{"id":"https://openalex.org/W7130650464","doi":"https://doi.org/10.34190/iccws.21.1.4537","title":"SOC Puppets: How Whaley\u2019s Theory of Outs and \u2018Noisy\u2019 Sock Puppets Encouraging Discovery of Network Deception Could Enhance Security Operations Center Analysis","display_name":"SOC Puppets: How Whaley\u2019s Theory of Outs and \u2018Noisy\u2019 Sock Puppets Encouraging Discovery of Network Deception Could Enhance Security Operations Center Analysis","publication_year":2026,"publication_date":"2026-02-19","ids":{"openalex":"https://openalex.org/W7130650464","doi":"https://doi.org/10.34190/iccws.21.1.4537"},"language":"en","primary_location":{"id":"doi:10.34190/iccws.21.1.4537","doi":"https://doi.org/10.34190/iccws.21.1.4537","is_oa":true,"landing_page_url":"https://doi.org/10.34190/iccws.21.1.4537","pdf_url":"https://papers.academic-conferences.org/index.php/iccws/article/download/4537/4034","source":{"id":"https://openalex.org/S4220651121","display_name":"International Conference on Cyber Warfare and Security","issn_l":"2048-9870","issn":["2048-9870","2048-9889","2048-9897"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":["jufo-1"],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":"cc-by-nd","license_id":"https://openalex.org/licenses/cc-by-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Conference on Cyber Warfare and Security","raw_type":"journal-article"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://papers.academic-conferences.org/index.php/iccws/article/download/4537/4034","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5094220131","display_name":"Tim Pappa","orcid":"https://orcid.org/0009-0004-2058-0740","observed_orcids":["https://orcid.org/0009-0004-2058-0740"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Tim Pappa","raw_affiliation_strings":["1 Analyst1 , Reston , Virginia , USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"1 Analyst1 , Reston , Virginia , USA","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5126452191","display_name":"Keyur Rajyaguru","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Keyur Rajyaguru","raw_affiliation_strings":["1 Analyst1 , Reston , Virginia , USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"1 Analyst1 , Reston , Virginia , USA","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"21","issue":"1","first_page":"705","last_page":"712"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.48100000619888306,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.48100000619888306,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.41260001063346863,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.013399999588727951,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/cyber-deception","display_name":"cyber deception","score":0.8259999752044678},{"id":"https://openalex.org/keywords/security-operations-center","display_name":"security operations center","score":0.6190000176429749},{"id":"https://openalex.org/keywords/attacker-behavior","display_name":"attacker behavior","score":0.6710000038146973},{"id":"https://openalex.org/keywords/network-traffic-analysis","display_name":"network traffic analysis","score":0.4009999930858612}],"concepts":[{"id":"https://openalex.org/C2779267917","wikidata":"https://www.wikidata.org/wiki/Q170028","display_name":"Deception","level":2,"score":0.9728999733924866},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6111999750137329},{"id":"https://openalex.org/C94124525","wikidata":"https://www.wikidata.org/wiki/Q912550","display_name":"Categorization","level":2,"score":0.5684999823570251},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5188000202178955},{"id":"https://openalex.org/C2780945871","wikidata":"https://www.wikidata.org/wiki/Q194274","display_name":"Backup","level":2,"score":0.40459999442100525},{"id":"https://openalex.org/C2776459999","wikidata":"https://www.wikidata.org/wiki/Q2119376","display_name":"Fidelity","level":2,"score":0.3901999890804291},{"id":"https://openalex.org/C191267431","wikidata":"https://www.wikidata.org/wiki/Q911932","display_name":"Honeypot","level":2,"score":0.3806000053882599},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.34459999203681946},{"id":"https://openalex.org/C198082294","wikidata":"https://www.wikidata.org/wiki/Q3399648","display_name":"Position (finance)","level":2,"score":0.33320000767707825},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.3095000088214874},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.30230000615119934},{"id":"https://openalex.org/C114713312","wikidata":"https://www.wikidata.org/wiki/Q7551269","display_name":"Social network analysis","level":3,"score":0.2939999997615814},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.28450000286102295},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.28189998865127563},{"id":"https://openalex.org/C4727928","wikidata":"https://www.wikidata.org/wiki/Q17164759","display_name":"Social network (sociolinguistics)","level":3,"score":0.27649998664855957},{"id":"https://openalex.org/C199776023","wikidata":"https://www.wikidata.org/wiki/Q202875","display_name":"Negotiation","level":2,"score":0.25029999017715454}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.34190/iccws.21.1.4537","doi":"https://doi.org/10.34190/iccws.21.1.4537","is_oa":true,"landing_page_url":"https://doi.org/10.34190/iccws.21.1.4537","pdf_url":"https://papers.academic-conferences.org/index.php/iccws/article/download/4537/4034","source":{"id":"https://openalex.org/S4220651121","display_name":"International Conference on Cyber Warfare and Security","issn_l":"2048-9870","issn":["2048-9870","2048-9889","2048-9897"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":["jufo-1"],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":"cc-by-nd","license_id":"https://openalex.org/licenses/cc-by-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Conference on Cyber Warfare and Security","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.34190/iccws.21.1.4537","doi":"https://doi.org/10.34190/iccws.21.1.4537","is_oa":true,"landing_page_url":"https://doi.org/10.34190/iccws.21.1.4537","pdf_url":"https://papers.academic-conferences.org/index.php/iccws/article/download/4537/4034","source":{"id":"https://openalex.org/S4220651121","display_name":"International Conference on Cyber Warfare and Security","issn_l":"2048-9870","issn":["2048-9870","2048-9889","2048-9897"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":["jufo-1"],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":"cc-by-nd","license_id":"https://openalex.org/licenses/cc-by-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Conference on Cyber Warfare and Security","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7130650464.pdf","grobid_xml":"https://content.openalex.org/works/W7130650464.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W4378234660","https://openalex.org/W4411666854","https://openalex.org/W4407208583","https://openalex.org/W4407208626","https://openalex.org/W2751249566","https://openalex.org/W7018082158","https://openalex.org/W2887520221","https://openalex.org/W4380785728","https://openalex.org/W2095988554","https://openalex.org/W2362427642"],"abstract_inverted_index":{"This":[0],"practitioners\u2019":[1],"position":[2,156],"paper":[3,157],"suggests":[4,158],"an":[5,18,163],"unorthodox":[6,160],"approach":[7,161,168],"integrating":[8],"Whaley\u2019s":[9],"Theory":[10],"of":[11,21,63,124],"Outs":[12],"and\u201cturnabout\u201d":[13],"deception":[14,22,29,49,67,121,171,179],"techniques":[15,41,50],"to":[16,36,57,66,101,137,183],"encourage":[17],"attacker\u2019s":[19],"discovery":[20],"on":[23,89,95,131,150,180],"a":[24,70,125,181],"network.":[25,97],"Although":[26],"the":[27,38,55,61,78,96],"lateAmerican":[28],"and":[30,45,141,143,153,166,173,185],"communication":[31],"researcher":[32],"Barton":[33],"Whaley":[34],"appeared":[35],"differentiate":[37],"categorization":[39],"ofdeception":[40],"such":[42],"as":[43],"\u201cturnabout\u201d":[44],"planning":[46],"for":[47,85],"backup":[48],"if":[51,54],"discovered":[52],"or":[53],"deceptionappeared":[56],"fail,":[58],"we":[59,116],"explore":[60],"integration":[62],"these":[64],"approaches":[65],"design":[68,172],"in":[69,74,77,106],"cyber":[71,170],"context,":[72],"mainly":[73],"situationswhere":[75],"analysts":[76],"Security":[79],"Operations":[80],"Center":[81],"(SOC)":[82],"are":[83],"looking":[84],"higher":[86],"fidelity":[87],"alerting":[88,149],"anomalous":[90],"events":[91],"andsuspected":[92],"attacker":[93],"activity":[94],"Because":[98],"attackers":[99,136],"appear":[100],"generally":[102],"demonstrate":[103],"greater":[104],"confidence":[105],"theirnetwork":[107],"movement":[108],"after":[109],"discovering":[110],"what":[111],"they":[112],"believe":[113],"is":[114],"deception,":[115],"visualize":[117],"how":[118],"\u2018noisy\u2019":[119,178],"controlled":[120],"sockpuppets":[122],"inside":[123],"network":[126,182],"prompting":[127],"optimized":[128],"query":[129],"returns":[130],"their":[132],"content":[133],"could":[134],"draw":[135],"later":[138],"stagedeception":[139],"functions":[140,152],"effects,":[142],"more":[144],"enhanced":[145],"SOC":[146,174],"analysis":[147],"following":[148],"those":[151],"effects.":[154],"Thispractitioners\u2019":[155],"our":[159],"offers":[162],"alternative":[164],"strategic":[165],"tactical":[167],"tocollaborative":[169],"alerting,":[175],"by":[176],"highlighting":[177],"lure":[184],"influenceattackers.":[186]},"counts_by_year":[],"updated_date":"2026-10-28T10:33:24.094632","created_date":"2026-02-20T00:00:00"}