# Do You Really Need to Disguise Normal Servers as Honeypots?

arXiv: https://arxiv.org/abs/2210.17399 · HTML: https://mlsanity.com/paper/2210.17399/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 31 Oct 2022.

## Built on by (most cited first, 1 of 1)

- [Strategic Deployment of Honeypots in Blockchain-based IoT Systems](https://mlsanity.com/paper/2405.12951/) (2024)

## Abstract (arXiv)

A honeypot, which is a kind of deception strategy, has been widely used for at least 20 years to mitigate cyber threats. Decision-makers have believed that honeypot strategies are intuitive and effective, since honeypots have successfully protected systems from Denial-of-Service (DoS) attacks to Advanced Persistent Threats (APT) in real-world cases. Nonetheless, there is a lack of research on the appropriate level of honeypot technique application to choose real-world operations. We examine and contrast three attack-defense games with respect to honeypot detection techniques in this paper. In particular, we specifically design and contrast two stages of honeypot technology one by one, starting with a game without deception. We demonstrate that the return for a defender using honeypots is higher than for a defender without them, albeit the defender may not always benefit financially from using more honeypot deception strategies. Particularly, disguising regular servers as honeypots does not provide defenders with a better reward. Furthermore, we take in consideration that fake honeypots can make maintaining normal nodes more costly. Our research offers a theoretical foundation for the real-world operator's decision of honeypot deception tactics and the required number of honeypot nodes.