Moving Target Defense (MTD) can enhance the resilience of cyber systems against attacks. Although there have been many MTD techniques, there is no systematic understanding and quantitative characterization of the power of MTD. In this paper, we propose to use a cyber epidemic dynamics approach to characterize the power of MTD. We define and investigate two complementary measures that are applicable when the defender aims to deploy MTD to achieve a certain security goal. One measure emphasizes the maximum portion of time during which the system can afford to stay in an undesired configuration (or posture), without considering the cost of deploying MTD. The other measure emphasizes the minimum cost of deploying MTD, while accommodating that the system has to stay in an undesired configuration (or posture) for a given portion of time. Our analytic studies lead to algorithms for optimally deploying MTD.
@cite_9: 
@cite_19: We study the spread of disease in an SIS model. The model considered is a time-varying, switched model, in which the parameters of the SIS model are subject to abrupt change. We show that the joint spectral radius can be used as a threshold parameter for this model in the spirit of the basic reproduction number for time-invariant models. We also present conditions for persistence and the existence of periodic orbits for the switched model and results for a stochastic switched model.
@cite_2: Theoretical modeling of computer virus worm epidemic dynamics is an important problem that has attracted many studies. However, most existing models are adapted from biological epidemic ones. Although biological epidemic models can certainly be adapted to capture some computer virus spreading scenarios (especially when the so-called homogeneity assumption holds), the problem of computer virus spreading is not well understood because it has many important perspectives that are not necessarily accommodated in the biological epidemic models. In this article, we initiate the study of such a perspective, namely that of adaptive defense against epidemic spreading in arbitrary networks. More specifically, we investigate a nonhomogeneous Susceptible-Infectious-Susceptible (SIS) model where the model parameters may vary with respect to time. In particular, we focus on two scenarios we call semi-adaptive defense and fully adaptive defense, which accommodate implicit and explicit dependency relationships between the model parameters, respectively. In the semi-adaptive defense scenario, the model’s input parameters are given; the defense is semi-adaptive because the adjustment is implicitly dependent upon the outcome of virus spreading. For this scenario, we present a set of sufficient conditions (some are more general or succinct than others) under which the virus spreading will die out; such sufficient conditions are also known as epidemic thresholds in the literature. In the fully adaptive defense scenario, some input parameters are not known (i.e., the aforementioned sufficient conditions are not applicable) but the defender can observe the outcome of virus spreading. For this scenario, we present adaptive control strategies under which the virus spreading will die out or will be contained to a desired level.
@cite_34: Given a contact network that changes over time (say, day vs night connectivity), and the SIS (susceptible infected susceptible, flu like) virus propagation model, what can we say about its epidemic threshold? That is, can we determine when a small infection will "take-off" and create an epidemic? Consequently then, which nodes should we immunize to prevent an epidemic? This is a very real problem, since, e.g. people have different connections during the day at work, and during the night at home. Static graphs have been studied for a long time, with numerous analytical results. Time-evolving networks are so hard to analyze, that most existing works are simulation studies [5]. Specifically, our contributions in this paper are: (a) we formulate the problem by approximating it by a Non-linear Dynamical system (NLDS), (b) we derive the first closed formula for the epidemic threshold of time-varying graphs under the SIS model, and finally (c) we show the usefulness of our threshold by presenting efficient heuristics and evaluate the effectiveness of our methods on synthetic and real data like the MIT reality mining graphs.
@cite_51: I. INTRODUCTION 1. Basic Concepts II . STABILITY OF SWITCHED SYSTEMS 2. Stability under Arbitrary Switching 3. Stability under Constrained Switching III. SWITCHING CONTROL 4. Systems not Stabilizable by Continuous Feedback 5. Systems with Sensor or Actuator Constraints 6. Systems with Large Modeling Uncertainty IV. SUPPLEMENTARY MATERIAL A. Stability B. Lie Algebras Notes and References Bibliography Index
We will use the cyber epidemic dynamics model in @cite_2 as the starting point of our study. This model @cite_2 describes reactive adaptive defense (i.e., the defender aims to adjust its defense to control contain the global security state). We extend this model to accommodate MTD, a kind of proactive defense , and the resulting model is analyzed using different skills @cite_51 @cite_9 . We mention that the effect of dynamic structures in cyber epidemic models is studied in @cite_34 , where the structure dynamics however follows a deterministic and periodic process, rather than adaptively scheduled by using (for example) MTD. We also mention that the effect of dynamic semi-heterogeneous structures (i.e., clustered networks), rather than arbitrary heterogeneous structures, is studied in @cite_19 . These studies @cite_34 @cite_19 consider static parameters only and do not have any of the measures we propose to use.