SOC Puppets: How Whaley’s Theory of Outs and ‘Noisy’ Sock Puppets Encouraging Discovery of Network Deception Could Enhance Security Operations Center Analysis
Year: 2026
Type: conference-paper
Abstract: This practitioners’ position paper suggests an unorthodox approach integrating Whaley’s Theory of Outs and“turnabout” deception techniques to encourage an attacker’s discovery of deception on a network. Although the lateAmerican deception and communication researcher Barton Whaley appeared to differentiate the categorization ofdeception techniques such as “turnabout” and planning for backup deception techniques if discovered or if the deceptionappeared to fail, we explore the integration of these approaches to deception design in a cyber context, mainly in situationswhere analysts in the Security Operations Center (SOC) are looking for higher fidelity alerting on anomalous events andsuspected attacker activity on the network. Because attackers appear to generally demonstrate greater confidence in theirnetwork movement after discovering what they believe is deception, we visualize how ‘noisy’ controlled deception sockpuppets inside of a network prompting optimized query returns on their content could draw attackers to later stagedeception functions and effects, and more enhanced SOC analysis following alerting on those functions and effects. Thispractitioners’ position paper suggests our unorthodox approach offers an alternative strategic and tactical approach tocollaborative cyber deception design and SOC alerting, by highlighting ‘noisy’ deception on a network to lure and influenceattackers.
Authors: Tim Pappa, Keyur Rajyaguru
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: diamond
OpenAlex ID: W7130650464