Composite Hybrid Techniques For Defending Against Targeted Attacks

摘要: We investigate the use of hybrid techniques as a defensive mechanism against targeted attacks and introduce Shadow Honeypots, novel architecture that combines best features honeypots anomaly detection. At high level, we variety detectors to monitor all traffic protected network/service. Traffic is considered anomalous processed by ”shadow honeypot” determine accuracy prediction. The shadow an instance software shares internal state with regular (”production”) application, instrumented detect potential attacks. Attacks are caught, any incurred changes discarded. Legitimate was misclassified will be validated handled correctly system transparently end user. outcome processing request used filter future attack instances could update detector.