Area-Dividing Route Mutation in Moving Target Defense Based on SDN

Abstract

To enhance mutation efficiency and proactively defend against denial of service attacks in moving target defense, we propose an effective and speedy multipath routing mutation approach called area-dividing random route mutation (ARRM). This approach can successfully resist denial of service attacks with acceptable CPU overhead and reduce convergence time caused by route mutation. Our contribution in this paper is threefold: (1) we provided model and method for smooth deployment of ARRM on software-defined networks; (2) we proposed extended shortest path calculation and route selection method to identify and select efficient route; (3) we simulated the interaction between ARRM defender and DoS attacker and develop analytical and experimental models to investigate the effectiveness and costs of ARRM under different mutation intervals and adversarial parameters. Our analysis and preliminary implementation show that ARRM can protect flow packets from being attacked against persistent DoS attackers and prolong attackers’ response time. Moreover, compared with traditional RRM schemes, our implementation shows that ARRM can efficiently decrease the recalculation time delay caused by route mutation with acceptable CPU costs.