  One of the widely used cyber deception techniques is decoying, where
defenders create fictitious machines (i.e., honeypots) to lure attackers.
Honeypots are deployed to entice attackers, but their effectiveness depends on
their configuration as that would influence whether attackers will judge them
as "real" machines or not. In this work, we study two-sided deception, where we
manipulate the observed configuration of both honeypots and real machines. The
idea is to improve cyberdefense by either making honeypots ``look like'' real
machines or by making real machines ``look like honeypots.'"We identify the
modifiable features of both real machines and honeypots and conceal these
features to different degrees. In an experiment, we study three conditions:
default features on both honeypot and real machines, concealed honeypots only,
and concealed both honeypots and real machines. We use a network with 40
machines where 20 of them are honeypots. We manipulate the features of the
machines, and using an experimental testbed (HackIT), we test the effectiveness
of the decoying strategies against humans attackers. Results indicate that: Any
of the two forms of deception (conceal honeypots and conceal both honeypots and
real machines) is better than no deception at all. We observe that attackers
attempted more exploits on honeypots and exfiltrated more data from honeypots
in the two forms of deception conditions. However, the attacks on honeypots and
data exfiltration were not different within the deception conditions. Results
inform cybersecurity defenders on how to manipulate the observable features of
honeypots and real machines to create uncertainty for attackers and improve
cyberdefense.
