Evaluating Moving Target Defense Methods Using Time to Compromise and Security Risk Metrics in IoT Networks

The Internet of Things (IoT) networks face an increasing number of cyber threats due to their heterogeneous, distributed, and resource-constrained nature. Conventional static defense mechanisms are often inadequate against sophisticated and advanced persistent threats. Moving Target Defense (MTD) is a dynamic proactive security method that increases system resilience by continuously changing the attack surface, thereby increasing uncertainty and complexity for attackers. In this paper, we evaluate the effectiveness of shuffling or diversity-based MTD methods using time-to-compromise and security risk metrics. We develop attack path-based mean time-to-compromise and security risk reduction metrics for assessing the effectiveness of MTD. These metrics provide a quantitative basis for evaluating how well MTD techniques delay successful compromises and lower overall security risk exposure. The performance of the deployed MTD mechanism is evaluated and discussed for different attacker skill levels and shuffling frequencies.