# Hydrakon, a Framework for Measuring Indicators of Deception in Emulated Monitoring Systems
## 6 Proposed Method
### Implementation
Next, we access \"Manage EMS Security Tools\" where we perform tasks such as setting up the specific security tool on the client and accessing the Security tool located on the client. The security tools we set up for this experiment include virtual machines such as VirtualBox, VMware and KVM. Sandboxes such as Flarevm and a custom sandbox containing a subset of analysis tools were set up. Phase 5. Test EMS Deception Level  
In this phase, we perform the task of extracting artifacts from a target. The first step is to extract artifacts from several client real machines, which will represent the \"ground truth\". The ground truth serves as a baseline or reference point for the purpose of comparing and assessing observations, measurements, or forecasts. The security analyst chooses whether to extract artifacts from a Microsoft Windows client or a Linux client. This will present a list of available clients with the type of operating system chosen. The controller extracts the artifacts from the selected clients and stores them locally for further processing. The next step is to extract artifacts from the security tool that was previously set up. This time, the controller extracts the security tool artifacts to be stored locally on the controller. The third step is to process the artifacts using Natural Language Processing to determine the deceptive ability of the security tool. The final step displays a graph to compare the similarity between the security tool and a real machine. The final step is to access the \"Test EMS Evasive Vectors\" module to extract data from the clients, that will be used as the baseline against the EMS security tools. Then, data are extracted from the specified environment and sent to the EMS controller to be processed and to allow us to perform tests to determine the deceptive capability of the security tools. In this experiment, we extracted data from two clients running Windows 10 Enterprise evaluation OS that will represent the base data set of a real system. Data are then extracted from VirtualBox, VMware and KVM to represent data from virtual machines. Sandbox data are also extracted from Flarevm and a custom sandbox. We filter the data extracted from these environments to include only relevant data that we refer to as artifacts. These artifacts related to the Windows 10 OS environment are stored in csv files based on the categories listed in Table 1.  
The EMS evasive vectors workflow in Figure 6 displays the process the EMS controller performs to test the similarity of target systems by applying the cosine similarity metric. The first step involves propagating evasive vectors from the EMS controller to the client real machines running Windows 10 OS. Next, the same procedure occurs with target systems running various virtual machines. The third step applies evasive vectors against target systems running different configured sandboxes. Each evasive vector category extracts artifacts from all targets and returns the artifacts in the form of csv files for the specific category. For example, Process P1 relates to artifacts retrieved from real machine 1's process category and Services 3 relates to artifacts retrieved from the VirtualBox virtual machine's services category. To determine the similarity score between two target systems, we apply cosine similarity to each artifact category and measure the degree of similarity. For example, we take the list of Process P1 and the list of Process P2 and construct term frequency vectors where each element represents the occurrence of a specific Windows process (e.g., svchost.exe, explorer.exe, csrss.exe). The cosine similarity is then calculated as:  
\[\cos(\theta)=(\text{P}_{1}\cdot\text{P}_{2})/(\mid\text{P}_{1}\mid\mid\mid\text {P}_{2}\mid\mid)\]  
When applied to all artifact categories of each target system, we are able to determine how similar each target system is to another target system. The more dissimilar the target system, the higher the probability that it is an EMS security tool.