Adaptive Honeypot Allocation in Multi-Attacker Networks via Bayesian Stackelberg Games

TL;DR

This paper introduces a Bayesian Stackelberg game framework for strategic honeypot placement in complex networks with multiple attackers, enabling dynamic defense adaptation and efficient resource allocation.

Contribution

It presents a novel multi-attacker Bayesian Stackelberg model that incorporates dynamic belief updates for effective honeypot deployment in large-scale networks.

Findings

Prevents attack success within a few rounds

Scales to networks with 500 nodes and 1,500 edges

Maintains tractable run times

Abstract

Defending against sophisticated cyber threats demands strategic allocation of limited security resources across complex network infrastructures. When the defender has limited defensive resources, the complexity of coordinating honeypot placements across hundreds of nodes grows exponentially. In this paper, we present a multi-attacker Bayesian Stackelberg framework modeling concurrent adversaries attempting to breach a directed network of system components. Our approach uniquely characterizes each adversary through distinct target preferences, exploit capabilities, and associated costs, while enabling defenders to strategically deploy honeypots at critical network positions. By integrating a multi-follower Stackelberg formulation with dynamic Bayesian belief updates, our framework allows defenders to continuously refine their understanding of attacker intentions based on actions detected through Intrusion Detection Systems (IDS). Experimental results show that the proposed method prevents attack success within a few rounds and scales well up to networks of 500 nodes with more than 1,500 edges, maintaining tractable run times.