A cooperative hopping-based moving target defense approach

In the face of an alarming annual increase of over 44,000 Internet security vulnerabilities, traditional static defense has become passive and ineffective. This predicament stems from the inevitability of software vulnerabilities, the asymmetrical cost between attack and defense, and the static nature of conventional network architectures. To overcome the limitations of single-dimensional hopping strategies in Moving Target Defense (MTD), this article proposes a collaborative hopping defense framework named Dual Address Hopping (DAH)-Dynamic Path Weights (DPW). This framework constructs an unpredictable attack surface through the spatio-temporal coordination of dual address hopping and dynamic path-weight-based routing. Leveraging a global collaboration architecture built on software-defined networking (SDN), it significantly reduces control overhead. Furthermore, a behavior-aware model is integrated to accurately identify malicious traffic. Both theoretical analysis and experimental results demonstrate that the proposed approach substantially increases the difficulty for attackers to execute eavesdropping and scanning attacks, thereby markedly enhancing the system’s proactive defense capabilities with acceptable performance overhead.