Reputation-based service migration for moving target defense

Abstract

As a proactive security approach, service migration can be used as a mechanism for moving target defense. By strategically moving services to different platforms, the system changes the service locations and the underlying platform configurations so that potential attackers cannot identify and target those services. This form of moving target increases the barriers for the attackers and make the system more unpredictable for outsiders. In this paper, we present a reputation-based service migration scheme to select the destination platform for each service to migrate periodically or on-demand. In a system where the platforms have different levels of security, quality, reliability, and communication capability to support user services, it is pertinent to choose the appropriate platform for each service as the new hosting infrastructure. The ability and quality of each platform to support user services is reflected on its reputation as evaluated by a set of agents in the system. The reputation of a platform is assessed based on a set of categorical factors. For each factor, a category reputation is determined from the perspective of that factor. We use a transferable belief-based model to combine multiple agents' opinions towards a platform's category reputation. Those category reputations are then aggregated to the overall reputation of the platform. Given the reputations of different platforms in the system, a service is to migrate to a platform with a high level of reputation.