Man-At-The-End attacks: Analysis, taxonomy, human aspects, motivation and future directions

被引:54
作者
Akhunzada, Adnan [1 ]
Sookhak, Mehdi [1 ]
Anuar, Nor Badrul [1 ]
Gani, Abdullah [1 ]
Ahmed, Ejaz [1 ]
Shiraz, Muhammad [1 ]
Furnell, Steven [2 ]
Hayat, Amir [3 ]
Khan, Muhammad Khurram [4 ]
机构
[1] Univ Malaya, Fac Comp Sci & Informat Technol, Ctr Mobile Cloud Comp Res C4MCCR, Kuala Lumpur 50603, Malaysia
[2] Univ Plymouth, Sch Comp Commun & Elect, Informat Secur & Network Res Grp, Plymouth PL4 8AA, Devon, England
[3] COMSATS Inst Informat Technol, Dept Comp Sci, Appl Secur Engn Res Grp, Islamabad, Pakistan
[4] King Saud Univ, Ctr Excellence Informat Assurance CoEIA, Riyadh 11451, Saudi Arabia
关键词
Man-At-The-End; Software protection; Information security; Digital rights management; Digital assets; Distributed software systems; INFORMATION-SYSTEMS SECURITY; POLICY COMPLIANCE; PROTECTION MOTIVATION; DECISION-MAKING; INSIDER THREAT; FEAR APPEALS; DETERRENCE; BEHAVIORS; POWER; OPPORTUNITIES;
D O I
10.1016/j.jnca.2014.10.009
中图分类号
TP3 [计算技术、计算机技术];
学科分类号
0812 ;
摘要
Man-At-The-End (MATE) attacks and fortifications are difficult to analyze, model, and evaluate predominantly for three reasons; firstly, the attacker is human and, therefore, utilizes motivation, creativity, and ingenuity. Secondly, the attacker has limitless and authorized access to the target. Thirdly, all major protections stand up to a determined attacker till a certain period of time. Digital assets range from business to personal use, from consumer devices to home networks, the public Internet, the cloud, and the Internet of Things - where traditional computer and network security are inadequate to address MATE attacks. MATE is fundamentally a hard problem. Much of the extant focus to deal with MATE attacks is purely technical; though security is more than just a technical issue. The main objective of the paper is to mitigate the consequences of MATE attacks through the human element of security and highlight the need for this element to form a part of a holistic security strategy alongside the necessary techniques and technologies. This paper contributes by taking software protection (SP) research to a new realm of challenges. Moreover, the paper elaborates the concept of MATE attacks, the different forms, and the analysis of MATE versus insider threats to present a thematic taxonomy of a MATE attack. The ensuing paper also highlights the fundamental concept of digital assets, and the core protection mechanisms and their qualitative comparison against MATE attacks. Finally, we present state-of-the-art trends and cutting-edge future research directions by taking into account only the human aspects for young researchers and professionals. (C) 2014 Elsevier Ltd. All rights reserved.
引用
收藏
页码:44 / 57
页数:14
相关论文
共 95 条
[1]  
Acquisti A, 2004, ADV INF SEC, V12, P165
[2]  
Adeyemi I.R., 2013, ADV COMPUTATIONAL SC, V225, P293, DOI DOI 10.1007/978-3-319-00951-3_28
[3]   The information security digital divide between information security managers and users [J].
Albrechtsen, Eirik ;
Hovden, Jan .
COMPUTERS & SECURITY, 2009, 28 (06) :476-490
[4]  
Anderson B., 2012, NEURAL CORRELATES GE
[5]  
[Anonymous], 2013 43 ANN IEEE IFI
[6]  
[Anonymous], 2013, P 7 INT C UB INF MAN
[7]  
[Anonymous], 1 INT WORKSH MAN INS
[8]  
[Anonymous], 2013, HDB ASIAN CRIMINOLOG, DOI DOI 10.1007/978-1-4614-5218-8
[9]  
Axelrod CW, 2008, INF SYST CONTROL J, V6, P25
[10]   What hackers learn that the rest of us don't - Notes on hacker curriculum [J].
Bratus, Sergey .
IEEE SECURITY & PRIVACY, 2007, 5 (04) :72-75