Farooqui, Mohammad Shariq and Singh, Amit Kumar and Chouhan, Pushpinder Kaur and Cui, Zhan Dynamic On Demand Decoy Deployment Using MicroVMs. In: IEEE International Conference on Cyber Security and Resilience (IEEE CSR), 2026-08-03 - 2026-08-05, Lisbon, Portugal. (In Press)
Farooqui, Mohammad Shariq and Singh, Amit Kumar and Chouhan, Pushpinder Kaur and Cui, Zhan Dynamic On Demand Decoy Deployment Using MicroVMs. In: IEEE International Conference on Cyber Security and Resilience (IEEE CSR), 2026-08-03 - 2026-08-05, Lisbon, Portugal. (In Press)
Farooqui, Mohammad Shariq and Singh, Amit Kumar and Chouhan, Pushpinder Kaur and Cui, Zhan Dynamic On Demand Decoy Deployment Using MicroVMs. In: IEEE International Conference on Cyber Security and Resilience (IEEE CSR), 2026-08-03 - 2026-08-05, Lisbon, Portugal. (In Press)
Abstract
Honeypots remain a key defensive technique for engaging intruders and gathering intelligence, yet existing designs struggle to balance interaction realism, resource efficiency, and security isolation. Low-interaction systems, which emulate services rather than running them, are lightweight but easily fingerprinted, while container-based approaches offer convenience but expose kernel-sharing risks. Recent deception frameworks such as CATCH have proposed dynamic decoy deployment, where high-interaction environments are instantiated only when attacker behaviour warrants it. However, CATCH does not prescribe a concrete mechanism capable of delivering safe, high-fidelity decoys with sub-second responsiveness. This paper provides that missing mechanism by introducing a microVM-based on-demand isolation architecture for SSH-initiated deception. When suspicious activity is detected—via honeytokens in our prototype—sessions are transparently redirected into dedicated Firecracker microVMs restored from snapshots. This approach operationalises the dynamic deployment concept proposed by CATCH by offering a lightweight execution substrate capable of spawning realistic, strongly isolated, per-attacker environments at the moment of detection. We implement a PostgreSQL protocol handler as a case study and demonstrate median microVM startup latency of 242 ms—comparable to Docker container startup (300 ms) but with full VM-level isolation rather than shared-kernel containment—with 106 MB memory usage per attacker and zero overhead for legitimate users. Timing analysis shows that fingerprinting is limited to a brief first-query window; subsequent interactions are indistinguishable from real systems. These results indicate that microVMs provide a practical foundation for scalable, high-interaction deception and represent a viable dynamic deployment backend for CATCH-style active-defence architectures.
| Item Type: | Conference or Workshop Item (Paper) |
|---|---|
| Additional Information: | Published proceedings: _not provided_ |
| Uncontrolled Keywords: | deception technology, honeypot, microVM, Fire-cracker, active defence |
| Subjects: | Z Bibliography. Library Science. Information Resources > ZR Rights Retention |
| Divisions: | Faculty of Science and Health Faculty of Science and Health > Computer Science and Electronic Engineering, School of |
| SWORD Depositor: | Unnamed user with email elements@essex.ac.uk |
| Depositing User: | Unnamed user with email elements@essex.ac.uk |
| Date Deposited: | 21 Apr 2026 10:33 |
| Last Modified: | 21 Apr 2026 10:33 |
| URI: | http://repository.essex.ac.uk/id/eprint/43133 |
Available files
Filename: On_demand_microVM_based_Deception (4).pdf
Licence: Creative Commons: Attribution 4.0