Evolutionary drift models for moving target defense

One of the biggest challenges faced by cyber defenders is that attacks evolve more rapidly than our ability to recognize them. We propose a moving target defense concept in which the means of detection is set in motion. This is done by moving away from static signature-based detection and instead adopting biological modeling techniques that describe families of related sequences. We present here one example for how to apply evolutionary models to cyber sequences, and demonstrate the feasibility of this technique on analysis of a complex, evolving software project. Specifically, we applied sequence-based and profile-based evolutionary models and report the ability of these models to recognize highly volatile code regions. We found that different drift models reliably identify different types of evolutionarily related code regions. The impact is that these (and possibly other) evolutionary models could be used in a moving target defense in which the "signature" being used to detect sequence-based behaviors is not a fixed signature but one that can recognize new variants of a known family based on multiple evolutionary models.