Design and implementation of deception session management based on FPGA
Chaochao Liu, Ning Li · 2024
New network attacks represented by APT have stretched traditional defenses. Existing defense methods such as firewalls, intrusion detection, access control, data encryption, and malicious code detection rely on known characteristics, and the protection capabilities they provide are passive, lagging, and difficult to deal with high-level attacks. Cyber deception defense builds a network deception environment in the protected system to mislead the attacker about the system or assets, induce the attacker to stop actions or take actions that are beneficial to the defender, and ultimately achieve the goal of detecting, delaying and even counterattacking. The effect is to provide a new idea for breaking the asymmetric situation of network attack and defense. Network deception defense builds a network deception environment in the protected system to mislead the attacker about the system or assets, induce the attacker to stop actions or take actions that are beneficial to the defender, and ultimately achieve the goal of delaying, detecting and even counterattacking. The effect is to provide a new idea for breaking the asymmetric situation of network attack and defense. During the implementation of cyber deception defense, there is a many-to-one relationship between masquerading hosts and responding hosts. How to accurately restore the fingerprint information of the data packet returned by the responding host to the fingerprint information of the disguised host before modification, so that the attacker can't detect the entire deception process, is a difficult problem that must be solved. This article proposes a deception session management technology based on FPGA, which uses the Hash algorithm to handle session conflicts and achieve refined management of session query, creation, update, aging, etc. Experimental results show that this method can solve the problem of accurate restoration of data packets and have high session management performance, the processing time of the deception session management is approximately 372ns.