Table Of ContentAdvances in Information Security 89
Tiffany Bao
Milind Tambe
Cliff Wang Editors
Cyber
Deception
Techniques, Strategies, and Human
Aspects
Advances in Information Security
Volume 89
SeriesEditors
SushilJajodia,GeorgeMasonUniversity,Fairfax,VA,USA
PierangelaSamarati,Milano,Italy
JavierLopez,Malaga,Spain
JaideepVaidya,EastBrunswick,NJ,USA
The purpose of the Advances in Information Security book series is to establish
the state of the art and set the course for future research in information security.
Thescopeofthisseriesincludesnotonlyallaspectsofcomputer,networksecurity,
andcryptography,butrelatedareas,suchasfaulttoleranceandsoftwareassurance.
Theseriesservesasacentralsourceofreferenceforinformationsecurityresearch
anddevelopments.Theseriesaimstopublishthoroughandcohesiveoverviewson
specific topics in Information Security, as well as works that are larger in scope
than survey articles and that will contain more detailed background information.
The series also provides a single point of coverage of advanced and timely topics
and a forum for topics that may not have reached a level of maturity to warrant a
comprehensivetextbook.
Tiffany Bao • Milind Tambe • Cliff Wang
Editors
Cyber Deception
Techniques, Strategies, and Human Aspects
Editors
TiffanyBao MilindTambe
ArizonaStateUniversity HarvardUniversity
Tempe,AZ,USA Cambridge,MA,USA
CliffWang
ArmyResearchOffice
Adelphi,MD,USA
ISSN1568-2633 ISSN2512-2193 (electronic)
AdvancesinInformationSecurity
ISBN978-3-031-16612-9 ISBN978-3-031-16613-6 (eBook)
https://doi.org/10.1007/978-3-031-16613-6
©ThisisaU.S.governmentworkandnotundercopyrightprotectionintheU.S.;foreigncopyright
protectionmayapply2023
Chapters“UsingAmnesiatoDetectCredentialDatabaseBreaches”and“DeceivingML-BasedFriend-
or-FoeIdentificationforExecutables”islicensedunderthetermsoftheCreativeCommonsAttribution
4.0InternationalLicense(http://creativecommons.org/licenses/by/4.0/).Forfurtherdetailsseelicense
informationinthechapter.
AllrightsaresolelyandexclusivelylicensedbythePublisher,whetherthewholeorpartofthematerialis
concerned,specificallytherightsoftranslation,reprinting,reuseofillustrations,recitation,broadcasting,
reproductiononmicrofilmsorinanyotherphysicalway,andtransmissionorinformationstorageand
retrieval,electronicadaptation,computersoftware,orbysimilarordissimilarmethodologynowknown
orhereafterdeveloped.
Theuseofgeneraldescriptivenames,registerednames,trademarks,servicemarks,etc.inthispublication
doesnotimply,evenintheabsenceofaspecificstatement,thatsuchnamesareexemptfromtherelevant
protectivelawsandregulationsandthereforefreeforgeneraluse.
Thepublisher,theauthors,andtheeditorsaresafetoassumethattheadviceandinformationinthisbook
arebelievedtobetrueandaccurateatthedateofpublication.Neitherthepublishernortheauthorsor
theeditorsgiveawarranty,expressedorimplied,withrespecttothematerialcontainedhereinorforany
errorsoromissionsthatmayhavebeenmade.Thepublisherremainsneutralwithregardtojurisdictional
claimsinpublishedmapsandinstitutionalaffiliations.
ThisSpringerimprintispublishedbytheregisteredcompanySpringerNatureSwitzerlandAG
Theregisteredcompanyaddressis:Gewerbestrasse11,6330Cham,Switzerland
Preface
This book introduces cutting-edge research works in cyber deception, a research
topic that has been actively studied and significantly advanced in the past decade.
Withthefocusoncyberdeception,thisbookspansawidevarietyofareas,including
gametheory,artificialintelligence,cognitivescience,andcybersecurity.Thisbook
willaddressthreecorecyberdeceptionresearchelementsasfollows:
1. Understandingofhuman’scognitivebehaviorsindecoyednetworkscenarios
2. Developmentofeffectivedeceptivestrategiesbasedonhumanbehaviors
3. Designofdeceptivetechniquesenforcingdeceptivestrategies
Theresearchintroducedinthisbookwillidentifythescientificchallenges,highlight
thecomplexity,andinspirefutureresearchofcyberdeception.
Thisbookcanbeusedasaprofessionalbookbycybersecuritypractitionersand
researchers, or a supplemental textbook for educational purposes. Readers will be
abletolearnthestateoftheartincyberdeceptiontoconductfollow-upresearchor
translaterelatedresearchoutcometopractice.
Tempe,AZ,USA TiffanyBao
Cambridge,MA,USA MilindTambe
TrianglePark,NC,USA CliffWang
v
Acknowledgments
Wewouldliketothankallthecontributorsfortheirdedicationtothisbook.Special
thanksgotoMs.SusanLagerstrom-FifeandMs.ShanthiniKamarajfortheirkind
supportofthisbook.Finally,wethanktheArmyResearchOfficefortheirfinancial
supportunderthegrantnumbersW911NF-17-1-0370.
vii
Contents
DiversifyingDeception:Game-TheoreticModelsforTwo-Sided
DeceptionandInitialHumanStudies.......................................... 1
Mohammad Sujan Miah, Palvi Aggarwal, Marcus Gutierrez, Omkar
Thakoor,YinuoDu,OscarVeliz,KuldeepSingh,ChristopherKiekintveld,
andCleotildeGonzalez
Human-SubjectExperimentsonRisk-BasedCyberCamouflageGames.. 25
PalviAggarwal,ShahinJabbari,OmkarThakoor,EdwardA.Cranford,
PhebeVayanos,ChristianLebiere,MilindTambe,andCleotildeGonzalez
AdaptiveCyberdefensewithDeception:AHuman–AICognitive
Approach.......................................................................... 41
Cleotilde Gonzalez, Palvi Aggarwal, Edward A. Cranford,
andChristianLebiere
CognitiveModelingforPersonalized,AdaptiveSignalingfor
CyberDeception.................................................................. 59
ChristianLebiere,EdwardA.Cranford,PalviAggarwal,SarahCooney,
MilindTambe,andCleotildeGonzalez
DeceptiveSignaling:UnderstandingHumanBehaviorAgainst
SignalingAlgorithms ............................................................ 83
PalviAggarwal,EdwardA.Cranford,MilindTambe,ChristianLebiere,
andCleotildeGonzalez
OptimizingHoneyTrafficUsingGameTheoryandAdversarial
Learning........................................................................... 97
MohammadSujanMiah,MuZhu,AlonsoGranados,NaziaSharmin,
IffatAnjum,Anthony Ortiz,ChristopherKiekintveld, WilliamEnck,
andMunindarP.Singh
Mee:AdaptiveHoneyfileSystemforInsiderAttackerDetection........... 125
MuZhuandMunindarP.Singh
ix
x Contents
HoneyPLC:ANext-GenerationHoneypotforIndustrialControl
Systems............................................................................ 145
EfrénLópezMorales,CarlosE.Rubio-Medrano,AdamDoupé,Ruoyu
Wang,YanShoshitaishvili,TiffanyBao,andGail-JoonAhn
UsingAmnesiatoDetectCredentialDatabaseBreaches .................... 183
KeCobyWangandMichaelK.Reiter
DeceivingML-BasedFriend-or-FoeIdentificationforExecutables........ 217
Keane Lucas, Mahmood Sharif, Lujo Bauer, Michael K. Reiter,
andSaurabhShintre
Diversifying Deception: Game-Theoretic
Models for Two-Sided Deception and
Initial Human Studies
MohammadSujanMiah,PalviAggarwal,MarcusGutierrez,
OmkarThakoor,YinuoDu,OscarVeliz,KuldeepSingh,
ChristopherKiekintveld,andCleotildeGonzalez
1 Introduction
Both civilian and military computer networks are under increasing threat from
cyberattacks,withthemostsignificantthreatposedbyAdvancedPersistentThreat
(APT) actors. These attackers use sophisticated methods to compromise networks
and remain inside, establishing greater control and staying for long periods to
gather valuable data and intelligence. These attackers seek to remain undetected,
and estimates from APT attacks show that they are often present in a network for
monthsbeforetheyaredetected[31].
Cyber deception methods use deceptive decoy objects like fake hosts (hon-
eypots), network traffic, files, and even user accounts to counter attackers in a
variety of ways [1, 13, 28]. They can create confusion for attackers, make them
morehesitantandlesseffectiveinexecutingfurtherattacks,andcanhelptogather
Anearlierversionofsomepartsoftheworkwaspublishedintheproceedingsofthe53rdHawaii
InternationalConferenceonSystemSciences(HICSS),2020,pp.01–20.
M.S.Miah·M.Gutierrez·O.Veliz·C.Kiekintveld((cid:2))
DepartmentofComputerScience,UniversityofTexasatElPaso,ElPaso,TX,USA
e-mail:[email protected];[email protected];[email protected];
[email protected]
P.Aggarwal·Y.Du·K.Singh·C.Gonzalez
CarnegieMellonUniversity,Pittsburgh,PA,USA
e-mail:[email protected];[email protected];[email protected];
[email protected]
O.Thakoor
UniversityofSouthernCalifornia,LosAngeles,CA,USA
e-mail:[email protected]
©ThisisaU.S.governmentworkandnotundercopyrightprotectionintheU.S.; 1
foreigncopyrightprotectionmayapply2023
T.Baoetal.(eds.),CyberDeception,AdvancesinInformationSecurity89,
https://doi.org/10.1007/978-3-031-16613-6_1
