PhantomFS-v2: Dare you to avoid this trap

Jione Choi, Hwiwon Lee, Younggi Park, Huy Kang Kim, Junghee Lee, Youngjae Kim, Gyuho Lee, Shin Woo Shim, Taekyu Kim

Research output: Contribution to journalArticlepeer-review

Abstract

It has been demonstrated that deception technologies are effective in detecting advanced persistent threats and zero-day attacks which cannot be detected by traditional signature-based intrusion detection techniques. Especially, a file-based deception technology is promising because it is very difficult (if not impossible) to commit an attack without reading and modifying any file. It can play as an additional security barrier because malicious file access can be detected even if an adversary succeeds in gaining access to a host. However, PhantomFS still has a problem that is common to deception technologies. Once a deception technology is known to adversaries, it is unlikely to succeed in alluring adversaries. In this paper, we classify adversaries who are aware of PhantomFS according to their knowledge level and permission of PhantomFS. Then we analyze the attack surface and develop a defense strategy to limit the attack vectors. We extend PhantomFS to realize the strategy. Specifically, we introduce multiple hidden interfaces and detection of file execution. We evaluate the security and performance overhead of the proposed technique. We demonstrate that the extended PhantomFS is secure against intelligent adversaries by penetration testing. The extended PhantomFS offers higher detection accuracy with lower false alarm rate compared to existing techniques. It is also demonstrated that the overhead is negligible in terms of response time and CPU time.

Original languageEnglish
Pages (from-to)198285-198300
Number of pages16
JournalIEEE Access
Volume8
DOIs
Publication statusPublished - 2020

Keywords

  • Deception technology
  • File system
  • Honeypot

ASJC Scopus subject areas

  • Computer Science(all)
  • Materials Science(all)
  • Engineering(all)

Fingerprint Dive into the research topics of 'PhantomFS-v2: Dare you to avoid this trap'. Together they form a unique fingerprint.

Cite this