Moving target defense of routing randomization with deep reinforcement learning against eavesdropping attack

Eavesdropping attacks have become one of the most common attacks on networks because of their easy implementation. Eavesdropping attacks not only lead to transmission data leakage but also develop into other more harmful attacks. Routing randomization is a relevant research direction for moving target defense, which has been proven to be an effective method to resist eavesdropping attacks. To counter eavesdropping attacks, in this study, we analyzed the existing routing randomization methods and found that their security and usability need to be further improved. According to the characteristics of eavesdropping attacks, which are “latent and transferable”, a routing randomization defense method based on deep reinforcement learning is proposed. The proposed method realizes routing randomization on packet-level granularity using programmable switches. To improve the security and quality of service of legitimate services in networks, we use the deep deterministic policy gradient to generate random routing schemes with support from powerful network state awareness. In-band network telemetry provides real-time, accurate, and comprehensive network state awareness for the proposed method. Various experiments show that compared with other typical routing randomization defense methods, the proposed method has obvious advantages in security and usability against eavesdropping attacks.

A spawning particle filter for defocused moving target detection in GNSS-based passive radar

Global Navigation Satellite System(GNSS)-based passive radar(GBPR)has been widely used in remote sensing applications.However,for moving target detection(MTD),the quadratic phase error(QPE)introduced by the non-cooperative target motion is usually difficult to be compensated,as the low power level of the GBPR echo signal renders the estimation of the Doppler rate less effective.Consequently,the moving target in GBPR image is usually defocused,which aggravates the difficulty of target detection even further.In this paper,a spawning particle filter(SPF)is proposed for defocused MTD.Firstly,the measurement model and the likelihood ratio function(LRF)of the defocused point-like target image are deduced.Then,a spawning particle set is generated for subsequent target detection,with reference to traditional particles in particle filter(PF)as their parent.After that,based on the PF estimator,the SPF algorithm and its sequential Monte Carlo(SMC)implementation are proposed with a novel amplitude estimation method to decrease the target state dimension.Finally,the effectiveness of the proposed SPF is demonstrated by numerical simulations and pre-liminary experimental results,showing that the target range and Doppler can be estimated accurately.

Strategy Selection for Moving Target Defense in Incomplete Information Game

As a core component of the network,web applications have become one of the preferred targets for attackers because the static configuration of web applications simplifies the exploitation of vulnerabilities by attackers.Although the moving target defense(MTD)has been proposed to increase the attack difficulty for the attackers,there is no solo approach can cope with different attacks;in addition,it is impossible to implement all these approaches simultaneously due to the resource limitation.Thus,the selection of an optimal defense strategy based on MTD has become the focus of research.In general,the confrontation of two players in the security domain is viewed as a stochastic game,and the reward matrices are known to both players.However,in a real security confrontation,this scenario represents an incomplete information game.Each player can only observe the actions performed by the opponent,and the observed actions are not completely accurate.To accurately describe the attacker’s reward function to reach the Nash equilibrium,this work simulated and updated the strategy selection distribution of the attacker by observing and investigating the strategy selection history of the attacker.Next,the possible rewards of the attacker in each confrontation via the observation matrix were corrected.On this basis,the Nash-Q learning algorithm with reward quantification was proposed to select the optimal strategy.Moreover,the performances of the Minimax-Q learning algorithm and Naive-Q learning algorithm were compared and analyzed in the MTD environment.Finally,the experimental results showed that the strategy selection algorithm can enable defenders to select a more reasonable defensive strategy and achieve the maximum possible reward.

An Active Deception Defense Model Based on Address Mutation and Fingerprint Camouflage

The static and predictable characteristics of cyber systems give attackers an asymmetric advantage in gathering useful information and launching attacks.To reverse this asymmetric advantage,a new defense idea,called Moving Target Defense(MTD),has been proposed to provide additional selectable measures to complement traditional defense.However,MTD is unable to defeat the sophisticated attacker with fingerprint tracking ability.To overcome this limitation,we go one step beyond and show that the combination of MTD and Deception-based Cyber Defense(DCD)can achieve higher performance than either of them.In particular,we first introduce and formalize a novel attacker model named Scan and Foothold Attack(SFA)based on cyber kill chain.Afterwards,we develop probabilistic models for SFA defenses to provide a deeper analysis of the theoretical effect under different defense strategies.These models quantify attack success probability and the probability that the attacker will be deceived under various conditions,such as the size of address space,and the number of hosts,attack analysis time.Finally,the experimental results show that the actual defense effect of each strategy almost perfectly follows its probabilistic model.Also,the defense strategy of combining address mutation and fingerprint camouflage can achieve a better defense effect than the single address mutation.

Survey on quantitative evaluations of moving target defense

Quantitative evaluations are of great importance in network security decision-making.In recent years,moving target defense(MTD)has appeared to be a promising defense approach that blocks asymmetrical advantage of attackers and favors the defender-notwithstanding,it has a limited deployment due to its uncertain efficiency and effectiveness in defense.In that case,quantitative metrics and evaluations of MTD are essential to prove its capability and impulse its further research.This article presents a comprehensive survey on state-of-the-art quantitative evaluations.First,taxonomy of MTD techniques is stated according to the software stack model.Then,a concrete review and comparison on existing quantitative evaluations of MTD is presented.Finally,notice-worthy open issues regarding this topic are proposed along with the conclusions of previous studies.

回波越距离单元走动的MTD研究

针对高速目标回波脉冲信号产生越距离单元走动,动目标检测的MTD方法积累脉冲减少导致检测性能下降的问题,提出一种校正存在多普勒模糊的越距离走动的方法。利用回波信号快时间频率域的积累以及一个CPI内同一距离单元对存在模糊的多普勒的采样特性,结合孙子定理,给出解模糊多普勒的新方法。对CPI每重复周期采样点进行采样补偿,再实现采样数据矩阵沿多普勒斜线的包络对齐。然后利用MTD,实现动目标检测。给出算法框图,通过仿真实验证明该方法的有效性。

一种新的随机PRI脉冲多普勒雷达无模糊MTD算法

传统的脉冲多普勒雷达存在严重的测距测速模糊和盲区效应。该文结合压缩感知理论,考虑在正常脉冲重复间隔(Pulse Repetition Interval,PRI)上叠加一个随机扰动,并把PRI的随机变化巧妙转化为稀疏观测矩阵的受限等距性质(Restricted Isometry Property,RIP),提出了一种新的全相参动目标检测(Moving Target Detection,MTD)技术。并重点研究了距离速度模糊消除技术,给出了不模糊测距测速的参数设计充分条件。仿真实验结果表明,该方案检测性能高、无模糊、无盲区,并且相比传统的多脉冲串参差重频方法而言,只需一个脉冲串,大大缩短了相参处理周期。

基于DMTD多普勒补偿的互补码脉冲压缩

为解决相位编码脉冲压缩信号的旁瓣导致大目标信号的旁瓣覆盖小目标,降低雷达对小目标的检测能力,提出一种基于数字动目标检测(DMTD)的交替发射互补码的方法,对正码和补码回波分别做MTD,然后分两步进行相位补偿,并分别脉压和叠加(去旁瓣).该方法能有效地补偿多普勒频移和分时发射导致的相位差,保持了脉压后正码和补码回波信号旁瓣的互补性.由于是交替发射正码和补码,能有效降低目标RCS的角闪烁导致的回波能量起伏带来的影响.以四相互补码为例进行了仿真,结果表明,该方法补偿了由于分时发射造成的互补码之间的初始相位差,脉冲压缩后对互补码进行叠加,得到了低旁瓣的脉冲压缩结果.

云原生环境下基于移动目标防御的ReDoS防御方法

针对云原生环境中正则表达式拒绝服务(ReDoS)攻击的防御方式存在效率低、无法进行主动防御的问题,提出了基于移动目标防御(MTD)技术的ReDoS攻击防御方法。首先基于云原生环境下的微服务应用特点,对攻防双方的行为进行了分析;其次,基于Kuberneters设计了基于MTD的防御系统,并提出基于拓扑信息和请求到达速率的动态和静态的多维微服务权重指标、基于排队论的服务效率判断指标以及轮换时机选择方法来指导关键微服务的选择和关键微服务的轮换时机;最后,给出了基于异构度和服务效率的多维指标MTD异构轮换算法,并使用Python进行了仿真,结果表明:所提算法防御时延比动态伸缩缩短了50%左右;并且防御开销在第一次攻击之后趋于平稳,不会持续增长。

针对负荷重分配攻击的移动目标防御策略

负荷重分配攻击考虑电力系统实际设备配置及实际运行情况,通过篡改负荷量测对电力系统安全稳定运行造成威胁。提出一种基于拓扑变换的移动目标防御方法,通过变换系统拓扑结构破坏攻击者对电力系统信息的掌握程度,实现对负荷重分配攻击的防御,为电力系统安全可靠运行提供保障。首先,建立负荷重分配双层优化模型,对攻击策略进行分析;然后,分析拓扑结构的优化重构方式,建立拓扑结构变换的优化模型;最后,将拓扑结构优化算法与状态估计相结合实现移动目标防御,完成对负荷重分配攻击的检测。在IEEE 14节点系统中对所提方法进行了测试与分析,算例证明基于拓扑变换的移动目标防御方法能够对负荷重分配攻击进行有效防御,增强电力系统的抗攻击能力。

移动目标防御(MTD)关键技术研究

移动目标防御(Moving Target Defense,MTD)技术是近年来网络空间中"改变游戏规则"的革命性技术之一。它与以往的网络安全技术完全不同,变被动防御为主动防御,其系统和网络状态随着时间、空间以及物理环境等多个维度的变化而不断改变,从而增加入侵者的入侵难度,有效限制己方漏洞暴露的概率。因此,移动目标防御将成为未来网络安全防护技术的重点发展方向。综合研究了MTD主要关键技术及其发展脉络,通过比较分析,提出了目前关键技术的优缺点,并结合网络技术的演化展望了MTD技术的发展前景。

Securing Forwarding Layers from Eavesdropping Attacks Using Proactive Approaches

As an emerging network paradigm,the software-defined network(SDN)finds extensive application in areas such as smart grids,the Internet of Things(IoT),and edge computing.The forwarding layer in software-defined networks is susceptible to eavesdropping attacks.Route hopping is amoving target defense(MTD)technology that is frequently employed to resist eavesdropping attacks.In the traditional route hopping technology,both request and reply packets use the same hopping path.If an eavesdropping attacker monitors the nodes along this path,the risk of 100%data leakage becomes substantial.In this paper,we present an effective route hopping approach,called two-day different path(TDP),that turns communication paths into untraceable moving targets.This technology minimizes the probability of data leakage by transmitting request data and reply data through different paths.Firstly,a brief introduction to the network model and attack model involved in this paper is given.Secondly,the algorithm and processingmethod of the TDP are proposed.Thirdly,the paper proposes three differentmetrics tomeasure the effectiveness of the proposed approach.Finally,theoretical analysis and simulation results show that the TDP can effectively reduce the percentage of data exposure,decrease eavesdropping attack success probability,and improve the unpredictability of the path.

基于信号博弈的异构容器动态调度策略选取方法

针对容器弱隔离的特性易使其遭受同驻攻击和逃逸攻击等问题,提出了一种基于信号博弈的异构容器动态调度策略选取方法。首先,对容器异构程度进行量化,结合多维度指标计算得到异构度集合,精确计算攻防收益提供必要参数;其次,考虑攻击者对容器信息获取程度不断变化,设计攻击者对容器信息获取程度的动态集合,构建多阶段不完全信息信号博弈模型;最后,提出了一种异构容器动态调度策略选取算法,多阶段求解最优动态调度策略。实验结果表明:与SmartSCR方法相比,动态轮换平均开销降低了47.3%,防御者平均收益提升了14.2%,与Stackelberg方法相比,动态轮换平均开销基本持平,防御者平均收益提升了65.73%。

基于演化博弈的Serverless移动目标防御决策方法

“无服务器”(Serverless)是一种新型计算范式,具有轻量、敏捷的特点,由于其架构的特殊性,导致在原有云安全问题的基础上又引入一些新的安全威胁。针对在未知攻防场景下难以准确选择最优化防御策略的问题,从虚拟化层和应用层两个方面根据移动目标防御(Moving Target Defense,MTD)多样化的思想提出防御策略。将具有玻尔兹曼探索的Q-Learning算法与复制动态方程结合,从有限理性的角度出发构建具有探索机制的演化博弈模型,使防御者在反复的攻防对抗中不断进行试错—探索—实施,最终获得最优化防御策略,获取最大收益。实验表明,引入探索机制的演化博弈模型具有可预测性,且演化博弈均衡点具有较强的稳定性。

MTI级联MTD的信噪比增益

雷达系统经常采用动目标指示(MTI)级联动目标检测(MTD)提高对运动目标的检测性能。文中推导出了MTI级联MTD的信噪比(SNR)增益计算公式,该增益不超过仅MTD处理的SNR增益。级联MTI后,对位于MTI通带中心处的MTD滤波器,其增益变化较小,越远离该中心的MTD滤波器,增益变化越大。MTI滤波使背景噪声变得不平稳,不利于后续的恒虚警率(CFAR)检测。采用MTI的频率响应加以校正,恢复噪声的平稳性。上述研究对工程实践具有较高的参考价值。

AMTD:一种适应性移动目标防御方法

MTD是通过动态移动目标的攻击面来改变攻击和防御不对称状态的一种新方式。MTD变换频率对于系统可用性、安全性和防御成本之间的权衡至关重要。但目前的变换频率通常根据管理者的经验确定,缺乏理论基础,无法达到可用性-安全性成本之间的权衡。为应对这一挑战,提出了适应性移动目标防御框架(AMTD),在确保系统可用的前提下,以最低的成本获取最大的系统安全性。AMTD的适应性体现在2方面:一是防御模式的适应性,通过提出一种自适应转换策略,提供由安全警报触发的反应性防御和定时器到期事件触发的主动防御;二是变换频率的适应性,通过建立数学模型获得最优的变换频率。采取4个系列的模拟实验验证该解决方案的有效性。

Dynamic defenses in cyber security:Techniques,methods and challenges Author links open overlay panel

Driven by the rapid development of the Internet of Things,cloud computing and other emerging technologies,the connotation of cyberspace is constantly expanding and becoming the fifth dimension of human activities.However,security problems in cyberspace are becoming serious,and traditional defense measures(e.g.,firewall,intrusion detection systems,and security audits)often fall into a passive situation of being prone to attacks and difficult to take effect when responding to new types of network attacks with a higher and higher degree of coordination and intelligence.By constructing and implementing the diverse strategy of dynamic transformation,the configuration characteristics of systems are constantly changing,and the probability of vulnerability exposure is increasing.Therefore,the difficulty and cost of attack are increasing,which provides new ideas for reversing the asymmetric situation of defense and attack in cyberspace.Nonetheless,few related works systematically introduce dynamic defense mechanisms for cyber security.The related concepts and development strategies of dynamic defense are rarely analyzed and summarized.To bridge this gap,we conduct a comprehensive and concrete survey of recent research efforts on dynamic defense in cyber security.Specifically,we firstly introduce basic concepts and define dynamic defense in cyber security.Next,we review the architectures,enabling techniques and methods for moving target defense and mimic defense.This is followed by taxonomically summarizing the implementation and evaluation of dynamic defense.Finally,we discuss some open challenges and opportunities for dynamic defense in cyber security.

MTD增强的网络欺骗防御系统

计算机网络正在飞速发展,但随之而来的系统破坏、信息泄露等网络安全问题也日益突出。攻击者在正式攻击前通常进行大量的网络侦查,以发现目标网络和系统上的可利用漏洞,而传统网络系统中的静态配置为攻击者发现网络目标和发起攻击提供了极大的优势。为了减轻攻击者持续性网络侦查攻击的有效性,基于软件定义网络开发了移动目标防御(moving target defense,MTD)增强的网络欺骗防御系统。该系统采用网络欺骗技术,混淆攻击者收集到的目标网络和系统信息,延长攻击者扫描到网络内真实脆弱性主机的时间,提高其时间成本;并在此基础上融合移动目标防御技术,动态随机地变换网络内节点的IP地址,增强网络欺骗系统的防御效能。实现了系统原型并对其进行评估,在虚拟网络拓扑规模为3个网段且地址变换周期为30 s的配置下,该系统将攻击者发现脆弱性主机的时间平均延迟7倍,将攻击者成功攻击脆弱性主机的概率降低83%,同时系统额外开销平均在8%以内。

MTDCD:一种对抗网络入侵的混合防御机制

移动目标防御和网络欺骗防御均是通过增加攻击者获取的信息的不确定性来保护己方系统和网络,该方法能够在一定程度上减缓网络入侵。然而,单一的移动目标防御技术无法阻止利用多元信息进行网络入侵的攻击者,同时,部署的诱饵节点可能会被攻击者识别和标记,降低了防御效能。因此,提出了融合移动目标防御和网络欺骗防御的混合防御机制MTDCD,并通过深入分析实际网络对抗,构建了网络入侵威胁模型,最后基于Urn模型建立了防御有效性评估模型,并从虚拟网络拓扑大小、诱饵节点的欺骗概率、IP地址随机化周期、IP地址转移概率等多个方面评估了所提混合防御机制MTDCD的防御效能,为后续防御策略设计提供了一定的参考和指导。

OTH雷达MTD与频率捷变兼容问题分析

随着电磁环境的日益复杂，要求雷达具有多模式反干扰能力。OTH地波超视距雷达的动目标检测（MTD）系统具有良好的反杂波干扰能力，可以在强杂波干扰背景下，利用回波多普勒信息，提取出所需要的动目标参量，但对来自于敌方的窄带瞄准式干扰无能为力，从而大大限制了其应用；而作为现代电子对抗的产物，采用脉间跳频的频率捷变体制具有极强的反有源干扰能力。本文从OTH雷达信息提取的特点和频率捷变体制的特点出发，就两种反干扰技术在一部雷达中的融合问题以及之间的兼容性问题进行了分析，得出了相关结论。