Cyber-Deception and Attribution in Capture-the-Flag Exercises

2015/07/07 by Eric Nunes, Nimish Kulkarni, Nunes, Eric +7 · 1 citation
Computer Science · #Advanced Malware Detection Techniques #Cryptography and Security (cs.CR) #Cybercrime and Law Enforcement Studies #FOS: Computer and information sciences #Network Security and Intrusion Detection

paper · pdf · doi:10.48550/arxiv.1507.01922

openalex publication_date 2015/07/07 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Attributing the culprit of a cyber-attack is widely considered one of the major technical and policy challenges of cyber-security. The lack of ground truth for an individual responsible for a given attack has limited previous studies. Here, we overcome this limitation by leveraging DEFCON capture-the-flag (CTF) exercise data where the actual ground-truth is known. In this work, we use various classification techniques to identify the culprit in a cyberattack and find that deceptive activities account for the majority of misclassified samples. We also explore several heuristics to alleviate some of the misclassification caused by deception.

Cited by

• A Descriptive Model for Modelling Attacker Decision-Making in Cyber-Deception

Related

• Argumentation Models for Cyber Attribution
• Navigating uncertainty in cyber conflict: incorporating false flags in the attribution process of offensive cyber operations
• Cyber Deception: State of the art, Trends and Open challenges
• Cyber Deception for Computer and Network Security: Survey and Challenges
• Evidence of Cognitive Biases in Capture-the-Flag Cybersecurity Competitions