As an active defense paradigm, cyber deception technology effectively misleads attackers by constructing deceptive network environments, thereby increasing the cost of attack operations and introducing uncertainty into their decision-making, while providing defenders with critical response time. However, existing deception strategies are mostly based on predefined static rules derived from expert knowledge and lack the ability to adapt to dynamic attack scenarios autonomously and intelligently. This limitation results in poor adaptability and suboptimal performance of the strategy. To solve these issues, this paper proposes an Adaptive Cyber Deception Defense System (ACDDS). Different from off-the-shelf MDP/DQN frameworks in existing adaptive defense, the core innovation of ACDDS is a scenario-customized Trigger-based Adaptive Deception Strategy evolution method using Deep Q-Networks (TADS-DQN). We specifically formulate the dynamic deception strategy optimization as a cyber-deception-tailored Markov Decision Process (MDP). In this model, the state of the system is represented as a state matrix, and the attack behavior defines the environment for agent interaction. The TADS-DQN method employs a trigger-based mechanism: when a threat to real services is detected, a Deep Q-Network agent is activated. This agent takes the current system state as input and outputs the optimal reconfiguration action. The simulation results indicate that, compared to the baseline methods, TADS-DQN provides more stable defense performance, as evidenced by a smaller fluctuation range and a lower standard deviation of the attack success rate. At the same time, it achieves a reduction in the hit rate against real services that is competitive with the baseline methods.
Zhao et al. (Mon,) studied this question.