Deception Technology: architecture and classification
Артем Вікторович Жилін, Olha Shevchuk · Collection Information technology and security · 2021
Due to the rapid growth and modification of hacker attacks, it is important to study security measures that would allow analyzing the behavior of an attacker on the network. Known methods of defense have their drawbacks and in most cases do not allow analyzing the actions of the attacker during the deployment of the attack. To solve these problems, new protection technologies are beginning to emerge, known as Deception Technology, which can reduce the load on the system (the number of security events) and help investigate the actions of an attacker in real time. The article discusses Deception Technology as a technology that not only eliminates the main drawback of standard security tools, namely the large number of generated security events that need to be processed, stored and responded to, but also allows you to investigate and analyze the actions of attackers. For the accurate and correct use of this technology, the question arises of studying its development and classifying solutions. Therefore, the main task that was being solved was the classification of Deception Technology. Along with overcoming the shortcomings of standard means of protection, the task of proving the effectiveness of the technology arises. The implementation of Deception Technology is carried out on the example of the T-Pot solution, the components of which are a fairly large number of honeypots that emulate network services. As a result of the work, a classification of Deception Technology and a description of its architecture are proposed. As an example, the implementation of the analyzed protection class is shown in order to prove the effectiveness of its work in real time and it is determined that due to the small amount of information collected it is easy to compare and identify the security area of the system. When viewing statistics on the use of logins and passwords, the most frequently used ones were identified, namely, the numeric passwords “1234” and “123456”, which in recent years have been the most used by cybercriminals in hacking systems.