Paper2019
Material reviewed: Publisher metadataBibliographic record on game theory applied to deception. The abstract and findings still require review.
NetworkAdversary engagement
Paper2019
Material reviewed: AbstractThe authors present an overview of cyber deception games across three environments, extending baseline signaling game models to include evidence via side-channel knowledge acquisition. They analyze deception in binary and continuous information spaces and explore a multi-stage incomplete-information Bayesian game model for defensive deception against advanced persistent threats, using perfect Bayesian Nash equilibrium as the solution concept.
NetworkAdversary engagementDecoy
Paper2019
Material reviewed: AbstractAndrew Bushby's article describes the use of deception technology as a mechanism for active, post-breach defence aimed at luring, detecting and defending against malware and intruders moving laterally within the network. It notes that such approaches come with misconceptions and argues that defences need to move beyond detecting bad activity within an ocean of good activity.
NetworkDecoyAdversary engagement
Paper2019
Material reviewed: AbstractAccording to the authors, this chapter presents three proactive defense schemes against advanced attackers: defensive deception for detection and counter-deception, feedback-driven Moving Target Defense (MTD), and adaptive honeypot engagement. The authors propose strategic learning schemes tailored to different levels of information uncertainty for these strategies.
NetworkHoneypotMoving target defense
Paper2018
Material reviewed: AbstractThis work proposes applying a cyber deception strategy in wireless local area networks, using decoys that are honeypots, to detect and characterize malicious activity such as the evil twin access point. The authors further describe how the same approach can be used to gather attacker activity information and to detect SSL stripping and DNS spoofing attacks.
NetworkHoneypotDecoy
Paper2018
Material reviewed: AbstractThe authors use game theory, including static Bayesian games, signaling games, and multi-stage models, to model defender-attacker interactions in cybersecurity under uncertainty and asymmetric information. Per the abstract, the study examines a case involving Advanced Persistent Threats (APTs) and the Tennessee Eastman process, considering that defenders may employ deception techniques such as honey files and honeypots to create strategic uncertainty for attackers.
NetworkOT/ICSHoneypotHoneytoken
Paper2018
Material reviewed: AbstractThe authors propose a game-theoretic model extending signaling games to include a probabilistic deception detector, applied to the design of defensive deception mechanisms in network security. The work analyzes pooling and partially-separating equilibria depending on detector quality.
NetworkAdversary engagement
Paper2018
Material reviewed: AbstractThe authors propose a partially observable stochastic game framework to model interactions between a fully-observing defender and a partially-observing infiltrator in cybersecurity. They formulate the deception strategy problem as a robust mixed-integer linear program and present a scalable approach using parametric Markov decision processes to compute finite-memory infiltration strategies, illustrating the approach on a network security model.
NetworkAdversary engagementMoving target defense
Paper2017
Material reviewed: AbstractThe authors address the difficulty of distinguishing large-scale non-directional attacks from advanced persistent threats (APTs) and propose implementing honeytokens and honeypots as an intrusion detection system by deliberately placing traps within existing environments. They describe deploying a series of interconnected honeytokens, each with an exploitation difficulty level, to categorize attacks, profile the attacker and steer the execution flow into a maze-like scenario aimed at distracting, gathering forensic evidence and potentially identifying or deterring the attacker.
CloudHoneypotHoneytoken
Paper2017
Material reviewed: AbstractThis paper studies a scenario where a defender uses honeynets for active defense to observe an attacker who has penetrated the network. The authors propose an infinite-horizon Markov decision process over a continuous state space to model when to eject the attacker after gathering information, and analyze the robustness of this policy via a Stackelberg game, with simulations on a conceptual network.
NetworkHoneypotAdversary engagement
Paper2015
Material reviewed: AbstractThe authors propose a game-theoretic model for mechanism design in deception-based defense, applied specifically to honeypots in network defense. They analyze cheap-talk games and an extended version with evidence, where the receiver can detect deception with some probability. According to the authors, the model generalizes traditional signaling games and complete-information games, showing numerically that deception detection can eliminate pure-strategy equilibria.
NetworkHoneypotAdversary engagement
Service—
Material reviewed: Public pageManaged offering DALEO publishes in conjunction with the CounterCraft platform.
NetworkDecoyAdversary engagement
Product—
Material reviewed: Public pageCritical readingPersistent instrumented environments for malware detonation and adversary observation, according to the platform description.
NetworkEndpointDecoyAdversary engagement
Open software—
Material reviewed: Repository documentationSSH tarpit that slowly sends an endless banner to tie up connecting SSH clients while the real SSH server uses another port.
NetworkAdversary engagementDecoy
Open software—
Material reviewed: Repository documentationA Splunk app that analyzes JSON logs from the Cowrie SSH honeypot to provide dashboards and metrics on attacker engagement, aiming to observe behavioral changes when honeypot configuration settings are adjusted.
NetworkHoneypotAdversary engagement
Open software—
Material reviewed: Repository documentationRuby on Rails gem plugin documenting honey traps and configurable responses to detect and respond to malicious behavior in an application.
ApplicationDecoyAdversary engagement
Open software—
Material reviewed: Repository documentationMedium-interaction SSH honeypot that simulates users and a shell to observe attacker commands; it documents downloading requested files to a separate directory for analysis.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationHoneypot for detecting and interacting with web application exploitation attempts. Its documentation describes backend-managed sensors and static, scripted, or AI-assisted responses.
ApplicationHoneypotAdversary engagement
Framework or guide—
Material reviewed: Public pageCritical readingFramework for planning and communicating denial, deception and adversary engagement.
NetworkCloudAdversary engagement
Open software—
Material reviewed: Repository documentationFraud-detection tool that receives attempted calls and SIP probes, recording source IPs and dialed numbers for alerts and lookup. Its deception link is allowing and observing those attempts.
NetworkAdversary engagement
Open software—
Material reviewed: Repository documentationModified OpenSSH daemon that forwards commands to Cowrie to interpret interactions and log brute-force attacks and SSH sessions.
NetworkHoneypotAdversary engagement
Open software—
Material reviewed: Repository documentationGo-based SSH honeypot with a fake shell and virtual filesystem; its documentation describes session recording, SFTP/SCP transfers, and JSON activity logs.
NetworkHoneypotAdversary engagement
Product—
Material reviewed: Public pageCritical readingCommercial platform using decoys for detection and threat intelligence, according to CounterCraft.
NetworkCloudDecoyAdversary engagement
Paper—
Material reviewed: AbstractThe thesis proposes an authentication framework combining multi-factor authentication with honeytoken-based deception techniques. It describes three successive architectures: static honeytokens to improve detection of compromised credentials, the 2FHA mechanism combining one-time passwords (Google Authenticator) with honeytokens, and a final architecture with session-bound honeytokens, blockchain-supported auditing, and smart contracts on Ethereum.
IdentityApplicationHoneytokenDecoy