Nothing Special   »   [go: up one dir, main page]

skip to main content
10.1007/978-3-031-09234-3_17guideproceedingsArticle/Chapter ViewAbstractPublication PagesConference Proceedingsacm-pubtype
Article

An Approach to Generate Realistic HTTP Parameters for Application Layer Deception

Published: 20 June 2022 Publication History

Abstract

Deception is a form of active defense that aims to confuse and divert attackers who try to tamper with a system. Deceptive techniques have been proposed for web application security, in particular, to enrich a given application with deceptive elements such as honey cookies, HTTP parameters or HTML comments. Previous studies describe how to automatically add and remove such elements into the application traffic, however, the elements themselves need to be decided manually, which is a tedious task (especially for large-scale applications) and makes the adoption of deception more cumbersome.
In this paper, we aim to automate the generation of deceptive HTTP parameter names for a given web application. Such parameters should seamlessly blend into application context and be indistinguishable from the rest of the parameters, in order to maximize the deception effect. To achieve this, we propose to use word embeddings trained with a domain-specific corpus obtained from existing web application source code. We evaluate our method through a survey, where we ask the participants to identify the deceptive parameters in two different web applications’ APIs. Moreover, the survey is composed of two variants in order to further experiment with the impact of the quantity and enticement of deceptive parameters.
The results confirm the effectiveness of our method in generating indistinguishable honey parameter names. We also find that the participants’ expectation of the ratio of honey parameters remains constant, regardless of the actual number. Thus, a higher number of honeytokens can provide a stronger defense. Moreover, making attackers aware of deception can help to obfuscate the real attack surface, e.g., by masquerading more than 10% of the real application elements to look like traps. Finally, although our work focuses on the generation of parameter names, we also discuss other related challenges in a holistic way, and provide multiple directions for future research.

References

[3]
difflib - Helpers for computing deltas. https://docs.python.org/3/library/difflib.html
[7]
Global Deception Technology Market: Growth, Trends and Forecast to 2025 - ResearchAndMarkets.com, April 2020. https://www.businesswire.com
[13]
Allamanis, M., Barr, E.T., Devanbu, P., Sutton, C.: A survey of machine learning for big code and naturalness. ACM Comput. Surv. (CSUR) 51, 1–37 (2018)
[14]
Almeshekah, M., Spafford, E.: Planning and integrating deception into computer security defenses. In: NSPW 2014 (2014)
[15]
Alon, U., Zilberstein, M., Levy, O., Yahav, E.: code2vec: learning distributed representations of code (POPL) (2019)
[16]
Anderson, P.: Deception: a healthy part of any defense in-depth strategy, March 2002. sans.org/reading-room/whitepapers/policyissues/deception-healthy-defense-in-depth-strategy-506
[17]
Araujo, F., Hamlen, K.W., Biedermann, S., Katzenbeisser, S.: From patches to honey-patches: lightweight attacker misdirection, deception, and disinformation. In: CCS 2014 (2014)
[18]
[19]
Barron, T., So, J., Nikiforakis, N.: Click this, not that: extending web authentication with deception. In: ASIA CCS 2021 (2021)
[21]
Bercovitch, M., Renford, M., Hasson, L., Shabtai, A., Rokach, L., Elovici, Y.: HoneyGen: an automated honeytokens generator. In: Proceedings of 2011 IEEE International Conference on Intelligence and Security Informatics, July 2011
[22]
Bowen BM, Hershkop S, Keromytis AD, and Stolfo SJ Chen Y, Dimitriou TD, and Zhou J Baiting inside attackers using decoy documents Security and Privacy in Communication Networks 2009 Heidelberg Springer 51-70
[23]
Cabrera Lozoya, R., Baumann, A., Sabetta, A., Bezzi, M.: Commit2vec: learning distributed representations of code changes (2019). arXiv:1911.07605
[24]
Chen, B., Jiang, Z.M.: Studying the use of java logging utilities in the wild. In: ICSE (2020)
[25]
Chen, Z., Monperrus, M.: A literature study of embeddings on source code. arXiv:1904.03061 (2019)
[26]
Cohen, F., Marin, I., Sappington, J., Stewart, C., Thomas, E.: Red teaming experiments with deception technologies (2001). http://all.net/journal/deception/RedTeamingExperiments.pdf
[27]
Devlin, J., Chang, M.W., Lee, K., Toutanova, K.: BERT: pre-training of deep bidirectional transformers for language understanding (2018). arXiv:1810.04805
[28]
Ferguson-Walter, K., et al.: The Tularosa study: an experimental design and implementation to quantify the effectiveness of cyber deception. In: HICSS (2019)
[29]
Ferguson-Walter, K.J., Major, M.M., Johnson, C.K., Muhleman, D.H.: Examining the efficacy of decoy-based and psychological cyber deception. In: USENIX Security (2021)
[30]
Fraunholz, D., Schotten, H.D.: Defending web servers with feints, distraction and obfuscation. In: ICNC 2018, March 2018
[31]
Fraunholz, D., et al.: Demystifying deception technology: a survey. CoRR abs/1804.06196 (2018)
[32]
Fraunholz, D., Reti, D., Duque Anton, S., Schotten, H.D.: Cloxy: a context-aware deception-as-a-service reverse proxy for web services. In: MTD 2018 (2018)
[33]
Gousios, G.: The GHTorrent dataset and tool suite. In: MSR 2013, May 2013. pub/ghtorrent-dataset-toolsuite.pdf
[34]
Han, X., Kheir, N., Balzarotti, D.: Evaluation of deception-based web attacks detection. In: MTD 2017 (2017)
[35]
Han, X., Kheir, N., Balzarotti, D.: Deception techniques in computer security: a research perspective. ACM Comput. Surv. 51, 1–36 (2018)
[36]
Hitaj, B., Gasti, P., Ateniese, G., Perez-Cruz, F.: PassGAN: a deep learning approach for password guessing. In: Deng, R.H., Gauthier-Umaña, V., Ochoa, M., Yung, M. (eds.) ACNS (2019)
[38]
Mikolov, T., Chen, K., Corrado, G., Dean, J.: Efficient estimation of word representations in vector space. arXiv preprint arXiv:1301.3781 (2013)
[39]
Ocanto-Dávila, C., Cabrera-Lozoya, R., Trabelsi, S.: Sociocultural influences for password definition: An AI-based study. In: ICISSP, pp. 542–549 (2021)
[40]
OpenAPI Initiative: OpenAPI Specification v3.1.0 (2021). https://spec.openapis.org/oas/v3.1.0.html
[42]
OWASP Foundation: Appsensor detection points (2015). https://www.owasp.org
[43]
Pennington, J., Socher, R., Manning, C.D.: Glove: Global vectors for word representation. In: EMNLP (2014)
[44]
Peters, M.E., et al.: Deep contextualized word representations (2018). arXiv:1802.05365
[45]
Pohl C, Zugenmaier A, Meier M, and Hof H-J Federrath H and Gollmann D B.Hive: a zero configuration forms honeypot for productive web applications ICT Systems Security and Privacy Protection 2015 Cham Springer 267-280
[46]
PortSwigger: Insecure direct object references (IDOR) (2021). https://portswigger.net/web-security/access-control/idor
[47]
Sahin, M., Hebert, C., Oliveira, A.: Lessons learned from sundew: a self defense environment for web applications. In: MADWeb (2020)
[48]
[49]
Swagger: OpenAPI Specification Version 2.0. https://swagger.io/specification/v2/
[50]
ThinkstCanary: Canarytokens (2019). https://canarytokens.org
[51]
Yue, C., Wang, H.: BogusBiter: a transparent protection against phishing attacks. ACM Trans. Internet Technol. 10, 1–31 (2010)

Cited By

View all
  • (2024)Honeyquest: Rapidly Measuring the Enticingness of Cyber Deception Techniques with Code-based QuestionnairesProceedings of the 27th International Symposium on Research in Attacks, Intrusions and Defenses10.1145/3678890.3678897(317-336)Online publication date: 30-Sep-2024
  • (2024)Knocking on Admin’s Door: Protecting Critical Web Applications with DeceptionDetection of Intrusions and Malware, and Vulnerability Assessment10.1007/978-3-031-64171-8_15(283-306)Online publication date: 17-Jul-2024

Index Terms

  1. An Approach to Generate Realistic HTTP Parameters for Application Layer Deception
      Index terms have been assigned to the content through auto-classification.

      Recommendations

      Comments

      Please enable JavaScript to view thecomments powered by Disqus.

      Information & Contributors

      Information

      Published In

      cover image Guide Proceedings
      Applied Cryptography and Network Security: 20th International Conference, ACNS 2022, Rome, Italy, June 20–23, 2022, Proceedings
      Jun 2022
      915 pages
      ISBN:978-3-031-09233-6
      DOI:10.1007/978-3-031-09234-3

      Publisher

      Springer-Verlag

      Berlin, Heidelberg

      Publication History

      Published: 20 June 2022

      Author Tags

      1. Web application security
      2. Deception
      3. Active defense

      Qualifiers

      • Article

      Contributors

      Other Metrics

      Bibliometrics & Citations

      Bibliometrics

      Article Metrics

      • Downloads (Last 12 months)0
      • Downloads (Last 6 weeks)0
      Reflects downloads up to 26 Nov 2024

      Other Metrics

      Citations

      Cited By

      View all
      • (2024)Honeyquest: Rapidly Measuring the Enticingness of Cyber Deception Techniques with Code-based QuestionnairesProceedings of the 27th International Symposium on Research in Attacks, Intrusions and Defenses10.1145/3678890.3678897(317-336)Online publication date: 30-Sep-2024
      • (2024)Knocking on Admin’s Door: Protecting Critical Web Applications with DeceptionDetection of Intrusions and Malware, and Vulnerability Assessment10.1007/978-3-031-64171-8_15(283-306)Online publication date: 17-Jul-2024

      View Options

      View options

      Login options

      Media

      Figures

      Other

      Tables

      Share

      Share

      Share this Publication link

      Share on social media