  Lateral movement of advanced persistent threats has posed a severe security
challenge. Due to the stealthy and persistent nature of the lateral movement,
defenders need to consider time and spatial locations holistically to discover
latent attack paths across a large time-scale and achieve long-term security
for the target assets. In this work, we propose a time-expanded random network
to model the stochastic service links in the user-host enterprise network and
the adversarial lateral movement. We design cognitive honeypots at idle
production nodes and disguise honey links as service links to detect and deter
the adversarial lateral movement. The location of the honeypot changes randomly
at different times and increases the honeypots' stealthiness. Since the
defender does not know whether, when, and where the initial intrusion and the
lateral movement occur, the honeypot policy aims to reduce the target assets'
Long-Term Vulnerability (LTV) for proactive and persistent protection. We
further characterize three tradeoffs, i.e., the probability of interference,
the stealthiness level, and the roaming cost. To counter the curse of multiple
attack paths, we propose an iterative algorithm and approximate the LTV with
the union bound for computationally efficient deployment of cognitive
honeypots. The results of the vulnerability analysis illustrate the bounds,
trends, and a residue of LTV when the adversarial lateral movement has infinite
duration. Besides honeypot policies, we obtain a critical threshold of
compromisability to guide the design and modification of the current system
parameters for a higher level of long-term security. We show that the target
node can achieve zero vulnerability under infinite stages of lateral movement
if the probability of movement deterrence is not less than the threshold.
