AI 中文总结
本文针对现有移动目标防御评估的碎片化问题，提出MTD-Playground评估框架，在企业多阶段攻击场景下，用复合评估方法分析基于SDN的路径随机化MTD技术，通过实验得出变异间隔与攻击成功率、完成时间、吞吐量等的关系，证明该技术可实际部署并扰乱攻击进程。
AI 中文摘要
移动目标防御（MTD）作为一种主动网络防御范式，通过软件定义网络（SDN）支持的路径随机化等动态网络重新配置技术增加攻击者的不确定性。但现有评估因攻击者假设、攻击场景和评估指标不一致而碎片化。本文提出MTD-Playground，用于在现实企业风格多阶段攻击场景下对基于SDN的路径随机化（PR）MTD技术进行基准测试。它引入复合评估方法，以分析部署有效性、变异间隔权衡和防御者-攻击者操作平衡。以周期性路径随机化为代表策略的评估显示，激进的变异间隔降低攻击成功率至4%-20%，同时增加攻击完成时间至160-311秒，还提高吞吐量达30.9%并降低内部路径延迟且不中断服务。复合分析表明，较短变异间隔能实现最高部署有效性和正向防御者优势。结果表明基于SDN的PR-MTD能显著扰乱多阶段攻击进程且可在企业环境中实际部署。
英文摘要
Moving Target Defense (MTD) has emerged as a proactive network cyber defense paradigm that increases attacker uncertainty through dynamic network reconfiguration techniques such as Software-Defined Networking (SDN)-enabled path randomization. However, existing evaluations remain fragmented due to inconsistent attacker assumptions, attack scenarios, and evaluation metrics, limiting reproducibility and deployment-oriented comparison. In this paper, we present MTD-Playground, an attacker-aware evaluation framework for benchmarking SDN-enabled path-randomization (PR) MTD techniques under realistic enterprise-style multi-stage attack scenarios. Beyond isolated security and performance metrics, MTD-Playground introduces a composite evaluation methodology for analyzing deployment effectiveness, mutation-interval trade-offs, and defender-attacker operational balance. Using periodic path randomization as a representative PR-MTD strategy, our evaluation shows that aggressive mutation intervals reduce attack success rates to 4-20% while increasing attack completion time to 160-311s across evaluated attack scenarios. At the same time, PR-MTD improves throughput by up to 30.9% and reduces internal-path latency without service interruption. Composite analysis further shows that shorter mutation intervals consistently achieve the highest deployment effectiveness and positive defender advantage. These results demonstrate that SDN-based PR-MTD can substantially disrupt multi-stage attack progression while remaining practically deployable in enterprise environments.
Comments15 pages, 6 figures
