LLM: LSTM Look-Ahead Moving Target Defense Based on Historical Malicious Scan

Computer Science > Cryptography and Security [Submitted on 13 Jun 2026] LLM: LSTM Look-Ahead Moving Target Defense Based on Historical Malicious Scan Yu Li Network scanning is a critical preliminary step for most adversaries to gain essential information before launching cyber attacks. Moving Target Defense (MTD) based on IP shuffling has emerged as a proactive defense strategy to counteract these reconnaissance efforts. Unlike static, reactive defense techniques, IP shuffling introduces randomness by dynamically reassigning network addresses, making it more challenging for attackers to identify and track targets. However, current IP shuffling methods face three key challenges: 1) limited scalability across different network topologies, 2) inherent reconfiguration overhead even in the absence of an active attack, and 3) the need for large-scale unused address blocks. To address these issues, we propose LSTM Look-ahead Moving Target Defense (LLM). Our approach is the first attempt using a Long Short-Term Memory (LSTM) network to predict future target addresses that attackers will likely scan. Ensemble learning is used to improve robustness to different scanning behaviors. We introduce a dynamic mutation mechanism to enhance adaptability. Compared to the baseline mutation strategy, LLM performs better in both security and overhead. Subjects: Cryptography and Security (cs.CR) Cite as: arXiv:2606.15229 [cs.CR]   (or arXiv:2606.15229v1 [cs.CR] for this version)   https://doi.org/10.48550/arXiv.2606.15229 Focus to learn more Submission history From: Yu Li [view email] [v1] Sat, 13 Jun 2026 09:58:55 UTC (494 KB) Access Paper: HTML (experimental) view license Current browse context: cs.CR < prev   |   next > new | recent | 2026-06 Change to browse by: cs References & Citations NASA ADS Google Scholar Semantic Scholar Export BibTeX Citation Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer (What is the Explorer?) Connected Papers Toggle Connected Papers (What is Connected Papers?) Litmaps Toggle Litmaps (What is Litmaps?) scite.ai Toggle scite Smart Citations (What are Smart Citations?) Code, Data, Media Demos Related Papers About arXivLabs Which authors of this paper are endorsers? | Disable MathJax (What is MathJax?)