In this paper we have introduced MIDAS, our proposal for a distributed certificate assessment
system intended to thwart advanced Man-in-the-Middle attacks. This system builds on existing
network monitoring and management technologies to provide a pinning-in-the-net approach
enabling hosts to effectively assess the validity of the certificates they encounter during TLS
interactions. The system relies on the existence of a set of network probe located in different
elements of the network (either hosts or switches or routers), a distributed analysis engine based
on Bayesian networks and a reaction subsystem which makes use of SDN technologies.
Right now we have fully implemented the network probes and developed a proof-of-concept
scenario of the complete architecture. Although the system looks promising, there is still
considerable work to be done to build realistic Bayesian networks specifically tailored to realistic
high-sensitive network scenarios. This would result in early detection of suspicious certificates
and would trigger mechanisms to defeat the attack, minimize its impact, and gather information
220
on the attackers. Additionally, a more detailed and thorough analysis could be performed. This
would be achieved through the use of Software Defined Network (SDN) techniques, allowing
a much more accurate and efficient response to man-in-the-middle attacks, and mitigating
damage in highly sensitive communication networks.