Blockchain-Enabled Intrusion Detection and Prevention System of APTs Within Zero Trust Architecture

Lampis Alevizos, Max Hashem Eiza, VINH-THONG TA, Qi Shi, Janet Read

Research output: Contribution to journalArticle (journal)peer-review

10 Downloads (Pure)

Abstract

In a world where organisations are embracing new IT working models such as Bring Your Own Device (BYOD) and remote working, the traditional mindset of defending the network perimeter is no longer sufficient. Zero Trust Architecture (ZTA) has recently emerged as a new security model in which the breach mindset dominates the threat model. By default, the ZTA considers any endpoint (i.e., device), user, or application to be untrusted until proven otherwise. Nonetheless, once proven by the endpoint, using Advanced Persistent Threats (APT), attackers can still take over an authenticated and authorised session via that endpoint. Therefore, they can perform several user/device centric malicious activities in addition to lateral movement rendering the endpoint the Achilles heel of ZTA. To effectively deter APT attack capabilities on the endpoints, this work proposes a Blockchain-enabled Intrusion Detection and Prevention System (BIDPS) that augments ZTA onto endpoints. The BIDPS aims to achieve two core outcomes: first, detect and prevent attackers’ techniques and tactics as per MITRE’s ATT&CK enterprise matrix earlier than the lateral movement stage, and secondly, strip trust out of the endpoint itself and place it on-chain, thus creating an immutable system of explicit trust. To evaluate the effectiveness of the BIDPS, a testbed was built where techniques of over ten APTs attacks were launched against the endpoint. BIDPS has a high rate of success defending against the launched attacks owing to its Blockchain’s immutability, fortifying the detection/prevention processes.
Original languageEnglish
Article number10
Pages (from-to) 89270 - 89288
Number of pages19
JournalIEEE Access
Volume10
Early online date18 Aug 2022
DOIs
Publication statusPublished - 29 Aug 2022

Keywords

  • Advanced persistent threats
  • blockchain
  • endpoints
  • intrusion detection
  • intrusion prevention
  • security
  • zero trust

Research Centres

  • Data & Complex Systems Research Centre

Fingerprint

Dive into the research topics of 'Blockchain-Enabled Intrusion Detection and Prevention System of APTs Within Zero Trust Architecture'. Together they form a unique fingerprint.

Cite this