Cloud

2/4/2019
04:00 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

Researchers Devise New Method of Intrusion Deception for SDN

Team from University of Missouri take wraps off Dolus, a system 'defense using pretense' which they say will help defend software-defined networking (SDN) cloud infrastructure.

Researchers with University of Missouri hope to move the ball forward on cyber decepton technology with a new form of intrusion deception they designed specifically to help defend software-defined networking (SDN) cloud infrastructure.

Their system, called Dolus, was designed using pretense theory from child-play psychology and machine learning to fool attackers: giving them a false sense of success that buys defenders time to thwart DDoS and targeted attacks while collecting valuable threat intelligence in the process.

"With the time gained through effective pretense initiation in the case of DDoS attacks, cloud service providers could coordinate across a unified (software defined everything Infrastructure) SDxI infrastructure involving multiple (autonomous systems) ASes to decide on policies that help in blocking the attack flows closer to the source side," they wrote in their research.

This is a classic sales pitch for intrusion deception methods, which can vary in sophistication from simple honeypots or honey nets all the way up to fully simulated systems and environments.

Research lead Prasad Calyam, associate professor of electrical engineering and computer science and the director of Cyber Education and Research Initiative in the MU College of Engineering, says the difference with Dolus is that it's more fully simulating an SDN environment in production.

"Honepots - they were more like pre-deployments of applications - so before something goes live you do a lot of this resilience testing and then once things are live, you don't do much in terms of sophisticated defense," says Calyam, who believes more sophisticated forms of intrusion deception are "under-explored."

The question is whether the market has already beaten Calyam and his cohort to the punch when it comes to evolving deception technology. Players like Cymmetria, TrapX, and Attivo are currently duking it out with commercial products moving in this direction, and a recent report from Market Insights Reports shows the market will grow by more than 15% annually through 2025.

So it’s no surprise that analysts like Rich Mogull and Adrian Lane of Securosis wonder whether this is much different than what practitioners already have access to on the market. 

Lane says he's "highly skeptical" from what he's seen skimming through the research. And Mogull notes that while he likes the concept of tricking attackers with deception, simply putting forward an advance using some social theory and AI/machine learning may not be enough to differentiate Dolus from existing deception products.

"It isn't that hard to trick attackers," Mogull says, also noting that the DDoS defense for SDN may still have a very limited market. "The market is somewhat limited to cloud providers. Very few enterprises are running SDN."

Calyam, however, believes that there is still room for the field to advance, and his team's next step is in exploring how to coordinate policies across providers' software-defined infrastructure in order to provide a defense that helps the ecosystem improve defense. They're seeking a means of distributed trust, perhaps through the use of blockchain, to accomplish this.

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-10010
PUBLISHED: 2019-03-24
Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not properly escaped during rendering, a different vulnerability than CVE-2018-20583.
CVE-2019-9978
PUBLISHED: 2019-03-24
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.
CVE-2019-9977
PUBLISHED: 2019-03-24
The renderer process in the entertainment system on Tesla Model 3 vehicles mishandles JIT compilation, which allows attackers to trigger firmware code execution, and display a crafted message to vehicle occupants.
CVE-2019-9962
PUBLISHED: 2019-03-24
XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to VCRUNTIME140!memcpy.
CVE-2019-9963
PUBLISHED: 2019-03-24
XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to ntdll!RtlFreeHeap.