Abstract:Network defenses based on traditional tools, techniques, and procedures (TTP) fail to account for the attacker's inherent advantage present due to the static nature of network services and configurations. To take away this asymmetric advantage, Moving Target Defense (MTD) continuously shifts the configuration of the underlying system, in turn reducing the success rate of cyberattacks. In this survey, we analyze the recent advancements made in the development of MTDs and highlight (1) how these defenses can be defined using common terminology, (2) can be made more effective with the use of artificial intelligence techniques for decision making, (3) be implemented in practice and (4) evaluated. We first define an MTD using a simple and yet general notation that captures the key aspects of such defenses. We then categorize these defenses into different sub-classes depending on what they move, when they move and how they move. In trying to answer the latter question, we showcase the use of domain knowledge and game-theoretic modeling can help the defender come up with effective and efficient movement strategies. Second, to understand the practicality of these defense methods, we discuss how various MTDs have been implemented and find that networking technologies such as Software Defined Networking and Network Function Virtualization act as key enablers for implementing these dynamic defenses. We then briefly highlight MTD test-beds and case-studies to aid readers who want to examine or deploy existing MTD techniques. Third, our survey categorizes proposed MTDs based on the qualitative and quantitative metrics they utilize to evaluate their effectiveness in terms of security and performance. We use well-defined metrics such as risk analysis and performance costs for qualitative evaluation and metrics based on Confidentiality, Integrity, Availability (CIA), attack representation, QoS impact, and target-d threat models for quantitative evaluation. Finally, we show that our categorization of MTDs is effective in identifying novel research areas and highlight directions for future research.

A moving target defence approach for detecting deception attacks on cyber-physical systems

Game Theory Approaches for Evaluating the Deception-based Moving Target Defense

A Moving Target Defense for Securing Cyber-Physical Systems

Stealthy MTD Against Unsupervised Learning-based Blind FDI Attacks in Power Systems

MTDSense: AI-Based Fingerprinting of Moving Target Defense Techniques in Software-Defined Networking

Replay Attack Detection for Cyber-Physical Systems with Sensitive States

PDDL: Proactive Distributed Detection and Localization Against Stealthy Deception Attacks in DC Microgrids

A Secure Strategy for a Cyber Physical System with Multi-Sensor under Linear Deception Attack.

Effectiveness of Moving Target Defenses for Adversarial Attacks in ML-based Malware Detection

Moving-horizon False Data Injection Attack Design against Cyber-Physical Systems

An Active Detection Strategy Based on Dimensionality Reduction for False Data Injection Attacks in Cyber-Physical Systems

CPMTD: Cyber-physical moving target defense for hardening the security of power system against false data injected attack

A Survey of Moving Target Defenses for Network Security

DOLOS: A Novel Architecture for Moving Target Defense

Converter-Based Moving Target Defense Against Deception Attacks in DC Microgrids

Enhanced cyber‐physical security using attack‐resistant cyber nodes and event‐triggered moving target defence

Multi-stage Moving Target Defense: A Security-enhanced D-FACTS Implementation Approach

Topology switching-based moving target defense against false data injection attacks on a power system

Moving-Target Defense for Detecting Coordinated Cyber-Physical Attacks in Power Grids

Towards a Theory of Moving Target Defense

Moving target defense: state of the art and characteristics