Quantifying & minimizing attack surfaces containing moving target defenses

Many security problems in software systems are because of vulnerabilities caused by improper configurations. A poorly configured software system leads to a multitude of vulnerabilities that can be exploited by adversaries. The problem becomes even more serious when the architecture of the underlying system is static and the misconfiguration remains for a longer period of time, enabling adversaries to thoroughly inspect the software system under attack during the reconnaissance stage. Employing diversification techniques such as Moving Target Defense (MTD) can minimize the risk of exposing vulnerabilities. MTD is an evolving defense technique through which the attack surface of the underlying system is continuously changing. However, the effectiveness of such dynamically changing platform depends not only on the goodness of the next configuration setting with respect to minimization of attack surfaces but also the diversity of set of configurations generated. To address the problem of generating a diverse and large set of secure software and system configurations, this paper introduces an approach based on Reinforcement Learning (RL) through which an agent is trained to generate the desirable set of configurations. The paper reports the performance of the RL-based secure and diverse configurations through some case studies.

Download Full-text

A moving-target defense strategy for Cloud-based services with heterogeneous and dynamic attack surfaces

2014 IEEE International Conference on Communications (ICC) ◽

10.1109/icc.2014.6883418 ◽

2014 ◽

Cited By ~ 28

Author(s):

Wei Peng ◽

Feng Li ◽

Chin-Tser Huang ◽

Xukai Zou

Keyword(s):

Moving Target ◽

Moving Target Defense ◽

Defense Strategy ◽

Attack Surfaces

Download Full-text

A Semistructured Random Identifier Protocol for Anonymous Communication in SDN Network

Security and Communication Networks ◽

10.1155/2018/2916356 ◽

2018 ◽

Vol 2018 ◽

pp. 1-20

Author(s):

Yulong Wang ◽

Junjie Yi ◽

Jun Guo ◽

Yanbo Qiao ◽

Mingyue Qi ◽

...

Keyword(s):

Binary Tree ◽

Network Performance ◽

Traffic Analysis ◽

Transport Layer ◽

Local Network ◽

Anonymous Communication ◽

Moving Target ◽

New Paradigm ◽

Network Defense ◽

Attack Surfaces

Traffic analysis is an effective mean for gathering intelligence from within a large enterprise’s local network. Adversaries are able to monitor all traffic traversing a switch by exploiting just one vulnerability in it and obtain valuable information (e.g., online hosts and ongoing sessions) for further attacking, while administrators have to patch all switches as soon as possible in hope of eliminating the vulnerability in time. Moving Target Defense (MTD) is a new paradigm for reobtaining the upper hand in network defense by dynamically changing attack surfaces of the network. In this paper, we propose U-TRI (unlinkability through random identifier) as a moving target technique for changing the information-leaking identifiers within PDUs for SDN network. U-TRI is based on VIRO protocol and implemented with the help of OpenFlow protocol. U-TRI employs an independent, binary tree-structured, periodically and randomly updating identifier to replace the first part of the static MAC address in PDU, and assigns unstructured random values to the remaining part of the MAC address. U-TRI also obfuscates identifiers in the network layer and transport layer in an unstructured manner. Such a semistructured random identifier enables U-TRI to significantly weaken the linkage between identifiers and end-hosts as well as communication sessions, thus providing anonymous communication in SDN network. The result of analysis and experiments indicates that U-TRI dramatically increases the difficulty of traffic analysis with acceptable burdens on network performance.

Download Full-text