Polymorphic Service Delivery: A Novel Adaptation of the Moving Target Defense for Disrupting Automated Reconnaissance

Abstract

Static web server configurations face escalating cyber threats, yet complex moving target defense (MTD) solutions, such as IP randomization or virtual machine migration, remain prohibitive for smaller organizations due to resource constraints. This study presents a preliminary model for polymorphic service delivery (PSD), a lightweight MTD strategy utilizing standard Linux utilities to dynamically rotate web server daemons (Apache2, Lighttpd, and H2O) via destination network address translation. Focusing explicitly on simple, stateless web applications designed for text data delivery, this study hypothesized that high-frequency service rotation disrupts automated reconnaissance and scanner-dependent exploits without requiring complex network overlays. Following the design science research methodology, a PSD artifact was deployed in a live Internet-facing environment, recording 461,613 attacks among 636,166 Hypertext Transfer Protocol (HTTP) requests over four months. Controlled penetration testing and performance benchmarking evaluated a high-frequency 3-second rotation interval. Results demonstrate that PSD fundamentally disrupts stateful automated vulnerability scanners, inducing tool failures via connection resets and inconsistent server responses. While the system induces connection drops for active sessions during high-frequency rotation, the stateless nature of standard HTTP requests ensures adequate delivery of simple text-based web pages. Within the execution context, PSD probabilistically disrupts 93% of categorized server-specific attacks in the execution context by introducing temporal attack surface variability, providing a highly accessible defense mechanism that provides attack confusion, increases attacker costs, and effectively demonstrates advanced defense strategies for resource-constrained environments.