Hybrid adversarial defense: Merging honeypots and traditional security methods1

Tanmoy Chakraborty, Sushil Jajodia, Noseong Park, Andrea Pugliese, Edoardo Serra, V. S. Subrahmanian

Research output: Contribution to journalArticle

1 Citation (Scopus)

Abstract

Most past work on honeypots has made two assumptions: (i) they assume that the only defensive measure used is a honeypot mechanism, and (ii) they do not consider both rational and subrational adversaries and do not reason with an adversary model when placing honeypots. However, real-world system security officers use a mix of instruments such as traditional defenses (e.g. firewalls, intrusion detection systems), and honeypots form only one portion of the strategy.Moreover, the placement of traditional defenses and honeypots cannot be done independently. In this paper, we consider a Stackelbergstyle game situation where the defender models the attacker and uses that model to identify the best placement of traditional defenses and honeypots. We provide a formal definition of undamaged asset value (i.e. the value that is not compromised by the attacker) under a given defensive strategy and show that the problem of finding the best placement so as to maximize undamaged asset value is NP-hard.We propose a greedy algorithm and show via experiments, both on real enterprise networks and on ones generated by the well-known network simulation tool NS-2, that our algorithm quickly computes near optimal placements. As such, our method is both practical and effective.

Original languageEnglish
Pages (from-to)615-645
Number of pages31
JournalJournal of Computer Security
Volume26
Issue number5
DOIs
Publication statusPublished - 2018 Jan 1

    Fingerprint

All Science Journal Classification (ASJC) codes

  • Software
  • Safety, Risk, Reliability and Quality
  • Hardware and Architecture
  • Computer Networks and Communications

Cite this

Chakraborty, T., Jajodia, S., Park, N., Pugliese, A., Serra, E., & Subrahmanian, V. S. (2018). Hybrid adversarial defense: Merging honeypots and traditional security methods1. Journal of Computer Security, 26(5), 615-645. https://doi.org/10.3233/JCS-171094