  In the field of network security, with the ongoing arms race between
attackers, seeking new vulnerabilities to bypass defense mechanisms and
defenders reinforcing their prevention, detection and response strategies, the
novel concept of cyber deception has emerged. Starting from the well-known
example of honeypots, many other deception strategies have been developed such
as honeytokens and moving target defense, all sharing the objective of creating
uncertainty for attackers and increasing the chance for the attacker of making
mistakes. In this paper a methodology to evaluate the effectiveness of
honeypots and moving target defense in a network is presented. This methodology
allows to quantitatively measure the effectiveness in a simulation environment,
allowing to make recommendations on how many honeypots to deploy and on how
quickly network addresses have to be mutated to effectively disrupt an attack
in multiple network and attacker configurations. With this optimum, attacks can
be detected and slowed down with a minimal resource and configuration overhead.
With the provided methodology, the optimal number of honeypots to be deployed
and the optimal network address mutation interval can be determined.
Furthermore, this work provides guidance on how to optimally deploy and
configure them with respect to the attacker model and several network
parameters.
