[Paper Review] Incorporating Deception into CyberBattleSim for Autonomous Defense

Erich C. Walter, Kimberly Ferguson‐Walter+1 more|arXiv (Cornell University)|Aug 31, 2021

Network Security and Intrusion Detection17 references4 citations

TL;DR

This paper integrates cyber deception—specifically honeypots and decoys—into Microsoft's CyberBattleSim reinforcement learning environment to evaluate their impact on autonomous attacker agents. Results show that increasing the number and strategically placing deceptive elements significantly reduces attacker cumulative rewards, demonstrating that deception can effectively impede automated cyber attacks in simulated enterprise networks.

ABSTRACT

Deceptive elements, including honeypots and decoys, were incorporated into the Microsoft CyberBattleSim experimentation and research platform. The defensive capabilities of the deceptive elements were tested using reinforcement learning based attackers in the provided capture the flag environment. The attacker's progress was found to be dependent on the number and location of the deceptive elements. This is a promising step toward reproducibly testing attack and defense algorithms in a simulated enterprise network with deceptive defensive elements.

Motivation & Objective

• To investigate the feasibility of incorporating cyber deception into an autonomous cyber defense simulation environment.
• To quantify how deception elements such as honeypots and decoys affect the behavior and success of reinforcement learning-based attackers.
• To provide a reproducible, dynamic simulation platform for testing autonomous defense algorithms with deceptive elements.
• To inform the design of future autonomous defender agents that can dynamically deploy and manage deception techniques.

Proposed method

• Enhanced the CyberBattleSim environment with configurable honeypots and decoys to simulate deceptive defensive elements in a network.
• Deployed reinforcement learning agents (DQL, QTAB, CRED, RAND) as attackers to explore their behavior in response to deception.
• Varied the number and placement (frontloaded vs. backloaded) of deceptive elements to assess their impact on attacker progress.
• Measured attacker performance using cumulative reward over time as a proxy for success in achieving network compromise.
• Used network path inference to determine optimal locations for deception deployment based on attacker progression.
• Evaluated multiple reward functions (RAND, CRED, QTAB, DQL) to assess agent sensitivity to deception across different learning strategies.

Experimental results

Research questions

• RQ1 How does the number of deceptive elements (decoys and honeypots) affect the cumulative reward of reinforcement learning-based attackers in CyberBattleSim?
• RQ2 How does the spatial layout of deceptive elements (frontloaded vs. backloaded) influence attacker behavior and success?
• RQ3 Which types of attackers (e.g., DQL, CRED, QTAB) are most affected by deception, and why?
• RQ4 Can deception serve as a high-confidence early warning mechanism that enables autonomous defenders to disrupt attackers proactively?
• RQ5 How can autonomous defenders leverage dynamic deception deployment to optimize defense outcomes?

Key findings

• Increasing the number of decoys significantly reduced the cumulative reward of all attacker agents, with the most pronounced effect observed in the DQL and CRED agents.
• Frontloaded deception (placed earlier in the network path) was more effective at reducing attacker progress than backloaded placement, especially for DQL and QTAB agents.
• The placement of a single decoy at step 3 (AzureStorage) or step 6 (Azure Resource Manager) disrupted the CRED and QTAB agents, indicating that strategic placement can impede specific attack strategies.
• The DQL agent was affected by a website decoy at step 1, suggesting that early deception can disrupt even deep reinforcement learning attackers.
• Honeypots placed at critical network junctions (e.g., step 1 or step 6) reduced attacker rewards across all agent types, confirming their effectiveness in delaying and disrupting attacks.
• Standard deviation in reward curves indicates that deception effects are consistent and measurable, supporting the reliability of the simulation for future research.