A Flow Scheduling Model for SDN Honeypot Using Multi-Layer Attack Graphs and Signaling Game

When analyzing the allocation of deception resources, there is often a general lack of support from geographic and high-dimensional information of attack graphs, seriously, the hierarchical approach to threat response is often neglected. In this paper, we propose an SDN-based deception resources allocation model using a multi-layer attack graph and signaling game. Depending on the threat level, our model enables the defender to dynamically allocate deception resources by regulating the SDN flow. We firstly design a multi-layer attack graph with geographical information and a Top-N module to quickly filter out interesting attack paths, which are classified according to the threat level. Secondly, we devise a signaling game model for flow scheduling quantified by the attack graph, to generate optimal allocation strategies. Two experiments are shown to illustrate the validity of our findings, and finally, we compare our model with other studies.