A Bayesian Improved Defense Model for Deceptive Attack in Honeypot-Enabled Networks

Internet and cloud computing are developing rapidly. Nowadays malicious network users often conceal attacks as ordinary access, but intrusion detection systems can not completely distinguish them. This paper proposed a decision model for network defenders of honeypot-enabled system. It firstly modeled the interaction between the malicious user and the defender as repeated games, and depicted the uncertainty behaviors of the malicious users by Bayesian model. Then based on the relative historical payoffs of game players, a Bayesian improved model is proposed. By the model defender decides whether to lead the visitor to regular services or to honeypots, which increases the attacker's cost and reduces attacks finally.