Hydrakon, a Framework for Measuring Indicators of Deception in Emulated Monitoring Systems

Kon Papazis and Naveen Chilamkurti ()
Additional contact information
Kon Papazis: Department of Computer Science and Information Technology, La Trobe University, Melbourne 3086, Australia
Naveen Chilamkurti: Department of Computer Science and Information Technology, La Trobe University, Melbourne 3086, Australia

Future Internet, 2024, vol. 16, issue 12, 1-20

Abstract: The current cybersecurity ecosystem is proving insufficient in today’s increasingly sophisticated cyber attacks. Malware authors and intruders have pursued innovative avenues to circumvent emulated monitoring systems (EMSs) such as honeypots, virtual machines, sandboxes and debuggers to continue with their malicious activities while remaining inconspicuous. Cybercriminals are improving their ability to detect EMS, by finding indicators of deception (IoDs) to expose their presence and avoid detection. It is proving a challenge for security analysts to deploy and manage EMS to evaluate their deceptive capability. In this paper, we introduce the Hydrakon framework, which is composed of an EMS controller and several Linux and Windows 10 clients. The EMS controller automates the deployment and management of the clients and EMS for the purpose of measuring EMS deceptive capabilities. Experiments were conducted by applying custom detection vectors to client real machines, virtual machines and sandboxes, where various artifacts were extracted and stored as csv files on the EMS controller. The experiment leverages the cosine similarity metric to compare and identify similar artifacts between a real system and a virtual machine or sandbox. Our results show that Hydrakon offers a valid approach to assess the deceptive capabilities of EMS without the need to target specific IoD within the target system, thereby fostering more robust and effective emulated monitoring systems.

Keywords: artifact; detection vector; evasive vector; emulated monitoring systems (EMSs); honeypot; indicators of deception (IoDs); operating system (OS); sandbox; security tool; virtual environment; virtual machine (VM) (search for similar items in EconPapers)
JEL-codes: O3 (search for similar items in EconPapers)
Date: 2024
References: View complete reference list from CitEc
Citations:

Downloads: (external link)
https://www.mdpi.com/1999-5903/16/12/455/pdf (application/pdf)
https://www.mdpi.com/1999-5903/16/12/455/ (text/html)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:gam:jftint:v:16:y:2024:i:12:p:455-:d:1536351

Access Statistics for this article

Future Internet is currently edited by Ms. Grace You

More articles in Future Internet from MDPI
Bibliographic data for series maintained by MDPI Indexing Manager ().