Unauthorized Host Research Articles

RDP-based Lateral Movement detection using Machine Learning

Detecting cyber threats has been an on-going research endeavor. In this era, Advanced Persistent Threats (APTs) can incur significant costs for organizations and businesses. The ultimate goal of cybersecurity is to thwart attackers from achieving their malicious intent, whether it is credential stealing, infrastructure takeover, or program sabotage. Every cyber attack goes through several stages before its termination. Lateral Movement (LM) is one of those stages that is of particular importance. Remote Desktop Protocol (RDP) is a method used in LM to successfully authenticate to an unauthorized host that leaves footprints on both host and network logs. In this paper, we propose to detect evidence of LM using Machine Learning (ML) and Windows RDP event logs. We explore different feature sets extracted from these logs and evaluate various supervised ML techniques for classifying RDP sessions with high precision and recall. We also compare the performance of our proposed approach to a state-of-the-art approach and demonstrate that our ML model outperforms in classifying RDP sessions in Windows event logs. In addition, we show that our model is robust against certain types of adversarial attacks.

네트워크 공격 방지를 지원하는 DHCP의 설계 및 구현에 관한 연구

ABSTRACT DHCP(Dynamic Host Configuration Protocol) is a protocol for efficiency and convenience of the IP address management. DHCP automatically assigns an IP address and configuration information needed to run the TCP/IP communication to individual host in the network. However, existing DHCP is vulnerable for network attack such as DHCP spoofing, release attack because there is no mutual auth entication systems between server and client. To solve this problem, we have designed a new DHCP protocol supporting the following features: First, ECDH(Elliptic Curve Diffie-Hellman) is used to create session key and ECDSA(Elliptic Curve Digital Signature Algorithm) is used for mutual authentication between server and client. Also this protocol ensures integrity of message by adding a HMAC(Hash-based Message Authentication Code) on the message. And replay attacks can be prevented by using a Nonce. As a result, The receiver can prevent the network attack by discarding the received message from unauthorized host.

An Improved End to End System for Sharing and Managing Data in Cloud Storage

Cloud Computing is one of the emerging area in modern times. It is providing excellent facilities due to its adaptable infrastructure and features, but the issues related to trust management and security are key challenges in various applications. Whenever data or information is shared or transmitted from one host to another in cloud storage there is a need for security and trust assurances to prevent data from unauthorized hosts. In this article we present a survey which addresses the various challenges of cloud storage along with the different trust computation models to identify important research issues in the hotfoot growing area of computer technology. In order to resolve those issues the proposed methodology incorporates the trust evaluation and Digital Envelope techniques for preserving data against the un-trusted hosts and networks.

IPv6 환경에서 호스트 탐색 및 네트워크 접속 차단 에이전트 시스템

As IPv4 addresses are exhausting, the use of IPv6 addresses is increasing. IPv6 environment provides address auto-configuration function. If addresses are allocated to each host automatically, network management system has difficulty in inspecting every IP of all devices and keeping the relevant informations. Also, as IP addresses are configured automatically, problems such as malicious users accessing network devices with no restriction can occur. To solve these problems, managing and blocking of malicious user is necessary. In this paper, we suggest agent system for searching of host computer and blocking network access which manages and protects the major network resources efficiently by searching host and blocking unauthorized host access to network in IPv6 environment. According to the test results of function of this agent system in IPv6 environment, we have checked that this system performs searching and blocking function normally.

Protection Against Internal Intruding using Host Identifier Authentication

Network security has become one of the most important interesting areas for researches. Protecting the network can be done by many mechanisms. Among the most effective one is the network firewall. While the firewall protecting the network from the external intruding, it does upward nothing about the internal intruding. Internal intruding or Inside attacks can lead to a big loosing. One of these attacks is attaching an unauthorized host to the network to get benefits of using the network resources provided by the server (like Internet service) or to leak information into the outside. To solve this problem, this paper suggested that two new programs have to be built under windows operating system in a client server model, one at the client and another at the server. The first supplies an authenticated unique host-ID to each packet destined to leave the network, while the latter verifies these information, allowing the authenticated packet to pass into its destined while dropping and documenting the unauthorized one. This work is considered as a logical extension of the conventional network firewall and can be installed with any of these firewalls. While the conventional firewall is protecting against outside attacks, this work is protecting against one of these inside attacks.

Network Intrusion Detection System Based on Matching Logical Address and Port Number

The aim of this paper is to design a significant system for detecting intrusion hosts inside
 computer networks. The goal is to let network administrators detect and discover if possible hackers
 (unauthorized hosts) that attempt to break into network infrastructure exist or no, who observe network
 traffic or try to cause service attack, by accident or with purpose.

A new solution for assigning cryptographic keys to control access in mobile agent environments

AbstractA mobile agent is a technological promising product. It is an executive program that can migrate from host to host, performing tasks autonomously. However, in an open environment, the mobile agent has many potential threats. Security becomes a critical issue for the mobile agent. Recently, Volker and Mehradad have constructed a mobile agent structure and designed a key assignment strategy to prevent the sensitive data to from being accessed by an unauthorized host. However, their scheme requires a larger agent size and a higher computational cost. In this paper, we shall propose an efficient key assignment scheme to enhance the performance of Volker and Mehradad's scheme. Only few computations and a fixed and small storage are required in our proposed scheme. Furthermore, our scheme can achieve the dynamic key management efficiently. It can also be implemented simply and practically. Copyright © 2006 John Wiley & Sons, Ltd.