Categorization of cyber security deception events for measuring the severity level of advanced targeted breaches
Teemu Väisänen · 2017
Advanced attackers have become more sophisticated in their target selection, evasion of detection and monetization of breached data. Cyber deception is used for gathering information about botnets and spreading worms, and to detect persistent external attackers hidden into the systems as well as insider threats. Decoys are resources that should not be normally accessed. They raise alerts and provide information when systems have been compromised. Decoys can be used for learning about automated malicious tools and behavior of the adversaries, as well as to slow down the attacks.