TY - JOUR
T1 - A Survey of Moving Target Defenses for Network Security
AU - Sengupta, Sailik
AU - Chowdhary, Ankur
AU - Sabur, Abdulhakim
AU - Alshamrani, Adel
AU - Huang, Dijiang
AU - Kambhampati, Subbarao
N1 - Funding Information:
Manuscript received April 30, 2019; revised October 24, 2019; accepted February 13, 2020. Date of publication March 26, 2020; date of current version August 21, 2020. This work was supported in part by the Naval Research Laboratory under Grant N00173-15-G017 and Grant N0017319-1-G002, in part by the Air Force Office of Scientific Research under Grant FA9550-18-1-0067, in part by the National Aeronautics and Space Administration under Grant NNX17AD06G, in part by the Office of Naval Research under Grant N00014-16-1-2892, Grant N00014-18-1-2442, and Grant N00014-18-12840, in part by NSF U.S. under Grant DGE-1723440, Grant OAC-1642031, Grant SaTC-1528099, and Grant 1723440, in part by NSF China under Grant 61628201 and Grant 61571375, in part by the JP Morgan AI Research Faculty Award, and in part by DARPA CHASE under Grant W912CG-19-C-0003 (via IBM). The work of Sailik Sengupta was supported by the IBM Ph.D. Fellowship. The work of Abdulhakim Sabur was supported by a scholarship from Taibah University through Saudi Arabian Cultural Mission. (Sailik Sengupta and Ankur Chowdhary contributed equally to this work.) (Corresponding author: Sailik Sengupta.) Sailik Sengupta, Ankur Chowdhary, Dijiang Huang, and Subbarao Kambhampati are with the School of Computing, Informatics, and Decision Systems Engineering, Arizona State University, Tempe, AZ 85287 USA (e-mail: ssengu15@asu.edu; achaud16@asu.edu; dijiang@asu.edu; rao@asu.edu).
Publisher Copyright:
© 1998-2012 IEEE.
PY - 2020/7/1
Y1 - 2020/7/1
N2 - Network defenses based on traditional tools, techniques, and procedures (TTP) fail to account for the attacker's inherent advantage present due to the static nature of network services and configurations. To take away this asymmetric advantage, Moving Target Defense (MTD) continuously shifts the configuration of the underlying system, in turn reducing the success rate of cyberattacks. In this survey, we analyze the recent advancements made in the development of MTDs and highlight (1) how these defenses can be defined using common terminology, (2) can be made more effective with the use of artificial intelligence techniques for decision making, (3) be implemented in practice and (4) evaluated. We first define an MTD using a simple and yet general notation that captures the key aspects of such defenses. We then categorize these defenses into different sub-classes depending on what they move, when they move and how they move. In trying to answer the latter question, we showcase the use of domain knowledge and game-theoretic modeling can help the defender come up with effective and efficient movement strategies. Second, to understand the practicality of these defense methods, we discuss how various MTDs have been implemented and find that networking technologies such as Software Defined Networking and Network Function Virtualization act as key enablers for implementing these dynamic defenses. We then briefly highlight MTD test-beds and case-studies to aid readers who want to examine or deploy existing MTD techniques. Third, our survey categorizes proposed MTDs based on the qualitative and quantitative metrics they utilize to evaluate their effectiveness in terms of security and performance. We use well-defined metrics such as risk analysis and performance costs for qualitative evaluation and metrics based on Confidentiality, Integrity, Availability (CIA), attack representation, QoS impact, and targeted threat models for quantitative evaluation. Finally, we show that our categorization of MTDs is effective in identifying novel research areas and highlight directions for future research.
AB - Network defenses based on traditional tools, techniques, and procedures (TTP) fail to account for the attacker's inherent advantage present due to the static nature of network services and configurations. To take away this asymmetric advantage, Moving Target Defense (MTD) continuously shifts the configuration of the underlying system, in turn reducing the success rate of cyberattacks. In this survey, we analyze the recent advancements made in the development of MTDs and highlight (1) how these defenses can be defined using common terminology, (2) can be made more effective with the use of artificial intelligence techniques for decision making, (3) be implemented in practice and (4) evaluated. We first define an MTD using a simple and yet general notation that captures the key aspects of such defenses. We then categorize these defenses into different sub-classes depending on what they move, when they move and how they move. In trying to answer the latter question, we showcase the use of domain knowledge and game-theoretic modeling can help the defender come up with effective and efficient movement strategies. Second, to understand the practicality of these defense methods, we discuss how various MTDs have been implemented and find that networking technologies such as Software Defined Networking and Network Function Virtualization act as key enablers for implementing these dynamic defenses. We then briefly highlight MTD test-beds and case-studies to aid readers who want to examine or deploy existing MTD techniques. Third, our survey categorizes proposed MTDs based on the qualitative and quantitative metrics they utilize to evaluate their effectiveness in terms of security and performance. We use well-defined metrics such as risk analysis and performance costs for qualitative evaluation and metrics based on Confidentiality, Integrity, Availability (CIA), attack representation, QoS impact, and targeted threat models for quantitative evaluation. Finally, we show that our categorization of MTDs is effective in identifying novel research areas and highlight directions for future research.
KW - Cyber security
KW - QoS metrics
KW - advanced persistent threats
KW - artificial intelligence
KW - attack representation methods (ARMs)
KW - cyber deception
KW - cyber kill chain (CKC)
KW - game theory
KW - moving target defense
KW - network function virtualization (NFV)
KW - network security
KW - qualitative metrics
KW - quantitative metrics
KW - risk analysis
KW - software-defined networking (SDN)
UR - http://www.scopus.com/inward/record.url?scp=85083468585&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85083468585&partnerID=8YFLogxK
U2 - 10.1109/COMST.2020.2982955
DO - 10.1109/COMST.2020.2982955
M3 - Article
AN - SCOPUS:85083468585
SN - 1553-877X
VL - 22
SP - 1909
EP - 1941
JO - IEEE Communications Surveys and Tutorials
JF - IEEE Communications Surveys and Tutorials
IS - 3
M1 - 9047923
ER -