Paper2022
Material reviewed: Full textIn the simulated scenarios, more decoys reduced the attacker agent’s episode win percentage and increased the steps needed to win.
NetworkAdversary engagement
Paper2022
Material reviewed: AbstractAccording to the authors' abstract, this paper uses attack-defense games to examine whether disguising normal servers as honeypots is beneficial. It compares three scenarios with varying levels of deception techniques and concludes, per the authors, that disguising real servers does not always yield better defender rewards and may increase the cost of maintaining normal nodes.
NetworkHoneypotDecoy
Paper2022
Material reviewed: AbstractThis study examines how the proportion of honeypots deployed in a network influences an adversary's decisions, using a deception game with two consecutive stages: probe and attack. Participants were randomly assigned to conditions with small, medium, or large honeypot proportions, and the authors report that as the honeypot proportion increased, honeypot-directed and no-attack actions increased dramatically.
NetworkHoneypotAdversary engagement
Paper2022
Material reviewed: AbstractThis work models attacker-defender engagements as Markov Games to understand human adversarial behaviors and optimize defensive strategy. The authors validate their approach using a Capture-The-Flag (CTF) setup and user studies across varying skill levels. According to the authors, application-level deceptions are an optimal mitigation strategy against targeted attacks, outperforming classic defensive maneuvers, and they present an analysis of attacker behavior when trapped in an embedded honeypot environment.
ApplicationHoneypotAdversary engagement
Paper2021
Material reviewed: AbstractThe authors present a low-cost honeypot capable of blocking commands or replying with insults to attackers, modeling the attacker-defender interaction as a Bayesian two-player game. According to the abstract, three honeypot instances were deployed and over 200 sessions were captured for a qualitative analysis of post-exploitation behavior.
NetworkHoneypotAdversary engagement
Paper2021
Material reviewed: AbstractThe authors propose a defensive deception framework for the container-based cloud, aiming to reveal stealthy attackers by presenting intentionally falsified information. The approach formalizes a System Risk Graph (SRG) as an updatable adversarial model, trains a deep reinforcement learning (DRL) model over the SRG so the agent produces decoy placement and deceptive routing strategies, and defines a coefficient of deception to evaluate the placement strategy.
CloudDecoyAdversary engagement
Paper2021
Material reviewed: AbstractAccording to the abstract, the authors propose a hypergame framework between an attacker and a defender where each can interpret the situation differently based on asymmetric beliefs, applied to advanced persistent threats (APT) across the cyber kill chain. The work evaluates through simulations how defensive deception strategies can manipulate attacker beliefs.
NetworkAdversary engagementDecoy
Paper2021
Material reviewed: Publisher metadataBibliographic record on game-theoretic deception models. The abstract and findings still require review.
NetworkAdversary engagement
Paper2021
Material reviewed: AbstractThis paper is a survey examining defensive deception approaches grounded in game theory and machine learning within cyber defense research. According to the authors, it analyzes key components, underlying principles, and tradeoffs of different approaches across various problem settings. The work compiles insights, lessons, and limitations from prior research and proposes future directions to address existing gaps.
NetworkAdversary engagementDecoy
Paper2021
Material reviewed: AbstractThis paper discusses methods for improving the realism and ecological validity of AI used for autonomous cyber defense, exploring the use of Inverse Reinforcement Learning (IRL) to understand attacker actions and utilities that cyber deception could thwart. According to the authors, the Tularosa study provides experimental data on real-world attacker techniques and tools that can inform autonomous defense systems.
Adversary engagement
Paper2021
Material reviewed: AbstractAccording to the authors, this paper proposes an approach to generate realistic user activity on IT systems, combining deterministic and deep learning-based methods through an external agent instrumented on each machine. The aim is to improve the credibility of attacker analysis platforms, such as honeynets, and facilitate the creation of coherent scenarios.
NetworkEndpointHoneypotAdversary engagement
Paper2021
Material reviewed: AbstractThis work reviews the literature on using reinforcement learning (RL) as a feedback architecture for cyber-resilient mechanisms. The authors discuss resilience against posture-related, information-related, and human-related vulnerabilities, introducing three application domains: moving target defense, defensive cyber deception, and assistive human security technologies. They also examine vulnerabilities of RL itself to attacks on rewards, state observations, and action commands.
NetworkMoving target defenseAdversary engagement
Paper2021
Material reviewed: AbstractThis work examines how decoy generation can slow the decision process of automated agents in adversary emulation scenarios. The authors show, according to their study, that the degree of inhibition greatly depends on the types of decoy objects used, pointing to the need to explicitly evaluate decoy generation and placement strategies against fast-moving automated adversaries.
NetworkDecoyAdversary engagement
Paper2020
Material reviewed: AbstractAccording to the authors, this paper presents an attack that partially breaks a defense that injects 'honeypots' into neural networks to detect adversarial attacks. They report reducing the detection true positive rate to 0% and detection AUC to 0.02 while maintaining original distortion bounds, and note that the original defense authors later amended it to mitigate the attack.
ApplicationHoneypotAdversary engagement
Paper2020
Material reviewed: AbstractThe authors propose a formal-methods approach to synthesize reactive defense strategies in networks equipped with decoy systems. They generalize attack graphs to incorporate defender countermeasures in an attack-defend game model, and introduce a class of hypergames to model asymmetric information created by decoys. According to the authors, this framework enables synthesis of effective defense strategies exploiting the attacker's misperception.
NetworkDecoyMoving target defense
Paper2020
Material reviewed: AbstractThis paper, according to its authors, presents an adaptive agent that uses active deception to recognize a cyber attacker's intent, modeling the problem as a two-agent sequential decision process via factored I-POMDPs. The authors describe using honeypots and decoys across multiple attack phases to refine predictions about attacker behavior, rather than merely delaying or confusing attackers.
NetworkEndpointHoneypotDecoy
Paper2020
Material reviewed: AbstractThis paper addresses the synthesis of active deception strategies in networks using two-player games with asymmetric information and temporal logic objectives, incorporating decoy systems and high-fidelity honeypots. The authors use a level-2 hypergame framework to model the attacker's incomplete perception and assess whether the defender can guarantee security properties.
NetworkDecoyHoneypot
Paper2019
Material reviewed: AbstractThe article discusses how cyber deception can change an attacker's perception of the network environment and lead attackers to false beliefs about which systems contain critical information. The authors introduce game theory models and discuss techniques combining artificial intelligence algorithms with those models to estimate hidden states of the attacker using feedback through payoffs, in order to learn how best to defend the system using cyber deception.
NetworkDecoyAdversary engagement
Paper2019
Material reviewed: Publisher metadataBibliographic record on cyber deception games. The abstract and findings still require review.
NetworkAdversary engagement
Paper2019
Material reviewed: Publisher metadataBibliographic record on game theory applied to deception. The abstract and findings still require review.
NetworkAdversary engagement
Paper2019
Material reviewed: AbstractThe authors present an overview of cyber deception games across three environments, extending baseline signaling game models to include evidence via side-channel knowledge acquisition. They analyze deception in binary and continuous information spaces and explore a multi-stage incomplete-information Bayesian game model for defensive deception against advanced persistent threats, using perfect Bayesian Nash equilibrium as the solution concept.
NetworkAdversary engagementDecoy
Paper2019
Material reviewed: AbstractAndrew Bushby's article describes the use of deception technology as a mechanism for active, post-breach defence aimed at luring, detecting and defending against malware and intruders moving laterally within the network. It notes that such approaches come with misconceptions and argues that defences need to move beyond detecting bad activity within an ocean of good activity.
NetworkDecoyAdversary engagement
Paper2019
Material reviewed: AbstractAccording to the authors, this chapter presents three proactive defense schemes against advanced attackers: defensive deception for detection and counter-deception, feedback-driven Moving Target Defense (MTD), and adaptive honeypot engagement. The authors propose strategic learning schemes tailored to different levels of information uncertainty for these strategies.
NetworkHoneypotMoving target defense
Paper2018
Material reviewed: AbstractThis work proposes applying a cyber deception strategy in wireless local area networks, using decoys that are honeypots, to detect and characterize malicious activity such as the evil twin access point. The authors further describe how the same approach can be used to gather attacker activity information and to detect SSL stripping and DNS spoofing attacks.
NetworkHoneypotDecoy