Attention: moving target defense networks, how well are you moving?

Abstract

The immense address space available with the new 128-bit addressing scheme enables mechanisms like Moving Target Defense for IPv6 networks. Moving Target IPv6 Defense (MT6D) promises security by letting nodes hop to new addresses that are cryptographically computed between involved nodes without disrupting ongoing conversations. After implementing MT6D as a testbed for previous research project, we asked ourselves if it is worth looking at the old addresses that are being given up by MT6D nodes and purged in the process. We explored the idea if activity on these relinquished addresses holds any vital clues for verifying and reinforcing the security of MT6D networks. During the analysis, we realized the need for a method to ensure the resiliency of the scheme besides uncovering any attacks that are underway. In this paper, we will discuss a novel solution that comprises of learning addresses that are being relinquished by the MT6D nodes, acquiring these addresses, performing traffic enumeration on these addresses and visualizing the same. We can become cognizant of a trailing attacker following a MT6D node along the address changes, besides uncovering any suspicious traffic hitting the MT6D nodes with this solution in place.