Location
Hilton Waikoloa Village, Hawaii
Event Website
https://hicss.hawaii.edu/
Start Date
7-1-2025 12:00 AM
End Date
10-1-2025 12:00 AM
Description
As organisations continue to adopt deception technology, adversaries are becoming aware of this technology. Little is known, however, about how this awareness changes the attacker’s behaviour as they navigate a victim's network. Concurrently, work is being done to build algorithms that predict attacker paths to recommend where to place deceptive assets, but it is not clear whether attacker awareness of deception alters their behaviour sufficiently to render these algorithms ineffective. We present an ongoing mixed method study to better understand how attackers move through a network when they are aware of the presence of deception. Thematic analysis of think-aloud sessions revealed three key decision-making themes. Themes suggest that several industry heuristics for the use of decoys may be inaccurate and impact the efficacy of decoy placement strategies. In addition, effect sizes indicate that awareness of deception leads attackers to take longer paths through the network, although no more decoys were required to detect them.
Recommended Citation
Reeves, Andrew and Ashenden, Debi, "‘It's Not Paranoia If They're Really After You’: When Announcing Deception Technology Can Change Attacker Decisions" (2025). Hawaii International Conference on System Sciences 2025 (HICSS-58). 2.
https://aisel.aisnet.org/hicss-58/da/cyber_deception/2
‘It's Not Paranoia If They're Really After You’: When Announcing Deception Technology Can Change Attacker Decisions
Hilton Waikoloa Village, Hawaii
As organisations continue to adopt deception technology, adversaries are becoming aware of this technology. Little is known, however, about how this awareness changes the attacker’s behaviour as they navigate a victim's network. Concurrently, work is being done to build algorithms that predict attacker paths to recommend where to place deceptive assets, but it is not clear whether attacker awareness of deception alters their behaviour sufficiently to render these algorithms ineffective. We present an ongoing mixed method study to better understand how attackers move through a network when they are aware of the presence of deception. Thematic analysis of think-aloud sessions revealed three key decision-making themes. Themes suggest that several industry heuristics for the use of decoys may be inaccurate and impact the efficacy of decoy placement strategies. In addition, effect sizes indicate that awareness of deception leads attackers to take longer paths through the network, although no more decoys were required to detect them.
https://aisel.aisnet.org/hicss-58/da/cyber_deception/2