Huangxin Wang

A moving target DDoS defense mechanism

In this paper, we introduce a moving target defense mechanism that defends authenticated clients against Internet service DDoS attacks. Our mechanism employs a group of dynamic, hidden proxies to relay traffic between authenticated clients and servers. By continuously replacing attacked proxies with backup proxies and reassigning (shuffling) the attacked clients onto the new proxies, innocent clients are segregated from malicious insiders through a series of shuffles. To accelerate the process of insider segregation, we designed an efficient greedy algorithm which is proven to have near optimal empirical performance. In addition, the insider quarantine capability of this greedy algorithm is studied and quantified to enable defenders to estimate the resource required to defend against DDoS attacks and meet defined QoS levels under various attack scenarios. Simulations were then performed which confirmed the theoretical results and showed that our mechanism is effective in mitigating the effects of a DDoS attack. The simulations also demonstrated that the overhead introduced by the shuffling procedure is low.

Towards Cost-Effective Moving Target Defense Against DDoS and Covert Channel Attacks

Traditionally, network and system configurations are static. Attackers have plenty of time to exploit the systems vulnerabilities and thus they are able to choose when to launch attacks wisely to maximize the damage. An unpredictable system configuration can significantly lift the bar for attackers to conduct successful attacks. Recent years, moving target defense (MTD) has been advocated for this purpose. An MTD mechanism aims to introduce dynamics to the system through changing its configuration continuously over time, which we call adaptations. Though promising, the dynamic system reconfiguration introduces overhead to the applications currently running in the system. It is critical to determine the right time to conduct adaptations and to balance the overhead afforded and the security levels guaranteed. This problem is known as the MTD timing problem. Little prior work has been done to investigate the right time in making adaptations. In this paper, we take the first step to both theoretically and experimentally study the timing problem in moving target defenses. For a broad family of attacks including DDoS attacks and cloud covert channel attacks, we model this problem as a renewal reward process and propose an optimal algorithm in deciding the right time to make adaptations with the objective of minimizing the long-term cost rate. In our experiments, both DDoS attacks and cloud covert channel attacks are studied. Simulations based on real network traffic traces are conducted and we demonstrate that our proposed algorithm outperforms known adaptation schemes.

Incentive mechanisms to enable fair renewable energy trade in smart grids

In this paper, we build up a renewable/green energy trading market for users in smart grids. Recently, more and more residential homes are equipped with solar panels to generate and consume renewable green solar energy. Unfortunately, there usually exists a mismatch between the supply and the demand of renewable energy for individual users. Thus, a market in which users can trade surplus green energy in order to serve their future demands is highly desired. In building up such a market, we need to guarantee fairness among non-cooperative users and provide an efficient incentive mechanism based on up-to-date battery and grid technologies. In this work, we propose a market model for trading green energy, design provable efficient incentive algorithms, and conduct experiments on real traces under various performance measures. We conclude that our scheme outperforms existing approaches in terms of fairness while it maintains the best-achievable green energy resource usage.