a deception framework for survivability against next generation

1

A Deception Framework for Survivability Against Next Generation Cyber Attacks

Ruchika Mehresh and Shambhu UpadhyayaDepartment of Computer Science and Engineering,

University at Buffalo, Buffalo, NY 14260

3

Motivation

The Asymmetric warfare

Kind of sophisticated attacks happening lately: Botnets, command and control Operation Aurora Stuxnet

4

Problem Statement

How to enable critical systems to survive the next-generation of sophisticated attacks

Deception

5

Introduction

• Survivability is the ability of a system to perform its mission (essential operations) in presence of attacks, faults or accidents

• Focus on how to survive an attack– Does not focus on source or type of attack

6

Introduction

• Survivability involves four phases:– Prevention against faults/attacks– Detection of faults/attacks– Recovery from faults/attacks– Adaptation/Evolution to avoid future attacks

• Timeliness property

7

Introduction

Next-generation attack assessment

Formal requirements

Deception as a tool of defense

Proposed framework

8

SolutionUnderlying pattern in sophisticated attacks [6]

Features:1. Multi-shot2. Stealth3. Contingency plan

9

Formal system requirements

Recognizing the smart adversary

Prevention

Surreptitious detection

Effective recovery with adaptation

Zero-day attacks

10

Formal system requirements

Conserving timeliness property

Non-verifiable deception

11

Deception as tool of defense

• Preventive deception– Hiding, Distraction, Dissuasion

• Detection– Honeypot farm

• Recovery– Concealing the detection till an effective patch has

been worked out

12

Framework

13

Work in progress

• Design issues

• Controlling the feedback loop

• Smart-box design– Assess the nature of the traffic flow– Map AIOS to a honeypot

14

Conclusion

• Deception based survivability solution against sophisticated attacks

• Dealing with zero-day attacks while conserving timeliness property

• Stronger recovery with surreptitious detection

15

References1. E. Nakashima and J. Pomfret. China proves to be an aggressive foe in cyberspace,

November 2009.2. M. Ramilli and M. Bishop. Multi-stage delivery of malware. 5th International

Conference on Malicious and Unwanted Software (MALWARE), 2010.3. E. J. Kartaltepe, J. A. Morales, S. Xu, and R. Sandhu. Social network based botnet

command-and-control: emerging threats and countermeasures. Proceedings of the 8th international conference on Applied cryptography and network security (ACNS), pages 511–528, 2010.

4. M. Labs and M. F. P. Services. Protecting your critical assets, lessons learned from operation aurora. Technical report, 2010.

5. M. J. Gross. A declaration of cyber-war, April 2011.6. K. A. Repik. Defeating adversary network intelligence efforts with active cyber

defense techniques. Master’s thesis, Graduate School of Engineering and Management, Air Force Institute of Technology, 2008.

7. A. D. Lakhani. Deception techniques using honeypots. Master’s thesis, MSc Thesis, ISG, Royal Holloway, University of London, 2003.