Deception by Design: Evidence-Based Signaling Games for Network Defense

TL;DR

This paper introduces a game-theoretic model for deception in network defense, analyzing how detection affects strategies and outcomes, with implications for designing more effective honeypot defenses.

Contribution

It develops a new model of deceptive interactions incorporating evidence detection, extending traditional signaling games, and reveals counterintuitive effects of detection on defender utility.

Findings

Detection can eliminate pure-strategy equilibria.

Deception detection can sometimes increase defender utility.

The model generalizes traditional signaling and complete information games.

Abstract

Deception plays a critical role in the financial industry, online markets, national defense, and countless other areas. Understanding and harnessing deception - especially in cyberspace - is both crucial and difficult. Recent work in this area has used game theory to study the roles of incentives and rational behavior. Building upon this work, we employ a game-theoretic model for the purpose of mechanism design. Specifically, we study a defensive use of deception: implementation of honeypots for network defense. How does the design problem change when an adversary develops the ability to detect honeypots? We analyze two models: cheap-talk games and an augmented version of those games that we call cheap-talk games with evidence, in which the receiver can detect deception with some probability. Our first contribution is this new model for deceptive interactions. We show that the model includes traditional signaling games and complete information games as special cases. We also demonstrate numerically that deception detection sometimes eliminate pure-strategy equilibria. Finally, we present the surprising result that the utility of a deceptive defender can sometimes increase when an adversary develops the ability to detect deception. These results apply concretely to network defense. They are also general enough for the large and critical body of strategic interactions that involve deception.