Authors:
Paulo Shakarian
1
;
Damon Paulo
2
;
Massimiliano Albanese
3
and
Sushil Jajodia
4
Affiliations:
1
Arizona State University, United States
;
2
U.S. Military Academy, United States
;
3
George Mason University, United States
;
4
George Mason University and The MITRE Corporation, United States
Keyword(s):
Moving Target Defense, Adversarial Modeling, Graph Theory.
Related
Ontology
Subjects/Areas/Topics:
Information and Systems Security
;
Insider Threats and Countermeasures
;
Network Security
;
Wireless Network Security
Abstract:
It is well known that not all intrusions can be prevented and additional lines of defense are needed to deal with
intruders. However, most current approaches use honeynets relying on the assumption that simply attracting
intruders into honeypots would thwart the attack. In this paper, we propose a different and more realistic
approach, which aims at delaying intrusions, so as to control the probability that an intruder will reach a
certain goal within a specified amount of time. Our method relies on analyzing a graphical representation
of the computer network’s logical layout and an associated probabilistic model of the adversary’s behavior.
We then artificially modify this representation by adding “distraction clusters” – collections of interconnected
virtual machines – at key points of the network in order to increase complexity for the intruders and delay the
intrusion. We study this problem formally, showing it to be NP-hard and then provide an approximation algo-
rithm that exhi
bits several useful properties. Finally, we present experimental results obtained on a prototypal
implementation of the proposed framework.
(More)