Harnessing the Power of Deception in Attack Graph-Based Security Games

Game-Theoretic and Machine Learning-based Approaches for Defensive Deception: A Survey

“…Durkota et al [58] leveraged a Stackelberg game where an attacker follows an attack graph and a defender can deploy a honeypot to deceive the attacker based on an efficient optimal strategy searching method using Markov Decision Processing (MDP) and sibling-class pruning. Kulkarni et al [85], Milani et al [96], Tsemogne et al [133] investigated game-theoretic cyberdeception techniques played on attack graphs. Kulkarni et al [85], Basak et al [23] formulated a deception game to place decoy devices to deceive and trap an attacker and proposed a greedy algorithm to solve the developed game.…”

“…Kulkarni et al [85], Basak et al [23] formulated a deception game to place decoy devices to deceive and trap an attacker and proposed a greedy algorithm to solve the developed game. Milani et al [96] developed a Stackelberg game to allocated defensive resources and manipulate a generated attack graph. Tsemogne et al [133] studied the malicious behavior through an epidemic model and solved a one-sided partially observable stochastic game for cyberdeception where a defender distributes a limited number of honeypots.…”

“…• Utility [14,15,13,12,37,49,65,73,75,81,96,97,99,101,100,106,107,111,114,122,132,133,137,141,153,155]:…”

“…As a result, some of these studies considered the impact to normal as another cost of deception technology [114,137]. A defender's expected utility is a common metric to be maximized as the system's objective, as shown in game-theoretic or ML-based DD techniques in [5,7,65,73,75,81,85,96,100,106,107,111,122,132,133,141,153,155].…”

“…2) Simulation Model-Based Evaluation [1,5,6,7,8,14,15,13,12,19,21,24,23,27,30,31,32,33,41,44,45,49,65,73,74,75,81,85,87,96,97,99,101,100,106,107,111,114,122,124,132,133,141,143,145,153]: In order to simulate benign network traffic, Rahman et al [114] generated network flow by the Internet Traffic Archive [53], using Nmap to test their deception technology. [44,45] to simulate their ...…”