A Formal Verification of Configuration-Based Mutation Techniques for Moving Target Defense

Abstract

Static system configuration provides a significant advantage for the adversaries to discover the assets and vulnerabilities in the system and launch attacks. Configuration-based moving target defense (MTD) reverses the cyber warfare asymmetry for the defenders’ advantage by mutating certain configuration parameters proactively in order to disrupt attacks planning or increase the attack cost significantly.

A key challenge in developing MTD techniques is guaranteeing design correctness and operational integrity. Due to the dynamic, asynchronous, and distributed nature of moving target defense, various mutation actions can be executed in an interleaved manner causing failures in the defense mechanism itself or negative interference in the cyber operations. Therefore, it is important to verify the correctness and operational integrity, of moving target techniques to identify the design errors or inappropriate run-time behavior that might jeopardize the effectiveness of MTD or cyber operations. To the best of our knowledge, there is no work aiming for the formal verification of the design correctness and integrity of moving target defense techniques.

In this paper, we present a methodology for formal verification of configuration based moving target defense. We model the system behaviors with system modeling language (SysML) and formalize the MTD technique using du-ration calculus (DC). The formal model satisfies the constraints and de-sign correctness properties. We use the random host mutation (RHM) as a case study of the MTD system that randomly mutates the IP addresses to make end-hosts untraceable by scanners. We validate the design correctness of RHM using model checking over various configuration-based mutation parameters.

Appendix: DC Implementable with Definition

DC implementables	Pattern	Description
Initialisation	$\lceil \rceil \longrightarrow \lceil x \rceil ; true,$	Each control automaton is either empty or in initial state
Sequence	$\lceil x \rceil \longrightarrow \lceil x \vee x_1 \vee x_2 \vee ..\vee x_n \rceil$	if the control automaton is in state x it subsequently stays in x or moves to one of the state $x_1,...,x_n$. e.g. all transition among the states of a component are specified using sequence implementable
Progress	$\lceil x \rceil \xrightarrow {\varepsilon } \lceil \lnot x \rceil$	The control automaton stays for $\varepsilon$ seconds in state x, it leaves this state and progresses accordingly. e.g. This will be used to define the computational overhead of mutation
Synchronization	$\lceil x \wedge \alpha \rceil \xrightarrow {\varepsilon } \lceil \lnot x \rceil$	The control automaton stays for $\varepsilon$ second in state x with condition $\alpha$ being true. The time unit $\varepsilon$ is a clock that can be either discrete or continuous type. e.g. This will be used to allow the transition iff the mutation criterion is satisfied
Bounded Stability	$\lceil \lnot x \rceil ; \lceil x \wedge \alpha \rceil \xrightarrow {\le \varepsilon } \lceil x \vee x_1 \vee x_2 \vee ..\vee x_n \rceil$	When the control automaton changes its state to x with the condition $\alpha$ being true and the time does not exceed $\varepsilon$ seconds, it stays in x or it moves to one of states $x_1,...,x_n$. e.g. Mutate vIP after a certain time interval
Unbounded Stability	$\lceil \lnot x \rceil ; \lceil x \wedge \alpha \rceil \longrightarrow \lceil x \vee x_1 \vee x_2 \vee ..\vee x_n \rceil$	when the control automaton changes its state to x with the condition $\alpha$ being true, it stays in x or it moves to one of states $x_1,...,x_n$. e.g. Select new vIP till all MT hosts get a new vIP
Bounded Initial Stability	$\lceil x \wedge \alpha \rceil \xrightarrow {\le \varepsilon } _0 \lceil x \vee x_1 \vee x_2 \vee ..\vee x_n \rceil$	When the control automaton initially is in state x with the condition $\alpha$ being true and the time does not exceed $\varepsilon$ seconds, it stays in x or it moves to one of states $x_1,..,x_n$. e.g. Set values of all parameters in initial phase before mutation starts
Unbounded Initial Stability	$\lceil x \wedge \alpha \rceil \longrightarrow _0 \lceil x \vee x_1 \vee x_2 \vee ..\vee x_n \rceil$	When the control automaton initially is in phase x with the condition $\alpha$ being true, it stays in x or it moves to one of states $x_1,..,x_n$. e.g. Initialise the configuration parameters in initial phase