An Input-Aware Mimic Defense Theory and its Practice

TL;DR

This paper introduces SIDMD, a new adaptive mimic defense framework that redefines vulnerabilities from input perspectives and employs dynamic strategies to enhance cybersecurity against complex, unknown threats.

Contribution

It proposes a novel theoretical model and a dynamic, input-aware mimic defense framework that improves security in complex cyberspace attack scenarios.

Findings

SIDMD significantly reduces attack success probability.

Theoretical analysis confirms SIDMD's superior security performance.

Experimental results validate SIDMD's effectiveness in complex scenarios.

Abstract

The current security problems in cyberspace are characterized by strong and complex threats. Defenders face numerous problems such as lack of prior knowledge, various threats, and unknown vulnerabilities, which urgently need new fundamental theories to support. To address these issues, this article proposes a generic theoretical model for cyberspace defense and a new mimic defense framework, that is, Spatiotemporally heterogeneous, Input aware, and Dynamically updated Mimic Defense (SIDMD). We make the following contributions: (1) We first redefine vulnerabilities from the input space perspective to normalize the diverse cyberspace security problem. (2) We propose a novel unknown vulnerability discovery method and a dynamic scheduling strategy considering temporal and spatial dimensions without prior knowledge. Theoretical analysis and experimental results show that SIDMD has the best security performance in complex attack scenarios, and the probability of successful attacks is greatly reduced compared to the state-of-the-art.