Exploiting static configuration of networks and hosts has always been a great advantage for design and launching of decisive attacks. Network reconnaissance of IP addresses and ports is prerequisite to many host and network attacks. At the same time, knowing IP addresses is required for service reachability in IP networks, which makes complete concealment of IP address for servers infeasible. In addition, changing IP addresses too frequently may cause serious ramifications including service interruptions, routing inflation, delays and security violations. In this paper, we present a novel approach that turns end-hosts into untraceable moving targets by transparently mutating their IP addresses in an intelligent and unpredictable fashion and without sacrificing network integrity, manageability or performance. The presented technique is called Random Host Mutation (RHM). In RHM, moving target hosts are assigned virtual IP addresses that change randomly and synchronously in a distributed fashion over time. In order to prevent disruption of active connections, the IP address mutation is managed by network appliances and totally transparent to end-host. RHM employs multi-level optimized mutation techniques that maximize uncertainty in adversary scanning by effectively using the whole available address range, while at the same time minimizing the size of routing tables, and reconfiguration updates. RHM can be transparently deployed on existing networks on end-hosts or network elements. Our analysis, implementation and evaluation show that RHM can effectively defend against stealthy scanning, many types of worm propagation and attacks that require reconnaissance for successful launching. We also show the performance bounds for moving target defense in a practical network setup.


Moving Target Constraint Satisfaction Problem Address Space Binary Decision Diagram Worm Propagation 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Lyon, G.F.: Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning. Insecure, USA (2009)Google Scholar
  2. 2.
    Laudicina, A.P.: Nessus - a powerful, free remote security scanner. Sys. Admin. 11(5) (2002)Google Scholar
  3. 3.
    Whyte, D., Kranakis, E., van Oorschot, P.C.: DNS-based Detection of Scanning Worms in an Enterprise Network. In: Proceedings of The 12th Annual Network and Distributed System Security Symposium (February 2005)Google Scholar
  4. 4.
    Bjørner, N., de Moura, L.: z310: Applications, enablers, challenges and directions. In: CFV 2009 (2009)Google Scholar
  5. 5.
    Antonatos, S., Akritidis, P., Markatos, E.P., Anagnostakis, K.G.: Defending against hitlist worms using network address space randomization. Comput. Netw. 51(12), 3471–3490 (2007)CrossRefzbMATHGoogle Scholar
  6. 6.
    Kewley, D., Fink, R., Lowry, J., Dean, M.: Dynamic approaches to thwart adversary intelligence gathering. In: DARPA Information Survivability Conference and Exposition, vol. 1, p. 0176 (2001)Google Scholar
  7. 7.
    Michalski, J.T.: Network security mechanisms utilising network address translation. International Journal of Critical Infrastructures 2(1), 10–49 (2006)MathSciNetCrossRefGoogle Scholar
  8. 8.
    Atighetchi, M., Pal, P., Webber, F., Jones, C.: Adaptive use of network-centric mechanisms in cyber-defense. In: ISORC 2003, p. 183. IEEE Computer Society (2003)Google Scholar
  9. 9.
    Kewley, D., Fink, R., Lowry, J., Dean, M.: Dynamic approaches to thwart adversary intelligence gathering. In: Proceedings of DARPA Information Survivability Conference Exposition II, DISCEX 2001, vol. 1, pp. 176–185 (2001)Google Scholar
  10. 10.
    Jafarian, J.H., Al-Shaer, E., Duan, Q.: Openflow random host mutation: Transparent moving target defense using software defined networking. In: Proceedings of HotSDN workshop at SIGCOMM 2012, Helsinki, Finland (2012)Google Scholar
  11. 11.
    Yegneswaran, V., Alfeld, C.: Camouflaging honeynets. In: Proceedings of IEEE Global Internet Symposium (2007)Google Scholar
  12. 12.
    Cai, J.-Y., Yegneswaran, V., Alfeld, C., Barford, P.: An Attacker-Defender Game for Honeynets. In: Ngo, H.Q. (ed.) COCOON 2009. LNCS, vol. 5609, pp. 7–16. Springer, Heidelberg (2009)CrossRefGoogle Scholar
  13. 13.
    Chakravarty, S.: A characterization of binary decision diagrams. IEEE Trans. Comput. 42(2), 129–137 (1993)MathSciNetCrossRefGoogle Scholar
  14. 14.
    Al-Shaer, E.S., Hamed, H.H.: Discovery of policy anomalies in distributed firewalls. In: Twenty-Third Annual Joint Conference of the IEEE Computer and Communications Societies, INFOCOM 2004, vol. 4, pp. 2605–2616 (March 2004)Google Scholar
  15. 15.
    Zou, C.C., Towsley, D., Gong, W.: On the performance of internet worm scanning strategies. Elsevier Journal of Performance Evaluation 63, 700–723 (2003)CrossRefGoogle Scholar
  16. 16.
    Zou, C.C., Towsley, D.: Routing Worm: A Fast, Selective attack worm based on IP address information. In: Workshop on Principles of Advanced and Distributed Simulation (PADS 2005), pp. 199–206 (2005)Google Scholar

Copyright information

© ICST Institute for Computer Science, Social Informatics and Telecommunications Engineering 2013

Authors and Affiliations

  • Ehab Al-Shaer
    • 1
  • Qi Duan
    • 1
  • Jafar Haadi Jafarian
    • 1
  1. 1.Department of Software and Information SystemsUniversity of North Carolina at CharlotteCharlotteUSA

Personalised recommendations