Hybrid adversarial defense: Merging honeypots and traditional security methods1

Chakraborty, Tanmoy; Jajodia, Sushil; Park, Noseong; Pugliese, Andrea; Serra, Edoardo; Subrahmanian, V. S.

doi:10.3233/jcs-171094

Cited by 2 publications

(2 citation statements)

References 45 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This turn-based interaction can be understood as if the defense is reactive against attacker's exploits. The turn-based interaction has been adapted in cyber-security research [6]. The generalization to concurrent stochastic game arena is a part of our future work.…”

Section: A the Game Arena Of Cyber-deception Gamementioning

confidence: 99%

Secure-by-synthesis network with active deception and temporal logic specifications

Fu,

Kulkarni,

Luo

et al. 2020

Preprint

View full text Add to dashboard Cite

This paper is concerned with the synthesis of strategies in network systems with active cyber deception. Active deception in a network employs decoy systems and other defenses to conduct defensive planning against the intrusion of malicious attackers who have been confirmed by sensing systems. In this setting, the defender's objective is to ensure the satisfaction of security properties specified in temporal logic formulas. We formulate the problem of deceptive planning with decoy systems and other defenses as a two-player games with asymmetrical information and Boolean payoffs in temporal logic. We use level-2 hypergame with temporal logic objectives to capture the incomplete/incorrect knowledge of the attacker about the network system as a payoff misperception. The true payoff function is private information of the defender. Then, we extend the solution concepts of ω-regular games to analyze the attacker's rational strategy given her incomplete information. By generalizing the solution of level-2 hypergame in the normal form to extensive form, we extend the solutions of games with safe temporal logic objectives to decide whether the defender can ensure security properties to be satisfied with probability one, given any possible strategy that is perceived to be rational by the attacker. Further, we use the solution of games with co-safe (reachability) temporal logic objectives to determine whether the defender can engage the attacker, by directing the attacker to a high-fidelity honeypot. The effectiveness of the proposed synthesis methods is illustrated with synthetic network systems with honeypots.

show abstract

Section: A the Game Arena Of Cyber-deception Gamementioning

confidence: 99%

Secure-by-synthesis network with active deception and temporal logic specifications

Fu,

Kulkarni,

Luo

et al. 2020

Preprint

View full text Add to dashboard Cite

show abstract

“…A game-theoretic model for defending against attacks is studied in honeypot-enabled IoT [38]. A Stackelberg-style game, which consists of a leader and its follower, is employed in an enterprise network [39]. In this model, the defender serves as a leader to identify the optimal placement of firewalls, IDS, and honeypots simultaneously.…”

Section: Game-theoretic Approaches To Model Honeypotsmentioning

confidence: 99%

A Game-Theoretic Analysis for Distributed Honeypots

Shi

Feng

2019

Future Internet

View full text Add to dashboard Cite

A honeypot is a decoy tool for luring an attacker and interacting with it, further consuming its resources. Due to its fake property, a honeypot can be recognized by the adversary and loses its value. Honeypots equipped with dynamic characteristics are capable of deceiving intruders. However, most of their dynamic properties are reflected in the system configuration, rather than the location. Dynamic honeypots are faced with the risk of being identified and avoided. In this paper, we focus on the dynamic locations of honeypots and propose a distributed honeypot scheme. By periodically changing the services, the attacker cannot distinguish the real services from honeypots, and the illegal attack flow can be recognized. We adopt game theory to illustrate the effectiveness of our system. Gambit simulations are conducted to validate our proposed scheme. The game-theoretic reasoning shows that our system comprises an innovative system defense. Further simulation results prove that the proposed scheme improves the server’s payoff and that the attacker tends to abandon launching attacks. Therefore, the proposed distributed honeypot scheme is effective for network security.

show abstract

Hybrid adversarial defense: Merging honeypots and traditional security methods1

Cited by 2 publications

References 45 publications

Secure-by-synthesis network with active deception and temporal logic specifications

Secure-by-synthesis network with active deception and temporal logic specifications

A Game-Theoretic Analysis for Distributed Honeypots

Contact Info

Product

Resources

About