No-answer puzzle: a curiosity-driven attacker model and motivation inference for APT in cybersecurity of major events

Abstract

Major events, such as the Olympic Games, pose unique cybersecurity challenges due to their high visibility, short duration, and complex system environments, making them prime targets for nation-state-level advanced persistent threat (APT). With sufficient preparation time, attackers often conduct early reconnaissance, among which large-scale password guessing against event-related systems is a recurrent preparatory behavior frequently observed before and during major events. Traditional defense mechanisms, such as firewalls and honeypots, can capture direct intrusion attempts but often overlook these pre-attack behaviors, missing valuable opportunities for early detection. To address this gap, we propose a no-answer puzzle scheme, a lightweight and non-loginable password-interaction system tailored for major-event scenarios to capture pre-attack preparations from attackers. Based on motivational psychology, the persistent and covert behaviors of APT attacks are all driven by a strong curiosity towards the target systems. Therefore, based on the captured interaction data, we define an attacker curiosity metric, design a computational update mechanism, and develop a fuzzy-logic-based model for inferring attacker motivation. Practical application in cybersecurity protection for major events has demonstrated that the system can effectively detect and capture potential attackers at an early stage without disrupting the normal operation of protected systems, thereby supporting the goal of zero cybersecurity incidents during major events.