Catching the Wily Hacker: A multilayer deception system

In recent years, enterprises have been facing a growing number of highly customized attacks using sophisticated techniques that seek to compromise important company assets. In this paper, we propose a multi-layer deception system that provides an in depth defense against such sophisticated attacks. Specifically, based on previous knowledge and patterns of such attacks, we model the attacker as trying to compromising an enterprise network via multiple stages of penetration and propose defenses at each of these layers using deception based detection. We present a proof of concept implementation of one of the key deception methods proposed. Due to various financial constraints of an enterprise, we model the design of the deception system as an optimization problem in order to minimize the expected losses due to system deployment and asset compromise.