Active Defense Through Deceptive Configuration Techniques

Security architecture, based on deception strategies can effectively change the starting point of the legitimate network, providing additional time to prepare adequate defenses. Through configurable logical networking, a virtual network can be designed to monitor, capture, and lure malicious activity deeper into a virtual labyrinth, away from the real network. By incorporating the use of dynamic threat lists, offered by specific security tools, signatures can be created to strengthen the defenses of the internal network before the malicious actions reach the boundary. Using honeynet architecture, the virtual labyrinth can be dynamically and continually created providing protection from attackers. Through real-time knowledge gathering of the attacker's exploitation techniques, the Labyrinth provides defenders with time to prepare effective countermeasures. In this paper, the demonstration on how the use of honeynet architecture can allow defense teams to strengthen their perimeter, by using customized dynamic threat lists created from a completely configured and monitored environment.