# Implementation of a Lossless Moving Target Defense Mechanism
## 4 Moving Target Defense  
To protect networks from cyberattacks, administrators utilize well-prepared security policies and implement best practices for network maintenance and configuration. They have access to a wide range of advanced tools and procedures, such as software updates to patch vulnerabilities and event log analysis to detect attack-related events or network anomalies. Unfortunately, these techniques are also well known to network attackers. Between the discovery of a software vulnerability and the release of an update, several days typically pass, and updates are typically performed when the system requiring the update is not in use. This delay provides a significant window of opportunity for carrying out zero-day attacks. Event log analysis may become ineffective when an attack is executed using custom malicious software, which can be challenging to detect or prevent with intrusion detection systems and antivirus tools. To prepare an effective defense against cyberattacks, the attack process used by adversaries must be understood, and the attack process from the attacker's perspective must be analyzed. Executing a sophisticated and impactful attack on a major network operator, financial organization, government institution, etc., requires substantial financial investments. Attacks on such entities are carried out by Advanced Persistent Threat (APT) groups, sponsored by wealthy organizations or states, driven by economic or political motives. An APT gains access to a computer network and remains undetected for an extended period. Figure 3: Operation of OpenFlow protocol. To counteract such activities, understanding what data can be collected by the APT with access to the network is crucial. Identifying the categories of data accessible to the attacking entity enables the pinpointing of potential attack types. To better understand the entire attack process, the Cyber Kill Chain (CKC) defined in [42] can be used. It consists of the following stages:  
1. Reconnaissance--This phase involves gathering data about the environment where the attack will take place. The monitoring area can be extensive, including network parameters such as used protocols and their versions, IP addresses, port numbers, load information, types and versions of applications and operating systems, and the types of services being used or provided. 2. Weaponization--Based on the data obtained in the first stage, the attacker employs various tools and techniques to prepare a payload for a targeted attack. This takes the form of a phishing email, an infected document, or even a modification of a delivered update (by tampering with the supply chain). 3. Delivery--The payload prepared in the previous step must be delivered to the targeted system to initiate infection. The attacker often leverages human factors, typically involving employees of the company or institution, to bypass authentication procedures. Another method of payload delivery may involve exploiting system vulnerabilities or compromising the supply chain. 4. Exploitation--This stage involves executing malicious code, rendering the infected system accessible to the attacker. The attacker gains increased privileges, typically through exploiting a known vulnerability or a zero-day exploit
5. Installation--With increased privileges, the attacker can install malicious software on the victim's computer or begin gathering information from the victim's databases for further actions. 6. Command and Control--This stage includes actions aimed at maintaining remote control over the victim's machine. 7. Actions on Objectives--This is the final stage of the attack, involving actions related to achieving the attacker's objectives. These actions may include downloading critical data, disrupting services, or using the victim's system to conduct further attacks, this time from a trusted system.