TY  - JOUR
AU  - Uma, Darapu
AU  - Yogi, Manas Kumar
PY  - 2026
DA  - 2026/06/30
TI  - GHOST: Game-Theoretic Honeytoken Optimization for Strategic Threat Detection
JO  - ICCK Transactions on Cybersecurity
T2  - ICCK Transactions on Cybersecurity
JF  - ICCK Transactions on Cybersecurity
VL  - 2
IS  - 1
SP  - 75
EP  - 92
DO  - 10.62762/TC.2026.152584
UR  - https://www.icck.org/article/abs/TC.2026.152584
KW  - honeytokens
KW  - game theory
KW  - nash equilibrium
KW  - stackelberg games
KW  - bayesian security
KW  - reinforcement learning
KW  - identity security
KW  - zero-trust architecture
KW  - deception technology
KW  - intrusion detection
AB  - As adversaries deploy advanced persistent threats (APTs), social engineering, and credential-stuffing attacks to circumvent classical reactive defenses, identity security faces a formidable challenge. This paper proposes GHOST (Game-theoretic Honeytoken Optimization for Strategic Threat Detection), a mathematically grounded and empirically evaluated framework that combines deceptive honeytokens with Stackelberg–Nash game-theoretic optimization, Bayesian attacker-type inference, and reinforcement learning (RL). The defender (Stackelberg leader) distributes honeytokens throughout a networked system of heterogeneous assets, while the attacker (follower) operates under imperfect knowledge of the deployed deceptive strategy. GHOST models the defender–attacker interaction as a Stackelberg game in which the defender commits to a mixed placement strategy before the attacker responds. A Bayesian updating mechanism iteratively refines the posterior belief over attacker archetypes, while Nash Equilibrium conditions are resolved to guarantee strategic stability. An RL-guided gradient-ascent engine dynamically repositions honeytokens in real time, yielding accelerated convergence and sustained optimal detection. Evaluated against a purpose-built simulation dataset of 10,000 network scenarios—the Honeytoken Strategic Security Dataset (HSSD)—GHOST achieves an 85.3% detection rate and a false positive rate of only 3.1%, outperforming the strongest baseline (rule-based placement) by 23.4%. Ablation experiments confirm the measurable contribution of each architectural component. GHOST is further shown to be 3.2× more cost-effective than random placement and integrates natively with zero-trust architectures (ZTA). A four-pillar governance model operationalizes ethical and regulatory compliance, addressing requirements under GDPR, HIPAA, CFAA, and the Budapest Convention.
SN  - 3069-3349
PB  - Institute of Central Computation and Knowledge
LA  - English
ER  - 

@article{Uma2026GHOST,
  author = {Darapu Uma and Manas Kumar Yogi},
  title = {GHOST: Game-Theoretic Honeytoken Optimization for Strategic Threat Detection},
  journal = {ICCK Transactions on Cybersecurity},
  year = {2026},
  volume = {2},
  number = {1},
  pages = {75-92},
  doi = {10.62762/TC.2026.152584},
  url = {https://www.icck.org/article/abs/TC.2026.152584},
  abstract = {As adversaries deploy advanced persistent threats (APTs), social engineering, and credential-stuffing attacks to circumvent classical reactive defenses, identity security faces a formidable challenge. This paper proposes GHOST (Game-theoretic Honeytoken Optimization for Strategic Threat Detection), a mathematically grounded and empirically evaluated framework that combines deceptive honeytokens with Stackelberg–Nash game-theoretic optimization, Bayesian attacker-type inference, and reinforcement learning (RL). The defender (Stackelberg leader) distributes honeytokens throughout a networked system of heterogeneous assets, while the attacker (follower) operates under imperfect knowledge of the deployed deceptive strategy. GHOST models the defender–attacker interaction as a Stackelberg game in which the defender commits to a mixed placement strategy before the attacker responds. A Bayesian updating mechanism iteratively refines the posterior belief over attacker archetypes, while Nash Equilibrium conditions are resolved to guarantee strategic stability. An RL-guided gradient-ascent engine dynamically repositions honeytokens in real time, yielding accelerated convergence and sustained optimal detection. Evaluated against a purpose-built simulation dataset of 10,000 network scenarios—the Honeytoken Strategic Security Dataset (HSSD)—GHOST achieves an 85.3\% detection rate and a false positive rate of only 3.1\%, outperforming the strongest baseline (rule-based placement) by 23.4\%. Ablation experiments confirm the measurable contribution of each architectural component. GHOST is further shown to be 3.2× more cost-effective than random placement and integrates natively with zero-trust architectures (ZTA). A four-pillar governance model operationalizes ethical and regulatory compliance, addressing requirements under GDPR, HIPAA, CFAA, and the Budapest Convention.},
  keywords = {honeytokens, game theory, nash equilibrium, stackelberg games, bayesian security, reinforcement learning, identity security, zero-trust architecture, deception technology, intrusion detection},
  issn = {3069-3349},
  publisher = {Institute of Central Computation and Knowledge}
}