Abstract:Cyber Security is a critical topic for organizations with IT/OT networks as they are always susceptible to attack, whether insider or outsider. Since the cyber landscape is an ever-evolving scenario, one must keep upgrading its security systems to enhance the security of the infrastructure. Tools like Security Information and Event Management (SIEM), Endpoint Detection and Response (EDR), Threat Intelligence Platform (TIP), Information Technology Service Management (ITSM), along with other defensive techniques like Intrusion Detection System (IDS), Intrusion Protection System (IPS), and many others enhance the cyber security posture of the infrastructure. However, the proposed protection mechanisms have their limitations, they are insufficient to ensure security, and the attacker penetrates the network. Deception technology, along with Honeypots, provides a false sense of vulnerability in the target systems to the attackers. The attacker deceived reveals threat intel about their modus operandi. We have developed a Security Orchestration, Automation, and Response (SOAR) Engine that dynamically deploys custom honeypots inside the internal network infrastructure based on the attacker's behavior. The architecture is robust enough to support multiple VLANs connected to the system and used for orchestration. The presence of botnet traffic and DDOS attacks on the honeypots in the network is detected, along with a malware collection system. After being exposed to live traffic for four days, our engine dynamically orchestrated the honeypots 40 times, detected 7823 attacks, 965 DDOS attack packets, and three malicious samples. While our experiments with static honeypots show an average attacker engagement time of 102 seconds per instance, our SOAR Engine-based dynamic honeypots engage attackers on average 3148 seconds.

Contextual Chart Generation for Cyber Deception

Differential Privacy and Natural Language Processing to Generate Contextually Similar Decoy Messages in Honey Encryption Scheme

HoneyFactory: Container-Based Comprehensive Cyber Deception Honeynet Architecture

Honeyquest: Rapidly Measuring the Enticingness of Cyber Deception Techniques with Code-based Questionnaires

Towards Identifying Human Actions, Intent, and Severity of APT Attacks Applying Deception Techniques -- An Experiment

HoneyGAN Pots: A Deep Learning Approach for Generating Honeypots

Honeyfile Camouflage: Hiding Fake Files in Plain Sight

TSM: Measuring the Enticement of Honeyfiles with Natural Language Processing

Three Decades of Deception Techniques in Active Cyber Defense -- Retrospect and Outlook

Deep Down the Rabbit Hole: On References in Networks of Decoy Elements

Towards in-situ Psychological Profiling of Cybercriminals Using Dynamically Generated Deception Environments

Act as a Honeytoken Generator! An Investigation into Honeytoken Generation with Large Language Models

Reveal the Mathematical Structures of Honeyword Security Metrics

Decoys in Cybersecurity: An Exploratory Study to Test the Effectiveness of 2-sided Deception

Cyber Deception Reactive: TCP Stealth Redirection to On-Demand Honeypots

Security Orchestration, Automation, and Response Engine for Deployment of Behavioural Honeypots

Towards Characterizing Cyber Networks with Large Language Models

HoneyGPT: Breaking the Trilemma in Terminal Honeypots with Large Language Model

Application Layer Cyber Deception without Developer Interaction

Nested Dirichlet models for unsupervised attack pattern detection in honeypot data

Active Deception using Factored Interactive POMDPs to Recognize Cyber Attacker's Intent