Deception technology has appeared on the market of information security systems relatively recently. However, some experts still consider Security Deception to be just a more advanced “honeypot.” In this article, we will try to highlight both the similarities and fundamental differences between these two solutions. In the first part, we will tell you about honeypot, how this technology developed and what are its advantages and disadvantages. And in the second part, we will dwell on the principles of operation of platforms for creating a distributed infrastructure of false targets (DDP).
Information security is a complex of technical and organizational measures and developed
documents in the broadest sense of the word. The main goal is to protect and preserve information
owned by the organization. However, information security remains an integral part of cybersecurity, a
much broader category, and includes the protection of information and data, as well as the protection
of systems, networks, etc. [
2022 Copyright for this paper by its authors.
For the first time, the term “honeypots” was used in 1989 in the book “The Cuckoo’s Egg” by
Clifford Stoll, which describes the events of tracking a hacker at the Lawrence Berkeley National
Laboratory (USA). This idea was put into practice in 1999 by Lance Spitzner, an information security
specialist at Sun Microsystems, who founded the Honeynet Project. The first honeypots were very
resource intensive, difficult to set up and maintain [
Let’s take a closer look at what honeypots and honeynets are. Honeypots are separate hosts, the purpose of which is to attract intruders to penetrate the company's network and try to steal valuable data, as well as expand the network coverage. A honeypot (literally translated as “a keg of honey”) is a special server with a set of different network services and protocols such as HTTP, FTP, etc. (Fig. 1).
If we combine several honeypots into a network, then we get a more efficient honeynet system,
which is an emulation of the company's corporate network (web server, file server, and other network
components). Such a solution allows us to understand the strategy of actions of the attackers and
mislead them. A typical honeynet typically runs in parallel with, and completely independent of, a
production network. Such a "network" can be published on the Internet via a separate channel, and a
separate range of IP addresses can also be allocated for it [
The obvious benefit of honeynets is that they mislead intruders, wasting their energy, resources and time. As a result, instead of real targets, they attack false ones and can stop attacking the network without achieving anything. Most often, honeynets technologies are used in government agencies and large corporations, financial organizations, since these structures are the targets for large cyber attacks.
Why are honeypots and honeynets not the best solutions to counter attacks today? It should be noted that attacks are becoming more large-scale, technically complex and capable of causing serious damage to the IT infrastructure of an organization, while cybercrime has reached a completely different level and represents highly organized shadow business structures equipped with all the necessary resources. To this must be added the “human factor” (errors in the settings of software and hardware, actions of insiders, etc.), so the use of only technologies to prevent attacks is no longer enough at the moment.
Below are the main limitations and disadvantages of honeypots (honeynets): Honeypots were originally designed to identify threats that are outside the corporate network, are intended rather to analyze the behavior of intruders and are not designed to quickly respond to threats. Attackers have usually learned how to recognize emulated systems and avoid honeypots. Honeynets (honeypots) have an extremely low level of interactivity and interaction with other security systems, as a result of which, using honeypots, it is difficult to obtain detailed information about attacks and attackers, and therefore, to effectively and quickly respond to information security incidents. Moreover, information security specialists receive a large number of false alerts about threats. In some cases, hackers can use a compromised honeypot as a starting point to continue their attack on an organization's network. Problems often arise with the scalability of honeypots, high operational load and configuration of such systems (they require highly qualified specialists, do not have a convenient management interface, etc.). There are great difficulties in deploying honeypots in specialized environments such as IoT, POS, cloud systems, etc.
Having studied all the advantages and disadvantages of honeypots, we come to the conclusion that
a completely new approach to responding to information security incidents is needed in order to
develop a quick and adequate response to the actions of attackers. And such a solution is Cyber
deception (Security deception) technologies [
The terminology “Cyber deception,” “Security deception,” “Deception technology,” “Distributed Deception Platform” (DDP) is relatively new and appeared not so long ago. In fact, all of these terms mean the use of “deception technologies” or “techniques to imitate IT infrastructure and misinform attackers.” The simplest Deception solutions are the development of honeypots ideas, only at a more technologically advanced level, which involves more automation in detecting and responding to threats. However, there are already serious DDP-class solutions on the market, which imply ease of deployment and scalability, and also have a serious arsenal of “traps” and “baits” for attackers.
How does the “Distributed Deception Platform” work? After the deployment of DDP, the IT infrastructure of the organization will be built as if from two layers: the first layer is the real infrastructure of the company, and the second is an "emulated" environment consisting of decoys, traps and decoys. lures) that are located on real physical devices on the network (Fig. 2).
For example, an attacker can detect false databases with “confidential documents,” fake credentials of supposedly “privileged users”—all these are false targets, they can interest the attackers, thereby diverting their attention from the true information assets of the company.
DDP is a novelty in the market of information security products, these solutions are only a few years old and so far only the corporate sector can afford them. But small and medium businesses will soon be able to take advantage of Deception, leasing DDPs from specialized providers “as a service.” This option is even more convenient, since there is no need for your own highly qualified personnel.
The main benefits of Deception technology are shown below: Authenticity (authenticity). Deception technology is able to reproduce a completely authentic IT environment of a company, qualitatively emulating operating systems, IoT, POS, specialized systems (medical, industrial, etc.), services, applications, credentials, etc. Decoys are carefully mixed with the production environment, and an attacker would not be able to identify them as honeypots. Implementation. DDPs use machine learning (ML) in their work. ML provides simplicity, customization, and efficiency in implementing Deception. “Traps” and “decoys” are very quickly updated, involving the attacker in the “false” IT infrastructure of the company, and in the meantime, advanced analysis systems based on artificial intelligence can detect active hacker actions and prevent them (for example, an attempt to access Active Directory based on fraudulent accounts). Ease of operation. Modern “Distributed Deception Platforms” are easy to maintain and manage.
Typically, they are managed through a local or cloud console, there is the possibility of integration with the corporate SOC (Security Operations Center) through the API and with many existing security controls. DDP service and operation does not require the services of highly qualified information security experts. Scalability. Security deception can be deployed in physical, virtual and cloud environments.
DDPs successfully work with specialized environments such as IoT, ICS, POS, SWIFT, etc. Enhanced Deception platforms can project “trickery” technologies into remote offices, isolated environments, without the need for additional full platform deployment. Interaction. Using effective and attractive decoys that are based on real operating systems and cleverly placed among the real IT infrastructure, the Deception platform collects a wealth of information about the attacker. DDP then delivers threat alerts, generates reports, and automatically responds to information security incidents. The starting point of the attack. In modern Deceptions, traps and baits are placed within the range of the network, rather than outside of it (as is the case with honeypots). This model of deploying traps prevents an attacker from using them as a launching point for an attack on a company's real IT infrastructure. In more advanced solutions of the Deception class, there are traffic routing capabilities, thus it is possible to direct all traffic of the attackers through a dedicated connection. This will allow you to analyze the activity of intruders without risking the company's valuable assets. The persuasiveness of "technology of deception". At the initial stage of an attack, cybercriminals collect and analyze data about the IT infrastructure, and then use it to move horizontally across the corporate network. With the help of "technologies of deception" the attacker will surely fall into "traps" that will lead him away from the real assets of the organization. DDP will analyze potential paths to access credentials on the corporate network and provide the attacker with "decoys" instead of the real credentials. These capabilities have been sorely lacking in honeypot technology.
We come to the most interesting point of our research. Let’s try to highlight the main differences
between Deception and Honeypot technologies. Despite some similarities, these two technologies are
still very different, ranging from the fundamental idea to the efficiency of work [
As an example of Honeypot and Deception technology comparison, please check Table 1. Please note that this is rough comparison chart made by looking over the standard possibilities provided by each platform and don’t includes unique solutions provided by private companies. Also this chart uses format from the previous tables that can be seen. It is done for the sake of formatting and for the purpose to create a standard for this kind of comparison between similar but different technologies. This way we will have a basic chart using all actual and use-case technologies in one place. Deception technology
Linux/ Windows Intelligence: Active + + + + + + + + + + + + + + + + + AWS/Azure + + + + + + + + + +
For a scientific point of view we conducted a simple test by facing both out-of-the-box systems before written detection bot. As far as we can see form the Fig. 3, the Deception system has lower percentage in comparison to Honeypot to be detected. This tendentious fracture is secured on every try of the test. On average Honeypot is by 7% more detectable. The comparison you can see from the Fig. 4.
Deception technology is a huge improvement over the older Honeypots technology. In essence, DDP has become a comprehensive security platform that is easy to deploy and manage.
Modern platforms of this class play an important role in accurate detection and effective response to network threats, and their integration with other components of the security stack increases the level of automation, increases the efficiency and effectiveness of incident response. Deception platforms are based on authenticity, scalability, ease of management and integration with other systems. All this gives a significant advantage in the speed of response to information security incidents.
Also, based on observations of pentests of companies where the system was implemented, it can be concluded that even experienced pentesters often cannot recognize the baits in the corporate network and are defeated, falling for the set traps. This fact once again confirms the effectiveness of Deception and the great prospects that open up for this technology in the future. 6. References