A cooperative and independent deception system in the active cyber defense system

Cyber deception technology is part of the process of identifying and responding to incidents. This technology helps the security team identify and analyze advanced threats by persuading an attacker to strike fake resources. The deception approach is to create a high-precision warning about high-risk behaviors. Deception occurs in a variety of ways, including an active defense approach. Active defense is an approach that is based on the establishment of measures to detect, analyze, identify and reduce threats to communication systems and networks in real time by default, which ultimately leads to cyber security. To better understand the techniques used in active defense, we can refer to Honeypot. Honeypot is a trick that is deliberately placed on the net to be explored by an attacker and to record, track and analyze the activities performed. In this project, we have used a low-interaction honeypot to identify malicious activity. Using these technologies and strategies, we have designed an active cyber defense system (SDF). This system has the ability to monitor and real-time detection of abnormalities that occur in the form of functional level of attackers. Both cyber deception and honeypot work on trapping the attacker by misleading, confusing, and etc. But cyber deception technology is an evolution of Honeypot, extending its limited capabilities.