A Model for Evaluating and Comparing Moving Target Defense Techniques Based on Generalized Stochastic Petri Net
Moving Target Defense has been proposed as a way to alter the asymmetric situation of attacks and defenses, and there has been given a great number of related works. Currently, the performance evaluation of these works has largely been empirical, but lack
- PDF / 2,487,213 Bytes
- 14 Pages / 439.37 x 666.142 pts Page_size
- 22 Downloads / 186 Views
eneralized stochastic petri net ·
Introduction
With the rapid growth of information technologies, Internet has become a national key infrastructure. However, cyber-attacks (such as IP prefix hijacking [1], botnet [2], DDoS attack [3]) can still be found everywhere, and major security incidents have been frequently reported in recent years (such as the PRISM [4], the Heartbleed Bug [5], eBay data leakage). Such security disasters are repeatedly showing that, the security of the Internet is always facing severe challenges. One of the major reasons of the severe Internet security situation is that the network configurations nowadays are typically deterministic, static, and homogeneous [6,7]. These features reduce the difficulties for cyber attackers scanning the network to identify specific targets and gather essential information, which gives the attackers the advantages of building up, launching and spreading attacks. Therefore, in the struggle between cyber network attack and defense, the attackers typically have asymmetric advantages and the defenders are always disadvantaged by being passive. c Springer Science+Business Media Singapore 2016 J. Wu and L. Li (Eds.): ACA 2016, CCIS 626, pp. 184–197, 2016. DOI: 10.1007/978-981-10-2209-8 16
A Model for Evaluating and Comparing Moving Target Defense Techniques
185
To alter the asymmetric situation between attacks and defenses, Moving Target Defense (MTD) is proposed as one of the “game-changing” themes in cybersecurity [6,8], which attempts to create, evaluate, and deploy mechanisms and strategies which are diverse, continually shift and change over time to increase complexity and costs for attackers, limit the exposure of vulnerabilities and opportunities for attack, and increase system resiliency [6]. Currently, there has been proposed a multitude of MTD approaches. The performance evaluation for these MTD approaches is usually empirical, but lacks the application of theoretical models. Until now, only three related works introduced existing urn models to the MTD area, and use them to evaluate the performance of Network Address Shuffling [9], Port Hopping [10], and combination of deception defense and movement (actually, Network Address Shuffling) [11], respectively. Furthermore, there lacks the comparison between different MTD techniques except the work of Jun Xu [12]. Petri Net (PN) is created as a mathematical tool to describe and model the information system, and system performance evaluation is one of its most successful applications [13]. In this paper, we attempt to introduce Petri Net theory into MTD area for evaluating and comparing different MTD techniques. To build the generalized abstract evaluation model for MTD system, we choose a Web server as the deployment platform. There are two reasons to consider this scenario. The one is that Web server is an very important target in network, which is worth deploying MTD to increase its security and resiliency. The other is that the three main typical MTD techniques (Software Transformations (ST), Dynamic Platform Tec
Data Loading...
