Random Host Mutation for Moving Target Defense
Exploiting static configuration of networks and hosts has always been a great advantage for design and launching of decisive attacks. Network reconnaissance of IP addresses and ports is prerequisite to many host and network attacks. At the same time, knowing IP addresses is required for service reachability in IP networks, which makes complete concealment of IP address for servers infeasible. In addition, changing IP addresses too frequently may cause serious ramifications including service interruptions, routing inflation, delays and security violations. In this paper, we present a novel approach that turns end-hosts into untraceable moving targets by transparently mutating their IP addresses in an intelligent and unpredictable fashion and without sacrificing network integrity, manageability or performance. The presented technique is called Random Host Mutation (RHM). In RHM, moving target hosts are assigned virtual IP addresses that change randomly and synchronously in a distributed fashion over time. In order to prevent disruption of active connections, the IP address mutation is managed by network appliances and totally transparent to end-host. RHM employs multi-level optimized mutation techniques that maximize uncertainty in adversary scanning by effectively using the whole available address range, while at the same time minimizing the size of routing tables, and reconfiguration updates. RHM can be transparently deployed on existing networks on end-hosts or network elements. Our analysis, implementation and evaluation show that RHM can effectively defend against stealthy scanning, many types of worm propagation and attacks that require reconnaissance for successful launching. We also show the performance bounds for moving target defense in a practical network setup.
KeywordsMoving Target Constraint Satisfaction Problem Address Space Binary Decision Diagram Worm Propagation
Unable to display preview. Download preview PDF.
- 1.Lyon, G.F.: Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning. Insecure, USA (2009)Google Scholar
- 2.Laudicina, A.P.: Nessus - a powerful, free remote security scanner. Sys. Admin. 11(5) (2002)Google Scholar
- 3.Whyte, D., Kranakis, E., van Oorschot, P.C.: DNS-based Detection of Scanning Worms in an Enterprise Network. In: Proceedings of The 12th Annual Network and Distributed System Security Symposium (February 2005)Google Scholar
- 4.Bjørner, N., de Moura, L.: z310: Applications, enablers, challenges and directions. In: CFV 2009 (2009)Google Scholar
- 6.Kewley, D., Fink, R., Lowry, J., Dean, M.: Dynamic approaches to thwart adversary intelligence gathering. In: DARPA Information Survivability Conference and Exposition, vol. 1, p. 0176 (2001)Google Scholar
- 8.Atighetchi, M., Pal, P., Webber, F., Jones, C.: Adaptive use of network-centric mechanisms in cyber-defense. In: ISORC 2003, p. 183. IEEE Computer Society (2003)Google Scholar
- 9.Kewley, D., Fink, R., Lowry, J., Dean, M.: Dynamic approaches to thwart adversary intelligence gathering. In: Proceedings of DARPA Information Survivability Conference Exposition II, DISCEX 2001, vol. 1, pp. 176–185 (2001)Google Scholar
- 10.Jafarian, J.H., Al-Shaer, E., Duan, Q.: Openflow random host mutation: Transparent moving target defense using software defined networking. In: Proceedings of HotSDN workshop at SIGCOMM 2012, Helsinki, Finland (2012)Google Scholar
- 11.Yegneswaran, V., Alfeld, C.: Camouflaging honeynets. In: Proceedings of IEEE Global Internet Symposium (2007)Google Scholar
- 14.Al-Shaer, E.S., Hamed, H.H.: Discovery of policy anomalies in distributed firewalls. In: Twenty-Third Annual Joint Conference of the IEEE Computer and Communications Societies, INFOCOM 2004, vol. 4, pp. 2605–2616 (March 2004)Google Scholar
- 16.Zou, C.C., Towsley, D.: Routing Worm: A Fast, Selective attack worm based on IP address information. In: Workshop on Principles of Advanced and Distributed Simulation (PADS 2005), pp. 199–206 (2005)Google Scholar