CATCH: A Tool to Automatic Deploy Decoys and Breadcrumbs Based on Network Analysis

This paper presents a novel approach to deception technology through CATCH. CATCH is a tool to automate the deployment of decoys and breadcrumbs triggered by network traffic analysis. Unlike current static deception offerings, this system dynamically deploys decoys and breadcrumbs within the organization’s network based on real-time traffic patterns. This dynamic approach offers significant advantages. Firstly, it improves efficiency by focusing decoys on areas experiencing potential threats, reducing wasted resources on unused decoys. Secondly, it provides economic gains compared to static deception solutions. By eliminating the need for preconfigured and potentially underutilized decoys, organizations can optimize their security budget. The paper details the design and implementation of this system and showcasing its ability to strategically deploy ephemeral deception artefacts, including decoys and breadcrumbs, to proactively mislead attackers. CATCH offers a significant advancement in deception technology, by providing centralized automatic deployment and management of decoys and breadcrumbs that improved security posture and cost-effectiveness for organizations.