Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Cyber Deception Reactive: TCP Stealth Redirection to On-Demand Honeypots

Pedro Beltran Lopez, Pantaleone Nespoli, Manuel Gil Perez

TL;DR

This paper addresses defending critical infrastructures with cyber deception by integrating stealth TCP redirection to on-demand honey servers. It presents an SDN/NFV-based architecture using a Snort IDS and a Ryu controller to redirect connections to a real-time clone of the victim, enabling continuous threat intelligence collection with minimal resource use. Through Mininet and KVM-based experiments, the work demonstrates that redirection remains stealthy, with negligible latency changes for attackers during migration, and that on-demand honey servers can be instantiated efficiently. The contributions include a publicly released implementation and a framework for threat-informed reaction and autonomous learning in future deployments.

Abstract

Cybersecurity is developing rapidly, and new methods of defence against attackers are appearing, such as Cyber Deception (CYDEC). CYDEC consists of deceiving the enemy who performs actions without realising that he/she is being deceived. This article proposes designing, implementing, and evaluating a deception mechanism based on the stealthy redirection of TCP communications to an on-demand honey server with the same characteristics as the victim asset, i.e., it is a clone. Such a mechanism ensures that the defender fools the attacker, thanks to stealth redirection. In this situation, the attacker will focus on attacking the honey server while enabling the recollection of relevant information to generate threat intelligence. The experiments in different scenarios show how the proposed solution can effectively redirect an attacker to a copied asset on demand, thus protecting the real asset. Finally, the results obtained by evaluating the latency times ensure that the redirection is undetectable by humans and very difficult to detect by a machine.

Cyber Deception Reactive: TCP Stealth Redirection to On-Demand Honeypots

TL;DR

This paper addresses defending critical infrastructures with cyber deception by integrating stealth TCP redirection to on-demand honey servers. It presents an SDN/NFV-based architecture using a Snort IDS and a Ryu controller to redirect connections to a real-time clone of the victim, enabling continuous threat intelligence collection with minimal resource use. Through Mininet and KVM-based experiments, the work demonstrates that redirection remains stealthy, with negligible latency changes for attackers during migration, and that on-demand honey servers can be instantiated efficiently. The contributions include a publicly released implementation and a framework for threat-informed reaction and autonomous learning in future deployments.

Abstract

Cybersecurity is developing rapidly, and new methods of defence against attackers are appearing, such as Cyber Deception (CYDEC). CYDEC consists of deceiving the enemy who performs actions without realising that he/she is being deceived. This article proposes designing, implementing, and evaluating a deception mechanism based on the stealthy redirection of TCP communications to an on-demand honey server with the same characteristics as the victim asset, i.e., it is a clone. Such a mechanism ensures that the defender fools the attacker, thanks to stealth redirection. In this situation, the attacker will focus on attacking the honey server while enabling the recollection of relevant information to generate threat intelligence. The experiments in different scenarios show how the proposed solution can effectively redirect an attacker to a copied asset on demand, thus protecting the real asset. Finally, the results obtained by evaluating the latency times ensure that the redirection is undetectable by humans and very difficult to detect by a machine.
Paper Structure (17 sections, 9 figures)

This paper contains 17 sections, 9 figures.

Table of Contents

  1. Introduction
  2. Related work
  3. Network traffic redirection
  4. Copy on demand
  5. System design
  6. Architecture
  7. Redirection implementation
  8. Copy on-demand deployment
  9. Experiments
  10. Experiments topology
  11. Redirection
  12. Settings
  13. Results
  14. Redirection & Copy on-demand
  15. Settings
  16. ...and 2 more sections

Figures (9)

  • Figure 1: Threat detection and response system architecture based on redirection and copy on-demand.
  • Figure 2: TCP packet exchange between the victim and the attacker in the process of stealth redirection.
  • Figure 3: Network topology for the proposed experiments.
  • Figure 4: Redirection latency means in the different experiments (1 Host - 1 Process).
  • Figure 5: Redirection latency mean in the different experiments (20 Host - 70 Process).
  • ...and 4 more figures