Application of Deception Technique for the Management of Zero-Day Exploit

Zero-day exploit has remained one of the main challenges facing network administrators over the years; while several studies have been proposed to help solve this problem, the need for a deception model which is reliable remains a gap. The aim of this study is deception technique for zero–day exploit management. The methodology used is quantitative. The testbed under study is Ethnos cyber limited. The research method are modelling of the network facility, formulation of vulnerability problem, proposed behavioural analytical model using Stochastic Game Theory (SGT) technique, modelling of the decoy facility with honeypot techniques, modelling of the decoy vulnerability with honeypot techniques, then modelling of the new deception technique for zero-day attack management. To implement the new security solution on the testbed, python programming language was applied, while the data used for the coding was collected from the testbed. Simulation was applied for the testing of the new security model using data collected from the testbed. Metrics such as Attack Diversion Rate (ADR), Honeytoken Activation Rate (HAR), Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), and False Positive Rate (FPR), vulnerability conviction rate and exploitability rate were all applied to evaluate the model performance. The ADR reported as 91.56%, MTTD recorded as 5.96s, while the rate of honeypot activation was measured as 87.45%. The exploitability and conviction rate of the honeytoken reported 0.6 and 0.98 respectively. MTTR reported 10.04s, while the false positive rate reported an average of 3.07%.