Security and Privacy in Communication Networks. 8th International ICST Conference, SecureComm 2012, Padua, Italy, September 3-5, 2012. Revised Selected Papers

Research Article

Random Host Mutation for Moving Target Defense

Download63 downloads
  • @INPROCEEDINGS{10.1007/978-3-642-36883-7_19,
        author={Ehab Al-Shaer and Qi Duan and Jafar Jafarian},
        title={Random Host Mutation for Moving Target Defense},
        proceedings={Security and Privacy in Communication Networks. 8th International ICST Conference, SecureComm 2012, Padua, Italy, September 3-5, 2012. Revised Selected Papers},
        proceedings_a={SECURECOMM},
        year={2013},
        month={2},
        keywords={},
        doi={10.1007/978-3-642-36883-7_19}
    }
    
  • Ehab Al-Shaer
    Qi Duan
    Jafar Jafarian
    Year: 2013
    Random Host Mutation for Moving Target Defense
    SECURECOMM
    Springer
    DOI: 10.1007/978-3-642-36883-7_19
Ehab Al-Shaer1,*, Qi Duan1,*, Jafar Jafarian1,*
  • 1: University of North Carolina at Charlotte
*Contact email: ealshaer@uncc.edu, qduan@uncc.edu, jjafaria@uncc.edu

Abstract

Exploiting static configuration of networks and hosts has always been a great advantage for design and launching of decisive attacks. Network reconnaissance of IP addresses and ports is prerequisite to many host and network attacks. At the same time, knowing IP addresses is required for service reachability in IP networks, which makes complete concealment of IP address for servers infeasible. In addition, changing IP addresses too frequently may cause serious ramifications including service interruptions, routing inflation, delays and security violations. In this paper, we present a novel approach that turns end-hosts into untraceable moving targets by transparently mutating their IP addresses in an intelligent and unpredictable fashion and without sacrificing network integrity, manageability or performance. The presented technique is called Random Host Mutation (RHM). In RHM, moving target hosts are assigned virtual IP addresses that change randomly and synchronously in a distributed fashion over time. In order to prevent disruption of active connections, the IP address mutation is managed by network appliances and totally transparent to end-host. RHM employs multi-level optimized mutation techniques that maximize uncertainty in adversary scanning by effectively using the whole available address range, while at the same time minimizing the size of routing tables, and reconfiguration updates. RHM can be transparently deployed on existing networks on end-hosts or network elements. Our analysis, implementation and evaluation show that RHM can effectively defend against stealthy scanning, many types of worm propagation and attacks that require reconnaissance for successful launching. We also show the performance bounds for moving target defense in a practical network setup.