基于动态认知蜜罐的远距离侧向运动风险缓解
Farsighted Risk Mitigation of Lateral Movement Using Dynamic Cognitive Honeypots
摘要：
先进的持续威胁的横向移动构成了严峻的安全挑战。由于横向移动的隐蔽性和持久性，防御者需要全面考虑时间和空间位置，以发现大时间范围内的潜在攻击路径，并实现目标资产的长期安全。在这项工作中，我们提出了一个时间扩展的随机网络模型的随机服务链接的用户-主机企业网和敌对的横向移动。我们在空闲的生产节点上设计认知蜜罐，并将蜂蜜链接伪装成服务链接，以检测和阻止敌对的横向移动。蜜罐的位置在不同的时间随机变化，增加了蜜罐的隐蔽性。由于防御者不知道初始入侵和横向移动是否、何时以及在何处发生，因此蜜罐策略旨在减少目标资产的长期脆弱性（LTV），以实现主动和持久的保护。我们进一步描述了三个权衡，即，干扰概率、隐蔽性级别和漫游成本。为了对抗多攻击路径的诅咒，我们提出了一种迭代算法，并近似的LTV与计算效率的认知蜜罐部署的工会界。脆弱性分析的结果说明了边界，趋势，和剩余的LTV时，敌对的横向运动具有无限的持续时间。除了蜜罐策略，我们得到了一个临界阈值的妥协，以指导设计和修改当前的系统参数，以达到更高的长期安全水平。我们表明，目标节点可以实现零脆弱性无限阶段的横向运动，如果运动威慑的概率不小于阈值。
英文摘要：
Lateral movement of advanced persistent threats has posed a severe security challenge. Due to the stealthy and persistent nature of the lateral movement, defenders need to consider time and spatial locations holistically to discover latent attack paths across a large time-scale and achieve long-term security for the target assets. In this work, we propose a time-expanded random network to model the stochastic service links in the user-host enterprise network and the adversarial lateral movement. We design cognitive honeypots at idle production nodes and disguise honey links as service links to detect and deter the adversarial lateral movement. The location of the honeypot changes randomly at different times and increases the honeypots' stealthiness. Since the defender does not know whether, when, and where the initial intrusion and the lateral movement occur, the honeypot policy aims to reduce the target assets' Long-Term Vulnerability (LTV) for proactive and persistent protection. We further characterize three tradeoffs, i.e., the probability of interference, the stealthiness level, and the roaming cost. To counter the curse of multiple attack paths, we propose an iterative algorithm and approximate the LTV with the union bound for computationally efficient deployment of cognitive honeypots. The results of the vulnerability analysis illustrate the bounds, trends, and a residue of LTV when the adversarial lateral movement has infinite duration. Besides honeypot policies, we obtain a critical threshold of compromisability to guide the design and modification of the current system parameters for a higher level of long-term security. We show that the target node can achieve zero vulnerability under infinite stages of lateral movement if the probability of movement deterrence is not less than the threshold.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
