Flytrap: A Proposed Network-Based Strategy for Dynamically Managing Security

System Elements Intrusion DetectionNetwork routing “Real” Systems“Faux” Systems Attack Database Artificial Opponent Faux Data Watermarking Faux data Real data

Detection Strategies No detection Rule-based detection –Simple firewall (stateless) –Stateful detection Intelligent detection –Anomaly detection –Attack classification

Observation Monitor integrity of all systems Isolate attacks to appropriate systems –Redirect attacks away from real systems –Generate attack logs usable by IDS and artificial opponents –Use an artificial opponent to collect more data –Conduct observation on system containing no “real” data

(Mis)information Use dynamically generated data to misinform attacker –Create a “believable” yet harmless base –Use a watermarking algorithm to produce variations on base Store watermark as evidence of attack –Data may be stored on attacker’s system –Data may be used in extortion schemes