Attack Surface Expansion through Decoy Trap for Protected Servers in Moving Target Defense

국문 초록 (Abstract)

본 논문에서는 보호대상 서버 네트워크에 디코이 트랩을 통한 공격 표면 확장의 적용 방법을 제안한다. 보호대상 서버 네트워크는 많은 수의 디코이들과 보호대상 서버로 구성되며, 각 보호대상 서버는 Hidden Tunner Networking이라는 네트워크 기반 이동 표적 방어 기법에 따라 IP 주소와 포트 번호를 변이한다. 이동 표적 방어는 공격을 막기 위하여 지속적으로 시스템의 공격 표면을 변경하는 사이버 보안에서의 새로운 접근방법이다. 공격 표면 확장은 공격을 막기 위해 디코이와 디코이 그룹을 활용하는 접근방법이다. 제안하는 방법에서는 공격자가 디코이 트랩에서 공격자의 모든 시간과 노력을 허비하도록 커스텀 체인과 RETURN 타켓을 사용하여 보호대상 서버의 NAT 테이블을 수정한다. 본 논문에서는 제안하는 방법이 적용되기 전과 후에 보호대상 서버 네트워크에서의 공격자 성공률을 수식으로 계산한다. 제안하는 방법은 보호대상 서버가 공격자에 의해 식별되고 공격당할 확률을 현저히 줄일 것으로 기대된다.

다국어 초록 (Multilingual Abstract)

In this paper, we propose a method to apply the attack surface expansion through decoy traps to a protected server network. The network consists of a large number of decoys and protected servers. In the network, each protected server dynamically mutates its IP address and port numbers based on Hidden Tunnel Networking that is a network-based moving target defense scheme. The moving target defense is a new approach to cyber security and continuously changes system’s attack surface to prevent attacks. And, the attack surface expansion is an approach that uses decoys and decoy groups to protect attacks. The proposed method modifies the NAT table of the protected server with a custom chain and a RETURN target in order to make attackers waste all their time and effort in the decoy traps. We theoretically analyze the attacker success rate for the protected server network before and after applying the proposed method. The proposed method is expected to significantly reduce the probability that a protected server will be identified and compromised by attackers.

목차 (Table of Contents)

• Abstract
• 요약
• I. Introduction
• II. Related Works
• III. Protected Server Networks
• IV. Attack Surface Expansion Approaches
• V. Attack Surface Expansion in the Protected Server Networks
• VI. Conclusions
• REFERENCES

참고문헌 (Reference)

1 Fred Cohen, "The Use of Deception Techniques: Honeypots and Decoys" Fred Cohen & Associates

2 K. Park, "Pseudonym Address based Hidden Tunnel Networking for Network Address Mutation"

3 K. Borders, "OpenFire: Using Deception to Reduce Network Attacks"

4 J. H. Jafarian, "Multi-dimensional Host Identity Anonymization for Defeating Skilled Attacks" 47-58, 2016

5 D. Kewley, "Dynamic Approaches to Thwart Adversary Intelligence Gathering" 176-185, 2001

6 박태근, "Design of a Protected Server Network with Decoys for Network-based Moving Target Defense" 한국컴퓨터정보학회 23 (23): 57-64, 2018

7 S. Antonatos, "Defending against histlist worms using network address space randomization" 51 (51): 3471-3490, 2007

8 J. Sun, "DESIR: Decoy-enhanced seamless IP randomization" 2016

9 T. Al-Salah, "Attack Surface Expansion Using Decoys to Protect Virtualized Infrastructure" 216-219, 2017

10 강구홍, "Analysis of Threat Model and Requirements in Network-based Moving Target Defense" 한국컴퓨터정보학회 22 (22): 83-92, 2017

11 J. H. Jafarian, "An Effective Address Mutation Approach for Distructing Reconnaissance Attacks" 10 (10): 2562-2577, 2015

12 M. Atighetchi, "Adaptive Use of Network-Centric Mechanisms in Cyber-Defense" 183-192, 2003

13 T. Park, "A Scalable and Seamless Connection Migration Scheme for Moving Target Defense in Legacy Networks" E101-D (E101-D): 2018