HoneyProxy: Design and implementation of next-generation honeynet via SDN

Kyung, Sukwha; Han, Wonkyu; Tiwari, Naveen; Dixit, Vaibhav Hemant; Srinivas, L. N. B.; Zhao, Ziming; Doupé, Adam; Ahn, Gail-Joon

doi:10.1109/cns.2017.8228653

Cited by 39 publications

(16 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…e front-end decoys transparently intercept and forward malicious commands to the back-end decoys, which use a low-interaction honeypot to show a high-interaction system view. Honeyproxy [12] can copy one attack traffic to multiple trapping points and then selects the most suitable one from all of the replies to feedback to the attacker. Honeypatches [13] use LXC as a trapping point and transfer the attack session that has touched the decoy patch to a specific trapping point for attack trapping.…”

Section: Related Workmentioning

confidence: 99%

A Multiphase Dynamic Deployment Mechanism of Virtualized Honeypots Based on Intelligent Attack Path Prediction

Gao

Zhang

Xing

2021

Security and Communication Networks

View full text Add to dashboard Cite

As an important deception defense method, a honeypot can be used to enhance the network’s active defense capability effectively. However, the existing rigid deployment method makes it difficult to deal with the uncertain strategic attack behaviors of the attackers. To solve such a problem, we propose a multiphase dynamic deployment mechanism of virtualized honeypots (MD2VH) based on the intelligent attack path prediction method. MD2VH depicts the attack and defense characteristics of both attackers and defenders through the Bayesian state attack graph, establishes a multiphase dynamic deployment optimization model of the virtualized honeypots based on the extended Markov’s decision-making process, and generates the deployment strategies dynamically by combining the online and offline reinforcement learning methods. Besides, we also implement a prototype system based on software-defined network and virtualization container, so as to evaluate the effectiveness of MD2VH. Experiments results show that the capture rate of MD2VH is maintained at about 90% in the case of both simple topology and complex topology. Compared with the simple intelligent deployment strategy, such a metric is increased by 20% to 60%, and the result is more stable under different types of the attacker’s strategy.

show abstract

Section: Related Workmentioning

confidence: 99%

A Multiphase Dynamic Deployment Mechanism of Virtualized Honeypots Based on Intelligent Attack Path Prediction

Gao

Zhang

Xing

2021

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…However, the false negatives will remain in the system while a substantial number of compromised nodes is evicted using DS 4 . • DS 5 -Low/high-interaction honeypots (LHs/HHs) [24]: LHs and HHs can be activated as a defense strategy. LHs and HHs differ in their deception detectability and cost.…”

Section: Defense Modelmentioning

confidence: 99%

“…As expected, since DD-based schemes allow the defender to learn additional attack intelligence which is considered in the NIDS, this naturally leads to the improvement of the TPR in the NIDS. 19)- (24) in this supplement document and Eqs. ( 9) and (10) in the main paper.…”

Section: B4 Tpr Of the Nids With Respect To The Number Of Gamesmentioning

confidence: 99%

See 1 more Smart Citation

Foureye: Defensive Deception based on Hypergame Theory Against Advanced Persistent Threats

Wan,

Cho,

Zhu

et al. 2021

Preprint

View full text Add to dashboard Cite

Defensive deception techniques have emerged as a promising proactive defense mechanism to mislead an attacker and thereby achieve attack failure. However, most game-theoretic defensive deception approaches have assumed that players maintain consistent views under uncertainty. They do not consider players' possible, subjective beliefs formed due to asymmetric information given to them. In this work, we formulate a hypergame between an attacker and a defender where they can interpret the same game differently and accordingly choose their best strategy based on their respective beliefs. This gives a chance for defensive deception strategies to manipulate an attacker's belief, which is the key to the attacker's decision making. We consider advanced persistent threat (APT) attacks, which perform multiple attacks in the stages of the cyber kill chain where both the attacker and the defender aim to select optimal strategies based on their beliefs. Through extensive simulation experiments, we demonstrated how effectively the defender can leverage defensive deception techniques while dealing with multi-staged APT attacks in a hypergame in which the imperfect information is reflected based on perceived uncertainty, cost, and expected utilities of both attacker and defender, the system lifetime (i.e., mean time to security failure), and improved false positive rates in detecting attackers.

show abstract

“…HoneyProxy [13] proposed the essential component used in HoneyMix. The proxy module distributes the requests and selects the most appropriate response for the attacker to interact with.…”

Section: B Sdn-enabled Honeypot Architecturesmentioning

confidence: 99%