Asguard: Adaptive Self-guarded Honeypot

Sereysethy Touch, Jean-Noël Colin

2021

Abstract

Cybersecurity is of critical importance to any organisations on the Internet, with attackers exploiting any security loopholes to attack them. To combat cyber threats, a honeypot, a decoy system, has been an effective tool used since 1991 to deceive and lure attackers to reveal their attacks. However, these tools become increasingly easy to detect, which diminishes their usefulness. Recently, adaptive honeypots, which can change their behaviour in response to attackers, have emerged: despite their promise, however, they still have some shortcomings of their own. In this paper we survey conventional and adaptive honeypots and discuss their limitations. We introduce an approach for adaptive honeypots that uses Q-learning, a reinforcement learning algorithm, to effectively achieve two objectives at the same time: (1) learn to engage with attacker to collect their attack tools and (2) guard against being compromised by combining state environment and action to form a new reward function.

Paper Citation

in Harvard Style

Touch S. and Colin J. (2021). Asguard: Adaptive Self-guarded Honeypot. In Proceedings of the 17th International Conference on Web Information Systems and Technologies - Volume 1: DMMLACS, ISBN 978-989-758-536-4, pages 565-574. DOI: 10.5220/0010719100003058

in Bibtex Style

@conference{dmmlacs21,
author={Sereysethy Touch and Jean-Noël Colin},
title={Asguard: Adaptive Self-guarded Honeypot},
booktitle={Proceedings of the 17th International Conference on Web Information Systems and Technologies - Volume 1: DMMLACS,},
year={2021},
pages={565-574},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0010719100003058},
isbn={978-989-758-536-4},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 17th International Conference on Web Information Systems and Technologies - Volume 1: DMMLACS,
TI - Asguard: Adaptive Self-guarded Honeypot
SN - 978-989-758-536-4
AU - Touch S.
AU - Colin J.
PY - 2021
SP - 565
EP - 574
DO - 10.5220/0010719100003058