EAGER: Exploring the Use of Deception to Enhance Cyber Security

我们的计算机系统不断受到攻击，从恶作剧者到敌对国家的特工。许多这样的系统和网络通过提供有用的信息来应对攻击，从而使对手的任务变得更容易。这是因为几十年来人们一直在编写软件和协议，以便为错误检测和纠正提供信息反馈。正是这种行为，通过允许攻击者绘制网络地图和确定系统缺陷，提高了他们成功的机会。这项研究解决了这样一个问题：“有没有使用欺骗性反应来帮助防止成功的攻击？”此外，这项研究还调查了是否有可能对欺骗可能有用的情况进行表征和建模。这项工作的结果为网络系统设计者提供了一些新的防御措施，并指导它们何时有用。该项目包括两个相关的研究方向。首先是探索欺骗在系统防御中的一些新应用。研究人员调查了对利用已知漏洞的尝试提供欺骗性响应，以及构建关于创建和删除关键文件的“谎言”的文件系统。这些机制中的每一个都应该通过提供对不良行为的早期警告以及钝化攻击来支持系统的安全。对攻击的欺骗性回应会导致犯罪者使用无效的攻击，从而浪费时间和精力。欺骗性文件系统可以捕获有关企图攻击的取证数据，但似乎只允许安装恶意文件。第二条研究线探索如何使用欺骗性技术将超博弈模型应用于网络防御。超级博弈是博弈论的延伸，包含了不正确和不确定的信息。通过构建超博弈模型，我们应该能够确定当欺骗作为防御时存在有利结果的情况。

Our computing systems are constantly under attack, by everyone from pranksters to agents of hostile nations. Many of those systems and networks make the task of the adversary easier by responding to attacks with useful information. This is because software and protocols have been written for decades to provide informative feedback for error detection and correction. It is precisely this behavior that enhances the chances of success by attackers, by allowing them to map networks and determine system flaws. This research addresses the question "Are there uses of deceptive responses that help prevent successful attacks?" Furthermore, the study investigates if it is possible to characterize and model the types of situations where deception may be useful. The result of this work provides cyber system designers with some new defensive measures, and guidance as to when they are useful to deploy.The project includes two related lines of research. The first of these is to explore some new applications of deceit in system defense. The researchers investigate presenting deceptive responses to attempts to exploit known vulnerabilities, and building a file system that "lies" about the creation and deletion of key files. Each of these mechanisms should support a system's security by providing early warning of bad behavior as well as blunting attacks. Deceitful responses to attacks can lead a perpetrator to employ ineffective attacks, thus wasting time and effort. A deceptive file system can capture forensic data about an attempted attack while only appearing to allow the installation of malicious files. The second line of research explores how to apply hypergame models to cyber defenses using deceptive techniques. Hypergames are an extension of game theory that includes incorrect and uncertain information. By constructing hypergame models we should be able to determine situations where there is a favorable result when deception is employed as a defense.