ShadowNet: An Active Defense Infrastructure for Insider Cyber Attack Prevention

Conference · Sun Jan 01 04:00:00 EST 2012

OSTI ID:1048708

Cui, Xiaohui ^[1]; Beaver, Justin M ^[1]; Treadwell, Jim N ^[1]

---

1. ORNL

The ShadowNet infrastructure for insider cyber attack prevention is comprised of a tiered server system that is able to dynamically redirect dangerous/suspicious network traffic away from production servers that provide web, ftp, database and other vital services to cloned virtual machines in a quarantined environment. This is done transparently from the point of view of both the attacker and normal users. Existing connections, such as SSH sessions, are not interrupted. Any malicious activity performed by the attacker on a quarantined server is not reflected on the production server. The attacker is provided services from the quarantined server, which creates the impression that the attacks performed are successful. The activities of the attacker on the quarantined system are able to be recorded much like a honeypot system for forensic analysis.

• Research Organization: Oak Ridge National Laboratory (ORNL)
• Sponsoring Organization: ORNL work for others
• DOE Contract Number: AC05-00OR22725
• OSTI ID: 1048708
• Country of Publication: United States
• Language: English

Related Subjects

99 GENERAL AND MISCELLANEOUS
COMPUTER CODES
COMPUTERS
PRODUCTION
PROGRAMMING
SECURITY