Paper2020
Material reviewed: AbstractThe paper proposes an anti-reconnaissance model for host fingerprints based on virtual nodes. The model constructs periodically reconfigurable virtual nodes to dynamically camouflage host fingerprint information and redirects attack traffic targeting virtual nodes to honeypots; the authors also introduce probabilistic models to examine how parameters such as the number of probes or honeypot mapping rules affect attack success probability, and they describe a prototype using SDN and DPDK intended to verify the model against reconnaissance.
NetworkHoneypotDecoy
Paper2020
Material reviewed: AbstractAccording to the authors, this study proposes a time-expanded random network to model adversarial lateral movement in enterprise networks, along with dynamic cognitive honeypots placed at idle production nodes and honey links disguised as service links. The authors describe an approach aimed at reducing long-term vulnerability through honeypot policies whose location changes randomly.
NetworkHoneypotDecoy
Paper2020
Material reviewed: AbstractThe authors propose an integrated defense technique combining cyberdeception via decoy systems with moving target defense through network topology shuffling, applied to SDN-based IoT networks. According to the abstract, they develop and compare several strategies for deciding when and how to reshuffle network topology in the presence of decoys, analytically evaluating effectiveness through a graphical security model. The authors report that their approach prolongs system lifetime, increases attack complexity, and maintains service availability compared to a network without the technique.
IoTNetworkMoving target defenseDecoy
Paper2020
Material reviewed: Publisher metadataBibliographic record on software diversity for deception. The abstract and findings still require review.
NetworkMoving target defense
Paper2019
Material reviewed: AbstractAccording to the authors, this chapter presents three proactive defense schemes against advanced attackers: defensive deception for detection and counter-deception, feedback-driven Moving Target Defense (MTD), and adaptive honeypot engagement. The authors propose strategic learning schemes tailored to different levels of information uncertainty for these strategies.
NetworkHoneypotMoving target defense
Paper2018
Material reviewed: AbstractThe authors propose a partially observable stochastic game framework to model interactions between a fully-observing defender and a partially-observing infiltrator in cybersecurity. They formulate the deception strategy problem as a robust mixed-integer linear program and present a scalable approach using parametric Markov decision processes to compute finite-memory infiltration strategies, illustrating the approach on a network security model.
NetworkAdversary engagementMoving target defense
Paper2017
Material reviewed: Full textCritical readingGame-theoretic taxonomy distinguishing several forms of defensive deception.
NetworkMoving target defenseHoneytoken
Paper2016
Material reviewed: AbstractThe authors propose an ant colony-based distributed denial of service (DDoS) detection technique that uses roaming virtual honeypots together with a multi-level secure architecture to collect information about intruders at different levels of the network and to limit the spread of the affected area. Detection relies on ant colony optimisation, using pheromone deposits in the considered area, and on a multi-level IP log table, aiming to reduce traffic overhead and wasted bandwidth.
NetworkHoneypotMoving target defense
Paper2016
Material reviewed: AbstractThe paper presents an architecture that extends a previous system for tracking IPv6 addresses discarded by MT6D nodes, adding automation and database integration. According to the authors, the solution can deploy a honeypot on demand in an LXC container based on traffic patterns observed on a discarded address, and it lets an MT6D host query the solution database for activity on its relinquished addresses as a JSON object in order to adjust MT6D scheme parameters; the authors report a proof-of-concept and an analysis of feasibility and scalability.
NetworkHoneypotMoving target defense