Estimating Parameters of Target's Detection Methods

Kód výsledku v IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14610%2F17%3A00099647" target="_blank" >RIV/00216224:14610/17:00099647 - isvavai.cz</a>

Výsledek na webu

<a href="http://ceur-ws.org/Vol-2057/Paper12.pdf" target="_blank" >http://ceur-ws.org/Vol-2057/Paper12.pdf</a>

DOI - Digital Object Identifier

—

Jazyk výsledku

angličtina

Název v původním jazyce

Estimating Parameters of Target's Detection Methods

Popis výsledku v původním jazyce

Dictionary attacks are a prevalent phenomenon, which was lately amplified with the onset of insecure SOHO and IoT devices. Some of these devices use their own protection against dictionary attacks and some offload their security to mechanisms deployed in the infrastructure, such as flow-based IPS systems. These mechanism often operate with the notion of a typical attacker, who represent common attacks against the infrastructure and lacks sophistication. However, the emergence of stealthy and distributed dictionary attacks indicate that detection mechanisms should take sophisticated attackers into account. In this paper we explore the capability of a sophisticated attacker, who can estimate parameters of detection methods deployed on target and can then craft an attack which could go undetected for arbitrary long time. For this, we propose a new model of attacker-target interaction during dictionary attacks, which is based on attacker's perspective. Using this model we then postulate and experimentally evaluate an algorithm for estimating parameters of target detection method, illustrating that an attacker requires only a handful of attack attempts to correctly guess these parameters.

Název v anglickém jazyce

Estimating Parameters of Target's Detection Methods

Popis výsledku anglicky

Dictionary attacks are a prevalent phenomenon, which was lately amplified with the onset of insecure SOHO and IoT devices. Some of these devices use their own protection against dictionary attacks and some offload their security to mechanisms deployed in the infrastructure, such as flow-based IPS systems. These mechanism often operate with the notion of a typical attacker, who represent common attacks against the infrastructure and lacks sophistication. However, the emergence of stealthy and distributed dictionary attacks indicate that detection mechanisms should take sophisticated attackers into account. In this paper we explore the capability of a sophisticated attacker, who can estimate parameters of detection methods deployed on target and can then craft an attack which could go undetected for arbitrary long time. For this, we propose a new model of attacker-target interaction during dictionary attacks, which is based on attacker's perspective. Using this model we then postulate and experimentally evaluate an algorithm for estimating parameters of target detection method, illustrating that an attacker requires only a handful of attack attempts to correctly guess these parameters.

Druh

D - Stať ve sborníku

CEP obor

—

OECD FORD obor

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Projekt

—

Návaznosti

I - Institucionalni podpora na dlouhodoby koncepcni rozvoj vyzkumne organizace

Rok uplatnění

2017

Kód důvěrnosti údajů

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Název statě ve sborníku

Proceedings of the NATO IST-152 Workshop on Intelligent Autonomous Agents for Cyber Defence and Resilience

ISBN

—

ISSN

1613-0073

e-ISSN

—

Počet stran výsledku

6

Strana od-do

84-89

Název nakladatele

CEUR Workshop Proceedings

Místo vydání

Praha

Místo konání akce

Prague

Datum konání akce

1. 1. 2017

Typ akce podle státní příslušnosti

WRD - Celosvětová akce

Kód UT WoS článku

—