PROJECT TITLE :

Blockchain-enabled Intrusion Detection and Prevention System of APTs within Zero Trust Architecture

ABSTRACT:

The traditional mentality of defending the network perimeter is no longer adequate in today's world, in which businesses are increasingly adopting new ways of working with information technology, such as the Bring Your Own Device (BYOD) and remote working models. Zero Trust Architecture, also known as ZTA, is a relatively new security model that predominates a breach mindset in its threat model. Any endpoint (that is, device), user, or application is presumed to be untrustworthy by the ZTA until it can be proven otherwise, even if it was trusted previously. Attackers can still take control of an authenticated and authorized session through the endpoint, even after it has been proven by Advanced Persistent Threats (APT). This is possible even after the endpoint has been proven. As a result, they are able to carry out a variety of malicious activities that are centered on the user or the device in addition to engaging in lateral movement, which makes the endpoint the Achilles' heel of ZTA. This work proposes a Blockchain-enabled Intrusion Detection and Prevention System (BIDPS) that augments ZTA onto endpoints in order to effectively deter APT attack capabilities on the endpoints. The BIDPS has two primary objectives: first, to identify and thwart the strategies and methods used by attackers in accordance with MITRE's ATT&CK enterprise matrix earlier than the stage of lateral movement; and second, to remove trust from the endpoint itself and place it on-chain, thereby producing an immutable system of explicit trust. Both of these goals are intended to be accomplished. In order to determine how effective the BIDPS is, a testbed was developed in which over ten different types of advanced persistent threats (APTs) were used to attack an endpoint. Due to the immutability of its Blockchain, which strengthens the detection and prevention processes, BIDPS has a high rate of success when defending itself against attacks that have been launched against it.