Moving target defense (MTD) is a promising proactive defense technique to enhance system or network security. One caveat in developing a time-based MTD-enabled system is the potential performance degradation due to MTD operations being triggered periodically. In this work, we present our developed stochastic models based on deterministic stochastic Petri net (DSPN) formalism to assess the performance degradation introduced by periodic MTD operations. In addition, we demonstrate the effect of triggering a time-based MTD operation on performance degradation (e.g., jobs dropped or response time) and quality-of-service (QoS) of the system. We conducted comparative performance analysis with five DSPN models implemented in software packages such as TimeNet and Mercury under five different system configuration scenarios. Our key findings from this study include the following: (1) the deployment of MTD with the switchover strategy can improve the performance of services; (2) the switchover strategy showed the best cost-effectiveness among all strategies considered in this work; and (3) the interval of triggering MTD operations introduced a modest impact on job completion probability.
CarrollTECrouseMFulpEW, et al. Analysis of network address shuffling as a moving target defense. In: Proceedings of the 2014 IEEE international conference on communications (ICC), Sydney, NSW, Australia, 10–14 June 2014, pp. 701–706. New York: IEEE.
2.
ManadhataPKWingJM.An attack surface metric. IEEE T Softw Eng2011; 37: 371–386.
3.
SenguptaSChowdharyASaburA, et al. A survey of moving target defenses for network security. IEEE Commun Surv Tutor2020; 22: 1909–1941.
4.
XuJKalbarczykZIyerRK. Transparent runtime randomization for security. In: Proceedings of the 22nd international symposium on reliable distributed systems, Florence, 6–8 October 2003, pp. 260–269. New York: IEEE.
5.
BarrantesEGAckleyDHForrestS, et al. Randomized instruction set emulation. ACM Trans Inf Syst Secur2005; 8: 3–40.
JafarianJHAl-ShaerEDuanQ. Openflow random host mutation: transparent moving target defense using software defined networking. In: Proceedings of the first workshop on hot topics in software defined networks, Helsinki, 13 August 2012, pp. 127–132. New York: ACM.
8.
Al-ShaerEDuanQJafarianJH.Random host mutation for moving target defense. In: KeromytisADDi PietroR (eds) Security and Privacy in Communication Networks. Berlin; Heidelberg: Springer, 2013, pp. 310–327.
9.
LuoYWangBWangX, et al. RPAH: random port and address hopping for thwarting internal and external adversaries. In: Proceedings of the 2015 IEEE Trustcom/BigdataSE/ISPA, Helsinki, 20–22 August 2015, pp. 263–270. New York: IEEE.
10.
SharmaDPKimDYoonS, et al. FRVM: flexible random virtual IP multiplexing in software-defined networks. In: Proceedings of the 2018 17th IEEE international conference on trust, security and privacy in computing and communications/12th IEEE international conference on Big Data science and engineering (Trustcom/BbigdataSE), New York: 1–3 August 2018, pp. 579–587. New York: IEEE.
11.
MenascéD.Security performance. IEEE Internet Comput2009; 7: 84–87.
12.
SukhwaniHWangNTrivediKS, et al. Performance modeling of hyperledger fabric (permissioned blockchain network). In: Proceedings of the 2018 IEEE 17th international symposium on network computing and applications (NCA), Cambridge, MA, 1–3 November 2018, pp. 1–8. New York: IEEE.
13.
ZimmermannA.Modeling and performance evaluation with TimeNET 4.4. In: BertrandNBortolussiL (eds) Quantitative evaluation of systems. Cham: Springer, 2017, pp. 300–303.
14.
XiaRYinXLopezJA, et al. Performance and availability modeling of ITSystems with data backup and restore. IEEE T Depend Sec Comput11(4): 375–389.
15.
MendonçaJChoJ-HMooreTJ, et al. Performability analysis of services in a software-defined networking adopting time-based moving target defense mechanisms. In: Proceedings of the 35th annual ACM symposium on applied computing SAC’20, Brno, 30March–3April2020, pp. 1180–1189. New York: Association for Computing Machinery.
16.
KreutzDRamosFMVVer’ıssimoPE, et al. Software-defined networking: a comprehensive survey. Proc IEEE2015; 103: 14–76.
17.
McKeownNAndersonTBalakrishnanH, et al. OpenFlow: enabling innovation in campus networks. SIGCOMM Comput Commun Rev2008; 38: 69–74.
18.
HongJBKimDS.Assessing the effectiveness of moving target defenses using security models. IEEE T Depend Sec Comput2016; 13: 163–177.
19.
CaiGWangBLuoY, et al. (2016) A model for evaluating and comparing moving target defense techniques based on generalized stochastic Petri net. In: WuJLiL (eds) Advanced computer architecture: ACA 2016—communications in computer and information science, vol. 626. Singapore: Springer, 2016, pp. 184–197.
20.
IbeOCChoiHTrivediKS.Performance evaluation of client-server systems. IEEE T Parall Distrib Syst1993; 4: 1217–1229.
21.
MarsanMAChiolaG.On Petri nets with deterministic and exponentially distributed firing times. Adv Petri Nets1987; 266: 132–145.
22.
MendonçaJLimaRMatosR, et al. Availability analysis of a disaster recovery solution through stochastic models and fault injection experiments. In: Proceedings of the 2018 IEEE 32nd international conference on advanced information networking and applications (AINA), Krakow, 16–18 May 2018. New York: IEEE.
23.
GermanR.Performance analysis of communication systems: modeling with non-Markovian stochastic Petri nets. New York: John Wiley & Sons, 2000.
GudeNKoponenTPettitJ, et al. NOX: towards an operating system for networks. SIGCOMM Comput Commun Rev2008; 38: 105–110.
26.
ElnozahyENKistlerMRajamonyR.Energy-efficient server clusters. In: FalsafiBVijaykumarTN (eds) Proceedings of the 2nd international conference on power-aware computer systems (PACS’02). Berlin: Springer, 2003, pp. 179–197.
27.
ChenYDasAQinW, et al. Managing server energy and operational costs in hosting centers. In: Proceedings of the 2005 ACM SIGMETRICS international conference on measurement and modeling of computer systems, Banff, AB, Canada, 6–10 June 2005, pp. 303–314. New York: ACM.
28.
SilvaBMatosRCallouG, et al. Mercury: an integrated environment for performance and dependability evaluation of general systems. In: Proceedings of the industrial track at 45th dependable systems and networks conference, Rio de Janeiro, 22–25 June 2015. New York: IEEE.
29.
TrivediKSSahnerR.SHARPE at the age of twenty two. SIGMETRICS Perform Eval Rev2009; 36: 52–57.
30.
HuTGuoMGuoS, et al. MTTF of composite web services. In: Proceedings of the international symposium on parallel and distributed processing with applications, Taipei, Taiwan, 6–9 September 2010. New York: IEEE.
31.
KimDSMachidaFTrivediKS. Availability modeling and analysis of a virtualized system. In: Proceedings of the 2009 15th IEEE Pacific rim international symposium on dependable computing, Shanghai, China, 16–18 November 2009, pp. 365–371. New York: IEEE.
32.
MachidaFAndradeEKimDS, et al. Candy: component-based availability modeling framework for cloud service management using SysML. In: Proceedings of the 2011 IEEE 30th international symposium on reliable distributed systems, Madrid, 4–7 October 2011, pp. 209–218. New York: IEEE.
33.
CassandrasCGLafortuneS.Introduction to discrete event systems. 2nd ed.Cham: Springer, 2010.
34.
GeMKimHKKimD. Evaluating security and availability of multiple redundancy designs when applying security patches. In: Proceedings of the 2017 47th annual IEEE/IFIP international conference on dependable systems and networks workshops (DSN-W), Denver, CO, 26–29 June 2017. New York: IEEE.
35.
AntonatosSAkritidisPMarkatosEP, et al. Defending against hitlist worms using network address space randomization. In: Proceedings of the 2005 ACM workshop on Rapid malcode (WORM’05), Fairfax, VA, 11 November, pp. 30–40. New York: ACM.
36.
ShiLJiaCLüS, et al. Port and address hopping for active cyber-defense. In: YangCCZengD (eds) Proceedings of the 2007 Pacific Asia conference on intelligence and security informatics. Berlin; Heidelberg: Springer, 2007, pp. 295–300.
37.
ElMirIChowdharyAHuangD, et al. Software defined stochastic model for moving target defense. In: AbrahamAHaqiqAElla HassanienA, et al. (eds) Proceedings of the third international Afro-European conference for industrial advancement (AECIA). Berlin: Springer, 2018, pp. 188–197.
38.
MacfarlandDCShueCA. The SDN shuffle: creating a moving-target defense using host-based software-defined networking. In: Proceedings of the second ACM workshop on moving target defense, Denver, CO, 12 October 2015, pp. 37–41. New York: IEEE.
39.
ConnellWMenasceDAAlbaneseM.Performance modeling of moving target defenses with reconfiguration limits. IEEE T Depend Sec Comput2018; 18: 205–219.
40.
MalekiHValizadehSKochW, et al. Markov modeling of moving target defense games. In: Proceedings of the 20 ACM workshop on moving target defense (MTD’16), Vienna, 24 October 2016, pp. 81–92. New York: ACM Press.
