# Implementation of a Lossless Moving Target Defense Mechanism
## 2 State of the Art  
The evolution of networks and computer systems has also forced the evolution of cyberattacks. Cyberattacks that were used 10 or 20 years ago are now considered simple or even primitive. The attacks used currently can be classified as smart attacks. Modern attacks, which use innovative approaches, are difficult to detect and resistant to traditional methods of defense. The reputation that an attacker could achieve in their environment has ceased to be a sufficient form of gratification. Attacks have become a source of livelihood for whole groups of people. Often, their execution is supported by funds from various organizations or governments that are considered to support terrorism. Such attacks have become very complicated and are adapted to the changing conditions of the attacked area. Only intelligent defense mechanisms can counteract intelligent attacks. Among such mechanisms, we include the MTD technique.  
MTD can be applied at many levels: data, application, runtime environment, operating system, or hardware. Moving target techniques in the dynamic data domain change the format, syntax, representation, or encoding of application data to complicate attacks. An interesting use of dynamic data techniques is data space randomization (DSR), where either the data space or the program code is modified [13]. Another example of an MTD technique, which falls within the category of dynamic applications, involves an environment utilizing several web application servers that perform the same functions. The MTD mechanisms used in this solution dynamically redirect client requests to any chosen server [14]. This mitigates the effects of vulnerabilities in server software. A product by Morphisec Labs exemplifies a dynamic runtime environment, a technique where the execution environment, including RAM addresses and instruction sets, changes dynamically [15]. In computer systems, the operating system, memory, and processor, with its instruction set being closely related, are interconnected. Therefore, MTD techniques covering these three elements are treated as a whole and are collectively referred to as a dynamic platform. Examples of the solutions in this area can be found in [16; 17; 18].  
The most explored research area in the field of MTD is dynamic networks. The techniques proposed in this area suggest modifications to a wide range of parameters. The proposed solutions include dynamic modifications to network topology. The initiation can be triggered randomly [19; 20] or at predefined times [21]. Another way to hinder reconnaissance is by changing the paths along which data are exchanged between two hosts [22; 23; 24; 25; 26]. In addition to changing the routes between two hosts, modifications to computer networks can also dynamically alter routing protocol data [27; 28]. As a result, changes in the network structure are more extensive. Beyond affecting switches and routers, it is also possible to implement changes that exclusively involve hosts. For example, random or timer-triggered changes in port numbers in established connections are possible [29; 30; 31].The method most commonly representation in the literature is IP address mutations [12; 22; 26; 32; 33; 34; 35; 36; 37]. As with other methods, the change in IP addresses can be initiated at random moments, at times determined by an algorithm (e.g., from game theory [38]), or by detecting anomalies indicating third-party activity. To detect anomalies, specially prepared devices, so-called honeypots [9; 39], can be used.