Cyber Deception for Computer and Network Security: Survey and Challenges

Abstract

Cyber deception has recently received increasing attentions as a promising mechanism for proactive cyber defense. Cyber deception strategies aim at injecting intentionally falsified information to sabotage the early stage of attack reconnaissance and planning in order to render the final attack action harmless or ineffective.Motivated by recent advances in cyber deception research, we in this paper provide a formal view of cyber deception, and review high-level deception schemes and actions. We also summarize and classify recent research results of cyber defense techniques built upon the concept of cyber deception, including gametheoretic modeling at the strategic level, network-level deception, in-host-system deception and cryptography based deception. Finally, we lay out and discuss in detail the research challenges towards developing full-fledged cyber deception frameworks and mechanisms.

Game-Theoretic and Machine Learning-based Approaches for Defensive Deception: A Survey

“…Recently, Lu et al [90] conducted a brief survey based on the processes of defensive deception consisting of three phases: planning of deception, implementation and deployment of deception, and monitoring and evaluation of deception. The authors discussed deception techniques based on information dissimulation to hide real information and information simulation to focus on attackers.…”

An optimal defensive deception framework for the container‐based cloud with deep reinforcement learning

“…1) A precise adversarial model. Lu et al [8] point out that a precise adversarial model is the key to create and evaluate a deception strategy. As deception defence leverages attackers' cognitive biases [10], detailing adversarial model of target environment is essential for transferring the weakness of adversaries into defence advantage.…”

“…It reverses the asymmetry between the defender and attacker by presenting intentionally falsified information. Different from signature-based countermeasures, it actively conceals system properties [7], misleads and traps attackers [8]. For example, Almohri et al [9] propose to conceal target nodes in cloud by organising decoy services.…”

“…For example, Almohri et al [9] propose to conceal target nodes in cloud by organising decoy services. To deter and detect stealthy attackers in the container-based cloud, defensive deception is particularly advantageous from following perspectives: (1) It actively reveals stealthy attackers by presenting exploitable decoys [8]. Decoys are well-designed digital assets with monitors.…”

“…Main concerns of implementing defensive deception in the cloud are the establishment of adversarial model [8] and the placement of decoy assets [12]. The precise adversarial model is the foundation to create and evaluate placement strategy.…”