# Hydrakon, a Framework for Measuring Indicators of Deception in Emulated Monitoring Systems
## 6 Proposed Method
### Implementation  
In this section, we describe the implementation of the Hydrakon framework to automate the process of setting up, configuring and managing components such as the EMS controller, FOG server, EMS server, EMS clients and EMS security tools. This will allow the framework to test the deceptive capabilities of various virtual machines and sandboxes. There are five phases that are implemented in this experiment:  
**Phase 1. Set Up the EMS Controller**  
The first step involves configuring the EMS controller to set up and manage the EMS server and FOG server. We set up and configured the FOG server to enable capturing images of Windows 10 clients and Linux Ubuntu clients. We install the FOG server on a separate virtual machine with enough capacity of 240 GB of disk space to store all the client images. Next, we set up and configure the EMS server and perform tasks such as generating SSH Authentication keys to allow the EMS controller to communicate with the EMS clients and other security tools such as virtual machines. Once that is carried out, we modify the access.json configuration file to add values such as FOG server IP address and credentials, EMS controller IP details, SSH keys, client and virtual machine credentials and port values. Figure 5: EMS threat evasion methodology showing the phases involved in evaluating an EMS security tool’s deceptive nature. Phase 2. Set Up EMS clients  
The EMS controller automates the process of configuring SSH public key authentication on the client. This allows the security analyst to access the client terminal via SSH or remote desktop to access the client's GUI if available. It also allows the EMS controller to connect to clients and extract data for later processing. An important feature of this phase is the ability to clone clients and deploy a captured image to the client from the FOG server. This enables the security analyst to set up Linux clients with various security tools and revert the client to a clean image for further experimentation. Next, we enter the \"Manage EMS Clients\" module to capture each client image and store it on the FOG server, where the image can be rapidly deployed back to the client at the captured state. We deploy SSH public keys on both Windows and Linux clients to access them without the need for manual entry of credentials. Phase 3. Setup Packer Boxes  
This phase is required to set up a Linux or Microsoft Windows operating system on a virtual machine located on the client. The security analysts are able to download the Operating System ISO from the web and build the Vagrant Box using the Packer imaging tool located on the client. The benefit of this method is that it allows the EMS controller to transfer the role of building images to the clients and ensure it is a leaner system. We move onto the \"EMS Packer Boxes\" module where we can build Windows 10 and Ubuntu vagrant boxes. This is achieved by downloading the Operating System ISO from the Internet and building the Vagrant Box using Packer on the client chosen. The vagrant box is exported back to the EMS controller, where it can be accessed by other clients. The reason behind building the vagrant box on the clients instead of the EMS controller was to avoid installing cumbersome packages on the EMS controller. Phase 4. Setup EMS Security Tools  
To set up a security tool requires the security analyst to choose the menu option \"Manage Security Tool on Client\". The security analyst chooses a client to connect from a list of clients. The controller then connects to the client, in which the client presents a menu of the available security tools to set up. Selecting the specific security tool enables the system to install all necessary dependencies and tools for that security tool on the client. The security analyst has a list of options available such as connecting to the security tool to perform tasks. In the case of virtual machines, the controller is able to connect to the virtual machine using a command line interface or GUI access is available on the virtual machine.