Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Application Layer Cyber Deception without Developer Interaction

Mario Kahlhofer, Stefan Rass

TL;DR

This paper addresses the challenge of deploying application-layer cyber deception without access to source code, focusing on runtime, post-deployment integration in cloud-native environments such as Kubernetes. It surveys 19 techniques, categorizing them by deployment location (container/pod, kernel/network, container platform) and whether they require developer interaction, and evaluates them along technical, topological, operational, and efficacy properties. The authors provide a structured taxonomy (including D-C-S types and deployment modes) and identify underexplored approaches, such as Kubernetes-native patterns and software frameworks, that could reduce interference and improve maintainability. The work aims to bridge theory and production practice, enabling more dynamic, scalable, and personalized deception strategies that operate near the application while remaining compatible with modern cloud-native ecosystems.

Abstract

Cyber deception techniques that are tightly intertwined with applications pose significant technical challenges in production systems. Security measures are usually the responsibility of a system operator, but they are typically limited to accessing built software artifacts, not their source code. This limitation makes it particularly challenging to deploy cyber deception techniques at application runtime and without full control over the software development lifecycle. This work reviews 19 technical methods to accomplish this and evaluates them based on technical, topological, operational, and efficacy properties. We find some novel techniques beyond honeypots and reverse proxies that seem to have received little research interest despite their promise for cyber deception. We believe that overcoming these technical challenges can drive the adoption of more dynamic and personalized cyber deception techniques, tailored to specific classes of applications.

Application Layer Cyber Deception without Developer Interaction

TL;DR

This paper addresses the challenge of deploying application-layer cyber deception without access to source code, focusing on runtime, post-deployment integration in cloud-native environments such as Kubernetes. It surveys 19 techniques, categorizing them by deployment location (container/pod, kernel/network, container platform) and whether they require developer interaction, and evaluates them along technical, topological, operational, and efficacy properties. The authors provide a structured taxonomy (including D-C-S types and deployment modes) and identify underexplored approaches, such as Kubernetes-native patterns and software frameworks, that could reduce interference and improve maintainability. The work aims to bridge theory and production practice, enabling more dynamic, scalable, and personalized deception strategies that operate near the application while remaining compatible with modern cloud-native ecosystems.

Abstract

Cyber deception techniques that are tightly intertwined with applications pose significant technical challenges in production systems. Security measures are usually the responsibility of a system operator, but they are typically limited to accessing built software artifacts, not their source code. This limitation makes it particularly challenging to deploy cyber deception techniques at application runtime and without full control over the software development lifecycle. This work reviews 19 technical methods to accomplish this and evaluates them based on technical, topological, operational, and efficacy properties. We find some novel techniques beyond honeypots and reverse proxies that seem to have received little research interest despite their promise for cyber deception. We believe that overcoming these technical challenges can drive the adoption of more dynamic and personalized cyber deception techniques, tailored to specific classes of applications.
Paper Structure (33 sections, 3 figures, 1 table)

This paper contains 33 sections, 3 figures, 1 table.

Table of Contents

  1. Introduction
  2. Problem Scope
  3. Related Work, Surveys, and Taxonomies
  4. Properties of Technical Methods
  5. Technical Methods
  6. Supporting Methods
  7. inner color=ColorA,outer color=FillA,fill color=FillA1S1 Deployment Agent
  8. inner color=ColorA,outer color=FillA,fill color=FillA1S2 Kubernetes Operator and API
  9. inner color=ColorA,outer color=FillA,fill color=FillA1S3 Secondary Containers
  10. inner color=ColorA,outer color=FillA,fill color=FillA1S4 Container Lifecycle Hooks
  11. inner color=ColorB,outer color=FillB,fill color=FillB1HP Self-contained Honeypots
  12. inner color=ColorC,outer color=FillC,fill color=FillC1RP Reverse Proxies
  13. Container- and Pod-specific Methods
  14. inner color=ColorD,outer color=FillD,fill color=FillD1C1 Container File Modifications
  15. inner color=ColorD,outer color=FillD,fill color=FillD1C2 Runtime Instrumentation
  16. ...and 18 more sections

Figures (3)

  • Figure 1: Components of a typical Kubernetes cluster.
  • Figure 2: Properties of technical methods for application layer cyber deception.
  • Figure 3: A topological overview of the 19 technical methods that we present.