Thwart Reconnaissance Attempts with Adaptive Deception (TRAAD)

ABSTRACT:Cyber detection and defense techniques and research typically focus on malicious actions and the damage they cause and rarely focus on how adversaries discover which action to take. A promising approach for addressing reconnaissance attempts is to use moving-target defense (MTD) methods that seek to reduce the attack surface by limiting the adversarys ability to gain an accurate picture of the enterprise topology. Unfortunately, MTD techniques change everything for everybody, and legitimate users are as likely to be tripped up as the adversary. Additionally, MTD typically requires extensive retooling and is therefore too costly to be deployed on every host in the enterprise. Complementary to techniques such as MTD, are techniques that reduce the defense surface to enable focused defenses based on the adversarys actual attack. Our Thwart Reconnaissance Attempts with Adaptive Deception (TRADD) approach addresses this half of the complete picture. TRAAD actively engages the adversary and uses natural language processing (NLP) understanding and generation techniques in concert; first to enable us to understand the goals behind an attackers reconnaissance activities and then to enable us to generate the most appropriate deceptions based on our ability to detect and predict the attackers goals and next moves.BENEFIT:We expect the full-scope TRAAD system, as well as the reconnaissance-detection, decoy-generation and attack surface visualization components, to have immediate and tangible benefit for a number of military cyber defense programs. These components can also be integrated into existing IDS and AV products or sold as a stand-alone product to businesses, especially those in the finance and defense sectors as they are often the victims of sophisticated attacks. Additionally, because TRAAD focuses on decreasing the defense surface and techniques that complement moving-target defense (MTD), it can benefit any enterprise using MTD to defend mission-critical applications and data.