Abstract:Network defenses based on traditional tools, techniques, and procedures (TTP) fail to account for the attacker's inherent advantage present due to the static nature of network services and configurations. To take away this asymmetric advantage, Moving Target Defense (MTD) continuously shifts the configuration of the underlying system, in turn reducing the success rate of cyberattacks. In this survey, we analyze the recent advancements made in the development of MTDs and highlight (1) how these defenses can be defined using common terminology, (2) can be made more effective with the use of artificial intelligence techniques for decision making, (3) be implemented in practice and (4) evaluated. We first define an MTD using a simple and yet general notation that captures the key aspects of such defenses. We then categorize these defenses into different sub-classes depending on what they move, when they move and how they move. In trying to answer the latter question, we showcase the use of domain knowledge and game-theoretic modeling can help the defender come up with effective and efficient movement strategies. Second, to understand the practicality of these defense methods, we discuss how various MTDs have been implemented and find that networking technologies such as Software Defined Networking and Network Function Virtualization act as key enablers for implementing these dynamic defenses. We then briefly highlight MTD test-beds and case-studies to aid readers who want to examine or deploy existing MTD techniques. Third, our survey categorizes proposed MTDs based on the qualitative and quantitative metrics they utilize to evaluate their effectiveness in terms of security and performance. We use well-defined metrics such as risk analysis and performance costs for qualitative evaluation and metrics based on Confidentiality, Integrity, Availability (CIA), attack representation, QoS impact, and target-d threat models for quantitative evaluation. Finally, we show that our categorization of MTDs is effective in identifying novel research areas and highlight directions for future research.

Self-Adaptive End-Point Mutation Technique Based on Adversary Strategy Awareness.

Adaptive IP Mutation: A Proactive Approach for Defending against Worm Propagation

Evolving Defense Mechanism for Future Network Security

Modeling of the Mimic Defense Based on Heterogeneous Redundancy

A Mutation-Enabled Proactive Defense Against Service-Oriented Man-in-The-Middle Attack in Kubernetes

Implementation of a Lossless Moving Target Defense Mechanism

Probabilistic models for evaluating network edge's resistance against scan and foothold attack

Moving Target Defense Techniques: A Survey

A Self-transforming Proactive Defense Network Framework based on“carrier”

A Survey of Moving Target Defenses for Network Security

Strategy-Aware Mitigation Using Markov Games for Dynamic Application-Layer Attacks

Adaptive Attacker Strategy Development Against Moving Target Cyber Defenses

Adversarial Sample Detection for Deep Neural Network through Model Mutation Testing

Learning Effective Strategies for Moving Target Defense with Switching Costs

Adaptive MTD Security using Markov Game Modeling

Every Time Can Be Different: A Data Dynamic Protection Method Based on Moving Target Defense.

Anti-Attacking Modeling and Analysis of Cyberspace Mimic DNS

Towards a Theory of Moving Target Defense

Novel Mitm Attacks On Security Protocols In Sdn: A Feasibility Study

An intelligent proactive defense against the client‐side DNS cache poisoning attack via self‐checking deep reinforcement learning

Using POMDP-based Approach to Address Uncertainty-Aware Adaptation for Self-Protecting Software