An adversarial coupon-collector model of asynchronous moving-target defense against botnet reconnaissance

George Kesidis, Yuquan Shan, Daniel Fleck, Angelos Stavrou, Takis Konstantopoulos

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

We consider a moving-target defense of a proxied multiserver tenant of the cloud where the proxies dynamically change to defeat reconnaissance activity by a botnet planning a DDoS attack targeting the tenant. Unlike the system of [4] where all proxies change simultaneously at a fixed rate, we consider a more 'responsive' system where the proxies may change more rapidly and selectively based on the current session request intensity, which is expected to be abnormally large during active reconnaissance. In this paper, we study a tractable 'adversarial' coupon-collector model wherein proxies change after a random period of time from the latest request, i.e., asynchronously. In addition to determining the stationary mean number of proxies discovered by the attacker, we study the age of a proxy (coupon type) when it has been identified (requested) by the botnet. This gives us the rate at which proxies change (cost to the defender) when the nominal client request load is relatively negligible.

Original languageEnglish (US)
Title of host publicationMALWARE 2018 - Proceedings of the 2018 13th International Conference on Malicious and Unwanted Software
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages61-67
Number of pages7
ISBN (Electronic)9781728101538
DOIs
StatePublished - Mar 4 2019
Event13th International Conference on Malicious and Unwanted Software, MALWARE 2018 - Nantucket, United States
Duration: Oct 22 2018Oct 24 2018

Publication series

NameMALWARE 2018 - Proceedings of the 2018 13th International Conference on Malicious and Unwanted Software

Conference

Conference13th International Conference on Malicious and Unwanted Software, MALWARE 2018
CountryUnited States
CityNantucket
Period10/22/1810/24/18

All Science Journal Classification (ASJC) codes

  • Computer Networks and Communications
  • Software
  • Safety, Risk, Reliability and Quality

Fingerprint Dive into the research topics of 'An adversarial coupon-collector model of asynchronous moving-target defense against botnet reconnaissance<sup>∗</sup>'. Together they form a unique fingerprint.

  • Cite this

    Kesidis, G., Shan, Y., Fleck, D., Stavrou, A., & Konstantopoulos, T. (2019). An adversarial coupon-collector model of asynchronous moving-target defense against botnet reconnaissance. In MALWARE 2018 - Proceedings of the 2018 13th International Conference on Malicious and Unwanted Software (pp. 61-67). [8659359] (MALWARE 2018 - Proceedings of the 2018 13th International Conference on Malicious and Unwanted Software). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/MALWARE.2018.8659359