Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Adaptive Honeypot Allocation in Multi-Attacker Networks via Bayesian Stackelberg Games

Dongyoung Park, Gaby G. Dagher

TL;DR

This work models defense against multiple concurrent attackers as a Bayesian Stackelberg game, where a defender pre-commits to honeypot placements and adversaries observe and respond on layered attack graphs. A MILP-based framework computes defender strategies while anticipating heterogeneous attacker types and dynamic belief updates from IDS observations, enabling adaptive reallocation of decoys over multiple rounds. The approach captures non-zero-sum interactions, exploit-aware path costs, and Bayesian updating to distill attacker intents, achieving rapid reductions in attack success and scalability to networks with hundreds of nodes. Empirical results demonstrate near-zero attack success within a few rounds and favorable scalability up to 500 nodes and 1,500+ edges, highlighting practical impact for real-world network defense.

Abstract

Defending against sophisticated cyber threats demands strategic allocation of limited security resources across complex network infrastructures. When the defender has limited defensive resources, the complexity of coordinating honeypot placements across hundreds of nodes grows exponentially. In this paper, we present a multi-attacker Bayesian Stackelberg framework modeling concurrent adversaries attempting to breach a directed network of system components. Our approach uniquely characterizes each adversary through distinct target preferences, exploit capabilities, and associated costs, while enabling defenders to strategically deploy honeypots at critical network positions. By integrating a multi-follower Stackelberg formulation with dynamic Bayesian belief updates, our framework allows defenders to continuously refine their understanding of attacker intentions based on actions detected through Intrusion Detection Systems (IDS). Experimental results show that the proposed method prevents attack success within a few rounds and scales well up to networks of 500 nodes with more than 1,500 edges, maintaining tractable run times.

Adaptive Honeypot Allocation in Multi-Attacker Networks via Bayesian Stackelberg Games

TL;DR

This work models defense against multiple concurrent attackers as a Bayesian Stackelberg game, where a defender pre-commits to honeypot placements and adversaries observe and respond on layered attack graphs. A MILP-based framework computes defender strategies while anticipating heterogeneous attacker types and dynamic belief updates from IDS observations, enabling adaptive reallocation of decoys over multiple rounds. The approach captures non-zero-sum interactions, exploit-aware path costs, and Bayesian updating to distill attacker intents, achieving rapid reductions in attack success and scalability to networks with hundreds of nodes. Empirical results demonstrate near-zero attack success within a few rounds and favorable scalability up to 500 nodes and 1,500+ edges, highlighting practical impact for real-world network defense.

Abstract

Defending against sophisticated cyber threats demands strategic allocation of limited security resources across complex network infrastructures. When the defender has limited defensive resources, the complexity of coordinating honeypot placements across hundreds of nodes grows exponentially. In this paper, we present a multi-attacker Bayesian Stackelberg framework modeling concurrent adversaries attempting to breach a directed network of system components. Our approach uniquely characterizes each adversary through distinct target preferences, exploit capabilities, and associated costs, while enabling defenders to strategically deploy honeypots at critical network positions. By integrating a multi-follower Stackelberg formulation with dynamic Bayesian belief updates, our framework allows defenders to continuously refine their understanding of attacker intentions based on actions detected through Intrusion Detection Systems (IDS). Experimental results show that the proposed method prevents attack success within a few rounds and scales well up to networks of 500 nodes with more than 1,500 edges, maintaining tractable run times.

Paper Structure

This paper contains 37 sections, 15 equations, 6 figures, 2 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Contribution
  3. Related Work
  4. System Model
  5. Network Environment
  6. Adversary Model
  7. Multi-Attacker Setting and Attack Graphs
  8. Attacker Capabilities and Objectives
  9. Proposed Game-Theoretic Framework
  10. Bayesian Stackelberg Game Formulation
  11. Defender's and Attacker's Actions
  12. Defender Actions
  13. Attacker Actions
  14. Reward Function
  15. Defender Reward :
  16. ...and 22 more sections

Figures (6)

  • Figure 1: Network Structure
  • Figure 2: Attack Success Rate Across Rounds
  • Figure 3: Impact of the discount factor
  • Figure 4: Impact of the honeypot cost
  • Figure 5: Defender's Expected Utility versus the number of honeypots
  • ...and 1 more figures