• DOI:10.1109/CyberSA52016.2021.9478201
• Corpus ID: 233182054

Secure (S)Hell: Introducing an SSH Deception Proxy Framework

@article{Reti2021SecureI,
  title={Secure (S)Hell: Introducing an SSH Deception Proxy Framework},
  author={Daniel Reti and David Klaassen and Simon D. Duque Ant{\'o}n and Hans D. Schotten},
  journal={2021 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA)},
  year={2021},
  pages={1-6}
}

• Daniel Reti, David Klaassen, +1 author H. Schotten
• Published 8 April 2021
• Computer Science
• 2021 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA)

Deceiving an attacker in the network security domain is a well established approach, mainly achieved through deployment of honeypots consisting of open network ports with the sole purpose of raising an alert on a connection. With attackers becoming more careful to avoid honeypots, other decoy elements on real host systems continue to create uncertainty for attackers. This uncertainty makes an attack more difficult, as an attacker cannot be sure whether the system does contain deceptive elements or not. Consequently, each action of an attacker could result in being discovered. In this paper a framework is proposed for placing decoy elements through an SSH proxy, allowing to deploy decoy elements on-the-fly without the need for a modification of the protected host system.