2RelatedWorkTheuseofdeceptivetechniquessuchasdisinformativepropagandatothwartonesenemieshasplayedapartinmilitarycon ictsinceantiquityNoonehassummarizedtheimportanceofdisinformationinthecontextofco ID: 335485
Download Pdf The PPT/PDF document "Defending computer system with decoys" is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
ofcomputers.1IntroductionOrganizationsacrosstheglobearebecomingincreasinglyawareoftheimportanceofsecuringtheircomputersystems.Asaconsequence,worldwidesalesofsecuritysoftwareroseby7.5%in2011[5].Governmentagenciesareparticularlyconsciousoftheneedtodefendtheircomputinginfrastructure.ThisisexempliedbythefactthattheUnitedStatesgovernmentincreasedfundingforcybersecurityresearchby35%from2011to2012[15].Attentivenesstosecuritypracticeshasalsorisenattheindividuallevel,as90%ofAmericanadultsnowbelievethatasafeInternetiscriticaltotheU.S.economy[16].Yetinspiteoftheheightenedscrutinythatsecuritypracticeshavebeenunder,computercrimescontinueto ourish.ArecentstudybythePonemonInstitutefoundthatthenumberofcyberattackshasmorethandoubledsince2010[14].Sincetheseattacksarealsobecomingmorecomplexanddiculttoanticipate,anaveragecompanycancurrentlyexpecttobethevictimof1.8successfulo ensivee ortspermonth[14].Thevastmajorityofexistingcomputersecuritymeasuresfocusoncontrollingaccesstokeepmaliciousactorsout.Otherapproachesattempttoeliminatesystemvulnerabilitiesoratleastpreventtheirexploitation.Theaforementionedtrendsinsecuritystatisticsleavelittledoubtthatthesetechniquesarenotcapableofsucientlysecuringtoday'scomputernetworks.Overtimesuchsecuritysolutionswillinvariablyfail,allowingadversariestoillicitlyaccesssystemcredentials,data,andnancialresources.Furthermore,traditionalsecuritytechniqueso ernodefenseagainst\insiders"whoinitiallyholdlegitimatecredentialsbutlaterchoosetogorogue.Thispaperproposestheuseofdecoysasanewparadigmforaddressingcomputersecurityissuesthatexistingdefensesarenotcapableofdetecting.Decoysareconstructswhichcontaindatathatappearsvaluablebutisinfactspurious.Sinceauthenticuserswillhaveanatural2 2RelatedWorkTheuseofdeceptivetechniques,suchasdisinformativepropaganda,tothwartone'senemieshasplayedapartinmilitarycon ictsinceantiquity.NoonehassummarizedtheimportanceofdisinformationinthecontextofcombatmoreconciselythanSunTzu,whowrotethat\allwarfareisbasedondeception"intheArtofWar[17].AwellknownexampleofdeceptioninamilitarycontextisOperationBodyguard,whichwasanAlliedplanusedduringWorldWarIItodistractGermanforcesfromtheinvasionofNormandy[8].Althoughdeceptionisanancientconcept,ithasonlyrecentlybeenappliedtotheprocessofsecuringcomputersystems.Cli Stollwastherstpersonknowntoutilizemisdirectioninordertosecureanetworkofcomputers.StollestablishedaspurioussetofcomputingresourcesinordertocatchhackerswhowereattemptingtoexltrateinformationfromLawrenceBerkeleyNationalLaboratory[6].Computerswhoseprimaryfunctionistoattracttheattentionofmaliciousactorsareoftencalled\honeypots."Entirenetworksofsuchspuriousmachinesareknownas\honeynets."Thesesystemsareusuallyconstructedinawaysuchthattheyappearasthoughtheyareanunassumingcomponentofalargernetworkarchitecture.Inreality,however,theyfailtocontainanyusefuldataandarecordonedo fromnetworkresourceswhichareactuallyvalued.Honeypotsandhoneynetscanbequitee ectivewhenusedtodetectexternalthreats.Theirapplicabilitytowardsdefendingagainstattacksoriginatingfromwithinanorganizationislimited,though.Thisisduetothefactthatthisclassofadversariestypicallyalreadyhavetheknowledgethatisrequiredtoaccesstheportionofanetworkwherelegitimatedataresides.Furthermore,honeypotso ernoutilityafterasuccessfulattackhasalreadyoccurred.Spitznerextendedtheconceptofhoneypotstothedomainofinsiderthreatdetectionbyinventingtheconceptof\honeytokens"[12].Honeytokensaredeceptivesecurityconstructsthatworkatamuchnergranularitythanhoneypotsorhoneynetworks.Theyareindividual4 bankcredentialsismorelikelytocapturetheirmaliciousactivitythanonewhosecontentconcernsmedicalinformation.Similarly,certaingenresofdecoysmaybemoreapplicabletospeciccorporateenvironments.WehaveincludedadetaileddiscussionofdecoyusagescenariosinSection4.Inordertodesigndecoysthatarease ectiveaspossible,itisalsobenecialtoanalyzetheminamoregeneralsensebyconsideringcharacteristicsthatareindependentofapar-ticularcontext.AsinitiallyexploredbyBowenet.alin[1],severalabstractpropertiesexistthatdenehowadecoyshouldoperateunderidealcircumstances.Someoftheseattributesconcerntherelationshipbetweenadversariesanddecoydata,whileotherspertaintotheinteractionsbetweenlegitimateusersanddeceptivematerial.A\perfectlybelievabledecoy"wouldpreciselyconformtoalloftheseguidelines,thoughpracticalrestrictionspreventthisfromoccurringinmostsituations.Althoughthereexistssomeoverlapbetweenthesetraits,itisalsoworthnotingthattheyarenotcompletelyorthogonal.Forexample,believabilityanddi erentiabilityareincontentiontosomeextent.3.1BelievabilityOneofadecoy'sprimaryfunctionsistobebelievable.Uponinspection,adecoyshouldappearauthenticandtrustworthy.Intheabsenceofanyadditionalinformation,itshouldbeimpossibletodiscernaspuriousdecoyfromauthenticdata.Forexample,adecoytaxdocumentshouldcontainallofthesameeldsasonethatisactuallyinuse,andeachofitseldsshouldbepopulatedwithrealisticvalues.Believabilitycanbeformalizedviathefollowingthoughtexperiment.Considerapoolofles,someofwhichcontainrealdataandsomeofwhicharefabricateddecoys.Selectadecoyleandrealpieceofdatafromthispool,andpresentittoanadversary.Theselecteddecoycanbeconsideredperfectlybelievableifthisattackerhasanequalprobabilityofselectingthedecoyandthelegitimatedocument.Thischaracteristicisofcriticalimportancetoexternallyobservablefeaturesofdecoys.6 locationssuchasauser'sdesktop.Italsodemonstratesthatitishelpfultoplacedocumentsinhightraclesystemlocations,includingworkingfolderswherelesthatareaccessedonaday-to-daybasisarestored.Filesystemsearchesarealsouseractionsthatmayresultinthepresenceofdecoys.Conspicuousdecoysshouldthereforebeeasilylocatedbysearchqueries.Thisrelatesconspicuousnessbacktoenticingness,however,asthesearchtermsthatanadversaryemployeeswillbeheavilydependentontheirunderlyingmotivation.3.4DetectabilityTheaforementioneddecoypropertiesallconcerntherelationshipbetweendecoydocumentsandapotentialattacker.Detectability,ontheotherhand,describestheabilityofdecoystonotifytheirownerwhentheyhavebeenaccessed.Anidealdecoysystemwouldissueanalerteachandeverytimeadecoyisaccessed,buttechnicalchallenges,includingnetworkavailabilityandvariabilitybetweensoftwareplatforms,meanthatthismaynotalwaysbepossibleinpractice.Deployingmultipleoverlappingdecoymonitorsthatoperateatdi erentsystemlevelscanhelpmitigatethepossibilityofanattackeraccessingadecoywhileremainingunde-tected.Featuresofthedecoydocumentsthemselvescanbeleveragedtoequipthemwithembeddedalertcode.Monitoringsoftwarecanbeplacedintheoperatingsystemtodetectpredeterminedtokensplacedwithindecoyswhentheyareopened.Further,operatingsys-temauditingcanbeenabledtorecorddecoyinteractions.Inordertocheckfordocumentexltration,softwarecanbeplacedonnetworkequipmenttocheckforsuchtokensaswell.Finally,thecontentofdecoydocumentscanalsoserveasanalertsystem.Forexample,credentialsforspuriousaccountscanbeplacedwithinadecoy.Sincethereisnoreasonthatalegitimateuserwouldeveraccesstheseaccounts,anyactivitytheyexhibitwouldsendastrongsignalofmaliciousintent.Itisparticularlycriticalthatdecoyaccesseventsaredetectablewhileanattackistakingplace.Continuingtomonitorthisinformationallowsforcondentiallyviolationstobe8 3.6StealthWhileitisclearlydesirablethateverydecoyaccesseventbeperceptibletotheownersofasystem,caremustbetakenlestthealarmsthataccomplishthisarousesuspicion.Anovertmechanismforissuingalertbeaconswouldprovideadversarieswithanobvioussignalthatanelementcontainsatrap,whichcompletelyviolatesthepropertyofdecoyvariability.Themessagesthataretransmittedbydecoysmustthereforebeassubtleandcovertaspossible.Raisinganalertthatdecoycontenthasbeenaccessednecessarilyinvolvestakingsomeaction,however.Evenifprecautionsaretaken,thereisalwaysthepossibilitythatthisactwillbeperceptibletoamaliciousactor.Itisthereforealsodesirabletotriggerbeaconeventsasearlyaspossibletopreventtheirinterception.Forexample,alertsforlebaseddecoysshouldberaisedassoonastheyareaccessedandpriortoanycontentbeingdisplayed,iffeasible.Thiswouldeliminatethepossibilityofadecoybeingrecognizedanddiscardedbeforethedecoysystemhasanopportunitytodetectthatishasbeenaccessed.3.7Non-interferenceThispropertyisthersttodescribehowdecoysshouldcoexistwithlegitimateuserswhoarenotmasqueradingwithassumedcredentials.Anoptimalmasqueraderdetectionnetworkwouldnota ectthehabitsoftypicalusersinanyway.Byinsertingdecoymaterialintoanoperatingenvironment,however,weintroducethepossibilitythatthisdatawillconfuseusersorotherwisehindertheirabilitytocompletetheireverydaytasks.Itisthereforedesirablefordecoystodemonstratethepropertyofnon-interferencebynotobstructingthebehaviorofnormalusers.Ifalesystemispopulatedwithdecoydocumentsthatserveasintrusionsensors,forexample,theprobabilitythatthelesystem'sprimaryownerisabletoaccessaparticularstandarddocumentshouldremainthesameasitwaspriortotheintroductionofthedecoycontent.Similarly,introducingdecoyapplicationstoamobiledevice'soperatingsystemshouldnotimpactauser'sabilitytoaccessrealapplicationsastheynormallywould.10 anoptimalleveloffunctionalityandafterwhichtheirecacybeginstodiminish.Itisthusdesirablefordecoydeploymentsystemstoincludeamechanismbywhichdecoyscanbeupdated,potentiallyextendingtheirshelflifeindenitely.4DecoyUsageScenariosThissectionintroducesseveralbroadsituationsinwhichsecuritycanbebolsteredbyde-ployingadecoydefensenetwork.Italsoattemptstodiscusssomeofthechallengesthatmustbemetinorderfordecoystobeusede ectivelyineachenvironment.4.1HostDecoysThemostcommonusagescenariofordecoysistoplacethemonaterminalthatiswithinalocalcomputernetwork.Thisistheoperatingenvironmentforwhichdecoydocumentswereoriginallydesigned,andassuchtheyrequirelittlemodicationtobeutilizedinthismanner.Therearestillsomedeploymentquestionsthatmustbeconsidered,however.Forexample,systemadministratorsmustdeterminewhethertheywillpushdecoydocumentsouttoclientsystemsorrequireuserstopulldecoysfromadistributionsourcethemselves.Theformerplaceslessofaburdenonindividualusers,butmaytemporarilyleadtoanincreaseinfalsepositivesasusersbecomeacquaintedwiththenewdecoysthathavebeenplacedintheirworkspace.Experimentsfrom[13]showhowdecoyaccessisa ectedbyadocument'slesystemlocationandthenumberofdeployeddecoys.4.2NetworkandBehavioralDecoysInane orttodetectsilentattackersastheyeavesdropontransmissionsbetweencomputersystems,wehavealsodevelopeddecoysthatoperateonanetworklevel.Ratherthanhostbaseddatales,thesedecoysconsistofbogusdata owsthatareinjectedintoanetwork.Thistracmustappearlegitimateintermsofprotocolspecicationsbutalsocontainsbait12 sensitivecorporateororganizationaldata.Furthermore,gainingaccesstoanorganization'sinfrastructureonthecloudisachievedthroughprovidingausernameandpassword.Suchalightweightauthenticationmechanismpresentsanincreaseintheproblemofmasqueraderinsiderthreats.Accordingto[18],observingdeviationsfromtypicaluserbehaviorcanbeusedintandemwithdecoydocumentsinacloudenvironment.Ifabnormaldataaccessisnoticed,thecloudcanreturndecoyinformationthatlookslegitimatetotheattackerwhotriggeredtheunusualusagepattern.Intheeventofafalsepositive,anauthorizeduserwouldbeabletorecognizeanyfalseinformationreturnedbythecloudandthencorrectlyrespondtoaseriesofauthenticationchallengestoprovehisorherlegitimacy.Thecloudwouldpreventanyunauthorizeddisclosureofinformationbycontinuouslyreturningfalsedatatoadversaries.Alsousefulinadistributedenvironmentsuchasthecloudistheconceptofcomputationaldecoys.Oftenasinglecomponentofacloudwillberesponsibleforacertaintask.Ifthiscomponentiscompromised,thedistributedsystemallowsmigrationoftheuncorruptedcomponentselsewhere.Thecompromisedcomponentscanthenactuallyusecomputationaldeceptiontoreturnfalsedata,thusdivertinganattacker'sattention[11].4.4SoftwareDecoysCompaniesareconstantlyfacedwiththechallengeofpreventingemployeesfromstealingproprietarysoftware.InMayof2012,forexample,acomputerprogrammerwasfoundguiltyofillegallycopyingsoftwarefromtheFederalReserveBankofNewYork[2].Softwareisperhapsthemostvaluableassetforanorganizationandisconsequentlyahighlyprotabletargetforinsiders.Toguardagainsttheunauthorizedexltrationofproprietarysoftware,wehavedevisedsoftwaredecoysthatlooklikelegitimatesourcecodebuthavebeaconsthattriggerwhenthecodeiscompiledorexecuted[19].InadditiontothepropertiesofdecoysdescribedinSection3,softwaredecoysshouldadheretoseveraladditionalrequirements.Thecodemustbecompilableandexecutablein14 Aseconduseofdecoysinamobilesetting,whichissimilartotheirusageinacloudenvironment,isforremoteaccesstosensitivedocuments.Peopleareincreasinglyusingmo-bilephonestoaccessprivateinformation.Wearecurrentlyworkingonamobileapplicationthatinterfaceswithauser'sdocumentsremotelyanddetectsunauthorizedaccess.Whenuploadingdocumentstotheremoteserver,ausercreatesaauthenticationgesturethatislaterusedtoretrieveadocument'scontent.Ifauserprovidesanincorrectgesturewhenattemptingtoaccessadocument,illegitimatedataisreturned.5DecoyGenerationHavingestablishedwhatqualitiesdecoysshouldpossessandwheretheyareintendedtobeused,wenowturnourattentiontohowtheyshouldbecreated.Userscouldcertainlycraftdecoymaterialbyhand.Forinstance,uponcompletinganinvoice,ausercouldcreateasecondaryfakeinvoicethatmirrorstheformattingortheauthenticversionbutcontainsbogusinformation.Suchdecoyswouldbehighqualityintermsoftheirbelievabilitybecausetheywouldcloselymirrorrealdata.Theywouldalsobeverydi erentiable;sinceuserswouldhavecreatedthedocumentsthemselves,theywouldeasilybeabletorecognizetheirphonycontent.Theprocessofmanuallyintroducingdecoycontenttoasystemisverytedious,however,sinceeachtimenewinformationissavedonthesystemanequalamountofspuriousmaterialwouldneedtobecreatedaswell.Userswouldalsoberesponsibleforcheckingaccesseventsfortheseles.Needlesstosay,manualdecoycreationwouldscaleverypoorlytoalargeorganizationwithmanycomputersandusers.Making,managing,andmonitoringdecoysisthusanontrivialproblem.Asanalternativetoperformingthesestepsmanually,wesuggestusingasystemthatdoessowithminimaluserinvolvement.ThisispreciselythepurposeoftheDecoyDocumentDistributor(D3)System[1].D3isatoolforgeneratingandmonitoringdecoyswhichcanbeaccessedby16 throughoutthecomputersonhisorhernetworkinordertodefendthemfrominsiderthreats.Tomanuallyplacedecoysinalesystem,thesystemadministratorwouldrsthavetocollectfeedbackfromusersregardingwhichlocationsintheirlesystemtheywouldliketoplacedecoys.Afteraggregatingthisdata,heorshewouldthenhavetorequestabatchofdecoysandthengothroughthepainstakingprocessofcopyingthemtotheirdestinationdirectoriesonebyone.Suchaprocessdoesnotscalewelltoanenvironmentwithalargenumberofcomputersandusers.Incontrast,theDDTrequiresneitherknowledgeregardinglesystemspecicsnorindividualleplacement.Itreducesthetaskofdecoydocumentmanagementtothesimplestepsofspecifyinghowmanydecoysaredesiredandinwhichportionofalesystemtoplacethem.Ourdistributionapplicationisthereforecapableofreducingthetimerequiredtoestablishasystemofinsiderthreatsensorsbyatleastanorderofmagnitudewhileretainingallofthesecuritybenetsofmanualdecoyusage.TheDDThastwomainobjectives.Therstistoautomaticallydeterminelocationsinacomputer'slesystemthataremostlikelytobeaccessedbyamaliciousinsider.Thesecondistoplacedecoydocumentsintheseselectedlocations,eitherdirectlyalongwithexistingdocumentsorinaseparatefolder.TheDDTallowsausertoselectasourcedirectoryofdecoydocumentsthatshouldbedistributedonthetargetmachine.TheusercanchooseanexistingfoldercontainingdecoysorcreateanewsetbyaccessingtheFOGwebsite[7]throughtheDDTandspecifyinganumberofdecoystobegenerated.Thisapproachenables exibilityinthetypesofdocumentsthataredeployedasdecoys.Oncetheuserchoosesasourcedirectoryofdecoydocuments,heorshethenspeciesadestinationdirectory.Thisdestinationdirectoryisusedasarootfromwhichtargetlocationsareselected.Enablingtheusertospecifytherootfromwhichtargetdirectoriesareidentiedallowsmorefreedomindecoyplacement.Forexample,ifaparticularownerofamachineonlyusesdirectorieswithin\C:nSal,"heorshemaywanttoconsiderplacingdecoyssolelyindirectoriesbranchingfromthisroot.18 inwithcurrentlyexistingdocuments,orinseparatefoldersthatcontaindecoysonly.6.3NamingofDecoyDocumentsandFoldersAswithlocation,thenamesofdocumentsdirectlyin uencehowenticingtheylooktoad-versaries.Foldernamescanalsoimpactauser'sdecisiontoaccessalocationinthelesystem.Whencreatingnewdirectoriesinwhichdecoyswillbeplaced,theDDTcreatesfourenticingly-namednewfoldersinthespecieddestinationdirectoryandevenlydispersesthedecoysoverthesefolders.Inane orttoincreasethevariabilityofdecoys,theDDTusesthreemethodsfornamingdecoydocumentswhenattemptingtoblendthemwithexistingdocumentsinafolder,ran-domlyselectingamongtheseapproaches.Theprimeobjectiveofthenamingschemeistocreatelenamesthatblendinwithexistinglegitimatedocumentssothattheydonotlookovertlysuspicious.Atthesametime,thedecoynamesshouldluremalevolentusersintoopeningthedocuments.Therstnamingmethodselectsanexistingleinthetargetdirectoryandappendseither\-nal"or\-updated"totheendofthelename.Thelogicbehindthisschemeisthatthemostrecentlymodiedversionsoflesmayseemmoreocialthanolderversions.Notethatifeitheroftheterms\nal"or\updated"arealreadyusedinthelename,theDDTselectsanothernamingmethodforthisdecoy.ThesecondnamingmethodemployedbytheDDTappendsadatestringtotheendofarandomlyselectedexistinglenameinthetargetdirectory.Appendingadatestringmakesadocumentappearasifithasbeenmarkedasamoreauthentic,ocialversion.TheDDTusestheformatmmddyyforthedatestrings.Forexample,adecoydocumentmaybenamedcompany employees-010412.pdfandplacedinthetargetfolderalongsidealegitimatedocumentnamedcompany employees.pdf.Blendinglenamesbyuseofdelimitersisthenalnamingapproach.TheDDTcalcu-latesthedelimiterusedmostofteninthetargetdirectoryandmodiesadecoy'slename20 date.Ifanadversarydecidedtosortafolder'scontentsbydate,thedecoydocumentswouldthenappearatthetopofthesortedlist,makingthemconspicuousandlikelytobemoreattractivetargets.Anamingconventionthatappendsadatestringtothedecoy'slenameshouldintuitivelysetthele'screationdatetothatusedintheselecteddatestring.TheDDTrstdeterminesanappropriatedateforadecoydocumentbyndingthemediancreationdateofexistinglesinthedecoy'stargetdirectory.Thedecoy'screationdateisthensetwithina48-hourwindowofthemedian.Thedatestringappendedtothelenameisobtainedfromtheproposedcreationdate.Whenplacingdecoydocumentsinaseparatenewfolder,theDDThasnoexistingdocu-mentdatesonwhichtobaseale'stargetdate.Therefore,themodifydatesofthedecoysaredeterminedbythedatethatthedecoysaregeneratedbytheFOGsystem.Acreationdateisthensettouptotwodaysbeforetheexistingmodifydate.TheDDTsubsequentlyaltersthemodifyandcreationdatesofthenewfolderinwhichthedecoysareplaced.Thecreationdateofthefolderissettothecreationdateoftheoldestdecoyleplacedinside;themodifydateissettothatofthemostrecentlymodieddocument.Weconsideredthisdatingapproachthemostpracticalforthecaseinwhichnewdecoyfoldersarecreated,sinceusershavedirectcontroloverthedatesappliedtothedecoydocuments.Inourfuturework,theDDTwillincludeafeatureto\refresh"thedatesofdecoyssothattheyremainamongthemostrecentdocumentsinthelesystem.7ConclusionsTosummarize,thispaperintroducedanovelsecurityparadigmwhichwerefertoasdecoytechnology.Decoysrepresentadrasticdeparturefromexistingsecuritysolutionsinseveralimportantways.Byplacingcontentthatisspuriousyetbelievableandenticinginthepathofpotentialadversaries,decoyscanserveasapotentlastlineofdefenseagainstattacks22 Networks,2009.[2]B.Katz.ChineseManPleadsGuiltytoNYFedCyberTheft.Availableathttp://www.reuters.com/article/2012/05/29/usa-crime-fed-idUSL1E8GTBG120120529,2012.[3]B.Bowen,P.Prabhu,V.Kemerlis,S.Sidiroglou,A.Keromytis,andS.Stolfo.Botswindler:Tamperresistantinjectionofbelievabledecoysinvm-basedhostsforcrimewaredetection.InRecentAdvancesinIntrusionDetection,page118137,2010.[4]B.M.Bowen,V.P.Kemerlis,P.Prabhu,A.D.Keromytis,andS.J.Stolfo.Automatingtheinjectionofbelievabledecoystodetectsnooping.InProceedingsofthethirdACMconferenceonWirelessnetworksecurity,page8186,2010.[5]C.PetteyandR.vanderMeulen.GartnerSaysSecuritySoftwareMarketGrew7.5Percentin2011.Availableathttp://www.gartner.com/it/page.jsp?id=1996415,2012.[6]C.Stoll.TheCuckoo'sEgg,1989.[7]ColumbiaUniversityIntrusionDetectionSystemsLab.FOGComputing.Availableathttp://ids.cs.columbia.edu/FOG/,2012.[8]J.Rubin.Deception:Theother'D'inD-Day.Availableathttp://www.msnbc.msn.com/id/5139053/ns/msnbc_tv-the_abrams_report/t/deception-other-d-d-day,2004.[9]J.VorisandN.BoggsandS.Stolfo.LostinTranslation:ImprovingDecoyDocumentsviaAutomatedTranslation.InWorkshoponResearchforInsiderThreat,2012.[10]J.YuillandM.ZappeandD.DenningandF.Feer.Honeyles:DeceptiveFilesforIntrusionDetection.InWorkshoponInformationAssurance,2004.[11]A.D.Keromytis,R.Geambasu,S.Sethumadhavan,S.J.Stolfo,J.Yang,A.Benameur,M.Dacier,M.Elder,D.Kienzle,andA.Stavrou.TheMEERKATScloudsecurity24