Honeyfile Camouflage: Hiding Fake Files in Plain Sight

Overview

• This paper explores the challenge of naming "honeyfiles" - fake files deployed to detect and infer information from malicious behavior.
• The researchers develop two metrics to camouflage honeyfile names so they blend in with real files in a file system.
• The metrics are based on measuring the cosine distance between file names in semantic vector spaces.
• The metrics are evaluated on a public dataset of GitHub software repositories.

Plain English Explanation

Honeyfiles are a type of honeypot - a security tool that creates fake targets to detect and study malicious activity. The key challenge is making the honeyfiles blend in with real files on a computer system so attackers don't realize they are fake.

The researchers in this paper developed two mathematical methods to name honeyfiles in a way that makes them seem like ordinary, normal files. Both methods use "semantic vector spaces" - mathematical representations of the meaning and relationships between words. By analyzing how similar the honeyfile names are to real file names in this vector space, the researchers can choose names that are well-camouflaged.

One method simply averages the vector distances, while the other uses a more sophisticated statistical technique called "clustering with mixture fitting." The researchers tested these methods on a large dataset of real software project files from GitHub, and found that both techniques did a good job of generating honeyfile names that blend in.

The key benefit of having well-camouflaged honeyfiles is that it helps security teams better detect and study malicious behavior. If attackers can't easily spot the fake files, they may interact with them in ways that reveal useful information about their tactics and techniques.

Technical Explanation

The paper proposes two metrics for generating camouflaged honeyfile names based on the cosine distance between file names in semantic vector spaces.

The first metric, "simple averaging," calculates the average cosine distance between a candidate honeyfile name and all real file names in the dataset. The goal is to choose a honeyfile name that has an average distance similar to real file names.

The second metric, "clustering with mixture fitting," first clusters the real file names into groups using a statistical technique called Gaussian Mixture Models. It then selects a honeyfile name that has a cosine distance closest to the centroid of one of these clusters, making it appear to belong to that group of similar real file names.

The researchers evaluate these two metrics on a dataset of over 6 million file names from public GitHub repositories. They find that both techniques are effective at generating honeyfile names that are well-camouflaged and difficult to distinguish from real files.

Critical Analysis

The paper provides a thorough evaluation of the proposed honeyfile naming techniques, but there are a few potential limitations:

• The evaluation is limited to a dataset of open-source software projects, which may not fully represent the diversity of real-world file systems. Honeyfiles deployed in other contexts may require different naming strategies.

• The paper does not address potential adversarial attacks where attackers try to actively detect the honeyfiles. More robust techniques may be needed to withstand sophisticated attempts to identify the fake files.

• While the metrics perform well on average, there may still be some honeyfile names that stand out as unusual. Further research is needed to understand the failure modes and improve consistency.

• The cost and computational overhead of the more complex "clustering with mixture fitting" approach is not evaluated. Simpler techniques may be preferable in some scenarios.

Overall, this research represents a valuable contribution to the field of cyber deception, but there are opportunities to expand on the techniques and validate them in a wider range of real-world applications.

Conclusion

This paper presents two new techniques for generating camouflaged honeyfile names that can help security teams detect and study malicious behavior. By making it harder for attackers to distinguish fake files from real ones, these methods can improve the effectiveness of honeypot security tools.

While the proposed metrics perform well in the evaluated dataset, there are opportunities to further refine the techniques and validate them in more diverse real-world scenarios. Ongoing research in cyber deception and adversarial detection will be crucial to staying ahead of increasingly sophisticated attackers and protecting critical systems and data.