[Paper Review] Kidemonas: The Silent Guardian

Rudra Prasad Baksi, Shambhu Upadhyaya|arXiv (Cornell University)|Dec 3, 2017

Network Security and Intrusion Detection7 references3 citations

TL;DR

Kidemonas is a covert threat detection and reporting architecture designed to silently identify Advanced Persistent Threats (APTs) in government and industrial systems without alerting attackers. By enabling stealthy detection and secret communication to administrators, it allows defenders to observe attacker behavior and develop countermeasures before significant damage occurs.

ABSTRACT

Advanced Persistent Threats or APTs are big challenges to the security of government organizations or industry systems. These threats may result in stealth attacks, but if the attack is confronted before the attacker end goal has been achieved, the attackers could become aggressive by changing the mode of attack or by resorting to some form of contingency plan, which might cause unexpected damage. Therefore, the attack detection and the notification to the system administrator should be done surreptitiously. This paper presents an architecture, called Kidemonas, to silently detect the threat and secretly report it to the user or the system administrator. This way the attacker is deceived into carrying out the attack, without sending any clear signal so that the defender can buy time to develop countermeasures to deal with the attack. We consider several attack scenarios and perform a security analysis to demonstrate the features of Kidemonas.

Motivation & Objective

• Address the challenge of detecting stealthy Advanced Persistent Threats (APTs) that evade traditional detection mechanisms.
• Prevent attackers from realizing they have been detected, thereby avoiding aggressive countermeasures or contingency plans.
• Enable system administrators to receive covert alerts without compromising the integrity of the detection process.
• Maintain operational security by ensuring that the detection mechanism itself remains undetected by adversaries.
• Provide a framework for time-delayed defensive response by observing attacker behavior in real time without interruption.

Proposed method

• Design a detection architecture that operates in stealth mode, avoiding any overt signaling during threat identification.
• Implement covert communication channels to silently report detected threats to system administrators or security teams.
• Integrate with existing system monitoring and logging mechanisms to detect anomalous behavior indicative of APTs.
• Use obfuscation and steganographic techniques to hide detection and reporting activities from potential attackers.
• Ensure that the detection logic remains dormant until specific, predefined APT-indicative behaviors are observed.
• Decouple the detection phase from the reporting phase to minimize the risk of exposure during the attack lifecycle.

Experimental results

Research questions

• RQ1 How can APTs be detected without alerting the attacker, thereby preventing escalation or contingency responses?
• RQ2 What mechanisms enable covert communication between the detection module and the system administrator?
• RQ3 In what ways can the detection system remain undetected by sophisticated adversaries while still being effective?
• RQ4 How can the system maintain its integrity and confidentiality during prolonged attacker presence?
• RQ5 What design principles ensure that the detection process does not disrupt normal system operations or trigger defensive behaviors from the attacker?

Key findings

• Kidemonas successfully enables silent detection of APTs by avoiding any overt signaling during the detection phase.
• The architecture supports covert reporting of threats to administrators without revealing the presence of the detection mechanism to attackers.
• Security analysis confirms that the system can operate undetected even under active adversarial probing.
• The framework allows defenders to observe attacker behavior over time, enabling strategic response planning.
• The use of steganographic and obfuscated communication channels ensures that detection reports remain hidden from adversaries.
• The system maintains resilience against common APT tactics such as lateral movement and data exfiltration by remaining dormant until critical indicators are triggered.