Abstract:Highly interactive honeypots can form reliable connections by responding to attackers to delay and capture intranet attacks. However, current research focuses on modeling the attacker as part of the environment and defining single-step attack actions by simulation to study the interaction of honeypots. It ignores the iterative nature of the attack and defense game, which is inconsistent with the correlative and sequential nature of actions in real attacks. These limitations lead to insufficient interaction of the honeypot response strategies generated by the study, making it difficult to support effective and continuous games with attack behaviors. In this paper, we propose an autonomous attack response framework (named AARF) to enhance interaction based on multi-agent dynamic games. AARF consists of three parts: a virtual honeynet environment, attack agents, and defense agents. Attack agents are modeled to generate multi-step attack chains based on a Hidden Markov Model (HMM) combined with the generic threat framework ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge). The defense agents iteratively interact with the attack behavior chain based on reinforcement learning (RL) to learn to generate honeypot optimal response strategies. Aiming at the sample utilization inefficiency problem of random uniform sampling widely used in RL, we propose the dynamic value label sampling (DVLS) method in the dynamic environment. DVLS can effectively improve the sample utilization during the experience replay phase and thus improve the learning efficiency of honeypot agents under the RL framework. We further couple it with a classic DQN to replace the traditional random uniform sampling method. Based on AARF, we instantiate different functional honeypot models for deception in intranet scenarios. In the simulation environment, honeypots collaboratively respond to multi-step intranet attack chains to defend against these attacks, which demonstrates the effectiveness of AARF. The average cumulative reward of the DQN with DVLS is beyond eight percent, and the convergence speed is improved by five percent compared to a classic DQN.

Game Theoretic Simulation on the Mimicry Honeypot

Honeypot Allocation for Cyber Deception in Dynamic Tactical Networks: A Game Theoretic Approach

Research on Optimization of Array Honeypot Defense Strategies Based on Evolutionary Game Theory

Cooperative Algorithm for Multi-agent Foraging Task Based on Modified Hawk-Dove Game

Modeling of the Mimic Defense Based on Heterogeneous Redundancy

An Evolutionary Cooperative Mechanism for Multi-agent System

Anti-Honeypot Enabled Optimal Attack Strategy for Industrial Cyber-Physical Systems.

Evaluating Deception and Moving Target Defense with Network Attack Simulation

HoneyGPT: Breaking the Trilemma in Terminal Honeypots with Large Language Model

Research on Dynamic Array Honeypot for Collaborative Network Defense Strategy

HoneyFactory: Container-Based Comprehensive Cyber Deception Honeynet Architecture

AARF: Autonomous Attack Response Framework for Honeypots to Enhance Interaction Based on Multi-Agent Dynamic Game

The analysis of dynamic honeypot and its design

Deception Maze: A Stackelberg Game-Theoretic Defense Mechanism for Intranet Threats

Adaptive Honeypot Engagement through Reinforcement Learning of Semi-Markov Decision Processes

A Comprehensive Survey on Cyber Deception Techniques to Improve Honeypot Performance

Decoys in Cybersecurity: An Exploratory Study to Test the Effectiveness of 2-sided Deception

Strategic Deployment of Honeypots in Blockchain-based IoT Systems

Do You Really Need to Disguise Normal Servers as Honeypots?

HoneyIoT: Adaptive High-Interaction Honeypot for IoT Devices Through Reinforcement Learning

Constructing Dynamic Honeypot Using Machine Learning