Deception Based Cyber Attacks Detection Framework for Multiple Public Facing Internet Servers

Abstract

With the passage of time, cyber threats and attacks are becoming more and more sophisticated and are continually evolving at an alarming rate. To confront these attacks, the existing security solutions are failing repeatedly because the attackers are coming up with new and advance attack vectors. Proactive detection of these attacks is becoming a tough challenge. Incorporation of deception technology and tools have the potential to early detect and guard against modern cyber-attacks and threats. Deception technology and tools enable the administrators and security specialists to entice the adversaries’ target selection and therefore, lead them to execute actions that might disclose their aim and presence. A structured framework and proof-of-concept implementation of a Deception Server (DS) is proposed. DS centrally maintains and provides continuous deception across multiple internet facing application server’s environment and detects the activities of adversaries in their reconnaissance stage of an attack. Additionally, DS is also capable to mislead or astray the attackers from a successful target infiltration as it can generate deceit response on-the-fly.