Runtime Cyber Deception via Shared-Library Patching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The deployment and orchestration of cyber deception techniques in software applications, particularly at the application layer, are hindered by the lack of integration with existing systems and the need for automation, especially in large organizations with distributed applications and limited access to source code.
Innovation Solution
A computer-implemented method for implementing cyber deception in a container orchestration system by installing a deception manager, configuring a storage medium, and modifying deployment manifests to load a shared library that includes hooks for deception methods, allowing dynamic integration with applications like Kubernetes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cyber deception techniques are integrated into application layer, then effectiveness of deception is improved, but deployment complexity increases
Solution Approach 1:
The patent introduces a deception manager as an intermediary component that mediates between the control plane and applications. The deception manager receives requests from the control plane, modifies deployment manifests to include deception elements (honeytokens, fake APIs), and coordinates with applications without requiring direct integration between the control plane and each application, thus improving effectiveness while managing deployment complexity
Solution Approach 2:
The deception manager serves multiple functions: it acts as a proxy for deception element deployment, modifies deployment manifests, manages honeytokens across multiple applications, and provides a unified interface for the control plane. This multi-functionality consolidates complexity into a single component rather than distributing it across the entire system
2Productivity
If automated deployment of deception elements is implemented, then productivity is improved, but device complexity increases
Solution Approach 1:
The system performs preliminary actions by pre-configuring deception elements (honeytokens, fake APIs) and embedding them in deployment manifests before applications are deployed. The deception manager is set up in advance to automatically intercept and modify deployment requests, eliminating the need for manual intervention during runtime deployment operations
Solution Approach 2:
The deception manager automatically modifies deployment manifests and deploys deception elements without requiring manual configuration for each application. The system self-services by intercepting deployment requests from the control plane, automatically adding deception components, and managing the entire lifecycle of deception elements across multiple applications through automated processes
3Adaptability or versatility
If deception elements are added to existing applications, then adaptability is improved, but ease of manufacture deteriorates
Solution Approach 1:
The patent extracts the complexity of deception element integration into a separate deception manager component, allowing existing applications to remain unchanged. The deception manager handles all modifications to deployment manifests and manages deception elements independently, so applications can be adapted to work with deception without requiring changes to their core code or deployment processes
Data Source
Figure 1~2
Figure 3~4B
Figure 5
AI summary
Tightly coupling cyber deception with software applications is promising in the lab but poses significant technical challenges in production systems. Because security measures are usually the responsibility of a system operator, access is typically limited to built software artifacts rather than their source code. This limitation makes it particularly challenging to deploy cyber deception techniques at application runtime and without full control over the software development lifecycle.