A Quantitative Framework to Model Reconnaissance by Stealthy Attackers and Support Deception-Based Defenses

Pham, Luan Huy; Albanese, Massimiliano; Chadha, Ritu; Chiang, Cho‐Yu Jason; Sridhar, Varadharajan; Kamhoua, Charles A.; Leslie, Nandi

doi:10.1109/cns48642.2020.9162298

Cited by 7 publications

(5 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Pham et al in [21] proposed a novel model to capture how advanced, stealthy adversaries acquire knowledge about the target network and establish and expand their foothold within the system. From the adversary's perspective, this model quantifies the cost and reward of compromising and maintaining control over target nodes.…”

Section: Algaolahi Et Al Inmentioning

confidence: 99%

Modeling Intruder Reconnaissance Behavior through State Diagrams to Support Defensive Deception

Belalis

Σπαθούλας

Anagnostopoulos

2023

JCP

View full text Add to dashboard Cite

Active reconnaissance is the primary source of information gathering about the infrastructure of a target network for intruders. Its main functions are host discovery and port scanning, the basic techniques of which are thoroughly analyzed in the present paper. The main contribution of the paper is the definition of a modeling approach regarding (a) all possible intruder actions, (b) full or partial knowledge of the intruder’s preferred methodology, and (c) the topology of the target network. The result of the modeling approach, which is based on state diagrams, is the extraction of a set of all probable paths that the intruder may follow. On top of this, a number of relevant metrics are calculated to enable the dynamic assessment of the risk to specific network assets according to the point on the paths at which the intruder is detected. The proposed methodology aims to provide a robust model that can enable the efficient and automated application of deception techniques to protect a given network. A series of experiments has also been performed to assess the required resources for the modeling approach when applied in real-world applications and provide the required results with bearable overhead to enable the online application of deception measures.

show abstract

Section: Algaolahi Et Al Inmentioning

confidence: 99%

Modeling Intruder Reconnaissance Behavior through State Diagrams to Support Defensive Deception

Belalis

Σπαθούλας

Anagnostopoulos

2023

JCP

View full text Add to dashboard Cite

show abstract

“…[44,45] to simulate their deception system and combine it with their proposed work. Thakoor et al [132] used the CyberVan [41,109] as a network simulation testbed to simulate their game-theoretic cyberdeception techniques. Al Amin et al [6] and Bilinski et al [30] proposed a deceptive system which was simulated using a Markov decision processes.…”

Section: B Evaluation Testbedsmentioning

confidence: 99%

Game-Theoretic and Machine Learning-based Approaches for Defensive Deception: A Survey

Zhu¹,

Anwar²,

Wan³

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

Defensive deception is a promising approach for cyberdefense. Although defensive deception is increasingly popular in the research community, there hasn't been a systematic investigation of its key components, the underlying principles, and its tradeoffs in various problem settings. This survey paper focuses on defensive deception research centered on game theory and machine learning, since these are prominent families of artificial intelligence approaches that are widely employed in defensive deception. This paper brings forth insights, lessons, and limitations from prior work. It closes with an outline of some research directions to tackle major gaps in current defensive deception research.

show abstract

“…Similarly, Pham et al. [29] design a deceptive topology for virtual network from the perspective of stealthy attackers.…”

Section: Background and Motivationmentioning

confidence: 99%

“…Almohri et al [9] propose to delay remote attackers by strategically placing decoys in the cloud network. Similarly, Pham et al [29] design a deceptive topology for virtual network from the perspective of stealthy attackers.…”

Section: Defensive Deception For Cloud Systemmentioning

confidence: 99%

An optimal defensive deception framework for the container‐based cloud with deep reinforcement learning

Guo

Sun

et al. 2021

IET Information Security

View full text Add to dashboard Cite

Defensive deception is emerging to reveal stealthy attackers by presenting intentionally falsified information. To implement it in the increasing dynamic and complex cloud, major concerns remain about the establishment of precise adversarial model and the adaptive decoy placement strategy. However, existing studies do not fulfil both issues because of ( 1) the insufficiency on extracting potential threats in virtualisation technique, (2) the inadequate learning on the agility of target environment, and (3) the lack of measurement for placement strategy. In this study, an optimal defensive deception framework is proposed for the container based-cloud. The System Risk Graph (SRG) is formalised to depict an updatable adversarial model with the automatic orchestration platform. Afterwards, a Deep Reinforcement Learning (DRL) model is trained based on SRG. The well-trained DRL agent generates optimal placement strategies for the orchestration platform to distribute decoys and deceptive routings. Lastly, the coefficient of deception, C, is defined to evaluate the effectiveness of placement strategy. Simulation results show that the proposed method increases C by 30.22%, and increase the detection ratio on the random walker attacker and persistent attacker by 30.69% and 51.10%, respectively.

show abstract

A Quantitative Framework to Model Reconnaissance by Stealthy Attackers and Support Deception-Based Defenses

Cited by 7 publications

References 12 publications

Modeling Intruder Reconnaissance Behavior through State Diagrams to Support Defensive Deception

Modeling Intruder Reconnaissance Behavior through State Diagrams to Support Defensive Deception

Game-Theoretic and Machine Learning-based Approaches for Defensive Deception: A Survey

An optimal defensive deception framework for the container‐based cloud with deep reinforcement learning

Contact Info

Product

Resources

About