A Honeybug for Automated Cyber Reasoning Systems

Automated cyber reasoning systems are susceptible to deceit and manipulation. In the Cyber Grand Challenge, the Rubeus system patched binaries with a honeybug that enticed competitor systems to pursue the honeybug instead of exploiting actual vulnerabilities. Surmising how these automated systems operated, we were able to take advantage of differences from the official scoring system to detect and manipulate their behavior. Methods for detecting and countering automation in the real world may be used to thwart the ability of malicious actors to find vulnerabilities.