Network reconfiguration via diversity: theoretical foundation and algorithm design

Moving Target Defense (MTD) is a powerful weapon to mitigate cyber attacks by increasing the attacker's efforts and complexity in fulfilling its goal. One effective technique of MTD is to deploy diverse implementations and configurations to provide equivalent functionality so as to increase the network resilience. In this paper, we investigate the algorithmic aspect of employing diversity to cause the network to be the most resilient possible. Specifically, we study two algorithmic optimization problems of both theoretical and practical importance: (1) given the network topology, how to assign different variants to different network nodes so as to maximize the network resilience; (2) when the variant assignment is fixed, but the network topology is configurable, what is the optimal topology maximizing the network resilience. We mathematically formulate the problems of variant assignment and network topology configuration and develop efficient algorithms, which can serve as design guidelines in the deployment of diversity-based MTD techniques to enhance the security of the network.