Procedures for improving security in an electronic communications network
The invention relates to a method for improving the security in an electronic communication network, in which lures and decoys are distributed in the communication network. The aim of the invention is that of providing a systemisation for the selection and positioning of lures and decoys, by means of which the lures and decoys are distributed as optimally as possible in the communication network. For this purpose, the invention proposes that an attack vector on the communication network be determined, an attack graph ( 1 ) be created on the basis of the attack vector, which graph shows possible attack paths as acyclic directed graphs, the type and the number of lures and decoys be determined on the basis of the structure of the attack graph, and the lures and the decoys be distributed in the communication network using a target function, wherein the target function takes account of parameters which detects, as quickly as possible and with as high a likelihood as possible, an attacker ( 4 ), using the available lures and decoys, and allows for an assessment of the distribution.
1. Method for improving the security of an electronic communication network using deception technology, in which lures and decoys are distributed in the communication network, in order to detect an attacker in the communication network, characterised in that an attack vector on the communications network is determined,
an attack graph is drawn up, on the basis of the attack vector, which graph shows possible weak points and attack paths as acyclic directed graphs having at least one sink representing the target, and at least one source representing the relevant weak point,
the type and the number of lures and decoys are determined on the basis of the structure of the attack graph, and
the lures and decoys are distributed in the communication network using a target function, wherein the target function takes into account the following parameters:
a) shorter paths to the target or the targets of the attack graph are particularly attractive for attackers;
b) a decoy is placed on as many paths as possible to the target or the targets of the attack graph; and
c) the lures and decoys are arranged as close as possible to the weak points of the attack graph,
wherein a new attack graph is created by the distribution of the lures and decoys, and wherein subsequently a comparison of the original attack graph with the newly created attack graph is carried out, and the change is assessed on the basis of the target function value.
2. Method according to claim 1 , characterised in that at least two attack vectors are specified, from which in each case one attack graph is drawn up, and the positioning of the lures and decoys in the respective attack graphs is overlaid.
3. Method according to claim 1 , characterised in that d) the complexity of the application of lures and decoys is used as a further parameter in the target function.
4. Method according to claim 1 , characterised in that a plurality of iterations of the method according to claim 1 are passed through.
5. Method according to claim 1 , characterised in that machine learning methods are used when carrying out the method.