# Implementation of a Lossless Moving Target Defense Mechanism
## 1 Introduction
A person conducting reconnaissance can utilize Open Source Intelligence (OSINT) to obtain valuable information about a system. Just as there is no human activity or action that is not in some way fraught with some risk that may affect health or life, no network exists that has not been or will not be the target of an attack. The attacker has many ways to \"lurk\" within the system, including using social engineering, exploiting breaks in the supply chain, or deploying zero-day attacks. Therefore, it is necessary to take actions aimed at making reconnaissance difficult. One possible method involves disorienting the attacker by indicating that the collected data are worthless, which means the process of collection and analysis must start from scratch. This could result in an increased cost of the attack, potentially rendering it unprofitable. This also increases the chances of detecting the attacker. One such method is Moving Target Defense (MTD), in which dynamic changes are made to the parameters of the protected system that enable its identification or determine its structure [6]. A significant drawback of the method is that involves changes made to an operating system, which can affect the continuity of provided services. This paper proposes a method for the dynamic mutation of IP addresses of hosts operating in a protected network. IP address mutation is not a new technique for hindering reconnaissance. A drawback of the published solutions is that they do not account for the transitional state in which network IP addressing is inconsistent. This oversight can cause disruptions in the service at the transport layer level, interrupting established TCP connections. This can lead to data loss, thereby degrading the level of Quality of Service (QoS) [7; 8; 9]. The presented IP mutation mechanisms in many implementations utilize the Dynamic Host Configuration Protocol (DHCP) to change IP addresses. In such a scenario, simultaneous IP address changes by all devices operating in the network are not possible. Moreover, this may require introducing changes at the operating system level to adjust the operation of network applications to the IP address changes. The aim of this study was to develop a solution utilizing IP address mutation that does not affect the functioning of transport-layer protocols. Since IP address mutation is completely transparent to protocols using IP protocol services, it avoids connection interruption or data loss. In the proposed solution, Software-Defined Network (SDN) is utilized [10; 11; 12]. However, the characteristics of SDN networks alone do not address the issue of of maintaining TCP connections. In the proposed solution, the Protocol-Independent Packet Processor Programming (P4) language and the Portable Switch Architecture (PSA) are employed, which offer another level of freedom in preparing network applications. The ability to implement packet processing algorithms directly in the data path helps to resolve the issue of temporary inconsistency in IP addressing. This article is organized as follows: The next section contains a literature review on MTD techniques. Section 3 introduces the concept of SDNs. Since every network equipment provider currently introduces their own solutions that fall within the SDN domain, the we describe the most crucial elements of SDNs used in implementation. The next section provides a description of the individual stages of the cyberattack process and how to defend against it, introducing the ideas behind the MTD technique. Section 5 contains a description of the P4 language, focusing on presenting the most important elements of the language essential for understanding the operation of the algorithm. In the following section, an evaluation of the performance of the MTD mechanism using IP address mutation is performed. The network convergence time was determined, i.e., the time after which all switches use only mutated IP addresses belonging to the same group, referred to as a generation. We also present formulas specifying how often addresses can be mutated.