Paper2023
Material reviewed: AbstractThe work proposes a decision support system based on a Bayesian belief network to guide cyber deception strategies from a detailed model of attacker beliefs, illustrated with a case study using passively observed operating system fingerprinting data. The authors compare the model's prediction accuracy with a sequential artificial neural network and introduce a deception algorithm to select a minimal set of features whose modification would make a system appear as a different operating system.
EndpointNetworkDecoy
Paper2023
Material reviewed: AbstractThe work describes the deployment of an ensemble of research honeypot detectors to analyze and evaluate attackers' behavior. The authors present an outline of a containerized cloud honeypot deployment that they state is portable, durable, and simple to deploy and administer, and they describe instrumented monitoring that generated data points from which inferences about malicious users' activities and purpose could be drawn.
CloudNetworkHoneypotDecoy
Paper2023
Material reviewed: AbstractThe authors present a method for selecting cyber deception strategies using a multi-stage Flipit game, aiming to account for defense timing alongside spatial strategy selection. The approach constructs a spatiotemporal decision-making model, introduces a discount factor and transition probabilities, and applies a Proximal Policy Optimization algorithm to compute defender strategies.
NetworkDecoyMoving target defense
Paper2023
Material reviewed: AbstractThe authors propose a signaling game framework between a defender and an insider human agent, using quantum decision theory to exploit cognitive biases and counter insider attacks. The defender deceives the attacker by luring them toward decoy sensors via generators that produce perceptions of classical signals. According to the authors, results show that strategically designed generators can worsen the attacker's ability to identify decoys compared to schemes without generators.
IdentityDecoyAdversary engagement
Paper2023
Material reviewed: AbstractThe authors present HoneyEVSE, a honeypot designed to simulate Electric Vehicle Supply Equipment (EVSE) within the Vehicle-to-Grid paradigm. The system emulates the charging process and login pages with high fidelity to increase attacker engagement. They exposed the honeypot for 30 days on the Internet and report it successfully evaded the Shodan Honeyscore metric while attracting numerous interactions.
IoTOT/ICSHoneypotDecoy
Paper2023
Material reviewed: AbstractThe authors propose a game-theoretic approach for optimal honeypot allocation in tactical networks with dynamic connectivity. They model a two-player dynamic game accounting for future network state evolution, aiming to maximize the attacker's likelihood of hitting a honeypot while minimizing reconfiguration costs. They present an iterative algorithm to find Nash equilibrium strategies and evaluate its scalability through simulations.
NetworkHoneypotDecoy
Paper2023
Material reviewed: AbstractThis report reviews the concepts and types of honeypots, which organizations use as decoy networks to lure attackers, and discusses challenges of deploying them along with advantages and disadvantages.
NetworkHoneypotDecoy
Paper2023
Material reviewed: AbstractThe work addresses honeyword generation: fake passwords that accompany the real password (the "sugarword") in a password-cracking detection system, where a honeychecker distinguishes the real password from the fake ones. The authors describe a honeyword generation method based on a proposed discrete salp swarm algorithm (SSA), a bio-inspired metaheuristic, and present the proposed methodology alongside experimental results compared with previous strategies.
IdentityHoneytokenDecoy
Paper2023
Material reviewed: AbstractThe authors propose a ransomware detection method based on behavior and deception, using decoy files and directories to reveal malicious activity. The paper describes a pilot study with Locky.
Decoy
Paper2023
Material reviewed: AbstractThe authors propose a deep learning based method to generate synthetic IoT device traffic flows mimicking real traffic, aiming to improve IoT honeypots against attacker detection. According to the abstract, the generator outperforms prior approaches in remaining indistinguishable from real traffic.
IoTNetworkHoneypotDecoy
Paper2023
Material reviewed: Publisher metadataBibliographic record on deception against autonomous attacks. The abstract and findings still require review.
NetworkDecoy
Paper2023
Material reviewed: AbstractThe authors investigate using ChatGPT to automatically reply to scam emails in order to waste scammers' time and resources through pointless communications. According to the abstract, preliminary results show ChatGPT can decoy scammers.
ApplicationDecoyAdversary engagement
Paper2023
Material reviewed: AbstractThe authors describe symbSODA, an active cyber deception system that analyzes real-world malware using multipath execution to extract Malicious Sub-graphs composed of WinAPIs and map them to ATT&CK tactics and techniques, in order to construct and execute customized deception playbooks. Its stated purpose is to let users create conflict-free deception plans and automate deception orchestration within a deceptive environment.
EndpointDecoyAdversary engagement
Paper2022
Material reviewed: AbstractThe authors propose a cyber deception defense method based on a signal game, aimed at dealing with network intrusions. The work describes a moving target defense (MTD) enhanced deception mechanism and a signal game model with an equilibrium solution method to guide defense strategy selection, evaluated by the authors through experimental results.
NetworkMoving target defenseDecoy
Paper2022
Material reviewed: AbstractAccording to the authors' abstract, this paper uses attack-defense games to examine whether disguising normal servers as honeypots is beneficial. It compares three scenarios with varying levels of deception techniques and concludes, per the authors, that disguising real servers does not always yield better defender rewards and may increase the cost of maintaining normal nodes.
NetworkHoneypotDecoy
Paper2022
Material reviewed: AbstractThis survey reviews twenty-three honeyword (decoy password) based authentication techniques introduced by Juels and Rivest in 2013, which aim to detect server-side threats on password files and notify the administrator when an attacker attempts to exploit a compromised file. The authors compare existing approaches and identify remaining gaps and emergent research opportunities.
IdentityDecoyHoneytoken
Paper2022
Material reviewed: AbstractThis survey reviews and categorizes honey-X-based defense strategies, such as honeypots and honeytokens, which use deception to gather threat intelligence and protect networks. The authors also examine their combination with moving target defense, game theory and machine learning, and outline security quantification, challenges and future directions.
NetworkHoneypotHoneytoken
Paper2022
Material reviewed: AbstractThe paper describes a security framework for multi-cloud environments aimed at diverting an attacker and gaining time to analyze and mitigate intrusions. The proposed mechanism consists of modules for managing the multi-cloud platform, an intrusion detection and prevention system, and honeypots, with detection results compared in a two-phase scenario.
CloudNetworkHoneypotDecoy
Paper2022
Material reviewed: AbstractThe authors summarize and analyze the methods, tactics, and tools adversaries use to conduct reconnaissance activities throughout the attack process, discussing what types of information they seek and how and when they can obtain it. They provide a taxonomy of adversarial reconnaissance techniques categorized by source, as third-party and human- and system-based information gathering, aiming to help understand and model this aspect of cyber attacks and offer insights for improving defensive strategies such as cyber deception.
NetworkDecoy
Paper2022
Material reviewed: AbstractThis paper studies the joint deployment of moving target defense (MTD) and deception against multi-stage cyberattacks. The authors propose a two-step optimization approach to allocate intrusion detectors (observable by the attacker) and stealthy sensors (unobservable), aiming to optimize attack detection rate. They illustrate the method's effectiveness through a cyber defense example.
NetworkDecoyMoving target defense
Paper2022
Material reviewed: Public pageThe paper proposes an intrusion detection framework combining CAPTCHA, honeypots and supervised learning. Honeypots would be integrated into a website to lure malicious software, and the diagram sketches realistic decoy pages and decoy fields.
ApplicationNetworkHoneypotDecoy
Paper2022
Material reviewed: AbstractThis paper introduces TSM (Topic Semantic Matching), a metric based on topic modelling and semantic matching in embedding spaces to measure the enticement of honeyfiles relative to local content. According to the authors, it is the first measure using NLP techniques to quantify this enticement robustly against paraphrasing, supported by a honeyfile corpus built with various NLP methods.
EndpointHoneypotDecoy
Paper2021
Material reviewed: AbstractThe authors propose a defensive deception framework for the container-based cloud, aiming to reveal stealthy attackers by presenting intentionally falsified information. The approach formalizes a System Risk Graph (SRG) as an updatable adversarial model, trains a deep reinforcement learning (DRL) model over the SRG so the agent produces decoy placement and deceptive routing strategies, and defines a coefficient of deception to evaluate the placement strategy.
CloudDecoyAdversary engagement
Paper2021
Material reviewed: Full textVision paper on automated generation of realistic deception artifacts with machine learning.
NetworkIdentityDecoy