Randomized Decoy Rotation¶
Deception tactic — instantiates Strategic Randomization and Exploitability Reduction
Rotates a shifting set of decoys and feints through the action space so an adversary who invests in attacking a target cannot tell the real one from the bait.
Randomized Decoy Rotation adds deliberate false options to the mix and shuffles which are real. Instead of only varying genuine actions, it seeds the action space with decoys and feints — targets, moves, or signals that look real to an adversary but are bait — and rotates them randomly so the enemy cannot learn which is which or where the real one will be next. Its defining move is manufacturing cost asymmetry through deception: every real target now hides among plausible fakes, so an adversary must pay to probe each one, and the effort they spend attacking a decoy is effort wasted while the rotation moves on. Where a plain mixed strategy randomizes over real actions, this mechanism's whole contribution is the fake option and the discipline of keeping the truth channel separate so friends aren't fooled too.
Example¶
A security team defends a corporate network against intruders who, once inside, scan for the database server holding customer records. A single well-guarded server is a single target to find. So the team deploys a rotating field of decoys: alongside the real database, a dozen honeypot servers advertise the same services, hold convincing fake records[1], and are wired to alert the moment anyone touches them. The set is rotated on a random schedule — decoys change hostnames, addresses, and apparent contents, and the real server's disguise shifts with them.
An intruder scanning the network now sees thirteen plausible targets and no cheap way to tell bait from prize. Every probe against a decoy trips an alarm and burns the attacker's time while revealing their tools; meanwhile a strictly held internal registry tells the defenders — and only the defenders — which node is real this week. The intruder's advantage from reconnaissance collapses: they can no longer study the network once and know where to strike, because the map they build is mostly lies that move.
How it works¶
- Mint credible fakes. Build decoys good enough that an adversary can't dismiss them cheaply — a bad decoy is ignored and does no work.
- Fold them into the repertoire. Treat decoys and real targets as one action space so the adversary faces a mixture, not a labeled set.
- Rotate randomly. Change which node is real and where the decoys sit on an unpredictable schedule, so yesterday's reconnaissance is stale.
- Wall off the truth channel. Keep a protected internal record of what's real, so defenders and auditors are never deceived by their own decoys — the discipline that separates a feint from friendly-fire confusion.
Tuning parameters¶
- Decoy-to-real ratio — how many fakes per genuine target. More decoys dilute the adversary's odds but cost more to build and maintain and can clutter the defenders' own view.
- Rotation rate — how often the assignment of real-versus-decoy changes. Faster rotation stales reconnaissance sooner but raises operational churn and the risk of a slip that exposes the real one.
- Decoy fidelity — how convincing each fake is. High fidelity forces expensive probing but costs more to sustain and risks a decoy being mistaken for real by insiders.
- Truth-channel tightness — how few people and systems know the real assignment. Tighter is safer against leakage but harder to operate under.
When it helps, and when it misleads¶
Its strength is imposing a probing tax on reconnaissance: an adversary who could once find the target and strike must now pay to test each candidate, and every wasted probe is a detection signal and a delay. It converts the defender's information advantage — knowing which is real — into a durable edge that plain randomization over real actions can't produce.
Its failure mode is deception blowback: decoys that confuse allies, auditors, or the organization itself more than the adversary. If the truth channel leaks or is forgotten, defenders chase their own bait, incident responders lose time, and trust erodes — the archetype's named risk that a "decoy rotation without internal truth channels can become deception blowback." A subtler misuse is decoys so cheap the adversary learns to spot and ignore them, at which point the whole apparatus is overhead that fools no one. The guarding discipline is to keep the internal truth record protected but reliably accessible to those who must not be deceived, invest enough fidelity that decoys can't be filtered out, and audit periodically that the deception is still costing the adversary more than it costs you.
How it implements the components¶
decoy_and_feint_option— the mechanism's core: it manufactures and maintains the false targets and feints that populate the mix.strategic_action_repertoire— it defines the combined space of real and decoy options so the adversary confronts a genuine mixture rather than a labeled target.observability_and_leakage_guard— the walled-off truth channel protects which option is real from leaking, both to the adversary and by accident to confused insiders.
It does not set the probability_policy weights or write the exception_override_rule — declaring the distribution over actions and when a human may override the draw is Mixed-Strategy Policy Table; decoy rotation supplies the fake options that table would otherwise never contain.
Related¶
- Instantiates: Strategic Randomization and Exploitability Reduction — supplies the decoy-and-feint dimension the archetype names but a pure real-action mix omits.
- Sibling mechanisms: Mixed-Strategy Policy Table · Randomized Patrol or Route Schedule · Random-Seeded Assignment Service · Commit-Reveal Random Draw · Entropy Budget Dashboard · Exploitability Matrix Review · Adversarial Bandit Exploration Policy · Red-Team Predictability Test · Stochastic Challenge or Audit Timing
Editorial Notes¶
Form Classification¶
Form family: Intervention, Treatment & Transformation
Rationale: Randomized Decoy Rotation operates by deploys credible false targets and directly rotates their positions so reconnaissance becomes stale. That concrete deployed or enacted form is Intervention, Treatment & Transformation under the frozen taxonomy.
Nearest alternative: Control, Automation & Runtime — Although Control, Automation & Runtime can support this mechanism, the frozen evidence makes its operative form the act that deploys credible false targets and directly rotates their positions so reconnaissance becomes stale; the alternative is therefore secondary rather than defining.
Review outcome: Adjudicated after independent review; high confidence.
Origin Attribution¶
Primary origin: Military & Strategic Studies
Origin pattern: Convergent development
Present-day reach: Multi-domain
Rationale: Rotating decoys and feints to make the real target unpredictable is rooted in military deception.
Related originating lineages:
- Computer Science & Software Engineering — Moving-target defense and cyber deception supplied automated randomized rotation.
- Security Studies & Intelligence Analysis — Counterintelligence supplied adversary-modeling and deception assessment.
Review resolution: Both blind reviewers agree on military_strategic_studies as the primary origin. Explicit reconciliation resolves encyclopedia_synthesis_disagreement. The merged alternate lineages retain only domains the reviewers identified as materially formative; domain_reach=multi_domain records later applicability separately from origin breadth.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Reconciled after independent review; high confidence.
References¶
[1] The MITRE Corporation. A Practical Guide to Adversary Engagement. Version 1.0, MITRE Engage (2022). Describes decoy artifacts containing convincing fake data that generate high-fidelity alerts when accessed. registry ↩