The disaggregation of monolithic applications in containerized microservices inevitably weaken their security posture. In this context, leveraging the cloning feature of containerized environments, we propose Decepto, a software platform that integrates a high-interaction cyber deception mechanism within cloud-native applications using Kubernetes (K8s). In particular, our deception solution automatically generates decoys as clones of production microservices and deploys them to look like legitimate microservices. Attackers that unknowingly interact with such deceptive artifacts are reliably detected and monitored. In this work, we first present Decepto technical implementation, then we demonstrate its functionalities and related computational performance overhead emulating a practical attack scenario on a real K8s cluster.

Cyber deception can be a valuable addition to traditional cyber defense mechanisms, especially for modern cloud-native environments with a fading security perimeter. However, pre-built decoys used in classical computer networks are not effective in detecting and mitigating malicious actors due to their inability to blend with the variety of applications in such environments. On the other hand, decoys cloning the deployed microservices of an application can offer a high-fidelity deception mechanism to intercept ongoing attacks within production environments. However, to fully benefit from this approach, it is essential to use a limited amount of decoy resources and devise a suitable cloning strategy to minimize the impact on legitimate services performance. Following this observation, we formulate a non-linear integer optimization problem that maximizes the number of attack paths intercepted by the allocated decoys within a fixed resource budget. Attack paths represent the attacker's movements within the infrastructure as a sequence of violated microservices. We also design a heuristic decoy placement algorithm to approximate the optimal solution and overcome the computational complexity of the proposed formulation. We evaluate the performance of the optimal and heuristic solutions against other schemes that use local vulnerability metrics to select which microservices to clone as decoys. Our results show that the proposed allocation strategy achieves a higher number of intercepted attack paths compared to these schemes while requiring approximately the same number of decoys.

Failures in mobile robot navigation are often caused by errors in localizing the robot relative to its environment. This paper explores the idea that these errors can be considerably reduced by planning paths taking the robot through positions where pertinent features of the environment can be sensed. It introduces the notion of a "sensory uncertainty field" (SUF). For every possible robot configuration q, this field estimates the distribution of possible errors in the robot configuration that would be computed by a localization function matching the data given by the sensors against an environment model, if the robot was at q. A planner is proposed which uses a precomputed SUF to generate paths that minimize expected errors or any other criterion combining, say, path length and errors. This paper describes in detail the computation of a specific SUF for a mobile robot equipped with a classical line-striping camera/laser range sensor. It presents an implemented SUF-based motion planner for this robot and shows paths generated by this planner. Navigation experiments were conducted with mobile robots using paths generated by the SUF-based planner and other paths. The former paths were tracked with greater precision than the others. The final section of the paper discusses additional research issues related to SUF-based planning.>