Cyber Deception Reactive: TCP Stealth Redirection to On-Demand Honeypots
Fuente:
arXiv
Guardado en:
| Autores principales: | , , |
|---|---|
| Formato: | Preprint |
| Publicado: |
2024
|
| Materias: | |
| Acceso en línea: | |
| Etiquetas: |
Agregar Etiqueta
Sin Etiquetas, Sea el primero en etiquetar este registro!
|
| _version_ | 1866914685555572736 |
|---|---|
| author | Lopez, Pedro Beltran Nespoli, Pantaleone Perez, Manuel Gil |
| author_facet | Lopez, Pedro Beltran Nespoli, Pantaleone Perez, Manuel Gil |
| contents | Cybersecurity is developing rapidly, and new methods of defence against attackers are appearing, such as Cyber Deception (CYDEC). CYDEC consists of deceiving the enemy who performs actions without realising that he/she is being deceived. This article proposes designing, implementing, and evaluating a deception mechanism based on the stealthy redirection of TCP communications to an on-demand honey server with the same characteristics as the victim asset, i.e., it is a clone. Such a mechanism ensures that the defender fools the attacker, thanks to stealth redirection. In this situation, the attacker will focus on attacking the honey server while enabling the recollection of relevant information to generate threat intelligence. The experiments in different scenarios show how the proposed solution can effectively redirect an attacker to a copied asset on demand, thus protecting the real asset. Finally, the results obtained by evaluating the latency times ensure that the redirection is undetectable by humans and very difficult to detect by a machine. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2402_09191 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | Cyber Deception Reactive: TCP Stealth Redirection to On-Demand Honeypots Lopez, Pedro Beltran Nespoli, Pantaleone Perez, Manuel Gil Cryptography and Security Networking and Internet Architecture Performance Systems and Control Cybersecurity is developing rapidly, and new methods of defence against attackers are appearing, such as Cyber Deception (CYDEC). CYDEC consists of deceiving the enemy who performs actions without realising that he/she is being deceived. This article proposes designing, implementing, and evaluating a deception mechanism based on the stealthy redirection of TCP communications to an on-demand honey server with the same characteristics as the victim asset, i.e., it is a clone. Such a mechanism ensures that the defender fools the attacker, thanks to stealth redirection. In this situation, the attacker will focus on attacking the honey server while enabling the recollection of relevant information to generate threat intelligence. The experiments in different scenarios show how the proposed solution can effectively redirect an attacker to a copied asset on demand, thus protecting the real asset. Finally, the results obtained by evaluating the latency times ensure that the redirection is undetectable by humans and very difficult to detect by a machine. |
| title | Cyber Deception Reactive: TCP Stealth Redirection to On-Demand Honeypots |
| topic | Cryptography and Security Networking and Internet Architecture Performance Systems and Control |
| url | https://arxiv.org/abs/2402.09191 |