Operating System Fingerprint Forgery with Data-Plane Programming for Network-level Cyber Deception and Adversary Engagement

We present a novel application of Data-Plane Programming technology and the Programming Protocol-independent Packet Processors (P4) framework for deceiving and engaging adversaries-in-the-middle who are performing reconnaissance in a compromised network. DPP and P4 enable "programmable" network switches to manipulate and edit the auxiliary, non-payload contents of traffic packets to reveal or hide indicators of host vulnerability that an adversary carrying out reconnaissance may find enticing. This approach targets manipulation of real, existing network traffic to deceive adversaries and methodically present a distorted state of the network's orientation and configuration. In this paper, we present a novel scheme of manipulating TCP/IP packet header structures within the network fabric itself to forge a packet's operating system fingerprint to deceive various operating system fingerprinting tools such as p0f, Ettercap, and Nmap.