This project was devoted to the exploration of how deception could be used to add to the defenses of computer and network systems ("cyber").  Most current computing systems provide helpful error messages and feedback for purposes of debugging and enhanced user experience, but that same feedback may assist attackers in exploiting weaknesses.


Our project examined how providing false information and decoys could be used to slow, mislead, or expose attackers.  Our efforts involved four separate but related efforts, described below.


The first effort was to develop a formal taxonomy of deceptive practices, including masking, decoys, and providing misleading information.  This effort resulted in a published, comprehensive model that can be used to classify every known form of cyber deception.


The second effort was to explore the effectiveness of providing false information in patches for security problems.  Patching is widely used to fix flaws and functionality, but the patches may be reverse-engineering to find attack points.  We explored methods of obfuscating the patches and providing false patches ("ghost patches") to slow or confuse attackers.  An extensive analysis and experiments with prototypes showed this had some minor promise, but would not be highly effective against sophisticated attackers.

 
We concluded that providing new instances of the entire software artifact using existing methods of obfuscation and confusion would likely be more effective in slowing reverse engineering analysis and attack than would be releasing "ghost" patches.  We determined there might be more involved methods of building false and illusory patches, but we did not fully explore them; we determined that complicated false patching would make legitimate maintenance and debugging more difficult, and thus would be of questionable value.


Our third effort was to explore how to provide a misleading view of secondary memory (disk) to an attacker.  Attackers often delete system resources, alter logs, and remove malware traces to hide malicious activity.  If those alterations and deleted items were available to the system defenders, it would provide an advantage in both recovery and forensics. However, it is essential to let the attacker believe that the alterations and deletions are occurring so that countermeasures are not taken, or to ensure that the attacker does not terminate the attack before sufficient evidence is collected.


We constructed two prototype systems that collect the state of artifacts that an attacker might change or delete yet are not visible to the end user.  One of these was part of a running OS, and the other was a modified virtual machine monitor.  In each case, we explored making the capture of data undetectable to the user, yet of sufficient fidelity to allow reconstruction of the system before the attack, and capture of any uploads.  We found that our final system, R2D2, worked well enough that it was also able to detect and counter ransomware attacks that would attempt to encrypt vast portions of the disk -- we were able to recover the entire disc contents after such an attack. We determined how to use a user-specified parameter to trade off the amount of extra storage used and the level of protection. 


Our fourth effort was to explore the use of an extension to game theory using incomplete information -- hypergames -- to model the deployment and use of deception.  Our goal was to explore if hypergames might be used to determine when deception was appropriate to use, and when it might not be effective.  We constructed some simple models using single rounds of deception and found that using deception mechanisms were effective in cases where the attacker suspected deception was present.   As of the end of this portion of the project, we have yet to explore more complex hypergames models of deception, such as, through multiple rounds of “games” between the attacker and the defender. 


In addition to 15 publications on our research results in conferences and journals, we also produced several software prototypes that are available for further experimentation by others.  Three students completed their Ph.D. degrees while working on this project, and several other graduate and undergraduate students obtained practical training in systems development and defense.


Both principal investigators on this project are planning on future research in the issues raised during the effort.  They are also exploring technology transfer opportunities to employ some of the lessons learned in real-world products.

Last Modified: 07/06/2018
Modified by: Eugene H Spafford