PhantomFS: File-Based Deception Technology for Thwarting Malicious Users

Abstract

File-based deception technologies can be used as an additional security barrier when adversaries have successfully gained access to a host evading intrusion detection systems. Adversaries are detected if they access fake files. Though previous works have mainly focused on using user data files as decoys, this concept can be applied to system files. If so, it is expected to be effective in detecting malicious users because it is very difficult to commit an attack without accessing a single system file. However, it may suffer from excessive false alarms by legitimate system services such as file indexing and searching. Legitimate users may also access fake files by mistake. This paper addresses this issue by introducing a hidden interface. Legitimate users and applications access files through the hidden interface which does not show fake files. The hidden interface can also be utilized to hide sensitive files by hiding them from the regular interface. By experiments, we demonstrate the proposed technique incurs negligible performance overhead, and it is an effective countermeasure to various attack scenarios and practical in that it does not generate false alarms for legitimate applications and users.

PhantomFS-v2: Dare You to Avoid This Trap

“…The file-based deception technology has been demonstrated to be effective in thwarting malicious users who have gained access to the host evading intrusion detection systems [9]. However, if adversaries become aware of the deception technology, the deception technology is unlikely to succeed in alluring adversaries.…”

“…The goal of PhantomFS [9] is to allure adversaries who have already gained access to a host without being detected by traditional intrusion detection systems. PhantomFS offers an additional security barrier to thwart such adversaries.…”

“…The original paper [9] assumes adversaries do not know anything about PhantomFS. They do not know the existence of the hidden interface and the location of the hidden path.…”

“…file indexing). PhantomFS [9] addresses this issue by introducing a hidden interface. The hidden interface is known only to legitimate users and applications.…”

Leveraging Machine Learning Techniques to Identify Deceptive Decoy Documents Associated With Targeted Email Attacks

“…Using decoy documents to track the users with malicious intent, the proposed method did not require additional user credential in the authentication process. In [13], Lee et al developed a hidden interface that recognized malicious users and used decoy files to lure them into an monitored environment. The advantage of their method is that no false alarms will be raised by legitimate applications and users.…”