Fooling adversaries with traps such as honeytokens can slow down cyber attacks and create strong indicators of compromise. Unfortunately, cyber deception techniques are often poorly specified. Also, realistically measuring their effectiveness requires a well-exposed software system together with a production-ready implementation of these techniques. This makes rapid prototyping challenging. Our work translates 13 previously researched and 12 self-defined techniques into a high-level, machine-readable specification. Our open-source tool, Honeyquest, allows researchers to quickly evaluate the enticingness of deception techniques without implementing them. We test the enticingness of 25 cyber deception techniques and 19 true security risks in an experiment with 47 humans. We successfully replicate the goals of previous work with many consistent findings, but without a time-consuming implementation of these techniques on real computer systems. We provide valuable insights for the design of enticing deception and also show that the presence of cyber deception can significantly reduce the risk that adversaries will find a true security risk by about 22% on average.

Ensuring that information flowing through a network is secure from manipulation and eavesdropping by unauthorized parties is an important task for network administrators. Many cyber attacks rely on a lack of network-level information flow controls to successfully compromise a victim network. Once an adversary exploits an initial entry point, they can eavesdrop and move laterally within the network (e.g., scan and penetrate internal nodes) to further their malicious goals. In this article, we propose a novel multilevel security (MLS) framework to enforce a secure inter-node information flow policy within the network and therein vastly reduce the attack surface available to an adversary who has penetrated it. In contrast to prior work on multilevel security in computer networks which relied on enforcing the policy at network endpoints, we leverage the centralization of software-defined networks (SDNs) by moving the task to the controller and providing this service transparently to all network nodes. Our framework, MLSNet, formalizes the generation of a policy compliant network configuration (i.e., set of flow rules on the SDN switches) as network optimization problems, with the objectives of (1) maximizing the number of flows satisfying all security constraints and (2) minimizing the security cost of routing any remaining flows to guarantee availability. We demonstrate that MLSNet can securely and efficiently route flows that satisfy the security constraints and route the remaining flows with a minimal security cost (e.g., route >85% of flows, where the heuristic achieves 89% and 87% of the optimal solutions for the optimization problems).

When routing flows in a software defined network (SDN), service disruption and inconsistencies can occur during the updates of routing tables leading to degraded QoS or interruption of existing services. We study the problem of rerouting existing flows in an SDN to enable the admission of new flows while minimizing the disruption of existing flows, under link capacity and Quality of Service (QoS) constraints. We formulate the problem as an integer linear programming problem and propose two randomized rounding algorithms with bounded congestion and demand loss to solve this problem.

Software defined networking (SDN) provides a framework to dynamically adjust and re-program the data plane with the use of flow rules. The realization of highly adaptive SDNs with the ability to respond to changing demands or recover after a network failure in a short period of time, hinges on efficient updates of flow rules. We model the time to deploy a set of flow rules by the update time at the bottleneck switch, and formulate the problem of selecting paths to minimize the deployment time under feasibility constraints as a mixed integer linear program (MILP). To reduce the computation time of determining flow rules, we propose efficient heuristics designed to approximate the minimum-deployment-time solution by relaxing the MILP or selecting the paths sequentially. Through extensive simulations we show that our algorithms outperform current, shortest path-based solutions by reducing the total network configuration time up to 55% while having similar packet loss, in the considered scenarios. We also demonstrate that in a networked environment with a certain fraction of failed links, our algorithms are able to reduce the average time to reestablish disrupted flows by 40%.

Live virtual machine (VM) migration is commonly used for enabling dynamic resource or fault management, or for load balancing in datacenters or cloud platforms. A service hosted by a VM may also be migrated to prevent its visibility to an external adversary who may seek to disrupt its operation by launching a DDoS attack against it. We first show that current systems cannot adequately hide a VM migration from an external adversary. The key reason for this is that a migration typically manifests a traffic pattern with distinguishable statistical properties. We introduce two new attacks that can allow an adversary to effectively track a migration in progress, by leveraging observations of these properties. As our primary contribution, we design and implement a stealth migration framework that causes migration traffic to be indistinguishable from regular Internet traffic, with a negligible latency overhead of approximately 0.37 seconds, on average.

Advanced targeted cyber attacks often rely on reconnaissance missions to gather information about potential targets, their characteristics and location to identify vulnerabilities in a networked environment. Advanced network scanning techniques are often used for this purpose and are automatically executed by malware infected hosts. In this paper, we formally define network deception to defend reconnaissance and develop a reconnaissance deception system, which is based on software defined networking, to achieve deception by simulating virtual topologies. Our system thwarts network reconnaissance by delaying the scanning techniques of adversaries and invalidating their collected information, while limiting the performance impact on benign network traffic. By simulating the topological as well as physical characteristics of networks, we introduce a system which deceives malicious network discovery and reconnaissance techniques with virtual information, while limiting the information an attacker is able to harvest from the true underlying system. This approach shows a novel defense technique against adversarial reconnaissance missions which are required for targeted cyber attacks such as advanced persistent threats in highly connected environments. The defense steps of our system aim to invalidate an attackers information, delay the process of finding vulnerable hosts and identify the source of adversarial reconnaissance within a network.

In infrastructure-lacking environments, like military areas of operation, the intermittent availability of backhaul networks leads to greater reliance on peer to peer data exchange. In such settings, mobile nodes use Delay Tolerant Network (DTN) protocols for exchanging location specific data. High transmission delay, packet loss and intermittent connectivity increases the need for efficient data transmission in such scenarios. In this paper, we evaluate network coding for efficient data exchange between mobile wireless nodes under the presence of an intermittent backhaul network, like a satellite or cellular link. We analyze the upper bound of savings achievable with network coding for single-hop packet transmission, and introduce a network coding algorithm focused on reducing the required number of packet transmissions in such a setting. Evaluation of our proposed data exchange protocol shows how network coding can be applied to reduce transmission delay and minimize the dependency on an intermittent backhaul network in a communication scenario typical of a military environment.

Buildings account for 40% of US primary energy consumption and 72% of electricity. Of this total, 50% of the energy consumed in buildings is used for Heating Ventilation and Air-Conditioning (HVAC) systems. Current HVAC systems only condition based on static schedules; rooms are conditioned regardless of occupancy. By conditioning rooms only when necessary, greater efficiency can be achieved. This paper describes POEM, a complete closed-loop system for optimally controlling HVAC systems in buildings based on actual occupancy levels. POEM is comprised of multiple parts. A wireless network of cameras called OPTNet is developed that functions as an optical turnstile to measure area/zone occupancies. Another wireless sensor network of passive infrared (PIR) sensors called BONet functions alongside OPTNet. This sensed occupancy data from both systems are then fused with an occupancy prediction model using a particle filter in order to determine the most accurate current occupancy in each zone in the building. Finally, the information from occupancy prediction models and current occupancy is combined in order to find the optimal conditioning strategy required to reach target temperatures and minimize ventilation requirements. Based on live tests of the system, we estimate ~30.0% energy saving can be achieved while still maintaining thermal comfort.