# An Adaptive IP Hopping Approach for Moving Target Defense Using a Light-Weight CNN Detector

Authors: Xiaoyu Xu; Hao Hu; Yuling Liu; Hongqi Zhang; Dexian Chang
Journal: Security and Communication Networks
 (2021)

---

## Abstract

Scanning attack is normally the first step of many other network attacks such as DDoS and propagation worm. Because of easy implementation and high returns, scanning attack especially cooperative scanning attack is widely used by hackers, which has become a serious threat to network security. In order to defend against scanning attack, this paper proposes an adaptive IP hopping in software defined network for moving target defense (MTD). In order to accurately respond to attacker’s behavior in real time, a light-weight convolutional neural network (CNN) detector composed of three convolutional modules and a judgment module is proposed to sense scanning attack. Input data of the detector is generated via designed packets sampling and data preprocess. The detection result of the detector is used to trigger IP hopping. In order to provide some fault tolerance for the CNN detector, IP hopping can also be triggered by a preset timer. The CNN driving adaptability is applied to a three-level hopping strategy to make the MTD system optimize its behavior according to real time attack. Experiments show that compared with existing technologies, our proposed method can significantly improve the defense effect to mitigate scanning attack and its subsequent attacks which are based on hit list. Hopping frequency of the proposed method is also lower than that of other methods, so the proposed method shows lower system overhead.


---

## Body

## 1. Introduction

According to Symantec’s 2019 report [1], a growing number of people and organizations display an interest in compromising operational computers via network. The static properties of network make the state and behavior of information system predictable, so attackers can not only launch attack effectively, but also escape detection easily [2]. Methods of network and host properties randomization such as Moving Targets Defense (MTD) have been recommended as a countermeasure against reconnaissance that attacks the static and predictable property of network [3]. IP hopping is one of the key technologies of MTD. It frequently changes IP addresses of protected nodes in network in order to prevent attackers from creating effective hit list.Existing researches [4–22] have proved that IP hopping technology is an effective method to defend against scanning attack which is normally the first step of many other network attacks such as DDoS [23] and propagation worm [24]. The game between scanning attacker and IP hopping defender is shown in Figure 1. Scanning attacks are generally manifested as attackers continuously release different forms of probe packets. Attackers will know which hosts in the network are potential targets according to the response packets received, while IP hopping technology frequently changes the used IP addresses of protected hosts. On the one hand, IP hopping makes the protected hosts avoid scanning attack to some extent. On the other hand, IP hopping could make the probed targets of attacker invalid in attacker’s hit list in a short time. For example, once the attacker probed a target and added its IP to the hit list, the IP may be invalid soon under the protection of IP hopping. The main challenge of defender is to decide when and how to hop.Figure 1
Background: game between the scanning attacker and IP hopping defender.IP hopping technology is firstly proposed and deployed in legacy network [2, 4–12] and proved to be an excellent defensive means. In recent years, software defined network (SDN) [25] has been widely studied and considered as the next network technology. SDN provides an operation mode of separating data forwarding and rule control. The flexibility of SDN brings conveniences and supports many new network technologies. Meanwhile, SDN also faces endless network threats. IP hopping technology applied to SDN has also been researched in many papers [11–20]. They usually use OpenFlow [26, 27] to develop a MTD architecture for IP hopping defense. The controller in SDN controls the mutation of IP of protected hosts. The controller also manages switches in protected network to ensure timely and accurate forwarding of packets in situation of constantly changing terminal IP addresses. The structure of SDN provides flexible convenience to deploy IP hopping defense technology.Faced with scanning attack, most of the researches do not pay enough attention to the behavior of attackers. The existing IP hopping defense systems lack the necessary perceptual ability to the attackers’ behavior. For instance, when no attacker invades the protected network, IP addresses of nodes keep hopping. In addition, the IP hopping system may probably be disruptive to legitimate user behavior. Some researches propose adaptive IP hopping methods [16, 19–22]. Adaptive methods can configure IP hopping scheme and execute IP hopping according to behavior of attackers so as to achieve elaborate defense effect. However, there is still much to improve in existing adaptive methods in reducing the success rate of scanning attacks and reducing the average life time of scanned targets in hit list.This paper proposes a novel adaptive IP hopping defense method in SDN. In our method, a light-weight convolutional neural network (CNN) [28, 29] is used to perceive the attackers’ scanning behavior and guide the configuration of next IP hopping. Experiments show that our proposed method can significantly improve the survival rate of protected hosts under scanning attack while reducing the average lifetime of targets in attackers’ hit list to avoid DDoS and other subsequent attacks. The main contribution of this paper can be concluded as follows. Firstly, we propose a sampling and data preprocess method of attacker’s behavior data in SDN. Secondly, we designed a light-weight CNN structure which can be used to detect attacker’s behavior in real time and drive IP hopping defense. Thirdly, applying CNN driving adaptability to three-level hopping strategy, a novel adaptive IP hopping in SDN is proposed and proved to achieve better defense effect via considerable amount of experiments.The rest of this paper is organized as follows. Section2 gives an overview of related works. Section 3 introduces the motivation of our proposed method. Section 4 presents our proposed method in detail. The implementation and experiments are presented in Section 5. Finally, Section 6 concludes this paper.


## 2. Related Works

Researches of IP hopping for MTD can be classified into two categories according to implementation platform, which are legacy network and SDN. We list both technologies in legacy network and SDN in detail.Traditional IP address randomization techniques such as DHCP [30] or NAT [31] do not develop the potential of IP randomization in network defense completely for the reasons of infrequency and traceability [2]. IP hopping technologies were firstly proposed and developed in legacy network. They have been tested to effective measures to contain different kinds of scanning attacks and other attacks based on hit list such as worms. Krylov and Kravtsov [4] proposed an IP hopping method which is deployable and effective to hide content and destination server. Zhao et al. [5] analyzed shortcomings of service migration and proposed new technique called “Middle Agent” which was applied to the end-hopping prototype system. Clark et al. [6] showed via analysis that refreshing and reassigning the IP addresses would disrupt the normal communication, so they introduced an optimal method to minimize the disruption. Zhuang et al. [7] defined some key concepts that might be used to formally talk about MTD system; they also discussed some essential problems of the MTD system. Yackoski et al. [8] introduced a new network architecture called Self-shielding Dynamic Network Architecture (SDNA) allowing multiple types of dynamics. Cho et al. [9] concluded the design principles, key methodologies, important algorithms, and some relevant key techniques about MTD. Dunlop et al. [10] proposed a hopping system based on IPv6 address called MT6D to handle the limit of number of IP addresses while ensuring the acceptable speed of UDP requests. Morrell et al. [11] explored the ratio of clients and server of MT6D and discovered some network limits. Miao et al. [12] pointed out that IP hopping defense in SDN is inefficient because of flow table matching which introduces high latency. They proposed the use of vector packet processing to accelerate IP hopping defense in legacy network. Experiment results showed that they effectively reduced the hit rate under scanning attack while maintaining the data processing capability.In SDN environment, Jafarian et al. [13] firstly proposed and deployed IP hopping in SDN; they proposed a MTD method named Random Host Mutation (RHM) which mutates IP addresses on the switches and keeps the mutation process transparent to the users (hosts). However, the hopping caused a certain amount of system overhead and cannot adapt to the behavior of the attacker. It is easy for attackers to find out the regular pattern of hopping defense. Jafarian et al. [14] then proposed a spatiotemporal address mutation that binds the changed IP address to the host. The source identity further improves the security of information system. However, the defense system requires sufficient address space, which is an additional overhead of defense. Krylov et al. [15] proposed a method countermeasure of DDoS attack called IP Fast Hopping, which is an implementable network layer software solution. This method also lacks the necessary perception of attack behavior and cannot adapt to the change of different attack behavior. On the basis of paper [13], Jafarian et al. [2] proposed an effective address randomization method which improves the unpredictability by fast mutation and constrained configuration. They proposed to use two-level hopping scheme to improve the efficiency of defense and further enhance the uncertainty of hopping. A flaw is that its attack perception ability is not sensitive enough, and it cannot adapt to the variety of attacks, such as irregular scanning frequency. Jafarian et al. [16] proposed an adversary-aware IP address randomization, which uses hypothesis testing to character behavior of attacker. Experiment shows a method in [16] which significantly slows down attack and increases its detectability. However, the accuracy of hypothesis test method depends on the number of known samples, which reduces the efficiency of attack perception. MacFarland and Shue proposed a new hopping method in SDN which provides protection for information system without any modification on clients [17]. This transparent defense method is similar to [13] in effect and cannot adapt to the changes of attacker behavior. In [18], Chang et al. not only randomize the IP address to achieve the purpose of defense, but also solve the problem of IP address synchronization between network nodes. This scheme is another implementation method in SDN. However, its synchronization behavior inevitably results in additional system overhead. In [19], Lei et al. deployed adversary strategy awareness module in MTD system and proposed a novel technique called self-adaptive end-point hopping technique (SEHT). In SEHT, IP hopping is triggered and configured with the guide of adversary strategy awareness. The result of three-level hoping is a more refined method, which improves the unpredictability of defense. However, similar to [16], its perception method is not sensitive to the change of aggressive behavior. In [20], Smith et al. also introduce intrusion detection to trigger MTD system. In their work, the intrusion detection is based on neuroevolution of augmented topologies algorithm (NEAT) and is real time in operation. However, the accuracy of detection still needs to be improved. In [21], in order to maximize unpredictability of network mutation, Zhang et al. use adversary strategy awareness with hypothesis test to make mutation strategy selection. Similar to [16], the accuracy of hypothesis testing depends on the number of valid samples, which is an additional overhead. In [22], Ma et al. use anomalous awareness in [32] to drive a self-adaptive end-point hopping defense. However, the anomalous awareness based on information distance is not accurate enough. A smart attacker may be scanning without anomalousness on information distance.In conclusion, IP hopping for MTD is an effective method that can defend against network attack especially scanning attack. However, some existing methods do have to be improved in their adaptability, which means the MTD system should respond to attack behavior accurately in real time and make fine-grained adjustment on hopping strategy.


## 3. Motivation

### 3.1. Attack Analysis

In this paper, we mainly focus on one kind of cooperative scanning attack. This cooperative scanning indicates that a number of hosts act as scanners and sample (probe) IP addresses in the protected network. The whole IP space will be divided and assigned to the scanners and will be scanned uniformly. The purpose of attacker is testing which IP addresses are currently used online, so that he can prepare for following attacks such as DDoS. A cautious attacker usually scans IP addresses without repetition to minimize failed probes [33].We assume that the scanning attack starts from the outer network but is a propagating scanning. Each newly probed host may get infected and start acting as a scanner. Once a host is probed, it takes timetp to infect the host. Scanners can share the IP address space that has not been scanned.Each scanner has two important attributes which are frequency of scanning packet (FSP) and proportion of scanning packet (PSP). FSP denotes the number of probes sent per second. PSP denotes the proportion of probe packets in all packets sent by the scanner.We believe that, compared with network data flow produced by normal host for legal communication, data flow produced for scanning attack does have distinguishing features. These features make it possible to detect scanning attack from network data flow without being disturbed by normal probes. “Normal probes” means probes released for legal communication.


### 3.2. Promotion Idea

In adaptive IP hoping system, the result of attack awareness is used to guide the configuration of IP hopping and trigger IP hopping. Both the accuracy and timeliness of attack awareness directly affect the validity of hopping. The accuracy demands not only detecting malicious packet (false rejection rate) but also not being disturbed by normal probes (false acceptance rate).However, the accuracy and timeliness of previous adaptive IP hopping methods still need to be improved. The method in [20] uses a nearly fully connected structure to build a light-weight detection network. The structure of full connection makes it difficult to balance the capacity and lightweight of the network, so it is difficult for the detection to achieve balance between accuracy and timeliness. The method in [19] simply judges failed probe packets as malicious. However, not failed probe packets can also be malicious ones, and failed probe packets may also be legal ones. The method of data sampling in [19] also needs to be improved.Regarding accurately aware behavior of attack in real time, in this paper, we firstly propose a new method of data sampling. The proposed sampling method collected all probe packets in order to include all malicious scanning packets. A part of nonprobe packets that may be related to scanning attack are also included. We then propose a novel CNN structure to detect sampled data and drive IP hopping system including guiding hopping configuration and triggering hopping. We try to make hopping defense react each illegal probe to improve effectiveness of hop and reduce invalid hops. Architecture of CNN driving adaptive IP hopping is shown in Figure2. The reason for choosing CNN as the detector is as follows: firstly CNN’s local perception processing can mine the data correlation and remove the redundant information in data so as to ensure the detection accuracy; secondly, CNN’s weight sharing and pooling process can reduce the number of connections and weights in neural network so as to build a light-weight detector. Thirdly, CNN has been used in intrusion detection system and proved an effective tool to detect behavior of attackers [34–37]; thus, previous works can be used for reference in this paper.Figure 2
Architecture of CNN driving adaptive IP hopping.


## 3.1. Attack Analysis

In this paper, we mainly focus on one kind of cooperative scanning attack. This cooperative scanning indicates that a number of hosts act as scanners and sample (probe) IP addresses in the protected network. The whole IP space will be divided and assigned to the scanners and will be scanned uniformly. The purpose of attacker is testing which IP addresses are currently used online, so that he can prepare for following attacks such as DDoS. A cautious attacker usually scans IP addresses without repetition to minimize failed probes [33].We assume that the scanning attack starts from the outer network but is a propagating scanning. Each newly probed host may get infected and start acting as a scanner. Once a host is probed, it takes timetp to infect the host. Scanners can share the IP address space that has not been scanned.Each scanner has two important attributes which are frequency of scanning packet (FSP) and proportion of scanning packet (PSP). FSP denotes the number of probes sent per second. PSP denotes the proportion of probe packets in all packets sent by the scanner.We believe that, compared with network data flow produced by normal host for legal communication, data flow produced for scanning attack does have distinguishing features. These features make it possible to detect scanning attack from network data flow without being disturbed by normal probes. “Normal probes” means probes released for legal communication.


## 3.2. Promotion Idea

In adaptive IP hoping system, the result of attack awareness is used to guide the configuration of IP hopping and trigger IP hopping. Both the accuracy and timeliness of attack awareness directly affect the validity of hopping. The accuracy demands not only detecting malicious packet (false rejection rate) but also not being disturbed by normal probes (false acceptance rate).However, the accuracy and timeliness of previous adaptive IP hopping methods still need to be improved. The method in [20] uses a nearly fully connected structure to build a light-weight detection network. The structure of full connection makes it difficult to balance the capacity and lightweight of the network, so it is difficult for the detection to achieve balance between accuracy and timeliness. The method in [19] simply judges failed probe packets as malicious. However, not failed probe packets can also be malicious ones, and failed probe packets may also be legal ones. The method of data sampling in [19] also needs to be improved.Regarding accurately aware behavior of attack in real time, in this paper, we firstly propose a new method of data sampling. The proposed sampling method collected all probe packets in order to include all malicious scanning packets. A part of nonprobe packets that may be related to scanning attack are also included. We then propose a novel CNN structure to detect sampled data and drive IP hopping system including guiding hopping configuration and triggering hopping. We try to make hopping defense react each illegal probe to improve effectiveness of hop and reduce invalid hops. Architecture of CNN driving adaptive IP hopping is shown in Figure2. The reason for choosing CNN as the detector is as follows: firstly CNN’s local perception processing can mine the data correlation and remove the redundant information in data so as to ensure the detection accuracy; secondly, CNN’s weight sharing and pooling process can reduce the number of connections and weights in neural network so as to build a light-weight detector. Thirdly, CNN has been used in intrusion detection system and proved an effective tool to detect behavior of attackers [34–37]; thus, previous works can be used for reference in this paper.Figure 2
Architecture of CNN driving adaptive IP hopping.


## 4. The Proposed Method

### 4.1. Architecture and Workflow

The proposed IP hopping system evades and prevents scanning attacks by dynamically changing IP address of protected hosts, thus increasing the usage difﬁculty of vulnerabilities and backdoors and ensuring the security of protected network. The adaptability of proposed method is reflected in two aspects: adaptive IP hopping configuration and adaptive IP hopping trigger. The CNN detector is used to make the attack behavior aware automatically and to not only guide hopping configuration but also trigger hopping.The flowchart of our proposed method is composed of 4 modules as shown in Figure3 which are packets sampling, data preprocess, trained CNN detector, and hopping strategy execution. In packets sampling module, we collect packets which may be related to scanning attack. Data preprocess module is used to form the collected packets into a data matrix as the input of the following CNN detector. The CNN detector is a designed module which is used to judge whether the input data correspond to a malicious host or not. Finally, IP hopping strategy is activated by the judgment result of CNN detector. Besides, the hopping can also be triggered by a preset timer in case that the CNN detector makes missed alert.Figure 3
The flowchart of the proposed IP hopping system.


### 4.2. Packets Sampling

Input data of CNN should include packets of normal probe or scanning attack and their related packets. In order to ensure the accuracy of detection, the input data should be as complete as possible but as little redundant as possible. Considering that the scanning behavior of attackers is variable, for example, attacker can launch scanning attack packets in different FSPs and PSPs. Smart attacker can also hide his scanning attack packets among background data stream. Considering that the attack data traffic may have the above characteristics, two different sampling methods are used at the same time, which are continuous sampling and precise sampling. Continuous sampling is used to sample not only probe packet itself but also the after background stream packet, so as to make it possible for the subsequent processing to mine the relationship between the attack packet and the background stream. Precise sampling is used to collect all probe packets since each probe packet could be an attack packet. Precise sampling collects only probe packets. Both precise sampling and continuous sampling are touched off by any of the eight kinds of packets which could be used to probe including ARP request, ICMP echo, ICMP time stamp, ICMP netmask, TCP SYN, TCP ACK, TCP FIN, and UDP empty.


#### 4.2.1. Continuous Sampling

For every probe packet, continuous sampling collects some following packets from the same source host. The following packets and probe packet itself form the sampled packets of one continuous sampling.Considering different packets from the same source that host may reach and that are forwarded by different switches, once any switch receives a probe packet, it packets in the probe packet to the controller and raises an event (it is called “event” in RYU platform) of continuous sampling. After that, it is ordered by the controller that every switch in the controlled network should packet in a certain number of following packets sent by the source host of the probe packet in a specified time.


#### 4.2.2. Precise Sampling

Precise sampling only pays attention to probe packets. For every probe packet, precise sampling collects some previous probe packets and some following probe packets from the same source. The previous probe packets, following probe packets, and probe packet itself form the sampled packets of one precise sampling.Implementation of precise sampling is similar to continuous sampling, but precise sampling only collects probe packets. Once any switch receives a probe packet, it packets in the probe packet to the controller and raises an event of precise sampling. After that, it is ordered by the controller that every switch in the controlled network should packet in a certain number of following probe packets from the same source in a specified time. The controller has already stored all previous probe packets in the network, and it selects a certain number of previous probe packets from the same source.


### 4.3. Data Preprocessing

Our designed CNN detectors will operate on data extracted from sampled packets in order to make a classification whether the packet and its source host are illegal or not. Data extracted from one continuous sampling and one precise sampling combine an input data of CNN detector. The method of data extraction is as follows.Each packet is essentially a binary bitstream. In order to further remove invalid parts from sampled data, only parts that may be related to scanning attack are preserved, while others are discarded. Five parts of each packet (if exist) are preserved, which are(1)
Fixed part of the IP datagram header (160 bits)(2)
Fixed part of the TCP message header (160 bits)(3)
UDP message header (64 bits)(4)
ICMP message header (64 bits)(5)
Ethernet header and ethernet ARP fields of ARP message (42 bits)Content of the packet that does not belong to the above five parts will be discarded. We also notice that since IP hopping system makes the protected network ever-changing, the judgment whether one probe packet is illegal or not should consider the current network situation. For this purpose, we add a flag bit at the end of the binary bitstream extracted from each probe packet, as shown in Figure4. If the probe packet hits a currently used IP address, the flag bit is set 1; otherwise it is set 0.Figure 4
Binary bitstream extracted from a probe packet and the added flag bit.We do not convert these binary bitstreams to integers as [20] does for the purpose of avoiding data confusion and preserving data integrity. Data extracted from each sampled packet were placed end-to-end forming vector F. In order to adapt to convolutional process in CNN detector, vector F is then converted to matrix M. Zero padding is used to ensure a two-dimensional matrix.Since the number of sampled packets may probably be different in each sampling, and the types of packets obtained from each sampling are also different, size ofM is not fixed. To adapt different size of input data, we introduce global pooling to be the last pooling layer in the structure of CNN, which is described in the next subsection.


### 4.4. Designed CNN Detector

CNN has been widely used in network intrusion detection such as [34–37]. Meanwhile, because of its local perceptual processing mode, CNN has special advantage in discovering the local to local correlation in data. As analysis in packets sampling and data process, the local to local correlation in our data may probably be related to the classification (malicious or not). For the structural design of CNN, we have kept adjusting the structure of CNN empirically in a large number of experiments. The adjustment process includes using different activation functions and using convolution kernels of different sizes to make sure the structure is suitable for the judgment on our processed attack traffic data.The CNN detector is designed to be deployed on the controller of SDN. We set two requirements of the deployment of the designed CNN: firstly, there should be no special requirements for hardware performance of the controller; secondly, time consumed in one execution of judgment should not be too long to avoid data piling up. The CNN should be a light-weight detector. The structure of the designed CNN is shown in Figure5, which is composed of three convolutional modules and a judgment module. Each convolutional module is composed of a convolutional layer, a batch normalization layer [38], a ReLU layer [39], and a pooling layer. The reason for using ReLU as activation is that our input data is a binary matrix. ReLU makes different activation for the element greater than 0 and less than 0. The judgment module is composed of a fully connected layer and a Softmax layer.Figure 5
Structure of designed CNN.In Figure5, the boxes with “Conv” mean convolutional layer. The formulas a×b×c×d in “Conv” boxes show the size and shape of convolutional kernel. A convolutional layer inputs d matrixes and outputs a matrixes, and b×c is the size of convolutional kernel on each input matrix. The process of a convolutional layer is shown in(1)Xjout=∑i=1dXiin∗Kij+Bj,where Xjout is the jth output matrix of the layer, Xiin is the ith input matrix of the layer, Kij is a convolutional kernel operated on Xiin and output to Xjout, and Bj is the bias matrix added to the jth output matrix. In (1), ∗ means convolutional operation.The boxes in Figure5 with “Pooling” mean pooling layer. In the boxes of pooling layer, “size” means the size of pooling window and “s” means the stride of pooling operation. The process of pooling layer can be described in(2)x=poolaveR=1R∑r∈Rr,where x is an output neuron, ave means we use average pooling in each pooling layer, R means a pooling region in the input matrix, and r is a neuron in R. Global pooling is operated in the last pooling layer, which means the size of pooling window flexibly is equal to the size of each input matrix of the layer. Global pooling enables the CNN to adapt to different size of input data. The process of convolution and pooling is shown in Figure 6.Figure 6
Convolution and pooling in convolutional neural network.The boxes in Figure5 with “ReLU” mean ReLU layer which is an activation layer. These layers improve the nonlinear factors of CNN and enable the model to fit a problem that linear model cannot. The process of ReLU layer is described in(3)xout=max0,xin,where xout is an output neuron and xin is an input neuron of ReLU layer.The boxes in Figure5 with “BN” mean batch normalization layer. BN layer first normalizes elements in each input feature map to zero-mean and unit-variance to ensure that the input neuron to ReLU falls in the region near value 0, and hence the gradient back-propagation would not fall into poor local minima.The box in Figure5 with “Fully connected” means fully connected layer. In this layer, each output neuron is connected to each input neuron with a weight parameter. The process of this layer is shown in(4)xjout=∑i=1Nfxiin×ωij,where xjout means the jth output neuron of this layer, xiin means the ith input neuron of this layer, Nf means the number of input neurons of this layer, and ωij is the weight parameter of connection between xjout and xiin.The box in Figure5 with “Softmax” means Softmax layer. This layer normalizes the value of neuron to the range of [0, 1] to indicate probabilities of the input data belonging to each class. The process of Softmax layer is shown in(5)xjout=exjin∑i=1Nsexiin,xjout∈0,1,where xjout means the jth output neuron of this layer, exjin and exiin mean jth and ith input neurons of this layer, and Ns means the number of input neurons and is also the number of output neurons of this layer. In our designed CNN, both fully connected layer and Softmax layer output two neurons; one indicates “normal” and the other indicates “malice.”DenoteD⋅ as the process of the trained CNN detector and X as a matrix of input date. Judgment of the CNN detector is shown in (6) where result “1” means “malice” and result “0” means “normal.”(6)DX=0,normal,1,malice.It is obvious that packets sampling occupies the channel between the switch and the controller to some extent. Also, data process and CNN detection consumes the resources on the controller side. In order to mitigate the impact on network QoS, one judgment result will also be applicable for other probe packets from the same source in 1 minute. In the following 1 minute, probe packets from the same source will not raise packets sampling. This also prevents the defense system from being overburdened by an excessive number of probe packets.


### 4.5. IP Hopping Strategy

In this paper, we provide each protected host with a fixed real IP (rIP) and a hopping virtual IP (vIP). In our IP hopping system, IP hopping can be touched off by two kinds of events: the first is the system timer (periodic hopping) and the second is the judgment result of the CNN detector (triggered hopping). Periodic hopping and triggered hopping run independently. The set of periodic hopping is in case that CNN makes missed alert and triggered hopping was not executed in some situation.The notions used in our IP hopping strategy are listed in Table1. Assume the whole protected network has k subnets which are represented by S1,S2,…,Sk. Total l protected hosts are distributed in the k subnets. The l protected hosts are represented by h1,h2,…,hl. IPW, IPR, and IPV represent the whole IP set, the real IP set, and the virtual IP set, respectively, so IPW=IPR∨IPV, rIP∈IPR, and vIP∈IPV. It is impossible to choose vIP from the whole IPV in each hopping, because a range of vIPs can only be assigned to one physical subnet at a given time. We adopt a three-level hopping to assign available vIP space, which are base hopping, low-frequency hopping, and high-frequency hopping. As shown in (7), the IPV set is divided into mB number of base hopping range (BHR) according to the number and scale of subnets, mB≥k.(7)IPV=∑b=1mBRBHRb.Table 1
The notions used in the IP hopping strategy.
CharacterDescriptionrIP, vIPReal IP address and virtual IP addressSi, hiTheith subnet and the ith host in the protected networkIPW, IPR, IPVThe sets of all IP addresses, real IP addresses, and virtual IP addressesRBHRb, RLHRlThebth BHR and the lth LHR in a BHRmB, mLThe number of BHR and the number of LHR in a BHRTBH,TLH,THHTime interval of base hopping, low-frequency hopping, and high-frequency hoppingωB,ωL,ωHWeights of each BHR, LHR. and protected host to characterize attacker’s scanning behaviorrijtA flag to show whetherRBHRj is allocated to Si in tth BHR assignment schemePBH,PLHThresholds to touch off base hopping and low-frequency hoppingHTBi,HTLiHit times of thevIP pool of Si and hiNSiThe number of hosts inSiThen, as shown in (8), each BHR is divided into mL number of low-frequency hopping range (LHR) according to the number of hosts in subnet. Each LHR contains several vIPs, and these vIPs are used for high-frequency hopping.(8)RBHRb=∑l=1mLRLHRl.


#### 4.5.1. Periodic Hopping

The IP hopping system periodically refers to three levels of hopping which are base hopping, low-frequency hopping, and high-frequency hopping. Base hopping changes the IP address range assigned to a given subnet with time intervalTBH. Low-frequency hopping changes the IP address ranges assigned to a given host within the corresponding BHR with time interval TLH. High-frequency hopping changes the vIP assigned to a given host within the corresponding LHR with time interval THH.Adaptive IP hopping configuration is an important aspect of adaptability in proposed method. To characterize attacker’s scanning behavior, we associate a weightωB with each BHR, a weight ωL with each LHR, and a weight ωH with each protected host. Higher weight for a range indicates higher attacker activity in that range in the last interval. The value of ωB, ωL, and ωH is computed according to the malicious probe packets in the last interval. These weights will guide the configuration of next hopping.(1) Base Hopping. In base hopping, each subnet will be assigned with one or more BHRs. Denote ωBi as the weight of the RBHRi and NBHRi as the number of vIPs in it. Computation of weight ωBi is in Algorithm 1.Algorithm 1: Computation of weight ωBi in base hopping in periodic hopping.
Require: All detected data X in last base hopping intervalFor all probe packets in the last base hopping intervalIfDX==1 && the target IP is in RBHRiωBi++;End ifEnd forωBi=ωBi/NBHRi;ReturnωBiWhen more than one BHR assignment schemes is available, we choose the scheme that achieves minimal standard deviation of sums of weights of BHRs assigned to a subnet, in order to ensure nearly equal security of each subnet. Denoterijt as a flag. rijt==1 means RBHRj is allocated to Si in the tth assignment scheme, and rijt==0 means RBHRj is not allocated to Si in the tth assignment scheme. In the tth assignment scheme, we compute the standard deviation of sums of weights of BHRs assigned to Si as (9)–(13). Vector W denotes the set of ωB; vector Rit denotes the set of flag rijt; sit denotes the sum of weights of BHRs assigned to Si in the tth BHR assignment scheme. μt denotes the mean, and σt denotes the standard deviation.(9)W=ωB1,ωB2,…,ωBmB,(10)Rit=ri1t,ri2t,…,rimBt,(11)sit=Rit⋅WT,(12)μt=1mB∑i=1mBsit,(13)σt=1mB∑i=1mBsit−μt2.We compareσt in each assignment scheme and select the assignment scheme with minimal σt for next base hopping.(2) Low-Frequency Hopping. Once a subnet is assigned with one or more BHRs, these BHRs are divided into several LHR. For low-frequency hopping, each host will be assigned with one or more LHRs. Each LHR has a weight ωL. The computing method of ωL and the selection of LHR assignment scheme are the same as those of base hopping, so they are not elaborated here.(3) High-Frequency Hopping. Once a host is assigned with one or more LHRs, vIPs in these LHRs form a vIP pool. In high-frequency hopping, a vIP in the pool will be selected and used in next interval. For high-frequency hopping, denote ωHi as the weight of the ith vIP in the pool of a host. Computation of weight ωHi is in Algorithm 2.Algorithm 2: Computation of weight ωHi in high-frequency hopping in periodic hopping.
Require: All detected data X in last high-frequency hopping intervalRequire: vIP pool of the host for high-frequency hoppingFor all probe packets in the last high-frequency hopping intervalIfDX==1 && the target IP is the ith vIP in the poolωHi++;End ifEnd forReturnωHiFor one host, only onevIP can be used at one time. All vIPs in the pool are sorted according to their weights. The vIPs with higher weights will be preferred.


#### 4.5.2. Triggered Hopping

In our IP hopping system, the hopping can also be touched off by the judgment result of the CNN detector. Base hopping, low-frequency hopping, and high-frequency hopping will be active in three cases, respectively.(1)
Base Hopping. As in Algorithm 3, in a time interval TBH, if the number of hit times of the vIP pool of a subnet divided by the number of host in the subnet has reached the threshold PBH, a base hopping for the whole protected network should be touched off. Denote HTBi as the number of hit times of the vIP pool of Si.(2)
Low-Frequency Hopping. As in Algorithm 4, in a time interval TLH, if the number of hit times of the vIP pool of host hi has reached the threshold PLH, a low-frequency hopping for the corresponding subnet should be touched off. Denote HTLi as the number of hit times of the vIP pool of hi.(3)
High-Frequency Hopping. As in Algorithm 5, in a time interval THH, if a host is hit by a malicious probe packet, a high-frequency hopping for the host should be touched off.Algorithm 3: Base hopping in triggered hopping.
Require: All detected data X after last base hoppingRequire: vIP pool of SiRequire: Preset threshold PBHHTBi=0;For all probe packetsIfDX==1 && the target IP is in the vIP pool of SiHTBi++;End ifEnd forIfHTBi/NSi≥PBHTriggering base hopping;End ifReturn NullAlgorithm 4: Low-frequency hopping in triggered hopping.
Require: All detected data X after last low-frequency hoppingRequire: vIP pool of hiRequire: Preset threshold PLHHTLi=0;For all probe packetsIfDX==1 && the target IP is in the vIP pool of hiHTLi++;End ifEnd forIfHTLi≥PLHTriggering low-frequency hopping for the corresponding subnet;End ifReturn NullAlgorithm 5: High-frequency hopping in triggered hopping.
Require: All detected data X after last high-frequency hoppingRequire: Currently used IP of hiIfDX==1 && the target IP is at use by hiTriggering high-frequency hopping forhi;End ifReturn NullThe proposed periodic hopping and triggered hopping are both adaptive hopping strategies. On the one hand, they can make protected hosts avoid using IP addresses that attackers may seriously scan, so as to improve the survival rate protected hosts under scanning attack. On the other hand, once a protected host is hit in scanning attack, its used IP address may immediately hop to another one to disable the scanned target in attacker’s hit list.


## 4.1. Architecture and Workflow

The proposed IP hopping system evades and prevents scanning attacks by dynamically changing IP address of protected hosts, thus increasing the usage difﬁculty of vulnerabilities and backdoors and ensuring the security of protected network. The adaptability of proposed method is reflected in two aspects: adaptive IP hopping configuration and adaptive IP hopping trigger. The CNN detector is used to make the attack behavior aware automatically and to not only guide hopping configuration but also trigger hopping.The flowchart of our proposed method is composed of 4 modules as shown in Figure3 which are packets sampling, data preprocess, trained CNN detector, and hopping strategy execution. In packets sampling module, we collect packets which may be related to scanning attack. Data preprocess module is used to form the collected packets into a data matrix as the input of the following CNN detector. The CNN detector is a designed module which is used to judge whether the input data correspond to a malicious host or not. Finally, IP hopping strategy is activated by the judgment result of CNN detector. Besides, the hopping can also be triggered by a preset timer in case that the CNN detector makes missed alert.Figure 3
The flowchart of the proposed IP hopping system.


## 4.2. Packets Sampling

Input data of CNN should include packets of normal probe or scanning attack and their related packets. In order to ensure the accuracy of detection, the input data should be as complete as possible but as little redundant as possible. Considering that the scanning behavior of attackers is variable, for example, attacker can launch scanning attack packets in different FSPs and PSPs. Smart attacker can also hide his scanning attack packets among background data stream. Considering that the attack data traffic may have the above characteristics, two different sampling methods are used at the same time, which are continuous sampling and precise sampling. Continuous sampling is used to sample not only probe packet itself but also the after background stream packet, so as to make it possible for the subsequent processing to mine the relationship between the attack packet and the background stream. Precise sampling is used to collect all probe packets since each probe packet could be an attack packet. Precise sampling collects only probe packets. Both precise sampling and continuous sampling are touched off by any of the eight kinds of packets which could be used to probe including ARP request, ICMP echo, ICMP time stamp, ICMP netmask, TCP SYN, TCP ACK, TCP FIN, and UDP empty.


### 4.2.1. Continuous Sampling

For every probe packet, continuous sampling collects some following packets from the same source host. The following packets and probe packet itself form the sampled packets of one continuous sampling.Considering different packets from the same source that host may reach and that are forwarded by different switches, once any switch receives a probe packet, it packets in the probe packet to the controller and raises an event (it is called “event” in RYU platform) of continuous sampling. After that, it is ordered by the controller that every switch in the controlled network should packet in a certain number of following packets sent by the source host of the probe packet in a specified time.


### 4.2.2. Precise Sampling

Precise sampling only pays attention to probe packets. For every probe packet, precise sampling collects some previous probe packets and some following probe packets from the same source. The previous probe packets, following probe packets, and probe packet itself form the sampled packets of one precise sampling.Implementation of precise sampling is similar to continuous sampling, but precise sampling only collects probe packets. Once any switch receives a probe packet, it packets in the probe packet to the controller and raises an event of precise sampling. After that, it is ordered by the controller that every switch in the controlled network should packet in a certain number of following probe packets from the same source in a specified time. The controller has already stored all previous probe packets in the network, and it selects a certain number of previous probe packets from the same source.


## 4.2.1. Continuous Sampling

For every probe packet, continuous sampling collects some following packets from the same source host. The following packets and probe packet itself form the sampled packets of one continuous sampling.Considering different packets from the same source that host may reach and that are forwarded by different switches, once any switch receives a probe packet, it packets in the probe packet to the controller and raises an event (it is called “event” in RYU platform) of continuous sampling. After that, it is ordered by the controller that every switch in the controlled network should packet in a certain number of following packets sent by the source host of the probe packet in a specified time.


## 4.2.2. Precise Sampling

Precise sampling only pays attention to probe packets. For every probe packet, precise sampling collects some previous probe packets and some following probe packets from the same source. The previous probe packets, following probe packets, and probe packet itself form the sampled packets of one precise sampling.Implementation of precise sampling is similar to continuous sampling, but precise sampling only collects probe packets. Once any switch receives a probe packet, it packets in the probe packet to the controller and raises an event of precise sampling. After that, it is ordered by the controller that every switch in the controlled network should packet in a certain number of following probe packets from the same source in a specified time. The controller has already stored all previous probe packets in the network, and it selects a certain number of previous probe packets from the same source.


## 4.3. Data Preprocessing

Our designed CNN detectors will operate on data extracted from sampled packets in order to make a classification whether the packet and its source host are illegal or not. Data extracted from one continuous sampling and one precise sampling combine an input data of CNN detector. The method of data extraction is as follows.Each packet is essentially a binary bitstream. In order to further remove invalid parts from sampled data, only parts that may be related to scanning attack are preserved, while others are discarded. Five parts of each packet (if exist) are preserved, which are(1)
Fixed part of the IP datagram header (160 bits)(2)
Fixed part of the TCP message header (160 bits)(3)
UDP message header (64 bits)(4)
ICMP message header (64 bits)(5)
Ethernet header and ethernet ARP fields of ARP message (42 bits)Content of the packet that does not belong to the above five parts will be discarded. We also notice that since IP hopping system makes the protected network ever-changing, the judgment whether one probe packet is illegal or not should consider the current network situation. For this purpose, we add a flag bit at the end of the binary bitstream extracted from each probe packet, as shown in Figure4. If the probe packet hits a currently used IP address, the flag bit is set 1; otherwise it is set 0.Figure 4
Binary bitstream extracted from a probe packet and the added flag bit.We do not convert these binary bitstreams to integers as [20] does for the purpose of avoiding data confusion and preserving data integrity. Data extracted from each sampled packet were placed end-to-end forming vector F. In order to adapt to convolutional process in CNN detector, vector F is then converted to matrix M. Zero padding is used to ensure a two-dimensional matrix.Since the number of sampled packets may probably be different in each sampling, and the types of packets obtained from each sampling are also different, size ofM is not fixed. To adapt different size of input data, we introduce global pooling to be the last pooling layer in the structure of CNN, which is described in the next subsection.


## 4.4. Designed CNN Detector

CNN has been widely used in network intrusion detection such as [34–37]. Meanwhile, because of its local perceptual processing mode, CNN has special advantage in discovering the local to local correlation in data. As analysis in packets sampling and data process, the local to local correlation in our data may probably be related to the classification (malicious or not). For the structural design of CNN, we have kept adjusting the structure of CNN empirically in a large number of experiments. The adjustment process includes using different activation functions and using convolution kernels of different sizes to make sure the structure is suitable for the judgment on our processed attack traffic data.The CNN detector is designed to be deployed on the controller of SDN. We set two requirements of the deployment of the designed CNN: firstly, there should be no special requirements for hardware performance of the controller; secondly, time consumed in one execution of judgment should not be too long to avoid data piling up. The CNN should be a light-weight detector. The structure of the designed CNN is shown in Figure5, which is composed of three convolutional modules and a judgment module. Each convolutional module is composed of a convolutional layer, a batch normalization layer [38], a ReLU layer [39], and a pooling layer. The reason for using ReLU as activation is that our input data is a binary matrix. ReLU makes different activation for the element greater than 0 and less than 0. The judgment module is composed of a fully connected layer and a Softmax layer.Figure 5
Structure of designed CNN.In Figure5, the boxes with “Conv” mean convolutional layer. The formulas a×b×c×d in “Conv” boxes show the size and shape of convolutional kernel. A convolutional layer inputs d matrixes and outputs a matrixes, and b×c is the size of convolutional kernel on each input matrix. The process of a convolutional layer is shown in(1)Xjout=∑i=1dXiin∗Kij+Bj,where Xjout is the jth output matrix of the layer, Xiin is the ith input matrix of the layer, Kij is a convolutional kernel operated on Xiin and output to Xjout, and Bj is the bias matrix added to the jth output matrix. In (1), ∗ means convolutional operation.The boxes in Figure5 with “Pooling” mean pooling layer. In the boxes of pooling layer, “size” means the size of pooling window and “s” means the stride of pooling operation. The process of pooling layer can be described in(2)x=poolaveR=1R∑r∈Rr,where x is an output neuron, ave means we use average pooling in each pooling layer, R means a pooling region in the input matrix, and r is a neuron in R. Global pooling is operated in the last pooling layer, which means the size of pooling window flexibly is equal to the size of each input matrix of the layer. Global pooling enables the CNN to adapt to different size of input data. The process of convolution and pooling is shown in Figure 6.Figure 6
Convolution and pooling in convolutional neural network.The boxes in Figure5 with “ReLU” mean ReLU layer which is an activation layer. These layers improve the nonlinear factors of CNN and enable the model to fit a problem that linear model cannot. The process of ReLU layer is described in(3)xout=max0,xin,where xout is an output neuron and xin is an input neuron of ReLU layer.The boxes in Figure5 with “BN” mean batch normalization layer. BN layer first normalizes elements in each input feature map to zero-mean and unit-variance to ensure that the input neuron to ReLU falls in the region near value 0, and hence the gradient back-propagation would not fall into poor local minima.The box in Figure5 with “Fully connected” means fully connected layer. In this layer, each output neuron is connected to each input neuron with a weight parameter. The process of this layer is shown in(4)xjout=∑i=1Nfxiin×ωij,where xjout means the jth output neuron of this layer, xiin means the ith input neuron of this layer, Nf means the number of input neurons of this layer, and ωij is the weight parameter of connection between xjout and xiin.The box in Figure5 with “Softmax” means Softmax layer. This layer normalizes the value of neuron to the range of [0, 1] to indicate probabilities of the input data belonging to each class. The process of Softmax layer is shown in(5)xjout=exjin∑i=1Nsexiin,xjout∈0,1,where xjout means the jth output neuron of this layer, exjin and exiin mean jth and ith input neurons of this layer, and Ns means the number of input neurons and is also the number of output neurons of this layer. In our designed CNN, both fully connected layer and Softmax layer output two neurons; one indicates “normal” and the other indicates “malice.”DenoteD⋅ as the process of the trained CNN detector and X as a matrix of input date. Judgment of the CNN detector is shown in (6) where result “1” means “malice” and result “0” means “normal.”(6)DX=0,normal,1,malice.It is obvious that packets sampling occupies the channel between the switch and the controller to some extent. Also, data process and CNN detection consumes the resources on the controller side. In order to mitigate the impact on network QoS, one judgment result will also be applicable for other probe packets from the same source in 1 minute. In the following 1 minute, probe packets from the same source will not raise packets sampling. This also prevents the defense system from being overburdened by an excessive number of probe packets.


## 4.5. IP Hopping Strategy

In this paper, we provide each protected host with a fixed real IP (rIP) and a hopping virtual IP (vIP). In our IP hopping system, IP hopping can be touched off by two kinds of events: the first is the system timer (periodic hopping) and the second is the judgment result of the CNN detector (triggered hopping). Periodic hopping and triggered hopping run independently. The set of periodic hopping is in case that CNN makes missed alert and triggered hopping was not executed in some situation.The notions used in our IP hopping strategy are listed in Table1. Assume the whole protected network has k subnets which are represented by S1,S2,…,Sk. Total l protected hosts are distributed in the k subnets. The l protected hosts are represented by h1,h2,…,hl. IPW, IPR, and IPV represent the whole IP set, the real IP set, and the virtual IP set, respectively, so IPW=IPR∨IPV, rIP∈IPR, and vIP∈IPV. It is impossible to choose vIP from the whole IPV in each hopping, because a range of vIPs can only be assigned to one physical subnet at a given time. We adopt a three-level hopping to assign available vIP space, which are base hopping, low-frequency hopping, and high-frequency hopping. As shown in (7), the IPV set is divided into mB number of base hopping range (BHR) according to the number and scale of subnets, mB≥k.(7)IPV=∑b=1mBRBHRb.Table 1
The notions used in the IP hopping strategy.
CharacterDescriptionrIP, vIPReal IP address and virtual IP addressSi, hiTheith subnet and the ith host in the protected networkIPW, IPR, IPVThe sets of all IP addresses, real IP addresses, and virtual IP addressesRBHRb, RLHRlThebth BHR and the lth LHR in a BHRmB, mLThe number of BHR and the number of LHR in a BHRTBH,TLH,THHTime interval of base hopping, low-frequency hopping, and high-frequency hoppingωB,ωL,ωHWeights of each BHR, LHR. and protected host to characterize attacker’s scanning behaviorrijtA flag to show whetherRBHRj is allocated to Si in tth BHR assignment schemePBH,PLHThresholds to touch off base hopping and low-frequency hoppingHTBi,HTLiHit times of thevIP pool of Si and hiNSiThe number of hosts inSiThen, as shown in (8), each BHR is divided into mL number of low-frequency hopping range (LHR) according to the number of hosts in subnet. Each LHR contains several vIPs, and these vIPs are used for high-frequency hopping.(8)RBHRb=∑l=1mLRLHRl.


### 4.5.1. Periodic Hopping

The IP hopping system periodically refers to three levels of hopping which are base hopping, low-frequency hopping, and high-frequency hopping. Base hopping changes the IP address range assigned to a given subnet with time intervalTBH. Low-frequency hopping changes the IP address ranges assigned to a given host within the corresponding BHR with time interval TLH. High-frequency hopping changes the vIP assigned to a given host within the corresponding LHR with time interval THH.Adaptive IP hopping configuration is an important aspect of adaptability in proposed method. To characterize attacker’s scanning behavior, we associate a weightωB with each BHR, a weight ωL with each LHR, and a weight ωH with each protected host. Higher weight for a range indicates higher attacker activity in that range in the last interval. The value of ωB, ωL, and ωH is computed according to the malicious probe packets in the last interval. These weights will guide the configuration of next hopping.(1) Base Hopping. In base hopping, each subnet will be assigned with one or more BHRs. Denote ωBi as the weight of the RBHRi and NBHRi as the number of vIPs in it. Computation of weight ωBi is in Algorithm 1.Algorithm 1: Computation of weight ωBi in base hopping in periodic hopping.
Require: All detected data X in last base hopping intervalFor all probe packets in the last base hopping intervalIfDX==1 && the target IP is in RBHRiωBi++;End ifEnd forωBi=ωBi/NBHRi;ReturnωBiWhen more than one BHR assignment schemes is available, we choose the scheme that achieves minimal standard deviation of sums of weights of BHRs assigned to a subnet, in order to ensure nearly equal security of each subnet. Denoterijt as a flag. rijt==1 means RBHRj is allocated to Si in the tth assignment scheme, and rijt==0 means RBHRj is not allocated to Si in the tth assignment scheme. In the tth assignment scheme, we compute the standard deviation of sums of weights of BHRs assigned to Si as (9)–(13). Vector W denotes the set of ωB; vector Rit denotes the set of flag rijt; sit denotes the sum of weights of BHRs assigned to Si in the tth BHR assignment scheme. μt denotes the mean, and σt denotes the standard deviation.(9)W=ωB1,ωB2,…,ωBmB,(10)Rit=ri1t,ri2t,…,rimBt,(11)sit=Rit⋅WT,(12)μt=1mB∑i=1mBsit,(13)σt=1mB∑i=1mBsit−μt2.We compareσt in each assignment scheme and select the assignment scheme with minimal σt for next base hopping.(2) Low-Frequency Hopping. Once a subnet is assigned with one or more BHRs, these BHRs are divided into several LHR. For low-frequency hopping, each host will be assigned with one or more LHRs. Each LHR has a weight ωL. The computing method of ωL and the selection of LHR assignment scheme are the same as those of base hopping, so they are not elaborated here.(3) High-Frequency Hopping. Once a host is assigned with one or more LHRs, vIPs in these LHRs form a vIP pool. In high-frequency hopping, a vIP in the pool will be selected and used in next interval. For high-frequency hopping, denote ωHi as the weight of the ith vIP in the pool of a host. Computation of weight ωHi is in Algorithm 2.Algorithm 2: Computation of weight ωHi in high-frequency hopping in periodic hopping.
Require: All detected data X in last high-frequency hopping intervalRequire: vIP pool of the host for high-frequency hoppingFor all probe packets in the last high-frequency hopping intervalIfDX==1 && the target IP is the ith vIP in the poolωHi++;End ifEnd forReturnωHiFor one host, only onevIP can be used at one time. All vIPs in the pool are sorted according to their weights. The vIPs with higher weights will be preferred.


### 4.5.2. Triggered Hopping

In our IP hopping system, the hopping can also be touched off by the judgment result of the CNN detector. Base hopping, low-frequency hopping, and high-frequency hopping will be active in three cases, respectively.(1)
Base Hopping. As in Algorithm 3, in a time interval TBH, if the number of hit times of the vIP pool of a subnet divided by the number of host in the subnet has reached the threshold PBH, a base hopping for the whole protected network should be touched off. Denote HTBi as the number of hit times of the vIP pool of Si.(2)
Low-Frequency Hopping. As in Algorithm 4, in a time interval TLH, if the number of hit times of the vIP pool of host hi has reached the threshold PLH, a low-frequency hopping for the corresponding subnet should be touched off. Denote HTLi as the number of hit times of the vIP pool of hi.(3)
High-Frequency Hopping. As in Algorithm 5, in a time interval THH, if a host is hit by a malicious probe packet, a high-frequency hopping for the host should be touched off.Algorithm 3: Base hopping in triggered hopping.
Require: All detected data X after last base hoppingRequire: vIP pool of SiRequire: Preset threshold PBHHTBi=0;For all probe packetsIfDX==1 && the target IP is in the vIP pool of SiHTBi++;End ifEnd forIfHTBi/NSi≥PBHTriggering base hopping;End ifReturn NullAlgorithm 4: Low-frequency hopping in triggered hopping.
Require: All detected data X after last low-frequency hoppingRequire: vIP pool of hiRequire: Preset threshold PLHHTLi=0;For all probe packetsIfDX==1 && the target IP is in the vIP pool of hiHTLi++;End ifEnd forIfHTLi≥PLHTriggering low-frequency hopping for the corresponding subnet;End ifReturn NullAlgorithm 5: High-frequency hopping in triggered hopping.
Require: All detected data X after last high-frequency hoppingRequire: Currently used IP of hiIfDX==1 && the target IP is at use by hiTriggering high-frequency hopping forhi;End ifReturn NullThe proposed periodic hopping and triggered hopping are both adaptive hopping strategies. On the one hand, they can make protected hosts avoid using IP addresses that attackers may seriously scan, so as to improve the survival rate protected hosts under scanning attack. On the other hand, once a protected host is hit in scanning attack, its used IP address may immediately hop to another one to disable the scanned target in attacker’s hit list.


## 4.5.1. Periodic Hopping

The IP hopping system periodically refers to three levels of hopping which are base hopping, low-frequency hopping, and high-frequency hopping. Base hopping changes the IP address range assigned to a given subnet with time intervalTBH. Low-frequency hopping changes the IP address ranges assigned to a given host within the corresponding BHR with time interval TLH. High-frequency hopping changes the vIP assigned to a given host within the corresponding LHR with time interval THH.Adaptive IP hopping configuration is an important aspect of adaptability in proposed method. To characterize attacker’s scanning behavior, we associate a weightωB with each BHR, a weight ωL with each LHR, and a weight ωH with each protected host. Higher weight for a range indicates higher attacker activity in that range in the last interval. The value of ωB, ωL, and ωH is computed according to the malicious probe packets in the last interval. These weights will guide the configuration of next hopping.(1) Base Hopping. In base hopping, each subnet will be assigned with one or more BHRs. Denote ωBi as the weight of the RBHRi and NBHRi as the number of vIPs in it. Computation of weight ωBi is in Algorithm 1.Algorithm 1: Computation of weight ωBi in base hopping in periodic hopping.
Require: All detected data X in last base hopping intervalFor all probe packets in the last base hopping intervalIfDX==1 && the target IP is in RBHRiωBi++;End ifEnd forωBi=ωBi/NBHRi;ReturnωBiWhen more than one BHR assignment schemes is available, we choose the scheme that achieves minimal standard deviation of sums of weights of BHRs assigned to a subnet, in order to ensure nearly equal security of each subnet. Denoterijt as a flag. rijt==1 means RBHRj is allocated to Si in the tth assignment scheme, and rijt==0 means RBHRj is not allocated to Si in the tth assignment scheme. In the tth assignment scheme, we compute the standard deviation of sums of weights of BHRs assigned to Si as (9)–(13). Vector W denotes the set of ωB; vector Rit denotes the set of flag rijt; sit denotes the sum of weights of BHRs assigned to Si in the tth BHR assignment scheme. μt denotes the mean, and σt denotes the standard deviation.(9)W=ωB1,ωB2,…,ωBmB,(10)Rit=ri1t,ri2t,…,rimBt,(11)sit=Rit⋅WT,(12)μt=1mB∑i=1mBsit,(13)σt=1mB∑i=1mBsit−μt2.We compareσt in each assignment scheme and select the assignment scheme with minimal σt for next base hopping.(2) Low-Frequency Hopping. Once a subnet is assigned with one or more BHRs, these BHRs are divided into several LHR. For low-frequency hopping, each host will be assigned with one or more LHRs. Each LHR has a weight ωL. The computing method of ωL and the selection of LHR assignment scheme are the same as those of base hopping, so they are not elaborated here.(3) High-Frequency Hopping. Once a host is assigned with one or more LHRs, vIPs in these LHRs form a vIP pool. In high-frequency hopping, a vIP in the pool will be selected and used in next interval. For high-frequency hopping, denote ωHi as the weight of the ith vIP in the pool of a host. Computation of weight ωHi is in Algorithm 2.Algorithm 2: Computation of weight ωHi in high-frequency hopping in periodic hopping.
Require: All detected data X in last high-frequency hopping intervalRequire: vIP pool of the host for high-frequency hoppingFor all probe packets in the last high-frequency hopping intervalIfDX==1 && the target IP is the ith vIP in the poolωHi++;End ifEnd forReturnωHiFor one host, only onevIP can be used at one time. All vIPs in the pool are sorted according to their weights. The vIPs with higher weights will be preferred.


## 4.5.2. Triggered Hopping

In our IP hopping system, the hopping can also be touched off by the judgment result of the CNN detector. Base hopping, low-frequency hopping, and high-frequency hopping will be active in three cases, respectively.(1)
Base Hopping. As in Algorithm 3, in a time interval TBH, if the number of hit times of the vIP pool of a subnet divided by the number of host in the subnet has reached the threshold PBH, a base hopping for the whole protected network should be touched off. Denote HTBi as the number of hit times of the vIP pool of Si.(2)
Low-Frequency Hopping. As in Algorithm 4, in a time interval TLH, if the number of hit times of the vIP pool of host hi has reached the threshold PLH, a low-frequency hopping for the corresponding subnet should be touched off. Denote HTLi as the number of hit times of the vIP pool of hi.(3)
High-Frequency Hopping. As in Algorithm 5, in a time interval THH, if a host is hit by a malicious probe packet, a high-frequency hopping for the host should be touched off.Algorithm 3: Base hopping in triggered hopping.
Require: All detected data X after last base hoppingRequire: vIP pool of SiRequire: Preset threshold PBHHTBi=0;For all probe packetsIfDX==1 && the target IP is in the vIP pool of SiHTBi++;End ifEnd forIfHTBi/NSi≥PBHTriggering base hopping;End ifReturn NullAlgorithm 4: Low-frequency hopping in triggered hopping.
Require: All detected data X after last low-frequency hoppingRequire: vIP pool of hiRequire: Preset threshold PLHHTLi=0;For all probe packetsIfDX==1 && the target IP is in the vIP pool of hiHTLi++;End ifEnd forIfHTLi≥PLHTriggering low-frequency hopping for the corresponding subnet;End ifReturn NullAlgorithm 5: High-frequency hopping in triggered hopping.
Require: All detected data X after last high-frequency hoppingRequire: Currently used IP of hiIfDX==1 && the target IP is at use by hiTriggering high-frequency hopping forhi;End ifReturn NullThe proposed periodic hopping and triggered hopping are both adaptive hopping strategies. On the one hand, they can make protected hosts avoid using IP addresses that attackers may seriously scan, so as to improve the survival rate protected hosts under scanning attack. On the other hand, once a protected host is hit in scanning attack, its used IP address may immediately hop to another one to disable the scanned target in attacker’s hit list.


## 5. Implementation and Evaluation

In this section, we firstly introduce the hardware and software platform of our implementation. Then the used network topology and the behavior of attackers are briefly described. Finally we propose three performance indexes to experiment and evaluate the performance of our proposed method.


### 5.1. Hardware and Software Platform

To investigate the effectiveness and scalability of proposed approach, we implemented it on an OpenFlow controller [26] that manages a Mininet network [40]. We used Mininet to create a network of OpenFlow switches (Open vSwitch kernel switches). Ryu platform is used on the controller to deploy the application of proposed IP hopping. We used Tensorflow 1.0 [41] to train and save the CNN model, and the trained model is called from Ryu application to enforce a judgment. The CNN model is trained in GPU mode with a Nvidia K40c, but it is used in CPU mode with Intel Core i7 8700 for the purpose of no high hardware requirements of controller.We use Mininet to create a virtual network which is managed by a remote controller. The virtual network is shown as Figure7. The created virtual network contains 210 hosts. These hosts are distributed in 25 subnets. The number of hosts in each subnet is random. The subnets are connected with each other with OpenFlow switches. Wireshark is used in our Mininet to collect and form data set of probe packets.Figure 7
The topology of Mininet virtual network.To show the effectiveness of the proposed method against hit list attacks, cooperative scanning attack is launched on some host and then may propagate to others. We assume that the scanners are aware of the IP resource pool of the protected network.


### 5.2. Performance Evaluation

Three performance indexes are used to experiment and evaluate the performance of our proposed method which are accuracy and performance of CNN detection, survival rate of protected hosts, and the average lifetime of targets in attack’s hit list. Technologies for performance comparison with our proposed method are OF-RHM [13], SEHT [19], and the method in [12]. In order to ensure fairness, OF-RHM and method in [12] are adjusted to three-level hopping which is consistent with SEHT and proposed method.


#### 5.2.1. Performance of CNN Detection

Accuracy and time efficiency are important indexes of CNN and determine the effectiveness of adaptability of our proposed method. Data extracted from one continuous sampling and one precise sampling combine a sample. We totally collected 10000 samples and these samples make up our data set. The data set is divided into three sets, which are training set, validation set, and testing set. The training set consists of 7000 samples and is used in training the CNN model; validation set consists of 1000 samples and is used to monitor the real time accuracy performance of CNN in the process of training; testing set consists of 2000 samples and is used to finally test the accuracy and time efficiency of CNN detection. Our data set is composed of samples collected from scanners with PSP 20%, 40%, 60%, and 80% and FSP 0.5 s, 1 s, and 2 s. The training phase takes 7.29 hours on our platform.In order to ensure real time of detection, if the amount of data in the queue to be detected reaches three, undetected data except the new arrival one will be discarded (data loss).DenoteAcc as the accuracy of CNN detection, FRR as the false rejection rate, and FAR as the false acceptance rate. Testing performance is shown in Table 2. The proposed CNN performs better under higher PSP.Table 2
Testing performance of the CNN detection.
PSP (%)AccFRRFAR200.76040.21130.2679400.82150.13570.2213600.84830.09280.2107800.96670.01790.0487DenoteTE as time efficiency, which means time consumed in one test including the time of data preprocess and CNN detection. Although the test of CNN is set in CPU mode, TE is only 0.019377 s. Another adaptive hopping method SEHT [19] directly treats all failed probe packets as scanning attacks, so it takes nearly no time to discover scanning attack. However, not distinguishing between scanning attack and normal probe in SEHT makes the result inaccurate. Moreover, SEHT adopts hypothesis tests based on Sibson entropy to discriminate scanning attack strategy. We obtain that TE of hypothesis test in SEHT is about 0.015377 s, which is only slightly better than our proposed CNN. CNN could be retrained through transfer learning to acquire ability of multiclassification to discriminate scanning attack strategy while barely increasing TE.For further research, we calculate the rate of data loss in different number of scanners under nonpropagating scanning.RDL denotes the rate of data loss. Table 3 shows RDLs in different number of scanners (NoS). Obviously, higher FSP and larger NoS cause higher RDL. The reason is that, with higher FSP and larger NoS, the CNN may probably find it more difficult to handle the coming packets in time.Table 3
Rates of data loss (RDL) in different number of scanners.
FSP (s)NoS501001502000.500.35120.40190.546710.34210.53810.60110.660420.51560.74020.83510.8603


#### 5.2.2. Survival Rate of Protected Hosts under Cooperative Scanning Attack

The attacker carries out uniform and unrepeatable scan on the IP space used in protected network. Survival rate of protected hosts denotes the proportion of hosts which are not probed by attacker through a round of attack.(1) Survival Rate under Different Initial Scanners. The survival rates of protected hosts under propagating cooperative scanning attack using different quantity of initial scanners are shown in Figures 8–11. Figure 8 shows survival rate under cooperative worm using 50 scanners; Figure 9 shows survival rate under cooperative worm using 100 scanners; Figure 10 shows survival rate under cooperative worm using 150 scanners; Figure 11 shows survival rate under cooperative worm using 200 scanners. The hyperparameters are set as follows: THH=20s, TLH=40s, TBH=160s, PSP = 60%, FSP = 2 s, PBH=0.5. PLH is equal to half the number of IPs in the IP pool of corresponding host.Figure 8
Survival rate under cooperative scanning (50 scanners).Figure 9
Survival rate under cooperative scanning (100 scanners).Figure 10
Survival rate under cooperative scanning (150 scanners).Figure 11
Survival rate under cooperative scanning (200 scanners).In a static network, the survival rate reaches 0 after spending 101 s–247 s because of using uniform active scanning. Method of OF-RHM can lower the reduction of survival rate and finally improve the minimum survival rate to some extent. The two adaptive methods can significantly lower the reduction of survival rate and finally improve the minimum survival rate. Moreover, performance of our proposed method is slightly better than SEHT. Meanwhile, the defense performance of method in [12] is similar to that of OF-RHM. The proposed method achieves the best result among the five methods, because it can accurately identify scanning attack packets and guide IP hopping of hosts to avoid attack.(2) Minimal Survival Rate under Different Time Intervals. Minimal survival rate denotes the proportion of hosts which are not probed after a round of scanning attack. Table 4 shows ten different time intervals used in our experiments. The minimum survival rates under cooperative worm on IP hopping systems with different time intervals are shown in Figures 12–15. Figure 12 shows the minimum survival rate using 50 scanners; Figure 13 shows the minimum survival rate using 100 scanners; Figure 14 shows the minimum survival rate using 150 scanners; Figure 15 shows the minimum survival rate using 200 scanners. The hyperparameters are set as follows: PSP = 60%, FSP = 2 s, PBH=0.5. PLH is equal to half the number of IPs in the IP pool of corresponding host.Table 4
P1–P10: different settings of three-level time interval (s).
P1P2P3P4P5P6P7P8P9P10THH5101520253035404550TLH102030405060708090100TBH4080120160200240280320360400Figure 12
The minimal survival rates under cooperative scanning with different time intervals (50 scanners).Figure 13
The minimal survival rates under cooperative scanning with different time intervals (100 scanners).Figure 14
The minimal survival rates under cooperative scanning with different time intervals (150 scanners).Figure 15
The minimal survival rates under cooperative scanning with different time intervals (200 scanners).The minimum survival rates under cooperative worm in network with OF-RHM decrease from P1 to P10 and finally reach 0 under P6 to P10. In network with OF-RHM, long time interval makes the network equivalent to a static one. The minimum survival rates under cooperative worm in network with SEHT decrease slightly between P1 and P7 and then go stabilized. The minimum survival rates under cooperative worm in network with the method in [12] are similar to that of OF-RHM. The minimum survival rates under cooperative worm in network with our proposed method decrease the most slightly in the three methods. Because scanning behavior of attacker triggers IP hopping with different levels, our proposed method gets the best performance in the three methods. Using our proposed method, defender can set greater time interval to reduce network resource overhead and the possibility of packet loss.(3) Minimal Survival Rate under Different PSP and FSP. The value of PSP affects the performance of our designed CNN detector, and the value of PSP affects rates of data loss. The minimal survival rates under different PSP and FSP are shown in Table 5. The hyperparameters are set as follows: THH=20s, TLH=40s, TBH=160s, PBH=0.5, NoS=50, and PLH is equal to half the number of IPs in the IP pool of corresponding host.Table 5
Minimal survival rate under different PSP and FSP.
PSP (%)FSPProposed methodSEHT [19]0.5 (s)1 (s)2 (s)0.5 (s)1 (s)2 (s)200.6990.5570.4510.6930.6550.579400.7040.6770.5940.6900.6610.595600.7990.7320.6790.7010.6670.597800.8330.7670.7690.6990.6720.601As shown in Table5, compared with SEHT, our proposed method performs better significantly when PSP = 60% and PSP = 80%; when PSP = 40%, our proposed method performs slightly better than SEHT; when PSP = 20%, our proposed method performs slightly worse except for FSP = 0.5 s. With the decrease of PSP value, the CNN makes more false rejection which weakens the advantage of our proposed method gradually. Lower FSP indicates better performance both in the proposed method and in SEHT. Also notable is that performance of SEHT is not sensitive to change of PSP for the reason that SEHT treats all failed probe packets as scanning attack.


#### 5.2.3. Average Lifetime of Targets in Attack’s Hit List

Worm-type virus and other hit list based network attacks need time long enough to launch. For example, propagation of worm from one host to another must take enough time. IfvIP of target host hopped before the completeness of worm propagation, the worm propagation fails. We compute the average lifetime of targets in attack’s hit list. Reducing lifetime of targets in attack’s hit list is beneficial to reduce the success rate of worm propagation. Lifetime of a target is explained as the duration between receiving response of probe packet from the target host and hopping of IP address of the target host. Figure 16 takes host 1 as an example to explain the meaning of lifetime.Figure 16
Lifetime of host 1 in attacker’s hit list.Figure17 shows the average lifetime of targets using 50 scanners; Figure 18 shows the average lifetime of targets using 100 scanners; Figure 19 shows the average lifetime of targets using 150 scanners; Figure 20 shows the average lifetime of targets using 200 scanners. The hyperparameters are set as follows: PSP = 60%, FSP = 2 s, PBH=0.5. PLH is equal to half the number of IPs in the IP pool of corresponding host.Figure 17
Average lifetime of targets in attacker’s hit list against different time intervals (50 scanners).Figure 18
Average lifetime of targets in attacker’s hit list against different time intervals (100 scanners).Figure 19
Average lifetime of targets in attacker’s hit list against different time intervals (150 scanners).Figure 20
Average lifetime of targets in attacker’s hit list against different time intervals (200 scanners).The average lifetime of targets in our proposed method is significantly lower than methods without CNN assistance. However, we also find that as the number of scanners increases, advantage of our proposed method is weakened gradually. That may be probably because of the increasing rate of data loss.Moreover, we make a comparison of average lifetime between targets caused by discarded data and data not discarded. The result of the comparison is shown in Table6. In Table 6, “NoS” means number of scanners. Once probe packets of attacker are detected, the lifetime of targets caused by these packets can be controlled in less than 1 second. The adaptability of our proposed method driven by CNN can obviously reduce the average lifetime of targets in attack’s hit list. Moreover, improve the efficiency of attack awareness and reduce data loss may probably be our future work.Table 6
The average lifetime (s) of targets in attack’s hit list caused by discarded data and data not discarded in the method of IP hopping with CNN assistance.
NoSStateP1P3P5P8P1050Discarded2.449.1311.8817.3223.55Not discarded0.830.880.890.860.86100Discarded2.679.9912.8719.5425.13Not discarded0.830.870.880.880.89150Discarded2.8110.4313.5519.8026.99Not discarded0.860.860.870.890.87200Discarded2.9210.8814.1620.7228.18Not discarded0.850.860.860.880.86


#### 5.2.4. Hopping Frequency

Once the IP address of a host hops, communication to the host will withstand a short time high delay for the reason of querying and loading new flow table. High delay may affect experience of legal users, so high hopping frequency may not be user friendly. DenoteHFRHM, HFSEHT, and HFPM as the actual hopping frequency of RHM, SEHT, and the proposed method. Hopping frequency here is defined as hopping times divided by time. The hyperparameters are set as follows: PSP = 60%, FSP = 2 s, PBH=0.5, NoS=50. PLH is equal to half the number of IPs in the IP pool of corresponding host.Comparison of hopping frequency in normal period is shown in Table7. In normal period without attack, their hopping frequencies are tested as HF12=HFRHM;HFPM<HFSEHT under a set time interval. The proposed method performs better than SEHT for the reason of nearly not being disturbed by normal probes. Hopping frequency of RHM and the method in [12] is equal to THH. OF-RHM and the method in [12] achieve the best performance because of not conducting any adaptive strategy.Table 7
Hopping frequency (times/s) under different set time intervals in normal period.
Set time intervalOF-RHM [13]SEHT [19]Method in [12]Proposed methodP10.2000.2970.2000.213P40.0500.1660.0500.052P100.0200.1190.0200.023Comparison of hopping frequency in attack period is shown in Table8. In attack period, their hopping frequencies are tested as HFPM<HFSEHT<HFRHM=HF12 when achieving same survival rate. The proposed method acts according to behavior of attack carefully to make each hop as effective as possible. The proposed method performs about 4%–14% better than SEHT and 21%–29% better than OF-RHM and the method in [12].Table 8
Hopping frequency (times/s) under different survival rates in attack period.
Survival rateOF-RHM [13]SEHT [19]Method in [12]Proposed method0.20.0330.0270.0330.0260.40.0670.0540.0670.0490.60.1250.1030.1250.089


### 5.3. Performance Overhead and Limitation

While making some performance breakthroughs, our proposed method does have performance overhead and limitation. Firstly, as detailed in Section4.2, both the used switches and controller should have enough cache space to temporarily store packets related to scanning attack. Secondly, training the CNN detector needs some devices and takes a period of time. Thirdly, our proposed method is designed and deployed in SDN environment. It cannot be used in legacy network environment directly. Adopting our proposed method to legacy network will be our future work.


## 5.1. Hardware and Software Platform

To investigate the effectiveness and scalability of proposed approach, we implemented it on an OpenFlow controller [26] that manages a Mininet network [40]. We used Mininet to create a network of OpenFlow switches (Open vSwitch kernel switches). Ryu platform is used on the controller to deploy the application of proposed IP hopping. We used Tensorflow 1.0 [41] to train and save the CNN model, and the trained model is called from Ryu application to enforce a judgment. The CNN model is trained in GPU mode with a Nvidia K40c, but it is used in CPU mode with Intel Core i7 8700 for the purpose of no high hardware requirements of controller.We use Mininet to create a virtual network which is managed by a remote controller. The virtual network is shown as Figure7. The created virtual network contains 210 hosts. These hosts are distributed in 25 subnets. The number of hosts in each subnet is random. The subnets are connected with each other with OpenFlow switches. Wireshark is used in our Mininet to collect and form data set of probe packets.Figure 7
The topology of Mininet virtual network.To show the effectiveness of the proposed method against hit list attacks, cooperative scanning attack is launched on some host and then may propagate to others. We assume that the scanners are aware of the IP resource pool of the protected network.


## 5.2. Performance Evaluation

Three performance indexes are used to experiment and evaluate the performance of our proposed method which are accuracy and performance of CNN detection, survival rate of protected hosts, and the average lifetime of targets in attack’s hit list. Technologies for performance comparison with our proposed method are OF-RHM [13], SEHT [19], and the method in [12]. In order to ensure fairness, OF-RHM and method in [12] are adjusted to three-level hopping which is consistent with SEHT and proposed method.


### 5.2.1. Performance of CNN Detection

Accuracy and time efficiency are important indexes of CNN and determine the effectiveness of adaptability of our proposed method. Data extracted from one continuous sampling and one precise sampling combine a sample. We totally collected 10000 samples and these samples make up our data set. The data set is divided into three sets, which are training set, validation set, and testing set. The training set consists of 7000 samples and is used in training the CNN model; validation set consists of 1000 samples and is used to monitor the real time accuracy performance of CNN in the process of training; testing set consists of 2000 samples and is used to finally test the accuracy and time efficiency of CNN detection. Our data set is composed of samples collected from scanners with PSP 20%, 40%, 60%, and 80% and FSP 0.5 s, 1 s, and 2 s. The training phase takes 7.29 hours on our platform.In order to ensure real time of detection, if the amount of data in the queue to be detected reaches three, undetected data except the new arrival one will be discarded (data loss).DenoteAcc as the accuracy of CNN detection, FRR as the false rejection rate, and FAR as the false acceptance rate. Testing performance is shown in Table 2. The proposed CNN performs better under higher PSP.Table 2
Testing performance of the CNN detection.
PSP (%)AccFRRFAR200.76040.21130.2679400.82150.13570.2213600.84830.09280.2107800.96670.01790.0487DenoteTE as time efficiency, which means time consumed in one test including the time of data preprocess and CNN detection. Although the test of CNN is set in CPU mode, TE is only 0.019377 s. Another adaptive hopping method SEHT [19] directly treats all failed probe packets as scanning attacks, so it takes nearly no time to discover scanning attack. However, not distinguishing between scanning attack and normal probe in SEHT makes the result inaccurate. Moreover, SEHT adopts hypothesis tests based on Sibson entropy to discriminate scanning attack strategy. We obtain that TE of hypothesis test in SEHT is about 0.015377 s, which is only slightly better than our proposed CNN. CNN could be retrained through transfer learning to acquire ability of multiclassification to discriminate scanning attack strategy while barely increasing TE.For further research, we calculate the rate of data loss in different number of scanners under nonpropagating scanning.RDL denotes the rate of data loss. Table 3 shows RDLs in different number of scanners (NoS). Obviously, higher FSP and larger NoS cause higher RDL. The reason is that, with higher FSP and larger NoS, the CNN may probably find it more difficult to handle the coming packets in time.Table 3
Rates of data loss (RDL) in different number of scanners.
FSP (s)NoS501001502000.500.35120.40190.546710.34210.53810.60110.660420.51560.74020.83510.8603


### 5.2.2. Survival Rate of Protected Hosts under Cooperative Scanning Attack

The attacker carries out uniform and unrepeatable scan on the IP space used in protected network. Survival rate of protected hosts denotes the proportion of hosts which are not probed by attacker through a round of attack.(1) Survival Rate under Different Initial Scanners. The survival rates of protected hosts under propagating cooperative scanning attack using different quantity of initial scanners are shown in Figures 8–11. Figure 8 shows survival rate under cooperative worm using 50 scanners; Figure 9 shows survival rate under cooperative worm using 100 scanners; Figure 10 shows survival rate under cooperative worm using 150 scanners; Figure 11 shows survival rate under cooperative worm using 200 scanners. The hyperparameters are set as follows: THH=20s, TLH=40s, TBH=160s, PSP = 60%, FSP = 2 s, PBH=0.5. PLH is equal to half the number of IPs in the IP pool of corresponding host.Figure 8
Survival rate under cooperative scanning (50 scanners).Figure 9
Survival rate under cooperative scanning (100 scanners).Figure 10
Survival rate under cooperative scanning (150 scanners).Figure 11
Survival rate under cooperative scanning (200 scanners).In a static network, the survival rate reaches 0 after spending 101 s–247 s because of using uniform active scanning. Method of OF-RHM can lower the reduction of survival rate and finally improve the minimum survival rate to some extent. The two adaptive methods can significantly lower the reduction of survival rate and finally improve the minimum survival rate. Moreover, performance of our proposed method is slightly better than SEHT. Meanwhile, the defense performance of method in [12] is similar to that of OF-RHM. The proposed method achieves the best result among the five methods, because it can accurately identify scanning attack packets and guide IP hopping of hosts to avoid attack.(2) Minimal Survival Rate under Different Time Intervals. Minimal survival rate denotes the proportion of hosts which are not probed after a round of scanning attack. Table 4 shows ten different time intervals used in our experiments. The minimum survival rates under cooperative worm on IP hopping systems with different time intervals are shown in Figures 12–15. Figure 12 shows the minimum survival rate using 50 scanners; Figure 13 shows the minimum survival rate using 100 scanners; Figure 14 shows the minimum survival rate using 150 scanners; Figure 15 shows the minimum survival rate using 200 scanners. The hyperparameters are set as follows: PSP = 60%, FSP = 2 s, PBH=0.5. PLH is equal to half the number of IPs in the IP pool of corresponding host.Table 4
P1–P10: different settings of three-level time interval (s).
P1P2P3P4P5P6P7P8P9P10THH5101520253035404550TLH102030405060708090100TBH4080120160200240280320360400Figure 12
The minimal survival rates under cooperative scanning with different time intervals (50 scanners).Figure 13
The minimal survival rates under cooperative scanning with different time intervals (100 scanners).Figure 14
The minimal survival rates under cooperative scanning with different time intervals (150 scanners).Figure 15
The minimal survival rates under cooperative scanning with different time intervals (200 scanners).The minimum survival rates under cooperative worm in network with OF-RHM decrease from P1 to P10 and finally reach 0 under P6 to P10. In network with OF-RHM, long time interval makes the network equivalent to a static one. The minimum survival rates under cooperative worm in network with SEHT decrease slightly between P1 and P7 and then go stabilized. The minimum survival rates under cooperative worm in network with the method in [12] are similar to that of OF-RHM. The minimum survival rates under cooperative worm in network with our proposed method decrease the most slightly in the three methods. Because scanning behavior of attacker triggers IP hopping with different levels, our proposed method gets the best performance in the three methods. Using our proposed method, defender can set greater time interval to reduce network resource overhead and the possibility of packet loss.(3) Minimal Survival Rate under Different PSP and FSP. The value of PSP affects the performance of our designed CNN detector, and the value of PSP affects rates of data loss. The minimal survival rates under different PSP and FSP are shown in Table 5. The hyperparameters are set as follows: THH=20s, TLH=40s, TBH=160s, PBH=0.5, NoS=50, and PLH is equal to half the number of IPs in the IP pool of corresponding host.Table 5
Minimal survival rate under different PSP and FSP.
PSP (%)FSPProposed methodSEHT [19]0.5 (s)1 (s)2 (s)0.5 (s)1 (s)2 (s)200.6990.5570.4510.6930.6550.579400.7040.6770.5940.6900.6610.595600.7990.7320.6790.7010.6670.597800.8330.7670.7690.6990.6720.601As shown in Table5, compared with SEHT, our proposed method performs better significantly when PSP = 60% and PSP = 80%; when PSP = 40%, our proposed method performs slightly better than SEHT; when PSP = 20%, our proposed method performs slightly worse except for FSP = 0.5 s. With the decrease of PSP value, the CNN makes more false rejection which weakens the advantage of our proposed method gradually. Lower FSP indicates better performance both in the proposed method and in SEHT. Also notable is that performance of SEHT is not sensitive to change of PSP for the reason that SEHT treats all failed probe packets as scanning attack.


### 5.2.3. Average Lifetime of Targets in Attack’s Hit List

Worm-type virus and other hit list based network attacks need time long enough to launch. For example, propagation of worm from one host to another must take enough time. IfvIP of target host hopped before the completeness of worm propagation, the worm propagation fails. We compute the average lifetime of targets in attack’s hit list. Reducing lifetime of targets in attack’s hit list is beneficial to reduce the success rate of worm propagation. Lifetime of a target is explained as the duration between receiving response of probe packet from the target host and hopping of IP address of the target host. Figure 16 takes host 1 as an example to explain the meaning of lifetime.Figure 16
Lifetime of host 1 in attacker’s hit list.Figure17 shows the average lifetime of targets using 50 scanners; Figure 18 shows the average lifetime of targets using 100 scanners; Figure 19 shows the average lifetime of targets using 150 scanners; Figure 20 shows the average lifetime of targets using 200 scanners. The hyperparameters are set as follows: PSP = 60%, FSP = 2 s, PBH=0.5. PLH is equal to half the number of IPs in the IP pool of corresponding host.Figure 17
Average lifetime of targets in attacker’s hit list against different time intervals (50 scanners).Figure 18
Average lifetime of targets in attacker’s hit list against different time intervals (100 scanners).Figure 19
Average lifetime of targets in attacker’s hit list against different time intervals (150 scanners).Figure 20
Average lifetime of targets in attacker’s hit list against different time intervals (200 scanners).The average lifetime of targets in our proposed method is significantly lower than methods without CNN assistance. However, we also find that as the number of scanners increases, advantage of our proposed method is weakened gradually. That may be probably because of the increasing rate of data loss.Moreover, we make a comparison of average lifetime between targets caused by discarded data and data not discarded. The result of the comparison is shown in Table6. In Table 6, “NoS” means number of scanners. Once probe packets of attacker are detected, the lifetime of targets caused by these packets can be controlled in less than 1 second. The adaptability of our proposed method driven by CNN can obviously reduce the average lifetime of targets in attack’s hit list. Moreover, improve the efficiency of attack awareness and reduce data loss may probably be our future work.Table 6
The average lifetime (s) of targets in attack’s hit list caused by discarded data and data not discarded in the method of IP hopping with CNN assistance.
NoSStateP1P3P5P8P1050Discarded2.449.1311.8817.3223.55Not discarded0.830.880.890.860.86100Discarded2.679.9912.8719.5425.13Not discarded0.830.870.880.880.89150Discarded2.8110.4313.5519.8026.99Not discarded0.860.860.870.890.87200Discarded2.9210.8814.1620.7228.18Not discarded0.850.860.860.880.86


### 5.2.4. Hopping Frequency

Once the IP address of a host hops, communication to the host will withstand a short time high delay for the reason of querying and loading new flow table. High delay may affect experience of legal users, so high hopping frequency may not be user friendly. DenoteHFRHM, HFSEHT, and HFPM as the actual hopping frequency of RHM, SEHT, and the proposed method. Hopping frequency here is defined as hopping times divided by time. The hyperparameters are set as follows: PSP = 60%, FSP = 2 s, PBH=0.5, NoS=50. PLH is equal to half the number of IPs in the IP pool of corresponding host.Comparison of hopping frequency in normal period is shown in Table7. In normal period without attack, their hopping frequencies are tested as HF12=HFRHM;HFPM<HFSEHT under a set time interval. The proposed method performs better than SEHT for the reason of nearly not being disturbed by normal probes. Hopping frequency of RHM and the method in [12] is equal to THH. OF-RHM and the method in [12] achieve the best performance because of not conducting any adaptive strategy.Table 7
Hopping frequency (times/s) under different set time intervals in normal period.
Set time intervalOF-RHM [13]SEHT [19]Method in [12]Proposed methodP10.2000.2970.2000.213P40.0500.1660.0500.052P100.0200.1190.0200.023Comparison of hopping frequency in attack period is shown in Table8. In attack period, their hopping frequencies are tested as HFPM<HFSEHT<HFRHM=HF12 when achieving same survival rate. The proposed method acts according to behavior of attack carefully to make each hop as effective as possible. The proposed method performs about 4%–14% better than SEHT and 21%–29% better than OF-RHM and the method in [12].Table 8
Hopping frequency (times/s) under different survival rates in attack period.
Survival rateOF-RHM [13]SEHT [19]Method in [12]Proposed method0.20.0330.0270.0330.0260.40.0670.0540.0670.0490.60.1250.1030.1250.089


## 5.2.1. Performance of CNN Detection

Accuracy and time efficiency are important indexes of CNN and determine the effectiveness of adaptability of our proposed method. Data extracted from one continuous sampling and one precise sampling combine a sample. We totally collected 10000 samples and these samples make up our data set. The data set is divided into three sets, which are training set, validation set, and testing set. The training set consists of 7000 samples and is used in training the CNN model; validation set consists of 1000 samples and is used to monitor the real time accuracy performance of CNN in the process of training; testing set consists of 2000 samples and is used to finally test the accuracy and time efficiency of CNN detection. Our data set is composed of samples collected from scanners with PSP 20%, 40%, 60%, and 80% and FSP 0.5 s, 1 s, and 2 s. The training phase takes 7.29 hours on our platform.In order to ensure real time of detection, if the amount of data in the queue to be detected reaches three, undetected data except the new arrival one will be discarded (data loss).DenoteAcc as the accuracy of CNN detection, FRR as the false rejection rate, and FAR as the false acceptance rate. Testing performance is shown in Table 2. The proposed CNN performs better under higher PSP.Table 2
Testing performance of the CNN detection.
PSP (%)AccFRRFAR200.76040.21130.2679400.82150.13570.2213600.84830.09280.2107800.96670.01790.0487DenoteTE as time efficiency, which means time consumed in one test including the time of data preprocess and CNN detection. Although the test of CNN is set in CPU mode, TE is only 0.019377 s. Another adaptive hopping method SEHT [19] directly treats all failed probe packets as scanning attacks, so it takes nearly no time to discover scanning attack. However, not distinguishing between scanning attack and normal probe in SEHT makes the result inaccurate. Moreover, SEHT adopts hypothesis tests based on Sibson entropy to discriminate scanning attack strategy. We obtain that TE of hypothesis test in SEHT is about 0.015377 s, which is only slightly better than our proposed CNN. CNN could be retrained through transfer learning to acquire ability of multiclassification to discriminate scanning attack strategy while barely increasing TE.For further research, we calculate the rate of data loss in different number of scanners under nonpropagating scanning.RDL denotes the rate of data loss. Table 3 shows RDLs in different number of scanners (NoS). Obviously, higher FSP and larger NoS cause higher RDL. The reason is that, with higher FSP and larger NoS, the CNN may probably find it more difficult to handle the coming packets in time.Table 3
Rates of data loss (RDL) in different number of scanners.
FSP (s)NoS501001502000.500.35120.40190.546710.34210.53810.60110.660420.51560.74020.83510.8603


## 5.2.2. Survival Rate of Protected Hosts under Cooperative Scanning Attack

The attacker carries out uniform and unrepeatable scan on the IP space used in protected network. Survival rate of protected hosts denotes the proportion of hosts which are not probed by attacker through a round of attack.(1) Survival Rate under Different Initial Scanners. The survival rates of protected hosts under propagating cooperative scanning attack using different quantity of initial scanners are shown in Figures 8–11. Figure 8 shows survival rate under cooperative worm using 50 scanners; Figure 9 shows survival rate under cooperative worm using 100 scanners; Figure 10 shows survival rate under cooperative worm using 150 scanners; Figure 11 shows survival rate under cooperative worm using 200 scanners. The hyperparameters are set as follows: THH=20s, TLH=40s, TBH=160s, PSP = 60%, FSP = 2 s, PBH=0.5. PLH is equal to half the number of IPs in the IP pool of corresponding host.Figure 8
Survival rate under cooperative scanning (50 scanners).Figure 9
Survival rate under cooperative scanning (100 scanners).Figure 10
Survival rate under cooperative scanning (150 scanners).Figure 11
Survival rate under cooperative scanning (200 scanners).In a static network, the survival rate reaches 0 after spending 101 s–247 s because of using uniform active scanning. Method of OF-RHM can lower the reduction of survival rate and finally improve the minimum survival rate to some extent. The two adaptive methods can significantly lower the reduction of survival rate and finally improve the minimum survival rate. Moreover, performance of our proposed method is slightly better than SEHT. Meanwhile, the defense performance of method in [12] is similar to that of OF-RHM. The proposed method achieves the best result among the five methods, because it can accurately identify scanning attack packets and guide IP hopping of hosts to avoid attack.(2) Minimal Survival Rate under Different Time Intervals. Minimal survival rate denotes the proportion of hosts which are not probed after a round of scanning attack. Table 4 shows ten different time intervals used in our experiments. The minimum survival rates under cooperative worm on IP hopping systems with different time intervals are shown in Figures 12–15. Figure 12 shows the minimum survival rate using 50 scanners; Figure 13 shows the minimum survival rate using 100 scanners; Figure 14 shows the minimum survival rate using 150 scanners; Figure 15 shows the minimum survival rate using 200 scanners. The hyperparameters are set as follows: PSP = 60%, FSP = 2 s, PBH=0.5. PLH is equal to half the number of IPs in the IP pool of corresponding host.Table 4
P1–P10: different settings of three-level time interval (s).
P1P2P3P4P5P6P7P8P9P10THH5101520253035404550TLH102030405060708090100TBH4080120160200240280320360400Figure 12
The minimal survival rates under cooperative scanning with different time intervals (50 scanners).Figure 13
The minimal survival rates under cooperative scanning with different time intervals (100 scanners).Figure 14
The minimal survival rates under cooperative scanning with different time intervals (150 scanners).Figure 15
The minimal survival rates under cooperative scanning with different time intervals (200 scanners).The minimum survival rates under cooperative worm in network with OF-RHM decrease from P1 to P10 and finally reach 0 under P6 to P10. In network with OF-RHM, long time interval makes the network equivalent to a static one. The minimum survival rates under cooperative worm in network with SEHT decrease slightly between P1 and P7 and then go stabilized. The minimum survival rates under cooperative worm in network with the method in [12] are similar to that of OF-RHM. The minimum survival rates under cooperative worm in network with our proposed method decrease the most slightly in the three methods. Because scanning behavior of attacker triggers IP hopping with different levels, our proposed method gets the best performance in the three methods. Using our proposed method, defender can set greater time interval to reduce network resource overhead and the possibility of packet loss.(3) Minimal Survival Rate under Different PSP and FSP. The value of PSP affects the performance of our designed CNN detector, and the value of PSP affects rates of data loss. The minimal survival rates under different PSP and FSP are shown in Table 5. The hyperparameters are set as follows: THH=20s, TLH=40s, TBH=160s, PBH=0.5, NoS=50, and PLH is equal to half the number of IPs in the IP pool of corresponding host.Table 5
Minimal survival rate under different PSP and FSP.
PSP (%)FSPProposed methodSEHT [19]0.5 (s)1 (s)2 (s)0.5 (s)1 (s)2 (s)200.6990.5570.4510.6930.6550.579400.7040.6770.5940.6900.6610.595600.7990.7320.6790.7010.6670.597800.8330.7670.7690.6990.6720.601As shown in Table5, compared with SEHT, our proposed method performs better significantly when PSP = 60% and PSP = 80%; when PSP = 40%, our proposed method performs slightly better than SEHT; when PSP = 20%, our proposed method performs slightly worse except for FSP = 0.5 s. With the decrease of PSP value, the CNN makes more false rejection which weakens the advantage of our proposed method gradually. Lower FSP indicates better performance both in the proposed method and in SEHT. Also notable is that performance of SEHT is not sensitive to change of PSP for the reason that SEHT treats all failed probe packets as scanning attack.


## 5.2.3. Average Lifetime of Targets in Attack’s Hit List

Worm-type virus and other hit list based network attacks need time long enough to launch. For example, propagation of worm from one host to another must take enough time. IfvIP of target host hopped before the completeness of worm propagation, the worm propagation fails. We compute the average lifetime of targets in attack’s hit list. Reducing lifetime of targets in attack’s hit list is beneficial to reduce the success rate of worm propagation. Lifetime of a target is explained as the duration between receiving response of probe packet from the target host and hopping of IP address of the target host. Figure 16 takes host 1 as an example to explain the meaning of lifetime.Figure 16
Lifetime of host 1 in attacker’s hit list.Figure17 shows the average lifetime of targets using 50 scanners; Figure 18 shows the average lifetime of targets using 100 scanners; Figure 19 shows the average lifetime of targets using 150 scanners; Figure 20 shows the average lifetime of targets using 200 scanners. The hyperparameters are set as follows: PSP = 60%, FSP = 2 s, PBH=0.5. PLH is equal to half the number of IPs in the IP pool of corresponding host.Figure 17
Average lifetime of targets in attacker’s hit list against different time intervals (50 scanners).Figure 18
Average lifetime of targets in attacker’s hit list against different time intervals (100 scanners).Figure 19
Average lifetime of targets in attacker’s hit list against different time intervals (150 scanners).Figure 20
Average lifetime of targets in attacker’s hit list against different time intervals (200 scanners).The average lifetime of targets in our proposed method is significantly lower than methods without CNN assistance. However, we also find that as the number of scanners increases, advantage of our proposed method is weakened gradually. That may be probably because of the increasing rate of data loss.Moreover, we make a comparison of average lifetime between targets caused by discarded data and data not discarded. The result of the comparison is shown in Table6. In Table 6, “NoS” means number of scanners. Once probe packets of attacker are detected, the lifetime of targets caused by these packets can be controlled in less than 1 second. The adaptability of our proposed method driven by CNN can obviously reduce the average lifetime of targets in attack’s hit list. Moreover, improve the efficiency of attack awareness and reduce data loss may probably be our future work.Table 6
The average lifetime (s) of targets in attack’s hit list caused by discarded data and data not discarded in the method of IP hopping with CNN assistance.
NoSStateP1P3P5P8P1050Discarded2.449.1311.8817.3223.55Not discarded0.830.880.890.860.86100Discarded2.679.9912.8719.5425.13Not discarded0.830.870.880.880.89150Discarded2.8110.4313.5519.8026.99Not discarded0.860.860.870.890.87200Discarded2.9210.8814.1620.7228.18Not discarded0.850.860.860.880.86


## 5.2.4. Hopping Frequency

Once the IP address of a host hops, communication to the host will withstand a short time high delay for the reason of querying and loading new flow table. High delay may affect experience of legal users, so high hopping frequency may not be user friendly. DenoteHFRHM, HFSEHT, and HFPM as the actual hopping frequency of RHM, SEHT, and the proposed method. Hopping frequency here is defined as hopping times divided by time. The hyperparameters are set as follows: PSP = 60%, FSP = 2 s, PBH=0.5, NoS=50. PLH is equal to half the number of IPs in the IP pool of corresponding host.Comparison of hopping frequency in normal period is shown in Table7. In normal period without attack, their hopping frequencies are tested as HF12=HFRHM;HFPM<HFSEHT under a set time interval. The proposed method performs better than SEHT for the reason of nearly not being disturbed by normal probes. Hopping frequency of RHM and the method in [12] is equal to THH. OF-RHM and the method in [12] achieve the best performance because of not conducting any adaptive strategy.Table 7
Hopping frequency (times/s) under different set time intervals in normal period.
Set time intervalOF-RHM [13]SEHT [19]Method in [12]Proposed methodP10.2000.2970.2000.213P40.0500.1660.0500.052P100.0200.1190.0200.023Comparison of hopping frequency in attack period is shown in Table8. In attack period, their hopping frequencies are tested as HFPM<HFSEHT<HFRHM=HF12 when achieving same survival rate. The proposed method acts according to behavior of attack carefully to make each hop as effective as possible. The proposed method performs about 4%–14% better than SEHT and 21%–29% better than OF-RHM and the method in [12].Table 8
Hopping frequency (times/s) under different survival rates in attack period.
Survival rateOF-RHM [13]SEHT [19]Method in [12]Proposed method0.20.0330.0270.0330.0260.40.0670.0540.0670.0490.60.1250.1030.1250.089


## 5.3. Performance Overhead and Limitation

While making some performance breakthroughs, our proposed method does have performance overhead and limitation. Firstly, as detailed in Section4.2, both the used switches and controller should have enough cache space to temporarily store packets related to scanning attack. Secondly, training the CNN detector needs some devices and takes a period of time. Thirdly, our proposed method is designed and deployed in SDN environment. It cannot be used in legacy network environment directly. Adopting our proposed method to legacy network will be our future work.


## 6. Conclusions

Faced with scanning attack, in order to improve the effectiveness of IP hopping defense, this paper proposes an adaptive moving target defense system, which uses a designed light-weight CNN to sense changeable attack behavior and guide IP hopping defense. In terms of security, experiment result shows that the proposed method achieves better effectiveness of defense for it performs better under the indexes of survival rate of protected hosts and average lifetime of targets in attack’s hit list compared with other methods. In terms of usability, experiment result shows that, when achieving same defense effect, the proposed method only needs lower hopping frequency, thus with lower overhead than other existing methods.Our following work includes firstly improving the structure of CNN detector to improve the processing efficiency while keeping the accuracy, so as to reduce the rate of data loss and achieve better security of protected network; secondly, applying the proposed method to different scanning strategies such as follow-up scanning; thirdly, exploring the deployment scheme of our proposed method in legacy network.



---

*Source: 8848473-2021-08-15.xml*