Proceedings of the 2016 ACM Workshop on Moving Target Defense最新文献

Formal Approach for Resilient Reachability based on End-System Route Agility 基于端系统路由敏捷性的弹性可达性形式化方法

Proceedings of the 2016 ACM Workshop on Moving Target Defense Pub Date : 2016-10-24 DOI: 10.1145/2995272.2995275

Usman Rauf, F. Gillani, E. Al-Shaer, M. Halappanavar, S. Chatterjee, C. Oehmen

{"title":"Formal Approach for Resilient Reachability based on End-System Route Agility","authors":"Usman Rauf, F. Gillani, E. Al-Shaer, M. Halappanavar, S. Chatterjee, C. Oehmen","doi":"10.1145/2995272.2995275","DOIUrl":"https://doi.org/10.1145/2995272.2995275","url":null,"abstract":"The deterministic nature of existing routing protocols has resulted into an ossified Internet with static and predictable network routes. This gives persistent attackers (e.g. eavesdroppers and DDoS attackers) plenty of time to study the network and identify the vulnerable (critical) links to plan devastating and stealthy attacks. Recently, Moving Target Defense (MTD) based approaches have been proposed to to defend against DoS attacks. However, MTD based approaches for route mutation are oriented towards re-configuring the parameters in Local Area Networks (LANs), and do not provide any protection against infrastructure level attacks, which inherently limits their use for mission critical services over the Internet infrastructure. To cope with these issues, we extend the current routing architecture to consider end-hosts as routing elements, and present a formal method based agile defense mechanism to embed resiliency in the existing cyber infrastructure. The major contributions of this paper include: (1) formalization of efficient and resilient End to End (E2E) reachability problem as a constraint satisfaction problem, which identifies the potential end-hosts to reach a destination while satisfying resilience and QoS constraints, (2) design and implementation of a novel decentralized End Point Route Mutation (EPRM) protocol, and (3) design and implementation of planning algorithm to minimize the overlap between multiple flows, for the sake of maximizing the agility in the system. Our PlanetLab based implementation and evaluation validates the correctness, effectiveness and scalability of the proposed approach.","PeriodicalId":20539,"journal":{"name":"Proceedings of the 2016 ACM Workshop on Moving Target Defense","volume":"45 1","pages":""},"PeriodicalIF":0.0,"publicationDate":"2016-10-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"86546798","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 15

SDN based Scalable MTD solution in Cloud Network 云网络中基于SDN的可扩展MTD解决方案

Proceedings of the 2016 ACM Workshop on Moving Target Defense Pub Date : 2016-10-24 DOI: 10.1145/2995272.2995274

Ankur Chowdhary, Sandeep Pisharody, Dijiang Huang

{"title":"SDN based Scalable MTD solution in Cloud Network","authors":"Ankur Chowdhary, Sandeep Pisharody, Dijiang Huang","doi":"10.1145/2995272.2995274","DOIUrl":"https://doi.org/10.1145/2995272.2995274","url":null,"abstract":"Software-Defined Networking (SDN) has emerged as a framework for centralized command and control in cloud data centric environments. SDN separates data and control plane, which provides network administrator better visibility and policy enforcement capability compared to traditional networks. The SDN controller can assess reachability information of all the hosts in a network. There are many critical assets in a network which can be compromised by a malicious attacker through a multistage attack. Thus we make use of centralized controller to assess the security state of the entire network and pro-actively perform attack analysis and countermeasure selection. This approach is also known as Moving Target Defense (MTD). We use the SDN controller to assess the attack scenarios through scalable Attack Graphs (AG) and select necessary countermeasures to perform network reconfiguration to counter network attacks. Moreover, our framework has a comprehensive conflict detection and resolution module that ensures that no two flow rules in a distributed SDN-based cloud environment have conflicts at any layer; thereby assuring consistent conflict-free policy implementation and preventing information leakage.","PeriodicalId":20539,"journal":{"name":"Proceedings of the 2016 ACM Workshop on Moving Target Defense","volume":"307 1","pages":""},"PeriodicalIF":0.0,"publicationDate":"2016-10-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"79689718","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 53

Markov Modeling of Moving Target Defense Games 移动目标防御博弈的马尔可夫建模

Proceedings of the 2016 ACM Workshop on Moving Target Defense Pub Date : 2016-10-24 DOI: 10.1145/2995272.2995273

M. Valizadeh, Hoda Maleki, W. Koch, Azer Bestavros, Marten van Dijk

引用次数: 90

A Moving Target Defense Approach to Disrupting Stealthy Botnets 破坏隐形僵尸网络的移动目标防御方法

Proceedings of the 2016 ACM Workshop on Moving Target Defense Pub Date : 2016-10-24 DOI: 10.1145/2995272.2995280

S. Venkatesan, Massimiliano Albanese, G. Cybenko, S. Jajodia

引用次数: 38

Towards Cost-Effective Moving Target Defense Against DDoS and Covert Channel Attacks 实现针对DDoS和隐蔽通道攻击的高性价比移动目标防御

Proceedings of the 2016 ACM Workshop on Moving Target Defense Pub Date : 2016-10-24 DOI: 10.1145/2995272.2995281

Huangxin Wang, Fei Li, Songqing Chen

{"title":"Towards Cost-Effective Moving Target Defense Against DDoS and Covert Channel Attacks","authors":"Huangxin Wang, Fei Li, Songqing Chen","doi":"10.1145/2995272.2995281","DOIUrl":"https://doi.org/10.1145/2995272.2995281","url":null,"abstract":"Traditionally, network and system configurations are static. Attackers have plenty of time to exploit the system's vulnerabilities and thus they are able to choose when to launch attacks wisely to maximize the damage. An unpredictable system configuration can significantly lift the bar for attackers to conduct successful attacks. Recent years, moving target defense (MTD) has been advocated for this purpose. An MTD mechanism aims to introduce dynamics to the system through changing its configuration continuously over time, which we call adaptations. Though promising, the dynamic system reconfiguration introduces overhead to the applications currently running in the system. It is critical to determine the right time to conduct adaptations and to balance the overhead afforded and the security levels guaranteed. This problem is known as the MTD timing problem. Little prior work has been done to investigate the right time in making adaptations. In this paper, we take the first step to both theoretically and experimentally study the timing problem in moving target defenses. For a broad family of attacks including DDoS attacks and cloud covert channel attacks, we model this problem as a renewal reward process and propose an optimal algorithm in deciding the right time to make adaptations with the objective of minimizing the long-term cost rate. In our experiments, both DDoS attacks and cloud covert channel attacks are studied. Simulations based on real network traffic traces are conducted and we demonstrate that our proposed algorithm outperforms known adaptation schemes.","PeriodicalId":20539,"journal":{"name":"Proceedings of the 2016 ACM Workshop on Moving Target Defense","volume":"47 1","pages":""},"PeriodicalIF":0.0,"publicationDate":"2016-10-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"78592310","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 36

Mayflies: A Moving Target Defense Framework for Distributed Systems 蜉蝣:分布式系统的移动目标防御框架

Proceedings of the 2016 ACM Workshop on Moving Target Defense Pub Date : 2016-10-24 DOI: 10.1145/2995272.2995283

Noor O. Ahmed, B. Bhargava

引用次数: 18

Moving Target Defense against DDoS Attacks: An Empirical Game-Theoretic Analysis 移动目标防御DDoS攻击:实证博弈论分析

Proceedings of the 2016 ACM Workshop on Moving Target Defense Pub Date : 2016-10-24 DOI: 10.1145/2995272.2995279

Mason Wright, S. Venkatesan, Massimiliano Albanese, Michael P. Wellman

引用次数: 32

Demo: A Symbolic N-Variant System 演示:符号n变系统

Proceedings of the 2016 ACM Workshop on Moving Target Defense Pub Date : 2016-10-24 DOI: 10.1145/2995272.2995284

Jun Xu, Pinyao Guo, Bo Chen, R. Erbacher, Ping Chen, Peng Liu

引用次数: 1

Automated Effectiveness Evaluation of Moving Target Defenses: Metrics for Missions and Attacks 移动目标防御的自动有效性评估:任务和攻击的度量

Proceedings of the 2016 ACM Workshop on Moving Target Defense Pub Date : 2016-10-24 DOI: 10.1145/2995272.2995282

Joshua Taylor, Kara Zaffarano, Ben Koller, C. Bancroft, Jason Syversen

引用次数: 26

Multi-dimensional Host Identity Anonymization for Defeating Skilled Attackers 打击熟练攻击者的多维主机身份匿名化

Proceedings of the 2016 ACM Workshop on Moving Target Defense Pub Date : 2016-10-24 DOI: 10.1145/2995272.2995278

J. H. Jafarian, Amirreza Niakanlahiji, E. Al-Shaer, Qi Duan

{"title":"Multi-dimensional Host Identity Anonymization for Defeating Skilled Attackers","authors":"J. H. Jafarian, Amirreza Niakanlahiji, E. Al-Shaer, Qi Duan","doi":"10.1145/2995272.2995278","DOIUrl":"https://doi.org/10.1145/2995272.2995278","url":null,"abstract":"While existing proactive-based paradigms such as address mutation are effective in slowing down reconnaissance by naive attackers, they are ineffective against skilled human attackers. In this paper, we analytically show that the goal of defeating reconnaissance by skilled human attackers is only achievable by an integration of five defensive dimensions: (1) mutating host addresses, (2) mutating host fingerprints, (3) anonymizing host fingerprints, (4) deploying high-fidelity honeypots with context-aware fingerprints, and (5) deploying context-aware content on those honeypots. Using a novel class of honeypots, referred to as proxy honeypots (high-interaction honeypots with customizable fingerprints), we propose a proactive defense model, called (HIDE), that constantly mutates addresses and fingerprints of network hosts and proxy honeypots in a manner that maximally anonymizes identity of network hosts. The objective is to make a host untraceable over time by not letting even skilled attackers reuse discovered attributes of a host in previous scanning, including its addresses and fingerprint, to identify that host again. The mutations are generated through formal definition and modeling the problem. Using a red teaming evaluation with a group of white-hat hackers, we evaluated our five-dimensional defense model and compared its effectiveness with alternative and competing scenarios. These experiments as well as our analytical evaluation show that by anonymizing all identifying attributes of a host/honeypot over time, HIDE is able to significantly complicate reconnaissance, even for highly skilled human attackers.","PeriodicalId":20539,"journal":{"name":"Proceedings of the 2016 ACM Workshop on Moving Target Defense","volume":"67 1","pages":""},"PeriodicalIF":0.0,"publicationDate":"2016-10-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"83417912","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 28