Planning for Attacker Entrapment in Adversarial Settings

Abstract

In this paper, we propose a planning framework to generate a defense strategy against an attacker who is working in an environment where the defender can operate covertly. Here the objective of the defender is to covertly guide the attacker to a trap state from which the attacker cannot achieve their goal. Further, the defender is constrained to achieve its goal within a K number of steps, where K is calculated as a pessimistic lower bound within which the attacker is likely to not suspect any foul play in the environment. Such a defense strategy is highly useful in real-world systems like honeypots or honeynets where an unsuspecting attacker interacts with a simulated production system while assuming it is the actual production system. Typically, the game between an attacker and a defender is captured using game theoretic frameworks. However, our problem formulation allows us to capture it as a much simpler infinite-horizon discounted MDP where the optimal policy to the MDP gives the defender's strategy against the actions of the attacker. Through empirical evaluation, we show the merits of our problem formulation.