A Game-theoretic Taxonomy and Survey of Defensive Deception for Cybersecurity and Privacy

Abstract

Cyberattacks on both databases and critical infrastructure have threatened public and private sectors. Ubiquitous tracking and wearable computing have infringed upon privacy. Advocates and engineers have recently proposed using defensive deception as a means to leverage the information asymmetry typically enjoyed by attackers as a tool for defenders. The term deception, however, has been employed broadly and with a variety of meanings. In this paper, we survey 24 articles from 2008-2018 that use game theory to model defensive deception for cybersecurity and privacy. Then we propose a taxonomy that defines six types of deception: perturbation, moving target defense, obfuscation, mixing, honey-x, and attacker engagement. These types are delineated by their information structures, agents, actions, and duration: precisely concepts captured by game theory. Our aims are to rigorously define types of defensive deception, to capture a snapshot of the state of the literature, to provide a menu of models which can be used for applied research, and to identify promising areas for future work. Our taxonomy provides a systematic foundation for understanding different types of defensive deception commonly encountered in cybersecurity and privacy.

A dynamic games approach to proactive defense strategies against Advanced Persistent Threats in cyber-physical systems

“…To combat adversarial deceptions where the deceiver is the attacker, a defender can also initiate defensive deception techniques [17] such as perturbations via external noises, obfuscations via revealing useless information, or honeypot deployments. A honeypot which appears to contain valuable information can lure attackers into isolation and surveillance.…”

Dynamic games for secure and resilient control system design

“…They are useful to describe outcomes of different types of interactions among players. For a detailed exposition of basic concepts of equilibrium solutions, we refer the reader to [27], [28]; and for a review of game-theoretic applications to cyber security, we refer readers to [20], [31]- [33].…”

Strategic Learning for Active, Adaptive, and Autonomous Cyber Defense

“…The idea of using deceptions defensively to detect and deter attacks has been studied theoretically as listed in the taxonomic survey [8], implemented to the Adversarial Tactics, Techniques and Common Knowledge (ATT&CK T M ) adversary model system [9], and tested in the real-time cyber-wargame experiment [10]. Many previous works imply the similar idea of type obfuscation, e.g., creating social network avatars (fake personas) on the major social networks [11], implementing honey files for ransomware actions [12], and disguising a production system as a honeypot to scare attackers away [13].…”

“…The indicators in (8) mean that both players only update the estimate average risk of the current action.…”

“…The coupled dynamics of the payoff learning (8) and policy learning (13) converge to their Ordinary Differential Equations (ODEs) counterparts in system dynamics (15) and attacker dynamics (16), respectively. Let e c l, h ∈ C l , e a l, h ∈ A l be vectors of proper dimensions with the h-th entry being 1 and others being 0.…”