Random domain name and address mutation (RDAM) for thwarting reconnaissance attacks

Area of Science:

• Cybersecurity
• Network Security
• Computer Science

Background:

• Network address shuffling is a moving target defense (MTD) strategy.
• Existing MTDs face limitations with finite address spaces and static domain names, leaving them vulnerable to sophisticated attacks.

Purpose of the Study:

• To propose a novel network defense method, Random Domain Name and Address Mutation (RDAM).
• To enhance protection against scanning attacks and worm propagation by increasing the attacker's scanning space.

Main Methods:

• RDAM utilizes dynamic domain name mutation.
• Employs Domain Name System (DNS) query lists and time window methods to reduce host vulnerability.
• Increases the attacker's scanning space through dynamic domain name generation.

Main Results:

• RDAM demonstrates superior defense capabilities against scanning attacks and worm propagation compared to traditional network address shuffling.
• The proposed method effectively mitigates threats by invalidating attacker-collected address information.
• RDAM introduces acceptable operational overhead.

Conclusions:

• RDAM offers a more robust defense against network scanning and worm propagation.
• The dynamic mutation of domain names and addresses significantly enhances network security.
• This approach provides a viable and effective solution for improving network resilience.