Control and Decision-Making in Deceptive Multi-Computer Systems Based on Previous Experience for Cybersecurity of Critical Infrastructure
Source abstract
Abstract
The paper presents methods for organizing decision-making and the functioning of deceptive multi-computer systems based on prior operational experience and multiple task execution options. A formal representation of system components and their interconnections is developed, distinguishing between the system center and the decision-making controller. The system center prepares possible task execution options, while the decision-making controller evaluates these options considering past performance and selects one. Analytical expressions are proposed to describe processes within multi-computer systems, enabling autonomous decision-making in task execution. A method is developed for organizing the decision-making controller’s operation to ensure the selection of a task option based on prior experience, component security levels, and system topology. This approach allows for the formation of polymorphic responses to external and internal actions in corporate networks. Additionally, a method for organizing system functioning enables systems to adapt their properties, structure, and interconnections in response to functional and cybersecurity conditions. This can be used especially in cybersecurity of critical infrastructure systems like electrical power grids, smart grid infrastructure, energy plants and industrial control systems. A prototype was developed and tested under two scenarios: choosing among five task options and having only one option. Results showed greater operational stability in the first case, confirming that incorporating prior experience enhances resilience and creates polymorphic responses that hinder attackers’ attempts to study and exploit corporate networks.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Smart Grid Security and Resilience · Infrastructure Resilience and Vulnerability Analysis · Information and Cyber Security
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Computer Engineering and Information Systems, Information Technologies Faculty, Khmelnytskyi National University, 29016 Khmelnytskyi, Ukraine
Faculty of Electrical and Computer Engineering, Cracow University of Technology, 24, Warszawska, 31-155 Cracow, Poland
Research Institute for Intelligent Computer Systems, West Ukrainian National University, 46020 Ternopil, Ukraine
Department of Informatics and Teleinformatics, Kazimierz Pulaski University of Radom, 26-600 Radom, Poland
References (54)
Show source-provided references
1. Breeden, J. (2025, September 12). 5 Top Deception Tools and How They Ensnare Attackers. CSO Online 2025. Retrieved 6 February 2025. Available online: https://www.csoonline.com/article/570063/5-top-deception-tools-and-how-they-ensnare-attackers.html.
2. Labyrinth Deception Platform (2025, September 12). Labyrinth Tech 2025. Retrieved 6 February 2025. Available online: https://labyrinth.tech/platform.
3. Principle and method of deception systems synthesizing for malware and computer attacks detection10.32620/reks.2023.4.10 ↗
4. Multi-computer malware detection systems with metamorphic functionality10.32620/reks.2024.1.13 ↗
5. Savenko, B., Kashtalian, A., Lysenko, S., and Savenko, O. (2023, January 7–9). Malware detection by distributed systems with partial centralization. Proceedings of the 2023 IEEE 12th International Conference on Intelligent Data Acquisition and Advanced Computing Systems: Technology and Applications (IDAACS), Dortmund, Germany.10.1109/IDAACS58523.2023.10348773 ↗
6. Proofpoint Identity Threat Defense (2025, September 12). Proofpoint 2025. Retrieved 6 February 2025. Available online: https://www.proofpoint.com/us/illusive-is-now-proofpoint.
7. The Commvault Data Protection Platform (2025, September 12). Commvault 2025. Retrieved 6 February 2025. Available online: https://www.commvault.com/.
8. SentinelOne (2025, September 12). SentinelOne 2025. Retrieved 6 February 2025. Available online: https://www.sentinelone.com/surfaces/identity/.
9. Counter Craft Security (2025, September 12). CounterCraft 2025. Retrieved 26 January 2025. Available online: https://www.countercraftsec.com/.
10. Fidelis Security (2025, September 12). Fidelis Security 2025. Retrieved 6 February 2025. Available online: https://fidelissecurity.com/fidelis-elevate/.
11. Lightweight on-demand honeypot deployment for cyber deception
12. Katakwar, H., Aggarwal, P., Maqbool, Z., and Dutt, V. (2020). Influence of network size on adversarial decisions in a deception game involving honeypots. Front. Psychol., 11.10.3389/fpsyg.2020.535803 ↗
13. Anwar, A.H., Zhu, M., Wan, Z., Cho, J.-H., Kamhoua, C.A., and Singh, M.P. (2022, January 4–8). Honeypot-based cyber deception against malicious reconnaissance via hypergame theory. Proceedings of the IEEE GLOBECOM, Rio de Janeiro, Brazil.10.1109/GLOBECOM48099.2022.10000813 ↗
14. Wang, H., and Wu, B. (2019, January 15–17). SDN-based hybrid honeypot for attack capture. Proceedings of the 2019 IEEE 3rd Information Technology, Networking, Electronic and Automation Control Conference (ITNEC), Chengdu, China.10.1109/ITNEC.2019.8729425 ↗
15. Zhang, L., and Thing, V.L.L. (2021). Three decades of deception techniques in active cyber defense—Retrospect and outlook. Comput. Secur., 106.10.1016/j.cose.2021.102288 ↗
16. Cutting edge trends in deception-based intrusion detection systems—A survey
17. Deception techniques in computer security10.1145/3214305 ↗
18. Trassare, S.T. (2025, September 12). A Technique for Presenting a Deceptive Dynamic Network Topology. Semantic Scholar 2023. Available online: https://www.semanticscholar.org/paper/A-Technique-for-Presenting-a-Deceptive-Dynamic-Trassare-Monterey/2d976496fff27f6b7d3fdd4076a353070be12342.
19. A survey on intrusion detection systems and honeypot-based proactive security mechanisms in VANETs and VANET Cloud
20. A novel honeypot-based security approach for real-time intrusion detection and prevention systems
21. Design and implementation of intelligent security framework using hybrid intrusion detection and prevention system
22. Parveen, S., Khan, M.A., and Mirza, A.H. (2021). A comprehensive survey of honeypot-based cybersecurity threat detection and mitigation tools: A taxonomy and future directions. J. Netw. Comput. Appl., 182.
23. Honeypot-based moving target defense mechanism for industrial internet of things
24. Mitchell, R., and Chen, R. (2014). A survey of intrusion detection techniques for cyber-physical systems. ACM Comput. Surv. (CSUR), 46.10.1145/2542049 ↗
25. A survey of intrusion detection in Internet of Things10.1016/j.jnca.2017.02.009 ↗
26. A survey of intrusion detection techniques in cloud10.1016/j.jnca.2012.05.003 ↗
27. A survey of intrusion detection techniques using machine learning
28. Zhang, Y., Zheng, Z., and Chen, X. (2021). A survey on anomaly detection methods in industrial control systems. Comput. Secur., 106.
29. Scalas, M., Gasparini, M., Cencetti, G., and Bondavalli, A. (2020). A review of anomaly detection systems in networked embedded systems. Sensors, 20.
30. Jalowski, Ł., Zmuda, M., and Rawski, M. (2022). A Survey on Moving Target Defense for Networks: A Practical View. Electronics, 11.10.3390/electronics11182886 ↗
31. Vakilinia, A., Sharif, R., and Liu, D. (2017, January 3–4). Modeling and analysis of deception games using dynamic Bayesian networks. Proceedings of the 2017 IEEE 2nd International Conference on Connected and Autonomous Driving (MetroCAD), Brussels, Belgium.
32. Wu, K., Tan, L., Xia, Y., and Xie, M. (2019). Cyber deception-based defense against DDoS attack: A game theoretical approach. Comput. Secur., 87.
33. Game theory for network security10.1109/SURV.2012.062612.00056 ↗
34. Morić, Z., Dakić, V., and Regvart, D. (2025). Advancing Cybersecurity with Honeypots and Deception Strategies. Informatics, 12.10.3390/informatics12010014 ↗
35. Liu, C., Wang, W., Zhang, Y., Chen, J., and Guan, X. (2022). Moving target defense for web applications using Bayesian Stackelberg game model. Comput. Netw., 209.
36. Defending against DDoS attacks based on cyber deception and game theory
37. Fu, X., Qin, Y., and Yang, B. (2021). Cyber deception-based DDoS defense mechanism using Bayesian game theory. J. Netw. Comput. Appl., 177.
38. Naghmouchi, M., Boudriga, H., and Laurent, M. (2019, January 3–4). Cyber deception and defense modeling in a cloud environment: A game-theoretic approach. Proceedings of the 2019 International Conference on Cyber Security and Protection of Digital Services (Cyber Security), Oxford, UK.
39. Han, Z., Marina, N., Debbah, M., and Hjørungnes, A. (2011). Game Theory in Wireless and Communication Networks: Theory, Models, and Applications, Cambridge University Press.10.1017/CBO9780511895043 ↗
40. Alpcan, T., and Başar, T. (2010). Network Security: A Decision and Game Theoretic Approach. Cambridge University Press.10.1017/CBO9780511760778 ↗
41. Manshaei, M., Zhu, Q., Alpcan, T., Başar, T., and Jean-Pierre, H. (2013). Game theory meets network security and privacy. ACM Comput. Surv. (CSUR), 45.10.1145/2480741.2480742 ↗
42. Game-theoretic analysis of cyber deception: Evidence-based strategies and implications
43. A survey on cyber deception: Motivation, taxonomy, and challenges
44. Wang, Y., Liu, X., and Yu, X. (2025). Research on Joint Game-Theoretic Modeling of Network Attack and Defense Under Incomplete Information. Entropy, 27.10.3390/e27090892 ↗
45. Evaluation criteria of centralization options in the architecture of multicomputer systems with traps and baits10.32620/reks.2025.1.18 ↗
46. Method and Rules for Determining the Next Centralization Option in Multicomputer System Architecture10.47839/ijc.24.1.3875 ↗
47. Botnet detection approach based on the distributed systems10.31891/1727-6209/2020/19/2-190-198 ↗
48. Anđelić, N., Baressi Šegota, S., and Car, Z. (2023). Improvement of Malicious Software Detection Accuracy through Genetic Programming Symbolic Classifier with Application of Dataset Oversampling Techniques. Computers, 12.10.3390/computers12120242 ↗
49. Pratama, Y., Munzi, R.S., Mustafa, A.B., and Kharisma, I.L. (2025). Static Malware Detection and Classification Using Machine Learning: A Random Forest Approach. Eng. Proc., 107.
50. Wang, P., Li, H.-C., Lin, H.-C., Lin, W.-H., and Xie, N.-Z. (2025). A Transductive Zero-Shot Learning Framework for Ransomware Detection Using Malware Knowledge Graphs. Information, 16.10.3390/info16060458 ↗
51. Alshomrani, M., Albeshri, A., Alturki, B., Alallah, F.S., and Alsulami, A.A. (2024). Survey of Transformer-Based Malicious Software Detection Systems. Electronics, 13.10.3390/electronics13234677 ↗
52. Gyamfi, N.K., Goranin, N., Ceponis, D., and Čenys, H.A. (2023). Automated System-Level Malware Detection Using Machine Learning: A Comprehensive Review. Appl. Sci., 13.10.3390/app132111908 ↗
53. Komar, M., Golovko, V., Sachenko, A., and Bezobrazov, S. (2011, January 15–17). Intelligent system for detection of networking intrusion. Proceedings of the 6th IEEE International Conference on Intelligent Data Acquisition and Advanced Computing Systems, Prague, Czech Republic.10.1109/IDAACS.2011.6072777 ↗
54. Using Graphic Network Simulator 3 for Ddos Attacks Simulation10.47839/ijc.16.4.910 ↗