Blockchain-Enabled Intrusion Detection and Prevention System of APTs Within Zero Trust Architecture

TLDR

Traditional perimeter defenses are inadequate for modern BYOD and remote work environments, and while Zero Trust Architecture treats all endpoints as untrusted, attackers can still hijack authenticated sessions and exploit endpoints as the Achilles heel of ZTA. This study proposes a Blockchain‑enabled Intrusion Detection and Prevention System (BIDPS) to augment Zero Trust on endpoints, aiming to detect and prevent APT techniques before lateral movement and to shift endpoint trust onto an immutable blockchain. The BIDPS was evaluated in a testbed that launched more than ten APT attack techniques against an endpoint to assess its detection and prevention performance. The BIDPS achieved a high success rate in defending against the launched attacks, demonstrating that blockchain immutability strengthens detection and prevention processes.

Abstract

In a world where organisations are embracing new IT working models such as Bring Your Own Device (BYOD) and remote working, the traditional mindset of defending the network perimeter is no longer sufficient. Zero Trust Architecture (ZTA) has recently emerged as a new security model in which the breach mindset dominates the threat model. By default, the ZTA considers any endpoint (i.e., device), user, or application to be untrusted until proven otherwise. Nonetheless, once proven by the endpoint, using Advanced Persistent Threats (APT), attackers can still take over an authenticated and authorised session via that endpoint. Therefore, they can perform several user/device centric malicious activities in addition to lateral movement rendering the endpoint as the Achilles heel of ZTA. To effectively deter APT attack capabilities on the endpoints, this work proposes a Blockchain-enabled Intrusion Detection and Prevention System (BIDPS) that augments ZTA onto endpoints. The BIDPS aims to achieve two core outcomes: first, detect and prevent attackers' techniques and tactics as per MITRE's ATT&CK enterprise matrix earlier than the lateral movement stage, and secondly, strip trust out of the endpoint itself and place it on-chain, thus creating an immutable system of explicit trust. To evaluate the effectiveness of the BIDPS, a testbed was built where techniques of over ten APTs attacks were launched against the endpoint. BIDPS has proven a high rate of success defending against the launched attacks owing to its Blockchain's immutability, fortifying the detection/prevention processes.