{"id":"https://openalex.org/W4386596944","doi":"https://doi.org/10.1109/tifs.2023.3314219","title":"How to Disturb Network Reconnaissance: A Moving Target Defense Approach Based on Deep Reinforcement Learning","display_name":"How to Disturb Network Reconnaissance: A Moving Target Defense Approach Based on Deep Reinforcement Learning","publication_year":2023,"publication_date":"2023-01-01","ids":{"openalex":"https://openalex.org/W4386596944","doi":"https://doi.org/10.1109/tifs.2023.3314219"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2023.3314219","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2023.3314219","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100375796","display_name":"Tao Zhang","orcid":"https://orcid.org/0000-0002-3366-7640"},"institutions":[{"id":"https://openalex.org/I21193070","display_name":"Beijing Jiaotong University","ror":"https://ror.org/01yj56c84","country_code":"CN","type":"education","lineage":["https://openalex.org/I21193070"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Tao Zhang","raw_affiliation_strings":["School of Software Engineering, Beijing Jiaotong University, Beijing, China","Beijing Key Laboratory of Security and Privacy in Intelligent Transportation, Beijing Jiaotong University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-3366-7640","affiliations":[{"raw_affiliation_string":"School of Software Engineering, Beijing Jiaotong University, Beijing, China","institution_ids":["https://openalex.org/I21193070"]},{"raw_affiliation_string":"Beijing Key Laboratory of Security and Privacy in Intelligent Transportation, Beijing Jiaotong University, Beijing, China","institution_ids":["https://openalex.org/I21193070"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5069646989","display_name":"Changqiao Xu","orcid":"https://orcid.org/0000-0003-1467-1086"},"institutions":[{"id":"https://openalex.org/I4392021250","display_name":"State Key Laboratory of Networking and Switching Technology","ror":"https://ror.org/00qtv5q45","country_code":null,"type":"facility","lineage":["https://openalex.org/I139759216","https://openalex.org/I4392021250"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Changqiao Xu","raw_affiliation_strings":["State Key Laboratory of Networking and Switching Technology, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0003-1467-1086","affiliations":[{"raw_affiliation_string":"State Key Laboratory of Networking and Switching Technology, Beijing, China","institution_ids":["https://openalex.org/I4392021250"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103008015","display_name":"Jiahao Shen","orcid":"https://orcid.org/0000-0003-3072-7879"},"institutions":[{"id":"https://openalex.org/I82880672","display_name":"Beihang University","ror":"https://ror.org/00wk2mp56","country_code":"CN","type":"education","lineage":["https://openalex.org/I82880672"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jiahao Shen","raw_affiliation_strings":["School of Computer Science and Engineering, Beihang University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0003-3072-7879","affiliations":[{"raw_affiliation_string":"School of Computer Science and Engineering, Beihang University, Beijing, China","institution_ids":["https://openalex.org/I82880672"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5053431750","display_name":"Xiaohui Kuang","orcid":"https://orcid.org/0000-0003-3816-402X"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaohui Kuang","raw_affiliation_strings":["National Key Laboratory of Science and Technology on Information System Security, Beijing, China","State Key Laboratory of Networking and Switching Technology, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National Key Laboratory of Science and Technology on Information System Security, Beijing, China","institution_ids":[]},{"raw_affiliation_string":"State Key Laboratory of Networking and Switching Technology, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5020385557","display_name":"Luigi Alfredo Grieco","orcid":"https://orcid.org/0000-0002-3443-6924"},"institutions":[{"id":"https://openalex.org/I4210099310","display_name":"Consorzio Nazionale Interuniversitario per le Telecomunicazioni","ror":"https://ror.org/0182a5n39","country_code":"IT","type":"funder","lineage":["https://openalex.org/I4210099310"]},{"id":"https://openalex.org/I68618741","display_name":"Polytechnic University of Bari","ror":"https://ror.org/03c44v465","country_code":"IT","type":"education","lineage":["https://openalex.org/I68618741"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Luigi Alfredo Grieco","raw_affiliation_strings":["Department of Electrical and Information Engineering and the Consorzio Nazionale Interuniversitario per le Telecomunicazioni (CNIT), Politecnico di Bari, Bari, Italy"],"raw_orcid":"https://orcid.org/0000-0002-3443-6924","affiliations":[{"raw_affiliation_string":"Department of Electrical and Information Engineering and the Consorzio Nazionale Interuniversitario per le Telecomunicazioni (CNIT), Politecnico di Bari, Bari, Italy","institution_ids":["https://openalex.org/I68618741","https://openalex.org/I4210099310"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":6,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":8.4225,"has_fulltext":false,"cited_by_count":48,"citation_normalized_percentile":{"value":0.98142823,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":100},"biblio":{"volume":"18","issue":null,"first_page":"5735","last_page":"5748"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9983000159263611,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8279538750648499},{"id":"https://openalex.org/keywords/reinforcement-learning","display_name":"Reinforcement learning","score":0.6970620155334473},{"id":"https://openalex.org/keywords/survivability","display_name":"Survivability","score":0.6461831331253052},{"id":"https://openalex.org/keywords/host","display_name":"Host (biology)","score":0.5959034562110901},{"id":"https://openalex.org/keywords/markov-decision-process","display_name":"Markov decision process","score":0.5284885168075562},{"id":"https://openalex.org/keywords/mutation","display_name":"Mutation","score":0.47903338074684143},{"id":"https://openalex.org/keywords/encoding","display_name":"Encoding (memory)","score":0.4417558014392853},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.43800729513168335},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.42447629570961},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.422443687915802},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.39458751678466797},{"id":"https://openalex.org/keywords/markov-process","display_name":"Markov process","score":0.33478736877441406},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.19539007544517517}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8279538750648499},{"id":"https://openalex.org/C97541855","wikidata":"https://www.wikidata.org/wiki/Q830687","display_name":"Reinforcement learning","level":2,"score":0.6970620155334473},{"id":"https://openalex.org/C2781133158","wikidata":"https://www.wikidata.org/wiki/Q1088669","display_name":"Survivability","level":2,"score":0.6461831331253052},{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.5959034562110901},{"id":"https://openalex.org/C106189395","wikidata":"https://www.wikidata.org/wiki/Q176789","display_name":"Markov decision process","level":3,"score":0.5284885168075562},{"id":"https://openalex.org/C501734568","wikidata":"https://www.wikidata.org/wiki/Q42918","display_name":"Mutation","level":3,"score":0.47903338074684143},{"id":"https://openalex.org/C125411270","wikidata":"https://www.wikidata.org/wiki/Q18653","display_name":"Encoding (memory)","level":2,"score":0.4417558014392853},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.43800729513168335},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.42447629570961},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.422443687915802},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.39458751678466797},{"id":"https://openalex.org/C159886148","wikidata":"https://www.wikidata.org/wiki/Q176645","display_name":"Markov process","level":2,"score":0.33478736877441406},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.19539007544517517},{"id":"https://openalex.org/C105795698","wikidata":"https://www.wikidata.org/wiki/Q12483","display_name":"Statistics","level":1,"score":0.0},{"id":"https://openalex.org/C18903297","wikidata":"https://www.wikidata.org/wiki/Q7150","display_name":"Ecology","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C55493867","wikidata":"https://www.wikidata.org/wiki/Q7094","display_name":"Biochemistry","level":1,"score":0.0},{"id":"https://openalex.org/C104317684","wikidata":"https://www.wikidata.org/wiki/Q7187","display_name":"Gene","level":2,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C185592680","wikidata":"https://www.wikidata.org/wiki/Q2329","display_name":"Chemistry","level":0,"score":0.0},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2023.3314219","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2023.3314219","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G3654910116","display_name":"\u672a\u67655G\u6d41\u5a92\u4f53\u670d\u52a1\u4e2d\u77e5\u8bc6\u9a71\u52a8\u7684\u7f13\u5b58\u4e0e\u4ea4\u4ed8\u673a\u5236\u7814\u7a76","funder_award_id":"61871048","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G4917731782","display_name":null,"funder_award_id":"62225105","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G5995687454","display_name":null,"funder_award_id":"K2022W010","funder_id":"https://openalex.org/F4320316125","funder_display_name":"China Railway"}],"funders":[{"id":"https://openalex.org/F4320316125","display_name":"China Railway","ror":"https://ror.org/044wv3489"},{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":56,"referenced_works":["https://openalex.org/W1480909796","https://openalex.org/W1529923522","https://openalex.org/W1612694023","https://openalex.org/W2085047345","https://openalex.org/W2108303927","https://openalex.org/W2132022337","https://openalex.org/W2137351629","https://openalex.org/W2183926967","https://openalex.org/W2189149472","https://openalex.org/W2495047120","https://openalex.org/W2519543959","https://openalex.org/W2561815404","https://openalex.org/W2725073272","https://openalex.org/W2744714095","https://openalex.org/W2780895759","https://openalex.org/W2789694608","https://openalex.org/W2794694510","https://openalex.org/W2807786182","https://openalex.org/W2884750245","https://openalex.org/W2888977251","https://openalex.org/W2895216609","https://openalex.org/W2901450325","https://openalex.org/W2936630130","https://openalex.org/W2953384591","https://openalex.org/W2955014922","https://openalex.org/W2964043796","https://openalex.org/W2964061570","https://openalex.org/W2969871287","https://openalex.org/W2979637235","https://openalex.org/W2980427366","https://openalex.org/W2982626833","https://openalex.org/W2996903041","https://openalex.org/W3000172442","https://openalex.org/W3008309395","https://openalex.org/W3009668666","https://openalex.org/W3011065733","https://openalex.org/W3031737714","https://openalex.org/W3036749975","https://openalex.org/W3043610783","https://openalex.org/W3112947928","https://openalex.org/W3120413657","https://openalex.org/W3130542705","https://openalex.org/W3137920819","https://openalex.org/W3137991997","https://openalex.org/W3159310286","https://openalex.org/W3166413890","https://openalex.org/W3169432716","https://openalex.org/W3198565628","https://openalex.org/W3212789951","https://openalex.org/W4206013528","https://openalex.org/W4230928526","https://openalex.org/W4281397562","https://openalex.org/W4285148832","https://openalex.org/W4286215678","https://openalex.org/W6692846177","https://openalex.org/W6713134421"],"related_works":["https://openalex.org/W2387494004","https://openalex.org/W2162492390","https://openalex.org/W2350417149","https://openalex.org/W2036372418","https://openalex.org/W2545190132","https://openalex.org/W2114587117","https://openalex.org/W2315999538","https://openalex.org/W187740018","https://openalex.org/W2162286586","https://openalex.org/W4255368532"],"abstract_inverted_index":{"With":[0],"the":[1,82,113,128,165],"explosive":[2],"growth":[3],"of":[4,15,84,131,167,179],"Internet":[5],"traffic,":[6],"large":[7],"sensitive":[8],"and":[9,71,116,161],"valuable":[10],"information":[11],"is":[12,60,97],"at":[13],"risk":[14],"cyber":[16],"attacks,":[17],"which":[18,151],"are":[19],"mostly":[20],"preceded":[21],"by":[22],"network":[23,37,58],"reconnaissance.":[24,38],"A":[25],"moving":[26],"target":[27],"defense":[28],"technique":[29],"called":[30],"host":[31,64],"address":[32,100],"mutation":[33,114,120],"(HAM)":[34],"helps":[35],"facing":[36],"However,":[39],"there":[40],"still":[41],"exist":[42],"several":[43],"fundamental":[44],"problems":[45],"in":[46],"HAM:":[47],"1)":[48],"current":[49],"approaches":[50],"cannot":[51],"be":[52],"self-adaptive":[53],"to":[54,67,99,111,123,153,194],"adversarial":[55],"strategies;":[56],"2)":[57],"state":[59],"time-varying":[61],"because":[62],"each":[63],"decides":[65],"whether":[66],"mutate":[68],"IP":[69],"address;":[70],"3)":[72],"most":[73],"methods":[74],"mainly":[75],"focus":[76],"on":[77],"enhancing":[78],"security,":[79],"but":[80],"ignore":[81],"survivability":[83],"existing":[85],"connections.":[86],"In":[87],"this":[88],"paper,":[89],"an":[90,145],"Intelligence-Driven":[91],"Host":[92],"Address":[93],"Mutation":[94],"(ID-HAM)":[95],"scheme":[96],"proposed":[98],"aforementioned":[101],"challenges.":[102],"We":[103,187],"firstly":[104],"model":[105],"a":[106,118,138,190],"Markov":[107],"decision":[108],"process":[109],"(MDP)":[110],"describe":[112],"process,":[115],"design":[117,144],"seamless":[119],"mechanism.":[121],"Secondly,":[122],"remove":[124],"infeasible":[125],"actions":[126],"from":[127,155],"action":[129],"space":[130],"MDP,":[132],"we":[133,143],"formulate":[134],"address-to-host":[135],"assignments":[136],"as":[137],"constrained":[139],"satisfaction":[140],"problem.":[141],"Thirdly,":[142],"advantage":[146],"actor-critic":[147],"algorithm":[148],"for":[149],"HAM,":[150],"aims":[152],"learn":[154],"scanning":[156,180,199],"behaviors.":[157],"Finally,":[158],"security":[159],"analysis":[160],"extensive":[162],"simulations":[163],"highlight":[164],"effectiveness":[166],"ID-HAM.":[168],"Compared":[169],"with":[170,197],"state-of-the-art":[171],"solutions,":[172],"ID-HAM":[173],"can":[174],"decrease":[175],"maximum":[176],"25%":[177],"times":[178],"hits":[181],"while":[182],"only":[183],"influencing":[184],"communication":[185],"slightly.":[186],"also":[188],"implemented":[189],"proof-of-concept":[191],"prototype":[192],"system":[193],"conduct":[195],"experiments":[196],"multiple":[198],"tools.":[200]},"counts_by_year":[{"year":2026,"cited_by_count":7},{"year":2025,"cited_by_count":17},{"year":2024,"cited_by_count":22},{"year":2023,"cited_by_count":2}],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2025-10-10T00:00:00"}