Deception Game on Decoy Systems and Honeypots
Deception Game on
Decoy Systems
Gihyuk Ko
gko@andrew.cmu.edu
Carnegie Mellon University
Decoy Systems and Honeypots
2
•
Decoy Systems
:
–
One of the deception technologies in computer security
–
Lure attackers into accessing fake objects (i.e., decoys)
–
Monitor attackers’ behavior, mitigate intrusion
•
Many variations in implementations of
decoy systems
–
Honeypots, Honeywords, Kamouflage System
, etc.
•
Honeypots
[Spitzner03]
:
“an information system resource whose value lies in
unauthorized or illicit use of that resource”
–
A
fake
server/host which
looks like a real
server/host
–
Seems as a valuable resource to attack to the attackers
–
No true value to the outsiders
Honeypots in the network
3
Honeypots
Actual servers
Attacker
272.17.31.10
272.17.31.11
272.17.31.12
272.17.31.13
272.17.31.14
272.17.31.15
272.17.31.16
272.17.31.17
Attack
successful
Attack fails:
becomes
monitored
Fake Honeypots
[Rowe06]
•
Attackers became aware that defenders use
honeypots
–
Attackers
‘probe’
the target to avoid attacking
honeypots
–
Attackers may collect
‘clues’
to discover honeypots
using
‘heuristics’
•
Signature-based approach
: look for particular features
e.g., well-known honeypot tool name, “magic numbers”
•
Anomaly-based approach
: use metrics on entire system
e.g., # of files / subdirectories, # of english-word file names,
stdev of length of filename
4
Fake Honeypots
[Rowe06]
(cont’d)
•
Fake honeypots:
–
Ordinary hosts/servers which are made to appear
like honeypots
–
Produced by planting
‘clues’
into the system
e.g., plant well-known honeypot tool’s trace in the memory,
make the stdev of the filename length close to zero
•
Attackers who discover
‘clues’
will
avoid the system
•
Fake honeypots are protected against intrusion
–
Using decoys, defender can deliberatively
‘
deceive’
attackers in active way
5
Attacker-defender game using honeypots
•
Consider an attacker who wants to attack
honeypot network
–
Attacker attacks honeypot node
gets detected
–
Attacker would first try to discover (by
‘probing’
)
honeypots, and avoid attacking them
–
Defender can build
‘fake honeypot’
to deceive the
attacker
–
These interactions can happen multiple times back
and forth
•
This can be viewed as a
two-player
game
!
6
Key Points
•
Many variations in deception techniques
which use decoy systems
–
Honeypots, Fake honeypots
•
Some attacker-defender interactions using the
decoy systems can be explained as
a two-
player game
–
Developing a game-theory model can benefit
defender in countering attacker with strategy!
7
Objective
•
Develop a
game-theoretic model
which
reflects
interactions
between real world
attacker and defender using
decoy
systems
, that
involve deceptive actions
such as ‘lying’.
8
Game Definition – Decoy Systems
Decoy Systems:
–
True objects:
actual valuable resource (e.g., servers)
–
Decoy objects:
decoys without any value (e.g., honeypots)
•
Total
n
objects,
k
true objects
,
n-k
decoys
•
Indicator function:
/
9
Game Definition – Category
We define a
two-player non-cooperative
complete imperfect information dynamic game
–
Two-player
: Attacker
A
, Defender
D
–
Non-cooperative
: independent decision-making
–
Complete information
: strategy profiles and
payoffs(utilities) are known to each other
–
Imperfect information
: not all the past actions are
known to each party
–
Dynamic
: turn-taking manner
10
Game Definition – Goals / Moves
Goals
•
A
’s goal:
distinguish
true objects from all objects
–
Learn
•
D
’s goal: prevent attacker from learning true objects
–
By
‘lying’
to an attacker
Moves
;
11
Game Definition – Moves (cont’d)
12
D
Initialization
D
deploys
decoys
and
true objects
D
defines an indicator function
Game Definition – Moves (cont’d)
13
D
Probe-Respond
A
A
picks an object to
‘probe’
D
responds to
‘probe’:
Tell the Truth
:
return indicator value of an object
Lie
:
return logical complement of indicator value of an object
Repeats until
A
stops
Game Definition – Moves (cont’d)
14
D
Termination
A
A
concludes with
k
objects to attack
...
Game Definition – Moves (cont’d)
Moves (cont’d)
•
Multiple
‘probes’
on the same object:
–
Applying different
‘heuristics’
to the same object
–
Higher probability to reveal identity of the object
–
Assumption
: two
‘probes’
on the same object
reveals whether object is decoy or not
15
Game Definition – Utilities
Utilities
•
We assume both
A
’s
‘probing’
and
D
’s
‘lying’
have per-
action costs
–
A
’s per-probe cost overall cost
–
D
’s per-lie cost
overall cost
•
Incentives depend on attacker’s final move (attack):
–
When
A
picked a
true object,
A
gets
overall incentive
–
When
A
picked a
decoy object
,
D
gets overall incentive
–
Incentives work in zero-sum manner:
•
Overall utility:
16
Analysis on Possible Strategies
Three possible example attacker strategies
•
All-Round-Probing
Attacker
•
No-Probing
Attacker
•
Selectively-Probing
Attacker
17
Analysis on Possible Strategies
All-Round-Probing Attacker
•
Attacker probes all objects
twice
until it finds k
true objects
•
Attacker always gets
k
true object right
–
Defender’s lies doesn’t help: defender should n
o
t use
any lies to maximize its utility
–
Unlikely to be considered as an attacker strategy
18
Analysis on Possible Strategies
No-Probing Attacker
•
Attacker might guess
k
objects without any probing
–
No cost for both
A
and
D
•
Efficiency of decoy systems comes as countermeasure
–
Intuitively, increasing portion of decoys
in the network,
expected correct guesses decreases
–
Increasing per-object penalty( ) will also benefit defender
19
Analysis on Possible Strategies
Selectively-Probing Attacker
•
Attacker may selectively probe twice on the
objects where he gets
‘true object’
response
•
Possible countermeasure for defender:
–
‘lie’
in every true objects to deter examination
from attacker as much as possible
–
‘lie’
in every decoy objects to make attacker waste
each probe examining decoy
20
Conclusion
•
Some attacker-defender interactions can be
viewed as a two-player game
•
We proposed a game-theoretic model which
reflects interaction between attacker and
defender using decoy systems
•
Analyzing many other possible strategies using
our game will remain as a future work
21
References
[Spitzner03]
L. Spitzner,
“Honeypots: Catching the Insider Threat”
, Computer
Security Applications Conference, 2003.
[Rowe06]
N. C. Rowe and E. J. Custy, “Fake Honeypots: A Defensive Tactic for
Cyberspace,”
Proceedings of 2006 IEEE Workshop on Information Assurance
,
pp. 223-230, 2006.
[Roy10]
S. Roy
et al.
, “A Survey of Game Theory as Applied to Network
Security,”
Proceedings of the 43
rd
Hawaii International Conference on System
Sciences
, pp. 1-10, 2010.
22
Game Definition – Moves (cont’d)
Moves (cont’d)
•
Step 1
:
Initialization
–
Defender
D
deploys
decoys
and
true objects
•
Step 2
:
Probe-Respond
–
Repeated until
A
stops
a: Attacker
A
picks an object to
‘probe’
To avoid attacking decoys: to collect
‘clues’
Assume
A
uses one
‘heuristic’
per each
‘probe’
23
Game Definition – Moves (cont’d)
Moves (cont’d)
•
Step 2
:
Probe-Respond (cont’d)
b: Defender
D
responds to
A
’s
‘probe’
by giving one-
digit value to
A
.
Defender can either ‘tell the truth’ or ‘lie’
24
Game Definition – Moves (cont’d)
Moves (cont’d)
•
Multiple
‘probes’
on the same object:
–
Applying different
‘heuristics’
to the same object
–
Higher probability to reveal identity of the object
–
Assumption
: two
‘probes’
on the same object reveals
whether object is decoy or not
•
Step 3
:
Termination
–
Attacker concludes with
k
objects to attack
;
25
Hi, I’m Gihyuk Ko. In this presentation, I will introduce my research on Deception Game on Decoy Systems.
Deception Game on Decoy Systems and Honeypots explores the use of deception technologies in computer security, focusing on decoy systems like honeypots. It delves into how attackers are lured into fake objects and the monitoring of their behavior to mitigate intrusion. The concept of fake honeypots, attacker-defender games using honeypots, and strategies for protecting against intrusion are discussed.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Deception Game on Decoy Systems Gihyuk Ko gko@andrew.cmu.edu Carnegie Mellon University
Decoy Systems and Honeypots Decoy Systems: One of the deception technologies in computer security Lure attackers into accessing fake objects (i.e., decoys) Monitor attackers behavior, mitigate intrusion Many variations in implementations ofdecoy systems Honeypots, Honeywords, Kamouflage System, etc. Honeypots[Spitzner03]: an information system resource whose value lies in unauthorized or illicit use of that resource A fake server/host which looks like a real server/host Seems as a valuable resource to attack to the attackers No true value to the outsiders 2
Honeypots in the network Attack successful Attacker Actual servers 272.17.31.10 272.17.31.11 272.17.31.12 272.17.31.16 272.17.31.17 Attack fails: becomes monitored Honeypots 272.17.31.13 272.17.31.15 272.17.31.14 3
Fake Honeypots[Rowe06] Attackers became aware that defenders use honeypots Attackers probe the target to avoid attacking honeypots Attackers may collect clues to discover honeypots using heuristics Signature-based approach: look for particular features e.g., well-known honeypot tool name, magic numbers Anomaly-based approach: use metrics on entire system e.g., # of files / subdirectories, # of english-word file names, stdev of length of filename 4
Fake Honeypots[Rowe06](contd) Fake honeypots: Ordinary hosts/servers which are made to appear like honeypots Produced by planting clues into the system e.g., plant well-known honeypot tool s trace in the memory, make the stdev of the filename length close to zero Attackers who discover clues will avoid the system Fake honeypots are protected against intrusion Using decoys, defender can deliberatively deceive attackers in active way 5
Attacker-defender game using honeypots Consider an attacker who wants to attack honeypot network Attacker attacks honeypot node gets detected Attacker would first try to discover (by probing ) honeypots, and avoid attacking them Defender can build fake honeypot to deceive the attacker These interactions can happen multiple times back and forth This can be viewed as a two-playergame! 6
Key Points Many variations in deception techniques which use decoy systems Honeypots, Fake honeypots Some attacker-defender interactions using the decoy systems can be explained as a two- player game Developing a game-theory model can benefit defender in countering attacker with strategy! 7
Objective Develop a game-theoretic model which reflectsinteractions between real world attacker and defender using decoy systems, that involve deceptive actions such as lying . 8
Game Definition Decoy Systems Decoy Systems: True objects: actual valuable resource (e.g., servers) Decoy objects: decoys without any value (e.g., honeypots) Total n objects, ktrue objects, n-kdecoys ... Indicator function: / 9
Game Definition Category We define a two-player non-cooperative complete imperfect information dynamic game Two-player: Attacker A, Defender D Non-cooperative: independent decision-making Complete information: strategy profiles and payoffs(utilities) are known to each other Imperfect information: not all the past actions are known to each party Dynamic: turn-taking manner 10
Game Definition Goals / Moves Goals A s goal: distinguish true objects from all objects Learn D s goal: prevent attacker from learning true objects By lying to an attacker Moves Steps A s move D s move Initialization ; Probe-Respond (repeated) Termination 11
Game Definition Moves (contd) Initialization ... D deploys decoys and true objects D D defines an indicator function 12
Game Definition Moves (contd) Probe-Respond ... A picks an object to probe D A D responds to probe : Tell the Truth: return indicator value of an object Lie: return logical complement of indicator value of an object Repeats until A stops 13
Game Definition Moves (contd) Termination ... D A ... A concludes with k objects to attack 14
Game Definition Moves (contd) Moves (cont d) Multiple probes on the same object: Applying different heuristics to the same object Higher probability to reveal identity of the object Assumption: two probes on the same object reveals whether object is decoy or not 15
Game Definition Utilities Utilities We assume both A s probing and D s lying have per- action costs A s per-probe cost overall cost D s per-lie cost overall cost Incentives depend on attacker s final move (attack): When A picked a true object,A gets When A picked a decoy object, D gets overall incentive Incentives work in zero-sum manner: Overall utility: overall incentive 16
Analysis on Possible Strategies Three possible example attacker strategies All-Round-Probing Attacker No-Probing Attacker Selectively-Probing Attacker 17
Analysis on Possible Strategies All-Round-Probing Attacker Attacker probes all objects twice until it finds k true objects Attacker always gets k true object right Defender s lies doesn t help: defender should not use any lies to maximize its utility Unlikely to be considered as an attacker strategy 18
Analysis on Possible Strategies No-Probing Attacker Attacker might guess k objects without any probing No cost for both A and D Efficiency of decoy systems comes as countermeasure Intuitively, increasing portion of decoys in the network, expected correct guesses decreases Increasing per-object penalty( ) will also benefit defender 19
Analysis on Possible Strategies Selectively-Probing Attacker Attacker may selectively probe twice on the objects where he gets true object response Possible countermeasure for defender: lie in every true objects to deter examination from attacker as much as possible lie in every decoy objects to make attacker waste each probe examining decoy 20
Conclusion Some attacker-defender interactions can be viewed as a two-player game We proposed a game-theoretic model which reflects interaction between attacker and defender using decoy systems Analyzing many other possible strategies using our game will remain as a future work 21
References [Spitzner03] L. Spitzner, Honeypots: Catching the Insider Threat , Computer Security Applications Conference, 2003. [Rowe06] N. C. Rowe and E. J. Custy, Fake Honeypots: A Defensive Tactic for Cyberspace, Proceedings of 2006 IEEE Workshop on Information Assurance, pp. 223-230, 2006. [Roy10] S. Roy et al., A Survey of Game Theory as Applied to Network Security, Proceedings of the 43rd Hawaii International Conference on System Sciences, pp. 1-10, 2010. 22
Game Definition Moves (contd) Moves (cont d) Step 1: Initialization Defender D deploys decoys and true objects Step 2: Probe-Respond Repeated until A stops a: Attacker A picks an object to probe To avoid attacking decoys: to collect clues Assume A uses one heuristic per each probe 23
Game Definition Moves (contd) Moves (cont d) Step 2: Probe-Respond (cont d) b: Defender D responds to A s probe by giving one- digit value to A. Defender can either tell the truth or lie 24
Game Definition Moves (contd) Moves (cont d) Multiple probes on the same object: Applying different heuristics to the same object Higher probability to reveal identity of the object Assumption: two probes on the same object reveals whether object is decoy or not Step 3: Termination Attacker concludes with k objects to attack ; 25
