Do You Really Need to Disguise Normal Servers as Honeypots?
Suhyeon Lee, Kwangsoo Cho, and Seungjoo Kim

TL;DR
This paper analyzes the effectiveness of honeypot deception strategies in cybersecurity, revealing that disguising normal servers as honeypots does not necessarily improve defender rewards and may increase operational costs.
Contribution
It provides a theoretical framework comparing honeypot techniques and clarifies when deception strategies are beneficial or costly in real-world scenarios.
Findings
Honeypots generally increase defender benefits over no deception.
Disguising normal servers as honeypots does not improve rewards.
Fake honeypots can raise maintenance costs for normal nodes.
Abstract
A honeypot, which is a kind of deception strategy, has been widely used for at least 20 years to mitigate cyber threats. Decision-makers have believed that honeypot strategies are intuitive and effective, since honeypots have successfully protected systems from Denial-of-Service (DoS) attacks to Advanced Persistent Threats (APT) in real-world cases. Nonetheless, there is a lack of research on the appropriate level of honeypot technique application to choose real-world operations. We examine and contrast three attack-defense games with respect to honeypot detection techniques in this paper. In particular, we specifically design and contrast two stages of honeypot technology one by one, starting with a game without deception. We demonstrate that the return for a defender using honeypots is higher than for a defender without them, albeit the defender may not always benefit financially from…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsNetwork Security and Intrusion Detection · Information and Cyber Security · Advanced Malware Detection Techniques
