Strengthening cyber deception strategies through simulated user behavior

Abstract

Cyber ​​deception is a key defensive strategy for detecting and countering advanced persistent threats and sophisticated attacks. However, the implementation of traditional activities, such as decoy services, often lacks credible support to bolster their effectiveness. In general, honeypots and honeytokens have limitations such as a lack of realism due to static configurations and the absence of human activity traces. Simulating actions is costly, and creating and maintaining profiles is difficult to scale, as is automation and integration. In this paper, we present a tool designed to automate the generation of realistic activities and behaviors for decoy users, seeking to integrate customized and consistent patterns of human interaction into cyber deception scenarios to improve the credibility of the operation. Based on the MITRE Engage framework, the tool contributes to strengthening defensive operations by addressing a key challenge of cyber deception strategies.