Blockchain-Enabled Intrusion Detection and Prevention System of APTs Within Zero Trust Architecture

Abstract

In a world where organisations are embracing new IT working models such as Bring Your Own Device (BYOD) and remote working, the traditional mindset of defending the network perimeter is no longer sufficient. Zero Trust Architecture (ZTA) has recently emerged as a new security model in which the breach mindset dominates the threat model. By default, the ZTA considers any endpoint (i.e., device), user, or application to be untrusted until proven otherwise. Nonetheless, once proven by the endpoint, using Advanced Persistent Threats (APT), attackers can still take over an authenticated and authorised session via that endpoint. Therefore, they can perform several user/device centric malicious activities in addition to lateral movement rendering the endpoint as the Achilles heel of ZTA. To effectively deter APT attack capabilities on the endpoints, this work proposes a Blockchain-enabled Intrusion Detection and Prevention System (BIDPS) that augments ZTA onto endpoints. The BIDPS aims to achieve two core outcomes: first, detect and prevent attackers' techniques and tactics as per MITRE's ATT&CK enterprise matrix earlier than the lateral movement stage, and secondly, strip trust out of the endpoint itself and place it on-chain, thus creating an immutable system of explicit trust. To evaluate the effectiveness of the BIDPS, a testbed was built where techniques of over ten APTs attacks were launched against the endpoint. BIDPS has proven a high rate of success defending against the launched attacks owing to its Blockchain's immutability, fortifying the detection/prevention processes.

Zero‐trust‐based security model against data breaches in the banking sector: A blockchain consensus algorithm

“…[60] proposes a Blockchain‐enabled Intrusion Detection and Prevention System (BIDPS) that aims to augment ZTA onto endpoints to effectively deter Advanced Persistent Threats (APT) attack capabilities. The BIDPS aims to detect and prevent attackers' techniques and tactics earlier than the lateral movement stage, strip trust out of the endpoint itself, and create an immutable system of explicit trust on the blockchain.…”

Internet of Things Intrusion Detection System Based on Convolutional Neural Network

“…In 2020, Latif et al [39] proposed an intrusion detection model based on federated learning and claimed the use of genetic algorithms with feedforward neural networks can better improve the accuracy of IDS. In 2022, Alevizos et al [40] consider a new security model called Zero Trust Architecture (ZTA) where no endpoint (i.e. device), user or application can be trusted.…”

Towards Trusted and Accountable Win-Win SDWN Platform for Trading Wi-Fi Network Access

“…In the case of video streaming, the considered minimum bit rate requirement for watching videos on YouTube is 700 kbps with Standard Definition (SD) 360p, 1.1 Mbps in the case of SD 480p, and 5 Mbps for High Definition (HD) 1080p 2 . The considered minimum bit rate requirement for watching videos on Netflix is 1 Mbps and 5 Mbps for SD and HD, respectively 3 . Finally, 50 independent simulation runs were performed to obtain the results which have been analysed in the next subsections.…”

“…These operators do not necessarily trust each other and would not yet trust the unknown SDWN controller that would handle the operations of the proposed platform. To alleviate this issue, Blockchain technologies [3] are utilised to establish that trust and facilitate a transparent, accountable, and trusted way for NOs to cooperate without giving up control to any other entity.…”