Endpoint Deflection Service for Reconnaissance Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems fail to effectively detect and prevent lateral movement by attackers within networks, as they often lack information about the network structure and rely on multiple attempts to find valuable targets, making it difficult to identify and deflect reconnaissance attempts.
Innovation Solution
Implementing a deflection service on endpoints that routes suspicious connection attempts to a BotSink decoy server, utilizing a combination of kernel and user space components to intercept and deflect TCP handshake packets, and employing a flow cache and whitelist to identify and manage suspicious connections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional detection systems are used to monitor lateral movement, then they can detect some attacks, but they generate many false positives and fail to effectively identify reconnaissance attempts due to lack of network information
Solution Approach 1:
The system performs preliminary actions by deploying a BotSink decoy server before actual attacks occur, and by pre-populating a flow cache with legitimate network traffic patterns. This allows the system to establish a baseline of normal behavior in advance, enabling more accurate detection of reconnaissance attempts without generating false positives from legitimate traffic
Solution Approach 2:
The BotSink decoy server acts as an intermediary that attracts and engages attackers away from production systems. The flow cache serves as another intermediary layer that mediates between detection rules and actual traffic analysis, filtering out legitimate traffic patterns before they can trigger false alarms
2Productivity
If attackers perform multiple reconnaissance attempts to find valuable targets, then they can eventually locate targets of interest, but this creates numerous connection attempts that are difficult to distinguish from legitimate traffic
Solution Approach 1:
The system converts the harmful reconnaissance attempts into a beneficial diagnostic tool. By analyzing the patterns of connection attempts to the BotSink decoy, the system gains valuable intelligence about attacker behavior, techniques, and targets. The flow cache similarly converts potentially alarming traffic patterns into beneficial baseline data that improves detection accuracy over time
Solution Approach 2:
The system extracts reconnaissance attempts from the general traffic stream by directing them to the BotSink decoy server. This separation allows for focused analysis of suspicious traffic patterns without being overwhelmed by legitimate traffic, making it easier to detect and respond to attacks
3Reliability
If a deflection service is implemented to route suspicious connections to BotSink, then reconnaissance attempts can be effectively detected, but the system complexity increases with kernel and user space components
Solution Approach 1:
The deflection service is segmented into distinct kernel space and user space components, each with specific responsibilities. The kernel module handles low-level packet interception and routing decisions, while the user space BotSink handles higher-level analysis and response. This segmentation allows for easier maintenance, debugging, and updates of individual components without affecting the entire system
Data Source
AI summary
An endpoint executes a deflection service that detects failed connection attempts (TCP RST packets) and evaluates whether they are likely the result of a reconnaissance attack. If an inbound connection fails, a connection request packet (TCP SYN) is sent to a decoy server that includes data from the TCP RST packet. The decoy server then completes a connection handshake with a destination of the TCP RST packet and engages a process at the destination. If an outbound connection fails, the deflection service facilitates a connection between a process executing on the endpoint and the decoy server and associated with a destination port referenced by the TCP RST packet.