Abstract: The network decoy confrontation is regarded as a kind of observable behavior of a multi-stage signaling game. Four types of gaming models for decoy confrontation process were constructed step by step using signaling game theory, i.e. the normal service, the mixed system of normal service and honeypot, the mixed system with two kinds of signaling, and the mixed system with two kinds of signaling and three actions. In these signaling game models, the server sent a normal signaling or honeypot signaling as the sender, while the attacker chose to access, give up or access in condition as the receiver. The effectiveness and the effectiveness conditions of the network decoy strategy were demonstrated through solving the Bayesian equilibrium strategies and analyzing the equilibrium conditions. Gambit as a game simulation tool was used to simulate the signaling game process of network decoy confrontation, and the existence of the Bayesian equilibrium, the correctness of the theoretical analysis were validated.

Key words: signaling game, network decoy defense, Bayesian equilibrium, simulation