网络欺骗响应式：TCP隐蔽重定向至按需蜜罐
Cyber Deception Reactive: TCP Stealth Redirection to On-Demand Honeypots
AI总结：
本文提出一种基于TCP隐蔽重定向的按需蜜罐欺骗机制，通过将攻击者无缝重定向至受害资产的克隆体来保护真实资产并收集威胁情报，实验证明其延迟低到难以被人类或机器察觉。
摘要：
网络安全正在快速发展，针对攻击者的新型防御方法不断出现，例如网络欺骗（CYDEC）。CYDEC的核心在于欺骗对手，使其在执行操作时并未意识到自己正被欺骗。本文提出设计、实现并评估一种基于TCP通信隐蔽重定向的欺骗机制，将攻击流量重定向至一个按需部署的蜜罐服务器，该服务器具有与受害资产完全相同的特征，即它是受害资产的克隆体。该机制通过隐蔽重定向确保防御者能够迷惑攻击者。在此情境下，攻击者将集中精力攻击蜜罐服务器，同时防御方可借此收集相关信息以生成威胁情报。在不同场景下的实验表明，所提出的解决方案能够按需将攻击者有效重定向至复制资产，从而保护真实资产。最后，通过评估延迟时间得到的结果证明，该重定向对人类而言无法察觉，且对机器而言极难检测。
英文摘要：
Cybersecurity is developing rapidly, and new methods of defence against attackers are appearing, such as Cyber Deception (CYDEC). CYDEC consists of deceiving the enemy who performs actions without realising that he/she is being deceived. This article proposes designing, implementing, and evaluating a deception mechanism based on the stealthy redirection of TCP communications to an on-demand honey server with the same characteristics as the victim asset, i.e., it is a clone. Such a mechanism ensures that the defender fools the attacker, thanks to stealth redirection. In this situation, the attacker will focus on attacking the honey server while enabling the recollection of relevant information to generate threat intelligence. The experiments in different scenarios show how the proposed solution can effectively redirect an attacker to a copied asset on demand, thus protecting the real asset. Finally, the results obtained by evaluating the latency times ensure that the redirection is undetectable by humans and very difficult to detect by a machine.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
