Influence of different honeypot proportions on adversarial decisions in a deception game

Abstract

Cyberattacks are proliferating, and deception via honeypots may provide efficient strategies for combating cyberattacks. Although prior research has examined deception and network factors using deception-based games, it is still unknown how the proportion of honeypots in a network influences the adversarial decision. This study evaluates the influence of different honeypot proportions on the adversary’s decisions using a deception game (DG). DG has two consecutive stages, probe and attack. In the probe stage, participants may probe a few webservers or not probe the network. In the attack stage, participants may attack any of the webservers or decide not to attack the webservers. Participants were randomly assigned to one of three between-subject conditions containing different honeypot proportions: small, medium, and large. With an increase in the proportion of honeypots, the honeypot and no-attack actions increased dramatically. We show how our findings are applicable in deception-based cyber scenarios.