Moving target defenses (MTDs) are widely used as an active defense strategy for thwarting cyberattacks on cyber-physical systems by increasing diversity of software and network paths. Recently, machine Learning (ML) and deep Learning (DL) models have been demonstrated to defeat some of the cyber defenses by learning attack detection patterns and defense strategies. It raises concerns about the susceptibility of MTD to ML and DL methods. Here, in this article, we analyze the effectiveness of ML and DL models when it comes to deciphering MTD methods and ultimately evade MTD-based protections in real-time systems. Specifically, we consider a MTD algorithm that periodically randomizes address assignments within the MIL-STD-1553 protocol—a military standard serial data bus. Two ML and DL-based tasks are performed on MIL-STD-1553 protocol to measure the effectiveness of the learning models in deciphering the MTD algorithm: 1) determining whether there is an address assignments change i.e., whether the given system employs a MTD protocol and if it does 2) predicting the future address assignments. The supervised learning models (random forest and k-nearest neighbors) effectively detected the address assignment changes and classified whether the given system is equipped with a specified MTD protocol. On the other hand, the unsupervised learning model (K-means) was significantly less effective. The DL model (long short-term memory) was able to predict the future addresses with varied effectiveness based on MTD algorithm's settings.
Mani, Ganapathy, et al. "Machine Learning Based Resilience Testing of an Address Randomization Cyber Defense." IEEE Transactions on Dependable and Secure Computing, vol. 20, no. 6, Jan. 2023. https://doi.org/10.1109/tdsc.2023.3234561
@article{osti_2311703,
author = {Mani, Ganapathy and Haliem, Marina and Bhargava, Bharat and Manickam, Indu and Kochpatcharin, Kevin and Kim, Myeongsu and Vugrin, Eric D. and Wang, Weichao and Jenkins, Christipher D. and Angin, Pelin and others},
title = {Machine Learning Based Resilience Testing of an Address Randomization Cyber Defense},
annote = {Moving target defenses (MTDs) are widely used as an active defense strategy for thwarting cyberattacks on cyber-physical systems by increasing diversity of software and network paths. Recently, machine Learning (ML) and deep Learning (DL) models have been demonstrated to defeat some of the cyber defenses by learning attack detection patterns and defense strategies. It raises concerns about the susceptibility of MTD to ML and DL methods. Here, in this article, we analyze the effectiveness of ML and DL models when it comes to deciphering MTD methods and ultimately evade MTD-based protections in real-time systems. Specifically, we consider a MTD algorithm that periodically randomizes address assignments within the MIL-STD-1553 protocol—a military standard serial data bus. Two ML and DL-based tasks are performed on MIL-STD-1553 protocol to measure the effectiveness of the learning models in deciphering the MTD algorithm: 1) determining whether there is an address assignments change i.e., whether the given system employs a MTD protocol and if it does 2) predicting the future address assignments. The supervised learning models (random forest and k-nearest neighbors) effectively detected the address assignment changes and classified whether the given system is equipped with a specified MTD protocol. On the other hand, the unsupervised learning model (K-means) was significantly less effective. The DL model (long short-term memory) was able to predict the future addresses with varied effectiveness based on MTD algorithm's settings.},
doi = {10.1109/tdsc.2023.3234561},
url = {https://www.osti.gov/biblio/2311703},
journal = {IEEE Transactions on Dependable and Secure Computing},
issn = {ISSN 1545-5971},
number = {6},
volume = {20},
place = {United States},
publisher = {IEEE},
year = {2023},
month = {01}}
2016 IEEE International Conference on Emerging Technologies and Innovative Business Practices for the Transformation of Societies (EmergiTech)https://doi.org/10.1109/EmergiTech.2016.7737362
Sharma, Dilli Prasad; Kim, Dong Seong; Yoon, Seunghyun
2018 17th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/ 12th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE)https://doi.org/10.1109/TrustCom/BigDataSE.2018.00088
Proceedings of the 22nd annual ACM SIGPLAN conference on Object oriented programming systems and applications - OOPSLA '07https://doi.org/10.1145/1297027.1297055
CCS'16: 2016 ACM SIGSAC Conference on Computer and Communications Security, Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Securityhttps://doi.org/10.1145/2976749.2978318