  The static nature of current cyber systems has made them easy to be attacked
and compromised. By constantly changing a system, Moving Target Defense (MTD)
has provided a promising way to reduce or move the attack surface that is
available for exploitation by an adversary. However, the current network- based
MTD obfuscates networks indiscriminately that makes some networks key services,
such as web and DNS services, unavailable, because many information of these
services has to be opened to the outside and remain real without compromising
their usability. Moreover, the indiscriminate obfuscation also severely reduces
the performance of networks. In this paper, we propose CHAOS, an SDN
(Software-defined networking)-based MTD system, which discriminately obfuscates
hosts with different security levels in a network. In CHAOS, we introduce a
Chaos Tower Obfuscation (CTO) method, which uses a Chaos Tower Structure (CTS)
to depict the hierarchy of all the hosts in an intranet and provides a more
unpredictable and flexible obfuscation method. We also present the design of
CHAOS, which leverages SDN features to obfuscate the attack surface including
IP obfuscation, ports obfuscation, and fingerprint obfuscation thereby
enhancing the unpredictability of the networking environment. We develop fast
CTO algorithms to achieve a different degree of obfuscation for the hosts in
each layer. Our experimental results show that a network protected by CHAOS is
capable of decreasing the percentage of information disclosure effectively to
guarantee the normal flow of traffic.
