TY  - GEN
A1  - Torkura, Kennedy A.
A1  - Sukmana, Muhammad Ihsan Haikal
A1  - Kayem, Anne V. D. M.
A1  - Cheng, Feng
A1  - Meinel, Christoph
T1  - A cyber risk based moving target defense mechanism for microservice architectures
T2  - IEEE Intl Conf on Parallel & Distributed Processing with Applications, Ubiquitous Computing & Communications, Big Data & Cloud Computing, Social Computing & Networking, Sustainable Computing & Communications (ISPA/IUCC/BDCloud/SocialCom/SustainCom)
N2  - Microservice Architectures (MSA) structure applications as a collection of loosely coupled services that implement business capabilities. The key advantages of MSA include inherent support for continuous deployment of large complex applications, agility and enhanced productivity. However, studies indicate that most MSA are homogeneous, and introduce shared vulnerabilites, thus vulnerable to multi-step attacks, which are economics-of-scale incentives to attackers. In this paper, we address the issue of shared vulnerabilities in microservices with a novel solution based on the concept of Moving Target Defenses (MTD). Our mechanism works by performing risk analysis against microservices to detect and prioritize vulnerabilities. Thereafter, security risk-oriented software diversification is employed, guided by a defined diversification index. The diversification is performed at runtime, leveraging both model and template based automatic code generation techniques to automatically transform programming languages and container images of the microservices. Consequently, the microservices attack surfaces are altered thereby introducing uncertainty for attackers while reducing the attackability of the microservices. Our experiments demonstrate the efficiency of our solution, with an average success rate of over 70% attack surface randomization.
KW  - Security Risk Assessment
KW  - Security Metrics
KW  - Moving Target Defense
KW  - Microservices Security
KW  - Application Container Security
Y1  - 2018
SN  - 978-1-7281-1141-4
U6  - https://doi.org/10.1109/BDCloud.2018.00137
SN  - 2158-9178
SP  - 932
EP  - 939
PB  - Institute of Electrical and Electronics Engineers
CY  - Los Alamitos
ER  -