# A Survey on Moving Target Defense: Intelligently Affordable, Optimized and Self-Adaptive
## 3 Intelligent MTD Techniques
### Intelligent MTD Techniques
#### 3.2.3 Towards Self-Adaptive  
Next, we present intelligent MTD techniques _towards self-adaptive_ in two ways. Summary has been shown in Table 8.  
The first is when it is appropriate to trigger MTD. If the triggering time interval is fixed, we need to consider: if the triggering time interval is too long if the attacker has enough time to penetrate the system and launch an attack; if the interval is too short, if the MTD mechanism will be triggered frequently, which wastes resources and reduce performance, and significantly reduces QoS. Therefore, ad hoc event triggering is preferred. Secondly, in the face of various attacks, how can we use relatively fixed defense strategies to counteract them? How can we determine which defense strategy is most effective in defending against these attacks? Relatively fixed defense strategies are easily recognized by attackers, while attack strategies change rapidly. Therefore, the way to trigger fixed defense strategies cannot keep up with evolving attack methods. We note that various MTD techniques have been developed in the direction _towards self-adaptive_, i.e., the defense system can automatically adapt to the behavioral characteristics of the attacker and adjust defense strategy according to the behavioral characteristics of the attack, configure transformation information, and trigger transformation actions in a targeted manner. We can understand that most of the self-adaptive MTD techniques should ensure affordability and optimization. Since self-adaptive MTD techniques require deploying a sensing engine to sense the attack behavior and the constant collection of data samples used to sense the attack, equipping machine learning algorithms to construct a sensing engine is a mainstream approach for researchers designing self-adaptive MTD techniques. After investigation, we found that existing intelligent MTD techniques are mainly self-adaptive from the following points. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Ref.** & **RL Method** & **Attack** & **Participants** & **Rationality** & **Environment** & **Order** \\ \hline [PERSON] et al. [62] & Iterative RL & Heart bleed & Single-agent & Perfect & Unknown/Incomplete & [PERSON] \\ [PERSON] et al. [63] & Basic RL & DDoS & Single-agent & Perfect & Known & - \\ [PERSON] et al. [64] & - & Adversarial & Single-agent & Perfect & Known & [PERSON] \\ [PERSON] et al. [27] & DDPG & Eavesdropping & Single-agent & Perfect & Known & - \\  & & attacks & & & & \\ [PERSON] et al. [67] & Multi-learner RL & Adversarial & Multi-agent & Perfect & Known & [PERSON] \\ [PERSON] et al. [66] & Multi-object RL & GENERALIZED & Multi-agent & Perfect & Known & - \\ [PERSON] et al. [65] & RLHF & GENERALIZED & Single agent & Perfect & Partially observable & - \\ [PERSON] et al. [60] & Double oracle & GENERALIZED & Multi-agent & Bounded & Partially observable & [PERSON] \\ [PERSON] et al. [61] & Q-Learning & GENERALIZED & Multi-agent & Bounded & Unknown/Incomplete & Stackelberg \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Our survey on recent MTD optimization research. * Self-adaptation empowered by machine learning [PERSON] et al. [69] proposed a self-adaptive MTD that could generate multiple new models in depth after deployment to detect and defend against adversarial examples collaboratively. Post-deployment quasi-secret deep models proposed in this paper significantly increased the bar for attackers constructing compelling adversarial examples. They also applied serial data fusion with an early stopping technique in order to reduce the inference time by up to five times while maintaining sensing and defense performance. In Section 3.2.1, we presented how [PERSON] et al. [19] proposed an adaptive IP hopping approach that not only performed a lightweight implementation in terms of system cost but also accomplished the adaptive processing of attacks.