Proceedings of the 5th ACM Workshop on Moving Target Defense最新文献_第2页

Dynamic Defense against Adaptive and Persistent Adversaries 动态防御适应和持久的对手

Proceedings of the 5th ACM Workshop on Moving Target Defense Pub Date : 2018-01-15 DOI: 10.1145/3268966.3268977

R. Poovendran

{"title":"Dynamic Defense against Adaptive and Persistent Adversaries","authors":"R. Poovendran","doi":"10.1145/3268966.3268977","DOIUrl":"https://doi.org/10.1145/3268966.3268977","url":null,"abstract":"This talk will cover two topics, namely, modeling and design of Moving Target Defense (MTD), and DIFT games for modeling Advanced Persistent Threats (APTs). We will first present a game-theoretic approach to characterizing the trade-off between resource efficiency and defense effectiveness in decoy- and randomization-based MTD. We will then address the game formulation for APTs. APTs are mounted by intelligent and resourceful adversaries who gain access to a targeted system and gather information over an extended period of time. APTs consist of multiple stages, including initial system compromise, privilege escalation, and data exfiltration, each of which involves strategic interaction between the APT and the targeted system. While this interaction can be viewed as a game, the stealthiness, adaptiveness, and unpredictability of APTs imply that the information structure of the game and the strategies of the APT are not readily available. Our approach to modeling APTs is based on the insight that the persistent nature of APTs creates information flows in the system that can be monitored. One monitoring mechanism is Dynamic Information Flow Tracking (DIFT), which taints and tracks malicious information flows through a system and inspects the flows at designated traps. Since tainting all flows in the system will incur significant memory and storage overhead, efficient tagging policies are needed to maximize the probability of detecting the APT while minimizing resource costs. In this work, we develop a multi-stage stochastic game framework for modeling the interaction between an APT and a DIFT, as well as designing an efficient DIFT-based defense. Our model is grounded on APT data gathered using the Refinable Attack Investigation (RAIN) flow-tracking framework. We present the current state of our formulation, insights that it provides on designing effective defenses against APTs, and directions for future work.","PeriodicalId":20619,"journal":{"name":"Proceedings of the 5th ACM Workshop on Moving Target Defense","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2018-01-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"89745650","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Ensuring Deception Consistency for FTP Services Hardened against Advanced Persistent Threats 确保FTP服务欺骗一致性，增强对高级持续威胁的防范

Proceedings of the 5th ACM Workshop on Moving Target Defense Pub Date : 2018-01-15 DOI: 10.1145/3268966.3268971

Zhan Shu, Guanhua Yan

{"title":"Ensuring Deception Consistency for FTP Services Hardened against Advanced Persistent Threats","authors":"Zhan Shu, Guanhua Yan","doi":"10.1145/3268966.3268971","DOIUrl":"https://doi.org/10.1145/3268966.3268971","url":null,"abstract":"As evidenced by numerous high-profile security incidents such as the Target data breach and the Equifax hack, APTs (Advanced Persistent Threats) can significantly compromise the trustworthiness of cyber space. This work explores how to improve the effectiveness of cyber deception in hardening FTP (File Transfer Protocol) services against APTs. The main objective of our work is to ensure deception consistency: when the attackers are trapped, they can only make observations that are consistent with what they have seen already so that they cannot recognize the deceptive environment. To achieve deception consistency, we use logic constraints to characterize an attacker's best knowledge (either positive, negative, or uncertain). When migrating the attacker's FTP connection into a contained environment, we use these logic constraints to instantiate a new FTP file system that is guaranteed free of inconsistency. We performed deception experiments with student participants who just completed a computer security course. Following the design of Turing tests, we find that the participants' chances of recognizing deceptive environments are close to random guesses. Our experiments also confirm the importance of observation consistency in identifying deception.","PeriodicalId":20619,"journal":{"name":"Proceedings of the 5th ACM Workshop on Moving Target Defense","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2018-01-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"90449486","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 11

A Security SLA-Driven Moving Target Defense Framework to Secure Cloud Applications 一个安全sla驱动的移动目标防御框架来保护云应用

Proceedings of the 5th ACM Workshop on Moving Target Defense Pub Date : 2018-01-15 DOI: 10.1145/3268966.3268975

V. Casola, Alessandra De Benedictis, M. Rak, Umberto Villano

引用次数: 2

Session details: Keynote 会议详情:

Proceedings of the 5th ACM Workshop on Moving Target Defense Pub Date : 2018-01-15 DOI: 10.1145/3285946

Massimiliano Albanese

引用次数: 0

Session details: Session 1: Evaluation of MTD Techniques 会议详情:第1部分:MTD技术的评估

Proceedings of the 5th ACM Workshop on Moving Target Defense Pub Date : 2018-01-15 DOI: 10.1145/3285944

I. Ray

引用次数: 0

Diversifying the Software Stack Using Randomized NOP Insertion 利用随机NOP插入实现软件堆栈的多样化

Proceedings of the 5th ACM Workshop on Moving Target Defense Pub Date : 2013-01-01 DOI: 10.1007/978-1-4614-5416-8_8

Todd Jackson, Andrei Homescu, Stephen Crane, Per Larsen, Stefan Brunthaler, M. Franz

引用次数: 45

Game Theoretic Approaches to Attack Surface Shifting 攻击面移动的博弈论方法

Proceedings of the 5th ACM Workshop on Moving Target Defense Pub Date : 2013-01-01 DOI: 10.1007/978-1-4614-5416-8_1

P. Manadhata

引用次数: 58

Security Games Applied to Real-World: Research Contributions and Challenges 安全游戏应用于现实世界:研究贡献与挑战

Proceedings of the 5th ACM Workshop on Moving Target Defense Pub Date : 2013-01-01 DOI: 10.1007/978-1-4614-5416-8_2

Manish Jain, Bo An, Milind Tambe

引用次数: 16

From Individual Decisions from Experience to Behavioral Game Theory: Lessons for Cybersecurity 从经验的个人决策到行为博弈论:网络安全的教训

Proceedings of the 5th ACM Workshop on Moving Target Defense Pub Date : 2013-01-01 DOI: 10.1007/978-1-4614-5416-8_4

Cleotilde González

引用次数: 8

Adversarial Dynamics: The Conficker Case Study 对抗性动力学:Conficker案例研究

Proceedings of the 5th ACM Workshop on Moving Target Defense Pub Date : 2013-01-01 DOI: 10.1007/978-1-4614-5416-8_3

D. Bilar, G. Cybenko, J. P. Murphy

引用次数: 5