# A Survey on Moving Target Defense: Intelligently Affordable, Optimized and Self-Adaptive
## 3 Intelligent MTD Techniques
### Intelligent MTD Techniques
#### 3.2.3 Towards Self-Adaptive
Their approach consists of a lightweight Convolutional Neural Network detector composed of three convolutional modules and a judgment module to sense scanning attacks and provide a CNN-based three-stage jumping strategy to achieve self-adaptation, which allows the MTD system to optimize its behavior in real-time according to the attacks. * Self-adaptation empowered by machine learning with legacy defense mechanisms As a feasible solution to the relatively fixed defense strategies issue proposed in Section 2.3.4. [PERSON] et al. [14] held the belief that although used as a defense mechanism, untimely triggered MTD could also be disruptive to ordinary users. For example, when IP addresses were dynamically changed, IP address resolution using DNS caching before performing any communication was no longer effective. The authors noted that MTD deployment could be triggered by using lightweight intrusion detection, which they proposed to use as an intrusion detection mechanism to help MTD become adaptive. They proposed an approach called the Neuro-evolution of Augmented Topologies, which generated sparse topologies by building packet-based detectors that could manipulate topologies in real time to accomplish the self-adaptive functionality. [PERSON] et al. [48] proposed a machine learning-based approach for dynamic honeypot configuration, deployment, and maintenance. By identifying network entities (machines and devices), these entities were further analyzed and clustered, and finally, honeypots were intelligently deployed in the network based on the clustering. Through machine learning, the honeypot system it deployed owned two characteristics: first, it was hybrid, i.e., low-interaction honeypots and high-interaction honeypots were deployed in a mixed manner, with low-interaction honeypots responsible for redirecting attack traffic to high-interaction honeypots and high-interaction honeypots emulating operating systems and network services; second, it was adaptive, i.e., the system could intelligently record and analyze intruder activities and take measures to protect the network based on analysis results. These honeypots did not require configuration and maintenance and were, therefore, a significant advantage of honeypot technology in modern network security. * Self-adaptation empowered by machine learning with game theories [PERSON] et al. [36] proposed a self-adaptive MTD technique aimed at mitigating the ability of the adversary to understand defense mechanisms. They modeled the adversary's adaptability through the learner's feature space to make adversarial predictions and trigger self-adaptive MTD. These methods are based on game theory and machine learning and are applicable to problems of practical size and complexity. They also utilized reinforcement learning [81] to model the co-evolutionary relationship between attackers and defenders to derive optimal defense strategies for MTD that are difficult to reverse. [PERSON] et al. [70] proposed a self-adaptive MTD method MTDeep, which focused on adversarial attacks on DNNs. In MTDeep, the input images are randomly classified, and a network is selected from a collection of networks based on a policy generated through game-theoretic reasoning. The interaction between image classification systems can be modeled as a repeated Bayesian game using MTDeep (i.e., the set of DNNs) and its users (i.e., adversarial and legitimate). The configuration space of the defenders is the set of DNNs that are trained for the same task but are not affected by the same attacks. The Stackelberg equilibrium of the game provides the optimal switching strategy for MTDeep to reduce the adversarial modification of images leading to misclassification and guaranteeing the high classification accuracy of the system.