Baiting Inside Attackers using Decoy Documents

Abstract

Abstract-The insider threat remains one of the most vexing problems in computer security. A number of approaches have been proposed to detect nefarious insider actions including user modeling and profiling techniques, policy and access enforcement techniques, and misuse detection. In this work we propose trap-based defense mechanisms and a deployment platform for addressing the problem of insiders attempting to exfiltrate and use sensitive information. The goal is to confuse and confound an adversary requiring more effort to identify real information from bogus information and provide a means of detecting when an attempt to exploit sensitive information has occurred. "Decoy Documents" are automatically generated and stored on a file system by the D 3 System with the aim of enticing a malicious user. We introduce and formalize a number of properties of decoys as a guide to design trap-based defenses to increase the likelihood of detecting an insider attack. The decoy documents contain several different types of bogus credentials that when used, trigger an alert. We also embed "stealthy beacons" inside the documents that cause a signal to be emitted to a server indicating when and where the particular decoy was opened. We evaluate decoy documents on honeypots penetrated by attackers demonstrating the feasibility of the method.

Analysis of high volumes of network traffic for Advanced Persistent Threat detection

“…Indeed, an APT aims to take control of a legitimate host inside of an organization, and the attacker will try to emulate normal behavior in order to avoid detection. However, an important difference is that an insider may not need to exfiltrate the data through a network, hence many approaches of insider threat detection focus on host-based logs [36] and honeypot strategies [37] instead of analyzing network traffic as it is done in our approach. An important observation is that the framework proposed in this paper could be easily integrated in insider threat detection systems: its approach based on traffic analyses can contribute significantly to existing insider threat solutions, although insider threat detection is not its primary objective.…”

Protected Honey Face Templates

“…On the data level we find solutions such as the honeywords and honeydocuments. The honeyword method [1] hides the password of a user between k hash values of random passwords, and honeydocuments [6] is again a trapbased mechanism which uses decoy documents. All these mechanisms serve as a safeguard against adversaries who try to get unauthorized data access.…”

“…Our first test to this regard is between the plain feature vectors c tst and the protected templates ST of user i. The general mathematical formula we have used is: (6) where var (x) is the variance of the vector x, and it is interpreted as the covariance of x with itself. The covariance cov(x, y) between vectors x and y shows how much the two vectors differ from each other.…”

Forgive and forget

“…Bowen et al [10] suggested using decoy documents to require an attacker to distinguish real information from false information, thereby confusing the attacker; this also allows the defenders to monitor those decoys, and hence the actions of the attackers. Ben Salem and Stolfo [7] characterize the desirable properties of decoys they have found effective.…”