Effective Proactive and Reactive Defense Strategies against Malicious Attacks in a Virtualized Honeynet

Abstract

Virtualization plays an important role in the recent trend of cloud computing. It allows the administrator to manage and allocate hardware resources flexibly. However, it also causes some security issues. This is a critical problem for service providers, who simultaneously strive to defend against malicious attackers while providing legitimate users with high quality service. In this paper, the attack-defense scenario is formulated as a mathematical model where the defender applies both proactive and reactive defense mechanisms against attackers with different attack strategies. In order to simulate real-world conditions, the attackers are assumed to have incomplete information and imperfect knowledge of the target network. This raises the difficulty of solving the model greatly, by turning the problem nondeterministic. After examining the experiment results, effective proactive and reactive defense strategies are proposed. This paper finds that a proactive defense strategy is suitable for dealing with aggressive attackers under “winner takes all” circumstances, while a reactive defense strategy works better in defending against less aggressive attackers under “fight to win or die” circumstances.

A Cyber-Attack Synergy Model Considering Both Positive and Negative Impacts from Each Attacker

“…As is evident in Table 8, the value of contest intensity determines the nature of a battle. However, there should be no obvious trend for network compromise probability based on the different values of contest intensity [14][15][16][17]. In other words, the value of contest intensity prefers neither the defender nor the commanders.…”

“…This function has been widely used in the literature addressing various economicsrelated activities, as well as international and civil wars [12,13]. In recent years, this theory has also been applied to the determination of the success probability for the attacker to compromise a system [14][15][16][17]. The form of contest success function is as follows:…”

A framework for Operational Security Metrics Development for industrial control environment

“…For instance, availability objectives could be decomposed into timeliness, recoverability, redundancy, etc. Integrity objective could be decomposed into accountability, authentication, non-repudiation [53], dependability, veracity, etc., while confidentiality objective could be decomposed to authorisation, access control, etc. [6], [10], [15], [33].…”

“…Existing security control efforts and implementations basically take on one of two broad control capabilities: proactivity and reactivity [53], [54]. Security metrics should thus mirror the same dimensions.…”

Research and Implementation of a Network Secure System Based on Honeypots

“…A virtual Honeypot Framework [3] describes the design and implementation of Honeyd, a framework for virtual honeypots that simulates computer systems at the network level. Literature [4] propose that a honeynet can be used to assist the system administrator in identifying malicious traffic on the enterprise network. Literature [5] applies the honeypot concept to the email system in order to proactively detect bad providers where the honey consists of unique email address.…”