MAAT: Multi-Stage Attack Attribution in Enterprise Systems using Software Defined Networks
DOI:
https://doi.org/10.4108/eai.7-12-2017.153396Keywords:
multi-stage attacks, attack attribution, software defined network, moving target defenseAbstract
Multi-layer distributed systems, such as those found in corporate systems, are often the target of multi- stage attacks. Such attacks utilize multiple victim machines, in a series, to compromise a target asset deep inside the corporate network. Under such attacks, it is difficult to identify the upstream attacker’s identity from a downstream victim machine because of the mixing of multiple network flows. This is known as the attribution problem in security domains. We present MAAT, a system that solves such attribution problems for multi-stage attacks. It does this by using moving target defense, ie, shuffling the assignment of clients to server replicas, which is achieved through software defined networking. As alerts are generated, MAAT maintains state about the level of risk for each network flow and progressively isolates the malicious flows. Using a simulation, we show that MAAT can identify single and multiple attackers in a variety of systems with different numbers of servers, layers, and clients.
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2022 EAI Endorsed Transactions on Security and Safety
This work is licensed under a Creative Commons Attribution 3.0 Unported License.
This is an open-access article distributed under the terms of the Creative Commons Attribution CC BY 3.0 license, which permits unlimited use, distribution, and reproduction in any medium so long as the original work is properly cited.