DeceptoGuard

ABSTRACT:Specific cyber deception challenges under APT threat require a high degree of consistency and depth of deception. In order to be able to withstand an attackers multi-pronged reconnaissance efforts, DOD and civilian networks require a software platform with advanced cyber agility and moving target defense capabilities, that also provide for a flexible deception infrastructure with low cost of re-deployment and minimal effect on system performance. Existing cyber deception solutions and research prototypes only demonstrate frameworks based on selected techniques and methods that do not satisfy the depth, consistency or maintainability requirements needed for the APT challenge. To address these critical needs, Intelligent Automation Inc. (IAI) proposes the DeceptoGuard solution to build a flexible system that introduces a full range of cyber deception capabilities based on novel anti-reconnaissance and moving target defense technique to impede, mislead and confuse an attacker. DeceptoGuard units deployed at key locations in the network, collectively thwart reconnaissance attempts by creating a perception of transient network environment, by randomizing and polluting the network attack surface, and by making it difficult for an attacker to determine the direction, volume and importance of network traffic.BENEFIT:DeceptoGuard can be directly applied to the military and security contexts. The ability to provide anti-reconnaissance protection against external attackers, as well as against an internal threat, will significantly disrupt cyber threats and enhance cyber deception capability. Both government and commercial organizations will benefit from the development of DeceptoGuard due to their significant unmet needs for effective cyber security solutions that protect their mission and business goals. The DoD along with several other government organizations (e.g., DHS, DoE, etc.) are actively pursuing multiple cyber security related technology development programs related to cyber deception and moving target defense. A wide range of DoD networks and systems need a stronger operation posture against attacks, and can potentially be enhanced by the proposed work. DeceptoGuard has significant commercial potential for applications such as corporate security design, information security, and cloud configurations. End users of DeceptoGuard include network security tool providers (e.g., Symantec, McAfee, SourceFire) to defend network infrastructure from both inside and outside threats; information security consulting companies (e.g., NSS Labs) to enhance the cyber security services they provide; and large commercial organizations including financial (e.g., Bank of America, Citibank), retail (e.g., Amazon, Overstock), and healthcare (e.g., United Healthcare, Humana).