  In this chapter, we present an approach using formal methods to synthesize
reactive defense strategy in a cyber network, equipped with a set of decoy
systems. We first generalize formal graphical security models--attack
graphs--to incorporate defender's countermeasures in a game-theoretic model,
called an attack-defend game on graph. This game captures the dynamic
interactions between the defender and the attacker and their defense/attack
objectives in formal logic. Then, we introduce a class of hypergames to model
asymmetric information created by decoys in the attacker-defender interactions.
Given qualitative security specifications in formal logic, we show that the
solution concepts from hypergames and reactive synthesis in formal methods can
be extended to synthesize effective dynamic defense strategy using cyber
deception. The strategy takes the advantages of the misperception of the
attacker to ensure security specification is satisfied, which may not be
satisfiable when the information is symmetric.
