ASTER: Active Smart Targets for Effective Response

Sophisticated attacks on computer systems typically proceed in stages. The attacker first probes the target site to discover its vulnerabilities, and then exploits the vulnerabilities. To avoid detection, attacks can be spread out over time or be launchedfrom multiple hosts. An attacker who has gained entry to a network host can use it as a base from which to attack other hosts on the network. Current techniques cannot reliably recognize successive stages of a coordinated attack. ATC-NY proposes to buildASTER (Active Smart Targets for Effective Response), a system to identify attackers by feeding them traceable information during exploratory probes. When attackers use the information in later attack stages, ASTER can correlate the stages and assess theattack. In Phase I, ATC-NY successfully demonstrated the feasibility of ASTER with an initial prototype. In Phase II, ASC-NY will enhance the types of information gathered about attackers by building a pre-production prototype and by a large-scaleevaluation. ASTER technology will also be adapted to address insider attacks and spam recognition.