Researchers Devise New Method of Intrusion Deception for SDN

Researchers with University of Missouri hope to move the ball forward on cyber decepton technology with a new form of intrusion deception they designed specifically to help defend software-defined networking (SDN) cloud infrastructure.

Their system, called Dolus, was designed using pretense theory from child-play psychology and machine learning to fool attackers: giving them a false sense of success that buys defenders time to thwart DDoS and targeted attacks while collecting valuable threat intelligence in the process.

"With the time gained through effective pretense initiation in the case of DDoS attacks, cloud service providers could coordinate across a unified (software defined everything Infrastructure) SDxI infrastructure involving multiple (autonomous systems) ASes to decide on policies that help in blocking the attack flows closer to the source side," they wrote in their research.

This is a classic sales pitch for intrusion deception methods, which can vary in sophistication from simple honeypots or honey nets all the way up to fully simulated systems and environments.

Research lead Prasad Calyam, associate professor of electrical engineering and computer science and the director of Cyber Education and Research Initiative in the MU College of Engineering, says the difference with Dolus is that it's more fully simulating an SDN environment in production.

"Honepots - they were more like pre-deployments of applications - so before something goes live you do a lot of this resilience testing and then once things are live, you don't do much in terms of sophisticated defense," says Calyam, who believes more sophisticated forms of intrusion deception are "under-explored."

The question is whether the market has already beaten Calyam and his cohort to the punch when it comes to evolving deception technology. Players like Cymmetria, TrapX, and Attivo are currently duking it out with commercial products moving in this direction, and a recent report from Market Insights Reports shows the market will grow by more than 15% annually through 2025.

So it’s no surprise that analysts like Rich Mogull and Adrian Lane of Securosis wonder whether this is much different than what practitioners already have access to on the market. 

Lane says he's "highly skeptical" from what he's seen skimming through the research. And Mogull notes that while he likes the concept of tricking attackers with deception, simply putting forward an advance using some social theory and AI/machine learning may not be enough to differentiate Dolus from existing deception products.

"It isn't that hard to trick attackers," Mogull says, also noting that the DDoS defense for SDN may still have a very limited market. "The market is somewhat limited to cloud providers. Very few enterprises are running SDN."

Calyam, however, believes that there is still room for the field to advance, and his team's next step is in exploring how to coordinate policies across providers' software-defined infrastructure in order to provide a defense that helps the ecosystem improve defense. They're seeking a means of distributed trust, perhaps through the use of blockchain, to accomplish this.

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.