Deceiving Adversary Network Scanning Efforts Using Host-Based Deception

In this research we demonstrate the usefulness of manipulating system traffic to deceive an attacker’s operating system (OS) fingerprinting as part of their network scanning efforts. Specifically, we address whether host-based OS obfuscation has merit and application as an integral part of Air Force network defense and whether the technique warrants, further research and application development. We accomplish this objective was accomplished through a literature review and a proof of concept evaluation of a selected OS obfuscation tool against selected OS fingerprinting tools under current Air Force network configuration. Our focus areas in the literature review include: how to characterize the scanning phase of an adversary attack, a survey of current OS fingerprinting and obfuscation tools, and description of current AF network concepts. To evaluate effectiveness of a candidate OS tool, we setup an experimental network environment that simulates adversarial network scanning. The results of our study are: a) that current OS obfuscation tools designed for Windows OS are capable of providing some OS obfuscation on AF networks; b) that the current tools need to be evaluated for impacts on network maintenance tools and processes, to include future initiatives like IPv6; and c) that the current tools need to improve OS fingerprints and add options to force inconclusive results from fingerprinting tools.

This work has been selected by scholars as being culturally important, and is part of the knowledge base of civilization as we know it. This work was reproduced from the original artifact, and remains as true to the original work as possible. Therefore, you will see the original copyright references, library stamps (as most of these works have been housed in our most important libraries around the world), and other notations in the work.

This work is in the public domain in the United States of America, and possibly other nations. Within the United States, you may freely copy and distribute this work, as no entity (individual or corporate) has a copyright on the body of the work.

As a reproduction of a historical artifact, this work may contain missing or blurred pages, poor pictures, errant marks, etc. Scholars believe, and we concur, that this work is important enough to be preserved, reproduced, and made generally available to the public. We appreciate your support of the preservation process, and thank you for being an important part of keeping this knowledge alive and relevant.