EAI Endorsed Transactions on Security and Safety 18(13): e4

Research Article

An Evaluation Framework for Moving Target Defense Based on Analytic Hierarchy Process

Download8 downloads
  • @ARTICLE{10.4108/eai.4-1-2018.153527,
        author={Chu Huang and Sencun Zhu and Yi Yang},
        title={An Evaluation Framework for Moving Target Defense Based on Analytic Hierarchy Process},
        journal={EAI Endorsed Transactions on Security and Safety},
        volume={18},
        number={13},
        publisher={EAI},
        journal_a={SESA},
        year={2018},
        month={1},
        keywords={Moving Target Defense, Analytic Hierarchy Process, Evaluation and Comparison},
        doi={10.4108/eai.4-1-2018.153527}
    }
    
  • Chu Huang
    Sencun Zhu
    Yi Yang
    Year: 2018
    An Evaluation Framework for Moving Target Defense Based on Analytic Hierarchy Process
    SESA
    EAI
    DOI: 10.4108/eai.4-1-2018.153527
Chu Huang1, Sencun Zhu1, Yi Yang2,*
  • 1: Pennsylvania State University, University Park, PA 16802, USA
  • 2: Fontbonne University, St. Louis, MO 63105, USA
*Contact email: yyang@fontbonne.edu

Abstract

A Moving Target Defense (MTD)-enabled system is one which can dynamically and rapidly change its properties and code such that the attackers do not have sufficient time to exploit it. Although a variety of MTD systems have been proposed, few work has focused on assessing the relative cost-effectiveness of different MTD approaches. In this paper, based on a generic MTD theory, we propose five general evaluation metrics and an assessment framework on top of Analytic Hierarchy Process (AHP), which aggregates these five metrics and systematically evaluates/compares security strengths and costs of multiple MTD-based approaches in the same category. This framework could be widely used in different MTD categories under various attacks and it will enable a security specialist to choose the best MTD approach from a set of possible alternatives based on his/her goal and understanding of the problem. A detailed case study on a specific MTD category called software diversification validates the effectiveness of this framework. Our evaluation results rank three software diversity algorithms and choose the best one among three based on problem setting and situation constraints.