Misery Digraphs: Delaying Intrusion Attacks in Obscure Clouds

Almohri, Hussain M. J.; Watson, Layne T.; Evans, David

doi:10.1109/tifs.2017.2779436

Cited by 11 publications

(15 citation statements)

References 30 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Almohri et al. [9] propose to delay remote attackers by strategically placing decoys in the cloud network. Similarly, Pham et al.…”

Section: Background and Motivationmentioning

confidence: 99%

“…Brzeczko et al [28] present an active deception model to secure cloud infrastructures by re-routing potential intruders to decoys. Almohri et al [9] propose to delay remote attackers by strategically placing decoys in the cloud network. Similarly, Pham et al [29] design a deceptive topology for virtual network from the perspective of stealthy attackers.…”

Section: Defensive Deception For Cloud Systemmentioning

confidence: 99%

“…To evaluate the effectiveness of detection, we simulate on a random-walker attacker [18] and a persistent attacker [9] as described in the adversarial model. The random-walker attacker takes a random attack path in AP 0 to reach target vertex.…”

Section: Simulation Setupmentioning

confidence: 99%

See 2 more Smart Citations

An optimal defensive deception framework for the container‐based cloud with deep reinforcement learning

Guo

Sun

et al. 2021

IET Information Security

View full text Add to dashboard Cite

Defensive deception is emerging to reveal stealthy attackers by presenting intentionally falsified information. To implement it in the increasing dynamic and complex cloud, major concerns remain about the establishment of precise adversarial model and the adaptive decoy placement strategy. However, existing studies do not fulfil both issues because of ( 1) the insufficiency on extracting potential threats in virtualisation technique, (2) the inadequate learning on the agility of target environment, and (3) the lack of measurement for placement strategy. In this study, an optimal defensive deception framework is proposed for the container based-cloud. The System Risk Graph (SRG) is formalised to depict an updatable adversarial model with the automatic orchestration platform. Afterwards, a Deep Reinforcement Learning (DRL) model is trained based on SRG. The well-trained DRL agent generates optimal placement strategies for the orchestration platform to distribute decoys and deceptive routings. Lastly, the coefficient of deception, C, is defined to evaluate the effectiveness of placement strategy. Simulation results show that the proposed method increases C by 30.22%, and increase the detection ratio on the random walker attacker and persistent attacker by 30.69% and 51.10%, respectively.

show abstract

“…Almohri et al. [9] propose to delay remote attackers by strategically placing decoys in the cloud network. Similarly, Pham et al.…”

Section: Background and Motivationmentioning

confidence: 99%

Section: Defensive Deception For Cloud Systemmentioning

confidence: 99%

See 1 more Smart Citation

An optimal defensive deception framework for the container‐based cloud with deep reinforcement learning

Guo

Sun

et al. 2021

IET Information Security

View full text Add to dashboard Cite

show abstract

“…VM live and cold migration propose to repeatedly relocate VMs across various physical hosts. Doing so for the purpose of defense has been addressed in previous work dealing with MTD and network defense in general [1,6,17,22,24,34,39], with suggested schemes generally differing in whether a VM's state is preserved or not. State preserving migration that we denote as live migration intends to seamlessly move a VM out of the attacker's reach while keeping it as is.…”

Section: Defense Techniquesmentioning

confidence: 99%

Automated benchmark network diversification for realistic attack simulation with application to moving target defense

Bajic

Becker²

2021

Int. J. Inf. Secur.

View full text Add to dashboard Cite

With numbers of exploitable vulnerabilities and attacks on networks constantly increasing, it is important to employ defensive techniques to protect one’s systems. A wide range of defenses are available and new paradigms such as Moving Target Defense (MTD) rise in popularity. But to make informed decisions on which defenses to implement, it is necessary to evaluate their effectiveness first. In many cases, the full impact these techniques have on security is not well understood yet. In this paper we propose network defense evaluation based on detailed attack simulation. Using a flexible modeling language, networks, attacks, and defenses are described in high detail, yielding a fine-grained scenario definition. Based on this, an automated instantiator generates a wide range of realistic benchmark networks. These serve to perform simulations, allowing to evaluate the security impact of different defenses, both quantitatively and qualitatively. A case study based on a mid-sized corporate network scenario and different Moving Target Defenses illustrates the usefulness of this approach. Results show that virtual machine migration, a frequently suggested MTD technique, more often degrades than improves security. Hence, we argue that evaluation based on realistic attack simulation is a qualified approach to examine and verify claims of newly proposed defense techniques.

show abstract

“…There are many security solutions proposed so far based on MTD in many areas including cloud computing, DDoS protection, and web security. [8][9][10][11] Software defined networking (SDN) is a very well-established networking paradigm. 12,13 Its fundamental goal is the separation of control and data planes and provision of central management.…”

Section: Introductionmentioning

confidence: 99%

Toward Domain Name System privacy enhancement using intent‐based Moving Target Defense framework over software defined networks

Hyder

Ismail

2021

Trans Emerging Tel Tech

View full text Add to dashboard Cite

Moving Target Defense (MTD) is an active security procedure while intent-based networking (IBN) is gaining popularity as an evolving networking model. Software defined network (SDN) provides centralized network management through the control plane. In this article, a mechanism for the privacy enhancement of the Domain Name System (DNS) is proposed using intent-based MTD over SDN. DNS is a critical internet service with a high risk of privacy disclosure as it is related to user preferences. The proposed model privacy enhancement using intent-based MTD running over SDN (PEIMS) exploits IBN API of ONOS SDN controller along with Openflow flow modification for privacy enhancement. PEIMS core components include MTD application running over the ONOS SDN controller, ONOS intent-based API, and the DNS server. The notion is the protection of privacy disclosures that occur during DNS queries. PEIMS provides a dynamic port shuffling technique for mapping DNS traffic to minimize the attacker's chances of observing the DNS queries responses. The proposed model was implemented using ONOS controller, ONOS north bound intent-based API, and Mininet. The proposed model was evaluated in terms of privacy protection, attacker, and defender cost. The results showed promising trends for DNS privacy protection at a low computational cost. The work also quantified the privacy disclosures.

show abstract

Misery Digraphs: Delaying Intrusion Attacks in Obscure Clouds

Cited by 11 publications

References 30 publications

An optimal defensive deception framework for the container‐based cloud with deep reinforcement learning

An optimal defensive deception framework for the container‐based cloud with deep reinforcement learning

Automated benchmark network diversification for realistic attack simulation with application to moving target defense

Toward Domain Name System privacy enhancement using intent‐based Moving Target Defense framework over software defined networks

Contact Info

Product

Resources

About