text: Before executing an attack, adversaries usually explore the victim's network in an attempt to infer the network topology and identify vulnerabilities in the victim's servers and personal computers. Falsifying the information collected by the adversary post penetration may significantly slower lateral movement and increase the amount of noise generated within the victim's network. We investigate the effect of fake vulnerabilities within a real enterprise network on the attacker performance. We use the attack graphs to model the path of an attacker making its way towards a target in a given network. We use combinatorial optimization in order to find the optimal assignments of fake vulnerabilities. We demonstrate the feasibility of our deception-based defense by presenting results of experiments with a large scale real network. We show that adding fake vulnerabilities forces the adversary to invest a significant amount of effort, in terms of time and exploitability cost.
  @cite_19: This paper describes a series of experiments in which specific deceptions were created in order to induce red teams attacking computer networks to attack network elements in sequence. It demonstrates the ability to control the path of an attacker through the use of deceptions and allows us to associate metrics with paths and their traversal.
  @cite_51: This paper describes experimental results on the efficacy of deception as a defense against network attacks.
  @cite_22: Abstract : The purpose of this research was to assess the potential of dynamic network reconfiguration and decoys to defeat adversary network reconnaissance efforts, thereby improving network defense. Specifically, this study sought to determine if the strategy has merit, thus warranting more resource intensive research and engineering studies. The research objective was achieved through a comprehensive literature review and limited technology survey. The key topics examined in the literature review include the network attack process, network defense strategies, deception and continuous unpredictable change. Many candidate technologies were surveyed, but only three identified as high potential were examined in detail: address hopping, honeypots and network telescopes. The following conclusions were reached: (a) the concept has merit and should be pursued further - dynamic network reconfiguration and decoys have demonstrated effectiveness in controlled experiments; (b) it's achievable in the near term - the essential technologies are available today; and (c) extensive analysis and engineering is needed to determine which technologies are appropriate, how and where to integrate them into our networks and how to employ them most effectively.
summary: In cyber security, deception is often used to create a controlled path for attackers to follow starting from the the initial reconnaissance phase. For example, Cohen and Koike @cite_19 @cite_51 showed how deception can control the path of an attack using red teams in experiments attacking a computer network. Repik @cite_22 makes a strong argument in favor of planned actions taken to mislead hackers. If the deception is obvious to the adversary, even unintentionally, the attacker can avoid, bypass, and even overcome the deceptive traps. We aim to avoid this situation and make the deception hard to identify by an adversary. RP Move to intro