Countermeasure Method Against Unauthorized and Anonymous Information System Data Collection

In this paper, we describe the problematics of the network security in corporate networks. We study the vulnerability of existing information system to unauthorized identification and analysis of the object's properties. We consider one of the professional hacking strategies performed during the stage of gathering information about the target system using anonymization technology (protected virtual channels, overlay technology and networks). We propose an original countermeasure method against such unauthorized analysis. The scientific novelty of the work is identifying and profiling the intruders who use anonymization technology for malicious activity by compiling attack vectors based on a number of parameters: anonymization network type, network address space, networks address pool exhaustion level, passive or active scanning type (scanning, probing), progress of the scan, correlation of parameters due to artificial delays and other factors. This approach is combined with the author's operating system and services falsification method that can work with various services for different hackers. This allows to successfully misinform and profile the attacker at the first stage of the cyberattack, then falsificate the object of the attack and redirect the attacker to the created trap-object. The software implementation of the author's method was successfully experimentally investigated and tested. The target area of application are server solutions that operate based on the TCP/IP Protocol stack.