Domain environment ADCS deception trapping method based on attack and defense game

Abstract

The invention relates to a domain environment ADCS deception trapping method based on an attack and defense game, and belongs to the technical field of network security. Aiming at the problems that strategy fingerprints are easy to expose and attack chains are difficult to trace in Active Directory certificate service defense, the system decodes attacks by deploying simulation honey point clusters, adopts a Stackelberg-Markov game model as the core to perform intelligent decision making, dynamically simulates TameMyCerts strategy fingerprints to hide real defense features, and embeds hidden identifiers in cheating certificates by using a certificate staining tracking technology, so that the real defense features are hidden. And capturing and tracing from attack detection to certificate utilization full link are realized. And finally, the system is linked with the existing security equipment through a collaborative interface to form an active defense closed loop, so that the security protection capability of the Active Direct certificate service is improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method for defending against Active Directory certificate service spoofing. Background Technology

[0002] Active Directory Certificate Service is a core identity authentication infrastructure in Microsoft Windows systems. It can issue digital certificates to users, workstations, and servers in an enterprise network for critical scenarios such as identity verification, message signing, and data encryption. It is a core component for ensuring secure communication networks within an enterprise.

[0003] In existing technologies, the deployment and maintenance of Active Directory Certificate Services rely on administrators manually configuring certificate templates, permission assignments, and security policies. However, significant security vulnerabilities and technical flaws exist in practical applications: ① Frequent configuration defects: Active Directory Certificate Services exhibits obvious configuration defects, exemplified by the ESC series vulnerabilities (including ESC1-ESC8). These defects often stem from improper configuration of certificate template attributes. For example, the ESC1 vulnerability, by simultaneously enabling client authentication and allowing users to provide subject attributes, allows attackers to escalate domain administrator privileges through certificate forgery. The ESC4 vulnerability, by allowing private key export in the certificate template, poses a risk of key leakage for certificates obtained by ordinary users. ② Failure to protect against known vulnerabilities: Even with the deployment of official Microsoft patches for publicly known vulnerabilities, protection may still fail due to improper configuration or compatibility issues with the Key Distribution Center. Attackers can exploit these vulnerabilities to bypass Multi-Factor Authentication (MFA) restrictions, escalate privileges to the domain administrator level through Active Directory Certificate Services, and launch malicious attacks such as DCSync to steal domain controller credentials. More seriously, this vulnerability has alternative attack paths and can still be successfully exploited even in a fully patched environment. ③ Inefficient Operation and Detection: Existing Active Directory certificate service security relies on regular manual audits, which are insufficient to cover dynamically changing network environments. Furthermore, issues such as outdated Certificate Revocation Lists (CRLs) and chaotic permission allocation are frequent, leading to the continued circulation of invalid certificates and increased risks of unauthorized access. While some automated scanning tools can detect known vulnerabilities, they only provide fixed remediation solutions and cannot adapt to the customized deployment scenarios of different enterprises. They also lack the ability to predict and protect against unknown configuration defects. ④ Continuously Escalating Attack Threats: Attackers have increasingly abused AD CS services as a key avenue for privilege escalation. Compared to traditional credential theft methods, these attacks are more likely to bypass endpoint security tools and are frequently used in advanced persistent threats (APT) attacks such as ransomware, causing severe data and economic losses to enterprises.

[0004] Despite considerable research dedicated to Active Directory Certificate Service (ACTS) defense, existing solutions still have limitations in the face of increasingly complex network environments and new challenges brought about by technological advancements: ① Existing policy-enhanced defense solutions, such as TameMyCerts, use statically fixed configurations for rejection codes and restriction rules. Attackers can construct specific certificate requests carrying illegal IP formats and malicious SAN fields to test and identify defense response characteristics (i.e., defense fingerprints), and then design targeted bypass schemes, rendering the defense ineffective. ② Traditional Active Directory Certificate Service (ACTS) defense systems are essentially passive response modes, only able to generate alert logs for known attacks, unable to dynamically adjust defense strategies based on the attack situation; they also lack mechanisms to track the subsequent use of issued certificates, making it difficult to achieve closed-loop tracing of the entire attack chain from attack detection, vulnerability exploitation, certificate acquisition to privilege maintenance, and unable to accurately locate the attack source and the scope of its impact. ③ Traditional Active Directory certificate service defense solutions are mostly deployed in "island-style" configurations, without standardized collaborative interfaces. They cannot work in real time with existing security infrastructure such as Security Information and Event Management (SIEM) systems, Endpoint Detection and Response (EDR) tools, and firewalls, resulting in fragmented defense responses and making it difficult to form a comprehensive collaborative defense loop, thus reducing the overall security protection efficiency.

[0005] In summary, existing Active Directory certificate service technologies have significant shortcomings in terms of vulnerability protection integrity, configuration management adaptability, and threat response timeliness. There is an urgent need for a technical solution that can accurately identify various configuration defects and vulnerabilities, adapt to dynamic network environments, and has efficient protection capabilities to address the security risks faced by Active Directory certificate services. Summary of the Invention

[0006] This invention provides a domain environment ADCS deception and trapping method based on attack and defense game theory. The core technical solution is as follows: This system adopts a modular design, and the core includes four major functional modules and external security system collaborative interfaces. The modules achieve adaptive defense through bidirectional data interaction. The overall architecture is: game theory decision engine, TameMyCerts policy deception simulator, Active Directory certificate service lightweight honeypot cluster, feedback analysis center, and external security systems (SIEM, EDR, firewall).

[0007] A Stackelberg-Markov coupled game model is constructed, in which Stackelberg game is used to optimize the initial defense layout (such as honeypot deployment location and initial strategy fingerprint selection), and the defender, as the leader, determines the initial configuration with the goal of maximizing long-term defense benefits; Markov game is used for dynamic decision-making during the attack process to achieve real-time adaptation between attack status and defense actions.

[0008] Define a 28-dimensional attack state feature space, covering query behavior features (8 dimensions), strategy testing features (6 dimensions), authentication features (4 dimensions), sequence matching features (5 dimensions), and environmental features (5 dimensions), to accurately identify the attack chain stages (scanning and probing A0, attempting to exploit A1, obtaining certificates A2, exploiting certificates A3, maintaining control A4).

[0009] The design includes an action space with five core defense actions: monitoring / strategy simulation (D0), issuing fake certificates (D1), issuing colorized certificates (D2), precise blocking (D3), and dynamic fingerprint switching (D4). The optimal defense action is selected based on a quantitative benefit function, forming a dynamic decision-making loop of "state assessment - action execution - effect feedback - state update".

[0010] Build a policy fingerprint library to store the response characteristics of different versions of TameMyCerts, including key fields such as fingerprint ID, applicable scenarios, rejection code set, prompt information, and processing delay, covering mainstream defense configuration scenarios;

[0011] The design features a dynamic fingerprint switching engine that supports two modes: switching triggered by a game theory decision engine command and automatic switching at set times. This ensures a smooth and seamless switching process, preventing the exposure of true defense features.

[0012] Implement the logic for handling illegal requests and responses, parse the incoming certificate request parameters, match the currently effective policy fingerprint, construct a response packet containing the corresponding rejection code, prompt information and random delay, and record request details logs to provide data support for subsequent attack analysis;

[0013] A dedicated honeypot cluster for Active Directory certificate services is built using Docker containerization technology, supporting one-click deployment and elastic scaling. This reduces resource consumption while maintaining a high degree of simulation, and does not affect the actual operation of Active Directory certificate services.

[0014] It simulates Active Directory certificate service and protocol interaction, supports core protocols such as LDAP, RPC, and Web Enrollment, and has 10 built-in certificate templates (including 5 ESC vulnerability templates and 5 normal templates), simulating key processes such as CA service configuration query and certificate template enumeration;

[0015] To counter attacks in the A1-A2 phase, fake certificates with invalid extended key usage (EKU) and extremely short validity periods are issued to disrupt the attacker's attack process; for the A2 phase, colored certificates with embedded custom OD identifiers are issued to provide technical support for attack chain tracing.

[0016] Collect data such as basic request information, parameter configuration, response characteristics, and certificate usage scenarios in real time, and upload them to the feedback analysis center in JSON format;

[0017] The architecture of Elasticsearch, Logstash and Kibana is adopted to realize real-time storage, parsing and indexing of log data, and to classify and manage data according to dimensions such as attack source IP, attack stage and certificate identifier;

[0018] It has the ability to reconstruct the attack chain. By associating log data from different stages with the OD identifier of the colored certificate, it can achieve full-link tracing from attack detection to certificate exploitation and accurately locate the attack source IP and associated account.

[0019] The system features a standardized collaborative interface that supports integration with SIEM systems via Syslog protocol, EDR tools via RESTful API, and firewalls via CLI / API. Command priorities can be set according to threat levels to enable cross-system collaborative distribution of defense commands. Attached Figure Description

[0020] Figure 1 Certificate coloring tracking graph for a domain environment ADCS deception and trapping method based on attack and defense game theory provided by the present invention;

[0021] Figure 2 A system flowchart of an ADCS deception and trapping method for a domain environment based on attack and defense game theory provided by the present invention;

[0022] Figure 3 This invention provides a game-theoretic decision-making process diagram for an ADCS deception and trapping method in a domain environment based on attack and defense game theory. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Unless otherwise defined, the technical or scientific terms used herein should have the ordinary meaning understood by those skilled in the art. The terms "comprising" and similar expressions used herein mean that the element or object preceding the word covers the element or object listed after the word and its equivalents, but does not exclude other elements or objects.

[0024] refer to Figure 1 The present invention provides a certificate coloring tracking graph for an Active Directory certificate service spoofing defense method, comprising the following steps:

[0025] P1. The process of issuing colored certificates is triggered when a lightweight honeypot cluster of Active Directory Certificate Services deployed in the network captures a malicious certificate request initiated by an attacker through its emulated CA service. The game theory decision engine, based on real-time analysis of the attacker's behavior, issues a defensive action instruction to issue a colored certificate.

[0026] P2. The attacker obtains and uses the stained certificate without being aware of its special nature. From the attacker's perspective, it's a successful certificate application, and they have successfully obtained legitimate credentials for authentication from the CA server (actually a honeypot). Subsequently, the attacker will use the stained certificate to proceed with their attack chain.

[0027] P3. Log Capture: When a colored certificate is used on a target system such as a KDC or application server, its usage will inevitably leave a record in the system's security log. The feedback analysis center of this invention actively captures and extracts these critical logs through the following methods.

[0028] In some embodiments, step P1 includes certificate issuance, embedding a custom OD (Object Identifier), and information association into the database.

[0029] Specifically, certificate issuance: After receiving an instruction, the certificate issuance module of the honeypot cluster simulates the issuance process of a real CA, generating a standard-compliant fake certificate based on the certificate template requested by the attacker. For example, it uses parameters such as an abused domain user authentication template, subject information, and alternative subject name (SAN).

[0030] Specifically, embedding custom ODs (Object Identifiers): During certificate generation, the system embeds one or more pre-defined custom ODs into the Certificate Policies extension field of the certificate. This OD is a valid extension field in the certificate structure, but its semantics and purpose are defined internally by the defense system. It is unknown and transparent to standard certificate verification clients, including tools used by attackers, and therefore does not affect the normal use of the certificate in subsequent attack activities such as Kerberos authentication.

[0031] Specifically, the information is associated with the database: After issuance, the system immediately creates a record in the background security association database. This record strongly associates the colored certificate's serial number, the embedded custom OD, the attacker's source IP address at the time of issuance, the domain account name used in the request (e.g., DOMAIN\attacker), the issuance timestamp, and the attack session ID that triggered this issuance. At this point, a tagged decoy certificate is ready.

[0032] refer to Figure 2 This invention provides a system workflow diagram for an Active Directory certificate service spoofing defense method. This system, through modular collaboration, achieves a complete closed loop from proactive spoofing and intelligent decision-making to source tracing. Specifically, it includes the following modules:

[0033] The game theory decision engine is responsible for global intelligent decision-making. This engine comprises two core decision layers:

[0034] The initial strategy optimization (Stackelber game) layer acts as the leader during the deployment phase, optimizing the initial honeypot deployment strategy and fingerprint configuration by predicting attacker behavior.

[0035] The dynamic decision-making loop (Markov game) layer, during the runtime phase, is based on the real-time offensive and defensive situation and iteratively executes "state assessment - action selection - effect assessment - state update" to select the optimal defensive action from the preset action space;

[0036] The TameMyCerts strategy deception simulator is the core of the system's camouflage, responsible for dynamically hiding real defense features. This simulator has a built-in strategy fingerprint library that stores response characteristics such as rejection codes, response information, and latency for various versions of TameMyCerts static defense strategies. Its dynamic switching engine switches the fingerprint presented externally in real time based on instructions from the game theory decision engine or preset strategies, effectively countering attackers' strategy reconnaissance and making it difficult for them to obtain stable defense fingerprints.

[0037] The certificate issuance module is responsible for simulating CA services and implementing tracing. Its CA emulation component simulates real Active Directory certificate services such as LDAP, RPC, and Web Enrollment, receiving and processing certificate requests. The coloring tracing function, when a high-threat attack is identified, issues a colored certificate with a custom OD identifier, laying tracing markers for subsequent attack chain tracing.

[0038] The Threat Analysis Center is responsible for data aggregation and analysis. Its log parsing function collects and analyzes logs from multiple sources, including honeypot clusters, domain controllers, and application servers, in real time. The attack chain tracing function uses correlation analysis to reconstruct a complete attack story from scattered logs such as certificate applications and Kerberos authentication. The collaborative policy generation function automatically generates and issues precise containment commands based on the tracing results.

[0039] The external security system collaborates by defining standardized data and command interfaces, connecting with the SIEM system to push high-value attack events; linking with the EDR endpoint detection and response platform to perform deep scanning and isolation of compromised hosts; and collaborating with firewalls to quickly block identified attack source IPs.

[0040] refer to Figure 3 The present invention provides a game theory decision-making process diagram for an Active Directory certificate service spoofing defense method. Its core game theory decision engine is driven by a Stackelberg-Markov coupled game model, and its decision-making process is specifically divided into the following two major stages:

[0041] Initial Strategy Optimization (Stackelberg Game Phase). In this phase, the system, acting as the defender, plays the leader role in the game. Its goal is to globally optimize the initial configuration during the early deployment phase by predicting the possible behaviors of potential attackers (followers). This includes, but is not limited to: the network location deployment of honeypot clusters, the initial loading sequence of the TameMyCerts policy fingerprint database, and the simulation weights of different certificate templates. By solving the equilibrium solution of this Stackelberg game, the system can construct an initial position with optimal expected defensive benefits before an attack occurs, thereby maximizing the success rate of early trapping and deceiving attackers.

[0042] Entering the dynamic decision-making loop (Markov game phase). Once the system is deployed and begins capturing attack traffic, the engine enters a continuously running dynamic decision-making loop based on the Markov decision-making process. This loop consists of the following four core steps forming a closed loop:

[0043] Status Assessment: The decision engine receives real-time data streams from the threat analysis center, including feature vectors across 28 dimensions such as attacker query frequency, policy testing characteristics, and authentication behavior. The engine quantitatively assesses the current attack posture to determine the specific defense status of the system. For example, low-threat scans, highly suspicious exploitation attempts, or certificates already issued.

[0044] Action selection: Based on the current assessed state, the engine selects the optimal defense action from its preset defense action space, including D0 monitoring / strategy simulation, D1 issuing fake certificates, D2 issuing colored certificates, D3 precise blocking, and D4 dynamic fingerprint switching, and calculates the optimal defense action that maximizes long-term defense benefits, taking into account immediate rewards and future state value, based on the Markov game strategy.

[0045] Action Execution and Effect Evaluation: The engine sends the selected optimal action instruction, such as issuing a colored certificate, to the policy deception simulator or certificate issuance module for execution. Subsequently, the system collects data on the attacker's response to this action, such as whether the attacker obtained and used the certificate, and quantifies the effect of the action's execution using a preset reward function. For example, a positive reward is given for successfully luring the attacker into a tracking trap, while a negative reward is given for an ineffective action or for exposing the attacker's own capabilities.

[0046] State Update: Based on new observation data and effect evaluation results after the action is executed, the engine updates its understanding of the overall offensive and defensive situation, and the system state changes accordingly. The updated state will serve as the input for the next round of decision-making, driving the engine to begin a new round of state evaluation.

[0047] While embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations fall within the scope and spirit of the invention as set forth in the claims. Furthermore, the invention described herein may have other embodiments and can be implemented or carried out in various ways.

Claims

1. A domain environment ADCS deception and trapping method based on attack and defense game theory, characterized in that: The game theory decision engine module is used to generate optimal defense action instructions based on the Stackelberg-Markov coupled game model and the real-time attack situation; the TameMyCerts policy deception simulator module is connected to the game theory decision engine module and is used to dynamically switch and simulate different versions of TameMyCerts defense policy fingerprints; the Active Directory certificate service lightweight honeypot cluster module is connected to the game theory decision engine module and the policy deception simulator module and is used to simulate the Active Directory certificate core service and issue colored certificates containing custom object identifiers according to instructions. The feedback analysis center module communicates with the Active Directory certificate service lightweight honeypot cluster module to collect and parse log data, realize attack chain reconstruction and tracing, and collaborate with external security systems through standardized interfaces.

2. The system according to claim 1, characterized in that, The game theory decision engine module includes: a Stackelberg game optimization unit, used as a defense leader to optimize the initial honeypot deployment configuration and strategy fingerprint sequence during the system deployment phase; and a Markov dynamic decision unit, used during the system operation phase to cyclically execute a decision process including state evaluation, action selection, execution and effect evaluation, and state update, wherein the state evaluation is based on a multi-dimensional feature vector of attack behavior.

3. The system according to claim 2, characterized in that, The multi-dimensional feature vector includes query behavior features, strategy testing features, authentication features, sequence matching features, and environmental features, totaling 28 dimensions.

4. The system according to claim 1, characterized in that, The TameMyCerts strategy deception simulator module includes: a strategy fingerprint library for storing response features of different TameMyCerts versions, the response features including a set of rejection codes, prompt information, and processing delay; and a dynamic fingerprint switching engine for selecting and activating the currently used strategy fingerprint from the strategy fingerprint library according to the instructions or preset strategies of the game theory decision engine module.

5. The system according to claim 1, characterized in that, The Active Directory Certificate Service lightweight honeypot cluster module is built on Docker containerization technology, emulates LDAP, RPC and Web Enrollment protocols, and has built-in certificate templates containing ESC vulnerability features. In the colored certificate, the custom object identifier is embedded in the certificate policy extension field.

6. The system according to claim 1, characterized in that, The feedback analysis center module includes: a log parsing and association unit, used to extract certificate usage records from domain controller and server logs, and associate them with the issuing source information of the stained certificate through the certificate serial number; and a collaborative response unit, used to issue blocking or scanning instructions to the SIEM system, EDR platform and firewall through Syslog interface, RESTful API or CLI / API based on the source tracing results.

7. An adaptive spoofing defense method for Active Directory certificate service based on game theory and TameMyCerts strategy simulation, characterized in that, The system applied to any one of claims 1-6 includes the following steps: intercepting a certificate request initiated by an attacker through the Active Directory Certificate Service lightweight honeypot cluster module; the game theory decision engine module, based on feature analysis of the attack behavior, decides to enter the coloring tracing stage and issues an instruction to the Active Directory Certificate Service lightweight honeypot cluster module to issue a colored certificate; the Active Directory Certificate Service lightweight honeypot cluster module issues a colored certificate with an embedded custom object identifier to the attacker and records the issuance information; the feedback analysis center module captures logs generated by the attacker using the colored certificate, associates them with the issuing source through the custom object identifier, and completes attack chain tracing; the feedback analysis center module, based on the tracing results, collaborates with an external security system to handle the attack source.

8. The method according to claim 7, characterized in that, Before the step of entrapping the attacker's certificate request, the method further includes: calculating and determining the initial deployment strategy and fingerprint configuration of the honeypot through the Stackelberg game optimization unit in the game theory decision engine module; and dynamically adjusting the strategy response characteristics presented externally through the TameMyCerts strategy deception simulator module to hide the real defense fingerprint.

9. The method according to claim 7, characterized in that, The specific analysis based on the characteristics of the attack behavior is as follows: based on the attacker's certificate template enumeration behavior, frequency of illegal format testing, authentication failure mode, and matching degree with known attack chains within a preset time window, the threat level and attack stage are comprehensively evaluated.

10. The method according to claim 7, characterized in that, The collaborative external security system's handling of the attack source includes: sending instructions to the firewall to block the attack source IP, sending instructions to the EDR platform to perform deep scanning of the associated terminals, and pushing source tracing alarm events containing the complete attack chain to the SIEM system.

Images