Paper2023
Material reviewed: AbstractThe authors describe symbSODA, an active cyber deception system that analyzes real-world malware using multipath execution to extract Malicious Sub-graphs composed of WinAPIs and map them to ATT&CK tactics and techniques, in order to construct and execute customized deception playbooks. Its stated purpose is to let users create conflict-free deception plans and automate deception orchestration within a deceptive environment.
EndpointDecoyAdversary engagement
Paper2022
Material reviewed: AbstractThe authors propose a cyber deception defense method based on a signal game, aimed at dealing with network intrusions. The work describes a moving target defense (MTD) enhanced deception mechanism and a signal game model with an equilibrium solution method to guide defense strategy selection, evaluated by the authors through experimental results.
NetworkMoving target defenseDecoy
Paper2022
Material reviewed: AbstractAccording to the authors' abstract, this paper uses attack-defense games to examine whether disguising normal servers as honeypots is beneficial. It compares three scenarios with varying levels of deception techniques and concludes, per the authors, that disguising real servers does not always yield better defender rewards and may increase the cost of maintaining normal nodes.
NetworkHoneypotDecoy
Paper2022
Material reviewed: AbstractThis survey reviews twenty-three honeyword (decoy password) based authentication techniques introduced by Juels and Rivest in 2013, which aim to detect server-side threats on password files and notify the administrator when an attacker attempts to exploit a compromised file. The authors compare existing approaches and identify remaining gaps and emergent research opportunities.
IdentityDecoyHoneytoken
Paper2022
Material reviewed: AbstractThis survey reviews and categorizes honey-X-based defense strategies, such as honeypots and honeytokens, which use deception to gather threat intelligence and protect networks. The authors also examine their combination with moving target defense, game theory and machine learning, and outline security quantification, challenges and future directions.
NetworkHoneypotHoneytoken
Paper2022
Material reviewed: AbstractThe paper describes a security framework for multi-cloud environments aimed at diverting an attacker and gaining time to analyze and mitigate intrusions. The proposed mechanism consists of modules for managing the multi-cloud platform, an intrusion detection and prevention system, and honeypots, with detection results compared in a two-phase scenario.
CloudNetworkHoneypotDecoy
Paper2022
Material reviewed: AbstractThe authors summarize and analyze the methods, tactics, and tools adversaries use to conduct reconnaissance activities throughout the attack process, discussing what types of information they seek and how and when they can obtain it. They provide a taxonomy of adversarial reconnaissance techniques categorized by source, as third-party and human- and system-based information gathering, aiming to help understand and model this aspect of cyber attacks and offer insights for improving defensive strategies such as cyber deception.
NetworkDecoy
Paper2022
Material reviewed: AbstractThis paper studies the joint deployment of moving target defense (MTD) and deception against multi-stage cyberattacks. The authors propose a two-step optimization approach to allocate intrusion detectors (observable by the attacker) and stealthy sensors (unobservable), aiming to optimize attack detection rate. They illustrate the method's effectiveness through a cyber defense example.
NetworkDecoyMoving target defense
Paper2022
Material reviewed: Public pageThe paper proposes an intrusion detection framework combining CAPTCHA, honeypots and supervised learning. Honeypots would be integrated into a website to lure malicious software, and the diagram sketches realistic decoy pages and decoy fields.
ApplicationNetworkHoneypotDecoy
Paper2022
Material reviewed: AbstractThis paper introduces TSM (Topic Semantic Matching), a metric based on topic modelling and semantic matching in embedding spaces to measure the enticement of honeyfiles relative to local content. According to the authors, it is the first measure using NLP techniques to quantify this enticement robustly against paraphrasing, supported by a honeyfile corpus built with various NLP methods.
EndpointHoneypotDecoy
Paper2021
Material reviewed: AbstractThe authors propose a defensive deception framework for the container-based cloud, aiming to reveal stealthy attackers by presenting intentionally falsified information. The approach formalizes a System Risk Graph (SRG) as an updatable adversarial model, trains a deep reinforcement learning (DRL) model over the SRG so the agent produces decoy placement and deceptive routing strategies, and defines a coefficient of deception to evaluate the placement strategy.
CloudDecoyAdversary engagement
Paper2021
Material reviewed: Full textVision paper on automated generation of realistic deception artifacts with machine learning.
NetworkIdentityDecoy
Paper2021
Material reviewed: AbstractAccording to the authors, this work studies two-sided deception in cybersecurity by manipulating the observable configuration of both honeypots and real machines. Using an experiment with a 40-machine network (20 honeypots) and an experimental testbed, the authors compare three feature-concealment conditions against human attackers.
NetworkHoneypotDecoy
Paper2021
Material reviewed: Public pageThe linked preprint abstract describes DARLH, a honeypot system that uses deep reinforcement learning-based and deep recurrent neural network-based IDS agents to detect internal and external runtime DoS attacks. Its purpose is to provide dynamic intrusion detection and event validation for monitoring DoS attacks in the honeypot environment.
NetworkHoneypotDecoy
Paper2021
Material reviewed: Full textBibliographic record on design thinking for cyber deception. The abstract and findings still require review.
NetworkDecoy
Paper2021
Material reviewed: AbstractThis paper presents an approach to container-based honeypots that simulate container escapes as a deception technique in the context of cloud computing virtualization. According to the authors, it investigates the possibilities of container-based honeypots to imitate legitimate network targets and raise alerts on attacker interactions, allowing study of attacker techniques.
NetworkCloudHoneypotDecoy
Paper2021
Material reviewed: AbstractAccording to the abstract, the authors propose a hypergame framework between an attacker and a defender where each can interpret the situation differently based on asymmetric beliefs, applied to advanced persistent threats (APT) across the cyber kill chain. The work evaluates through simulations how defensive deception strategies can manipulate attacker beliefs.
NetworkAdversary engagementDecoy
Paper2021
Material reviewed: AbstractThis paper is a survey examining defensive deception approaches grounded in game theory and machine learning within cyber defense research. According to the authors, it analyzes key components, underlying principles, and tradeoffs of different approaches across various problem settings. The work compiles insights, lessons, and limitations from prior research and proposes future directions to address existing gaps.
NetworkAdversary engagementDecoy
Paper2021
Material reviewed: AbstractAccording to the authors, HoneyCar is a decision support framework for configuring honeypots in the Internet of Vehicles, based on known vulnerabilities from the NVD/CVE database. The approach models adversarial interaction as a repeated imperfect-information zero-sum game, aiming to compute optimal honeypot configuration strategies for threat intelligence collection.
IoTNetworkHoneypotDecoy
Paper2021
Material reviewed: AbstractThis paper describes the incorporation of deceptive elements, including honeypots and decoys, into Microsoft's CyberBattleSim experimentation platform. According to the authors, they tested the defensive capabilities of these elements against reinforcement-learning-based attackers in a capture-the-flag environment, finding that attacker progress depended on the number and location of deceptive elements.
NetworkHoneypotDecoy
Paper2021
Material reviewed: AbstractThe authors extend their anti-ransomware tool R-Locker to Windows, relying on a honeyfile-based approach in which 'infinite' trap files are disseminated around the target filesystem for early detection and to block ransomware action. The Windows version addresses differences in FIFO handling and adds improved global management of honeyfiles and (semi)automated blocking of suspicious ransomware through the dynamic use of white-/black-lists.
EndpointHoneytokenDecoy
Paper2021
Material reviewed: AbstractThe work addresses the protection of vulnerable components in Internet-of-Things (IoT) networks through an intrusion prevention technique that combines cyberdeception (a decoy system) and moving target defense (network topology shuffling). The authors analytically evaluate effectiveness and efficiency using a graphical security model in an SDN-based IoT network, defining strategies for when and how to perform topology shuffling to pursue goals such as prolonging system lifetime, increasing attack complexity on critical nodes, or maintaining service availability.
IoTNetworkDecoyMoving target defense
Paper2021
Material reviewed: AbstractThis work examines how decoy generation can slow the decision process of automated agents in adversary emulation scenarios. The authors show, according to their study, that the degree of inhibition greatly depends on the types of decoy objects used, pointing to the need to explicitly evaluate decoy generation and placement strategies against fast-moving automated adversaries.
NetworkDecoyAdversary engagement
Paper2021
Material reviewed: Full textBibliographic record on self-adaptive deception. The abstract and findings still require review.
NetworkDecoy