arXiv subjects

Sebastian Garcia

Publications and source records attributed to Sebastian Garcia.

23 records · Page 2Linked to original sources

arXiv2023

Attacker Profiling Through Analysis of Attack Patterns in Geographically Distributed Honeypots

Honeypots are a well-known and widely used technology in the cybersecurity community, where it is assumed that placing honeypots in different geographical locations provides better visibility and increases effectiveness. However, how geolocation affects the usefulness of honeypots is not well-studied, especially for threat intelligence as early warning systems. This paper examines attack patterns in a large public dataset of geographically distributed honeypots by answering methodological questions and creating behavioural profiles of attackers. Results show that the location of honeypots helps identify attack patterns and build profiles for the attackers. We conclude that not all the intelligence collected from geographically distributed honeypots is equally valuable and that a good early warning system against resourceful attackers may be built with only two distributed honeypots and a production server.

cs.CR↗

arXiv2023

Catch Me If You Can: Improving Adversaries in Cyber-Security With Q-Learning Algorithms

The ongoing rise in cyberattacks and the lack of skilled professionals in the cybersecurity domain to combat these attacks show the need for automated tools capable of detecting an attack with good performance. Attackers disguise their actions and launch attacks that consist of multiple actions, which are difficult to detect. Therefore, improving defensive tools requires their calibration against a well-trained attacker. In this work, we propose a model of an attacking agent and environment and evaluate its performance using basic Q-Learning, Naive Q-learning, and DoubleQ-Learning, all of which are variants of Q-Learning. The attacking agent is trained with the goal of exfiltrating data whereby all the hosts in the network have a non-zero detection probability. Results show that the DoubleQ-Learning agent has the best overall performance rate by successfully achieving the goal in $70\%$ of the interactions.

cs.AI↗

arXiv2021

Deep Generative Models to Extend Active Directory Graphs with Honeypot Users

Active Directory (AD) is a crucial element of large organizations, given its central role in managing access to resources. Since AD is used by all users in the organization, it is hard to detect attackers. We propose to generate and place fake users (honeyusers) in AD structures to help detect attacks. However, not any honeyuser will attract attackers. Our method generates honeyusers with a Variational Autoencoder that enriches the AD structure with well-positioned honeyusers. It first learns the embeddings of the original nodes and edges in the AD, then it uses a modified Bidirectional DAG-RNN to encode the parameters of the probability distribution of the latent space of node representations. Finally, it samples nodes from this distribution and uses an MLP to decide where the nodes are connected. The model was evaluated by the similarity of the generated AD with the original, by the positions of the new nodes, by the similarity with GraphRNN and finally by making real intruders attack the generated AD structure to see if they select the honeyusers. Results show that our machine learning model is good enough to generate well-placed honeyusers for existing AD structures so that intruders are lured into them.

cs.CR↗

arXiv2021

Current State of IPv6 Security in IoT

This report presents the current state of security in IPv6 for IoT devices. In this research conducted from May 2020 to July 2020, we explored the global growth of IPv6 and compared it with the real growth of IPv6 in a medium size network. If IPv6 is already being used, are attackers already attacking using this protocol? To answer this question we look at the current vulnerabilities, attacks, and malware leveraging IPv6. Our research showed that while IPv6 adoption is growing, we are years away of a full adoption. The current global adoption is of 35\%, however there are countries rapidly adopting IPv6, such as India with 60\% of IPv6 enabled in the country. IPv6 brings new challenges for both attackers and defenders. With a larger address space, the activity of device discovery will force attackers to devise new techniques and tools. Defenders will also have to adapt their tools and monitoring technology to be able to work with IPv6. There are currently more than 16 million devices exposed on the internet on IPv6, however malware authors seem to be still focused mainly on IPv4. There is to date, one malware capable of attacking IPv6 networks. This may give an edge to defenders, who have now the opportunity to give the first step ahead of attackers.

cs.NI↗

arXiv2020

DNS Tunneling: A Deep Learning based Lexicographical Detection Approach

Domain Name Service is a trusted protocol made for name resolution, but during past years some approaches have been developed to use it for data transfer. DNS Tunneling is a method where data is encoded inside DNS queries, allowing information exchange through the DNS. This characteristic is attractive to hackers who exploit DNS Tunneling method to establish bidirectional communication with machines infected with malware with the objective of exfiltrating data or sending instructions in an obfuscated way. To detect these threats fast and accurately, the present work proposes a detection approach based on a Convolutional Neural Network (CNN) with a minimal architecture complexity. Due to the lack of quality datasets for evaluating DNS Tunneling connections, we also present a detailed construction and description of a novel dataset that contains DNS Tunneling domains generated with five well-known DNS tools. Despite its simple architecture, the resulting CNN model correctly detected more than 92% of total Tunneling domains with a false positive rate close to 0.8%.

cs.CR↗