Implementation of an Environment for Reproducing Targeted Attacks

Yu Tsuda, Masaki Kamizono, Takashi Tomine, Shingo Yasuda, Ryosuke Miura, Toshiyuki Miyachi, Masashi Eto, Daisuke Inoue, Koji Nakao

Targeted attacks which aimed at a specific orgnization or company become an object of public concern. Targeted attacks have some attacking phases, for instance reconnaissance, installation exploitation and so on. According to some analyzing reports, attackers use various tools. Most of analyzing reports have results which include attacking tools and malwares individually. Therefore, relevances among the individual results are complemented of scenarios which analysts suppose, because analysts can not obtain attaking environments and harmful environments substantially. In this paper, we implement an environment for reproducing whole scenarios of targeted attacks in order to observing attackers' activities precisely. The environment has some attaking tools and a simulated C&C server as an attacker's zone. Also, we implement a victim's zone like a company's computing environment which is targeted from attackers. In addition, the environment has supporting zone which is used for reproducing attacking scenarios easily. At last, we produce a scenario of a targeted attack in this environment and discuss this environment with some logs such as Windows event logs, some server logs and network traffic data on the victim's zone.

Implementation of an Environment for Reproducing Targeted Attacks

Bibliographic Information

Search this article

Description

Journal

Keywords

Details 詳細情報について

Export

Report a problem