Cyber deception aims to misrepresent the state of the network to mislead the attackers, falsify their reconnaissance conclusions, and deflect them away from their goals. Honeypots serve as decoy devices inside networks that can capture adversaries for monitoring purposes. We propose a two-phase deception approach based on honeypot allocation. In the first phase, we develop a proactive deceptive honeypot allocation policy, the second phase proposes a reactive deception approach that dynamically allocates honeypots according to IDS updates. Considering a practical scenario, the defender partially monitors the adversary’s activities. To this end, we develop our deception approach using a combination of game-theoretic and reinforcement learning models. We cast the problem of reactive deception as a partially observable Markov decision process (POMDP) based on a game-theoretic dynamic model to accommodate the imperfect monitoring of the actions taken by the attacker. We solve this combined partially observable game model using Monte-Carlo tree search to overcome the game model complexity. We give a game-theoretic analysis to explain the attack-defense policies at equilibrium. Finally, we present numerical results to validate the effectiveness of the proposed deception approach.

Generative adversarial networks (GANs) are often billed as "universal distribution learners", but precisely what distributions they can represent and learn is still an open question. Heavy-tailed distributions are prevalent in many different domains such as financial risk-assessment, physics, and epidemiology. We observe that existing GAN architectures do a poor job of matching the asymptotic behavior of heavy-tailed distributions, a problem that we show stems from their construction. Additionally, common loss functions produce unstable or near-zero gradients when faced with the infinite moments and large distances between outlier points characteristic of heavy-tailed distributions. We address these problems with the Pareto GAN. A Pareto GAN leverages extreme value theory and the functional properties of neural networks to learn a distribution that matches the asymptotic behavior of the marginal distributions of the features. We identify issues with standard loss functions and propose the use of alternative metric spaces that enable stable and efficient learning. Finally, we evaluate our proposed approach on a variety of heavy-tailed datasets.

In this paper, we propose a cyber deception approach using software diversity in a honeynet. Honeypot allocation is used as an active cyber deception technique to increase the uncertainty of adversaries and hide the true state of the network. Moreover, software diversity limits the ability of attackers to discover honeypots. Specifically, this paper introduces a diversity-based honeypot allocation approach for network security formulated in a game-theoretic framework. We consider a two-player zero-sum game between the network defender and the adversary. To validate our findings, we measured the potential benefits of diversity on network security and calculated the optimum diversifying strategy in Nash equilibrium using different honeypot types.

This paper considers the problem of mitigating jamming attacks by aiming to deceive the jammer. Specifically, in the presence of a jammer, to defend a transmitter-receiver pair sending (real) information, the paper proposes the novel technique of sending fake information over a second transmitter-receiver pair in order to deceive the jammer into investing some of its jamming power budget for jamming the channel carrying fake information. The paper develops a leader-follower model where the jammer (acting as the follower) adopts it's jamming strategy after sensing the communication activities on the channels carrying the real and fake information, while the system (acting as the leader) adopts its power allocation strategy prior to the jammer. The paper characterizes the optimal power allocation strategy of the system considering the jammer to be non-strategic in nature, as well as characterizes the Subgame Perfect Nash Equilibrium (SPNE) strategy of the leader-follower game considering both the system and the jammer to be strategic entities. Extensive simulation results are provided to gain insights into the deception strategies developed in the paper.

This paper aims to characterize deception based attack-defense strategies when a system and an attacker is behavioral in nature under strategic considerations. The paper uses Prospect Theory to model the behavioral nature of the system and the attacker, and Game Theory to model the strategic interactions between them. The paper first considers the availability of multiple computing devices that can be used to deceive a behavioral attacker into attacking a device being unused by a behavioral system and characterizes the Nash Equilibrium (NE) based attack-defense strategy in such a scenario under cost considerations. The paper then considers the problem of protecting a target device that is accessible via a tree network and proposes the idea of deceptive routing to mislead a behavioral attacker towards a fake target present in the network. The NE based attack-defense strategies in the context of the proposed deceptive routing technique is also characterized. Numerical results provide insights into the strategic deception techniques presented in this paper.

Cyber deception techniques are crucial to protect networks in battlefield settings and combat malicious cyber attacks. Cyber deception can effectively disrupt the surveillance process outcome of an adversary. In this paper, we propose a novel approach for cyber deception to protect important nodes and trap the adversary. We present a sequential approach of honeypot placement to defend and protect the network vital nodes. We formulate a stochastic game to study the dynamic interactions between the network administrator and the attacker. The defender makes strategic decisions about where to place honeypots to introduce new vulnerabilities to the network. The attacker's goal is to develop an attack strategy to compromise the nodes of the network by exploiting a set of known vulnerabilities. To consider a practical threat model, we assume that the attacker can only observe a noisy version of the network state. To this end, both players solve a partially observable stochastic game (POSG). Finally, we present a discussion on existing techniques to solve the formulated game and possible approaches to reduce the game complexity as part of our ongoing and future research.