# Implementation of a Lossless Moving Target Defense Mechanism
## 1 Introduction  
A criminal planning to intentionally break the law does not manifest their intentions. The aim is to remain unnoticed by those in their surroundings for as long as possible, especially by security institutions such as the police, intelligence, and counterintelligence services. The main operational and reconnaissance method of state services is the observation of people, places, and things; therefore, from the perspective of a criminal, and often a criminal group, it is completely justified to carry out counter-intelligence activities [1]. Criminals carefully plan their next moves. They do everything possible to ensure that the process of gathering information, which could aid in committing a prohibited act, is unnoticed. They meticulously cover up traces that could indicate who committed the crime. If the crime is ongoing or meant to last for a longer period, the criminal disguises their presence and the manner in which the crime was committed. Describing the criminal mechanism is not a praise for the level of intelligence and cunning of criminals; it only indicates the costs incurred during the commission of crimes. For the commission of acrime to be profitable for the criminal (taking into account the costs of preparation and the probability of punishment), the value of the object of the crime must be significantly higher than the costs. Cybercriminals may also follow a pattern. The process of gathering information about a system is called reconnaissance [2; 3]. Paradoxically, reconnaissance was originally used to gather information about systems in order to identify security vulnerabilities. Originally, it was an ethical hacking technique that allowed network owners to better secure their systems after identifying security gaps. It should be noted that not all hackers are criminals. The term \"hacker\" is frequently misapplied to individuals engaging in malicious security breaches for personal gain, often with criminal intentions. In hacker communities, such people are called crackers. Over the years, reconnaissance has evolved from an ethical hacking procedure to a mechanism of cyber attack. A reconnaissance attack is a process in which the hacker takes on the role of a secret detective to obtain information about target systems. This information is then used to identify security vulnerabilities before launching an attack or to pinpoint resources that may be targeted. Reconnaissance attacks are most often carried out from within the targeted system. We distinguish between active and passive reconnaissance [4]. In active reconnaissance, the attacker interacts directly with the target. This can take place on multiple levels. To obtain confidential information, the attacker may use social engineering, such as sending emails, using chatbots, or other interactive communication means, to establish a connection. Another method is port scanning, which entails checking open (active) Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) protocol ports by sending data transfer requests to the tested ports. Active footprinting is also a technique used, involving actions aimed at checking active Internet Protocol (IP) addresses or email addresses, by interacting with the relevant services. Active reconnaissance is extremely efficient, as it is targeted at obtaining data essential for conducting an attack and is relatively quick. A notable defense feature against such attacks is the possibility of detection, since the attacker's interactions with the system can be identified as deviations from normal activity. The second type of reconnaissance is passive reconnaissance. In this approach, the attacker does not directly interact with the user or their system. They conduct their investigation remotely, monitoring traffic and interactions on the network. The attacker can collect and analyze data from public resources, in a process known as open source intelligence (OSINT) [5]. Both individuals and networks disseminate their information on the network, whether intentionally or unintentionally.