{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,4]],"date-time":"2026-08-04T20:47:43Z","timestamp":1785876463186,"version":"3.56.0"},"reference-count":56,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,12,1]],"date-time":"2026-12-01T00:00:00Z","timestamp":1796083200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,12,1]],"date-time":"2026-12-01T00:00:00Z","timestamp":1796083200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,12,1]],"date-time":"2026-12-01T00:00:00Z","timestamp":1796083200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,12,1]],"date-time":"2026-12-01T00:00:00Z","timestamp":1796083200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,12,1]],"date-time":"2026-12-01T00:00:00Z","timestamp":1796083200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,12,1]],"date-time":"2026-12-01T00:00:00Z","timestamp":1796083200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,12,1]],"date-time":"2026-12-01T00:00:00Z","timestamp":1796083200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/501100013314","name":"Higher Education Discipline Innovation Project","doi-asserted-by":"publisher","award":["B21049"],"award-info":[{"award-number":["B21049"]}],"id":[{"id":"10.13039\/501100013314","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U25B2031"],"award-info":[{"award-number":["U25B2031"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program of China","doi-asserted-by":"publisher","award":["2024YFB2906503"],"award-info":[{"award-number":["2024YFB2906503"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Future Generation Computer Systems"],"published-print":{"date-parts":[[2026,12]]},"DOI":"10.1016\/j.future.2026.108676","type":"journal-article","created":{"date-parts":[[2026,6,18]],"date-time":"2026-06-18T15:54:20Z","timestamp":1781798060000},"page":"108676","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["Moving target defense strategies against lateral movement in cloud-native environments"],"prefix":"10.1016","volume":"185","author":[{"ORCID":"https:\/\/orcid.org\/0009-0006-5521-9204","authenticated-orcid":false,"given":"Shangrong","family":"Ma","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-8125-035X","authenticated-orcid":false,"given":"Lei","family":"Ding","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tao","family":"Zhou","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6729-1450","authenticated-orcid":false,"given":"Liyuan","family":"Chang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8541-308X","authenticated-orcid":false,"given":"Lixiang","family":"Li","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.future.2026.108676_b1","doi-asserted-by":"crossref","DOI":"10.1016\/j.jnca.2023.103810","article-title":"Surgical immunization strategies against lateral movement in Active Directory environments","volume":"222","author":"Herranz-Oliveros","year":"2024","journal-title":"J. Netw. Comput. Appl."},{"key":"10.1016\/j.future.2026.108676_b2","doi-asserted-by":"crossref","first-page":"37","DOI":"10.1016\/j.neucom.2021.12.026","article-title":"LMTracker: Lateral movement path detection based on heterogeneous graph embedding","volume":"474","author":"Fang","year":"2022","journal-title":"Neurocomputing"},{"key":"10.1016\/j.future.2026.108676_b3","doi-asserted-by":"crossref","DOI":"10.1016\/j.jnca.2024.104036","article-title":"RT-APT: A real-time APT anomaly detection method for large-scale provenance graph","volume":"233","author":"Weng","year":"2025","journal-title":"J. Netw. Comput. Appl."},{"issue":"3","key":"10.1016\/j.future.2026.108676_b4","doi-asserted-by":"crossref","DOI":"10.1145\/3588771","article-title":"Euler: Detecting network lateral movement via scalable temporal link prediction","volume":"26","author":"King","year":"2023","journal-title":"ACM Trans. Priv. Secur."},{"issue":"5","key":"10.1016\/j.future.2026.108676_b5","doi-asserted-by":"crossref","first-page":"5361","DOI":"10.1109\/TNSM.2024.3414267","article-title":"A graph learning-based approach for lateral movement detection","volume":"21","author":"Rabbani","year":"2024","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"10.1016\/j.future.2026.108676_b6","series-title":"30th USENIX Security Symposium","first-page":"3093","article-title":"Hopper: Modeling and detecting lateral movement","author":"Ho","year":"2021"},{"key":"10.1016\/j.future.2026.108676_b7","series-title":"27th Conference on Innovation in Clouds, Internet and Networks, ICIN 2024, Paris, France, March 11-14, 2024","first-page":"130","article-title":"Moving target defense for cloud-native applications","author":"Awarkeh","year":"2024"},{"issue":"7","key":"10.1016\/j.future.2026.108676_b8","doi-asserted-by":"crossref","first-page":"4285","DOI":"10.1109\/TII.2019.2907754","article-title":"Real-time lateral movement detection based on evidence reasoning network for edge computing environment","volume":"15","author":"Tian","year":"2019","journal-title":"IEEE Trans. Ind. Inform."},{"key":"10.1016\/j.future.2026.108676_b9","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2024.104296","article-title":"CORAL: Container Online Risk Assessment with Logical attack graphs","volume":"150","author":"Tayouri","year":"2025","journal-title":"Comput. Secur."},{"key":"10.1016\/j.future.2026.108676_b10","series-title":"2020 IEEE International Conference on Software Architecture","first-page":"157","article-title":"From monolithic architecture style to microservice one based on a semi-automatic approach","author":"Selmadji","year":"2020"},{"key":"10.1016\/j.future.2026.108676_b11","series-title":"Proceeding of 2021 International Conference on Wireless Communications, Networking and Applications","first-page":"399","article-title":"PCCP: A private container cloud platform supporting domestic hardware and software","author":"Wang","year":"2022"},{"key":"10.1016\/j.future.2026.108676_b12","series-title":"2024 20th International Conference on Network and Service Management","first-page":"1","article-title":"Lateral movement identification in cross-cloud deployment","author":"Poeng","year":"2024"},{"key":"10.1016\/j.future.2026.108676_b13","series-title":"23rd International Symposium on Research in Attacks, Intrusions and Defenses","first-page":"257","article-title":"Detecting lateral movement in enterprise computer networks with unsupervised graph AI","author":"Bowman","year":"2020"},{"key":"10.1016\/j.future.2026.108676_b14","doi-asserted-by":"crossref","first-page":"525","DOI":"10.1016\/j.future.2019.02.045","article-title":"Bayesian network based weighted APT attack paths modeling in cloud computing","volume":"96","author":"Zimba","year":"2019","journal-title":"Future Gener. Comput. Syst."},{"key":"10.1016\/j.future.2026.108676_b15","series-title":"Decision and Game Theory for Security","first-page":"125","article-title":"Farsighted risk mitigation of lateral movement using dynamic cognitive honeypots","author":"Huang","year":"2020"},{"key":"10.1016\/j.future.2026.108676_b16","doi-asserted-by":"crossref","first-page":"49662","DOI":"10.1109\/ACCESS.2021.3069105","article-title":"Hidden Markov model and cyber deception for the prevention of adversarial lateral movement","volume":"9","author":"Amin","year":"2021","journal-title":"IEEE Access"},{"issue":"5","key":"10.1016\/j.future.2026.108676_b17","doi-asserted-by":"crossref","first-page":"8440","DOI":"10.1109\/JIOT.2023.3322412","article-title":"A comprehensive detection method for the lateral movement stage of APT attacks","volume":"11","author":"He","year":"2024","journal-title":"IEEE Internet Things J."},{"key":"10.1016\/j.future.2026.108676_b18","doi-asserted-by":"crossref","DOI":"10.1016\/j.cosrev.2023.100544","article-title":"A survey: When moving target defense meets game theory","volume":"48","author":"Tan","year":"2023","journal-title":"Comput. Sci. Rev."},{"issue":"2","key":"10.1016\/j.future.2026.108676_b19","doi-asserted-by":"crossref","first-page":"16","DOI":"10.1109\/MSP.2013.137","article-title":"Finding focus in the blur of moving-target techniques","volume":"12","author":"Okhravi","year":"2014","journal-title":"IEEE Secur. Priv."},{"issue":"1","key":"10.1016\/j.future.2026.108676_b20","first-page":"822","article-title":"CMTD: A fast moving target defense scheme based on CFL authentication","volume":"12","author":"Li","year":"2025","journal-title":"IEEE Internet Things J."},{"issue":"10","key":"10.1016\/j.future.2026.108676_b21","doi-asserted-by":"crossref","first-page":"3293","DOI":"10.1109\/JSAC.2023.3310072","article-title":"When moving target defense meets attack prediction in digital twins: A convolutional and hierarchical reinforcement learning approach","volume":"41","author":"Zhang","year":"2023","journal-title":"IEEE J. Sel. Areas Commun."},{"issue":"10","key":"10.1016\/j.future.2026.108676_b22","doi-asserted-by":"crossref","first-page":"7818","DOI":"10.1109\/JIOT.2020.3040358","article-title":"MTD, where art thou? A systematic review of moving target defense techniques for IoT","volume":"8","author":"Navas","year":"2021","journal-title":"IEEE Internet Things J."},{"issue":"14","key":"10.1016\/j.future.2026.108676_b23","doi-asserted-by":"crossref","DOI":"10.3390\/app9142928","article-title":"Address space layout randomization next generation","volume":"9","author":"Marco Gisbert","year":"2019","journal-title":"Appl. Sci."},{"issue":"4","key":"10.1016\/j.future.2026.108676_b24","doi-asserted-by":"crossref","DOI":"10.1145\/3419841","article-title":"On architectural support for instruction set randomization","volume":"17","author":"Christou","year":"2020","journal-title":"ACM Trans. Archit. Code Optim."},{"key":"10.1016\/j.future.2026.108676_b25","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2023.103685","article-title":"Proactive defense mechanism: Enhancing IoT security through diversity-based moving target defense and cyber deception","volume":"139","author":"Rehman","year":"2024","journal-title":"Comput. Secur."},{"key":"10.1016\/j.future.2026.108676_b26","series-title":"2013 IEEE Symposium on Security and Privacy","first-page":"559","article-title":"Practical control flow integrity and randomization for binary executables","author":"Zhang","year":"2013"},{"key":"10.1016\/j.future.2026.108676_b27","series-title":"2008 IEEE International Conference on Dependable Systems and Networks with FTCS and DCC","first-page":"187","article-title":"Security through redundant data diversity","author":"Nguyen-Tuong","year":"2008"},{"key":"10.1016\/j.future.2026.108676_b28","series-title":"23rd USENIX Security Symposium","first-page":"703","article-title":"Preventing cryptographic key leakage in cloud virtual machines","author":"Pattuk","year":"2014"},{"key":"10.1016\/j.future.2026.108676_b29","series-title":"2018 17th IEEE International Conference on Trust, Security and Privacy in Computing and Communications\/ 12th IEEE International Conference on Big Data Science and Engineering","first-page":"573","article-title":"Evaluation for combination of shuffle and diversity on moving target defense strategy for cloud computing","author":"Alavizadeh","year":"2018"},{"key":"10.1016\/j.future.2026.108676_b30","doi-asserted-by":"crossref","first-page":"507","DOI":"10.1016\/j.future.2019.10.009","article-title":"Model-based evaluation of combinations of Shuffle and Diversity MTD techniques on the cloud","volume":"111","author":"Alavizadeh","year":"2020","journal-title":"Future Gener. Comput. Syst."},{"issue":"6","key":"10.1016\/j.future.2026.108676_b31","doi-asserted-by":"crossref","first-page":"4719","DOI":"10.1109\/TDSC.2022.3232537","article-title":"WF-MTD: Evolutionary decision method for moving target defense based on Wright-Fisher process","volume":"20","author":"Tan","year":"2023","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"issue":"1","key":"10.1016\/j.future.2026.108676_b32","doi-asserted-by":"crossref","first-page":"1097","DOI":"10.1109\/TII.2022.3190556","article-title":"How to mitigate DDoS intelligently in SD-IoV: A moving target defense approach","volume":"19","author":"Zhang","year":"2023","journal-title":"IEEE Trans. Ind. Inform."},{"key":"10.1016\/j.future.2026.108676_b33","doi-asserted-by":"crossref","first-page":"667","DOI":"10.1109\/TIFS.2022.3220939","article-title":"SCEMA: An SDN-oriented cost-effective edge-based MTD approach","volume":"18","author":"Javadpour","year":"2023","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.future.2026.108676_b34","doi-asserted-by":"crossref","first-page":"5735","DOI":"10.1109\/TIFS.2023.3314219","article-title":"How to disturb network reconnaissance: A moving target defense approach based on deep reinforcement learning","volume":"18","author":"Zhang","year":"2023","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"issue":"11","key":"10.1016\/j.future.2026.108676_b35","doi-asserted-by":"crossref","first-page":"17413","DOI":"10.1109\/JIOT.2025.3539653","article-title":"Small-signal-stability-guaranteed moving target defense against load redistribution attack on IoT-based smart grid","volume":"12","author":"Wang","year":"2025","journal-title":"IEEE Internet Things J."},{"key":"10.1016\/j.future.2026.108676_b36","series-title":"Proactive defense for internet-of-things: Moving target defense with cyberdeception","author":"Ge","year":"2021"},{"issue":"1","key":"10.1016\/j.future.2026.108676_b37","first-page":"80","article-title":"Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains","volume":"1","author":"Hutchins","year":"2011","journal-title":"Lead. Issues Inf. Warf. Secur. Res."},{"issue":"3","key":"10.1016\/j.future.2026.108676_b38","first-page":"1125","article-title":"DSEOM: A framework for dynamic security evaluation and optimization of MTD in container-based cloud","volume":"18","author":"Jin","year":"2021","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"10.1016\/j.future.2026.108676_b39","series-title":"Common vulnerability scoring system v3. 1: Specification document","author":"FIRST","year":"2015"},{"key":"10.1016\/j.future.2026.108676_b40","series-title":"Introduction to Algorithms","author":"Cormen","year":"2022"},{"issue":"63","key":"10.1016\/j.future.2026.108676_b41","doi-asserted-by":"crossref","first-page":"30","DOI":"10.1080\/14786445508641925","article-title":"V. On liquid diffusion","volume":"10","author":"Fick","year":"1855","journal-title":"Lond. Edinb. Dublin Philos. Mag. J. Sci."},{"issue":"5","key":"10.1016\/j.future.2026.108676_b42","doi-asserted-by":"crossref","first-page":"1291","DOI":"10.1109\/TNN.2005.853425","article-title":"Spatial-temporal modeling of malware propagation in networks","volume":"16","author":"Chen","year":"2005","journal-title":"IEEE Trans. Neural Netw."},{"key":"10.1016\/j.future.2026.108676_b43","series-title":"Advances in Neural Information Processing Systems","article-title":"Learning combinatorial optimization algorithms over graphs","volume":"Vol. 30","author":"Khalil","year":"2017"},{"key":"10.1016\/j.future.2026.108676_b44","series-title":"Advances in Neural Information Processing Systems","article-title":"Exact combinatorial optimization with graph convolutional neural networks","volume":"Vol. 32","author":"Gasse","year":"2019"},{"key":"10.1016\/j.future.2026.108676_b45","doi-asserted-by":"crossref","first-page":"288","DOI":"10.1016\/j.jnca.2016.10.018","article-title":"Using epidemic betweenness to measure the influence of users in complex networks","volume":"78","author":"Wen","year":"2017","journal-title":"J. Netw. Comput. Appl."},{"issue":"1","key":"10.1016\/j.future.2026.108676_b46","doi-asserted-by":"crossref","first-page":"61","DOI":"10.1109\/TNN.2008.2005605","article-title":"The graph neural network model","volume":"20","author":"Scarselli","year":"2008","journal-title":"IEEE Trans. Neural Netw."},{"key":"10.1016\/j.future.2026.108676_b47","doi-asserted-by":"crossref","unstructured":"B. Jiang, Z. Zhang, D. Lin, J. Tang, B. Luo, Semi-Supervised Learning With Graph Learning-Convolutional Networks, in: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, CVPR, 2019.","DOI":"10.1109\/CVPR.2019.01157"},{"key":"10.1016\/j.future.2026.108676_b48","series-title":"Advances in Neural Information Processing Systems","article-title":"Inductive representation learning on large graphs","volume":"Vol. 30","author":"Hamilton","year":"2017"},{"key":"10.1016\/j.future.2026.108676_b49","series-title":"K3s-lightweight kubernetes","author":"Authors","year":"2025"},{"key":"10.1016\/j.future.2026.108676_b50","doi-asserted-by":"crossref","first-page":"25","DOI":"10.1007\/s10664-021-10063-9","article-title":"Enjoy your observability: an industrial survey of microservice tracing and analysis","volume":"27","author":"Li","year":"2022","journal-title":"Empir. Softw. Eng."},{"key":"10.1016\/j.future.2026.108676_b51","series-title":"2022 IEEE\/ACM 44th International Conference on Software Engineering","first-page":"623","article-title":"DeepTraLog: Trace-log combined microservice anomaly detection through graph-based deep learning","author":"Zhang","year":"2022"},{"key":"10.1016\/j.future.2026.108676_b52","series-title":"2021 IEEE\/ACM 43rd International Conference on Software Engineering: Software Engineering in Practice","first-page":"338","article-title":"MicroHECL: High-efficient root cause localization in large-scale microservice systems","author":"Liu","year":"2021"},{"issue":"2","key":"10.1016\/j.future.2026.108676_b53","doi-asserted-by":"crossref","first-page":"67","DOI":"10.1080\/23742917.2019.1627702","article-title":"The epidemiology of lateral movement: exposures and countermeasures with network contagion models","volume":"4","author":"Powell","year":"2020","journal-title":"J. Cyber Secur. Technol."},{"key":"10.1016\/j.future.2026.108676_b54","series-title":"Mathematics of Epidemics on Networks: From Exact to Approximate Models","author":"Istvan","year":"2019"},{"issue":"44","key":"10.1016\/j.future.2026.108676_b55","doi-asserted-by":"crossref","first-page":"1731","DOI":"10.21105\/joss.01731","article-title":"EoN (Epidemics on Networks): a fast, flexible Python package for simulation, analytic approximation, and analysis of epidemics on networks","volume":"4","author":"Miller","year":"2019","journal-title":"J. Open Source Softw."},{"key":"10.1016\/j.future.2026.108676_b56","doi-asserted-by":"crossref","first-page":"21355","DOI":"10.1038\/s41598-022-24652-1","article-title":"A comparison of node vaccination strategies to halt SIR epidemic spreading in real-world complex networks","volume":"12","author":"Sartori","year":"2022","journal-title":"Sci. Rep."}],"container-title":["Future Generation Computer Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167739X26003109?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167739X26003109?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,8,4]],"date-time":"2026-08-04T20:07:56Z","timestamp":1785874076000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0167739X26003109"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,12]]},"references-count":56,"alternative-id":["S0167739X26003109"],"URL":"https:\/\/doi.org\/10.1016\/j.future.2026.108676","relation":{},"ISSN":["0167-739X"],"issn-type":[{"value":"0167-739X","type":"print"}],"subject":[],"published":{"date-parts":[[2026,12]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"Moving target defense strategies against lateral movement in cloud-native environments","name":"articletitle","label":"Article Title"},{"value":"Future Generation Computer Systems","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.future.2026.108676","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Elsevier B.V. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"108676"}}