# A Survey on Moving Target Defense: Intelligently Affordable, Optimized and Self-Adaptive
## 1 Introduction
### Comparison with Existing MTD Surveys  
We selected several surveys that had completed investigations of MTD since 2013 for comparison, chiefly aiming at the main concept, mechanism, and classification of MTD techniques and intelligent MTD techniques, and insights and future development recommendations on MTD, as shown in Table 1.  
Figure 2: The systematic flow of our survey. The earliest investigation of MTD-related techniques appeared in 2013, when MIT Lincoln Laboratory published a technical report that provided an exhaustive survey of MTD [3] and, within five years, a significantly expanded and updated version was released [4]. The main contribution of these two surveys is that the first survey was the first to classify MTD into five layers based on what MTD moved: dynamic data layer, dynamic software layer, dynamic runtime environment layer, dynamic platform layer, and dynamic network layer. The second survey gave an exhaustive list of MTD techniques in each category and the types of attacks based on each category of MTD techniques. In 2016, [PERSON] et al. [5] adopted a revolutionary classification method to classify MTD techniques: three implementation layers, including software, the running platform, and the physical network. This classification covered all kinds of examples in the literature on MTD techniques at that time, but this survey did not provide a comprehensive summary in terms of the combination of MTD techniques. The three-layer classification method was not widely used due to its limitation in classification, and most of the MTD techniques are still classified based on the five-layer classification method mentioned above. In 2018, [PERSON] et al. [6] conducted extensive investigations in the areas of strategies generation, restructuring the implementation and performance evaluation of MTD, among which the classification methods are based on multiple criteria: theory (e.g., game theory, machine learning, and genetic algorithms), technology (e.g., transformation or restructuring of system configurations), and purpose. For this reason, one may need a more consistent classification to obtain a clear depiction of the overall trends in MTD research and to easily gain insights from existing MTD methods. In 2019, [PERSON] et al. [7] published an overview of a survey on the technical architecture of MTD based on the application, operating system, and network levels. As the title suggests, this survey focused mainly on an architectural analysis of MTD techniques, such as software diversification, addressing space layout randomization, instruction set randomization, and IP randomization. In the same year, [PERSON] et al. [8] conducted a survey of defensive MTD tools, techniques, and strategies, from which the designation of key actions, the implementation of MTD, and the evaluation of the effectiveness of MTD are all covered in this survey. However, some critical aspects of the implementation layer and MTD portfolio are missing from its classification. This is the unity that is generally lacking in MTD surveys. [PERSON] et al. [9] 2020 presented a comprehensive survey of MTD techniques covering all the relevant aspects that MTD techniques may involve: essential layers, design principles of MTD techniques, MTD classification, common attacks, key methods, important algorithms,