# RL and Fingerprinting to Select Moving Target Defense Mechanisms for Zero-day Attacks in IoT

arXiv: https://arxiv.org/abs/2212.14647 · HTML: https://mlsanity.com/paper/2212.14647/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 9 of its 35 references that are in the map.
- First posted on arXiv 30 Dec 2022.

## Builds on (most cited first, 9 of 9)

- [Monte Carlo Gradient Estimation in Machine Learning](https://mlsanity.com/paper/1906.10652/) (2019)
- [Temporal Difference Models: Model-Free Deep RL for Model-Based Control](https://mlsanity.com/paper/1802.09081/) (2018)
- [Multi-agent Reinforcement Learning in Bayesian Stackelberg Markov Games for Adaptive Moving Target Defense](https://mlsanity.com/paper/2007.10457/) (2020)
- [A Survey on Device Behavior Fingerprinting: Data Sources, Techniques, Application Scenarios, and Datasets](https://mlsanity.com/paper/2008.03343/) (2020)
- [Toward Proactive, Adaptive Defense: A Survey on Moving Target Defense](https://mlsanity.com/paper/1909.08092/) (2019)
- [Electrosense: Open and Big Spectrum Data](https://mlsanity.com/paper/1703.09989/) (2017)
- [Multi-Agent Deep Reinforcement Learning with Human Strategies](https://mlsanity.com/paper/1806.04562/) (2018)
- [Studying the Robustness of Anti-adversarial Federated Learning Models Detecting Cyberattacks in IoT Spectrum Sensors](https://mlsanity.com/paper/2202.00137/) (2022)
- [A Lightweight Moving Target Defense Framework for Multi-purpose Malware Affecting IoT Devices](https://mlsanity.com/paper/2210.07719/) (2022)

## Built on by (most cited first, 3 of 3)

- [CyberForce: A Federated Reinforcement Learning Framework for Malware Mitigation](https://mlsanity.com/paper/2308.05978/) (2023)
- [From Static to Adaptive Defense: Federated Multi-Agent Deep Reinforcement Learning-Driven Moving Target Defense Against DoS Attacks in UAV Swarm Networks](https://mlsanity.com/paper/2506.07392/) (2025)
- [Adaptive Learning for Moving Target defence: Enhancing Cybersecurity Strategies](https://mlsanity.com/paper/2508.17945/) (2025)

## Abstract (arXiv)

Cybercriminals are moving towards zero-day attacks affecting resource-constrained devices such as single-board computers (SBC). Assuming that perfect security is unrealistic, Moving Target Defense (MTD) is a promising approach to mitigate attacks by dynamically altering target attack surfaces. Still, selecting suitable MTD techniques for zero-day attacks is an open challenge. Reinforcement Learning (RL) could be an effective approach to optimize the MTD selection through trial and error, but the literature fails when i) evaluating the performance of RL and MTD solutions in real-world scenarios, ii) studying whether behavioral fingerprinting is suitable for representing SBC's states, and iii) calculating the consumption of resources in SBC. To improve these limitations, the work at hand proposes an online RL-based framework to learn the correct MTD mechanisms mitigating heterogeneous zero-day attacks in SBC. The framework considers behavioral fingerprinting to represent SBCs' states and RL to learn MTD techniques that mitigate each malicious state. It has been deployed on a real IoT crowdsensing scenario with a Raspberry Pi acting as a spectrum sensor. More in detail, the Raspberry Pi has been infected with different samples of command and control malware, rootkits, and ransomware to later select between four existing MTD techniques. A set of experiments demonstrated the suitability of the framework to learn proper MTD techniques mitigating all attacks (except a harmfulness rootkit) while consuming <1 MB of storage and utilizing <55% CPU and <80% RAM.