Software Deception Steering through Version Emulation

Determined cyber adversaries often strategize their attacks by carefully selecting high-value target machines that host insecure (e.g., unpatched) legacy software. In this paper, we propose a moving-target approach to thwart and countersurveil such adversaries, wherein live (non-decoy) enterprise software services are automatically modified deceptively emulate vulnerable versions entice attackers. A game-theoretic framework chooses which emulated stacks, versions, configurations, vulnerabilities yield the best defensive payoffs most useful threat data given specific attack model. The results show effective movement strategies can be computed account for pragmatic aspects of deception, as utility various intelligence-gathering actions, impact vulnerabilities, performance costs patch deployment, complexity exploits, attacker profile.