Cyber Deception Against Zero-Day Attacks: A Game Theoretic Approach

Abstract

Reconnaissance activities precedent other attack steps in the cyber kill chain. Zero-day attacks exploit unknown vulnerabilities and give attackers the upper hand against conventional defenses. Honeypots have been used to deceive attackers by misrepresenting the true state of the network. Existing work on cyber deception does not model zero-day attacks. In this paper, we address the question of "How to allocate honeypots over the network?" to protect its most valuable assets. To this end, we develop a two-player zero-sum game theoretic approach to study the potential reconnaissance tracks and attack paths that attackers may use. However, zero-day attacks allow attackers to avoid placed honeypots by creating new attack paths. Therefore, we introduce a sensitivity analysis to investigate the impact of different zero-day vulnerabilities on the performance of the proposed deception technique. Next, we propose several mitigating strategies to defend the network against zero-day attacks based on this analysis. Finally, our numerical results validate our findings and illustrate the effectiveness of the proposed defense approach.

Strategic Honeypot Allocation in Dynamic Networks: A Game-Theoretic Approach for Enhanced Cybersecurity

“…We meticulously pinpoint the most detrimental links and subsequently propose a mitigating strategy. This work complements our analysis and evaluates the impact and mitigation of imperfect vulnerability information to the defender in relation to our previous work on security games with imperfect information (Sayed et al 2022).…”

“…Hypergame-based deception against advanced persistent threat attacks performing multiple attacks performed in the stages of cyber kill chain discussed in (Wan et al 2021). A game theoretic approach for zero-day vulnerability analysis and deceptive mitigation against zero-day vulnerability proposed by (Sayed et al 2022). The synergies between game theory and machine learning to formulate defensive deception discussed in (Zhu et al 2021).…”

Improving Quality of Service and HTTPS DDoS Detection in MEC Environment With a Cyber Deception-Based Architecture

“…Cyber deception is a strategy that utilizes false information and decoys in networks to mislead and divert attackers. The goal is to lure, confuse, or delay attackers while simultaneously detecting their presence and gaining insights into their tactics, allowing for early threat detection and enhanced cybersecurity defenses [11]. Furthermore, in [12], the authors addressed the critical issue of DDoS attacks on SDN IoT-Edge Computing, exacerbated by the pandemic-induced remote work trend.…”

“…This situation arises due to the widespread use of IoT, * Upon receiving a "Yes" response from the checker, indicating ample resources within the MEC server, the SDN controller forwards the request to the VNF processor (10). The VNF processor carries out the computation and transmits the response back to the SDN controller (11). The received response is then dispatched to the VNF receiver (VM3) for storage in the Cloud data center ( 8) and delivery to the legitimate device.…”