Episode 14: CMU Cybersecurity Researchers Explore New Ways to Deceive Cyber Attackers

Jeremy Boren: Hello and welcome to the Empower Up podcast. I'm Jeremy Boren, Gray Matters brand manager. Before we get started today, I really encourage you to go and listen to our previous episode and my conversation with Gray Matters Cybersecurity Practice Director Scott Christensen. It sets up a lot of what we're going to be talking about today with today's special guest, Pauly Agarwal.

Wall. She's a researcher at Carnegie Mellon University, and she specializes in cybersecurity and specifically deception technology, which is our topic for today's interview. So I'm going to let Pahlvi introduce herself, and then we're going to get into a discussion about her latest research paper into how cybersecurity attacks unfold and specifically how deception technology can help industrial companies protect themselves. Also, just a quick reminder, if you haven't done so already, give us a rating and give us a review on Apple Podcasts or wherever you happen to listen.

The feedback is always helpful. Thanks.

Palvi Aggarwal: Hi, Jeremy. Thank you so much. Hi, everyone. I'm I work at a dynamic decision making lab at Carnegie Mellon University.

So my research has been focused on specifically cybersecurity. I have been, I did my PhD from India, International Indian Institute of Technology, MUNDI, where my research was focused on cyber deception. And then I learned about human decision making there and started to look at a different perspective, along with technology, how human factors matter in the field of cybersecurity. And then I joined TDM Lab at Carnegie Mellon and started working with Professor Koti Gonzales on the same area.

Yeah. Yeah.

Jeremy Boren: That's great. Thank you. Yeah. So one of the reasons I wanted to talk with you, Pavi, was about your interest in your recent research with your team into deception technology and kind of some of the behavioral aspects of that.

Could you give people who are maybe a little bit new to deception tech a bit of a lesson on what it is and what your research paper focused on?

Palvi Aggarwal: Okay, sure. So I think cyber deception has been used like from years, especially if we talk about military deception. So in World War II as well, like armies deployed decoys so that they can, you know, create uncertainty in the decisions that their enemies are making. So similar approach was being used by attackers all the time.

Like they were trying to falsify signatures, use phishing attacks all the time. And so they were using deception. Then I think very recently this cyber deception is being used by cyber defenders. Although honey bots were existing from years and mostly honey bots were being used to lure attackers so that honey bots or deception was being used such as like you create such an object which is very interesting for attacker and instead of going to real targets, attacker come up on the honey bots, for example.

So that was kind of ambition that can we deviate attackers from the real target and give them something fake, which is not valuable for defender. But strategically, we gain information. So that was the concept of cyber deception. And our team has been using like a cyber deception, you know, studying the basic questions, basically.

How to deceive attackers? attackers, what are the vulnerabilities in human behavior that we can approach and exploit. So for example, humans have certain kind of biases for say confirmation bias. Okay, I believe that this looks like this, this is a real machine.

So I have to convince attackers that yes, this is a real machine. How do I do that? That's the research question. And And similarly, we also study that how much deception to use because human behavior works on trust.

If we trust other things, then we become easy in decision making. But once we build this trust and then betray, that's more effective. So using the similar approach that how to build trust and then betray attackers trust so that we can convince them to fall for our strategy. And then looking at how to make deception more effective in the sense what features of systems can be used in creating deception.

And to understand all of these factors, our lab study in a controlled environment. So we manipulate some of the factors and understand how attackers are making decisions in such scenarios. So to do this, we basically conduct our experiments using testbeds like we have HackIt and CyberVan, which are being used. Also, we have other games which are binary choice games or multiple choice games.

But those games are kind of simple. simple, but we also have more complicated games like HackIt and CyberBand testbed, which is more complex and close to real environment. So using those testbeds, we deploy our experiments. But the technology, like the optimal defense algorithms that are coming to us from our collaborators, for example, we work with Professor Milan Dambe at Harvard University.

So their team is expert in developing defense algorithms using game theory algorithms. So we deploy these strategies on our platform and then hire human attackers to communicate with our scenarios and understand. Yeah.

Jeremy Boren: Are those real hackers or are they kind of like test? Like who is actually testing?

Palvi Aggarwal: So our experiments, we are not using like pen testers per se. So we are hiring mostly anyone who is interested. So we are trying to publicize on social media platforms and taking a kind of cyber security quiz that if they can pass that quiz, we hire them to conduct our experiments. So most of the participants are kind of university students who are taking courses in network security.

Jeremy Boren: Interesting. Okay. Yeah. So what were some of the surprising findings or learnings that you gained along the way while you were doing the experiments and research?

And I know it's still ongoing as well.

Palvi Aggarwal: Yeah. Yeah. Yeah. I would just focus on major lessons that we learned so far.

So we have been using different kind of deceptions like signaling, masking, decoying. So those are the major categories which we have been working on. So one of the lessons that we learned was that all the optimal algorithms usually think that attackers are rational, like they will be making optimal decisions and go for the best possible outcome. But what we learned through human experimentation and human behavior that attackers are not optimal.

So they are boundedly rational. So they have certain kinds of biases. Like they are sometimes risk averse. They have certainty bias.

Going for short option is one of their strategy and they have confirmation bias in their decision making. So with those biases in humans, they are deviating from optimal decisions and going for suboptimal solutions rather than going for best possible outcome. outcome. And so that's the major learning.

And integrating those learnings into our defense algorithms is the key finding that don't consider attackers are optimal. Consider these biases and suboptimal solutions in your algorithms.

Jeremy Boren: Well, that's the advantage of what you're studying because rather than assuming that somebody is going to go for an optimal strategy, you realize that they're not, and then you can calibrate that. And the whole idea is to make a bad actor waste their time, right? Waste their time, resources, and energy working on something that has no value in the end anyway, to them anyway.

Palvi Aggarwal: That's right. And another thing I think is very important to learn is that static solutions would be exploited very fast. If you deploy one strategy and you are not changing that strategy, attackers would learn it very fast. So your defense and your strategies should be adaptive.

So our team has been working on cognitive models. So cognitive model is basically a representation of a bad actor, per se, the attacker in a model form, which is kind of learning the process of decision making and try to replicate that. So using these cognitive models, what you can learn is you can predict what attackers would do in such situations and adapt your defense algorithms. I think that that's another key finding of our research, that adaptive and personalized defense would always work the best.

Jeremy Boren: Absolutely. I totally, totally agree with not wanting to be static. And obviously, you know, if you're creating a strategy, you want to have many layers. Why would a company be interested in studying and learning about deception technology as a way to protect their resources?

Palvi Aggarwal: I guess one thing I have seen is like this is a preventive action. Basically, usually what sometimes happens with intrusion detection systems or other technology, you get an alert once things are done. done or you need some markers that, okay, once the damage is done, then you learn about some patterns. But with deception, I think the major point is you try to deceive during the reconnaissance process.

That's the major thing. When attackers are learning about the information, you try to deceive and deviate them. So that's the key that why deception is important. And that can buy time to the companies or defenders in terms of understanding those patterns, what attackers are interested in and what kind of vulnerabilities your system might have.

So that's a key thing. I think by time, it's less costly in the sense that, for example, I take signaling. So in signaling strategy, you are not actually deploying anything. You are just sending a marker or a message to attacker, okay, this might be protected.

So that's very simple in the sense. But if you implement that effectively, I think that saves cost and also saves your target.

Jeremy Boren: And you mentioned reconnaissance. Can you expand on that? That's an early stage, right, in what an attack, I guess, posture would be, right?

Palvi Aggarwal: Yeah. So reconnaissance would be, I would say, the first phase where attacker is kind of learning what kind of network infrastructure do you have, what kind of operating system you are running, ports you are having, and try to gain this information and find out vulnerabilities. vulnerabilities so if you fake your systems that time if you deploy decoys or you use masking like hide the real features then you are kind of invalidating the learning that attacker has so whatever attacker learns he has partial information or imperfect information in that way and if he's not gathering perfect information then the chance of being successful in later stages would be known. So that's the advantage of using deception early on, I would say.

Jeremy Boren: Absolutely. What got you interested in deception technology?

Palvi Aggarwal: Sure. That's an interesting question. So I was into information security in Masters. I was learning all about intrusion detection system, more technological part.

But there was, like, Like we were also studying social engineering attacks. I think from there, I learned a little bit about how easily humans can be, you know, attacked. Like it's a human factor is important. Just by going on a reception, just, you know, talking to a receptionist, you can gain access to a lot of things.

So that's where I was kind of got interested in like human part of cybersecurity. security then I I started the literature survey for my PhD and learned about cyber deception because human can be deceived easily due to our basic intensity of being trusting others so I thought okay if attackers are using like phishing spear phishing those kind of stuff of how defenders could use it effectively. And I saw a lot of examples of honeypots. But again, I think a human factor part of this was kind of missing.

That's how I got into behavioral cyber deception area. That how can we deceive humans?

Jeremy Boren: What's the best way if people want to read your research and learn more about what your team does, where can they learn more?

Palvi Aggarwal: I think you can visit my Google Scholar profile. So if you search also our dynamic decision-making lab. So we have a webpage where we put all the publications. So that would be the best way to reach out to our research.

Jeremy Boren: On CMU site, right? The dynamic Distribution Making Lab. Excellent.

Palvi Aggarwal: Yeah, sure. Yeah, I can provide you links as well.

Jeremy Boren: For sure. Well, Pavi, thank you so much for taking us through your research and Deception Tech. I think it's a fascinating area of study.

Palvi Aggarwal: Right. Yeah. Thank you, Jeremy. It was fun.

Jeremy Boren: Special thanks to our guest today, Pavi Agarwal from Carnegie Mellon University. If you want to learn more about deception technology and Gray Matters Solution Deception Guard, visit us online at www.graymattersystems.com. And don't forget, rate and review us wherever you listen to your podcasts.