# Hydrakon, a Framework for Measuring Indicators of Deception in Emulated Monitoring Systems
## 4 Hydrakon Framework
### Hydrakon Architecture
#### 4.2.3 EMS Server  
The EMS server virtual machine is set up by installing a Linux-based OS running Ubuntu Desktop 22.04. It has the responsibility of managing the entire EMS ecosystem through an innovative menu-driven system. We have structured the menu in a modular fashion to allow the separation of tasks based on the specific functionality of the module, promoting flexibility in its design. The EMS server is composed of five modules that act as menu items to separate tasks of managing the entire EMS ecosystem. Figure 3 displays the main menu of the EMS Controller. It allows the configuration and management of EMS components such as the EMS Controller, clients representing Win-dows 10 and Linux OS, EMS security tools, Packer boxes are leveraged to build a machine image that is exported as a Vagrant box and the fifth menu choice provides the user with the ability to apply evasive vectors to targets and extract artifacts that are collated and processed to determine the deceptive capability of the EMS security tool. Figure 2: Workflow cloning and deploying clients via FOG server. The modular design allows the modification of individual modules without having an adverse effect on the functioning of the system. It also includes flexibility by allowing future expansion of the Hydrakon framework to include analysis of evasive malware under different EMS security tool configurations. The list of modules includes the following: manage EMS controller, manage EMS clients, manage EMS security tools, manage EMS packer boxes and manage EMS evasive vectors. We will discuss the functionality of each module. Manage EMS Controller Module  
This module allows the configuration of the EMS controller. It contains the following functions:  
Manages physical client host names on the EMS controller by adding, removing and listing hostnames and IP addresses stored in the hosts file on the EMS server. Manages the SSH configuration file on the EMS controller. Manages the configuration files for the user to input their credentials in the EMS ecosystem. Manage EMS Client Module  
This module manages EMS clients consisting of various Microsoft Windows 10 and Linux-based Ubuntu Operating Systems. It contains the following functions:  
Determine what clients are running and accessible from the EMS controller. Automate the deployment of SSH public key authentication on both Linux-based Ubuntu and Microsoft Windows 10 clients. Allows the EMS controller to connect to the client using SSH public key authentication or connect via RDP to the client. Deploys captured image from the FOG server to client. Captures client image and stores it on the FOG server. Powers up the client. Shuts down the client. This module manages and connects to EMS security tools located on EMS clients. One of the main tasks this module provides is the ability to manage different types of virtual machines. We leverage the Vagrant tool [46], an open-source software for automating the creation and management of various virtual machines. Vagrant provides a simple,  
Figure 3: EMS controller main menu. consistent way to create and configure lightweight, reproducible, and portable development environments. It works as a wrapper around virtualization software such as VirtualBox 7.1.4, VMware Workstation Pro 17.0 and KVM kenel version 2.6.32.3. It contains the following functions:  
Manage EMS Packer Boxes Module  
This module manages operating system ISO files and Vagrant boxes and allows building Vagrant boxes on the EMS client. One of the important tasks in this module is the provisioning of Vagrant boxes. To provision a Vagrant box, we leverage Packer [47], an open-source tool designed to automate the creation of Windows 10 OS or Linux-based Ubuntu OS images across multiple platforms from a single configuration file. The tool works by reading a Windows 10 or Ubuntu template file that specifies the builders, provisioners, and post-processors needed to create and configure the desired OS image.