SCALING NETWORK TARPITS FOR IPV6

Abstract

Cyberspace is vital to the application of joint military operations, to the advancement of economic growth, and to the enhancement of day-to-day life. As such, its defense is critical, yet its defense is also difficult, largely due to malicious actor persistence and weaknesses inherited from the cyber domain's initial development. This research proposes and tests an extension to a network tarpit, Greasy, a cyberspace defense tool, enabling reduced state requirements, adding new tarpit behavior, and maintaining its deception capability in both Internet Protocol version 4 and Internet Protocol version 6 environments. These modifications are hypothesized to enable Greasy's operation at scale in the much larger address space of Internet Protocol version 6, thereby sustaining its relevance for years to come. The results also support an improvement in Greasy's overall capabilities. Greasy is effective at slowing network reconnaissance attempts and using a deception scheme that alters the responsive areas of networks on which it is operating. Based on the findings, continued development of the tool to refine it for deployment in defensive cyberspace operations is recommended.