technologies can be easily identified and bypassed by experienced attackers. The goal of D OLOS is to create a dynamic and hard-to-recognize attack surface by seamlessly integrating deception technologies and randomization strategies within the production system, thereby achieving proactive defense against attackers. Specifically, D OLOS does not directly randomize real system services but manipulates fake services and system attributes to reduce overhead and management complexity. It is directly integrated into the production system through multi-layer isolation, making it difficult for attackers to bypass its defenses. In summary, this research aims to enhance the network security defense system by developing a new architecture, D OLOS, that effectively integrates Moving Target Defense and network deception technologies. This will improve the ability to resist various attackers (including automated malware and professional penetration testers) while minimizing the impact on normal system operations.

DOLOS: A Novel Architecture for Moving Target Defense

Game Theory Approaches for Evaluating the Deception-based Moving Target Defense

A Proactive Decoy Selection Scheme for Cyber Deception using MITRE ATT&CK

A Moving Target Defense for Securing Cyber-Physical Systems

D3GF: A Study on Optimal Defense Performance Evaluation of Drone-Type Moving Target Defense Through Game Theory

A moving target defence approach for detecting deception attacks on cyber-physical systems

PDDL: Proactive Distributed Detection and Localization Against Stealthy Deception Attacks in DC Microgrids

Towards a Theory of Moving Target Defense

Moving Target Defense for Service-oriented Mission-critical Networks

Implementation of a Lossless Moving Target Defense Mechanism

D2M: Dynamic Defense and Modeling of Adversarial Movement in Networks

Moving Target Defense Techniques: A Survey

Proactive Defense for Internet-of-Things: Integrating Moving Target Defense with Cyberdeception

Evaluating Deception and Moving Target Defense with Network Attack Simulation

CHAOS: an SDN-based Moving Target Defense System

A Survey of Moving Target Defenses for Network Security

Research and Development of Moving Target Defense Technology

Proactive Defense Mechanism: Enhancing IoT Security through Diversity-based Moving Target Defense and Cyber Deception

Moving Target Defense: Creating Asymmetric Uncertainty for Cyber Threats - Volume 54

Designing Secure and Resilient Cyber-Physical Systems: a Model-based Moving Target Defense Approach

Learning Effective Strategies for Moving Target Defense with Switching Costs