Chapter 3

Moving Target Defense

Mechanisms in
Cyber-Physical Systems
Shih-Wei Fang, Anthony Portante, and
Mohammad Iftekhar Husain
California State Polytechnic University, Pomona

Contents
3.1 Introduction...................................................................................................................... 64
3.2 MTD at Different Layers of a System.................................................................................65
3.2.1 Dynamic Runtime Environment............................................................................65
3.2.2 Dynamic Software..................................................................................................65
3.2.3 Dynamic Networks............................................................................................... 66
3.2.4 Dynamic Platforms................................................................................................ 66
3.2.5 Dynamic Data........................................................................................................67
3.3 Attacks on MTD Techniques.............................................................................................67
3.3.1 Brute-Force or Bypass MTD Techniques................................................................67
3.3.2 Predict MTD Techniques...................................................................................... 68
3.3.3 Limiting the Choice of Movement......................................................................... 68
3.3.4 Disabling Movement............................................................................................. 68
3.4 Cyber-Physical System....................................................................................................... 68
3.5 MTD Techniques for Network Security........................................................................... 69
3.5.1 Denial of Service................................................................................................... 69
3.5.2 Packet Scheduling.................................................................................................. 71
3.5.3 Eavesdropping....................................................................................................... 73
3.6 MTD Techniques for Controller Security......................................................................... 75
3.6.1 Deception Attack....................................................................................................76
3.6.2 Worms and Viruses................................................................................................ 77
3.6.3 Buffer Overflow..................................................................................................... 80

63
64 ◾ Securing Cyber-Physical Systems

3.7 MTD Techniques for Physical System Security..................................................................81

3.7.1 Deception Attacks................................................................................................. 82
3.7.2 Buffer Overflow..................................................................................................... 82
3.7.3 Physical Attack...................................................................................................... 84
3.8 Conclusion........................................................................................................................ 86
3.9 Future Research Direction................................................................................................ 87
Author Biographies.................................................................................................................... 87
References.................................................................................................................................. 88

Abstract: This chapter presents the importance and feasibility of applying moving target
defense (MTD) techniques to cyber-physical systems (CPSs) as well as understanding
what a malicious attacker may attempt to do to circumvent such defenses. MTD is a
relatively new form of cybersecurity and, until recent years, it only consisted of Internet
protocol (IP) hopping and address space randomization. It is a concept of changing the
properties of a system. By randomizing and reconfiguring the system properties, MTD
dynamically alters the attack surface in such a way that the cost for the attacker to locate
and launch a successful attack on a target increases. A CPS is a combination of cyber and
physical systems such as industrial control systems (ICSs) and the smart grid. MTD is a
practical and powerful choice to improve the security of CPSs. This chapter provides a
classification of MTD mechanisms and discusses how these mechanisms can be applied
to thwart attacks in different parts of a CPS: network, controller, and physical system.
Keywords: Moving target defence; Cyber-physical systems; Security; Diversity; Smart
grid; Industrial control system

3.1 Introduction
Moving target defense (MTD) is a game-changing cybersecurity concept that allows defenders to
alter the attack surface of a particular system and makes system penetration difficult for attackers.
Originating from the idea of address space randomization [1] and Internet protocol (IP) hopping [2],
MTD has now evolved into more modern techniques such as software behavior encryption [3] and
Internet protocol version 6 (IPv6) address randomization [4]. To access a system successfully, attackers
need to collect specific information at every stage. MTD allows us to alter this information in either a
random or a timed manner, significantly prolonging the time for a successful attack. With more and
more vulnerabilities being discovered every day, having a robust defense is vital to secure sensitive sys-
tems, such as a cyber-physical system (CPS). A CPS is a system that facilitates the interaction between
the cyberworld and the physical world, and it has rapidly emerged in the past decade. CPS security
is a crucial challenge not only because of its rapid emergence, but also because of its importance. For
example, many electricity distribution systems have recently been upgraded to a CPS, known as the
smart grid. In [5], the authors state that a single bug in the smart grid could cause a loss of more than a
billion dollars due to the immense size of this industry. To sum up, because of its growth and signifi-
cance, a CPS requires a more advanced and robust defense technology, such as MTD.
In this chapter, we will discuss MTD basics and how MTD can be applied to a CPS. We will
first dive into certain MTD techniques that are being applied to different layers of the system.
After getting a firm grasp of the MTD basics, we will then explore security issues in the CPS
domain and how the MTD techniques can be applied to different layers or parts of a CPS.
 Moving Target Defense Mechanisms in Cyber-Physical Systems ◾ 65

3.2 MTD at Different Layers of a System

MTD is one of the key components of a cybermaneuver that reshapes friendly networks and
their associated assets to be resilient to cyberattacks. Every system has attack surfaces and the
goal of MTD is to continually shift the attack surface in a planned way that makes every step
to the attack more costly for the attacker. A real-world example of MTD was demonstrated by
the Georgia government in 2008 when it came under large-scale cyberattack [6]. During the
attack, Georgia sought cyberrefuge from the United States and other friendly countries such as
Poland and Estonia by relocating its key government services to these countries. In making a
defensive cybermaneuver, Georgia was able to maintain key government services in the face of
a massive denial-of-service (DoS) attack and demonstrated the effectiveness of MTD. With the
recent advances in technology, such as virtualization, process migration, redundant network con-
nections, just-in-time compilers, instruction set randomization, and address space layout random-
ization, the realization of MTD has become feasible.
At the National Cyber Leap Year (NCLY) Summit 2009, MTD was chosen as one of the five
game-changing techniques [7]. Although MTD has earned attention from researchers for only a
decade, numerous research ventures have been developed. Based on the layer of the system that it
is applied to, MTD can be grouped into five categories [8]:

3.2.1 Dynamic Runtime Environment

Dynamic runtime environment changes the environment during executions. There are two major
techniques in this category: address space randomization and instruction set randomization.
Address space randomization is the most known example of MTD, and has been developed for
roughly a decade. This MTD mechanism protects the system from buffer or stack overflow attacks.
By overrunning the static memory structure, buffer overflow attacks overwrite key data on a mem-
ory address and call specific functions to control the system. To obscure attackers from knowing
the location of key data, address space randomization randomly selects memory addresses or sizes.
There are different variations of memory randomization, such as randomizing the stack structure,
the heap structure, or the function pointer structure [9]; each of these provides different levels of
complexity for the attacker. For instance, in address space layout permutation (ASLP) [10], the
kernel-level address permutation contains randomizations for the user stack, the brk()-managed
heap, and the mmap() allocation.
The other technique is instruction set randomization [11], which prevents code-injection
attacks, including buffer overflow attacks. Taking a buffer overflow attack as an example, the
attacker overwrites the data with the address of specific functions in order to control the sys-
tem. Instruction set randomization impedes the attack by constantly changing the location of the
instruction sets, which means the function addresses are vague. Due to the uncertainty of loca-
tions, the attacker cannot correctly invoke the desired functions. This technique is implemented
by manipulating the instruction structure, function name, or system call data. It can also be done
by encrypting the instruction sets with an encryption scheme such as the Advanced Encryption
Standard [12].

3.2.2 Dynamic Software

Dynamic software dynamically changes an application’s code by modifying the program instructions,
their order, their grouping, or their format. Software diversity techniques prevent code-injection
66 ◾ Securing Cyber-Physical Systems

attacks and worms by diversifying vulnerabilities. An execution system, such as a compiler or a server,
holds distinct implementations with identical functionality and randomly allocates them to minimize
the damages. One such example of this can be found in [3], where the authors describe the concept
of software behavior encryption, dubbed ChameleonSoft. It changes the implementation sequence of
complex services and programs even including the language of implementation that is used to thwart
language-specific attacks. A more in-depth discussion on ChameleonSoft can be found in Section 3.3.
O’Donnell and Sethu propose a software diversity technique to improve network security using dis-
tributed coloring algorithms [13]. To increase the diversity of the whole network, they show that
randomizing individual systems is insufficient. They analyze network topologies of software packages
with identical functionalities. Using distributed coloring algorithms, the system allocates software
packages to prevent the spread of attacks. Since each package suffers from different vulnerabilities,
the attacker needs to come up with unique attack schemes for each package. Moreover, by choosing
diverse packages for servers or clients, the defense minimizes the damage from identical attacks. There
are other implementations for software diversity. Fraser et al. [14] presented a defense that manipulates
the security policies of servers. Roeder and Schneider [15] introduced a method for creating server
replicas with less identical vulnerabilities.

3.2.3 Dynamic Networks

By reconfiguring network properties, MTD techniques in dynamic networks secure the integrity
and availability of connections. Depending on the implementations, the defense can randomize
distinct properties on the network, such as IP addresses, the transmission control protocol (TCP)
port, and trust nodes. Kewley et al. [2] developed a gateway called DYNAT, which randomizes
the IP address and the TCP port. In order to communicate with each other, DYNAT needs to
be installed on both sides of the connection. Before the data transmits to the public network,
DYNAT modifies the destination host address on an IP header and the destination port on a
TCP header. The randomization of addresses is an encryption based on shared secrets between
two DYNATs. The secrets are updated periodically. By constantly changing the addresses, the
defense impedes attackers from observing the connections. In concealing the connections and the
locations of both sides, DYNAT avoids attacks utilizing IP addresses, such as DoS, eavesdrop-
ping, and hijacking. Furthermore, depending on the purpose of the connection, there are differ-
ent MTD techniques. To quickly and correctly update the information, Li [16] presented MTD
randomizing trust nodes. By treelike connections, the source spreads the updates, and each node
transmits to its child nodes. When joining to the network, this defense diversifies the parent and
child nodes to avoid incorrect updates or the attacker’s updates.

3.2.4 Dynamic Platforms

Dynamic platforms change the configuration of platforms, such as operating systems (OSs) and
central processing units (CPUs). According to the requirements of the defense, the platform
randomizes different properties, such as the OS version, OS instance, and CPU architecture.
Holland and his team [17] proposed a virtual machine monitor that produces a large number
of OSs with slight differences. To resist 100 attacks per second for a week requires 227 distinct
machines, which means 27 independent binary decisions. They analyzed possible properties for
creating different machines, such as the number of registers, word size, and representations of a
signed number. However, no practical experiment has proved the concept. Next, Okhravi [18]
described a framework that can migrate applications on heterogeneous platforms, called the
 Moving Target Defense Mechanisms in Cyber-Physical Systems ◾ 67

Trusted Dynamic Logical Heterogeneity System (TALENT). Supporting programs that are
written in C, TALENT is able to move to another OS and hardware while running the applica-
tion. In order to move across the environment, TALENT uses OS-level virtualization to sandbox
the application. This defense is able to prevent code-injection attacks that utilize the vulnerabili-
ties of specific OSs or hardware.

3.2.5 Dynamic Data

Dynamic data changes the properties of data, such as data format, syntax, and representations.
Ammann and Knight [19] proposed a data diversity technique that provides fault tolerance. By
reexpressing an input to multiple inputs, they computed the function with a different imple-
mentation. For instance, with sin(x) = sin(a)*sin(π/2 − b) + sin(π/2 − a)*sin(b), the program is
able to compute sin(x) using another implementation. When a + b = x, two implementations are
expected to have identical results. By choosing a different a and b, the program is able to compute
several answers to avoid faults from computations. They decomposed the input and recomposed
the results by utilizing the representation of data. In [20], the authors present data randomization
techniques, which provide probabilistic protection from attacks that exploit memory errors. Using
XOR-ing data with random masks, the defense encrypts data before storing it in the memory.
Because the data is decrypted before use, attackers cannot overwrite the memory with malicious
data, which results in an error when decrypting. Similarly, attackers are unable to obtain confiden-
tial information from other classes, since the encrypted key is different.
Although MTD has been categorized into five categories, its techniques are not restricted to
one single category. For instance, the software diversity technique falls under both the dynamic
software and the dynamic platform since it can change both the codes and the properties of the
platform simultaneously.

3.3 Attacks on MTD Techniques

In this section, we discuss the vulnerabilities of existing MTD techniques as identified in [8].

3.3.1 Brute-Force or Bypass MTD Techniques

If the space of randomization is not large enough, the attacker can brute-force the defense. By
launching a large number of attacks simultaneously, the attacker can overwhelm a number of
targets. Also, after analyzing MTD technique, an attacker can carefully craft an attack to bypass
the protection.
For instance, rather than injecting codes in the systems, the return-to-libc attack utilizes the
system-defined libraries where instruction set randomization does not have an effect [21]. With
the existing libraries, the attacker bypasses the randomization of instruction sets. Introduced
by Shacham [22], return-oriented programming (ROP) is an improvement of the return-to-libc
attack, which again bypasses MTD. Instead of jumping to the beginning of the library, ROP
chains the instructions in existing codes to execute the desired functions; however, there are also
improvements in instruction set randomization. For instance, G-Free is a defense that protects
from ROP attack [23]. Onarlioglu et al. discovered that ROP utilizes specific instructions in
libraries, called free branch. By randomizing the locations of the instructions, G-Free impedes the
attacker from chaining the instructions.
68 ◾ Securing Cyber-Physical Systems

3.3.2 Predict MTD Techniques

In this category, the attacker predicts the choice of defender in an MTD technique. MTD mecha-
nisms are not always random due to the restriction of the deployment environment. For example,
in software diversity techniques, the software may not be installed on all types of OS, such as
Windows and Mac OSs. The attacker can target the software on a specific OS. Moreover, even
when MTD randomizes the choice, prediction is still possible through information leaked by side
channels. In address space randomization, the attacker might predict the location of libraries by
leaked addresses. Also, if MTD technique randomizes its choices by cryptography such as IP hop-
ping, the attacker can predict IP addresses with the key leakage. So, based on information leakage
of the system, it might be possible for the attacker to predict the technique applied by MTD.

3.3.3 Limiting the Choice of Movement

By limiting the choice of movement, the attacker is able to decrease defense options. For example,
the adversary can fill up memory space to limit the randomization possibilities in address space
randomization. Moreover, the limitation may not always be caused by attackers. In IPv4, the free
space for IP addresses is scarce due to incremental usage. Thus, the IP hopping technique for IPv4
is not sufficient due to the shortage of IP addresses. Although the scope of IPv6 is very large, the
IP hopping technique may also suffer from limited space in the future.

3.3.4 Disabling Movement

In this attack, the adversary disables the movement of MTD. In other words, the attacker turns off
MTD or impedes MTD from operating. For instance, by pushing a bad configuration, attackers
can disable the address space randomization in the OS. Shacham [21] introduces an attack against
address space randomization that disables the server from reconstructing the object. Generally,
when modifying the address, the system produces errors and restarts the function or system;
however, Shacham found that the location is identical when restarting the system for specific
functions. That is, the attacker is able to obtain the correct position without an attempt limit. For
instance, if there are n possibilities of the position, without changing the position the attack will
succeed before completing all n attempts.
Despite some existing vulnerabilities, MTD still provides sufficient defense because of the
improvements in its design and flexibility. In the following sections, we examine the security of a
CPS and discuss MTD applications in different parts of a CPS.

3.4 Cyber-Physical System

By definition, a CPS [14] can be viewed as the construction of a network, a physical system, and a
controller, as shown in Figure 3.1. The network delivers feedback and controls the signals between
controllers and physical systems. Physical systems include sensors and actuators. Sensors collect
the physical information from the physical world, and actuators interact with the physical world
by commands from controllers. Lastly, controllers make decisions and command actuators based
on information from sensors. Each component faces its own security challenges not only as indi-
vidual pieces, but also from the interaction as a whole. Due to the complexity of a CPS, we analyze
its security by discussing MTD techniques that are being applied to each of the three components
as well as possible attacks.
 Moving Target Defense Mechanisms in Cyber-Physical Systems ◾ 69

Actuators Sensors
a1 s1
Physical
s2
world
a2
a3 s3 s4

Network

Figure 3.1 Components of a CPS. (From Petkac, M., et al.

c1 c1 c1 Security agility for dynamic execution environments. DARPA
Information Survivability Conference and Exposition, 2000.
Distributed controllers
DISCEX ’00. Proceedings, 2000. With permission.)

3.5 MTD Techniques for Network Security

Confidentiality, integrity, and availability (CIA) are three basic requirements in cybersecurity. For
a CPS there are several issues that makes the CIA requirements challenging. First of all, the net-
work is connected to the public network, which is not only used by employees, but also by public
users. A CPS should provide security schemes for external access based on the system require-
ments. Secondly, the network access is diverse. Depending on the environment, information is
transmitted via a particular type of network: wired or wireless. For example, a CPS may transmit
through near field communication (NFC), Bluetooth, or Wi-Fi in a wireless connection; and also
cable, Ethernet, or other wired access. Due to the diversity of network access, each CPS faces a
unique type of attack. Next, the amount of data transmission varies. Each CPS should be robust
enough to address specific situations. A smart meter may only need to transmit data once per day;
however, it may need to transmit data every second for a monitor. Lastly, there is a huge difference
in computational power between the physical systems and the controllers. For instance, smart
meters contain one processor, nonvolatile storage, and a communication interface [5]; however,
control centers are combinations of computers. The extreme difference between the two sides of
the network restricts a complex defense with heavy resources. Due to the abovementioned chal-
lenges, each CPS needs unconventional solutions for its security. To avoid the diversity of a CPS,
we focus on the possible attacks that occur in a CPS.
Figure 3.2 shows attacks in a CPS, which are represented by tags: A1–A12. In this section,
we introduce attacks on network security and discuss MTD techniques to address such attacks.
Table 3.1 shows MTD techniques for each attack.

3.5.1 Denial of Service

Denial of service, or distributed denial of service (DDoS), is an attack that makes the service or
network unavailable to users. Although the methods, targets, and resources vary, DoS temporally
suspends use of the connection in general. For example, by flooding the network, jamming the
connection, and attacking the protocols, DoS prevents users from reaching the service. DDoS is a
DoS with multiple simultaneous attacks, usually performed by bots (or botnets), which are collec-
tions of Internet-connected programs that perform identical tasks. In this chapter, DoS represents
both DoS and DDoS since the attack strategy is identical.
In a CPS, DoS attacks impede the connection between the controller and the physical sys-
tem. As shown in Figure 3.2, A4 is a DoS attack that renders the controller unavailable to receive
70 ◾ Securing Cyber-Physical Systems

Compromised
physical system

A3 A5
A2 A4

A1 A6

A12 Physical
Controller A7
system

A11 A8
A9
A10

Figure 3.2 Attacks on a CPS.

Table 3.1 MTD Techniques to Address Network Security Attacks on CPS

Tag Attacks MTD Category Example CPS Extension Exists?

A4, A9 DOS Dynamic network DynaBone No

MT6D Yes

A2, A10 Packet scheduling Dynamic network MT6D Yes

A6, A11 Eavesdropping Dynamic network DynaBone No

MT6D Yes

Dynamic data N-variant with No

data diversity

connections from physical systems. Without information collected from the physical world, the
controller is unable to make decision; furthermore, the attacker can mislead the controller to per-
form unintended actions [27]. On the other hand, A9 is the DoS in the opposite direction. The
data sent from controllers are control signals executed by the physical system. Without the signal,
physical systems will not be able to perform the action signaled, which may be the intention of the
attackers. For instance, by restricting the control signal, a smart meter will not turn off the home
appliance, which will cause an inconvenience to users. Furthermore, physical systems face addi-
tional effects from DoS. Since embedded systems often have significant energy constraints, and
many are battery powered, DoS may cause battery attacks in physical systems [33]. With power-
hungry communications, DoS wastes the batteries of physical systems during interaction. By drain-
ing the battery power, the attacker turns off the physical device without even breaking into it.
Touch et al. [34] proposed an MTD against DDoS attacks among private groups of networked
systems, called DynaBone. Using parallel interior overlays, known as innerlays, DynaBone pro-
vides multiple targets for attackers while maintaining a single network service, called the outerlay.
To manipulate the outerlay and innerlays, Touch et al. propose a proactive/reactive multiplexer
 Moving Target Defense Mechanisms in Cyber-Physical Systems ◾ 71

3DES encrypt / Linkstate

P P
R RC5 encrypt / RIP R
M M

MD5 auth / static

Figure 3.3 DynaBone design. (From Touch, J. D., et al. DynaBone: Dynamic defense using
multi-layer Internet overlays. In Proceedings 3rd DARPA Information Survivability Conference
and Exposition (DISCEX-III), Washington, DC. 2003. With permission.)

(PRM) that decides the distribution of packets for each innerlay. Figure 3.3 shows the design of
DynaBone. Each innerlay utilizes a distinct network protocol and security algorithms.
In general, the PRM distributes packets in the innerlays with attack statistics and scatters
the damage from DoS. Since the PRM changes the packets in each innerlay, the attacker cannot
understand the information of the blocked packets; that is, the attacker can only target specific
packets by chance. On the other hand, when suffering DoS on some innerlays, the PRM transmits
the packets with other innerlays. This approach detects DoS attacks from incorrectly received
packets, and moves the attacked connection to a safe innerlay. Due to the combination of different
approaches, DynaBone not only handles DoS attacks, but also escapes from future attacks.
The controller and the physical systems are private groups in some CPSs. For instance, the
smart grid can be considered a private group of network systems, since smart meters are privately
connected. In general, for smart meters the only communication is with the control center. While
there may exist communications with other devices, such as cell phones and home appliances,
smart meters can create a private connection with the control center [35]. The major issue with
implementing DynaBone is the computational power of physical systems. The PRM, innerlays,
and outerlay design can be simplified without using statistical analysis. While the security algo-
rithms are intensive for physical systems, the application of this MTD technique is still feasible.
By randomly distributing packets into overlays and disabling the attacked overlays, MTD can be
simplified for a lesser amount of security guarantee.

3.5.2 Packet Scheduling

The second attack is a packet-scheduling attack that reorders the packets. Rather than blocking
the entire network, such as DoS, packet-scheduling attacks delay some packets to in turn cause a
system error. Packet-scheduling attacks can be mounted using several techniques. For example, by
placing malicious software on the router on the path of the connection, the attacker reorders the
72 ◾ Securing Cyber-Physical Systems

packets without consent. Since the latency of the packets is minimal, it is difficult for a system to
detect.
Packet-scheduling attacks can also be launched in both directions in a CPS. From physical
systems to the controller (A2), the attacker reschedules the packets to exceed the deadline, which
causes the system to retransmit the packets. The delay and the missing data on the controller
cause a control analysis problem. Due to incomplete data, the controller may conclude with a
false decision [30]. On the other hand, if the packets received from the controller are reordered,
the physical system may perform the actions in same order (A10). This may cause errors in the
performance of the physical system. Packet-scheduling attacks utilize only the connection infor-
mation and not the content. Even if the attacker has no information on the content, the attack
may still succeed.
Groat et al. [4] presented an MTD that protects the connection from attackers, called
MT6D. Specifically, MT6D hides the communication by proactively changing the IP address
in the IPv6 space, which is an IP hopping–type MTD method. IPv4 is not feasible for this
scenario because of the high density and the ease of scanning the entire address space. In IPv6,
however, the address space is huge and is time consuming to scan with current technology. In
fact, scanning the whole address space in IPv6 would take 8.77 × 1010 years [36]. While there
are several IP hopping techniques in IPv6, MT6D provides the implementation in the smart
grid.
Similar to other IP hopping techniques, MT6D provides an MT6D gateway, which is installed
in both sides of the connection. In this case, the controller and the physical system both need to
implement an MT6D gateway. Figure 3.4 shows the third party’s view after implementing the
MT6D gateway for one controller and one physical system. Since the IP address is dynamically
determined, there are numerous possibilities for the location of the physical system. On the other
hand, the controller also hides in a subnet with a dynamic configuration. The attacker cannot even
target the subnet, since the location is concealed.
To compute the IP address, which is an MT6D interface identifier (IID), MT6D provides a
function using three components. The first component is the value of the host, such as a media

Home Controller

??

??
Home
Controller
??

Home Attacker
Controller

Figure 3.4 An overview of implementing MT6D in a home and a controller. (From Groat, S.,
and Dunlop, M. Using an IPv6 moving target defense to protect the smart grid. Innovative Smart
Grid Technologies (ISGT), 2012 IEEE PES, 2012. With permission.)
 Moving Target Defense Mechanisms in Cyber-Physical Systems ◾ 73

access control (MAC) address. The second component is a key that is shared between the control-
ler and the physical system, such as a symmetric key. The last component is a nonce value, such as
time, which is known by both parties. Although there are three components in this function, the
only component that needs to be secret is the shared key. The function is formed as

IIDx ′(i ) = f { IV x * S *CVi }64

The output of this function is 64-bits. The IID represents the new location in a subnet for host
x at instance i; IVx is the first component that is unique to the host x; S is the shared secret key;
and CVi is the nonce value at instance i. The operation is denoted by * and the 64-bit function is
denoted by f {.}64. This function may be a computation of a MAC address, a shared symmetric key,
and the current time. To proactively change with time, each MT6D computes both its IID and
the other’s IID with the next time value, which means that the IP address is not randomized, but is
determined by the time variable; however, to the attacker, without knowing the shared secret key,
the IID appears to be a random object. Moreover, MT6D provides the obfuscation without caus-
ing the additional overhead of reestablishing or breaking down during midsession. By computing
the next IP address, MT6D automatically changes the destination address when needed. This
protects against an attacker that is trying to collect all packets for a particular session.
Although MT6D secures the system with a varying address space, there are still limitations.
First of all, this technique provides an additional shared key to randomize the IID. When con-
structing the connection, MT6D transmits the key over the network. So, the security of the key
becomes another challenge in the system. Secondly, although the concept of MT6D also works
for IPv4, it is not feasible to implement. The lack of free space in IPv4 and the ease of scanning a
whole subnet are the major issues. Lastly, the latency and overhead are another challenge. MT6D
utilizes an additional 62 bytes to encapsulate the connection. Since the smart gird transmits data
with small pieces of information, the latency may not be affordable.
In [4], MT6D is targeted to smart grid systems; however, its application to other CPSs may also
be feasible. Although each CPS needs specific modifications, the concept of IP hopping secures CPSs
by hiding their connection. Moreover, MT6D may also be improved by using other existing tech-
niques. For example, Kewley et al. [2] randomized not only the IP address, but also the TCP port.

3.5.3 Eavesdropping
An eavesdropping attack attempts to secretly listen to private conversations without consent. In
computer science, all communication between devices, computers, and components can be defined
as conversations. Eavesdropping can be done over wired and wireless connections. Attackers ana-
lyze the packets and obtain the targeted information. From an eavesdropped packet, the attacker
can receive the information of an IP address, a TCP address, and even the content. Since eaves-
dropping is passive and does not modify data, its detection is difficult.
There are also two directions for an eavesdropping attack. In Figure 3.2, A6 represents the
eavesdropping on the connection from physical systems to controllers. Although eavesdropping
may not immediately harm the system, attackers are able to construct other attacks based on the
information. By A6, attackers may understand the syntax of the data, analyze the packets of the
connection, and gather the information of sensors. With the syntax of the data, attackers can
transmit the artificial data to compromise the system; with the analysis of the packets, adversaries
may break security encryptions; and with the sensor’s data, the attacker understands factors that
74 ◾ Securing Cyber-Physical Systems

influence the decisions of controllers. On the other hand, A11 eavesdrops on the connection from
the controller to the physical system, which is the control signal. By analyzing the control signal,
attackers can spoof the physical system by modifying the data.
The MTD technique introduced in Section 3.5.1 is also sufficient to thwart eavesdropping.
By distributing packets into overlays, the attackers can only partially understand the information.
That is, even if the attackers break a specific innerlay, they may obtain the content on the innerlay,
but not the whole connection. Moreover, with a different algorithm on innerlays, the attackers
need to construct distinct attacks to compromise the data; however, the reactive technique is no
longer useful. Since eavesdropping will not be detected, DynaBone cannot escape the eavesdrop-
ping attack reactively.
Furthermore, the IP hopping technique is also a solution to eavesdropping. Attackers cannot
target the connection because of the obfuscation of the IP address. By proactively changing the
IP address or protocols, attackers need to obtain the connection using other methods, such as a
Domain Name System (DNS) server. The MTD techniques introduced so far are for securing the
communication; however, since attackers can analyze content with eavesdropping, the system also
needs to protect the data.
In the dynamic data category, there is an MTD technique for data diversity. Although research
targets software fault tolerance and data intrusion, the concept is able to enhance the security
of data. The previous design, called N-variant [37], provides software fault tolerance. By imple-
menting redundant functions, the software obtains multiple outputs. Based on the comparison of
outputs, the software is able to avoid false computation. The redundant functions have to be iden-
tical in functionality but distinct in implementation. With the same input, the functions cause
different types of errors or false computations depending on the implementation. Since the errors
are manifested differently, the system is able to choose the correct answer with the majority vote.
Furthermore, based on the N-variant defense, the researchers proposed an MTD technique for
data intrusion, which protects the system from malicious inputs. By reexpressing the input, the sys-
tem compares the output and rejects it if they are different. In this design, the functions also provide
identical functionality but different input expressions. For each function, as shown in Figure 3.5, the
system reexpresses the input, computes the function, and transforms the output based on the reverse

External input

App interpreter App interpreter

Malicious data Normal data Normal data Malicious data

R0 R1
=
App interpreter App interpreter

Figure 3.5 N-variant systems with data diversity. (From Nguyen-Tuong, A., et al. Security
through redundant data diversity. 2008 IEEE International Conference Dependable System
Networks with FTCS DCC, 2008. With permission.)
 Moving Target Defense Mechanisms in Cyber-Physical Systems ◾ 75

of the reexpression function. The malicious inputs produce different outputs since the implementa-
tion of functions is distinct. To sum up, the concepts of the designs are redundancy and reexpression.
N-variant utilizes the redundant functions to tolerate function faults; N-variant with data diversity,
on the other hand, reexpresses the inputs to overcome the intrusion.
To apply the concept to eavesdropping on a network, we employ both redundancy and reex-
pression. By providing redundant transmission, the defender is able to confuse the attackers from
understanding the content. Since the attackers are unable to know which packet contains useful
information, they make a false decision based on the wrong information. Although this may pro-
vide certain security, the performance reduction due to the increment of traffic is a drawback. The
reexpression can also be applied on the network. By reexpressing data before transmission, it may
be difficult to understand the actual meaning of the transmission. The space of randomization
varies based on the expressions of data.
Furthermore, by increasing the complexity of encryption and dynamically changing the
encryption methods, the connection can also be protected. DynaBone distributes the packets
in innerlays with different encryptions. With the concept of IP hopping, the encryptions can
also be changed based on time, keys, or other factors. Since eavesdropping targets both connec-
tion and content, MTDs that hide the connection or complicate the content are protections to a
certain level. In fact, by preventing eavesdropping, MTDs also impede other attacks, such as a
deception attack, a command injection attack, and more. These attacks are launched based on the
information from eavesdropping. Attackers cannot construct the attacks without collecting the
information.

3.6 MTD Techniques for Controller Security

In the previous section, we introduced MTD techniques for network security. In this section, we
discuss MTD techniques to secure controllers in a CPS.
Controllers are usually a combination of computing devices that are responsible for receiv-
ing data from sensors, analyzing the data, and sending feedback to actuators to interact with the
physical world. Compared with the other two components, controllers have more computational
power; however, there are still several issues in controller security [24].
In general, a CPS has a high reliability requirement, since the electric, gas, and water distribu-
tion systems as well as the Industrial Control Systems (ICSs) should remain safe and maintain the
availability of resources as long as it is operating. As the brain of a CPS, controllers are responsible
for the reliability of the whole system. Even if there is a compromised physical system, the CPS
remains functional and is available for other users; however, the effect of compromised physical
systems can lead to disasters with a small deviation in controller functionality [38].
Next, the network dynamics are simple. The packets transmitted between the physical systems
and the controllers are data from sensors and control signals for actuators. Contrary to public pro-
duction networks, the patterns of transmission are easier to analyze, which means that attackers
can duplicate or modify the connection with less effort.
Lastly, the data is in real time and is collected from the physical world. Since events occurring
in the real world are unpredictable, the data is composed with infinite possibilities. It is hard for
controllers to differentiate the data from attackers and that from its own physical system. The trust
in the data becomes a challenge for controllers. To summarize, the aforementioned challenges can
cause the following attacks in controllers. Table 3.2 shows MTDs that are used to combat each
attack.
76 ◾ Securing Cyber-Physical Systems

Table 3.2 MTD Techniques to Address Controller Security Attacks on CPS

CPS Extension
Tag Attacks MTD Category Example Exists?

A1 Deception Dynamic network DynaBone No

MT6D Yes

Dynamic data N-variant with data No

diversity

State estimation MTD Yes

A3 False information from Dynamic data State estimation MTD Yes

compromised sensors

A5 Replay Dynamic data N-variant with data No

diversity

State estimation MTD Yes

A7 Worm and virus Dynamic platform Implementation Yes

Diversity

Dynamic software Software Diversity No

A7 Buffer overflow Dynamic runtime Address space No

environment randomization

Instruction set No
randomization

3.6.1 Deception Attack

Deception attacks are attacks that transmit false information. Figure 3.2 shows several deception
attacks. To begin with, the first attack is A1, a deception attack from the physical system to the
controller. By analyzing the information collected from an eavesdropping attack, the attacker
creates a fake transmission or modifies the data. The fake data then deceives the controller and
is used for decision. Based on the incorrect information, the controller analyzes data from sen-
sors, and commands actuators to take the wrong actions. For instance, Amin et al. [39] intro-
duced a deception attack for water Supervisory Control and Data Acquisition (SCADA) systems,
which withdraws water from pools through offtakes. By modifying the parameter of the water
partial differential equation (PDE) system, the controller is unable to detect when water is lost.
Specifically, the adversary opens the offtake and deceives the controller with a fake water level to
avoid detection. Since the water will rebalance after the offtake is closed, the attacker is able to
restore the original environment without being noticed.
Another deception attack is A3, which transmits the data from compromised sensors.
Although the consequence is identical to A1, A3 is more difficult to detect because of the trust
from compromised sensors. The adversary can construct the connection as usual with the secu-
rity identification, such as shared keys. For example, Kim et al. [40] proposed a deception attack
from compromised components against a smart grid system. With a slightly and continuously
changing electric volume, the attacker places the system in an extreme situation. In the event
of a huge change, the system breaks down since the physical system cannot handle the excess
 Moving Target Defense Mechanisms in Cyber-Physical Systems ◾ 77

electricity. The attack can be performed sequentially and is time costly due to the trust of com-
promised sensors.
Another attack in this category is a replay attack (A5). By replaying the transmission, the system
receives redundant information and goes with the attacker’s intention. In [41], the authors presented
a replay attack to a smart grid system. The attack can steal the energy or even cause damage to the
system. By simply replaying the data, the compromised smart meter reports fake usages to steal the
electricity or, similar to A3, the artificial data may damage the system by replaying messages.
Since the characteristics of attack are different, there are specific MTD solutions for each
deception attack. To perform the attack described under A1, the adversary needs to eavesdrop on
the connection to construct the attack. So, the MTD techniques introduced in Section 3.5.3 can
partially defend against deception attacks as well. IP hopping and DynaBone protect the con-
nection from attackers. Since replay attacks do not need to understand the communication, the
protection on the network has no influence on the attacker.
In addition, the data diversity technique reexpresses the content to prevent the reuse of the
connection. For example, since there are different expressions with a single meaning, the system
requires a specific expression and will not accept the replaying data.
A3 is an attack where compromised sensors transmit false information to the controller. The
defenses on the network and the data cannot address these attacks. To secure from compromised
sensors, trust is the crucial factor. Tang et al. [32] introduced a trustworthiness analysis of sensor
data in a CPS, called Tru-Alarm. By comparing the data with neighboring sensors, the Tru-Alarm
system may distinguish the deception attack. For example, in a water SCADA system, a Tru-
Alarm can detect a malicious reporting of wrong water level by a sensor by comparing it with the
water levels reported by neighboring sensors.
Furthermore, Rahman et al. [42] introduced an MTD that prevents state estimation (SE)
from deception attacks. In a smart grid system, SE is a process of estimating the current state of
systems using information from smart meters and other physical systems. With continuous false
information, the attacker deceives the controller and places the system in an extreme situation as
described in [40]. Rather than reexpressing data, this MTD changes the set of measurements and
perturbs line admittances. Similar to the N-variant system, it develops multiple measurements
of SE based on distinct attributes. By changing the estimation methods dynamically, attackers
cannot be certain of the success of the deception attacks. On the other hand, it also dynamically
modifies the topology of networks, such as an alternating current (ac) transmission system. This
technique is similar to the DynaBone design, which provides multiple inner layers for transmis-
sions. Since attackers may inject malicious codes in an ac transmission system, this MTD avoids
the false data by changing the route.

3.6.2 Worms and Viruses

Worms and viruses are malicious programs that may damage a computer or a system. A virus
attaches itself to a program or a file and infects others. Most viruses hide in executable files. That
is, the virus will only start infecting other programs or files after running the program. On the
other hand, worms are similar to viruses and are considered a subclass of a virus by some research-
ers. Contrary to viruses, worms spread from computer to computer without human action. From
the file or data communication features, worms automatically exploit vulnerabilities in systems
and infect other systems.
In 2009, a worm called Stuxnet [31] targeted an ICS and other similar systems. The final
goal of Stuxnet is to compromise the programmable logic controllers (PLC) and change the
78 ◾ Securing Cyber-Physical Systems

operation of systems without notice. To accomplish this goal, the code contains a mass array of
components, such as zero-day exploits, a Windows rootkit, PLC rootkits, and more. Each com-
ponent is able to utilize certain functionalities or compromise specific vulnerabilities. In fact,
Stuxnet is an extremely sophisticated worm, which includes different attack vectors. According
to a Symantec report, as of September 29, 2010, there are approximately 100,000 infected hosts
from 155 countries [31].
To address malicious software, the first MTD is implementation diversity. This MTD includes
several different layers. For instance, similar to the N-variant, the function layer contains redun-
dant implementations with identical functionalities; however, rather than running all functions,
the system randomly chooses an implementation, which may be able to avoid an attack that is
targeting a specific vulnerability. In other words, the adversary can only exploit the system with
probability since the execution is nondetermined. Moreover, the technique can also be build diver-
sity [43], which provides a similar concept in a different layer. From high-level language imple-
mentation, diverse binary images can be produced with different building tool chains. When an
application is built, the system randomly selects code-generation template variants to provide a
nondetermined binary image. Build diversity reduces the success probability of an attack designed
for a specific image. The implementation diversity technique includes multiple layers, such as func-
tion, binary, structural, and more.
System diversity is another MTD technique that constantly changes the system’s environment.
By modifying runtime policies, the system is able to execute with different environmental configu-
rations. Since attackers are able to observe the concurrent environment, system diversity changes
periodically to avoid attacks. For attacks targeting a specific environment, this technique reduces
the chance of a successful attack.
Azab and Eltoweissy [3] proposed an MTD technique called ChameleonSoft, incorporating
the idea of implementation diversity and system diversity. Inspired by chameleons in biology,
the system provides multilayer diversity for different purposes. ChameleonSoft is based on cell-
oriented architecture (COA). COA utilizes active components termed cells that support the soft-
ware development, deployment, execution, and maintenance. Separating logic, state, and physical
resources, cells contain specific information about the system. Using a composition of cells, an
organism is generated, representing complex multitasking applications. Figure 3.6 illustrates an
abstract view of a COA cell at runtime. Containing a specific functionality, cells isolate the execut-
able logic from the underlying physical resources.

Active sensing

Input ports Variant pool Cell components Output ports

Unique ID

Cell at runtime

Figure 3.6 COA cell at runtime. (From Azab, M., and Eltoweissy, M. ChameleonSoft: Software
behavior encryption for moving target defense. Mobile Networks Applications, 2012. With
permission.)
 Moving Target Defense Mechanisms in Cyber-Physical Systems ◾ 79

HLL Binary Moving Robust

code image target moving target
Specification Diverse variants Diverse variants Runtime software Automatic software
implementation building shuffling fault
recovery

Figure 3.7 BioSENSE overview. (From Eltarras, R. M. Biosense: Biologically-inspired secure elas-
tic networked sensor environment. Ph.D. dissertation, The Faculty of the Virginia Polytechnic
Institute and State University. 2011. With permission.)

Furthermore, Eltarras introduced a system integrating MTD techniques for a CPS, called
BioSENSE (Biologically Inspired Secure Elastic Networked Sensor Environment) [43]. Also
based on the COA, BioSENSE provides an implementation diversity that includes more ran-
domizations. Figure 3.7 depicts the MTD principles of BioSENSE. In the first two stages
on the left, the system creates static randomizations for layers. The randomizations include
not only structural diversity, but also fault, tough spot, and failure diversity. Fault diversity
estimates the faults found among variants; tough spot diversity estimates the fault-proneness
among the elements of variants; and failure diversity estimates the failure behavior among
variants. These variants provide the system to be composed of organisms with more diversity.
Moreover, the system also supports build diversity in randomizing binary images. In the third
stage, BioSENSE provides several shuffles for organisms: periodic, random, event-driven, and
application-initiated shuffling. The periodic and random shuffling changes the composition of
organisms by time. Rather than changing with a static duration, random shuffling reconstructs
over a random period. Event-driven shuffling changes when an event occurs, such as detection.
Lastly, the system reconstructs the organisms when explicitly requested to by the running vari-
ant. For instance, when an unexpected error occurs, the system restarts the current stage and
shuffles the cells.
Different from the aforementioned diversity techniques in considering a single system, soft-
ware diversity considers a whole ecosystem. In Section 3.2.2, we briefly introduced two software
diversity techniques targeting different variables: software and vulnerability. Using a distributed
coloring algorithm, O’Donnell and Sethu diversify the software on the network [13]. Figure 3.8
illustrates a simple example of the difference between a homogeneous network and a diversified
network. In Figure 3.8a, servers and clients all install Software 1; in Figure 3.8b, clients have
Software 1 and servers install Software 2. With identical Software 1, a worm can infect all the
computers on the network (a), since the vulnerabilities are identical; however, in network (b),
due to the difference in vulnerability, servers X and Y will not be infected by a malware that
exploits the vulnerability of Software 1, which means that there is no infection when any system
is compromised.
Furthermore, Neti et al. [44] focused on diversifying vulnerabilities. If different hosts con-
tain identical vulnerabilities, diversifying software cannot prevent an attack from exploiting
the same vulnerability. Each piece of software contains different numbers of vulnerabilities. By
computing the diversity entropy of software, Neti et al. calculate the diversity of the system,
and improve the resilience of the network as a whole. This MTD technique can also reduce
the numbers of systems that are compromised by worms or viruses, but it does not completely
defend them.
80 ◾ Securing Cyber-Physical Systems

Client A Client B Client C Client D

Software 1 Software 1 Software 1 Software 1

Server X Server Y
Software 1 Software 1
(a)

Client A Client B Client C Client D

Software 1 Software 1 Software 1 Software 1

Server X Server Y
Software 2 Software 2
(b)

Figure 3.8 Homogeneous network and diversified network. (From O’Donnell, A. J., and Sethu,
H. On achieving software diversity for improved network security using distributed coloring
algorithms. In Proceedings of the 11th ACM Conference on Computer and Communications
Security, ACM, New York. 2004. With permission.)

3.6.3 Buffer Overflow

Buffer overflow is an attack that manipulates the return address on a stack to execute a specific
code. Depending on the execution of the attack on the stack or heap, this attack is also termed
stack overflow and heap overflow. In controllers, the buffer overflow may reset passwords, mod-
ify content, and run malicious codes. To perform a buffer overflow attack, an attacker needs to
execute several steps. First of all, attackers need the position of the return address in a stack and
the position of the malicious function that it intends to execute. With the positions of the return
address and the function known, the attackers modify the data on the return address with the
function address. As a result, when the return address is called, the system will execute the func-
tion that the attackers intend to execute. The key components of this attack are the positions of the
return address and the functions. Since a buffer overflow attack is a common attack within cyber-
security, there are several MTD techniques based on address space randomization and instruction
set randomization.
Address space randomization has been around for roughly a decade. Its goal is to randomize
the position of the return address. Without knowing the return address, attackers can also attack
by guessing the address. Since there are numerous implementations with a similar concept, we
introduce one specific example: ASLP [10]. Rather than randomizing the return address, ASLP
modifies several structures. The changes can be classified into user level and kernel level. In user-
level randomization, ASLP can modify the execution file to randomly relocate the static code, data
segments, and other elements. Since the object file (e.g., helloworld.o) contains information, such as
relocation records, the type of object file, and debugging-related information, attackers may con-
struct attacks based on them. With a binary rewriting tool, ASLP transforms an executable and
 Moving Target Defense Mechanisms in Cyber-Physical Systems ◾ 81

linking format (ELF) file into another layout. Specifically, the user level makes a coarse-grained
permutation and a fine-grained permutation. By rewriting the ELF header, program header, and
sections, the coarse-grained permutation shifts the code and segments according to a user-defined
offset value, and the fine-grained permutation randomly reorders functions and variables within
the code and data segment. With the permutations in the user level, ASLP impedes attackers from
utilizing the compiled files.
On the other hand, the kernel level modifies the structure of data in runtime. There are three
regions for permutations: the user-mode stack, the brk()-managed heap, and mmap allocations.
In the early stage of process creation, ASLP randomizes the stack pointer of the user stack from
0 to 4 KB. In the later stage, the permutation randomly selects a start location of stacks between
128 MB and 3 GB. For the heap randomization, ASLP also performs in process creation. A page-
aligned virtual address between 0 and 3 GB is generated and a subpage random value between 0
and 4 KB is determined. Lastly, mmap() is used to map objects into the memory. The mmap allo-
cation also provides random, page-aligned addresses between 0 and 3 GB. With the permutations
of stacks and heaps, ASLP prevents a buffer overflow attack.
Moreover, instruction set randomization can also protect the system from a buffer overflow
attack. Rather than changing the stack and heap structure, this defense randomizes the location
of functions. G-Free is an instruction set randomizer that protects from an ROP attack [23]. As
introduced in Section 3.3.1, ROP is an improvement on utilizing function calls. Rather than
transferring the program execution to the beginning of a library function, ROP chains specific
functions, called gadgets, and executes them directly. Kornau discovered that each gadget has to
end with a “free-branch” instruction, which changes the program to the attacker-defined destina-
tion. G-Free randomizes “free-branch” instructions causing false connections between gadgets.
This prevents attackers from completing buffer overflow attacks.

3.7 MTD Techniques for Physical System Security

In this section, we discuss the security of physical systems in a CPS. Physical systems contain two
subcomponents: sensors and actuators. Sensors collect information from the physical world and
transmit it to controllers, while actuators receive commands from controllers and perform actions
interacting with the physical world. Although there are differences in their design details, such
as their sensing range and action target, physical systems generally communicate with controllers
and interact with the physical world. There are two major challenges in physical systems: resource
constraints and physical interaction.
Contrary to controllers, physical systems face tremendous limitations from computation,
energy consumption, and budgets. Computational power is based on the quality and quantity
of hardware; however, both of these are constrained for physical systems. For example, pace-
makers and implantable cardiac defibrillators (ICD) are devices that maintain a normal heart
rhythm [28]. Since these devices are implanted into the human body, their size, weight, and mate-
rials are restricted and their computation capability is low.
Moreover, the energy consumption of physical systems restricts their ability. Taking the same pace-
makers and ICDs as examples, once the device is implanted in the body, the battery should support the
device for the rest of its life. The more computation a physical system has to do, the more energy it will
consume. In order to maintain the battery life, the computational capacity is restricted.
Last but not least, the cost of hardware is also a resource constraint on the physical system. For
instance, smart meters are placed in buildings, such as homes, companies, and factories. Because
82 ◾ Securing Cyber-Physical Systems

of the huge demand of smart meters, a dollar increment causes an additional million dollars of
budget. The hardware should be used completely and efficiently; however, smart meters should
also remain functional for a long period of time. The huge number of devices not only causes an
increment in the budget, but it is also difficult to replace and update them.
Furthermore, interaction with the physical world contains unexpected actions and physical
security issues. Changes in the physical world can be unexpected, which means that the system
cannot take all possible information into account. For example, noisy messages are common for
sensors in the physical world. Physical security is one of the major attacks in a physical system. Due
to the lack of resources and interaction with the physical world, the security of a physical system is
a challenge for researchers. The MTD solutions for physical systems are shown in Table 3.3.

3.7.1 Deception Attacks

In Section 3.6, we introduced MTD techniques to address deception attacks. Since those MTDs are
sufficient to address attacks in physical systems, we will not repeat them in this section. In contrast
with the controller domain, physical systems face resource constraints and battery issues. Therefore,
the design of controllers for physical systems should be more lightweight while providing a reason-
able level of security. For example, Halperin [28] proposed a deception attack for pacemakers and
ICDs. The adversary can obtain the personal information or modify the data on the device by eaves-
dropping on the connection with administrators and replaying the transmission. Since resources are
limited, the defense should be designed with lightweight computation and low energy consumption.

3.7.2 Buffer Overflow

Although we also introduced the buffer overflow attack in Section 3.6, different MTD techniques
exist for physical systems. Due to the lack of computational power, physical systems may not
be able to implement address space randomization and instruction set randomization; however,
physical systems also face buffer overflow attacks. To overcome these attacks, researchers proposed
a different type of MTD technique for physical systems.
McLaughlin and Podkuiko [45] proposed an MTD technique for smart meters. This static
MTD technique encrypts the data with several keys before saving, and checks the decryptions

Table 3.3 MTD Techniques to Address Physical System Security Attacks on CPS
Tag Attacks MTD Category Example CPS Extension Exists?

A8 Deception Dynamic network DynaBone No

MT6D Yes

Dynamic data N-variant with data No

diversity

N-variant No

A12 Buffer overflow Dynamic data Data randomization Yes

A12 Physical Dynamic platform Data migration Yes

Dynamic data REA No

 Moving Target Defense Mechanisms in Cyber-Physical Systems ◾ 83

before using them. The following codes illustrate the differences between original and instru-
mented executions:
Original function call:

push A ; Save address

jmp B ; Perform branch

Instrumented function call:

mov D [key1_addr] ; D = K_1

mov C A ; C = A
xor C D ; C = C XOR D
push C ; Save encrypted address
mov D [key2_addr] ; D = K_2
mov C A ;
xor C D ; Second redundant encryption
push C ;
mov D [key3_addr] ; D = K_3
mov C A ;
xor C D ; Third redundant encryption
push C ;
jmp B ; Perform branch

Original return call:

pop A ; Load return address

jmp A ; Perform branch

Instrumented return call:

mov D [key3_addr] ; D = K_3

pop A ; Load third encrypted address
xor A D ; A = A XOR D
mov D [key2_addr] ; D = K_2
pop B ; Load second encrypted address
xor B D ; B = B XOR D
mov D [key1_addr] ; D = K_1
pop C ; Load first encrypted address
xor C D ; C = C XOR D
cmp A B ; Check A – B
jnz fail_stop ; Fail if A – B!= 0
cmp B C ; Check B – C
jnz fail_stop ; Fail if B – C!= 0
jmp A ; Return to calling function

For function calls, the original code has only two operations: save address and jump to another
branch. On the other hand, the instrumented function call encrypts (XOR) the address with
three different keys and saves the three encrypted data. The encryption of a function call per-
forms 11 more lines than the original and utilizes two more data spaces. On the other hand, the
original return code also contains two operations: load address and jump to the address; however,
the instrumented return code executes 14 operations. In the first nine lines, the system decrypts
(XOR) the three pieces of data with corresponding keys, and on lines 10–13, it compares the three
84 ◾ Securing Cyber-Physical Systems

pieces of decrypted data with each other. If the data is different, the system will stop the execution.
Although wasting two more data spaces and several lines of operations, this MTD is sufficient for
smart meters. Since the computations of smart meters are small and lightweight, the performance
that is lost is acceptable. This MTD provides a 1/248 probability of guessing the data.
Rather than encrypting the return address, Cadar et al. [20] described an MTD for several sit-
uations: general case, function calls, instrumentation with fixed-size masks, load-time instrumen-
tation, and more. Although this MTD provides only one encryption per data, its implementation
secures more operations. For example, when performing a function call, such as o1 = CALL
& _ function, o2, o3, it transforms into

t2 = BITXOR o2, m2
t3 = BITXOR o3, m3
t1 = CALL &_function t2, t3
o1 = BITXOR t1, m1

Where o1, o2, and o3 are unsafe operands; t1, t2, and t3 are new temporaries; and m1, m2,
and m3 are constants with the mask values for the operands. In the first two lines, the system
decrypts the two operands. Line 3 performs a normal function call. Then Line 4 encrypts the
result before writing it into the memory. By encrypting the data, this defense prevents attacks from
utilizing memory errors. This MTD is also suitable for physical systems since the performance
overhead is low, with an 11% runtime overhead and a 1% space overhead on average.

3.7.3 Physical Attack

A physical attack is an attack that physically compromises or destroys the device. This attack can
be achieved in multiple ways, such as smashing the device, reverse engineering the system, and dis-
connecting the transmission feature. For a CPS, controllers are safe from physical attacks because
they are settled in an access-controlled area; however, physical systems are located in exposed loca-
tions. Each system may face different physical attacks.
Szefer et al. [46] presented an MTD against physical intrusions for data centers. The goal of
the adversary is to obtain the data in the data center. To prevent physical intrusions, numerous
mechanisms are implemented. These include security locks, crash barriers, two-factor authentica-
tion, surveillance cameras, security guards, and so on. Based on these sensors, MTD analyzes the
statuses and moves, encrypts, or deletes the data in the data center. In order to implement MTD,
they introduce three components to the data center: a physical security monitor, an application
programming interface (API), and decision logic.
As Figure 3.9 shows, the physical security monitor collects information from sensors and
transfers it to an API. For sensors that are not connected to the management system, the physical
security monitor provides a conversion to use the API. The API is used as the standard since nor-
mal environmental controls should be able to communicate with it. The management infrastruc-
ture gathers all sensor information from the physical security monitor and environmental controls
and analyzes it with decision logic. Although the architecture seems complicated, the concept
is simple: collecting sensor information, analyzing the information, and then reconfiguring it if
necessary. For this MTD, Szefer et al. provide three different MTD techniques: move, encrypt,
and delete.
The move action refers to transmitting the sensitive data to another data center; the encrypt
action refers to encrypting the data to prevent the attacker from knowing the data; and the delete
action refers to deleting the data. These three different actions are decided by the remaining time
 Moving Target Defense Mechanisms in Cyber-Physical Systems ◾ 85

Sensors Sensors Sensors

0 1 … i

Physical
Environmental
security
controllers
monitor

API

Management
Decision logic infrastructure

Status Virtual machine

API management
feedback
instructions
Compute
infrastructure

Figure 3.9 The components of the system by Szefer et al. (From Szefer, J., et al. Physical
attack protection with human-secure virtualization in data centers. In IEEE/IFIP International
Conference Dependable Systems Networks Work. [DSN’2012], 2012. With permission.)

of the attack. On detecting an intrusion, the system computes the remaining time before the
attacker obtains the data, based on the status of the sensors. If there is enough time to transmit
data to another data center, it chooses move; if the time is only enough to encrypt data, it chooses
encrypt; and if the time is only enough to delete data, it chooses delete. Since the loss from each
movement is different, the order of choice is move, encrypt, and then delete.
To adopt this MTD to a CPS domain, we discuss the data center in two perspectives. The
management system can be considered as a controller, which collects information from sensors
and commands the movement of data when detecting attacks. That is, this MTD approach can
be viewed as a CPS. Rather than protecting physical systems, this MTD protects data (assets in
controller) from intrusions. When physical devices are attacked, they transmit signals to the con-
troller to prevent further attacks. With this perspective, the controller receives information and
performs a dynamic-reactive MTD.
On the other hand, a data center can be considered a physical system. The physical system
moves its sensitive data to another physical system or controller to escape physical attacks. This is
similar to MTD used during the Russo-Georgian war. With a bird’s-eye view, the data is hidden
in multiple data centers. When a physical intrusion occurs, the controller moves or destroys the
data. In this perspective, physical systems protect themselves if there is a physical attack. To sum
up, although we consider this defense as an MTD with multiple perspectives, its goal is to escape
damage, not to protect physical systems from physical attacks. In order to prevent physical attacks,
we introduce another MTD.
Husain et al. [47] proposed lightweight reconfigurable symmetric encryption architecture
(REA) to maintain data confidentiality on devices in a resource-constrained scenario. This MTD
prevents cryptanalysis, which is based on knowledge of encryption architecture. REA supports
the implementation of any symmetric encryption algorithm (substitution-permutation network).
A substitution-permutation network is a substitution from a block of bits to another block of bits,
and permutes to represent the input of the next round. Operations such as lookup table (LUT),
XOR, and bitwise rotation can be efficiently performed with hardware. With multiple rounds, the
86 ◾ Securing Cyber-Physical Systems

Reconfiguration key

M
P Data M

Round
key
S S S

M
Ciphertext

Figure 3.10 REA encryption and decryption flow. (From Husain, M. I., et al. Lightweight recon-
figurable encryption architecture for moving target defense. MILCOM 2013–2013 IEEE Military
Communications Conference, 2013. With permission.)

encryption provides a randomization, which is impossible to break with cryptanalysis. Figure 3.10
presents the architecture of REA.
The idea of the architecture is to load the S-boxes and permutations based on the key for each
round. The S-box is a substitution box that substitutes bits for other bits. To begin the encryption,
the key and plaintext are passed through the S-boxes and permutations to become the input of the
next round. The symbol M indicates the choice of options. Repeating the encryption for a user-
defined round, the architecture will produce an encrypted text in the final round. The decryption
is executed using the same scenario since REA is a symmetric encryption architecture. Using
REA, this MTD prevents the compromise of the data that is stored on physical systems.

3.8 Conclusion
In this chapter, we discussed MTD techniques for a CPS. MTD is the concept of moving attack
surfaces in a system to obscure them from an attacker. As the technology has matured, various
MTD techniques have been realized, such as address space randomization, instruction set ran-
domization, software diversity, data randomization, and more. We described the taxonomy of
MTD and showed how it is suitable for CPS security in different parts of a CPS: network, control-
ler, and physical system.
In addressing network security, we introduced DoS, packet-scheduling attacks, and eavesdrop-
ping attacks. To address these attacks, a CPS may hide connections and diversify data from attack-
ers. The implementations include transmission diversity, transmission partitioning, IP hopping,
and data diversity. Secondly, controllers are vulnerable from deception attacks, false informa-
tion from compromised sensors, replay attacks, buffer overflow attacks, worms, and viruses. The
defenses in network security can also partially secure attacks through the network. The concepts
used in controller security are implementation diversity, software diversity, address space random-
ization, and instruction set randomization. Each MTD impedes attackers at a unique layer.
The last component is the physical system. Due to the lack of resources, although facing the
same attacks as controllers, MTD should be implemented with less computation and complexity.
Moreover, physical attacks only exist in the physical system, such as smashing the device, reverse
engineering the system, and disconnecting the transmission feature. Data randomization, data
 Moving Target Defense Mechanisms in Cyber-Physical Systems ◾ 87

migration, and data encryption are techniques that ensure the integrity of the data on physical sys-
tems. Although some MTD concepts have no implementation in CPS as of yet, we have discussed
how those can be used in the CPS domain.

3.9 Future Research Direction

In this chapter, we introduced different MTD concepts that can be applied to secure a CPS;
however, some concepts have still not been implemented in the CPS domain. For example, REA
can be applied for specific physical systems, data diversity can be implemented for controllers, and
transmission diversity can be realized for networks. These implementations are possible research
directions for the future. Also, since most of the MTD techniques we discussed here are for the
ICS or the smart grid, we need to look at other types of CPSs, such as water distribution systems,
gas distribution systems, or unmanned aerial vehicle (UAV) command systems, to see how the
MTD techniques could be applied to those types of CPSs.
Furthermore, innovative MTD concepts can be developed. For instance, Zhu et al. [48]
introduced an MTD for information technology (IT) systems. The reinforcement learning algo-
rithm analyzes the current attack status and computes the best response. This MTD dynamically
changes the policies of the intrusion detection system. Finally, the combination and modifica-
tion of existing MTDs are also a possible research direction. For example, DynaBone [43] and
ChameleonSoft [3] both contain multiple MTD strategies in single systems. More such composite
MTD techniques can be developed.

Author Biographies
Shih-Wei Fang is currently a third-year graduate student in computer science at California State
Polytechnic University, Pomona. He obtained his undergraduate degree in mathematical science
from the National ChengChi University in Taiwan. His research interests include moving target
defense, the cyber-physical system, and game theory. His thesis focuses on the interaction between
moving target defense and game theory. He plans to continue his education and obtain a PhD.

Anthony Portante is a senior undergraduate student at California State Polytechnic University,

Pomona. He is an Air Force Reserve Officers’ Training Corps (ROTC) cadet and is scheduled to
commission in June 2015 and join the air force as a cyberoperations officer. He has been conducting
research in the area of moving target defense (MTD) since the fall of 2013, focusing on the applica-
tion of MTD techniques within virtualized environments. Some other areas that he finds interest-
ing are operating systems, human–agent teamwork systems, and cyber-physical systems. Anthony
plans to continue his education within the Air Force and obtain his master’s and PhD degrees.

Mohammad Iftekhar Husain has been a tenure-track assistant professor of computer science
at California State Polytechnic University, Pomona, since 2012. His broad research interest is in
the domain of security and forensics, specifically in the areas of cloud computing, cyber-physical
systems, and unmanned aerial vehicles (UAV). Dr. Husain’s academic activities are supported
by the National Science Foundation (NSF), Northrop Grumman Corporation, and Microsoft
Corporation. He graduated with a PhD in computer science and engineering from the University
at Buffalo, The State University of New York, in 2012.
88 ◾ Securing Cyber-Physical Systems

References
1. S. Forrest, A. Somayaji, and D. Ackley. 1997. Building diverse computer systems. In Proceedings of the
6th Workshop on Hot Topics in Operating Systems (HotOS-VI) (HOTOS’97), IEEE Computer Society,
Washington, DC, pp. 67–72.
2. D. Kewley, R. Fink, J. Lowry, and M. Dean. Dynamic approaches to thwart adversary intelligence
gathering. In Proceedings DARPA Information Survivability Conference & Exposition II. DISCEX’01,
Anaheim, CA, vol. 1, pp. 176–185.
3. M. Azab, and M. Eltoweissy. 2012. ChameleonSoft: Software behavior encryption for moving target
defense. Mobile Networks Applications, 18(2), pp. 271–292.
4. S. Groat, and M. Dunlop. 2012. Using an IPv6 moving target defense to protect the smart grid.
Innovative Smart Grid Technologies (ISGT), 2012 IEEE PES, pp. 1–7.
5. P. McDaniel, and S. McLaughlin. 2009. Security and privacy challenges in the smart grid. IEEE
Security & Privacy, 7(3), pp. 75–77.
6. S. W. Korns. 2009. Botnets outmaneuvered. Armed Forces Journal [Online]. January 1. Available:
[Link] Accessed August 8, 2014.
7. A. K. Ghosh, D. Pendarakis, and W. H. Sanders. 2009. National Cyber Leap Year Summit 2009
co-chairs’ report. The Networking and Information Technology Research and Development (NITRD)
Program.
8. H. Okhravi, M. Rabe, T. Mayberry, W. Leonard, T. Hobson, D. Bigelow, and W. Streilein. 2013.
Survey of cyber moving targets. Technical report 1166, MIT Lincoln Laboratory.
9. H. Shacham, M. Page, B. Pfaff, E.-J. Goh, N. Modadugu, and D. Boneh. 2004. On the effective-
ness of address-space randomization. In Proceedings of the 11th ACM Conference on Computer and
Communications Security (CCS ‘04), ACM, New York, pp. 298–307.
10. C. Kil, J. Jim, and C. Bookholt. 2006. Address space layout permutation (ASLP): Towards fine-
grained randomization of commodity software. Computer Security Applications Conference 2006.
ACSAC’06. 22nd Annual IEEE, 2006, pp. 339–348.
11. G. S. Kc, A. D. Keromytis, and V. Prevelakis. 2003. Countering code-injection attacks with instruc-
tion-set randomization. In Proceedings of the 10th ACM conference on Computer and Communications
Security (CCS ‘03), ACM, New York, pp. 272–280.
12. W. Hu, J. Hiser, D. Williams, A. Filipi, J. W. Davidson, D. Evans, J. C. Knight, A. Nguyen-Tuong,
and J. Rowanhill. 2006. Secure and practical defense against code-injection attacks using soft-
ware dynamic translation. In Proceedings of the 2nd International Conference on Virtual Execution
Environments – VEE’06, Ottawa, Canada, p. 2.
13. A. J. O’Donnell and H. Sethu. 2004. On achieving software diversity for improved network security
using distributed coloring algorithms. In Proceedings of the 11th ACM Conference on Computer and
Communications Security, ACM, New York, pp. 121–131.
14. M. Petkac, L. Badger, and W. Morrison. 2000. Security agility for dynamic execution environments.
In DARPA Information Survivability Conference and Exposition, 2000. DISCEX ’00 Proceedings, vol. 1,
pp. 377–390.
15. T. Roeder, and F. B. Schneider. 2010. Proactive obfuscation. ACM Transactions on Computer Systems,
28(2), Article 4.
16. J. Li, P. L. Reiher, and G. J. Popek. 2004. Resilient self-organizing overlay networks for security
update delivery. IEEE Journal on Selected Areas Communications, 22(1), pp. 189–202.
17. D. A. Holland, A. T. Lim, and M. I. Seltzer. 2005. An architecture a day keeps the hacker away. ACM
SIGARCH Computer Architecture News, 33(1), 34.
18. H. Okhravi, A. Comella, E. Robinson, and J. Haines. 2012. Creating a cyber moving target for criti-
cal infrastructure applications using platform diversity. International Journal of Critical Infrastructure
Protection, 5(1), pp. 30–39.
19. P. E. Ammann, and J. C. Knight. 1988. Data diversity: An approach to software fault tolerance. IEEE
Transactions Computers, 37(4), pp. 418–425.
20. C. Cadar, P. Akritidis, M. Costa, J.-P. Martin, and M. Castro. 2008. Data randomization. Technical
report, Microsoft Research. MSR-TR-2008-120.
 Moving Target Defense Mechanisms in Cyber-Physical Systems ◾ 89

21. H. Shacham, M. Page, B. Pfaff, E.-J. Goh, N. Modadugu, and D. Boneh. 2004. On the effective-
ness of address-space randomization. Proceedings of the 11th ACM Conference on Computer and
Communications Security – CCS’04, New York, pp. 298–307.
22. H. Shacham. 2007. The geometry of innocent flesh on the bone: Return-into-LIBC without func-
tion calls (on the x86). In Proceedings of the 14th ACM Conference on Computer and Communications
Security (CCS ’07), ACM, New York, pp. 552–561.
23. K. Onarlioglu, L. Bilge, A. Lanzi, D. Balzarotti, and E. Kirda. 2010. G-Free: Defeating return-oriented
programming through gadget-less binaries. In Proceedings of the 26th Annual Computer Security Applications
Conference (ACSAC ‘10), ACM, New York, pp. 49–58.
24. A. Cardenas, S. Amin, and B. Sinopoli. 2009. Challenges for securing cyber physical systems. In
Workshop on Future Directions in Cyber-Physical Systems Security, DHS, July 23, 2009.
25. Q. Shafi. 2012. Cyber physical systems security: A brief survey. 2012 12th International Conference
Computational Science and Its Application, pp. 146–150.
26. D. M. Nicol, C. M. Davis, and T. Overbye. 2009. A testbed for power system security evaluation.
International Journal of Information and Computer Security, 3(2), pp. 1–18.
27. A. A. Cárdenas, S. Amin, and S. Sastry. 2008. Research challenges for the security of control systems.
In Proceedings of the 3rd Conference on Hot Topics in Security HotSec, Berkeley, CA.
28. D. Halperin. 2008. Pacemakers and implantable cardiac defibrillators: Software radio attacks and
zero-power defenses. Security and Privacy, 2008. IEEE Symposium on SP 2008.
29. Y. Mo, and B. Sinopoli. 2009. Secure control against replay attacks. In 47th Annual Allerton Conference
Communication Control and Computing, pp. 911–918.
30. Y. Shoukry, J. Araujo, and P. Tabuada. 2013. Minimax control for cyber-physical systems under
network packet scheduling attacks. In Proceedings of the 2nd ACM International Conference on High
Confidence Networked Systems, ACM, New York, pp. 93–100.
31. N. Falliere, L. Murchu, and E. Chien. 2011. W32. Stuxnet dossier. White paper, Symantec
Corporation, Security Response, 4, pp. 1–69.
32. L.-A. Tang, X. Yu, S. Kim, Q. Gu, J. Han, A. Leung, and T. La Porta. 2013. Trustworthiness analysis
of sensor data in cyber-physical systems. Journal of Computer and System Sciences, 79(3), pp. 383–401.
33. P. Koopman. 2004. Embedded system security. IEEE Computer, 37(7), pp. 95–97.
34. J. D. Touch, G. G. Finn, Y. Wang, and L. Eggert. 2003. DynaBone: Dynamic defense using multi-
layer Internet overlays. In Proceedings of the 3rd DARPA Information Survivability Conference and
Exposition (DISCEX-III), vol. 2, Washington, DC.
35. M. Weiss, F. Mattern, T. Graml, T. Staake, and E. Fleisch. 2009. Handy feedback: Connecting
smart meters with mobile phones. In Proceedings of the 8th International Conference on Mobile and
Ubiquitous Multimedia (MUM’09), ACM, New York.
36. G. Stephen, D. Matthew, M. Randy, and T. Joseph. 2011. Using dynamic addressing for a moving
target defense. In Proceedings of the 6th International Conference on Information Warfare and Security
(ICIW’11), Academic Conferences Limited.
37. A. Nguyen-Tuong, D. Evans, J. C. Knight, B. Cox, and J. W. Davidson. 2008. Security through
redundant data diversity. 2008 IEEE International Conference Dependable System Networks with FTCS
DCC, pp. 187–196.
38. H. Khurana, M. Hadley, N. Lu, and D. A. Frincke. 2010. Smart-grid security issues. IEEE Security &
Privacy, 8(1), pp. 81–85.
39. S. Amin, X. Litrico, S. S. Sastry, and A. M. Bayen. 2010. Stealthy deception attacks on water SCADA
systems. In Proceedings of the 13th ACM International Conference Hybrid Systems Computation and
Control (HSCC’10), p. 161.
40. T. T. Kim, H. V. Poor. 2011. Strategic protection against data injection attacks on power grids. IEEE
Transactions on Smart Grid, 2(2), pp. 326–333.
41. T.-T. Tran, O.-S. Shin, and J.-H. Lee. 2013. Detection of replay attacks in smart grid systems. 2013
International Conference Computing, Management and Telecommunications (ComManTel), pp. 298–302.
42. M. A. Rahman, E. Al-Shaer, and R. B. Bobba. 2014. Moving target defense for hardening the secu-
rity of the power system state estimation. In Proceedings of the First ACM Workshop on Moving Target
Defense, ACM, New York, pp. 59–68.
90 ◾ Securing Cyber-Physical Systems

43. R. M. Eltarras. 2011. Biosense: Biologically inspired secure elastic networked sensor environment.
PhD dissertation, The Faculty of the Virginia Polytechnic Institute and State University.
44. S. Neti, A. Somayaji, and M. Locasto. 2012. Software diversity: Security, entropy and game theory.
In Proceedings of the 7th USENIX HotSec, Bellevue, WA.
45. S. McLaughlin, and D. Podkuiko. 2010. Embedded firmware diversity for smart electric meters. In
HotSec Proceedings of the 5th USENIX Conference on Hot Topics in Security, Berkeley, CA.
46. J. Szefer, P. Jamkhedkar, and R. B. Lee. 2012. Physical attack protection with human-secure virtu-
alization in data centers. In IEEE/IFIP International Conference Dependable Systems Networks Work
(DSN’2012), pp. 1–6.
47. M. I. Husain, K. Courtright, and R. Sridhar. 2013. Lightweight reconfigurable encryption architec-
ture for moving target defense. MILCOM 2013–2013 IEEE Military Communications Conference,
pp. 214–219.
48. M. Zhu, Z. Hu, and P. Liu. 2014. Reinforcement learning algorithms for adaptive cyber defense
against heartbleed. Proceedings of the First ACM Workshop on Moving Target Defense, ACM, New York,
pp. 51–58.