Visible to the public Analysis of network address shuffling as a moving target defense

TitleAnalysis of network address shuffling as a moving target defense
Publication TypeConference Paper
Year of Publication2014
AuthorsCarroll, T.E., Crouse, M., Fulp, E.W., Berenhaut, K.S.
Conference NameCommunications (ICC), 2014 IEEE International Conference on
Date PublishedJune
KeywordsComputational modeling, Computers, Information systems, IP networks, moving target defense, network address remapping, network address shuffling, probabilistic models, probability, Probes, Reconnaissance, security of data

Address shuffling is a type of moving target defense that prevents an attacker from reliably contacting a system by periodically remapping network addresses. Although limited testing has demonstrated it to be effective, little research has been conducted to examine the theoretical limits of address shuffling. As a result, it is difficult to understand how effective shuffling is and under what circumstances it is a viable moving target defense. This paper introduces probabilistic models that can provide insight into the performance of address shuffling. These models quantify the probability of attacker success in terms of network size, quantity of addresses scanned, quantity of vulnerable systems, and the frequency of shuffling. Theoretical analysis shows that shuffling is an acceptable defense if there is a small population of vulnerable systems within a large network address space, however shuffling has a cost for legitimate users. These results will also be shown empirically using simulation and actual traffic traces.

Citation Key6883401