IPv6 Connection Shuffling for Moving Target Defense (MTD) in SDN

Moving Target Defense (MTD) is the defensive strat-egy of obscuring an entity by controlled changes in its attack surface. This approach alone does not secure a system but challenges potential attacks with additional complexity. This work presents an MTD solution called “Randomized Host and Service Shuffling in IPv6 (RHSS6)” against network reconnaissance attacks and evaluates its effects on performance and security. To achieve this goal, a Software Defined Networking (SDN) based prototype was developed in which RHSS6 performs two MTD strategies, IP Shuffling and Port Shuffling. Measurements on TCP and UDP traffic are made to evaluate the performance impact of RHSS6. An MTD network with both IP Shuffling and Port Shuffling had similar performance results compared to a baseline network; however, the video stream bit rate was significantly lower when Port Shuffling was enforced. Regarding the security gain, RHSS6 was effective in increasing the average number of scan attempts needed to identify a targeted host in a network with a fixed address range. We conclude that a defender using RHSS6 can adjust the probability of an attacker locating targeted hosts in a network by selecting a suitable address space and port range. Such parameters and shuffling trigger time can be optimized to maximize the benefits for different scenarios while minimizing the operational overhead.