Static Analysis Opportunities for Improving Agile and Moving Target Defenses

Agile defenses have been proposed to enable systems to change their defensive posture dynamically to thwart attacks. Researchers have suggested a variety of agile defenses that leverage renaming (e.g., for network services), migration (e.g., for cloud instances), variation (e.g., for application configurations), and patching (e.g., for programs), among others. These agile defenses demonstrate promise for achieving a key goal: increasing the cost of launching a successful attack. However, agile defenses also incur non-trivial costs in overhead and/or complexity to defenders as well, leaving defenders hesitant to employ such defenses without further justification for their necessity. A question we examine in this keynote is how to develop techniques that may aid defenders in choosing when to employ agile defenses and which agile defenses to employ.