MAYA: a hardware-based cyber-deception framework to combat malware
A hardware framework for cyber-deception operations provides flexibility in formulating counterattacks and leverages hardware support for efficiency. Hardware-assisted deception primitives are provided at kernel crossing boundaries to privileged system features that propel the security defenses to dynamically manipulate the malware execution and present a deceptive view of the system state to the attackers. Malware may be in the form of various attack vectors including ransomware, infostealers, buffer overflow, and side-channels.
1. A cyber-deception system comprising:
a hardware processor is configured to:
intercept a system call; and
select at least one subroutine amongst a plurality of subroutines based on the intercepted system call;
the hardware processor having a subroutine, wherein the subroutine is configured to implement, based on the system call, at least one deception strategy amongst a plurality of deception strategies, wherein the at least one deception strategy is implemented by executing one or more instructions of the selected at least one subroutine; and
the hardware processor executes pre-runtime setup instructions to allow a system administrator to directly populate tactics into a deception table through a user interface, wherein the hardware processor further includes exception synthesis instructions to translate the tactics from the deception table entries into an exception subroutine, wherein one or more honey quivers are synthesized based on the tactic specified.
2. The cyber-deception system of claim 1 , the hardware processor further configured to:
execute one or more instructions of the intercepted system call; and
return at least one result of the executed one or more instructions of the intercepted system call.
3. The cyber-deception system of claim 1 , wherein the intercepted system call is determined to have originated from a malicious actor.
4. The cyber-deception system of claim 1 , wherein the intercepted system call includes at least one attack vector including data integrity corruption, ransomware, privilege escalation, infostealers, buffer overflow exploits, privacy leakage, side-channels, or a combination thereof.
5. The cyber-deception system of claim 1 , wherein the at least one deception strategy is at least one of a diversion strategy, a fabrication strategy, and an exhaustion strategy.
6. The cyber-deception system of claim 1 , wherein the selected at least one subroutine invokes at least one exception.
7. The cyber-deception system of claim 1 , wherein the at least one deception strategy is selected using a random number generator.
8. The cyber-deception system of claim 1 , wherein the deception table is populated with one or more deception strategy entries received from the hardware processor used against malware types.
9. The cyber-deception system of claim 1 , wherein the at least one subroutine is selected based on a number of the intercepted system call.
10. A deception trigger device, comprising:
a hardware processor; and
a memory coupled to the hardware processor, the memory having instructions stored thereon that when executed by the hardware processor implement:
receiving a system call associated with an attacker, the system call having a system call number;
reading the system call number of the received system call;
recording the system call number in a register;
invoking a system call-specific subroutine amongst a plurality of system call-specific subroutines, based on the system call number of the received system call; and
implementing at least one deception strategy by executing the invoked system call-specific subroutine, wherein the at least one deception strategy includes one or more deception primitive data types include kernel boundaries to intercept malware system service requests and to enforce the at least one deception strategy at the hardware processor, wherein a system administrator, through a user interface, directly retrieves the appropriate format for a specified tactic comprising the deception primitive and mode from a deception table supported by a disclosed hardware.
11. The deception trigger device of claim 10 , wherein, in response to the one or more deception primitives specifying at least one return-time manipulation of target fields, a system return tracker flag is set to 1.
12. The deception trigger device of claim 11 , wherein the at least one deception strategy is invoked for a system return when the system return tracker flag is set to 1 by the received system call.
13. The deception trigger device of claim 12 , wherein the at least one deception strategy invoked for the system return uses the recorded number in the register and the system return tracker flag value to index a subroutine for return-time deception.
14. A deception trigger device, comprising:
a hardware processor; and
a memory coupled to the hardware processor, the memory having instructions stored thereon that when executed by the hardware processor implement:
receiving a system call associated with an attacker, the system call having a system call number;
reading the system call number of the received system call;
recording the system call number in a register;
invoking a system call-specific subroutine amongst a plurality of system call-specific subroutines, based on the system call number of the received system call; and
implementing at least one deception strategy by executing the invoked system call-specific subroutine, wherein the at least one deception strategy includes a return-time deception, wherein a hardware-assisted random number generator triggers a random selection of an index to dynamically activates a deception tactic with one of an exception subroutine each time for each of the system call-specific subroutines, wherein at least one deception subroutine is executed during time of return for the received system call.
15. A deception trigger device, comprising:
a hardware processor; and
a memory coupled to the hardware processor, the memory having instructions stored thereon that when executed by the hardware processor implement:
receiving a system call associated with an attacker, the system call having a system call number;
reading the system call number of the received system call;
recording the system call number in a register;
invoking a system call-specific subroutine amongst a plurality of system call-specific subroutines, based on the system call number of the received system call; and
implementing at least one deception strategy by executing the invoked system call-specific subroutine, wherein the at least one deception strategy includes a deception tactic received from triggering a hardware-assisted random number generator to randomly select an index and dynamically activates a deception tactic with one of a respective honey quivers an exception subroutine each time for each of the system call-specific subroutines, to provide useless bytes to the attacker by scrambling a read buffer using a SCRAMBLE RETURN primitive, which randomizes each byte value in REG mode of operation wherein the scrambling is an iterative loop based on the value held in a RDX register.