Aggressive network path randomisation drops multi-stage attack success rates to between 4 and 20 per cent, according to a new arXiv preprint released on 15 July [S1]. The same approach stretches attack completion times to 160 to 311 seconds and lifts network throughput by up to 30.9 per cent [S1]. But the framework that produced those numbers also tackles a problem that has held the entire field back for years.

The problem with shuffling the network

Moving Target Defence, or MTD, works on a simple idea: if the network keeps changing, the attacker keeps losing. Routes shift and paths randomise, so the map an attacker built five minutes ago is already wrong [S1]. Software-Defined Networking (SDN) makes this possible by letting defenders reprogram traffic paths on the fly, without rewiring anything physical.

The concept has been around for years. The problem is that nobody agrees on how to test it. Existing evaluations disagree on basic assumptions about attackers and attack scenarios, and they use incompatible metrics, so results are impossible to compare side by side [S1]. One lab's "effective" is another lab's "barely works." The five authors, Mohammad Farhad, Mohoshin Ara Tahera, Padam Jung Thapa, Shuvalaxmi Dass, and Bhupendra Acharya [P2], built their new framework, MTD-Playground, to fix exactly this [S1].

What MTD-Playground actually does

The framework, described in a preprint that has not been peer-reviewed [S1], benchmarks one specific flavour of MTD: SDN-enabled path randomisation, or PR-MTD. Instead of testing a single attack against a single defence, it runs composite evaluations that measure three things at once: how well the defence deploys, what happens when you change the mutation interval (how often paths shuffle), and where the balance of power sits between attacker and defender [S1].

Think of the mutation interval as how often the network reshuffles its internal roads. Short intervals mean the attacker's map goes stale faster. Long intervals give the attacker more time to work.

The results are stark. With aggressive mutation, attack success rates fall to 4 to 20 per cent across the evaluated scenarios [S1]. Attack completion times blow out to 160 to 311 seconds [S1]. And in a finding that should surprise network engineers who assume security always costs performance, throughput rises by as much as 30.9 per cent under PR-MTD, with internal-path latency dropping and no service interruption [S1].

What it means

For a reader with no background in network security, here is the plain version. Most networks are static. The routes between servers, databases, and gateways stay the same for days or weeks. An attacker who maps those routes can move through the network stage by stage: find a weak entry point and pivot toward the target machine by machine. Each step takes time, but the map never changes, so the attacker can plan.

MTD breaks that by shuffling the routes. The attacker's map goes stale. Every time the paths change, the attacker has to remap and restart part of the attack chain. The composite analysis finds that frequent shuffling delivers the strongest deployment results and tilts the balance toward the defender [S1]. Shuffle more often, and the attacker loses more often.

The throughput result is the counterintuitive part. Path randomisation can improve network performance because SDN can route traffic around congestion for both security and efficiency. The 30.9 per cent throughput gain suggests that in some configurations, the defence and the optimisation are the same thing [S1].

What it means for business

A small IT team running an SDN-capable network should care about this, even if they never read the preprint. The practical takeaway is that the mutation interval is the dial that matters. Set it too long, and the defence is decorative. Set it short, and the numbers in this preprint suggest attack success rates drop to single digits [S1].

For a two-person security firm advising clients, the framework's composite methodology offers a way to compare MTD products on a level field rather than trusting vendor benchmarks. The preprint's authors note that existing evaluations are fragmented and hard to reproduce [S1], which is exactly the problem a small firm faces when evaluating competing tools.

For a suburban IT services company managing networks for local businesses, the throughput finding matters. If path randomisation can improve performance while hardening security, the pitch to clients changes from "security costs you speed" to "security makes your network faster." That said, every number in this preprint comes from simulated enterprise-style scenarios, not confirmed live deployments [S1]. The authors conclude SDN-based PR-MTD is "practically deployable" in enterprise environments [S1], but that is their assessment, not an independent one.

What we don't know yet

The preprint has not been peer-reviewed [S1]. Every statistic, from 4 per cent to 30.9 per cent to 311 seconds, comes from the authors' own experimental setup and has not been independently verified.

The framework evaluates only SDN-enabled path randomisation techniques [S1]. Other MTD approaches, such as IP randomisation and port hopping, are outside its scope. Whether the mutation-interval findings generalise beyond path randomisation is an open question.

The source code for MTD-Playground is not confirmed to be publicly available. A related but separate repository, NASIM-MTD from DFKI, simulates deception and moving target defence with network attack simulation [P5], but it is a different project with 14 stars on GitHub and no published link to this preprint.

The next concrete event to watch is whether this preprint enters peer review and whether the authors release the framework's code for independent testing. Until then, the numbers are self-reported and unverified.

Subscribe to follow the next development in network defence testing.

Sources

More from Not A Tech Guy

Generated from an audited evidence pack with primary-source research. Social-media items are discussion signals, not verified facts. Nothing here is financial, legal or medical advice.