# CHAOS: an SDN-based Moving Target Defense System

## TL;DR

CHAOS is an SDN-based Moving Target Defense system that selectively obfuscates network hosts using a hierarchical Chaos Tower structure, reducing attack surface and information disclosure while maintaining network performance.

## Contribution

The paper introduces CHAOS, a novel SDN-based MTD system with a Chaos Tower Obfuscation method for hierarchical, flexible, and unpredictable network obfuscation.

## Key findings

- Reduces information disclosure effectively.
- Maintains normal network traffic flow.
- Provides flexible obfuscation levels for different hosts.

## Abstract

The static nature of current cyber systems has made them easy to be attacked and compromised. By constantly changing a system, Moving Target Defense (MTD) has provided a promising way to reduce or move the attack surface that is available for exploitation by an adversary. However, the current network- based MTD obfuscates networks indiscriminately that makes some networks key services, such as web and DNS services, unavailable, because many information of these services has to be opened to the outside and remain real without compromising their usability. Moreover, the indiscriminate obfuscation also severely reduces the performance of networks. In this paper, we propose CHAOS, an SDN (Software-defined networking)-based MTD system, which discriminately obfuscates hosts with different security levels in a network. In CHAOS, we introduce a Chaos Tower Obfuscation (CTO) method, which uses a Chaos Tower Structure (CTS) to depict the hierarchy of all the hosts in an intranet and provides a more unpredictable and flexible obfuscation method. We also present the design of CHAOS, which leverages SDN features to obfuscate the attack surface including IP obfuscation, ports obfuscation, and fingerprint obfuscation thereby enhancing the unpredictability of the networking environment. We develop fast CTO algorithms to achieve a different degree of obfuscation for the hosts in each layer. Our experimental results show that a network protected by CHAOS is capable of decreasing the percentage of information disclosure effectively to guarantee the normal flow of traffic.