Abstract:Network defenses based on traditional tools, techniques, and procedures (TTP) fail to account for the attacker's inherent advantage present due to the static nature of network services and configurations. To take away this asymmetric advantage, Moving Target Defense (MTD) continuously shifts the configuration of the underlying system, in turn reducing the success rate of cyberattacks. In this survey, we analyze the recent advancements made in the development of MTDs and highlight (1) how these defenses can be defined using common terminology, (2) can be made more effective with the use of artificial intelligence techniques for decision making, (3) be implemented in practice and (4) evaluated. We first define an MTD using a simple and yet general notation that captures the key aspects of such defenses. We then categorize these defenses into different sub-classes depending on what they move, when they move and how they move. In trying to answer the latter question, we showcase the use of domain knowledge and game-theoretic modeling can help the defender come up with effective and efficient movement strategies. Second, to understand the practicality of these defense methods, we discuss how various MTDs have been implemented and find that networking technologies such as Software Defined Networking and Network Function Virtualization act as key enablers for implementing these dynamic defenses. We then briefly highlight MTD test-beds and case-studies to aid readers who want to examine or deploy existing MTD techniques. Third, our survey categorizes proposed MTDs based on the qualitative and quantitative metrics they utilize to evaluate their effectiveness in terms of security and performance. We use well-defined metrics such as risk analysis and performance costs for qualitative evaluation and metrics based on Confidentiality, Integrity, Availability (CIA), attack representation, QoS impact, and target-d threat models for quantitative evaluation. Finally, we show that our categorization of MTDs is effective in identifying novel research areas and highlight directions for future research.

A Model for Evaluating and Comparing Moving Target Defense Techniques Based on Generalized Stochastic Petri Net.

Model-based Performance Evaluation of a Moving Target Defense System

Effectiveness Evaluation Model of Moving Target Defense Based on System Attack Surface

Application Of Stochastic Petri Net For The Evaluation Of Intrusion-Tolerant Systems In Distributed Systems

Game Theoretic Analysis for the Mechanism of Moving Target Defense

Gametheoretic analysis for themechanism of moving target defense

NPM: an Anti-attacking Analysis Model of the MTD System Based on Martingale Theory

Moving target defense: state of the art and characteristics

A Two-Dimension Security Assessing Model for CMDs Combined with Generalized Stochastic Petri Net

A Survey of Moving Target Defenses for Network Security

Moving Target Defense for Web Applications using Bayesian Stackelberg Games

Modeling and Analysing of Air-defense Threat Netting

Efficient Strategy Selection for Moving Target Defense under Multiple Attacks

An Evaluation Method of Object-Oriented Petri Net on Combat Effectiveness of Air Defense and Antimissile

Numerical Evaluation of Job Finish Time under MTD Environment

MTTEGDM: A Moving Target Evolutionary Game Defense Model Based on Three-Way Decisions

Modeling and security analysis of enterprise network using attack-defense stochastic game Petri nets

Network Attack and Defense Modeling and System Security Analysis: A Novel Approach Using Stochastic Evolutionary Game Petri Net

Research and Development of Moving Target Defense Technology

The Analysis Techniques and Applications of Generalized Stochastic Petri Net

Towards a Theory of Moving Target Defense