Honeypot Detection Strategy Against Advanced Persistent Threats in Industrial Internet of Things: A Prospect Theoretic Game

Software-defined networking (SDN) has become a promising trend for managing the Industrial Internet of Things (IIoT) devices. As the core of sensitive data storage and business interaction, the SDN is vulnerable to advanced persistent threats (APTs) attacks, while honeypots have shown great promise against APT attacks. In this article, we propose a new SDN-based dynamic bounded rational honeypot-APT game model in IIoT. Specifically, the defender maximizes the utility by chossing the period strategy of honeypot collecting and analyzing the data, while the attacker maximizes utility by choosing the period strategy of its latency and attack. To describe the bounded rationality, we model the simultaneous dynamic attack and defense process through the prospect theory, in which the Prelec function and the value function are both introduced. Experiment results show that bounded rationality affects strategy selection and reduces defender and attacker's utilities. Furthermore, our strategy outperforms the existing work in defensive performance.