Strengthening MT6D Defenses with Darknet and Honeypot capabilities
| dc.contributor.author | Basam, Dileep Kumar | en |
| dc.contributor.committeechair | Marchany, Randolph C. | en |
| dc.contributor.committeechair | Tront, Joseph G. | en |
| dc.contributor.committeemember | Ransbottom, J. Scot | en |
| dc.contributor.department | Electrical and Computer Engineering | en |
| dc.date.accessioned | 2015-12-26T09:05:38Z | en |
| dc.date.available | 2015-12-26T09:05:38Z | en |
| dc.date.issued | 2015-12-09 | en |
| dc.description.abstract | With the ever increasing adoption of IPv6, there has been a growing concern for security and privacy of IPv6 networks. Mechanisms like the Moving Target IPv6 Defense (MT6D) leverage the immense address space available with the new 128-bit addressing scheme to improve security and privacy of IPv6 networks. MT6D allows participating hosts to hop onto new addresses, that are cryptographically computed, without any disruption to ongoing conversations. However, there is no feedback mechanism in the current MT6D implementation to substantiate the core strength of the scheme i.e., to find an attacker attempting to discover and target any MT6D addresses. This thesis proposes a method to monitor the intruder activity targeting the relinquished addresses to extract information for reinforcing the defenses of the MT6D scheme. Our solution identifies and acquires IPv6 addresses that are being discarded by MT6D hosts on a local network, in addition to monitoring and visualizing the incoming traffic on these addresses. This is essentially equivalent to forming a darknet out of the discarded MT6D addresses. The solution's architecture also includes an ability to deploy a virtual (LXC-based) honeypot on-demand, based on any interesting traffic pattern observed on a discarded address. With this solution in place, we can become cognizant of an attacker trailing an MT6D-host along the address changes, as well as understanding the composition of attack traffic hitting the discarded MT6D addresses. With the honeypot deployment capabilities, the solution can take the conversation forward with the attacker to collect more information on attacker methods and delay further tracking attempts. The solution architecture also allows an MT6D host to query the solution database for network activity on its relinquished addresses as a JavaScript Object Notation (JSON) object. This feature allows the MT6D host to identify any suspicious activity on its discarded addresses and strengthen the MT6D scheme parameters accordingly. We have built a proof-of-concept for the proposed solution and analyzed the solution's feasibility and scalability. | en |
| dc.description.degree | Master of Science | en |
| dc.format.medium | ETD | en |
| dc.identifier.other | vt_gsexam:6692 | en |
| dc.identifier.uri | http://hdl.handle.net/10919/64375 | en |
| dc.publisher | Virginia Tech | en |
| dc.rights | In Copyright | en |
| dc.rights.uri | http://rightsstatements.org/vocab/InC/1.0/ | en |
| dc.subject | Moving Target Defense | en |
| dc.subject | MT6D | en |
| dc.subject | Darknet | en |
| dc.subject | Honeypot | en |
| dc.subject | Dionaea | en |
| dc.subject | IPv6 | en |
| dc.title | Strengthening MT6D Defenses with Darknet and Honeypot capabilities | en |
| dc.type | Thesis | en |
| thesis.degree.discipline | Computer Engineering | en |
| thesis.degree.grantor | Virginia Polytechnic Institute and State University | en |
| thesis.degree.level | masters | en |
| thesis.degree.name | Master of Science | en |