Minimizing Internal Data Theft in Cloud Through Disinformation Attacks

Abstract: Cloud computing has changed the way computing takes place significantly. It is a new computing model which enables parties to make use of its services such as Infrastructure as a Service (IaaS), Software as a Service (SaaS) and Platform as a Service (PaaS) in pay per use fashion. The users of cloud computing need not to indulge in huge capital investments as the resources are made available by cloud service providers. There are security challenges in cloud computing. One such challenge is data theft attacks. The existing mechanisms such as encryption are not able to present insider data theft attacks. Recently Stolfo et al. presented a mechanism to prevent insider data theft attacks using offensive decoy technology. In this paper we implement this technology by building a web based prototype that demonstrates the efficiency of the decoy technology. When the application suspects unauthorized access it throws challenges besides launching disinformation attack using decoy information. This prevents insider theft. The empirical results revealed that the mechanism is capable of providing security against insider data theft attacks.

Keywords: Encryption, decoy technology, decoy information