The Lemmy Club
  • Communities
  • Create Post
  • Create Community
  • heart
    Support Lemmy
  • search
    Search
  • Login
  • Sign Up
digicat@infosec.pubM to blueteamsec@infosec.pubEnglish · 15 days ago

Network and Device Level Cyber Deception for Contested Environments Using RL and LLMs

arxiv.org

external-link
message-square
0
link
fedilink
3
external-link

Network and Device Level Cyber Deception for Contested Environments Using RL and LLMs

arxiv.org

digicat@infosec.pubM to blueteamsec@infosec.pubEnglish · 15 days ago
message-square
0
link
fedilink
Cyber deception assists in increasing the attacker's budget in reconnaissance or any early phases of threat intrusions. In the past, numerous methods of cyber deception have been adopted, such as IP address randomization, the creation of honeypots and honeynets mimicking an actual set of services, and networks deployed within an enterprise or operational technology(OT) network. These types of strategies follow naive approaches of recreating services that are expensive and that need a lot of human intervention. The advent of cloud services and other automations of containerized applications, such as Kubernetes, makes cyber defense easier. Yet, there remains a lot of potential to improve the accuracy of these deception strategies and to make them cost-effective using artificial intelligence (AI)-based solutions by making the deception more dynamic. Hence, in this work, we review various AI-based solutions in building network- and device-level cyber deception methods in contested environments. Specifically, we focus on leveraging the fusion of large language models (LLMs) and reinforcement learning(RL) in optimally learning these cyber deception strategies and validating the efficacy of such strategies in some stealthy attacks against OT systems in the literature.
alert-triangle
You must log in or # to comment.

blueteamsec@infosec.pub

blueteamsec@infosec.pub

Subscribe from Remote Instance

Create a post
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !blueteamsec@infosec.pub

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

Visibility: Public
globe

This community can be federated to other instances and be posted/commented in by their users.

  • 14 users / day
  • 104 users / week
  • 270 users / month
  • 495 users / 6 months
  • 3 local subscribers
  • 672 subscribers
  • 750 Posts
  • 54 Comments
  • Modlog
  • mods:
  • digicat@infosec.pub
  • BE: 0.19.17
  • Modlog
  • Legal
  • Instances
  • Docs
  • Code
  • join-lemmy.org