CyberdeceptionAtlas · Question → testES

Library / Paper

Paper

symbSODA: Configurable and Verifiable Orchestration Automation for Active Malware Deception

The authors describe symbSODA, an active cyber deception system that analyzes real-world malware using multipath execution to extract Malicious Sub-graphs composed of WinAPIs and map them to ATT&CK tactics and techniques, in order to construct and execute customized deception playbooks. Its stated purpose is to let users create conflict-free deception plans and automate deception orchestration within a deceptive environment.

DecoyAdversary engagementEndpoint

What we know

The authors describe symbSODA, an active cyber deception system that analyzes real-world malware using multipath execution to extract Malicious Sub-graphs composed of WinAPIs and map them to ATT&CK tactics and techniques, in order to construct and execute customized deception playbooks. Its stated purpose is to let users create conflict-free deception plans and automate deception orchestration within a deceptive environment.

Evidence limits

Review based only on the Crossref-deposited abstract; the full text was not consulted and the authors' reported results, such as accuracy, recall, or precision figures, were not independently validated.

Reviewed: author abstract. Full-text results were not analyzed.

Sources and provenance

  1. symbSODA: Configurable and Verifiable Orchestration Automation for Active Malware Deception
    abstract · 2026-10-11

Reviewed: 2026-10-13. This record may change when new evidence is found.

RIS · BibTeX