Baiting Inside Attackers Using Decoy Documents

摘要: The insider threat remains one of the most vexing problems in computer security. A number approaches have been proposed to detect nefarious actions including user modeling and profiling techniques, policy access enforcement misuse detection. In this work we propose trap-based defense mechanisms a deployment platform for addressing problem insiders attempting exfiltrate use sensitive information. goal is confuse confound an adversary requiring more effort identify real information from bogus provide means detecting when attempt exploit has occurred. “Decoy Documents” are automatically generated stored on file system by D3 System with aim enticing malicious user. We introduce formalize properties decoys as guide design defenses increase likelihood attack. decoy documents contain several different types credentials that used, trigger alert. also embed “stealthy beacons” inside cause signal be emitted server indicating where particular was opened. evaluate honeypots penetrated attackers demonstrating feasibility method.