# A Game-Theoretic Analysis for Distributed Honeypots
## 2 Related Work
### Game-Theoretic Approaches to Model Honeypots  
There have been some works that combine a honeypot with game theory in term of security issues. The system equipped with honeypots serves as a player (i.e., the defender) and the other (i.e., the attacker) acts as its adversary. Payoffs are analyzed and the results of some specific purposes are derived.  
In [35], a game-theoretic model that involves an attacker and a defender is applied to IoT (Internet of Things). Two players interact with the other in disguise. The former employs several attack techniques and the latter uses a honeypot as a deception tool. Such a problem is modeled as Bayesian game of incomplete information. A honeypot is applied to social network [36]. In the proposed pseudo honeypot game model, the attacker is rational and will choose the optimal strategy according to the defender's strategy. Bayesian Nash equilibriums are proved under different circumstances, capable of reducing energy consumption and of improving efficiency.  
A honeypot is introduced into the advanced metering infrastructure network [37]. Via analysis of interactions between the defenders and their adversaries, optimal strategies are derived, and several Bayesian Nash equilibriums are proved. A game-theoretic model for defending against attacks is studied in honeypot-enabled IoT [38]. A Stackelberg-style game, which consists of a leader and its follower, is employed in an enterprise network [39]. In this model, the defender serves as a leader to identify the optimal placement of firewalls, IDS, and honeypots simultaneously. A signaling game with perfect Bayesian equilibrium is used in [40] for performance analysis of denial of service (DoS) defense. As a deceptive tool, a honeypot can deceive attackers. Then, a deception-based protection mechanism is proposed, involving game theory to model the interactive activities among players. In the studied scenario, the defender takes first step to decide whether to camouflage or not. After that the attacker responds with three different actions (i.e., attack, observe, and retreat). Since the adversary is uncertain of the system type, this is a game of incomplete information. A honeypot is incorporated with the proposed model, serving as a probing device [41]. A game-theoretic approach is adopted in cloud infrastructure for mitigating the economic denial of sustainability attack. In a static game scenario, an interactive game is modeled to find the optimal strategic threshold value for limiting incoming flow via Nash equilibriums.  
A game-theoretic approach is used to explore the best solution in detection of low-rate denial of service attacks (e.g., Shrew) [42]. The presented solution relies on the bandwidth threshold, below which the flow will be transmitted to a honeypot server. In a static simultaneous game, determination of firewalls' best detection option is the defender's strategy. Meanwhile, the attacker's strategy is to exploit some related mechanisms and elude the low-rate detector. Both parties' payoffs are calculated. Flexibility features Content delivery network, in which distributed nodes suffer from some security problems. An optimal hybrid algorithm is proposed to cope with intrusion issues, which contains game theory, signature and honeypots [43]. Combination thwarts illegal intruders and solves resource allocation problems. This proposal combines both cooperative and non-cooperative game theories due to its hybrid nature. A methodology provided by game theory is used in [44] for decision support. Two players and multistage game are modeled for network defense where a honeypot distracts an attacker as a decoy host. As a player, the administrator chooses the optimal decision in allocation of honeypots, which can minimize the cost and loss brought by an attacker. Meanwhile, the attacker adopts the strategy that maximizes the value of destabilizing a network and that minimizes the corresponding cost.