Enhancing Artificial Intelligence with Verification Techniques to Support Automated Moving Target Defense in Cloud Composite Services

Advancements in softwarization and service composition have contributed to the deployment of large-scale distributed cloud services across diverse infrastructures. The growing complexity of these services, combined with the continuous emergence of new vulnerabilities, constitutes a significant challenge in terms of security management. Moving target defense strategies, leveraged by artificial intelligence, offer new opportunities to protect them. At the meantime, the changes that are operated by these strategies may lead these services into vulnerable configurations. We propose in this paper a moving target defense strategy which bridges the gap between artificial intelligence and configuration verification techniques. The objective is to select the movements to be applied on the cloud composite service, in order to reduce the predictability of configuration changes, while minimizing the risk of critical vulnerable configurations. We formalize and design a framework exploiting reinforcement learning and SMT solving, to support this strategy. We also perform large series of experiments to evaluate the feasibility and performance of our solution based on OVAL vulnerability descriptions.