NDLI: Multi-dimensional Host Identity Anonymization for Defeating Skilled Attackers

Please wait, while we are loading the content...

A Cyber Mutation: Metrics, Techniques and Future Directions

Have No PHEAR: Networks Without Identifiers

A Moving Target Defense Approach to Disrupting Stealthy Botnets

Demo: A Symbolic N-Variant System

Moving Target Defense: a Journey from Idea to Product

Markov Modeling of Moving Target Defense Games

Towards Cost-Effective Moving Target Defense Against DDoS and Covert Channel Attacks

Multi-dimensional Host Identity Anonymization for Defeating Skilled Attackers

Moving Target Defense against DDoS Attacks: An Empirical Game-Theoretic Analysis

SDN based Scalable MTD solution in Cloud Network

Mayflies: A Moving Target Defense Framework for Distributed Systems

Dependency Graph Analysis and Moving Target Defense Selection

Formal Approach for Resilient Reachability based on End-System Route Agility

Automated Effectiveness Evaluation of Moving Target Defenses: Metrics for Missions and Attacks

Multi-dimensional Host Identity Anonymization for Defeating Skilled Attackers

Content Provider	ACM Digital Library
Author	Jafarian, Jafar Haadi Niakanlahiji, Amirreza Duan, Qi Al-Shaer, Ehab
Abstract	While existing proactive-based paradigms such as address mutation are effective in slowing down reconnaissance by naive attackers, they are ineffective against skilled human attackers. In this paper, we analytically show that the goal of defeating reconnaissance by skilled human attackers is only achievable by an integration of five defensive dimensions: (1) mutating host addresses, (2) mutating host fingerprints, (3) anonymizing host fingerprints, (4) deploying high-fidelity honeypots with context-aware fingerprints, and (5) deploying context-aware content on those honeypots. Using a novel class of honeypots, referred to as proxy honeypots (high-interaction honeypots with customizable fingerprints), we propose a proactive defense model, called (HIDE), that constantly mutates addresses and fingerprints of network hosts and proxy honeypots in a manner that maximally anonymizes identity of network hosts. The objective is to make a host untraceable over time by not letting even skilled attackers reuse discovered attributes of a host in previous scanning, including its addresses and fingerprint, to identify that host again. The mutations are generated through formal definition and modeling the problem. Using a red teaming evaluation with a group of white-hat hackers, we evaluated our five-dimensional defense model and compared its effectiveness with alternative and competing scenarios. These experiments as well as our analytical evaluation show that by anonymizing all identifying attributes of a host/honeypot over time, HIDE is able to significantly complicate reconnaissance, even for highly skilled human attackers.
Starting Page	47
Ending Page	58
Page Count	12
File Format	PDF
ISBN	9781450345705
DOI	10.1145/2995272.2995278
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2016-10-24
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Moving target defense Reconnaissance Active cyber deception Address randomization Fingerprint anonymization
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in