Abstract Moving Target Defense (MTD) has emerged as a game changer to reverse the asymmetric situation between attackers and defenders, and as one of the most effective countermeasures to mitigate DDoS attacks, shuffling-based MTD has gained ever-growing attention in cyber security. Despite the increased security, frequent shuffles would significantly bring heavy burden to the system. Moreover, most existing work has not adequately considered the impact of MTD techniques on the defender, and especially ignored that on legitimate users. Due to the lack of cost-effective shuffling methods, it is difficult to reach the optimal balance between the performance and overhead associated with the MTD deployment. Building on our preliminary work in this field, we propose a novel cost-effective shuffling method, which involves common users as a trilateral game for strategy generation and resists DDoS attacks with several MTD mechanisms. The novel game model extends our previous work to further describe the interaction among the attacker, the defender and users in detail, and we exploit Multi-Objective Markov Decision Processes to find the optimal MTD strategy by solving the trade-off problem between the effectiveness and cost of shuffling. By designing a trilateral game cost-effective shuffling algorithm, we capture the best MTD strategy and reach a balance between them in a given shuffling scenario. Simulation and experiments on an experimental software-defined network (SDN) indicate that our approach can effectively mitigate DDoS attacks with an acceptable overload, and exhibit better performance than other related and state of the art approaches.

中文翻译：

---

使用三边博弈和多目标马尔可夫决策过程对 DDoS 攻击进行经济高效的移动目标防御

摘要 移动目标防御 (MTD) 已成为扭转攻击者和防御者之间不对称局面的游戏规则改变者，并且作为缓解 DDoS 攻击的最有效对策之一，基于改组的 MTD 在网络安全中受到越来越多的关注。尽管增加了安全性，但频繁的洗牌会给系统带来沉重的负担。此外，大多数现有工作都没有充分考虑 MTD 技术对防御者的影响，尤其忽略了对合法用户的影响。由于缺乏具有成本效益的改组方法，很难在与 MTD 部署相关的性能和开销之间达到最佳平衡。基于我们在该领域的初步工作，我们提出了一种新的经济高效的改组方法，它涉及普通用户作为策略生成的三边游戏，并通过多种 MTD 机制抵抗 DDoS 攻击。新颖的博弈模型扩展了我们之前的工作，进一步详细描述了攻击者、防御者和用户之间的交互，我们利用多目标马尔可夫决策过程通过解决有效性和防御性之间的权衡问题来寻找最佳 MTD 策略。洗牌的成本。通过设计一个三边博弈具有成本效益的洗牌算法，我们捕捉到最佳的 MTD 策略并在给定的洗牌场景中达到它们之间的平衡。在实验性软件定义网络 (SDN) 上的模拟和实验表明，我们的方法可以在可接受的过载下有效缓解 DDoS 攻击，并且表现出比其他相关和最先进的方法更好的性能。