TY - GEN
T1 - Keeping intruders at bay
T2 - 11th International Joint Conference on E-Business and Telecommunications, ICETE 2014
AU - Shakarian, Paulo
AU - Kulkarni, Nimish
AU - Albanese, Massimiliano
AU - Jajodia, Sushil
N1 - Funding Information:
This work was partially supported by the Army Research Office under award number W911NF-13-1-0421. Paulo Shakarian were supported by the Army Research Office project 2GDATXR042. The work of Sushil Jajodia was also supported by the MITRE Sponsored Research Program.
Publisher Copyright:
© Springer International Publishing Switzerland 2015.
PY - 2015
Y1 - 2015
N2 - It is well known that not all intrusions can be prevented and additional lines of defense are needed to deal with intruders. However, most current approaches use honey-nets relying on the assumption that simply attracting intruders into honeypots would thwart the attack. In this chapter, we propose a different and more realistic approach, which aims at delaying intrusions, so as to control the probability that an intruder will reach a certain goal within a specified amount of time. Our method relies on analyzing a graphical representation of the computer network’s logical layout and an associated probabilistic model of the adversary’s behavior. We then artificially modify this representation by adding "distraction clusters"-collections of interconnected virtual machines-at key points of the network in order to increase complexity for the intruders and delay the intrusion. We study this problem formally, showing it to be NP-hard and then provide an approximation algorithm that exhibits several useful properties. Finally, we compare recent approach for selecting a subset of distraction clusters with our prototypal implementation of the proposed framework and then unveil experimental results.
AB - It is well known that not all intrusions can be prevented and additional lines of defense are needed to deal with intruders. However, most current approaches use honey-nets relying on the assumption that simply attracting intruders into honeypots would thwart the attack. In this chapter, we propose a different and more realistic approach, which aims at delaying intrusions, so as to control the probability that an intruder will reach a certain goal within a specified amount of time. Our method relies on analyzing a graphical representation of the computer network’s logical layout and an associated probabilistic model of the adversary’s behavior. We then artificially modify this representation by adding "distraction clusters"-collections of interconnected virtual machines-at key points of the network in order to increase complexity for the intruders and delay the intrusion. We study this problem formally, showing it to be NP-hard and then provide an approximation algorithm that exhibits several useful properties. Finally, we compare recent approach for selecting a subset of distraction clusters with our prototypal implementation of the proposed framework and then unveil experimental results.
KW - Adversarial modeling
KW - Graph theory
KW - Moving target defense
UR - http://www.scopus.com/inward/record.url?scp=84955318092&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=84955318092&partnerID=8YFLogxK
U2 - 10.1007/978-3-319-25915-4_11
DO - 10.1007/978-3-319-25915-4_11
M3 - Conference contribution
AN - SCOPUS:84955318092
SN - 9783319259147
T3 - Communications in Computer and Information Science
SP - 191
EP - 211
BT - E-Business and Telecommunications - 11th International Joint Conference, ICETE 2014, Revised Selected Papers
A2 - Obaidat, Mohammad S.
A2 - Filipe, Joaquim
A2 - Holzinger, Andreas
PB - Springer Verlag
Y2 - 28 August 2014 through 30 August 2014
ER -