Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

HoneyGAN Pots: A Deep Learning Approach for Generating Honeypots

Ryan Gabrys, Daniel Silva, Mark Bilinski

TL;DR

This work investigates using generative adversarial networks to create realistic decoy configurations for low-interaction honeypots, addressing the challenge of selecting and generating effective decoys. A simple data model and two conditional GANs (OS- and device-type-conditioned) are proposed to generate network configurations conditioned on OS or service types, with an unconditional GAN providing diverse outputs. Evaluation using precision-recall distributions shows strong fidelity for generated configurations and robustness against honeypot detectors, while conditional models offer controllability at some cost to PRD. HoneyD-based experiments using GAN-generated decoys yield Karma values comparable to real configurations, underscoring the practical potential of GAN-driven decoy generation for proactive cyber defense.

Abstract

This paper investigates the feasibility and effectiveness of employing Generative Adversarial Networks (GANs) for the generation of decoy configurations in the field of cyber defense. The utilization of honeypots has been extensively studied in the past; however, selecting appropriate decoy configurations for a given cyber scenario (and subsequently retrieving/generating them) remain open challenges. Existing approaches often rely on maintaining lists of configurations or storing collections of pre-configured images, lacking adaptability and efficiency. In this pioneering study, we present a novel approach that leverages GANs' learning capabilities to tackle these challenges. To the best of our knowledge, no prior attempts have been made to utilize GANs specifically for generating decoy configurations. Our research aims to address this gap and provide cyber defenders with a powerful tool to bolster their network defenses.

HoneyGAN Pots: A Deep Learning Approach for Generating Honeypots

TL;DR

This work investigates using generative adversarial networks to create realistic decoy configurations for low-interaction honeypots, addressing the challenge of selecting and generating effective decoys. A simple data model and two conditional GANs (OS- and device-type-conditioned) are proposed to generate network configurations conditioned on OS or service types, with an unconditional GAN providing diverse outputs. Evaluation using precision-recall distributions shows strong fidelity for generated configurations and robustness against honeypot detectors, while conditional models offer controllability at some cost to PRD. HoneyD-based experiments using GAN-generated decoys yield Karma values comparable to real configurations, underscoring the practical potential of GAN-driven decoy generation for proactive cyber defense.

Abstract

This paper investigates the feasibility and effectiveness of employing Generative Adversarial Networks (GANs) for the generation of decoy configurations in the field of cyber defense. The utilization of honeypots has been extensively studied in the past; however, selecting appropriate decoy configurations for a given cyber scenario (and subsequently retrieving/generating them) remain open challenges. Existing approaches often rely on maintaining lists of configurations or storing collections of pre-configured images, lacking adaptability and efficiency. In this pioneering study, we present a novel approach that leverages GANs' learning capabilities to tackle these challenges. To the best of our knowledge, no prior attempts have been made to utilize GANs specifically for generating decoy configurations. Our research aims to address this gap and provide cyber defenders with a powerful tool to bolster their network defenses.
Paper Structure (14 sections, 3 equations, 7 figures, 3 tables)

This paper contains 14 sections, 3 equations, 7 figures, 3 tables.

Table of Contents

  1. Introduction
  2. Our Approach
  3. Contributions
  4. Outline
  5. Background and Related Work
  6. Generative Adversarial Networks
  7. Cyber Defensive Deception
  8. Experimental Setup and GAN Architecture
  9. Dataset and Model
  10. Evaluation
  11. Conclusion
  12. Representation of Port/Service Information in Data Model
  13. Device Types in Conditional DT GAN
  14. Conditional Generator Outputs for Finite Sample Sizes

Figures (7)

  • Figure 1: Discriminator Model
  • Figure 2: Generator Model
  • Figure 3: JSON representation of Windows Server device
  • Figure 4: Sample Data Model for Machine Configuration
  • Figure 5: PRD Plots for Achievable $(\alpha, \beta)$ Pairs Across Different GANs
  • ...and 2 more figures