Deceptive Environment Research Articles

SymbSODA: Configurable and Verifiable Orchestration Automation for Active Malware Deception

Malware is commonly used by adversaries to compromise and infiltrate cyber systems in order to steal sensitive information or destroy critical assets. Active Cyber Deception (ACD) has emerged as an effective proactive cyber defense against malware to enable misleading adversaries by presenting fake data and engaging them to learn novel attack techniques. However, real-time malware deception is a complex and challenging task because (1) it requires a comprehensive understanding of the malware behaviors at technical and tactical levels in order to create the appropriate deception ploys and resources that can leverage this behavior and mislead malware, and (2) it requires a configurable yet provably valid deception planning to guarantee effective and safe real-time deception orchestration. This article presents symbSODA, a highly configurable and verifiable cyber deception system that analyzes real-world malware using multipath execution to discover API patterns that represent attack techniques/tactics critical for deception, enables users to create their own customized deception ploys based on the malware type and objectives, allows for constructing conflict-free Deception Playbooks , and finally automates the deception orchestration to execute the malware inside a deceptive environment. symbSODA extracts Malicious Sub-graphs (MSGs) consisting of WinAPIs from real-world malware and maps them to tactics and techniques using the ATT&CK framework to facilitate the construction of meaningful user-defined deception playbooks. We conducted a comprehensive evaluation study on symbSODA using 255 recent malware samples. We demonstrated that the accuracy of the end-to-end malware deception is 95% on average, with negligible overhead using various deception goals and strategies. Furthermore, our approach successfully extracted MSGs with a 97% recall, and our MSG-to-MITRE mapping achieved a top-1 accuracy of 88.75%. Our study suggests that symbSODA can serve as a general-purpose Malware Deception Factory to automatically produce customized deception playbooks against arbitrary malware behavior.

A Study of the Ordinal Scale Classification Algorithm for Cyber Threat Intelligence Based on Deception Technology

Cyber deception technology plays an important role in monitoring attackers’ activities and detecting new attack types. However, in a deceptive environment, low-risk attack traffic, such as scanning, is included in large quantities and acts as noise. Therefore, even though high-risk traffic is actually present, it may be overlooked, or the analysis algorithm’s accuracy regarding traffic may be reduced, causing significant difficulties in intrusion detection and analysis processes. In this study, we propose a model that can identify and filter the ordinal scale risk of the source IP in deceptive environment-generated traffic. This model aims to quickly classify low-risk attacks, including information gathering and scanning, which are widely and repeatedly performed, as well as high-risk attacks, rather than classifying specific types of attacks. Most existing deceptive technology-based Cyber Threat Intelligence (CTI) generation studies have been limited in their applicability to real-world environments because data labeling, learning, and detection processes using AI algorithms that consume significant amounts of time and computing resources. Here, the Naive Bayes discriminant analysis-based ordinary scale classification model showed higher accuracy for low-risk attack classification, while consuming significantly fewer resources than the models presented in other studies do. The accuracy of the current active deceptive environment traffic analysis research may be enhanced by filtering low-risk traffic via preprocessing.

Detection and Orientation of GNSS Spoofing Based on Positioning Solutions of Three Receivers

Spoofing poses a serious security threat to the satellite navigation system. Most of the current spoofing detection methods are based on the information in the receiver-solving process. Applying the above spoofing detection algorithm on the receiver requires a redesign of the original receiver, which limits the application of the deceptive detection method on the ex-factory receiver. In the case of single-station spoofing, the positions of the successfully spoofed multiple receivers are the same according to the deception signal, but the clock offset is different. The single-difference clock offset is positively correlated with the distance between the two receivers. Based on the above principles, this paper proposes a spoofing detection and spoofing direction method based on the positioning solutions of three receivers. The observation value of the baseline length is calculated from the position information in the positioning solution, and spoofing detection is realized by hypothesis testing. The clocks of the three receivers are synchronized. The Adaptive Delta Gradient Descent(ADGD) method is adopted to calculate the spoofing direction according to the single-difference clock offset in the positioning solution. The direction angle is optimized through the Interacting Multiple Model based on the volume Kalman Filter. The relationship between several parameters and the direction accuracy of spoofing is analyzed through simulation tests. Experimental results show that this method can effectively detect and orient spoofing. In addition, the detection and orientation method of spoofing has the advantage of fast response speed, which can realize fast spoofing detection and direction finding in a deception environment.

Omni wheels Robot for Effective Surveillance and Transportation Purpose

Abstract: Industrial and technical applications for remote robots are growing in importance. They are already being used for monitoring, testing and transportation activities. One of the main requirements for an independent remote robot is its ability to navigate the workplace, avoid obstacles and find its way to the next location, in order to perform its function, skills known as local performance and navigation. Navigating robots under different world conditions such as very steep slopes, ramps, slippery slopes and slippery terrain is a major challenge. In project work, the Omni-wheel with a 60-Degree of inclination is designed and tested in an intrusive, sloping and deceptive environment. Annex acclerometer and gyrometer sensors are common. Keeping track of the platform up to a minimum no matter where the robot is located is our goal. Omni wheels are specially selected to make navigation easier in any conditions. In order to balance ground collisions and active sedation in a moving environment, we use a simple method where the surface of the robot will remain in contact with the ground and the robot will align with the slope. The project introduces Omni steering wheels in Mecanum and discusses the kinematic relationships of the four-wheel drive Mecanum. Forward and Inverse kinematic was taken from this project. Keywords: Omni Wheel Robot, Wireless Communications, Transportation, Arduino etc.

Product-Counterfeiting can be Controlled in Supply Chains of Automotive Parts Industry

The objective of this paper is to compile information that will help researchers and practitioners to use EFA (Exploratory Factor Analysis) in reference to the relevant anti-counterfeiting strategies in supply chain under deceptive buying environment, in order to make prudent decisions according to the “best industry practices” based on ISO (International Organization for Standardization) available in the automotive industry. Product counterfeiting is a worldwide business issue which effect firm’s supply chain (supply chain sustainability) directly or indirectly. The study used a quantitative research design technique where categorical and numerical variables are used to determine relationships among variables where a survey is used as a main research method. Futuristically, the developed instrument using EFA would lead to the CFA (Confirmatory Factor Analysis) to answer questions regarding validity of the instrument in the concerned population subgroups. This empirical study is done after conducting Initial Survey where pilot testing procedure of Initial instrument was followed to make sure that questions asked were good enough (reliability analysis) to capture the impacts of ANCT-INT (Anti-Counterfeiting Strategies Initiative) on the FSP (Firms’ Supply Performance). The Pilot test process of Initial Survey Instrument is conducted prior to an actual data collection (confirmatory survey) stage that can helps researcher in refining the confirmatory survey instrument. The pilot test is conducted under the patronage of PAAPAM (Pakistan Association of Automobile Parts and Accessories Manufacturers) secretariat in Lahore. The participants involved are the Automotive Engineering firms practicing as the permanent PAAPAM member firms.

Is Online Partner-Seeking Associated with Increased Risk of Condomless Sex and Sexually Transmitted Infections Among Individuals Who Engage in Heterosexual Sex? A Systematic Narrative Review.

Use of Internet websites and mobile applications to meet potential romantic and sexual partners is becoming increasingly popular. While the Internet might foster better communication and sexual negotiation between partners, it can also be a deceptive environment that instigates and accelerates sexual risk-taking. Given the complexities of the Internet, it is critical to examine the association between risky sexual behaviors (RSBs) and online partner-seeking. Five databases (i.e., Google Scholar, PubMed, PsycINFO, Web of Science, and Ovid Medline) were searched for articles published before September 10, 2017, that examined the association between online partner solicitation (either for romantic and/or sexual reasons) and RSBs. Studies were eligible for inclusion if they were empirical papers published in English-language peer-reviewed journals looking at samples of online partner seekers who practice heterosexual sex (with a comparison group) and reporting either condom use or sexually transmitted infections (STIs) status, which were the two primary outcomes. A total of 25 studies met the criteria to be included in our review. Results from this literature search do not indicate a clear association between online partner-seeking and condom use or STI status. Potential moderators (i.e., age, gender, reasons for online partner solicitation, duration of Internet correspondence, and Internet modalities) that should be included in future research were identified. Sexual health prevention efforts should address methods to negotiate safe practices between sexual partners and to encourage healthy non-virtual relationships, particularly among vulnerable populations.

Automatically Traceback RDP‐Based Targeted Ransomware Attacks

While various ransomware defense systems have been proposed to deal with traditional randomly‐spread ransomware attacks (based on their unique high‐noisy behaviors at hosts and on networks), none of them considered ransomware attacks precisely aiming at specific hosts, e.g., using the common Remote Desktop Protocol (RDP). To address this problem, we propose a systematic method to fight such specifically targeted ransomware by trapping attackers via a network deception environment and then using traceback techniques to identify attack sources. In particular, we developed various monitors in the proposed deception environment to gather traceable clues about attackers, and we further design an analysis system that automatically extracts and analyze the collected clues. Our evaluations show that the proposed method can trap the adversary in the deception environment and significantly improve the efficiency of clue analysis. Furthermore, it also helps us trace back RDP‐based ransomware attackers and ransomware makers in the practical applications.

Symmetrical Hierarchical Stochastic Searching on the Line in Informative and Deceptive Environments.

A stochastic point location (SPL) problem aims to find a target parameter on a 1-D line by operating a controlled random walk and receiving information from a stochastic environment (SE). If the target parameter changes randomly, we call the parameter dynamic; otherwise static. SE can be 1) informative (p > 0.5 where p represents the probability for an environment providing a correct suggestion) and 2) deceptive (p <; 0.5). Up till now, hierarchical stochastic searching on the line (HSSL) is the most efficient algorithms to catch static or dynamic parameter in an informative environment, but unable to locate the target parameter in a deceptive environment and to recognize an environment's type (informative or deceptive). This paper presents a novel solution, named symmetrical HSSL, by extending an HSSL binary tree-based search structure to a symmetrical form. By means of this innovative way, the proposed learning mechanism is able to converge to a static or dynamic target parameter in the range of not only 0.6181 <; p <; 1, but also 0 <; p <; 0.382. Finally, the experimental results show that our scheme is efficient and feasible to solve the SPL problem in any SE.

A General CPL-AdS Methodology for Fixing Dynamic Parameters in Dual Environments

The algorithm of Continuous Point Location with Adaptive d-ary Search (CPL-AdS) strategy exhibits its efficiency in solving stochastic point location (SPL) problems. However, there is one bottleneck for this CPL-AdS strategy which is that, when the dimension of the feature, or the number of divided subintervals for each iteration, d is large, the decision table for elimination process is almost unavailable. On the other hand, the larger dimension of the features d can generally make this CPL-AdS strategy avoid oscillation and converge faster. This paper presents a generalized universal decision formula to solve this bottleneck problem. As a matter of fact, this decision formula has a wider usage beyond handling out this SPL problems, such as dealing with deterministic point location problems and searching data in Single Instruction Stream-Multiple Data Stream based on Concurrent Read and Exclusive Write parallel computer model. Meanwhile, we generalized the CPL-AdS strategy with an extending formula, which is capable of tracking an unknown dynamic parameter λ in both informative and deceptive environments. Furthermore, we employed different learning automata in the generalized CPL-AdS method to find out if faster learning algorithm will lead to better realization of the generalized CPL-AdS method. All of these aforementioned contributions are vitally important whether in theory or in practical applications. Finally, extensive experiments show that our proposed approaches are efficient and feasible.

Hypothesis-driven information fusion in adversarial, deceptive environments

The problem domain addressed in this work is urban, armed engagement against a guerilla force. The paper focuses particularly on the algorithm developed to combine incomplete and potentially deceptive observations of the opponent forces and actions into a fused estimate of the opponent’s actual positions and strengths. The algorithm generates and maintains a set of hypotheses, and evaluates each hypothesis in a manner that combines ongoing observations with recognition of the opponent’s efforts to conceal its forces and to deceive. The theoretical foundations of the proposed approach derive primarily from the theory of risk-sensitive control. The paper describes an implementation of the proposed approach that approximates theoretical constructs with heuristics for the sake of computational feasibility in applications that require near-real-time generation of fused estimates. Multiple realistic experiments, including live force experiments, demonstrated quantitatively that the resulting tools are capable of producing estimates at least comparable in accuracy to those produced by competent humans. The paper also discusses the potential incorporation of the tools into operational battle command systems.

Models for strategy choice in random or potentially deceptive environments

Abstract Two simulation models are presented illustrative of decision and behavioural choice issues for complex adaptive systems involving cognitive agents. The first illustrates the value of managed instability for complex systems. It explores conditions under which a system able maintain itself in an unstable state gains an advantage in behavioural flexibility offsetting the extra expense involved in maintaining that state against instability. The second model considers the trade-off between quickness and accuracy of response in risk/reward identification, in order to differentiate conditions under which rapid or considered responses are favoured. The second model is currently being used to distinguish cases where cognitive agents are preferable to non-cognitive agents and vice versa.