Simulation of false information traffic to protect the structural and functional characteristics of the information system is not an easy task in view of self-similarity of its statistical properties in IP-networks not only in the current moment, but also retrospectively. We have developed a methodology to substantiate the characteristics of false network traffic to simulate information systems, allowing to solve the problem of maximum likelihood of false network traffic by pseudophase reconstruction of the dynamic system attractor, which approximates the time series of the protected object information traffic.
Information protection measures in state information systems currently include: • hiding the architecture and configuration of the information system; • creation (emulation) of false information systems or their components designed to detect, register and analyze the actions of intruders in the process of implementing threats to information security; • reproduction of false and (or) concealment of true individual information technologies and (or) structural and functional characteristics of the information system or its segments, ensuring the imposition of a false idea on the offender about the true information technologies and (or) structural and functional characteristics of the information system.
This is due to the fact that a sufficiently large number of computer attacks are reconnaissance in
nature in order to obtain information about the composition, structure and algorithms of the functioning,
location and ownership of information systems, as well as data stored, processed and transmitted in
such systems. Along with the threats to information security, related to the dialog interaction of the
intruder and information system (in particular – automated network scanning tools), the reconstruction
of structural and functional characteristics of information system is aimed at the threat of determining
its topology, uncompromisingly implemented by the analysis of network traffic. The result is revealing
the topology of the cyberspace distributed information system, determining the importance of its nodes
witch could be used by an intruder to implement planned APT-attacks (advanced persistent threat,
targeted cyberattack) [
The task of implementing the above information protection measures is solved by false (masking) information traffic, which is understood as a set of false (masking) message packets formed by network information objects in order to manage the demasking signs of information systems functioning algorithms: the intensity of traffic between topologically localized network information objects of a distributed information system, network interaction protocols and hierarchical levels (ranks) of its elements.
For this purpose, false network information objects (also called "deceptive" systems) are used, which implement dialog interaction with the intruder, which leads to "depletion" of its computing resources and compromises the processes of tampering.
It is known the way to protect computer networks [
The following variants of solving the problem of false (masking) information traffic are possible.
Pre-recording of information system network traffic and subsequent sending of saved packets to the network. In this case, the time interval between packets is taken from the network traffic record. Disadvantages of this approach, associated with the need to store large amounts of data, are obvious. In addition, with a relatively small number of subscribers in the information system it is possible to detect the fact of re-use (cloning) of traffic.
Another, and more preferable, method is the generation of false (masking) information traffic based on the characteristics of real traffic, which is performed by a false network information object. In order to ensure maximum plausibility of false network traffic, its statistical properties must match the statistical properties of the information traffic of the protection object. Otherwise the application of such protection measures will be compromised, and the goals of simulation will not be achieved.
Thus, there is a contradiction between the need to implement an effective masking exchange and the lack of a unified way to assess the characteristics of network traffic for the false information exchange generation in the system.
Simulation of false information traffic for protection of information system structural and functional
characteristics is a complex task in view of self-similarity of its statistical properties in IP-networks [
It is known [
Today, global networking is growing exponentially, with traffic statistics that mathematically exhibit fractal characteristics: self-similarity and long-range dependence. With these properties, data traffic shows high peak-to-average bandwidth ratios and causes data networks inefficient. These problems make it difficult to predict, quantify, and control data traffic, in contrast to the traditional Poisson-distributed traffic in telephone networks [19, 20].
A commonly used index of self-similarity of a process is the Hurst index H , initially introduced in [21], depending on its values the following conclusions about the processes under study are drawn: • at 0 ≤ H ≤ 0,5 is a random process, it has no self-similarity; • at H > 0, 5 the process has a long memory and is self-similar [22].
The Hearst index calculations use the algorithm for analyzing the adjusted modified range proposed in [23], [24], which consists in the following.
Z
={zi },i =1, 2,..., n . in which its initial segments are sequentially allocated
Zτ = z1, z2 ,..., zτ , where τ = 3, 4,..., n , for each of which the current average is calculated
1 τ zτ = ∑ zi (3)
τ i=1
Next, for each fixed zτ ,τ = 3, 4,..., n , calculate the accumulated deviation for each of the segments of length t :
t X (t,τ ) =∑ (zi − zτ ) , where t = 1,τ
i=1 The main characteristic of a sample of a random process is the normalized range R/S, where R(τ ) =max X (t,τ ) − min X (t,τ )
1≤t≤τ 1≤t≤τ maximum amplitude range of the random process, S is standard deviation of the process S =S (τ ) = 1 τ
∑ (z j − zτ )2 , τ j=1 t - discrete time with integer values; τ - duration of the time interval in question.
The normalized R/S spread is described by the empirical relation R / S = (τ / 2)H , where H is the
We obtain the Cartesian coordinates of the trajectory points ( xτ , yτ ) by logarithmization of both parts of this equality (6), whose ordinates and abscissas are, respectively:
log(R(τ ) / S (τ )) yτ =H (τ ) = , xτ =τ.
log(τ / 2)
The R/S-trajectory required for the fractal analysis of the series is represented in Cartesian logarithmic coordinates by a sequence of points, the abscissas and ordinates of which are as follows xτ = log(τ / 2) , yτ = log(R(τ ) / S (τ )) .
Let a sample (dump) of information system traffic X t for some set of time moments t ≤ T be obtained at time T . Then the model of prediction of characteristics of information traffic defines a set where vector aT represents the model coefficients derived from the results of traffic dumping up to and including moment T , and matrix F represents the set of approximating functions.
In most cases, it is necessary to study only the attractor, a compact subset of the phase space to which the evolution trajectories of all points of the system located near this subset are asymptotically "attracted", in order to analyze the behavior of the dynamical system (8). Its dimensionality determines the amount of information required to specify the coordinates of a point belonging to the attractor within the specified accuracy.
The fractal dimension D can be expressed through the Hearst index H by the ratio
D = 2 − H . (9)
The attractor is related to the fractal dimension through the correlation integral C(r) , which is estimated directly for a sequence of points (shows the relative number of pairs of points at a distance not greater than r ):
C(r)
1 m m =lim∑ ∑θ (r − ρ (xi , x j )) , m→∞ m(m − 1) i=1 j=1 (10) where (1) (2) (4) (5) (6) (7) 1,α ≥ 0, θ (α ) = (11)
0,α < 0 (Haviside function), ρ is the distance between a pair of points in n -dimensional phase space, and m is the number of points xi on the attractor.
Tackens in [25] showed that for almost every smooth dynamical system it is possible to calculate the correlation integral and the fractal dimension by measurements of only one of the phase coordinates of this system.
The method for synthesizing a mathematical model of a process described in [26] is based on the application of the so-called pseudophase reconstruction.
A pseudophase reconstruction [27] is a mapping that maps the x(t) point of a time series to the [x(t), x(t +τ ),..., x(t + (m −1) ⋅τ )]∈ Rm point, where t is the discrete time (t = ((m −1)τ + 1), N )) , τ is the time delay (in time discretes), and m is the dimension of the embedding space. Thus, it is possible to reconstruct the original attractor in the point space with delay [x(t), x(t +τ ),..., x(t + (m −1) ⋅τ )] for an initial set of measurements of the phase coordinate x(1), x(2),..., x(N ), , where N is the number of measurements, so that it preserves the essential topological properties and dynamics of the original attractor. The attractor dimension m is determined by the formula m ≥ 2[d ] + 1 , where d is the fractal dimension of the attractor.
Consequently, in order to synthesize a mathematical model of the network traffic of the system under study, it is necessary to calculate the Hurst exponent H for one of the parameters of the network traffic dump and then, using the known mathematical models of attractors, select their coefficients so that the Hurst exponent H S of the synthesized time series coincides with H with an accuracy of some ε .
Let us consider a traffic dump of 211972 packets from an Internet subscriber point (Table 1). We want to synthesize a mathematical model of this dump to predict, quantify, and control destination ports of data traffic.
Protocol
TCP TCP TCP HTTP TCP TCP TCP TCP TCP TCP TCP TCP TCP TCP TCP TCP TCP
Length 1494 66 66 1494 1494 1494 1494 1494 1494 1494 1494
66 1494 1494 1494 66 66
66 1494 66
We filter out packages by destination port and present them as a time series (Figure 1). Then we calculate R/S spread and Hurts index using the algorithm above.
The results of calculating the time dependence of the normalized R/S spread in double logarithmic scale and its linear approximation for packets filtered by destination port are shown in Figure 2.
Hearst index for the studied time series H = 0, 67199 , fractal dimension D =2– H =1,32801 . Let us approximate the time series under study, for example, by the van der Pol nonlinear oscillator d 2 x dx equation [28], which has the form 2 − a(1 − b ) + x =0 .
d t dt
Choosing the coefficients for the practically important case ( a > 0,b > 0 ) and solving differential equations with numerical methods, for example, Runge-Kutta of order 4 and 5, we obtain that the closest calculated value of the Hurst index HS = 0, 67199 to the value of the Hurst index H = 0, 67199 of the studied time series of packages filtered by destination ports is obtained at a = 8,514 ; b = 10 .
Thus, the processing of the Van der Pol generator model series with the presented coefficients resulted in a dependence that can be considered as a fairly accurate approximation of the empirical series of R/S dependence for a sequence of packets with different destination ports, i.e. its mathematical model:
Now let’s examine packages filtered by source port and present them as a time series (Figure 1). Then we calculate R/S spread and Hurts index.
The results of calculating the time dependence of the normalized R/S spread in double logarithmic scale and its linear approximation for packets filtered by destination port are shown in Figure 6.
Hearst index for the studied time series H = 0, 66513 , fractal dimension D =2– H =1,33487 .
Let us approximate the time series of source port packages by the Rössler system [29], which has the form
Iterate the confidents a , b , and c and solving the system of differential equations with numerical methods using GNU Octave lsode solver we obtain that the closest calculated value of the Hurst index x =− y − z y = x + ay z =b − cz + xz filtered by source ports is obtained at a = 0,2 , b = 0, 2 , c = 5, 2 .
Thus, the processing of the Rössler system model series with the presented coefficients resulted in a dependence that can be considered as a fairly accurate approximation of the empirical series of R/S dependence for a sequence of packets with different source ports, i.e. its mathematical model: x =− y − z
, HS = 0, 66881, D =2– HS
The resulting mathematical models can be used to adjust honeypot parameters, allowing the synthesis of false network traffic to different ports that is statistically similar to the reference traffic.
Thus, the paper substantiates the possibility of analyzing the information system de-masking features and generation of false network traffic, statistically similar to the traffic of the protected information system, to reduce the effectiveness of network reconnaissance.
The novelty of the developed methodology consists in the application of modified algorithms of fractal analysis to assess the characteristics of network traffic and synthesis of its mathematical model to improve the reliability of false network information objects.
The implementation of the proposed scientific solutions in the information system structure will reduce the availability of its elements and management processes, which will ensure the weakening of the influence or neutralization of network reconnaissance, as well as deprive the attacker the necessary information about the structure of a distributed information system.