Decoy Server Research Articles

HoneyCirculator: distributing credential honeytoken for introspection of web-based attack cycle

A web user who falsely accesses a compromised website is usually redirected to an adversary’s website and is forced to download malware after being exploited. Additionally, the adversary steals the user’s credentials by using information-leaking malware. The adversary may also try to compromise public websites owned by individual users by impersonating the website administrator using the stolen credentials. These compromised websites then become landing sites for drive-by download malware infection. Identifying malicious websites using crawling techniques requires a large amount of resources and time. To monitor the web-based attack cycle for effective detection and prevention, we propose a monitoring system called HoneyCirculator based on a honeytoken, which actively leaks bait credentials and lures adversaries to our decoy server that behaves like a compromised web content management system. To recursively analyze attack phases on the web-based attack cycle, our proposed system involves collecting malware, distributing bait credentials, monitoring fraudulent access, and inspecting compromised web content. It can instantly discover unknown malicious entities without conducting large-scale web crawling because of the direct monitoring behind the compromised web content management system. Our proposed system enables continuous and stable monitoring for about one year. In addition, almost all the malicious websites we discovered had not been previously registered in public blacklists.

CHAOS: An SDN-Based Moving Target Defense System

Moving target defense (MTD) has provided a dynamic and proactive network defense to reduce or move the attack surface that is available for exploitation. However, traditional network is difficult to realize dynamic and active security defense effectively and comprehensively. Software-defined networking (SDN) points out a brand-new path for building dynamic and proactive defense system. In this paper, we propose CHAOS, an SDN-based MTD system. Utilizing the programmability and flexibility of SDN, CHAOS obfuscates the attack surface including host mutation obfuscation, ports obfuscation, and obfuscation based on decoy servers, thereby enhancing the unpredictability of the networking environment. We propose the Chaos Tower Obfuscation (CTO) method, which uses the Chaos Tower Structure (CTS) to depict the hierarchy of all the hosts in an intranet and define expected connection and unexpected connection. Moreover, we develop fast CTO algorithms to achieve a different degree of obfuscation for the hosts in each layer. We design and implement CHAOS as an application of SDN controller. Our approach makes it very easy to realize moving target defense in networks. Our experimental results show that a network protected by CHAOS is capable of decreasing the percentage of information disclosure effectively to guarantee the normal flow of traffic.

Detection and analysis of eavesdropping in anonymous communication networks

Anonymous communication networks, like Tor, partially protect the confidentiality of user traffic by encrypting all communications within the overlay network. However, when the relayed traffic reaches the boundaries of the network, toward its destination, the original user traffic is inevitably exposed to the final node on the path. As a result, users transmitting sensitive data, like authentication credentials, over such networks, risk having their data intercepted and exposed, unless end-to-end encryption is used. Eavesdropping can be performed by malicious or compromised relay nodes, as well as any rogue network entity on the path toward the actual destination. Furthermore, end-to-end encryption does not assure defense against man-in-the-middle attacks. In this work, we explore the use of decoys at multiple levels for the detection of traffic interception by malicious nodes of proxy-based anonymous communication systems. Our approach relies on the injection of traffic that exposes bait credentials for decoy services requiring user authentication, and URLs to seemingly sensitive decoy documents which, when opened, invoke scripts alerting about being accessed. Our aim was to entice prospective eavesdroppers to access our decoy servers and decoy documents, using the snooped credentials and URLs. We have deployed our prototype implementation in the Tor network using decoy IMAP, SMTP, and HTTP servers. During the course of over 30 months, our system has detected 18 cases of traffic eavesdropping that involved 14 different Tor exit nodes.

Extracting real IP address used to connect to P2P messenger using ARIT agent

Current IP based tracking method include host based traceback method, using traceback module installed in all system to locate the hacker’s real location, network packet method, installing traceback module in location where is possible to observe network packet, IP traceback method, tracebacking real location of IP address altered packet. Various other method has been proposed and all are in theoretical stage where ISP overhead is to be endured. Honeypot decoy server and automatic hacker tracing software and various other methods are being developed, but only can operate in certain enviornments, and is redundant in normal conditions. However, using the ARIT Agent discussed on this paper will not only extract the IP address of abnormal connection, but to pinpoint the location of the user. ARIT agent can extract the IP address by following steps. Transfer of user’s IP address collected through information analysis stored in Database and information gathered by Real IP Scan to IP comparison DB table recorded in ISP centre, then information comparison is made in comparison table to locate the IP address. Finally compared information is sent to security cetnre to notify the user’s safety. Using the 2 channel method proposed on this paper combined with the ARIT agent, user’s Real IP address can be certified with the IP address received from channel 1 through independent authentication server. Through independent authentication server, comparing the IP address obtained from channel 1 and 2, if the user’s location and the real location is different, realising the situation can prove valuble in prevention of further crimes. ARIT agent proves great advantage in prevention of phising or farming attack, pretending to be acquanitance to request financial support, or personal infromation, by analysing location information.