Open Access

ARTICLE

Enhancing Ransomware Resilience in Cloud-Based HR Systems through Moving Target Defense

Jay Barach^*

Systems Staffing Group, Inc., King of Prussia, PA 19406, USA

* Corresponding Author: Jay Barach. Email:

Computers, Materials & Continua 2026, 86(2), 1-23. https://doi.org/10.32604/cmc.2025.071705

Received 11 August 2025; Accepted 20 October 2025; Issue published 09 December 2025

Abstract

Human Resource (HR) operations increasingly rely on cloud-based platforms that provide hiring, payroll, employee management, and compliance services. These systems, typically built on multi-tenant microservice architectures, offer scalability and efficiency but also expand the attack surface for adversaries. Ransomware has emerged as a leading threat in this domain, capable of halting workflows and exposing sensitive employee records. Traditional defenses such as static hardening and signature-based detection often fail to address the dynamic requirements of HR Software as a Service (SaaS), where continuous availability and privacy compliance are critical. This paper presents a Moving Target Defense (MTD) framework for HR SaaS that combines container mutation, IP hopping, and node reassignment to randomize the attack surface without pausing services. Many prior defenses for cloud or IoT rely on static hardening or signature-driven detection and do not meet HR SaaS needs such as uninterrupted sessions, privacy compliance, and live service continuity. This paper presents a MTD framework for HR SaaS that combines container mutation, IP hopping, and node reassignment to randomize the attack surface without pausing services. The framework runs on Kubernetes and uses a KL-divergence–based anomaly detector that monitors HR access logs across five modules (onboarding, employee records, leave, payroll, and exit). In simulation with realistic HR traffic, the approach reaches 96.9% average detection accuracy with AUC 0.94–0.98, cuts mean time to containment to 91.4 s, and lowers the ransomware encryption rate to 13.2%. Measured overheads for CPU, memory, and per-mutation latency remain modest. Compared with prior MTD and non-MTD baselines, the design provides stronger containment without service interruption and aligns with zero-trust and compliance goals. Its modular implementation and control-plane orchestration support stepwise, enterprise-scale deployment in HR SaaS environments.

---

Keywords

---