Network Aware Defenses for Intrusion Recognition and Response (NADIR)

Abstract

It has become increasingly difficult to monitor computer networks as they have grown in scale and complexity. This lack of awareness makes responding to, or even recognizing, attacks a challenge. As a result, organizations’ reactions to attacks are delayed, typically leaving them to address the situation long after an incident has taken place. The central idea behind this research is to provide earlier notification of potential network attacks by using deceptive network service information as bait. These “decoy” or “honeyservices” will indicate system vulnerabilities which do not actually exist when suspicious network circumstances are detected. That is, although up-to-date versions of programs are installed and running, vulnerable software versions will be advertised when a potential attack or reconnaissance effort is detected. Exploits launched against these services will be unsuccessful, yet may provide valuable information about attacks. Our system uses a decision tree based learning algorithm to detect anomalous attack traffic and change its behavior to advertise honeyservices in response. By indicating the existence of fake vulnerabilities, our system is capable of collecting information about attacks earlier in the reconnaissance phase, potentially catching adversaries in the act without exposing any actual system weaknesses. Our solution effectively transforms any legitimate server into a honeypot without the added overhead of setting up and maintaining fake network infrastructure.