# A Survey on Moving Target Defense: Intelligently Affordable, Optimized and Self-Adaptive
## 3 Intelligent MTD Techniques
### Intelligent MTD Techniques
#### 3.2.1 Towards Affordable  
One of the primary goals of MTD is to provide an affordable defense. This refers to reducing resource costs in deploying the techniques, which includes both deployment costs and system overhead. Deployment cost determines the economic threshold for users to adopt the technology, while system overhead affects the QoS and users' experience of the deployed system. Currently, MTD techniques pursue high-precision and high-accuracy security defense effectiveness, which requires a substantial increase in data samples. Processing these data requires better hardware support, resulting in high-intensity hardware dependency and difficulties in promoting applications. On top of that, the deployment of MTD inevitably occupies storage and computational resources, especially self-adaptive MTD, which requires collecting data samples for sensing attacks and, thus, occupying network channel resources. In this way, how to reduce the deployment cost and system overhead has become one of the most pressing issues in the development of MTD. The use of machine learning algorithms, such as Neural Network Compression [71], to reduce resource costs has been achieved in other areas, such as data processing [72], image recognition [73], and speech recognition [74], which can efficiently process large amounts of data and retain key features to improve computational efficiency [75; 76]. Drawing on this, an increasing number of MTD techniques have started to utilize machine learning algorithms to improve defense performance while reducing resource costs. After recapitulation, we found that the existing intelligent MTD came _towards affordable_ for defense mainly from the following points:  
* New MTD methods are designed to reduce the high overhead of existing methods  
[PERSON] et al. [39] found that the CAPTCHA approach traditionally used to defend against web bot attacks such as XRumer, Magic Submitter, and SENuke generates a significant system overhead and reduces system availability. To address this, they designed a new MTD technique that intelligently randomized HTML elements to counter web bot attacks without affecting normal users. After analysis, they categorized the system overhead into page load time (PLT) and page size. To reduce the system overhead, they designed \begin{table}
\begin{tabular}{l} \hline \hline \(\bullet\) Large resource consumption and high defense costs & \(\bullet\) Towards affordable \\ \(\bullet\) The incapability of balancing multi-constraints & \(\bullet\) Towards optimized \\ \(\bullet\) Relatively fixed defense strategies & \(\bullet\) Towards self-adaptive \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Challenges of MTD and accomplishments of machine learning. \begin{table}
\begin{tabular}{l l l l} \hline \hline Towards affordable & CNN [19] & DL [39] & RL [34] \\ Towards optimized & RL [60; 61; 62; 63; 64; 65; 66; 67; 68] & \\ Towards self-adaptive & DL [69] & CNN [19] & Neuro-evolution [14] \\  & Clustering [48] & RL [36] & RNN [70] \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Common machine learning algorithms applied for intelligent MTD techniques. an intelligent randomization algorithm to ensure that only a small number of characters needed to be added from the original string for each element, which ensured that the PLT increase overhead was less than 0.2 s in all cases, and the average page size increase was only 0.103 KB. This technique was evaluated to prevent all web bot attacks successfully with relatively low overhead while ensuring users' experience and system QoS. As a feasible solution to the IP hopping issue proposed in Section 2.3.4. [PERSON] et al. [19] proposed a CNN-based adaptive IP hopping approach to defending against scanning attacks. To achieve lightweight defense, they first compressed the CNN detector deployed in the control plane using deep compression techniques to reduce its storage and computational resource usage, improve its forward computational efficiency, and release its dependence on GPU computation cards in its usage phase.