# Hydrakon, a Framework for Measuring Indicators of Deception in Emulated Monitoring Systems
###### Abstract  
The current cybersecurity ecosystem is proving insufficient in today's increasingly sophisticated cyber attacks. Malware authors and intruders have pursued innovative avenues to circumvent emulated monitoring systems (EMSs) such as honeypots, virtual machines, sandboxes and debuggers to continue with their malicious activities while remaining inconspicuous. Cybercriminals are improving their ability to detect EMS, by finding indicators of deception (IoDs) to expose their presence and avoid detection. It is proving a challenge for security analysts to deploy and manage EMS to evaluate their deceptive capability. In this paper, we introduce the Hydrakon framework, which is composed of an EMS controller and several Linux and Windows 10 clients. The EMS controller automates the deployment and management of the clients and EMS for the purpose of measuring EMS deceptive capabilities. Experiments were conducted by applying custom detection vectors to client real machines, virtual machines and sandboxes, where various artifacts were extracted and stored as csv files on the EMS controller. The experiment leverages the cosine similarity metric to compare and identify similar artifacts between a real system and a virtual machine or sandbox. Our results show that Hydrakon offers a valid approach to assess the deceptive capabilities of EMS without the need to target specific IoD within the target system, thereby fostering more robust and effective emulated monitoring systems. artifact; detection vector; evasive vector; emulated monitoring systems (EMSs); honeypot; indicators of deception (IoDs); operating system (OS); sandbox; security tool; virtual environment; virtual machine (VM) +
Footnote †: journal: _Future Internet_  
introhers [10]. Some of the techniques to reduce the number of IoD in EMS are CPU ID masking, registry modification, process list spoofing and realistic file system manipulation. Further tools have been developed by security researchers to mitigate the exposure of IoD in virtual machines and sandboxes. InviZZzible [11] evaluates the virtual environment for its evasive capabilities and includes some remedies to mitigate IoD exposure. VMCloak [12] automatically creates a Windows virtual machine and applies some system and hardware configuration settings inside the virtual machine to cloak its presence from evasive malware. To support the ongoing battle with mitigating threat actors and malware evasive tactics, the security community has developed tools to assist security researchers in detecting IoD in emulated monitoring systems. This will provide a means to conceal IoD in emulated monitoring systems from detection by threat actors and malware. Paranoid Fish (pafish) [13] is such a tool that detects the presence of emulated monitoring systems such as sandboxes and virtual machines. It employs a number of evasive techniques to test the EMS security tool's deceptive nature. Al-Khaser [14] is a security application that applies common malware tactics to evade the emulated monitoring system. VMDE Project [15] provides methods to detect execution in a controlled environment such as a sandbox or virtual machine. However, these tools require searching for specific IoD on target systems that only employ sandboxes and virtual machines. Other tools and techniques are required to reveal the presence of honeypots. The task of setting up an analysis environment for the purpose of malware analysis and intruder monitoring requires time, knowledge and manual configuration of the analysis environment. There have been attempts at automating malware analysis environments focusing on real machines (bare-metal) [16; 17], virtual machine and sandbox deployment [18; 19; 20; 21], various automated honeypot deployment methods [22; 23; 24; 25; 26] and automating anti-debugging techniques [27]. However, these solutions focus on a particular subset of EMS security tools for malware analysis, malware evasive tactics and threat actor access.