AN EFFICIENT STRATEGY FOR DEPLOYING DECEPTION TECHNOLOGY

Implementations of deception technology is crucial in discovering attacks by creating a controlled and monitored environment for detecting malicious activity. This technology involves the deployment of decoys, traps, and honeypots that mimic natural systems and network assets to attract and identify attackers. The use of deception technology provides an early warning system for detecting cyber-attacks, allowing organizations to respond quickly and mitigate damage. This article proposed a framework that focuses on maximizing the efficiency of deception technology in detecting sophisticated attacks. The framework employs multi-layered deception techniques at various levels of the network, system, and application to provide comprehensive coverage and increase the likelihood of detecting attacks. The strategic placement of decoys and honeypots throughout the network ensures maximum visibility to potential attackers and minimizes accidental interaction with legitimate users. The framework adapts dynamically to changes in the network environment, maintaining the effectiveness of decoys and honeypots through obfuscation, encryption, and access control. Additionally, the framework integrates seamlessly with existing security tools, such as intrusion detection systems, firewalls, and SIEM systems, for efficient threat intelligence sharing and unified response to detected attacks. This thesis aims to present a comprehensive strategy for utilizing deception technology. Our proposed approach focuses on defining realistic decoy attributes and fingerprints and identifying the most suitable locations to deploy the decoys within the network for improved visibility and enhanced detection capabilities. Furthermore, we outline effective techniques for minimizing false negatives in logs, and increasing accuracy. Additionally, we conduct lab demonstrations to simulate various types of attacks and demonstrate how deception technology can successfully detect them