Abstract:Recently cyber deception has emerged as a promising defense approach for detecting and defeating advanced persistent threat. By leveraging deceptive decoys, the defenders seek to proactively engage with the attackers and entice them away from the protected server infrastructure. The effectiveness of such decoy-based deception largely relies on the decoy fidelity. In this paper, we observe that realistic server system inevitably experiences wearoff from service request processing and regular maintenance, resulting in characteristic access pattern, running states, and system artifacts. Accordingly, we identify two deception evasion attacks, namely, traffic fingerprinting and system fingerprinting, which enable sophisticated adversaries to accurately distinguish decoys from real servers. To protect web server decoys against those evasion attacks, we develop Mirage, a seamless real-time network traffic replay framework to generate network traffic and system artifacts on the decoy server based on the normal clients' interactions with the real server. Mirage works as a TLS-capable reverse proxy that transparently replays real traffic towards decoys. To resolve the inconsistent states between the real and decoy servers, we integrate a decoy client emulator into the reverse proxy to maintain the stateful data features and caching logic of a decoy session. Moreover, we employ format preserving encryption technique to obfuscate sensitive data before being sent to the decoy server. Implementations and evaluations of a prototype demonstrate that Mirage can effectively mitigate deception evasion attacks with acceptable performance overhead.

Research and Implement of Network Deception System Based on Network/host Copy

Technique of Network Topology and OS Camouflage

Hiding and Trapping: A Deceptive Approach for Defending against Network Reconnaissance with Software-Defined Network

Research on Active Network Defence Technology Based on Deception

Towards a Believable Decoy System: Replaying Network Activities from Real System

Research and Implementation of Network Security Cooperative Defense System

WiP: Deception-in-Depth Using Multiple Layers of Deception

A Distributed IP Spoof Detection System in Intranet

A Dynamic Deceptive Honeynet System with A Hybrid of Virtual and Real Devices

Research on Seamless Switch Environment Technology of Intrusion Deception

New Backdoor Communication Way Based on Fake DNS and Sniffer

Cyber Deception Reactive: TCP Stealth Redirection to On-Demand Honeypots

Secure Networked Control Under Deception Attacks

Several Research and Implementation of Applications based on ARP Protocol

Applying Wireless Honeypot to Deception-in-Depth

Application Layer Cyber Deception without Developer Interaction

A Secure Dynamic Content Delivery Scheme in Named Data Networking

A New Multi-Function System to Deal with Hacker Intrusion

CyberMoat: Camouflaging critical server infrastructures with large scale decoy farms.

Design and Implementation of the Sniffer Prototype Based on the MAC Spoofing

Secure (S)Hell: Introducing an SSH Deception Proxy Framework