Network Defence Strategy Evaluation: Simulation vs. Live Network

Result code in IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14610%2F17%3A00094471" target="_blank" >RIV/00216224:14610/17:00094471 - isvavai.cz</a>

Result on the web

<a href="http://ieeexplore.ieee.org/document/7987267/" target="_blank" >http://ieeexplore.ieee.org/document/7987267/</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.23919/INM.2017.7987267" target="_blank" >10.23919/INM.2017.7987267</a>

Result language

angličtina

Original language name

Network Defence Strategy Evaluation: Simulation vs. Live Network

Original language description

A lot of research has been dedicated to finding an optimal strategy to defend network infrastructure. The proposed methods are usually evaluated using simulations, replayed attacks or testbed environments. However, these evaluation methods may give biased results, because in real life, attackers can follow a suboptimal strategy or react to a defence in an unexpected way. In this paper, we use a network of honeypots as a testing environment for evaluating network defence strategies. The honeypot network provides the opportunity to test a defence strategy against real attackers and is not as time and resource consuming as using white hat hackers. In our experiment, we use two different strategies to defend a group of honeypots in a live network and we compare these results to the results of a simulation with replayed attacks. We show that the results of the strategies in the simulation significantly differ from the results on the honeypot network which implies simulations are not sufficient for strategy evaluation. We also investigate how the attacker adapts to the responses taken by a defence strategy and how this change in behaviour affects the evaluation results.

Czech name

—

Czech description

—

Type

D - Article in proceedings

CEP classification

—

OECD FORD branch

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Project

<a href="/en/project/VI20172020070" target="_blank" >VI20172020070: Research of Tools for Cyber Situational Awareness and Decision Support of CSIRT Teams in Protection of Critical Infrastructure</a><br>

Continuities

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)

Publication year

2017

Confidentiality

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Article name in the collection

2017 IFIP/IEEE Symposium on Integrated Network and Service Management (IM)

ISBN

9783901882890

ISSN

—

e-ISSN

—

Number of pages

8

Pages from-to

81-88

Publisher name

IEEE

Place of publication

Lisbon

Event location

Lisbon

Event date

May 8, 2017

Type of event by nationality

WRD - Celosvětová akce

UT code for WoS article

—