Baiting Inside Attackers Using Decoy Documents

Abstract

Abstract-The insider threat remains one of the most vexing problems in computer security. A number of approaches have been proposed to detect nefarious insider actions including user modeling and profiling techniques, policy and access enforcement techniques, and misuse detection. In this work we propose trap-based defense mechanisms and a deployment platform for addressing the problem of insiders attempting to exfiltrate and use sensitive information. The goal is to confuse and confound an adversary requiring more effort to identify real information from bogus information and provide a means of detecting when an attempt to exploit sensitive information has occurred. "Decoy Documents" are automatically generated and stored on a file system by the D 3 System with the aim of enticing a malicious user. We introduce and formalize a number of properties of decoys as a guide to design trap-based defenses to increase the likelihood of detecting an insider attack. The decoy documents contain several different types of bogus credentials that when used, trigger an alert. We also embed "stealthy beacons" inside the documents that cause a signal to be emitted to a server indicating when and where the particular decoy was opened. We evaluate decoy documents on honeypots penetrated by attackers demonstrating the feasibility of the method.

Modeling User Search Behavior for Masquerade Detection

“…A thorough evaluation of the right model checking and alerting frequency in light of average search times on a file system inter alia is the subject of ongoing research. Another focus of ongoing research is the correlation of search behavior anomaly detection with trap-based decoy files such as [2]. This should provide stronger evidence of malfeasance, and therefore improve the detector's accuracy.…”

The MEERKATS Cloud Security Architecture

“…The inputs will contain automatically generated enticing and believable deceptive information (DI) whose misuse by an adversary can be subsequently detected. Examples of such enticing bait information include documents with built-in "beacons" [9], URLs and username/passwords to honeypots or sites whose access can be directly or indirectly monitored [10], credit card and bank account numbers with triggers [11], etc. Other types of DI that we plan to use include deceptive documents in the filesystem and entries in database tables (or entire databases).…”

Detecting Traffic Snooping in Tor Using Decoys

“…These credentials could be exposed to Tor exits via canned protocol interactions. Combined with decoy information generation services [8], this infrastructure could be used as a composable eavesdrop detection system [27].…”

“…The decoy credentials used in our approach can thus be viewed as particular instance of honeytokens. Bowen et al [8] proposed the use of decoy documents to detect misbehaving entities within the perimeter of an organization. The decoy documents contain embedded "beacons," such as scripts or macros, which are executed when the document is opened.…”

“…The use of fake information, or honeytokens [29], for the detection of unauthorized use of sensitive data is not new. Decoy information has been previously used to to detect eavesdropping on unprotected wireless networks [9] and warn of insider threats [8]. The idea behind these systems is that eavesdroppers will probably try to use the collected information in some way.…”