Deception Through Cloning against Web Site Attacks

In this study, a deception-based solution to the web site attacks is proposed. No fake entity is created to attract the intruders. The suggested solution involves cloning the web site under attack after the intrusion is detected and diverting the attacker to this cloned web page. Intrusion detection system (IDS) is used for detecting the attacks and Docker is used as the virtualization technology to create the cloned web site. While the intruder is connected to the clone, information is gathered on her/his activities. The system is implemented and tested for different attack types, and performance measurements were carried out. The results show that the system implementation for static pages is feasible and the system performance is not significantly affected.