Affiliations: [a] Computer Science and Engineering Department, Indraprastha Institute of Information Technology at Delhi, India. E-mail: tanmoy@iiitd.ac.in | [b] Center for Secure Information Systems, George Mason University at Fairfax, VA, USA. E-mail: jajodia@gmu.edu | [c] Software and Information Systems Department, University of North Carolina at Charlotte, NC, USA. E-mail: npark2@uncc.edu | [d] DIMES Department, University of Calabria, Italy. E-mail: andrea.pugliese@unical.it | [e] Computer Science Department, Boise State University, ID, USA. E-mail: edoardoserra@boisestate.edu | [f] Computer Science Department, Dartmouth College, NH, USA. E-mail: vs@dartmouth.edu
Note: [1] The authors are listed in alphabetical order.
Note: [*] The author did part of the work as a postdoctoral researcher at University of Maryland, College Park, USA.
Abstract: Most past work on honeypots has made two assumptions: (i) they assume that the only defensive measure used is a honeypot mechanism, and (ii) they do not consider both rational and subrational adversaries and do not reason with an adversary model when placing honeypots. However, real-world system security officers use a mix of instruments such as traditional defenses (e.g. firewalls, intrusion detection systems), and honeypots form only one portion of the strategy. Moreover, the placement of traditional defenses and honeypots cannot be done independently. In this paper, we consider a Stackelberg-style game situation where the defender models the attacker and uses that model to identify the best placement of traditional defenses and honeypots. We provide a formal definition of undamaged asset value (i.e. the value that is not compromised by the attacker) under a given defensive strategy and show that the problem of finding the best placement so as to maximize undamaged asset value is NP-hard. We propose a greedy algorithm and show via experiments, both on real enterprise networks and on ones generated by the well-known network simulation tool NS-2, that our algorithm quickly computes near optimal placements. As such, our method is both practical and effective.
Keywords: Adversarial defense of enterprise systems, game theoretic models
