Network scanning is a critical preliminary step for most adversaries to gain essential information before launching cyber attacks. Moving Target Defense (MTD) based on IP shuffling has emerged as a proactive defense strategy to counteract these reconnaissance efforts. Unlike static, reactive defense techniques, IP shuffling introduces randomness by dynamically reassigning network addresses, making it more challenging for attackers to identify and track targets. However, current IP shuffling methods face three key challenges: 1) limited scalability across different network topologies, 2) inherent reconfiguration overhead even in the absence of an active attack, and 3) the need for large-scale unused address blocks. To address these issues, we propose LSTM Look-ahead Moving Target Defense (LLM). Our approach is the first attempt using a Long Short-Term Memory (LSTM) network to predict future target addresses that attackers will likely scan. Ensemble learning is used to improve robustness to different scanning behaviors. We introduce a dynamic mutation mechanism to enhance adaptability. Compared to the baseline mutation strategy, LLM performs better in both security and overhead.

翻译：网络扫描是大多数攻击者在发起网络攻击前获取关键信息的重要预备步骤。基于IP地址跳变的移动目标防御（MTD）已成为对抗此类侦察行为的一种主动防御策略。与静态、被动式的防御技术不同，IP地址跳变通过动态重新分配网络地址引入随机性，使攻击者更难识别和追踪目标。然而，当前IP跳变方法面临三个关键挑战：1）在不同网络拓扑结构下的可扩展性有限；2）即使没有活跃攻击，也存在固有的重配置开销；3）需要大规模未使用的地址块。为解决这些问题，我们提出了LSTM前瞻式移动目标防御（LLM）。该方法首次尝试利用长短期记忆（LSTM）网络来预测攻击者可能扫描的未来目标地址。采用集成学习以增强对多种扫描行为的鲁棒性，并引入动态变异机制提升适应性。与基线变异策略相比，LLM在安全性和开销方面均表现更优。