Abstract:IP address mutation is a proactive defense method that is used to reduce the risk of network attacks, especially to deal with the worm propagation attacks. However, previous work did not give much consideration to the negative effects that IP address mutation could bring to network performance. To be specific, there is a trade-off between network performance and security, which implies that when a security mechanism is reinforced, network performance would be impaired and vice versa. Therefore, in order to achieve the optimal balance between performance and security, an optimal solution should be provided. In this paper, we propose an adaptive IP mutation defense method which is based on temporal-dimension, to dynamically control the mutation interval according to real-time measurable metrics, assurance and avoidance. This method leverages a genetic algorithm to achieve the optimization of performance-security trade-off. We then evaluate our method in a simulated computer cluster environment, including 1024 hosts, and demonstrate that our method can successfully find the optimal solution according to the experimental results. For example, it can reduce the worm propagation significantly, while maintaining the network performance in a predefined level.

A Defense Approach of DAD Attack in Stateless Auto Configuration

Hiding and Trapping: A Deceptive Approach for Defending against Network Reconnaissance with Software-Defined Network

Novel Duplicate Address Detection with Hash Function

Combination Attacks and Defenses on SDN Topology Discovery.

Multi-variant Network Address Hopping to Defend Stealthy Crossfire Attack

P4DAD: Securing Duplicate Address Detection Using P4

Towards securing Duplicate Address Detection using P4

Duplicate Address Detection Process with Variable-Length Prefix

Adaptive IP Mutation: A Proactive Approach for Defending against Worm Propagation

A Method Based on AMHI for DDoS Attacks Detection and Defense

Research on Equivalence Between Address Resolution and Duplicate Address Detection

Research on Two Problems Related to Address Resolution

A Pull Model Ipv6 Duplicate Address Detection

A Novel Address Resolution Process Based on the Seek Secret Man Protocol.

A Two-Level Source Address Spoofing Prevention Based on Automatic Signature and Verification Mechanism

Address Protection-as-a-Service An inter-AS Framework for IP Spoofing Resilience

Research on Stateless Address Auto-Configuration and Duplicate Address Detection in Space-Integrated-Ground Information Network

Dynamic Dual-Binding: A Solution to ARP Cache Poisoning

Research of the ARP Spoofing Principle and a Defensive Algorithm

Proactive Security Defense of Dynamic Network

Agent-Based Passive Autoconfiguration for Large Scale MANETs