Hybrid adversarial defense: Merging honeypots and traditional security methods1

Tanmoy Chakraborty, Sushil Jajodia, Noseong Park, Andrea Pugliese, Edoardo Serra, V. S. Subrahmanian

Research output: Contribution to journalArticlepeer-review

1 Citation (Scopus)

Abstract

Most past work on honeypots has made two assumptions: (i) they assume that the only defensive measure used is a honeypot mechanism, and (ii) they do not consider both rational and subrational adversaries and do not reason with an adversary model when placing honeypots. However, real-world system security officers use a mix of instruments such as traditional defenses (e.g. firewalls, intrusion detection systems), and honeypots form only one portion of the strategy.Moreover, the placement of traditional defenses and honeypots cannot be done independently. In this paper, we consider a Stackelbergstyle game situation where the defender models the attacker and uses that model to identify the best placement of traditional defenses and honeypots. We provide a formal definition of undamaged asset value (i.e. the value that is not compromised by the attacker) under a given defensive strategy and show that the problem of finding the best placement so as to maximize undamaged asset value is NP-hard.We propose a greedy algorithm and show via experiments, both on real enterprise networks and on ones generated by the well-known network simulation tool NS-2, that our algorithm quickly computes near optimal placements. As such, our method is both practical and effective.

Original languageEnglish
Pages (from-to)615-645
Number of pages31
JournalJournal of Computer Security
Volume26
Issue number5
DOIs
Publication statusPublished - 2018

Bibliographical note

Funding Information:
This work was partially funded by the Army Research Office under grants W911NF-13-1-0421, W911NF-15-1-0576, and W911NF-14-1-0358, by the Office of Naval Research under grants N00014-15-1-2007, N00014-16-1-2896, and N00014-15-1-2742, by the National Science Foundation under grant IIP-1266147, and by the Ramanujan Faculty Fellowship.

Publisher Copyright:
© 2018 - IOS Press and the authors.

All Science Journal Classification (ASJC) codes

  • Software
  • Safety, Risk, Reliability and Quality
  • Hardware and Architecture
  • Computer Networks and Communications

Fingerprint Dive into the research topics of 'Hybrid adversarial defense: Merging honeypots and traditional security methods1'. Together they form a unique fingerprint.

Cite this