Simulating Deception for Web Applications Using Reinforcement Learning

Web applications are constantly under attack as the public-facing components of information systems. One defense mechanism is deception, which introduces deceptive components into the application to detect the attacks with high fidelity, while distracting attackers from the successful attack path. One important challenge that hinders the widespread adoption of deception is the difficulty to assess its effectiveness. This often requires conducting human experiments, which can be both costly and impractical for every individual web application scenario. A recent solution proposed to address this issue for network-layer deception has been to use a Reinforcement Learning (RL) based framework to simulate an attacker in a network with deceptive elements. In this paper, we extend this framework to simulate the different components of web applications and related deceptive strategies. We then conduct several experiments to understand how the different quantities and types of deceptive elements impact the time to detect the attacker. Our empirical findings reveal that a larger number of honeytokens impede the agent’s learning, and allows for earlier attack detection. We also demonstrate the impact of each honeytoken on the success rate of attack detection, and how the implementation of deceptive elements can affect the performance of the agent.