Lost in Translation: Improving Decoy Documents via Automated Translation

Abstract

Abstract-Detecting insider attacks continues to prove to be one of the most difficult challenges in securing sensitive data. Decoy information and documents represent a promising approach to detecting malicious masqueraders; however, false positives can interfere with legitimate work and take up user time. We propose generating foreign language decoy documents that are sprinkled with untranslatable enticing proper nouns such as company names, hot topics, or apparent login information. Our goal is for this type of decoy to serve three main purposes. First, using a language that is not used in normal business practice gives real users a clear signal that the document is fake, so they waste less time examining it. Second, an attacker, if enticed, will need to exfiltrate the document's contents in order to translate it, providing a cleaner signal of malicious activity. Third, we consume significant adversarial resources as they must still read the document and decide if it contains valuable information, which is made more difficult as it will be somewhat scrambled through translation. In this paper, we expand upon the rationale behind using foreign language decoys. We present a preliminary evaluation which shows how they significantly increase the cost to attackers in terms of the amount of time that it takes to determine if a document is real and potentially contains valuable information or is entirely bogus, confounding their goal of exfiltrating important sensitive information.

Insider Threat Identification by Process Analysis

“…Others study how to create effective decoys [41] and honeypots [42]. Stolfo et al [43] extend this work to the cloud.…”

Towards Creating Believable Decoy Project Folders for Detecting Data Theft

“…In this paper we introduce a data-driven approach to create believable project folders that can be deployed to detect data theft attempts. Previous approaches focused on creating and placing single decoy documents( [13], [2], [10], [11]) or file systems [6]. Conceptually we also create decoys to detect data theft.…”

A bodyguard of lies

“…In [5], a project history is simulated for a piece of bogus software is produced by introducing obfuscated software variations. Similarly, in [9], the creation of documents in foreign languages is proposed to deceive attackers without the ability to apply translation tools on the fly.…”