Most past work on honeypots has made two assumptions: (i) they assume that the only defensive measure used is a honeypot mechanism, and (ii) they do not consider both rational and subrational adversaries and do not reason with an adversary model when placing honeypots. However, real-world system security officers use a mix of instruments such as traditional defenses (e.g. firewalls, intrusion detection systems), and honeypots form only one portion of the strategy.Moreover, the placement of traditional defenses and honeypots cannot be done independently. In this paper, we consider a Stackelbergstyle game situation where the defender models the attacker and uses that model to identify the best placement of traditional defenses and honeypots. We provide a formal definition of undamaged asset value (i.e. the value that is not compromised by the attacker) under a given defensive strategy and show that the problem of finding the best placement so as to maximize undamaged asset value is NP-hard.We propose a greedy algorithm and show via experiments, both on real enterprise networks and on ones generated by the well-known network simulation tool NS-2, that our algorithm quickly computes near optimal placements. As such, our method is both practical and effective.
Bibliographical noteFunding Information:
This work was partially funded by the Army Research Office under grants W911NF-13-1-0421, W911NF-15-1-0576, and W911NF-14-1-0358, by the Office of Naval Research under grants N00014-15-1-2007, N00014-16-1-2896, and N00014-15-1-2742, by the National Science Foundation under grant IIP-1266147, and by the Ramanujan Faculty Fellowship.
© 2018 - IOS Press and the authors.
All Science Journal Classification (ASJC) codes
- Safety, Risk, Reliability and Quality
- Hardware and Architecture
- Computer Networks and Communications