# A Survey on Moving Target Defense: Intelligently Affordable, Optimized and Self-Adaptive
## 2 MTD Techniques
### Design and Classification
#### 2.2.2 How to Move  
By seeking ways to shift attack surfaces to increase unpredictability and uncertainty, MTD techniques can lead to information failure for attackers. [PERSON] et al. [9] classified the shifting of attack surfaces into shuffling, diversity, and redundancy (SDR), as well as hybrid techniques based on a mixture of these two or three, as shown in Figure 4.  
* Shuffling  
Shuffling involves randomizing or rearranging system configurations. IP hopping [11] is a common shuffling method that constantly changes the host's IP address to evade scanning by attackers. Shuffling does not require building new security techniques. Instead, it builds on existing ones, and is, therefore, less burdensome in terms of development costs and resource consumption, is easy to operate, and is highly compatible. However, because shuffling relies on the quality of existing techniques, its effectiveness may be limited if those techniques are not sufficiently robust against attacks.  
* Diversity  
Diversity means alternating between different components that can achieve the same system functionality. For example, if a program is programmed in Python, the same functionality can be achieved in C++. Diversity builds on existing defense techniques and  
\begin{table}
\begin{tabular}{c c c} \hline \hline \multicolumn{3}{c}{**The Attack Surfaces Often Utilized in Recent Years (Since ’18)**} \\ \hline Network L. & \(\boxed\)IP address/Port [11; 12; 13; 14; 15; 16; 17; 18; 19; 20; 21; 22; 23] & Route/Network topology [24; 25; 26; 27; 28] \\ Platform L. & \(\boxed\)Virtual Machines [29; 30; 31; 32; 33] & Proxies [34] \\ Rt. Env. L. & \(\boxed\)Operation Systems [35; 36; 37] & \\ Software L. & \(\boxed\)Software [38; 39; 40; 41; 42] & \\ Data L. & Instruction sets [43; 44] & Codes [45; 46] \\ \hline \hline \end{tabular}
\end{table}
Table 2: Attack surfaces most often utilized.  
Figure 4: SDR examples.  
has similar advantages and disadvantages to shuffling. However, it also incurs additional defense costs due to the need to prepare extra systems or components.
* Redundancy Redundancy refers to the preparation of multiple copies of a system or network component to ensure that the new copy can be replaced at any time if the original system or component is attacked, disabling the original attack process. It is worth noting that redundancy requires higher service availability for users than the previous two techniques. Therefore, quality measurement of redundancy is usually accomplished by evaluating the system's Quality of Service (QoS). In addition, if redundancy is not performed correctly, it provides a more significant opportunity for an attacker to execute an attack on a larger attack surface (e.g., another server to attack or another path to the target) than a system that does not use redundancy.
* Hybrid Hybrid combines two or three of the above methods. While enhancing security, the benefits of each of the three methods can be taken into account, such as improving QoS while keeping the overhead low, but what cannot be overlooked is that hybrid presents a larger attack surface than individual methods and requires an additional overhead when combining multiple methods into a single solution.  
We have presented the two mainstream classifications of MTD techniques based on what to move and how to move, respectively. We believe that these two categories can cover almost all the MTD techniques that have been proposed so far. Based on this idea, we introduced a combination of these two methods to form a new classification method called SDR/Five layers, as shown in Table 3. The features of this are precisely explained in this table.