A Game-theoretic Taxonomy and Survey of Defensive Deception for Cybersecurity and Privacy
Citations Over TimeTop 1% of 2019 papers
Abstract
Cyberattacks on both databases and critical infrastructure have threatened public and private sectors. Ubiquitous tracking and wearable computing have infringed upon privacy. Advocates and engineers have recently proposed using defensive deception as a means to leverage the information asymmetry typically enjoyed by attackers as a tool for defenders. The term deception, however, has been employed broadly and with a variety of meanings. In this article, we survey 24 articles from 2008 to 2018 that use game theory to model defensive deception for cybersecurity and privacy. Then, we propose a taxonomy that defines six types of deception: perturbation, moving target defense, obfuscation, mixing, honey-x, and attacker engagement. These types are delineated by their information structures, agents, actions, and duration: precisely concepts captured by game theory. Our aims are to rigorously define types of defensive deception, to capture a snapshot of the state of the literature, to provide a menu of models that can be used for applied research, and to identify promising areas for future work. Our taxonomy provides a systematic foundation for understanding different types of defensive deception commonly encountered in cybersecurity and privacy.
Related Papers
- → Deception Methodology in Virtual Honeypots(2010)27 cited
- → Use of Deception to Improve Client Honeypot Detection of Drive-by-Download Attacks(2009)9 cited
- The Research of Intrusion Deception System Based on Honeypot Technique(2007)
- Scheme of intrusion deception(2004)