{"critical_reading": null, "data": {"access_date": "2026-09-15", "environments": ["Cloud", "Identity"], "review_basis": "source-page", "source_title": "Acalvio CPG Customer Reference", "tags": [], "techniques": ["Decoy"]}, "evidence": "vendor-published-case", "id": "acalvio-cpg-reference", "kind": "case-study", "name": "Acalvio CPG Customer Reference", "organization": "Acalvio", "reviewed_at": "2026-09-15", "slug": "acalvio-cpg-reference", "source_url": "https://www.acalvio.com/wp-content/uploads/acalvio-customer-reference-cpg.pdf", "status": "published", "summary_en": "ShadowPlex selection and pilot story published by Acalvio for a consumer goods company.", "summary_es": "Relato de selección y piloto de ShadowPlex publicado por Acalvio para una empresa de bienes de consumo.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "environments": ["OT/ICS"], "review_basis": "source-page", "source_title": "Acalvio Industrial Manufacturer Reference", "tags": [], "techniques": ["Decoy"]}, "evidence": "vendor-published-case", "id": "acalvio-industrial-reference", "kind": "case-study", "name": "Acalvio Industrial Manufacturer Reference", "organization": "Acalvio", "reviewed_at": "2026-09-15", "slug": "acalvio-industrial-reference", "source_url": "https://www.acalvio.com/wp-content/uploads/acalvio-customer-reference-industrial-manufacturer.pdf", "status": "published", "summary_en": "Industrial manufacturer story published by Acalvio; recorded as a vendor case.", "summary_es": "Relato de un fabricante industrial publicado por Acalvio; se registra como experiencia del proveedor.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": {"limitations_en": "An exchange format does not guarantee intelligence quality or usefulness.", "limitations_es": "La existencia de un formato de intercambio no garantiza calidad o utilidad de la inteligencia.", "observation_en": "The datasheet describes provider-hosted external decoys and STIX sharing.", "observation_es": "La ficha de producto describe señuelos externos alojados por el proveedor e intercambio STIX.", "question_en": "Which STIX objects are delivered and with what capture context?", "question_es": "¿Qué objetos STIX se entregan y con qué contexto de captura?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Cloud"], "review_basis": "source-page", "source_title": "Managed Targeted Threat Intel", "tags": [], "techniques": ["Decoy"]}, "evidence": "provider-datasheet", "id": "acalvio-managed-targeted-intel", "kind": "service", "name": "Managed Targeted Threat Intel", "organization": "Acalvio", "reviewed_at": "2026-09-15", "slug": "acalvio-managed-targeted-intel", "source_url": "https://www.acalvio.com/wp-content/uploads/acalvio-shadowplex-threat-intel-datasheet.pdf", "status": "published", "summary_en": "Acalvio datasheet describing cloud-hosted and managed external decoys with STIX intelligence sharing.", "summary_es": "Ficha de Acalvio que describe alojar y gestionar señuelos externos en su cloud para compartir inteligencia mediante STIX.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": {"limitations_en": "Commercial material does not allow attribution or intelligence quality to be estimated.", "limitations_es": "El material comercial no permite estimar atribución ni calidad de inteligencia.", "observation_en": "Acalvio presents external decoys with managed and appliance options.", "observation_es": "Acalvio presenta señuelos externos con modalidades gestionada y appliance.", "question_en": "Which observed artifacts lead to verifiable defensive decisions?", "question_es": "¿Qué artefactos observados pasan a decisiones defensivas comprobables?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Cloud", "Network"], "review_basis": "source-page", "source_title": "ShadowPlex Targeted Threat Intel", "tags": [], "techniques": ["Decoy", "Honeytoken"]}, "evidence": "vendor-claim", "id": "acalvio-targeted-threat-intel", "kind": "product", "name": "ShadowPlex Targeted Threat Intel", "organization": "Acalvio", "reviewed_at": "2026-09-15", "slug": "acalvio-targeted-threat-intel", "source_url": "https://www.acalvio.com/products/shadowplex-targeted-threat-intel/", "status": "published", "summary_en": "Decoy-based targeted threat intelligence offering; Acalvio describes managed and appliance delivery.", "summary_es": "Oferta de inteligencia de amenazas basada en señuelos externos; Acalvio describe modalidades gestionada y como appliance.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": {"limitations_en": "The page does not establish safe deployment in a specific industrial system.", "limitations_es": "La página no demuestra despliegues seguros en sistemas industriales concretos.", "observation_en": "ACSG publishes managed monitoring with decoys for IT, cloud and ICS.", "observation_es": "ACSG publica monitoreo gestionado con señuelos para IT, cloud e ICS.", "question_en": "How are decoys separated from real industrial processes?", "question_es": "¿Cómo se separan los señuelos de los procesos industriales reales?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Network", "Cloud", "OT/ICS"], "organization_country": "United States", "review_basis": "source-page", "source_language": "en", "source_title": "Deception as a Service", "tags": [], "techniques": ["Decoy", "Honeytoken"]}, "evidence": "provider-offering", "id": "acsg-deception-as-a-service", "kind": "service", "name": "Deception as a Service", "organization": "Advanced Computer Solutions Group", "reviewed_at": "2026-09-15", "slug": "acsg-deception-as-a-service", "source_url": "https://www.advancedcsg.net/deception-as-a-service/", "status": "published", "summary_en": "ACSG publishes a managed decoy and continuous-monitoring offering for IT, cloud and ICS.", "summary_es": "ACSG publica una oferta gestionada de señuelos y monitoreo continuo para IT, cloud e ICS.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": {"limitations_en": "This record does not establish real-device fidelity or coverage of IoT attacks beyond ADB.", "limitations_es": "La ficha no establece que reproduzca un dispositivo real ni que cubra ataques IoT distintos de ADB.", "observation_en": "The repository describes low-interaction Android Debug Bridge simulation.", "observation_es": "El repositorio describe una simulación de Android Debug Bridge de baja interacción.", "question_en": "Which commands are recorded, and which reveal that the service is simulated?", "question_es": "¿Qué comandos registra y cuáles revelan que el servicio es simulado?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["IoT"], "review_basis": "repository-metadata", "source_title": "ADBHoney", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "adbhoney", "kind": "software", "name": "ADBHoney", "organization": "huuck", "reviewed_at": "2026-09-15", "slug": "adbhoney", "source_url": "https://github.com/huuck/ADBHoney", "status": "published", "summary_en": "Low-interaction honeypot simulating the Android Debug Bridge service.", "summary_es": "Honeypot de baja interacción que simula el servicio Android Debug Bridge.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "design_en": "Formal analysis using total-variation bounds and repeated learning under shared memory.", "design_es": "Análisis formal con límites de variación total y aprendizaje repetido bajo memoria compartida.", "environments": ["Application", "Identity"], "finding_en": "Shows that policies observable to trusted agents can leak how to distinguish honeytokens; proposes a private reference monitor.", "finding_es": "Muestra que políticas observables por agentes confiables pueden filtrar cómo distinguir honeytokens; propone un monitor privado de referencia.", "full_text_reviewed_at": "2026-09-16", "limits_en": "Results are theoretical and depend on assumptions about knowledge, repetition and response laws.", "limits_es": "Los resultados son teóricos y dependen de supuestos sobre conocimiento, repetición y leyes de respuesta.", "review_basis": "full-text", "source_language": "en", "source_title": "When Agents Talk: Honeytokens under Shared Memory", "tags": ["open-access"], "techniques": ["Honeytoken"]}, "evidence": "full-text-review", "id": "agents-shared-memory-2026", "kind": "paper", "name": "When Agents Talk: Honeytokens under Shared Memory", "organization": "Joshua S. Gans", "reviewed_at": "2026-09-16", "slug": "agents-shared-memory-2026", "source_url": "https://arxiv.org/abs/2608.11436", "status": "published", "summary_en": "Formal analysis of honeytoken limits when trusted agents and attackers share memory or policies.", "summary_es": "Análisis formal de límites de honeytokens cuando agentes confiables y atacantes comparten memoria o políticas.", "updated_at": "2026-09-18", "year": 2026}
{"critical_reading": {"limitations_en": "This is a related capability; the record does not describe a standalone deception product.", "limitations_es": "Es una capacidad relacionada; la ficha no describe un producto de deception autónomo.", "observation_en": "Akamai documents dynamic redirection to a deception environment within its segmentation offering.", "observation_es": "Akamai documenta redirección dinámica a un entorno de engaño dentro de su oferta de segmentación.", "question_en": "Which segmentation rules trigger redirection and which traffic is excluded?", "question_es": "¿Qué reglas de segmentación activan la redirección y qué tráfico se excluye?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Network", "OT/ICS"], "review_basis": "source-page", "source_title": "Akamai Guardicore Segmentation: Dynamic Deception", "tags": ["related capability"], "techniques": ["Decoy", "Moving target defense"]}, "evidence": "vendor-claim", "id": "akamai-guardicore-deception", "kind": "product", "name": "Akamai Guardicore Segmentation: Dynamic Deception", "organization": "Akamai", "reviewed_at": "2026-09-15", "slug": "akamai-guardicore-deception", "source_url": "https://www.akamai.com/products/akamai-guardicore-segmentation", "status": "published", "summary_en": "Primarily a microsegmentation product whose documentation includes dynamic redirection into a deception environment; this related capability is recorded.", "summary_es": "Producto principalmente de microsegmentación cuya documentación incluye redirección dinámica hacia un entorno de engaño; se registra esa capacidad relacionada.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "environments": ["Network", "Application"], "review_basis": "source-page", "source_title": "Awesome Honeypots", "tags": [], "techniques": ["Honeypot"]}, "evidence": "community-directory", "id": "awesome-honeypots", "kind": "community", "name": "Awesome Honeypots", "organization": "Community contributors", "reviewed_at": "2026-09-15", "slug": "awesome-honeypots", "source_url": "https://github.com/paralax/awesome-honeypots", "status": "published", "summary_en": "Community list of honeypot projects and materials; each link requires separate verification.", "summary_es": "Lista comunitaria de proyectos y materiales sobre honeypots; cada enlace requiere verificación propia.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "disclosure_en": "Federico Pacheco, the Atlas owner, contributed to this project or its associated publication. This record follows the same source and limitation criteria as the rest of the catalog; it is not an independent evaluation.", "disclosure_es": "Federico Pacheco, responsable de este Atlas, participa en este proyecto o su publicación asociada. La ficha aplica los mismos criterios de fuentes y límites que el resto del catálogo; no constituye una evaluación independiente.", "environments": ["Endpoint", "Network"], "license": "GPL-3.0", "limitations_en": "The repository and paper describe the design and intended features. This record did not verify generated-trace quality or improved detection in production.", "limitations_es": "El repositorio y el paper describen el diseño y las funciones previstas. Esta ficha no verificó la calidad de las huellas generadas ni una mejora de detección en producción.", "review_basis": "repository-metadata", "source_language": "en", "source_title": "BUDA — código y documentación", "tags": ["BASE4 Security", "Federico Pacheco", "Diego Staino"], "techniques": ["Decoy", "Adversary engagement"]}, "evidence": "repository-documentation", "id": "base4-buda", "kind": "software", "name": "BUDA", "organization": "BASE4 Security", "reviewed_at": "2026-09-15", "slug": "base4-buda", "source_url": "https://github.com/Base4Security/BUDA", "status": "published", "summary_en": "Experimental framework generating fictitious user profiles and activity for decoy environments; the repository documents narratives, profiles and language-model integration.", "summary_es": "Framework experimental que genera perfiles ficticios y actividad de usuarios para dar contexto a entornos señuelo; el repositorio documenta narrativas, perfiles e integración con modelos de lenguaje.", "updated_at": "2026-09-15", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "disclosure_en": "Federico Pacheco, the Atlas owner, contributed to this project or its associated publication. This record follows the same source and limitation criteria as the rest of the catalog; it is not an independent evaluation.", "disclosure_es": "Federico Pacheco, responsable de este Atlas, participa en este proyecto o su publicación asociada. La ficha aplica los mismos criterios de fuentes y límites que el resto del catálogo; no constituye una evaluación independiente.", "environments": ["Network", "Application"], "license": "MIT", "limitations_en": "The lab contains intentional vulnerabilities and should run in isolation. This record does not establish learning gains or defensive effectiveness versus other approaches.", "limitations_es": "El laboratorio contiene vulnerabilidades deliberadas y debe ejecutarse aislado. La ficha no demuestra mejoras de aprendizaje ni eficacia defensiva frente a otras prácticas.", "review_basis": "repository-metadata", "source_language": "en", "source_title": "Cyber Deception Playground — código y documentación", "tags": ["BASE4 Security", "Federico Pacheco", "Diego Staino"], "techniques": ["Honeypot", "Decoy", "Honeytoken"]}, "evidence": "repository-documentation", "id": "base4-cyberdeception-playground", "kind": "software", "name": "Cyber Deception Playground", "organization": "BASE4 Security", "reviewed_at": "2026-09-15", "slug": "base4-cyberdeception-playground", "source_url": "https://github.com/Base4Security/cyberdeception-playground", "status": "published", "summary_en": "Open Docker Compose lab with vulnerable services, configurable deception levels, monitoring and an attacker environment for controlled training and research.", "summary_es": "Laboratorio abierto con Docker Compose, servicios vulnerables, niveles configurables de engaño, monitoreo y un entorno atacante para formación e investigación controlada.", "updated_at": "2026-09-15", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "disclosure_en": "Federico Pacheco, the Atlas owner, contributed to this project or its associated publication. This record follows the same source and limitation criteria as the rest of the catalog; it is not an independent evaluation.", "disclosure_es": "Federico Pacheco, responsable de este Atlas, participa en este proyecto o su publicación asociada. La ficha aplica los mismos criterios de fuentes y límites que el resto del catálogo; no constituye una evaluación independiente.", "environments": ["Network", "Application"], "license": "GPL-3.0", "limitations_en": "This review did not test isolation, decoy fidelity or operational performance. The related paper proposes a methodology, not a comparative outcome study.", "limitations_es": "No se probó en esta revisión el aislamiento, la fidelidad de los señuelos ni su rendimiento operativo. El artículo relacionado propone una metodología, no una comparación de resultados.", "review_basis": "repository-metadata", "source_language": "en", "source_title": "DOLOS-T — código y documentación", "tags": ["BASE4 Security", "Federico Pacheco", "Diego Staino"], "techniques": ["Decoy", "Honeypot", "Adversary engagement"]}, "evidence": "repository-documentation", "id": "base4-dolos-t", "kind": "software", "name": "DOLOS-T", "organization": "BASE4 Security", "reviewed_at": "2026-09-15", "slug": "base4-dolos-t", "source_url": "https://github.com/Base4Security/DOLOS-T", "status": "published", "summary_en": "Open framework for planning deception operations and deploying decoys and services with Python and Docker, according to its repository and documentation.", "summary_es": "Framework abierto para planificar operaciones de deception y desplegar señuelos y servicios mediante Python y Docker, según el repositorio y su documentación.", "updated_at": "2026-09-15", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "authors": ["Federico Pacheco", "Diego Staino"], "design_en": "Design and prototype of decoy profiles and simulated activity aligned with MITRE Engage.", "design_es": "Diseño y prototipo de perfiles señuelo y actividad simulada alineados con MITRE Engage.", "disclosure_en": "Federico Pacheco, the Atlas owner, contributed to this project or its associated publication. This record follows the same source and limitation criteria as the rest of the catalog; it is not an independent evaluation.", "disclosure_es": "Federico Pacheco, responsable de este Atlas, participa en este proyecto o su publicación asociada. La ficha aplica los mismos criterios de fuentes y límites que el resto del catálogo; no constituye una evaluación independiente.", "doi": "10.24215/15146774e095", "environments": ["Endpoint", "Network"], "finding_en": "Proposes adding temporal coherence and user traces to static technical decoys.", "finding_es": "Propone añadir coherencia temporal y rastros de usuario a activos técnicos estáticos.", "full_text_reviewed_at": "2026-09-16", "journal": "SADIO Electronic Journal of Informatics and Operations Research 25(1), e095", "limitations_en": "This record is based on the publisher abstract; full-text results were not analyzed and BUDA effectiveness was not independently tested.", "limitations_es": "La ficha se basa en el resumen editorial; no se analizaron resultados del texto completo ni se verificó experimentalmente la eficacia de BUDA.", "limits_en": "The work defines a future evaluation strategy and does not yet provide comparative field results.", "limits_es": "El trabajo define una estrategia de evaluación futura; todavía no aporta resultados comparativos de campo.", "review_basis": "full-text", "source_language": "es", "source_title": "SADIO EJS — artículo y resumen", "tags": ["BASE4 Security", "Federico Pacheco", "Diego Staino"], "techniques": ["Decoy", "Adversary engagement"]}, "evidence": "full-text-review", "id": "buda-user-behavior-2026", "kind": "paper", "name": "Refuerzo de estrategias de ciber engaño mediante comportamiento simulado de usuarios", "organization": "Federico Pacheco y Diego Staino", "reviewed_at": "2026-09-16", "slug": "buda-user-behavior-2026", "source_url": "https://revistas.unlp.edu.ar/ejs/article/view/20422", "status": "published", "summary_en": "Pacheco and Staino present BUDA as an approach to simulating fictitious-user activity and strengthening decoy credibility, aligned with MITRE Engage.", "summary_es": "Pacheco y Staino presentan BUDA como propuesta para simular actividad de usuarios ficticios y reforzar la credibilidad de señuelos, alineada con MITRE Engage.", "updated_at": "2026-09-18", "year": 2026}
{"critical_reading": {"limitations_en": "A trigger may come from tests, indexers or accidental use; it is not automatically an intrusion.", "limitations_es": "Una activación puede provenir de pruebas, indexadores o uso accidental; no equivale automáticamente a intrusión.", "observation_en": "Documentation offers mechanisms for creating tokens that alert when used.", "observation_es": "La documentación ofrece mecanismos para crear tokens que alertan ante su uso.", "question_en": "How is legitimate use excluded and each alert contextualized?", "question_es": "¿Cómo se evita uso legítimo y se contextualiza cada alerta?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Identity", "Cloud"], "review_basis": "repository-metadata", "source_title": "Canarytokens", "tags": [], "techniques": ["Honeytoken"]}, "evidence": "repository-documentation", "id": "canarytokens-open", "kind": "software", "name": "Canarytokens", "organization": "Thinkst", "reviewed_at": "2026-09-15", "slug": "canarytokens-open", "source_url": "https://github.com/thinkst/canarytokens", "status": "published", "summary_en": "Open project for creating decoy tokens that alert when someone uses them.", "summary_es": "Proyecto abierto para generar tokens señuelo que alertan cuando alguien los utiliza.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": {"limitations_en": "Time to first interaction alone does not represent detection effectiveness.", "limitations_es": "El período hasta la primera interacción no representa por sí mismo eficacia de detección.", "observation_en": "CounterCraft reports an interaction with a bank API digital twin within 30 days.", "observation_es": "CounterCraft informa una interacción en un gemelo digital de API bancaria en menos de 30 días.", "question_en": "Which actions distinguished an actionable interaction from a scan?", "question_es": "¿Qué acciones distinguieron la interacción investigable de un escaneo?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Application", "Cloud"], "review_basis": "source-page", "source_title": "Global Bank API Digital Twin", "tags": [], "techniques": ["Decoy"]}, "evidence": "vendor-published-case", "id": "countercraft-global-bank-api", "kind": "case-study", "name": "Global Bank API Digital Twin", "organization": "CounterCraft", "reviewed_at": "2026-09-15", "slug": "countercraft-global-bank-api", "source_url": "https://www.countercraftsec.com/blog/external-attack-surface-management-with-digital-twins-a-case-study/", "status": "published", "summary_en": "CounterCraft describes a bank API digital twin that attracted an attack within 30 days; outcome attributed to the vendor.", "summary_es": "CounterCraft describe un gemelo digital de API bancaria que atrajo un ataque en menos de 30 días; resultado atribuido al proveedor.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": {"limitations_en": "An intelligence claim requires checking which observations are actionable and how they are attributed.", "limitations_es": "Una promesa de inteligencia requiere verificar qué observación es accionable y cómo se atribuye.", "observation_en": "The vendor presents decoys aimed at detection and threat intelligence.", "observation_es": "El proveedor presenta señuelos orientados a detección e inteligencia de amenazas.", "question_en": "Which defensive decision changes because of decoy observations?", "question_es": "¿Qué decisión defensiva cambia a partir de las observaciones del señuelo?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Network", "Cloud"], "review_basis": "source-page", "source_title": "The Platform", "tags": [], "techniques": ["Decoy", "Adversary engagement"]}, "evidence": "vendor-claim", "id": "countercraft-platform", "kind": "product", "name": "The Platform", "organization": "CounterCraft", "reviewed_at": "2026-09-15", "slug": "countercraft-platform", "source_url": "https://www.countercraftsec.com/products/", "status": "published", "summary_en": "Commercial platform using decoys for detection and threat intelligence, according to CounterCraft.", "summary_es": "Plataforma comercial que utiliza señuelos para detección e inteligencia de amenazas, según CounterCraft.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": {"limitations_en": "Commands observed in a honeypot do not represent all attackers or prove detection effectiveness.", "limitations_es": "Los comandos observados en un honeypot no representan por sí solos a todos los atacantes ni prueban eficacia de detección.", "observation_en": "The repository documents SSH/Telnet login and session capture.", "observation_es": "El repositorio documenta captura de accesos y sesiones SSH/Telnet.", "question_en": "What share of sessions leads to useful investigation, and at what operational cost?", "question_es": "¿Qué porcentaje de las sesiones genera una investigación útil y con qué costo operativo?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Network"], "review_basis": "repository-metadata", "source_title": "Cowrie", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "cowrie", "kind": "software", "name": "Cowrie", "organization": "Cowrie contributors", "reviewed_at": "2026-09-15", "slug": "cowrie", "source_url": "https://github.com/cowrie/cowrie", "status": "published", "summary_en": "SSH and Telnet honeypot that records login attempts and attacker sessions.", "summary_es": "Honeypot SSH y Telnet que registra intentos de acceso y sesiones del atacante.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": {"limitations_en": "This record does not verify that samples represent current adversarial conversations.", "limitations_es": "No se comprobó aquí que las muestras representen conversaciones adversarias actuales.", "observation_en": "Zenodo identifies JSONL shell conversations for training and evaluation.", "observation_es": "Zenodo identifica conversaciones de shell en JSONL para entrenamiento y evaluación.", "question_en": "How are training and test sessions separated to prevent leakage?", "question_es": "¿Cómo se separan las sesiones de entrenamiento y prueba para evitar fuga?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "doi": "10.5281/zenodo.21108705", "environments": ["Network"], "review_basis": "source-page", "source_title": "CTU-HONEY-LLM-2", "tags": [], "techniques": ["Honeypot"]}, "evidence": "dataset-record", "id": "ctu-honey-llm-2", "kind": "dataset", "name": "CTU-HONEY-LLM-2", "organization": "CTU research authors", "reviewed_at": "2026-09-15", "slug": "ctu-honey-llm-2", "source_url": "https://zenodo.org/records/21108705", "status": "published", "summary_en": "JSONL shell-conversation datasets for training and testing language-model SSH honeypots, according to Zenodo.", "summary_es": "Conjuntos JSONL de conversaciones de shell para entrenar y probar honeypots SSH basados en modelos de lenguaje, según Zenodo.", "updated_at": "2026-09-15", "year": 2026}
{"critical_reading": {"limitations_en": "Geographic distribution does not ensure representation of all regions.", "limitations_es": "La distribución geográfica no garantiza representatividad de todas las regiones.", "observation_en": "The record describes Zeek traffic from distributed low-interaction sensors.", "observation_es": "El registro describe tráfico Zeek de sensores de baja interacción distribuidos.", "question_en": "What difference does each region contribute in origin, protocol and time?", "question_es": "¿Qué diferencia aporta cada región en origen, protocolo y horario?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Network"], "review_basis": "source-page", "source_title": "CTU Hornet 65 Niner", "tags": [], "techniques": ["Honeypot"]}, "evidence": "dataset-record", "id": "ctu-hornet-65-niner", "kind": "dataset", "name": "CTU Hornet 65 Niner", "organization": "CTU researchers", "reviewed_at": "2026-09-15", "slug": "ctu-hornet-65-niner", "source_url": "https://zenodo.org/records/13920267", "status": "published", "summary_en": "Zeek traffic record from geographically distributed low-interaction sensors; the page says no conventional honeypot software was used.", "summary_es": "Registro de tráfico Zeek de sensores de baja interacción distribuidos geográficamente; la página indica que no empleó software honeypot convencional.", "updated_at": "2026-09-15", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "environments": ["Network"], "review_basis": "source-page", "source_title": "Managed Deception Service", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "provider-offering", "id": "cyber-fidelity-managed-deception", "kind": "service", "name": "Managed Deception Service", "organization": "Cyber Fidelity", "reviewed_at": "2026-09-15", "slug": "cyber-fidelity-managed-deception", "source_url": "https://www.cyberfidelity.co/", "status": "published", "summary_en": "Managed honeypot and decoy offering published by Cyber Fidelity.", "summary_es": "Oferta gestionada de honeypots y señuelos publicada por Cyber Fidelity.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": {"limitations_en": "This record is based on the abstract; selection criteria, included studies and full-text results were not checked here.", "limitations_es": "La ficha parte del abstract; no se verificaron aquí criterios de selección, estudios incluidos ni resultados del texto completo.", "observation_en": "The abstract announces a review of trends and open challenges in the field.", "observation_es": "El abstract anuncia una revisión de tendencias y desafíos del campo.", "question_en": "Which subfields fall outside the authors’ proposed taxonomy?", "question_es": "¿Qué subáreas quedan fuera de la taxonomía propuesta por los autores?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "authors": ["Pedro Beltrán López", "Manuel Gil Pérez", "Pantaleone Nespoli"], "design_en": "Survey using objective and subjective selection of 83 works published from 2019 to 2023.", "design_es": "Revisión con selección objetiva y subjetiva de 83 trabajos publicados entre 2019 y 2023.", "environments": ["Network", "Cloud"], "finding_en": "Combines taxonomy, frameworks, AI and non-AI techniques, TRL and challenges; identifies the lack of common metrics.", "finding_es": "Integra taxonomía, frameworks, técnicas con y sin IA, TRL y desafíos; identifica falta de métricas comunes.", "full_text_reviewed_at": "2026-09-16", "limits_en": "Subjective selection and the time window limit reproducibility and currency; outcomes are not compared on one benchmark.", "limits_es": "La selección subjetiva y el corte temporal limitan reproducibilidad y actualidad; no compara resultados con un benchmark único.", "review_basis": "full-text", "source_title": "Cyber Deception: State of the Art, Trends and Open Challenges", "tags": [], "techniques": ["Adversary engagement"]}, "evidence": "full-text-review", "id": "cydec-state-2024", "kind": "paper", "name": "Cyber Deception: State of the Art, Trends and Open Challenges", "organization": "Beltrán López et al.", "reviewed_at": "2026-09-16", "slug": "cydec-state-2024", "source_url": "https://arxiv.org/abs/2409.07194", "status": "published", "summary_en": "Survey proposing a taxonomy and comparing cyber deception research lines, including AI-based work.", "summary_es": "Revisión que propone una taxonomía y compara líneas de investigación en cyberdeception, incluidas las que usan IA.", "updated_at": "2026-09-18", "year": 2024}
{"critical_reading": {"limitations_en": "The authors’ classification is not an operational test of every technique.", "limitations_es": "La clasificación descrita por los autores no constituye una prueba operativa de cada técnica.", "observation_en": "The abstract presents a survey of defensive deception models and techniques.", "observation_es": "El abstract presenta una revisión de modelos y técnicas de engaño defensivo.", "question_en": "Which techniques have reproducible evaluation, and which only models?", "question_es": "¿Qué técnicas cuentan con evaluación reproducible y cuáles solo con modelos?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "authors": ["Zhuo Lu", "Cliff Wang", "Shangqing Zhao"], "design_en": "Conceptual review of deception models, actions and applications across networks, hosts and cryptography.", "design_es": "Revisión conceptual de modelos, acciones y aplicaciones de deception en red, host y criptografía.", "environments": ["Network", "Endpoint"], "finding_en": "Models deception as iterative planning, deployment and evaluation, and separates simulation from dissimulation.", "finding_es": "Modela deception como interacción iterativa de planificación, despliegue y evaluación, y separa simulación de disimulación.", "full_text_reviewed_at": "2026-09-16", "limits_en": "It does not provide a systematic search or comparable effectiveness evaluation.", "limits_es": "No presenta una búsqueda sistemática ni una evaluación comparable de efectividad.", "review_basis": "full-text", "source_title": "Cyber Deception for Computer and Network Security: Survey and Challenges", "tags": [], "techniques": ["Decoy"]}, "evidence": "full-text-review", "id": "cydec-survey-2020", "kind": "paper", "name": "Cyber Deception for Computer and Network Security: Survey and Challenges", "organization": "Lu et al.", "reviewed_at": "2026-09-16", "slug": "cydec-survey-2020", "source_url": "https://arxiv.org/abs/2007.14497", "status": "published", "summary_en": "Survey of defensive deception models and techniques in networks, hosts and cryptographic mechanisms.", "summary_es": "Revisión de modelos y técnicas de engaño defensivo en redes, sistemas y mecanismos criptográficos.", "updated_at": "2026-09-18", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "environments": ["Network"], "review_basis": "source-page", "source_title": "Deception as a Service", "tags": [], "techniques": ["Decoy", "Adversary engagement"]}, "evidence": "provider-offering", "id": "daleo-deception-service", "kind": "service", "name": "Deception as a Service", "organization": "DALEO Synergy", "reviewed_at": "2026-09-15", "slug": "daleo-deception-service", "source_url": "https://www.daleosynergy.eu/products", "status": "published", "summary_en": "Managed offering DALEO publishes in conjunction with the CounterCraft platform.", "summary_es": "Oferta gestionada que DALEO publica junto a la plataforma de CounterCraft.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "design_en": "Vision paper covering ML generation of hosts, documents, activity and communications.", "design_es": "Artículo de visión que recorre generación de hosts, documentos, actividad y comunicaciones mediante ML.", "doi": "10.1109/TPSISA52974.2021.00026", "environments": ["Network", "Identity"], "finding_en": "Identifies scalable realistic generation as a central opportunity and organizes risks and research directions.", "finding_es": "Identifica la generación realista y escalable como oportunidad central y organiza riesgos y líneas de trabajo.", "full_text_reviewed_at": "2026-09-16", "limits_en": "It is neither a systematic review nor an evaluation of an integrated system.", "limits_es": "No es una revisión sistemática ni una evaluación de un sistema integrado.", "review_basis": "full-text", "source_language": "en", "source_title": "Deception for Cyber Defence: Challenges and Opportunities", "tags": ["open-access"], "techniques": ["Decoy"]}, "evidence": "full-text-review", "id": "deception-challenges-2021", "kind": "paper", "name": "Deception for Cyber Defence: Challenges and Opportunities", "organization": "Liebowitz et al.", "reviewed_at": "2026-09-16", "slug": "deception-challenges-2021", "source_url": "https://arxiv.org/abs/2208.07127", "status": "published", "summary_en": "Vision paper on automated generation of realistic deception artifacts with machine learning.", "summary_es": "Artículo de visión sobre generación automatizada de artefactos de engaño realistas mediante aprendizaje automático.", "updated_at": "2026-09-18", "year": 2021}
{"critical_reading": {"limitations_en": "A simulation depends on its assumptions and does not replace measurement of real adversaries and networks.", "limitations_es": "Una simulación depende de los supuestos y no sustituye mediciones de adversarios y redes reales.", "observation_en": "The abstract presents attack simulation to evaluate deception and moving target defense.", "observation_es": "El abstract presenta simulación de ataques para evaluar deception y moving target defense.", "question_en": "Which parameters and data make the experiment reproducible?", "question_es": "¿Qué parámetros y datos permiten reproducir el experimento?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "design_en": "NASim-based simulation with three scenarios and attacker types varying honeypots and address mutation.", "design_es": "Simulación basada en NASim con tres escenarios y tipos de atacante para variar honeypots y mutación de direcciones.", "environments": ["Network"], "finding_en": "The method explores configurations against explicit network and attacker parameters.", "finding_es": "El método permite explorar configuraciones frente a parámetros explícitos de red y atacante.", "full_text_reviewed_at": "2026-09-16", "limits_en": "Results depend on simulated agents and scenarios and do not equal behavior on a real network.", "limits_es": "Los resultados dependen de agentes y escenarios simulados y no equivalen a comportamiento en una red real.", "review_basis": "full-text", "source_title": "Evaluating Deception and Moving Target Defense with Network Attack Simulation", "tags": [], "techniques": ["Honeypot", "Moving target defense"]}, "evidence": "full-text-review", "id": "deception-mtd-simulation-2023", "kind": "paper", "name": "Evaluating Deception and Moving Target Defense with Network Attack Simulation", "organization": "Research authors", "reviewed_at": "2026-09-16", "slug": "deception-mtd-simulation-2023", "source_url": "https://arxiv.org/abs/2301.10629", "status": "published", "summary_en": "Proposes a simulation method for evaluating honeypots and moving target defense in networks.", "summary_es": "Propone un método de simulación para evaluar honeypots y moving target defense en redes.", "updated_at": "2026-09-18", "year": 2023}
{"critical_reading": {"limitations_en": "The description does not establish what would be observed outside prepared scenarios.", "limitations_es": "La descripción no establece qué conductas se observarían fuera de esos escenarios preparados.", "observation_en": "The platform advertises instrumented environments for observing post-compromise actions.", "observation_es": "La plataforma anuncia entornos instrumentados para observar acciones posteriores a la intrusión.", "question_en": "What isolation and retention limits apply to the environment?", "question_es": "¿Qué límites de aislamiento y retención se aplican al entorno?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Network", "Endpoint"], "review_basis": "source-page", "source_title": "Deception.Pro", "tags": [], "techniques": ["Decoy", "Adversary engagement"]}, "evidence": "vendor-claim", "id": "deception-pro-platform", "kind": "product", "name": "Deception.Pro", "organization": "Deception.Pro", "reviewed_at": "2026-09-15", "slug": "deception-pro-platform", "source_url": "https://deception.pro/", "status": "published", "summary_en": "Persistent instrumented environments for malware detonation and adversary observation, according to the platform description.", "summary_es": "Entornos persistentes e instrumentados para detonar malware y observar acciones de adversarios, según la descripción de la plataforma.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": {"limitations_en": "Missing periods limit comparisons of volume or attack rates.", "limitations_es": "Los períodos faltantes limitan comparaciones de volumen o tasas de ataque.", "observation_en": "The Zenodo record documents DICOM/PACS telemetry and data-loss periods.", "observation_es": "El registro Zenodo documenta telemetría DICOM/PACS y períodos de pérdida de datos.", "question_en": "Which analyses remain valid with incomplete capture intervals?", "question_es": "¿Qué análisis siguen siendo válidos con los intervalos de captura incompletos?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "doi": "10.5281/zenodo.20698626", "environments": ["Application", "OT/ICS"], "review_basis": "source-page", "source_title": "DICOMHawk Medical Imaging Deception Dataset", "tags": [], "techniques": ["Honeypot"]}, "evidence": "dataset-record", "id": "dicomhawk-medical-deception", "kind": "dataset", "name": "DICOMHawk Medical Imaging Deception Dataset", "organization": "DICOMHawk research authors", "reviewed_at": "2026-09-15", "slug": "dicomhawk-medical-deception", "source_url": "https://zenodo.org/records/20698626", "status": "published", "summary_en": "Zenodo record of DICOM/PACS telemetry from medical-imaging honeypot research; it documents periods of data loss.", "summary_es": "Registro Zenodo de telemetría DICOM/PACS de una investigación de honeypots para infraestructura de imagen médica; incluye notas de pérdida de datos.", "updated_at": "2026-09-15", "year": 2026}
{"critical_reading": {"limitations_en": "This record has no comparable protocol coverage or operating-load test.", "limitations_es": "No hay en esta ficha una prueba comparable de cobertura de protocolos o de carga de operación.", "observation_en": "The repository describes observation of attempts against simulated network services.", "observation_es": "El repositorio describe observación de intentos contra servicios de red simulados.", "question_en": "Which protocols relevant to the organization does the current setup cover?", "question_es": "¿Qué protocolos relevantes para la organización cubre la configuración actual?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Network"], "review_basis": "repository-metadata", "source_title": "Dionaea", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "dionaea", "kind": "software", "name": "Dionaea", "organization": "DinoTools", "reviewed_at": "2026-09-15", "slug": "dionaea", "source_url": "https://github.com/DinoTools/dionaea", "status": "published", "summary_en": "Honeypot project for observing attacks against network services.", "summary_es": "Proyecto de honeypot para observar intentos de explotación de servicios de red.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": null, "data": {"abstract_source_doi": "10.21203/rs.3.rs-207770/v1", "access_date": "2026-10-16", "authors": ["Selvakumar Veluchamy", "Ruba Soundar Kathavarayan"], "creator_name_aliases_inferred": false, "doi": "10.1002/int.22708", "doi_aliases": ["10.21203/rs.3.rs-207770/v1"], "draft_review_basis": "deepseek-draft-and-independent-claude-review", "environments": ["Network"], "family_resource_count": 1, "family_scope_basis": [{"batch": 20, "candidate_id": "doi:10.21203/rs.3.rs-207770/v1", "catalog_decision": null, "doi": "10.21203/rs.3.rs-207770/v1", "existing_identifier_matches": [], "existing_title_matches": [], "identity_status": "declared-version-family-review-needed", "selection_report": "data/coverage/bibliography-deposited-third-crossref-020-2026-10-16.json", "selection_report_sha256": "517f1960e8d694cc2f48b90ba7ca0dd17f64936113acd9ce5d63e0204616a34f", "source_sha256": "3c0b5ff078fc00815a4d07d57868f47a4b20bd1dcec600b2f7e848f7a906519f", "title": "Deep Reinforcement Learning for Building Honeypots against Runtime DOS Attack", "year": 2021}], "full_text_equality_claimed": false, "full_text_reviewed": false, "identity_report": "data/coverage/deposited-followup-family-review-2026-10-16.json", "identity_report_sha256": "d8486dc729d6c0aa6a91da335c385db7fbbce91367b6f1514f6601698918bdf8", "journal": "International Journal of Intelligent Systems", "limitations_en": "The journal record has no abstract; this summary is based solely on the explicitly linked preprint abstract, without full-text reading or independent result validation.", "limitations_es": "El registro de revista no tiene resumen; este resumen se basa únicamente en el resumen explícitamente vinculado del preprint, sin lectura del texto completo ni validación independiente de resultados.", "metadata_sha256": "af9dc882ddf58a1f927b3e8fc5317eb36e8c90fd6288a8bd7d5b0c3f34caac1f", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "source-page", "review_depth": "deposited abstract of DOI 10.21203/rs.3.rs-207770/v1; version identity metadata; no full-text analysis", "reviewed_metadata_url": "https://api.crossref.org/works/10.1002/int.22708", "selection_report": "data/coverage/bibliography-deposited-third-crossref-020-2026-10-16.json", "selection_report_sha256": "517f1960e8d694cc2f48b90ba7ca0dd17f64936113acd9ce5d63e0204616a34f", "source_document_url": "https://doi.org/10.21203/rs.3.rs-207770/v1", "source_packet_sha256": "de3b708f9c62d5bd9dbd76b45e5becbfc9f6f25d1dfae864f3ef2555ce24cd45", "source_quote": "the proposed DARLH system implements DARL based IDS (Intrusion Detection System) agents and Deep Recurrent Neural Network (DRNN) based IDS agents for monitoring multiple runtime DoS attacks", "source_quote_locator": {"abstract_source_doi": "10.21203/rs.3.rs-207770/v1", "field": "deposited abstract (HTML normalized)"}, "source_sha256": "3c0b5ff078fc00815a4d07d57868f47a4b20bd1dcec600b2f7e848f7a906519f", "source_title": "Deep reinforcement learning for building honeypots against runtime DoS attack", "source_type": "deposited abstract of DOI 10.21203/rs.3.rs-207770/v1; version identity metadata; no full-text analysis", "tags": [], "techniques": ["Honeypot", "Decoy"], "version_history": [{"creators": [{"ORCID": "https://orcid.org/0000-0003-1151-5352", "affiliation": [{"name": "Department of Computer Science and Engineering Chennai Institute of Technology  Chennai Tamil Nadu India"}], "authenticated-orcid": false, "family": "Veluchamy", "given": "Selvakumar", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "first"}, {"ORCID": "https://orcid.org/0000-0003-4082-5536", "affiliation": [{"name": "Department of Computer Science and Engineering Mepco Schlenk Engineering College  Sivakasi Tamil Nadu India"}], "authenticated-orcid": false, "family": "Kathavarayan", "given": "Ruba Soundar", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}], "doi": "10.1002/int.22708", "issued": {"date-parts": [[2021, 10, 20]]}, "metadata_sha256": "af9dc882ddf58a1f927b3e8fc5317eb36e8c90fd6288a8bd7d5b0c3f34caac1f", "titles": ["Deep reinforcement learning for building honeypots against runtime DoS attack"]}, {"creators": [{"affiliation": [{"name": "Chennai Institute of Technology"}], "family": "Veluchamy", "given": "Selvakumar", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "first"}, {"affiliation": [{"name": "P S R Engineering College"}], "family": "Kathavarayan", "given": "RubaSoundar", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}], "doi": "10.21203/rs.3.rs-207770/v1", "issued": {"date-parts": [[2021, 3, 24]]}, "metadata_sha256": "3c0b5ff078fc00815a4d07d57868f47a4b20bd1dcec600b2f7e848f7a906519f", "titles": ["Deep Reinforcement Learning for Building Honeypots against Runtime DOS Attack"]}]}, "evidence": "primary-source-passages", "id": "doi-10-1002-int-22708", "kind": "paper", "name": "Deep reinforcement learning for building honeypots against runtime DoS attack", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-1002-int-22708", "source_url": "https://doi.org/10.1002/int.22708", "status": "published", "summary_en": "The linked preprint abstract describes DARLH, a honeypot system that uses deep reinforcement learning-based and deep recurrent neural network-based IDS agents to detect internal and external runtime DoS attacks. Its purpose is to provide dynamic intrusion detection and event validation for monitoring DoS attacks in the honeypot environment.", "summary_es": "El resumen del preprint vinculado describe DARLH, un sistema de honeypot que emplea agentes IDS basados en aprendizaje por refuerzo profundo y en redes neuronales recurrentes profundas para detectar ataques DoS en tiempo de ejecución internos y externos. Su propósito es dotar al honeypot de detección dinámica de intrusiones y validación de eventos para monitorizar ataques DoS.", "updated_at": "2026-10-16", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-15", "authors": ["Tiago Conceição", "Nuno Cruz"], "doi": "10.1007/s10207-025-01112-1", "doi_aliases": [], "draft_review_basis": "deepseek-original-draft; codex-source-correction-and-independent-claude-review", "environments": ["Network"], "full_text_reviewed": false, "journal": "International Journal of Information Security", "limitations_en": "Review based solely on the publisher-deposited abstract; full text was not accessed and results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado por el editor; no se accedió al texto completo ni se validaron los resultados de forma independiente.", "metadata_sha256": "de15bc18a71253942c3bbb91d81d0ae529086e2c67a848433eb9e413b7dfe4ba", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "source-page", "review_depth": "Crossref member-deposited bibliographic metadata with abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1007/s10207-025-01112-1", "selection_report": "data/coverage/educational-scope-third-review-2026-10-13.json", "selection_report_sha256": "51793eb87f113136572518fc4b6516e2c019f3714ebc6d160a68220f1c6706e3", "source_correction_input_sha256": "b0917c58b5d8f7bafac94a890b747835206318b7f6f08611e0bff408b75034ed", "source_document_url": "https://api.crossref.org/works/10.1007/s10207-025-01112-1", "source_packet_sha256": "1d851c108a9b40ea32e29e688618dd6499d7d2162ab99d675cf64e71c8ac278f", "source_quote": "This study evaluates the potential of Large Language Models (LLMs) in automating cybersecurity tasks, specifically focusing on three critical areas: Honeypot generation, Malware Detection, and Capture The Flag (CTF) exercise creation.", "source_quote_locator": {"field": "Crossref.message.abstract (HTML normalized)"}, "source_sha256": "de15bc18a71253942c3bbb91d81d0ae529086e2c67a848433eb9e413b7dfe4ba", "source_title": "Evaluation of the maturity of LLMs in the cybersecurity domain", "source_type": "Crossref member-deposited bibliographic metadata with abstract", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-source-passages", "id": "doi-10-1007-s10207-025-01112-1", "kind": "paper", "name": "Evaluation of the maturity of LLMs in the cybersecurity domain", "organization": null, "reviewed_at": "2026-10-15", "slug": "doi-10-1007-s10207-025-01112-1", "source_url": "https://doi.org/10.1007/s10207-025-01112-1", "status": "published", "summary_en": "The study evaluates LLMs for cybersecurity tasks, including honeypot generation, combining knowledge questions with automated assessment of security artifacts.", "summary_es": "El estudio evalúa LLMs para tareas de ciberseguridad, incluida la generación de honeypots, combinando preguntas de conocimiento con una evaluación automatizada de artefactos de seguridad.", "updated_at": "2026-10-15", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Maryam Var Naseri", "Ian Welch", "Junaid Haseeb", "Masood Mansoori"], "doi": "10.1007/s10207-026-01221-5", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "b3e4b06421c21c1920436af0f129283f84a3dc25494b0d990352ce897275fa35", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "International Journal of Information Security", "limitations_en": "This entry is based only on the title and abstract deposited in Crossref; it does not imply full-text reading, replication, working software, or independent validation of effectiveness.", "limitations_es": "Esta entrada se basa únicamente en el título y el resumen depositados en Crossref; no implica lectura del texto completo, replicación, software en funcionamiento ni validación independiente de la eficacia.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1007/s10207-026-01221-5", "source_quote": "We propose “Q-Cowrie”, a honeypot that is built upon customising a medium interaction server honeypot, that is, Cowrie, to increase the honeypot’s deception.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "4361cacd5dcf2ee20279c2174cf74c1117ef5aa7cbddde6518dc9f7b19a01c53", "source_title": "Q-Cowrie: An adaptive honeypot to analyse attackers’ behaviour", "tags": [], "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1007-s10207-026-01221-5", "kind": "paper", "name": "Q-Cowrie: An adaptive honeypot to analyse attackers’ behaviour", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1007-s10207-026-01221-5", "source_url": "https://doi.org/10.1007/s10207-026-01221-5", "status": "published", "summary_en": "The authors discuss applying reinforcement learning to improve response generation in honeypots and propose Q-Cowrie, a customization of the medium-interaction Cowrie honeypot intended to increase deception and support adaptive decisions while interacting with attackers. They report two experimental studies, one deploying Cowrie to capture attacks and model attacker decision-making with a Markov decision process, and another using Q-Cowrie to support adaptive interaction.", "summary_es": "Los autores describen la aplicación del aprendizaje por refuerzo para mejorar la generación de respuestas en honeypots y presentan Q-Cowrie, una adaptación del honeypot de interacción media Cowrie orientada a aumentar el engaño y permitir decisiones adaptativas durante la interacción con atacantes. Señalan que realizaron dos estudios experimentales, uno con Cowrie para capturar ataques y modelar el proceso de decisión de los atacantes mediante un proceso de decisión de Markov, y otro con Q-Cowrie para apoyar interacciones adaptativas.", "updated_at": "2026-10-13", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Antonio Lara-Gutierrez", "Juan Zamorano", "Jose A. Onieva"], "doi": "10.1007/s10489-026-07442-4", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "b3e4b06421c21c1920436af0f129283f84a3dc25494b0d990352ce897275fa35", "environments": ["Application"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Applied Intelligence", "limitations_en": "Review limited to the deposited abstract; the full text was not read and results were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado; no se ha leído el texto completo ni se han validado de forma independiente los resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1007/s10489-026-07442-4", "source_quote": "we present GenPot, a fine-tuned LLM-powered honeypot that integrates command-line, API, and dynamic web interaction to deliver realistic yet non-compromisable environments", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "75dcd151458cb0c761403f554dc89c658da7f104470d60ba26c099ac8a4fe3cc", "source_title": "GenPot: A generative honeypot architecture for adaptive web and API interaction", "tags": [], "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1007-s10489-026-07442-4", "kind": "paper", "name": "GenPot: A generative honeypot architecture for adaptive web and API interaction", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1007-s10489-026-07442-4", "source_url": "https://doi.org/10.1007/s10489-026-07442-4", "status": "published", "summary_en": "The authors present a honeypot architecture based on a fine-tuned LLM that combines command-line, API and dynamic web interaction with state management and security safeguards. The abstract describes a prototype simulating a Synology NAS on an OpenCanary baseline and an adaptation to a medical FHIR API.", "summary_es": "Los autores presentan una arquitectura de honeypot basada en un LLM ajustado que combina interacción por línea de comandos, API y web dinámica, con gestión de estado y salvaguardas de seguridad. El resumen describe un prototipo que simula un NAS Synology sobre OpenCanary y una adaptación a una API médica FHIR.", "updated_at": "2026-10-13", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Leslie F. Sikos", "Craig Valli", "Alexander E. Grojek", "David J. Holmes", "Samuel G. Wakeling", "Warren Z. Cabral", "Nickson M. Karie"], "doi": "10.1007/s11416-023-00463-4", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "b3e4b06421c21c1920436af0f129283f84a3dc25494b0d990352ce897275fa35", "environments": ["IoT"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Journal of Computer Virology and Hacking Techniques", "limitations_en": "Review based solely on the Crossref-deposited abstract; the full text was not examined and results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se examinó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1007/s11416-023-00463-4", "source_quote": "a novel approach is proposed for video camera deception via honeypots, offering increased security measures compared to what is available on conventional Internet-enabled video cameras", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "d24cef71a5258752e41695f1c3d848f7be871f033d40e475d8ee34db8099c1e0", "source_title": "CamDec: Advancing Axis P1435-LE video camera security using honeypot-based deception", "tags": [], "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1007-s11416-023-00463-4", "kind": "paper", "name": "CamDec: Advancing Axis P1435-LE video camera security using honeypot-based deception", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1007-s11416-023-00463-4", "source_url": "https://doi.org/10.1007/s11416-023-00463-4", "status": "published", "summary_en": "The paper proposes a honeypot-based deception approach for Internet-connected video cameras. Its abstract places the proposal in the security and privacy risks of cameras and other video-capable IoT devices.", "summary_es": "El trabajo propone un enfoque de engaño mediante honeypots para cámaras de vídeo conectadas a Internet. Su resumen sitúa la propuesta en los riesgos de seguridad y privacidad de las cámaras y otros dispositivos IoT con capacidad de vídeo.", "updated_at": "2026-10-13", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Michael Kouremetis", "Dean Lawrence", "Ron Alford", "Zoe Cheuvront", "David Davila", "Benjamin Geyer", "Trevor Haigh", "Ethan Michalak", "Rachel Murphy", "Gianpaolo Russo"], "doi": "10.1007/s12243-024-01018-4", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "b3e4b06421c21c1920436af0f129283f84a3dc25494b0d990352ce897275fa35", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Annals of Telecommunications", "limitations_en": "Review limited to the Crossref-deposited abstract; the full text was not consulted and results or system effectiveness were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se consultó el texto completo ni se validaron de forma independiente los resultados o la eficacia del sistema.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1007/s12243-024-01018-4", "source_quote": "we present and evaluate Mirage, an experimentation system demonstrated in both emulation and simulation forms that allows for the implementation and testing of novel cyber deceptions designed to counter cyber adversaries that use AI search and planning capabilities", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "b4ac1bb190848ac8bb6679c3d479818006272926033e559c4a31e9c1c36277f6", "source_title": "Mirage: cyber deception against autonomous cyber attacks in emulation and simulation", "tags": [], "techniques": ["Decoy", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1007-s12243-024-01018-4", "kind": "paper", "name": "Mirage: cyber deception against autonomous cyber attacks in emulation and simulation", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1007-s12243-024-01018-4", "source_url": "https://doi.org/10.1007/s12243-024-01018-4", "status": "published", "summary_en": "The work presents and evaluates Mirage, an experimentation system in both emulation and simulation forms that allows for the implementation and testing of cyber deceptions designed to counter adversaries using AI search and planning capabilities. The authors frame cyber deception as a possible defensive mechanism against future AI-enabled adversaries.", "summary_es": "El trabajo presenta y evalúa Mirage, un sistema de experimentación en formas de emulación y simulación que permite implementar y probar engaños cibernéticos diseñados para contrarrestar adversarios que emplean capacidades de búsqueda y planificación basadas en inteligencia artificial. Los autores enmarcan el engaño cibernético como un posible mecanismo defensivo frente a futuros adversarios habilitados por IA.", "updated_at": "2026-10-13", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Nitin Naik", "Paul Jenkins", "Nick Savage", "Longzhi Yang"], "doi": "10.1007/s40747-020-00209-5", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "b3e4b06421c21c1920436af0f129283f84a3dc25494b0d990352ce897275fa35", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Complex & Intelligent Systems", "limitations_en": "Review based only on the abstract deposited in Crossref, not on the full text or independent validation of results.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref, no en el texto completo ni en una validación independiente de los resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1007/s40747-020-00209-5", "source_quote": "This paper presents a computational intelligence enabled honeypot that is capable of discovering and predicting an attempted fingerprinting attack by using a Principal components analysis and Fuzzy inference system.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "132e9abe5ae27a8a6addbd669ba9f7188528e31f5d598cde982b482f01fab0c9", "source_title": "A computational intelligence enabled honeypot for chasing ghosts in the wires", "tags": [], "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1007-s40747-020-00209-5", "kind": "paper", "name": "A computational intelligence enabled honeypot for chasing ghosts in the wires", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1007-s40747-020-00209-5", "source_url": "https://doi.org/10.1007/s40747-020-00209-5", "status": "published", "summary_en": "The paper describes a computational intelligence enabled honeypot intended to discover and predict attempted fingerprinting attacks while it interacts with attackers. According to the authors, the system uses principal components analysis and a fuzzy inference system, and it was tested against five fingerprinting tools: Nmap, Xprobe2, NetScanTools Pro, SinFP3 and Nessus.", "summary_es": "El artículo describe un honeypot basado en inteligencia computacional cuyo propósito es descubrir y predecir intentos de ataque de fingerprinting mientras interactúa con atacantes. Según los autores, el sistema emplea análisis de componentes principales y un sistema de inferencia difusa, y fue probado contra cinco herramientas de fingerprinting: Nmap, Xprobe2, NetScanTools Pro, SinFP3 y Nessus.", "updated_at": "2026-10-13", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Dwarakanath G V", "Kalpesh Popat"], "doi": "10.1007/s43926-026-00351-5", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "b3e4b06421c21c1920436af0f129283f84a3dc25494b0d990352ce897275fa35", "environments": ["IoT", "Network", "Endpoint"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Discover Internet of Things", "limitations_en": "Review is limited to the publisher-deposited abstract in Crossref; the full text was not read and the results, software or effectiveness of the approach were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado por el editor en Crossref; no se ha leído el texto completo ni se han validado de forma independiente los resultados, el software o la eficacia del enfoque.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1007/s43926-026-00351-5", "source_quote": "Suspicious requests are sent to Deception-Based Edge Nodes (DBENs) - virtual honeypot-like environments that attract, isolate and profile attackers without interrupting the normal services.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "a50d956f960b138d1f9543d009a3f412f9e693c90d9b9fac8be94f444933e8a3", "source_title": "A trust-aware blockchain framework with deception-based edge nodes for secure and scalable IoT healthcare systems", "tags": [], "techniques": ["Honeypot", "Decoy", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1007-s43926-026-00351-5", "kind": "paper", "name": "A trust-aware blockchain framework with deception-based edge nodes for secure and scalable IoT healthcare systems", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1007-s43926-026-00351-5", "source_url": "https://doi.org/10.1007/s43926-026-00351-5", "status": "published", "summary_en": "The authors propose TAB-DEN, a framework for IoT healthcare systems that combines a permissioned blockchain with Proof of Authority consensus for decentralized authentication, a hierarchical edge architecture of primary and secondary edge servers that compute trust scores in real time and redirect traffic according to trustworthiness, and deception-based edge nodes acting as honeypot-like environments to attract, isolate and profile attackers. The stated aim is to provide scalable and quantum-resistant security, recording intrusion events through a lattice-based post-quantum signature scheme so that attack records are immutable and verifiable on the distributed ledger.", "summary_es": "Los autores proponen TAB-DEN, un marco para sistemas sanitarios de IoT que combina blockchain permisionada con consenso Prueba de Autoridad para autenticación descentralizada, una arquitectura jerárquica de servidores edge que calculan puntuaciones de confianza en tiempo real y desvían el tráfico según su fiabilidad, y nodos edge basados en engaño que actúan como entornos tipo honeypot para atraer, aislar y perfilar a los atacantes. El objetivo declarado es proporcionar seguridad escalable y resistente a ataques cuánticos, registrando los eventos de intrusión mediante un esquema de firma post-cuántico basado en retículos para que los registros de ataque resulten inmutables y verificables en el libro mayor distribuido.", "updated_at": "2026-10-13", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "authors": ["Kimberly J. Ferguson-Walter", "Maxine M. Major", "Chelsea K. Johnson", "Craig J. Johnson", "Dakota D. Scott", "Robert S. Gutzwiller", "Temmie Shade"], "doi": "10.1016/j.cose.2023.103268", "environments": ["Network"], "journal": "Computers & Security", "review_basis": "publisher-metadata", "source_title": "Cyber expert feedback: Experiences, expectations, and opinions about cyber deception", "tags": ["DOI"], "techniques": ["Adversary engagement"]}, "evidence": "publisher-metadata", "id": "doi-10-1016-j-cose-2023-103268", "kind": "paper", "name": "Cyber expert feedback: Experiences, expectations, and opinions about cyber deception", "organization": "Kimberly J. Ferguson-Walter, Maxine M. Major", "reviewed_at": "2026-09-15", "slug": "doi-10-1016-j-cose-2023-103268", "source_url": "https://doi.org/10.1016/j.cose.2023.103268", "status": "published", "summary_en": "Bibliographic record on expert experiences and opinions. The abstract and findings still require review.", "summary_es": "Registro bibliográfico sobre experiencias y opiniones de expertos. El resumen y los resultados aún requieren lectura.", "updated_at": "2026-09-15", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Andrea Oliveri", "Filippo Lauria"], "doi": "10.1016/s1353-4858(19)30009-1", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "b3e4b06421c21c1920436af0f129283f84a3dc25494b0d990352ce897275fa35", "environments": ["IoT"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Network Security", "limitations_en": "Review based only on the abstract deposited at Crossref; the full text was not examined and results or effectiveness were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se examinó el texto completo ni se validaron de forma independiente los resultados o la eficacia.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1016/s1353-4858%2819%2930009-1", "source_quote": "Its activities were based on honeypots that were able to ‘sense’ the Internet solely in order to map and classify IoT bots according to their behaviours.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "115605d7bee626c756bb14652ccca339d1311eda63570cef80d53327f4f576ae", "source_title": "Sagishi: an undercover software agent for infiltrating IoT botnets", "tags": [], "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1016-s1353-4858-19-30009-1", "kind": "paper", "name": "Sagishi: an undercover software agent for infiltrating IoT botnets", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1016-s1353-4858-19-30009-1", "source_url": "https://doi.org/10.1016/s1353-4858(19)30009-1", "status": "published", "summary_en": "The work addresses mapping and classifying bots that form part of IoT botnets and how they propagate across the Internet, a task the authors describe as challenging. According to the deposited abstract, Fooresec aimed to address this issue by footprinting, reporting and remotely securing IoT devices that had previously been turned into bots, relying on honeypots able to 'sense' the Internet in order to map and classify IoT bots according to their behaviours.", "summary_es": "El trabajo aborda el mapeo y la clasificación de bots que forman parte de botnets de IoT y de cómo se propagan por Internet, una tarea que los autores describen como difícil. Según el resumen depositado, Fooresec buscó hacer frente a este problema mediante la huella, el reporte y la protección remota de dispositivos IoT previamente convertidos en bots, apoyándose en honeypots capaces de 'percibir' Internet para mapear y clasificar bots de IoT según su comportamiento.", "updated_at": "2026-10-13", "year": 2019}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Israel Barak"], "doi": "10.1016/s1353-4858(20)30106-9", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "7fd1c16772ca255f60cbb77d30af70b2433ae3f8fd02df80ac82dbadaaef3221", "environments": ["OT/ICS", "Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Network Security", "limitations_en": "Review limited to the title and abstract deposited in Crossref; the full text was not read and results were not independently validated. The abstract describes no honeypot deployment, empirical data or specific findings, so the content referred to in the title cannot be confirmed from this source.", "limitations_es": "Revisión limitada al título y al resumen depositados en Crossref; no se consultó el texto completo ni se verificaron de forma independiente los resultados. El resumen no describe ningún despliegue de honeypot, datos empíricos ni hallazgos concretos, por lo que el contenido aludido en el título no puede confirmarse a partir de esta fuente.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1016/s1353-4858%2820%2930106-9", "source_quote": "To counter this threat, critical infrastructure operators should aim to minimise mean time to response when attacks occur. They also need to gain more visibility into their systems – particularly between the IT and OT environments.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "dba7a4b9373ddd97b1053ffc84dcce5cd0ebe77b53bb4b4d6187e5edb92ff558", "source_title": "Critical infrastructure under attack: lessons from a honeypot", "tags": [], "techniques": []}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1016-s1353-4858-20-30106-9", "kind": "paper", "name": "Critical infrastructure under attack: lessons from a honeypot", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1016-s1353-4858-20-30106-9", "source_url": "https://doi.org/10.1016/s1353-4858(20)30106-9", "status": "published", "summary_en": "Israel Barak's article concerns attacks on critical infrastructure — energy, water supply, transport, election systems, government and health — and argues that operators should aim to minimise mean time to response when attacks occur and gain more visibility into their systems, particularly between the IT and OT environments. The author further argues that security needs to be an intrinsic element in all OT systems, right from the initial design.", "summary_es": "El artículo de Israel Barak trata sobre los ataques a infraestructuras críticas —energía, suministro de agua, transporte, sistemas electorales, gobierno y salud— y sostiene que los operadores deberían reducir el tiempo medio de respuesta ante incidentes y obtener más visibilidad de sus sistemas, en particular entre los entornos de TI y OT. El autor plantea además que la seguridad debe ser un elemento intrínseco de todos los sistemas OT, desde el diseño inicial.", "updated_at": "2026-10-13", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-15", "authors": ["Assaf Morag"], "doi": "10.1016/s1353-4858(20)30116-1", "doi_aliases": [], "draft_review_basis": "deepseek-original-draft; codex-source-correction-and-independent-claude-review", "environments": ["Cloud"], "full_text_reviewed": false, "journal": "Network Security", "limitations_en": "Review based only on the Crossref-deposited abstract; results were not validated and the full text was not consulted.", "limitations_es": "Revisión basada solo en el resumen depositado en Crossref; no se validaron resultados ni se consultó el texto completo.", "metadata_sha256": "b4af2c828c8c25882b567a45a72e5c37048e4a60660d55ba144f73bcfc7bab29", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "source-page", "review_depth": "Crossref member-deposited bibliographic metadata with abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1016/s1353-4858(20)30116-1", "selection_report": "data/coverage/educational-scope-third-review-2026-10-13.json", "selection_report_sha256": "51793eb87f113136572518fc4b6516e2c019f3714ebc6d160a68220f1c6706e3", "source_correction_input_sha256": "b0917c58b5d8f7bafac94a890b747835206318b7f6f08611e0bff408b75034ed", "source_document_url": "https://api.crossref.org/works/10.1016/s1353-4858%2820%2930116-1", "source_packet_sha256": "e1b2d563b63df898a512145879c01db45e46299eafc0f7e24d54d858f78519e3", "source_quote": "Based on data from a honeypot, Assaf Morag of Aqua Security examines the mechanisms used to automatically infect a host with crypto-miners", "source_quote_locator": {"field": "Crossref.message.abstract (HTML normalized)"}, "source_sha256": "b4af2c828c8c25882b567a45a72e5c37048e4a60660d55ba144f73bcfc7bab29", "source_title": "Exploitable hosts used in cloud native cyber attacks", "source_type": "Crossref member-deposited bibliographic metadata with abstract", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-source-passages", "id": "doi-10-1016-s1353-4858-20-30116-1", "kind": "paper", "name": "Exploitable hosts used in cloud native cyber attacks", "organization": null, "reviewed_at": "2026-10-15", "slug": "doi-10-1016-s1353-4858-20-30116-1", "source_url": "https://doi.org/10.1016/s1353-4858(20)30116-1", "status": "published", "summary_en": "The article analyzes data captured by a honeypot to describe how cryptomining campaigns infect a host and seek new vulnerable targets. It includes an analysis of victim IP addresses.", "summary_es": "El artículo analiza datos captados por un honeypot para describir cómo las campañas de criptominería infectan un host y buscan nuevos objetivos vulnerables. Incluye un análisis de las direcciones IP de las víctimas.", "updated_at": "2026-10-15", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Andrew Bushby"], "doi": "10.1016/s1361-3723(19)30008-9", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "7fd1c16772ca255f60cbb77d30af70b2433ae3f8fd02df80ac82dbadaaef3221", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Computer Fraud & Security", "limitations_en": "Review based solely on the Crossref-deposited abstract; the full text was not consulted and the described results or effectiveness were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se consultó el texto completo ni se validaron de forma independiente los resultados o la eficacia descrita.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1016/s1361-3723%2819%2930008-9", "source_quote": "Given how attackers are progressing, there is a clear case for invoking an active defence to lure, detect and defend against malware and intruders moving laterally within the network.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "00d3c08ef09f3624c3599e54b0f8dadbe8e96e124c197721bc748abfb66cb57c", "source_title": "How deception can change cyber security defences", "tags": [], "techniques": ["Decoy", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1016-s1361-3723-19-30008-9", "kind": "paper", "name": "How deception can change cyber security defences", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1016-s1361-3723-19-30008-9", "source_url": "https://doi.org/10.1016/s1361-3723(19)30008-9", "status": "published", "summary_en": "Andrew Bushby's article describes the use of deception technology as a mechanism for active, post-breach defence aimed at luring, detecting and defending against malware and intruders moving laterally within the network. It notes that such approaches come with misconceptions and argues that defences need to move beyond detecting bad activity within an ocean of good activity.", "summary_es": "El artículo de Andrew Bushby describe el uso de tecnología de engaño como un mecanismo de defensa activa posterior a una brecha, orientado a atraer, detectar y defender contra malware e intrusos que se desplazan lateralmente dentro de la red. Señala que estos enfoques suelen acompañarse de conceptos erróneos y sostiene que las defensas deben ir más allá de la detección de actividad maliciosa dentro de un gran volumen de actividad legítima.", "updated_at": "2026-10-13", "year": 2019}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["V. S. Devi Priya", "S. Sibi Chakkaravarthy"], "doi": "10.1038/s41598-023-28613-0", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "7fd1c16772ca255f60cbb77d30af70b2433ae3f8fd02df80ac82dbadaaef3221", "environments": ["Cloud", "Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Scientific Reports", "limitations_en": "Review based solely on the abstract deposited in Crossref; the full text was not consulted and results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se consultó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1038/s41598-023-28613-0", "source_quote": "This paper delivers a robust outline of the deployment of containerized honeypot deployment", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_quote_normalization": "case-only-from-frozen-source", "source_sha256": "69472a4487e6cf563cec6f08ee01f8a3d133bc378e6e2d02c5fe5abddcb50b1d", "source_title": "Containerized cloud-based honeypot deception for tracking attackers", "tags": [], "techniques": ["Honeypot", "Decoy", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1038-s41598-023-28613-0", "kind": "paper", "name": "Containerized cloud-based honeypot deception for tracking attackers", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1038-s41598-023-28613-0", "source_url": "https://doi.org/10.1038/s41598-023-28613-0", "status": "published", "summary_en": "The work describes the deployment of an ensemble of research honeypot detectors to analyze and evaluate attackers' behavior. The authors present an outline of a containerized cloud honeypot deployment that they state is portable, durable, and simple to deploy and administer, and they describe instrumented monitoring that generated data points from which inferences about malicious users' activities and purpose could be drawn.", "summary_es": "El trabajo describe el despliegue de un conjunto de detectores honeypot orientados a la investigación para analizar y evaluar el comportamiento de los atacantes. Los autores presentan un esquema de despliegue de honeypots containerizados en la nube que, según señalan, resultan portables, duraderos y sencillos de desplegar y administrar, y describen la monitorización instrumentada de la que obtuvieron datos para inferir la actividad y los propósitos de usuarios maliciosos.", "updated_at": "2026-10-13", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Usman Wushishi", "Altaf Hussain", "Muhammad Imran Khalid", "Nasir Hussain", "Mona Jamjoom", "Zahid Ullah"], "doi": "10.1038/s41598-025-33426-4", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "7fd1c16772ca255f60cbb77d30af70b2433ae3f8fd02df80ac82dbadaaef3221", "environments": ["IoT", "OT/ICS"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Scientific Reports", "limitations_en": "Review based solely on the publisher-deposited abstract; no full text was accessed and results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado por el editor; no se accedió al texto completo ni se verificaron de forma independiente los resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1038/s41598-025-33426-4", "source_quote": "The defense problem is formulated as a Markov Decision Process, in which a Dueling Deep Q-Network agent maximizes a multi-objective reward to balance between attack mitigation, deception engagement, false positive control and resource cost.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "e94d9b413535cc79b0059aca8157f48d1f9b1d9bc03b663b3789cabcd4d17bb2", "source_title": "D3O-IIoT: deep reinforcement learning-driven dynamic deception orchestration for industrial IoT security", "tags": [], "techniques": ["Honeypot", "Moving target defense", "Decoy", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1038-s41598-025-33426-4", "kind": "paper", "name": "D3O-IIoT: deep reinforcement learning-driven dynamic deception orchestration for industrial IoT security", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1038-s41598-025-33426-4", "source_url": "https://doi.org/10.1038/s41598-025-33426-4", "status": "published", "summary_en": "The authors present D3O-IIoT, a reinforcement learning model that dynamically coordinates deception techniques such as honeypot deployment, moving target defense, fake telemetry injection, and node isolation, driven by real-time threat monitoring. The defense problem is formulated as a Markov Decision Process, in which a Dueling Deep Q-Network agent maximizes a multi-objective reward to balance attack mitigation, deception engagement, false positive control, and resource cost.", "summary_es": "Los autores presentan D3O-IIoT, un modelo de aprendizaje por refuerzo que coordina dinámicamente técnicas de engaño como despliegue de honeypots, defensa de objetivo móvil, inyección de telemetría falsa y aislamiento de nodos, guiándose por monitoreo de amenazas en tiempo real. El problema de defensa se formula como un Proceso de Decisión de Markov, donde un agente Dueling Deep Q-Network maximiza una recompensa multiobjetivo para equilibrar mitigación de ataques, interacción de engaño, control de falsos positivos y costo de recursos.", "updated_at": "2026-10-13", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Rajeshwari Ramaraj", "Umarani Govindasamy"], "doi": "10.1038/s41598-026-59245-9", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "7fd1c16772ca255f60cbb77d30af70b2433ae3f8fd02df80ac82dbadaaef3221", "environments": ["Network", "OT/ICS"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Scientific Reports", "limitations_en": "Review limited to the abstract deposited in Crossref by the authors; full text, reproducibility and actual effectiveness of the results were not verified.", "limitations_es": "Revisión limitada al resumen depositado en Crossref por los autores; no se verificó el texto completo, la reproducibilidad ni la eficacia real de los resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1038/s41598-026-59245-9", "source_quote": "dynamic and life-like attack vectors created through Generative Adversarial Networks (GANs) to mimic real-world zero-day and polymorphic threats", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "225d9b5a2776271fa56a3e7ba847e3ec6f7690e6e0c802cc9a8abdc09066932c", "source_title": "Self-adaptive cyber deception and resilient network defense via adversarial environment simulation", "tags": [], "techniques": ["Decoy", "Adversary engagement", "Moving target defense"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1038-s41598-026-59245-9", "kind": "paper", "name": "Self-adaptive cyber deception and resilient network defense via adversarial environment simulation", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1038-s41598-026-59245-9", "source_url": "https://doi.org/10.1038/s41598-026-59245-9", "status": "published", "summary_en": "The authors propose a proactive cyber-defense system that combines cyber deception, adversarial environment simulation and deep reinforcement learning, with GAN-generated attack vectors emulating zero-day and polymorphic threats. The aim is to train context-aware defense policies that detect malicious behavior, re-route detection vectors and trigger deceptive traps, evaluated with benign and adversarial traffic on a synthetic smart-grid network.", "summary_es": "Los autores proponen un sistema de defensa cibernética proactiva que combina engaño, simulación de entorno adversario y aprendizaje por refuerzo profundo, con vectores de ataque generados mediante GAN para emular amenazas de día cero y polimórficas. El objetivo es entrenar políticas de defensa adaptativas al contexto que detecten comportamientos maliciosos, reorienten vectores de detección y activen trampas de engaño, evaluado con tráfico bueno y adversario en una red sintética de red eléctrica inteligente.", "updated_at": "2026-10-13", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Usman Wushishi", "Nasir Hussain", "Altaf Hussain", "Amal Al-Rasheed", "Zahid Ullah"], "doi": "10.1038/s41598-026-60920-0", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "7fd1c16772ca255f60cbb77d30af70b2433ae3f8fd02df80ac82dbadaaef3221", "environments": ["IoT", "OT/ICS"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Scientific Reports", "limitations_en": "Review limited to the title and abstract deposited in Crossref; the full text was not read and the described results, software, or effectiveness were not independently validated.", "limitations_es": "Revisión limitada únicamente al título y al resumen depositados en Crossref; no se ha leído el texto completo ni se han validado de forma independiente los resultados, el software o la eficacia descritos.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1038/s41598-026-60920-0", "source_quote": "This paper introduces Co-ADAM, a Co-evolutionary Adaptive Deception-Aware Multi-mechanism defense framework that formalizes IIoT cyber deception as a constrained Markov decision process (CMDP) with an embedded signaling game.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "b30183c4d5fc5fd8b2589f4ec2bbd3fe1385baf68738ff6f9798f8e7442451cd", "source_title": "Co-ADAM: a co-evolutionary signaling game framework for equilibrium cyber deception in industrial IoT", "tags": [], "techniques": ["Honeypot", "Decoy", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1038-s41598-026-60920-0", "kind": "paper", "name": "Co-ADAM: a co-evolutionary signaling game framework for equilibrium cyber deception in industrial IoT", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1038-s41598-026-60920-0", "source_url": "https://doi.org/10.1038/s41598-026-60920-0", "status": "published", "summary_en": "The paper introduces Co-ADAM, a defense framework that formalizes cyber deception in the Industrial Internet of Things (IIoT) as a constrained Markov decision process with an embedded signaling game, aiming to jointly model the deception investment level and a co-evolutionary adversary that accumulates skepticism. The authors describe training a deep Q-network (DQN) defender against an adaptive attacker pool with budget constraints and skepticism dynamics embedded in the environment, and report evaluation on several IIoT datasets and a physical testbed.", "summary_es": "El artículo presenta Co-ADAM, un marco de defensa que formula el engaño cibernético en el Industrial Internet of Things (IIoT) como un proceso de decisión de Markov con restricciones que incorpora un juego de señalización, con el objetivo de modelar conjuntamente el nivel de inversión en engaño y un adversario co-evolutivo que acumula escepticismo. Los autores describen el entrenamiento de un defensor basado en una red Q profunda (DQN) frente a un conjunto de atacantes adaptativos con restricciones de presupuesto y dinámicas de escepticismo, y reportan evaluación sobre varios conjuntos de datos IIoT y un banco de pruebas físico.", "updated_at": "2026-10-13", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Rajalakshmi Selvaraj", "Venu Madhav Kuthadi", "Tshilidzi Marwala"], "doi": "10.1049/iet-com.2015.0497", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "7fd1c16772ca255f60cbb77d30af70b2433ae3f8fd02df80ac82dbadaaef3221", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "IET Communications", "limitations_en": "Review limited to the title and abstract deposited in Crossref metadata; the full text was not examined and the results or effectiveness were not independently validated.", "limitations_es": "Revisión limitada únicamente al título y al resumen depositados en metadatos de Crossref; no se examinó el texto completo ni se validaron de forma independiente los resultados o la eficacia.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1049/iet-com.2015.0497", "source_quote": "Ant colony optimisation technique is used to detect the intruders based on the pheromone deposit on that considered area.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "a8a9ffecb37cedb7b8576544eea41b6bb50cb35c9b1089180741ff4d660837f8", "source_title": "Ant‐based distributed denial of service detection technique using roaming virtual honeypots", "tags": [], "techniques": ["Honeypot", "Moving target defense"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1049-iet-com-2015-0497", "kind": "paper", "name": "Ant‐based distributed denial of service detection technique using roaming virtual honeypots", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1049-iet-com-2015-0497", "source_url": "https://doi.org/10.1049/iet-com.2015.0497", "status": "published", "summary_en": "The authors propose an ant colony-based distributed denial of service (DDoS) detection technique that uses roaming virtual honeypots together with a multi-level secure architecture to collect information about intruders at different levels of the network and to limit the spread of the affected area. Detection relies on ant colony optimisation, using pheromone deposits in the considered area, and on a multi-level IP log table, aiming to reduce traffic overhead and wasted bandwidth.", "summary_es": "Los autores proponen una técnica de detección de denegación de servicio distribuida (DDoS) basada en colonias de hormigas que emplea honeypots virtuales itinerantes junto con una arquitectura segura multinivel para recopilar información sobre intrusos en distintos niveles de la red y limitar la propagación del área afectada. La detección se apoya en la optimización por colonia de hormigas, usando el depósito de feromona en la zona considerada, y en una tabla de registro de IP multinivel, con el objetivo de reducir la sobrecarga de tráfico y el desperdicio de ancho de banda.", "updated_at": "2026-10-13", "year": 2016}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Keshnee Padayachee"], "doi": "10.1049/iet-ifs.2014.0063", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "961b355af69e2d99979efe06e841c2abd5a31a5dd1de20d6af1b4108c4ea01b4", "environments": ["Application"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "IET Information Security", "limitations_en": "Review based solely on the Crossref-deposited abstract; the full text was not examined and results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se examinó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1049/iet-ifs.2014.0063", "source_quote": "This approach is tested by developing a proof‐of‐concept prototype in an aspect‐oriented language, namely AspectJ.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "5cf20d5657f4af962635473466a67a8f9b4ebf81f1535c02b9b884749c6c7e43", "source_title": "Aspectising honeytokens to contain the insider threat", "tags": [], "techniques": ["Honeytoken"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1049-iet-ifs-2014-0063", "kind": "paper", "name": "Aspectising honeytokens to contain the insider threat", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1049-iet-ifs-2014-0063", "source_url": "https://doi.org/10.1049/iet-ifs.2014.0063", "status": "published", "summary_en": "The study proposes a generic implementation strategy for honeytokens deployed within a database management system, leveraging the aspect-oriented paradigm to contain the insider threat. The authors test this approach by developing a proof-of-concept prototype in AspectJ and reflect on the design and implementation challenges involved in deploying honeytokens.", "summary_es": "El estudio propone una estrategia de implementación genérica para honeytokens desplegados dentro de un sistema de gestión de bases de datos, empleando el paradigma orientado a aspectos para contener la amenaza interna. Los autores prueban este enfoque mediante un prototipo de prueba de concepto en AspectJ y reflexionan sobre los desafíos de diseño e implementación que conlleva el despliegue de honeytokens.", "updated_at": "2026-10-13", "year": 2015}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Wenjun Fan", "David Fernández", "Zhihui Du"], "doi": "10.1049/iet-ifs.2015.0256", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "961b355af69e2d99979efe06e841c2abd5a31a5dd1de20d6af1b4108c4ea01b4", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "IET Information Security", "limitations_en": "Review based only on the Crossref-deposited abstract; full text, experimental results and effectiveness were not verified.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se verificaron el texto completo, los resultados experimentales ni la eficacia del sistema.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1049/iet-ifs.2015.0256", "source_quote": "In this study, the authors propose a versatile virtual honeynet management tool to address this problem.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "6b820e11d86750ae8b30856c80667357cfea0e6b693e36d5cf28f8c0cb022074", "source_title": "Versatile virtual honeynet management framework", "tags": [], "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1049-iet-ifs-2015-0256", "kind": "paper", "name": "Versatile virtual honeynet management framework", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1049-iet-ifs-2015-0256", "source_url": "https://doi.org/10.1049/iet-ifs.2015.0256", "status": "published", "summary_en": "The authors propose a versatile virtual honeynet management tool for deploying heterogeneous types of honeypots through a dynamic configuration approach that adapts to mutable network environments. The stated purpose is to support investigation of malicious behavior where general platforms for versatile honeynet deployment are lacking.", "summary_es": "Los autores proponen una herramienta de gestión versátil de honeynets virtuales para facilitar el despliegue de tipos heterogéneos de honeypots mediante una configuración dinámica que se adapta a entornos de red cambiantes. El objetivo es apoyar la investigación del comportamiento malicioso cuando faltan plataformas generales para gestionar honeynets versátiles.", "updated_at": "2026-10-13", "year": 2017}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Nilesh Chakraborty", "Samrat Mondal"], "doi": "10.1049/iet-ifs.2017.0538", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "961b355af69e2d99979efe06e841c2abd5a31a5dd1de20d6af1b4108c4ea01b4", "environments": ["Identity"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "IET Information Security", "limitations_en": "Review based only on the Crossref-deposited abstract; the full text was not read and results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se leyó el texto completo ni se validaron los resultados de forma independiente.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1049/iet-ifs.2017.0538", "source_quote": "The authors’ analysis shows that the idea of incorporating the honeywords directly into an n‐SRRUAS is particularly difficult as it prevents the system from storing passwords after applying password‐based key derivation function or in the form of a hashed string.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "6aaca236247cf743f76cfc6abe27262469ec376297e1741f475749b6ffbe6353", "source_title": "Towards incorporating honeywords in n‐session recording attack resilient unaided authentication services", "tags": [], "techniques": ["Honeytoken"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1049-iet-ifs-2017-0538", "kind": "paper", "name": "Towards incorporating honeywords in n‐session recording attack resilient unaided authentication services", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1049-iet-ifs-2017-0538", "source_url": "https://doi.org/10.1049/iet-ifs.2017.0538", "status": "published", "summary_en": "The work examines n-session recording attack resilient unaided authentication services (n-SRRUASs) and notes that they cope poorly with server-side issues within their authentication procedure. The authors propose generic principles for incorporating honeywords (fake passwords) into n-SRRUASs and, with the help of an existing n-SRRUAS, show the idea is implementable in practice to fill that gap.", "summary_es": "El trabajo analiza los servicios de autenticación sin ayuda resistentes a ataques de grabación de n sesiones (n-SRRUAS) y señala que afrontan mal los problemas del lado del servidor dentro de su procedimiento de autenticación. Los autores proponen principios genéricos para incorporar honeywords (contraseñas falsas) en n-SRRUAS y, con ayuda de un n-SRRUAS existente, muestran que la idea es implementable en la práctica para cubrir esa laguna.", "updated_at": "2026-10-13", "year": 2019}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Matej Zuzčák", "Petr Bujok"], "doi": "10.1049/iet-ifs.2018.5141", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "961b355af69e2d99979efe06e841c2abd5a31a5dd1de20d6af1b4108c4ea01b4", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "IET Information Security", "limitations_en": "Review is limited to the Crossref-deposited abstract; the full text was not read and results were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se consultó el texto completo ni se verificaron de forma independiente los resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1049/iet-ifs.2018.5141", "source_quote": "This study studies the influence of country attributes on the number of secure shell attacks originating from it detected by the author's honeynet.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "0d3bcedf21095cb7b3fe19f98f4a342b66e2ae3c7e86d92a734a29bbb4011c9c", "source_title": "Causal analysis of attacks against honeypots based on properties of countries", "tags": [], "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1049-iet-ifs-2018-5141", "kind": "paper", "name": "Causal analysis of attacks against honeypots based on properties of countries", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1049-iet-ifs-2018-5141", "source_url": "https://doi.org/10.1049/iet-ifs.2018.5141", "status": "published", "summary_en": "The authors analyze how country attributes—such as population size, access to information and communication technologies, and ICT use—influence the number of secure shell attacks seen by their honeynet, using four statistical models built from three data sources and methods including partial least-squares path modelling and clustering of countries by similarity.", "summary_es": "Los autores analizan la influencia de atributos de distintos países, como población, acceso a las TIC y uso de las TIC, sobre el número de ataques de shell seguro vistos por su honeynet, mediante cuatro modelos estadísticos construidos a partir de tres fuentes de datos y con métodos como el modelado de rutas por mínimos cuadrados parciales y el agrupamiento de países por similitud.", "updated_at": "2026-10-13", "year": 2019}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Haibin Zheng", "Wenjie Shen", "Jinyin Chen"], "doi": "10.1049/ipr2.70201", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "961b355af69e2d99979efe06e841c2abd5a31a5dd1de20d6af1b4108c4ea01b4", "environments": [], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "IET Image Processing", "limitations_en": "Review limited to the Crossref-deposited abstract; the full text was not consulted and results, software, and effectiveness were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se consultó el texto completo ni se validaron de forma independiente los resultados, el software ni la efectividad.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1049/ipr2.70201", "source_quote": "we propose a novel run‐time defense against diverse backdoor attacks, dubbed HoneyFL", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "8297f72c94897bf72269232020b41f52347af511b0d15736d797f2b0f67b71f7", "source_title": "HoneyFL: Using Honeypots to Catch Backdoors in Federated Learning", "tags": [], "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1049-ipr2-70201", "kind": "paper", "name": "HoneyFL: Using Honeypots to Catch Backdoors in Federated Learning", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1049-ipr2-70201", "source_url": "https://doi.org/10.1049/ipr2.70201", "status": "published", "summary_en": "The authors propose HoneyFL, a run-time defense against diverse backdoor attacks in federated learning that uses honeypot clients and differential prediction to handle adaptive attacks. The work reports comparative experiments against five state-of-the-art defense baselines, with detection and false-positive rates reported by the authors and an impact on main-task aggregation described as negligible.", "summary_es": "Los autores proponen HoneyFL, una defensa en tiempo de ejecución contra diversos ataques de puerta trasera en aprendizaje federado que emplea clientes señuelo (honeypot) y predicción diferencial para manejar ataques adaptativos. El trabajo informa experimentos comparativos frente a cinco defensas de referencia, con tasas de detección y falsos positivos reportadas por los autores y un impacto descrito como insignificante en la agregación de la tarea principal.", "updated_at": "2026-10-13", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["José Antonio Gómez‐Hernández", "Raúl Sánchez‐Fernández", "Pedro García‐Teodoro"], "doi": "10.1049/ise2.12042", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "961b355af69e2d99979efe06e841c2abd5a31a5dd1de20d6af1b4108c4ea01b4", "environments": ["Endpoint"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "IET Information Security", "limitations_en": "Review based solely on the Crossref-deposited abstract; no full text was consulted and results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se consultó el texto completo ni se verificaron de forma independiente los resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1049/ise2.12042", "source_quote": "the authors introduced in a previous work a novel anti‐ransomware tool for Unix platforms named R‐Locker . The proposal is supported on a honeyfile‐based approach, where ‘infinite’ trap files are disseminated around the target filesystem for early detection and to effectively block the ransomware action", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "f330de3e623022b446f893e36a2f0557f7c5fe29b57a107f4a30ac9bd445ccc8", "source_title": "Inhibiting crypto‐ransomware on windows platforms through a honeyfile‐based approach with R‐Locker", "tags": [], "techniques": ["Honeytoken", "Decoy"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1049-ise2-12042", "kind": "paper", "name": "Inhibiting crypto‐ransomware on windows platforms through a honeyfile‐based approach with R‐Locker", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1049-ise2-12042", "source_url": "https://doi.org/10.1049/ise2.12042", "status": "published", "summary_en": "The authors extend their anti-ransomware tool R-Locker to Windows, relying on a honeyfile-based approach in which 'infinite' trap files are disseminated around the target filesystem for early detection and to block ransomware action. The Windows version addresses differences in FIFO handling and adds improved global management of honeyfiles and (semi)automated blocking of suspicious ransomware through the dynamic use of white-/black-lists.", "summary_es": "Los autores extienden a Windows su herramienta anti-ransomware R-Locker, que se apoya en un enfoque de honeyfiles: archivos trampa 'infinitos' distribuidos por el sistema de archivos para detectar de forma temprana y bloquear la acción del ransomware. La versión para Windows aborda las diferencias en el manejo de FIFO y añade una gestión global mejorada de los honeyfiles y un bloqueo (semi)automatizado de ransomware sospechoso mediante el uso dinámico de listas blancas y negras.", "updated_at": "2026-10-13", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Huanruo Li", "Yunfei Guo", "Penghao Sun", "Yawen Wang", "Shumin Huo"], "doi": "10.1049/ise2.12050", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "961b355af69e2d99979efe06e841c2abd5a31a5dd1de20d6af1b4108c4ea01b4", "environments": ["Cloud"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "IET Information Security", "limitations_en": "Review based only on the publisher-deposited Crossref abstract; the full text was not read and results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref por el editor; no se consultó el texto completo ni se verificaron de forma independiente los resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1049/ise2.12050", "source_quote": "Defensive deception is emerging to reveal stealthy attackers by presenting intentionally falsified information.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "a15ff5bc66e3e50646c3e8fe87554965419a9def5213bc82d65bb2a7c419dcb9", "source_title": "An optimal defensive deception framework for the container‐based cloud with deep reinforcement learning", "tags": [], "techniques": ["Decoy", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1049-ise2-12050", "kind": "paper", "name": "An optimal defensive deception framework for the container‐based cloud with deep reinforcement learning", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1049-ise2-12050", "source_url": "https://doi.org/10.1049/ise2.12050", "status": "published", "summary_en": "The authors propose a defensive deception framework for the container-based cloud, aiming to reveal stealthy attackers by presenting intentionally falsified information. The approach formalizes a System Risk Graph (SRG) as an updatable adversarial model, trains a deep reinforcement learning (DRL) model over the SRG so the agent produces decoy placement and deceptive routing strategies, and defines a coefficient of deception to evaluate the placement strategy.", "summary_es": "Los autores proponen un marco de engaño defensivo para la nube basada en contenedores, con el objetivo de revelar a atacantes sigilosos mediante información presentada de forma intencionadamente falsificada. El enfoque formaliza un System Risk Graph (SRG) como modelo adversario actualizable, entrena un modelo de aprendizaje por refuerzo profundo (DRL) sobre el SRG para que el agente genere estrategias de colocación de señuelos y rutas engañosas, y define un coeficiente de engaño para evaluar la estrategia de colocación.", "updated_at": "2026-10-13", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Yussuf Ahmed", "Kehinde Beyioku", "Mehdi Yousefi"], "doi": "10.1049/smc2.12084", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "943d08aa0ee0692d6a4f001a02097826a0851d7f4794c15e1deee568d78537b7", "environments": ["IoT"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "IET Smart Cities", "limitations_en": "Review based solely on the abstract deposited in Crossref, not on the full text or independent validation of results.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref, no en el texto completo ni en una validación independiente de resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1049/smc2.12084", "source_quote": "The authors aim to address these challenges by leveraging honeypot data and machine learning to enhance IoT security.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "894158ccc00ae15ec520f2dad7f8d91ab917af8563babfd15fb15fabde5b94dd", "source_title": "Securing smart cities through machine learning: A honeypot‐driven approach to attack detection in Internet of Things ecosystems", "tags": [], "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1049-smc2-12084", "kind": "paper", "name": "Securing smart cities through machine learning: A honeypot‐driven approach to attack detection in Internet of Things ecosystems", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1049-smc2-12084", "source_url": "https://doi.org/10.1049/smc2.12084", "status": "published", "summary_en": "The work addresses security in Internet of Things (IoT) ecosystems in smart cities by using honeypot data and machine learning and neural network algorithms for attack detection. The authors set out to identify datasets from IoT-targeted honeypots, evaluate threat detection algorithms, and propose security solutions, analyzing real-world cyber-attack data from diverse honeypots simulating IoT devices.", "summary_es": "El trabajo aborda la seguridad en ecosistemas de Internet de las Cosas (IoT) en ciudades inteligentes mediante el uso de datos de honeypots y algoritmos de aprendizaje automático y redes neuronales para la detección de ataques. Los autores se proponen identificar conjuntos de datos de honeypots dirigidos a IoT, evaluar algoritmos de detección de amenazas y proponer soluciones de seguridad, analizando datos reales de ciberataques obtenidos de diversos honeypots que simulan dispositivos IoT.", "updated_at": "2026-10-13", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Seungjin Lee", "Azween Abdullah", "N.Z. Jhanjhi", "S.H. Kok"], "doi": "10.1051/matecconf/202133504003", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "943d08aa0ee0692d6a4f001a02097826a0851d7f4794c15e1deee568d78537b7", "environments": ["IoT", "OT/ICS"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "MATEC Web of Conferences", "limitations_en": "Review based only on the abstract deposited in Crossref; the full text was not consulted and the results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se consultó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1051/matecconf/202133504003", "source_quote": "In this study, a botnet detection model was proposed by combining honeypot with machine learning, specifically designed for smart factories.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "5a39f2c865326b9819f08fdd9ed85e1fffe9a3fea5b40233cd296f0cc527ee8d", "source_title": "Honeypot Coupled Machine Learning Model for Botnet Detection and Classification in IoT Smart Factory – An Investigation", "tags": [], "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1051-matecconf-202133504003", "kind": "paper", "name": "Honeypot Coupled Machine Learning Model for Botnet Detection and Classification in IoT Smart Factory – An Investigation", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1051-matecconf-202133504003", "source_url": "https://doi.org/10.1051/matecconf/202133504003", "status": "published", "summary_en": "The paper proposes and investigates a botnet detection and classification model that combines honeypots with machine learning, aimed at smart factories. The study was carried out in a hardware configuration virtually mimicking a smart factory environment, as described by the authors.", "summary_es": "El artículo propone y examina un modelo de detección y clasificación de botnets que combina honeypots con aprendizaje automático, orientado a fábricas inteligentes. El estudio se llevó a cabo en una configuración de hardware que imitaba virtualmente un entorno de fábrica inteligente, según lo descrito por los autores.", "updated_at": "2026-10-13", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Tao Zhang", "Bin Lu", "Ding Li", "Kang He", "Yuefei Zhu"], "doi": "10.1088/1742-6596/1584/1/012033", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "943d08aa0ee0692d6a4f001a02097826a0851d7f4794c15e1deee568d78537b7", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Journal of Physics: Conference Series", "limitations_en": "Review based only on the Crossref-deposited abstract; the full text was not examined and results, effectiveness, or any implementations were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se examinó el texto completo ni se validaron de forma independiente los resultados, la eficacia ni posibles implementaciones.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1088/1742-6596/1584/1/012033", "source_quote": "The model constructs periodically reconfigurable virtual nodes, dynamically camouflages the fingerprint information of the host to deceive the detector, and redirect attack traffic targeting virtual nodes to honeypots that can capture and analyze attack behavior.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "81d599622d763cf751e1f9974d4c083750f6c8c911e80e83289388cc43dede7a", "source_title": "Anti-reconnaissance Model of Host Fingerprint Based on Virtual Node", "tags": [], "techniques": ["Honeypot", "Decoy", "Moving target defense"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1088-1742-6596-1584-1-012033", "kind": "paper", "name": "Anti-reconnaissance Model of Host Fingerprint Based on Virtual Node", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1088-1742-6596-1584-1-012033", "source_url": "https://doi.org/10.1088/1742-6596/1584/1/012033", "status": "published", "summary_en": "The paper proposes an anti-reconnaissance model for host fingerprints based on virtual nodes. The model constructs periodically reconfigurable virtual nodes to dynamically camouflage host fingerprint information and redirects attack traffic targeting virtual nodes to honeypots; the authors also introduce probabilistic models to examine how parameters such as the number of probes or honeypot mapping rules affect attack success probability, and they describe a prototype using SDN and DPDK intended to verify the model against reconnaissance.", "summary_es": "El artículo propone un modelo anti-reconocimiento de huellas de host basado en nodos virtuales. El modelo crea nodos virtuales reconfigurables periódicamente para camuflar dinámicamente la información de huella del host y redirige el tráfico de ataque hacia honeypots; además, los autores presentan modelos probabilísticos para analizar cómo parámetros como el número de sondas o las reglas de mapeo de honeypots afectan la probabilidad de éxito del ataque, y describen un prototipo con SDN y DPDK para verificar el modelo contra el reconocimiento.", "updated_at": "2026-10-13", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Chunlai Du", "Shichuan Zhao", "Wei Wang"], "doi": "10.1088/1742-6596/1757/1/012183", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "943d08aa0ee0692d6a4f001a02097826a0851d7f4794c15e1deee568d78537b7", "environments": [], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Journal of Physics: Conference Series", "limitations_en": "Review based only on the Crossref-deposited abstract; the full text was not consulted and results or software were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se consultó el texto completo ni se validaron de forma independiente los resultados o el software.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1088/1742-6596/1757/1/012183", "source_quote": "By combining the native honeypot system with an RnR framework, the system supports to postpone the time-consuming analysis to the replay stage, thereby enables fine-grained analysis.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "485c9d61371198341b72b077d68f30e2c8a064e22a754d6b33f676467af983be", "source_title": "RRPOT: A Record and Replay Based Honeypot System", "tags": [], "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1088-1742-6596-1757-1-012183", "kind": "paper", "name": "RRPOT: A Record and Replay Based Honeypot System", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1088-1742-6596-1757-1-012183", "source_url": "https://doi.org/10.1088/1742-6596/1757/1/012183", "status": "published", "summary_en": "The authors propose RRPOT, a honeypot system that combines a native honeypot with a virtual machine record and replay (RnR) framework, aiming to postpone time-consuming analysis to the replay stage and thereby enable fine-grained analysis. The system employs on-demand record and on-demand replay mechanisms to reduce performance and storage costs and to improve replay efficiency, as described in the deposited abstract.", "summary_es": "Los autores proponen RRPOT, un sistema honeypot que combina un honeypot nativo con un marco de grabación y reproducción (RnR) de máquina virtual, con el fin de posponer el análisis que consume tiempo a la etapa de reproducción y permitir así un análisis de grano fino. El sistema incorpora mecanismos de grabación y reproducción bajo demanda para reducir los costos de rendimiento y almacenamiento y mejorar la eficiencia de la reproducción, según lo descrito en el resumen depositado.", "updated_at": "2026-10-13", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Zhenxia Wang", "Linlin Yu"], "doi": "10.1088/1742-6596/1856/1/012008", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "943d08aa0ee0692d6a4f001a02097826a0851d7f4794c15e1deee568d78537b7", "environments": ["IoT", "Endpoint"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Journal of Physics: Conference Series", "limitations_en": "Review limited to the Crossref-deposited abstract; the full text was not consulted and the experimental results were not independently verified.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se consultó el texto completo ni se verificaron de forma independiente los resultados experimentales.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1088/1742-6596/1856/1/012008", "source_quote": "Honeypot technology is a highly deceptive security protection technology, which can run in a variety of networks and terminal systems with characteristic vulnerabilities deliberately.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "8864b81b6b1c0e20b63f1ea93d18708b568b106e45895ee5e18c967e23dbe868", "source_title": "Research on IoT Security Defense Based on Honeypot Technology", "tags": [], "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1088-1742-6596-1856-1-012008", "kind": "paper", "name": "Research on IoT Security Defense Based on Honeypot Technology", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1088-1742-6596-1856-1-012008", "source_url": "https://doi.org/10.1088/1742-6596/1856/1/012008", "status": "published", "summary_en": "The paper proposes an intelligent defense method for mobile-terminal unknown threats based on honeypot technology, as deposited by the authors. The approach aims to induce intruders to attack the honeypot terminal in order to delay attacks on the real target and to monitor, collect and analyze attack behavior.", "summary_es": "El artículo propone un método de defensa inteligente para amenazas desconocidas en terminales móviles basado en tecnología honeypot, según lo depositado por los autores. El enfoque busca inducir a los intrusos a atacar el terminal honeypot para retrasar el ataque al objetivo real y monitorizar, recopilar y analizar el comportamiento de ataque.", "updated_at": "2026-10-13", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Kai Cheng", "Zhan Wu", "Dongkun Li", "Xin Li", "Mu Ren"], "doi": "10.1088/1742-6596/2203/1/012077", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "943d08aa0ee0692d6a4f001a02097826a0851d7f4794c15e1deee568d78537b7", "environments": ["IoT", "Endpoint"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Journal of Physics: Conference Series", "limitations_en": "Assessment based only on the Crossref deposited abstract; the full text was not consulted and results were not independently verified.", "limitations_es": "Evaluación basada únicamente en el resumen depositado en Crossref; no se consultó el texto completo ni se verificaron de forma independiente los resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1088/1742-6596/2203/1/012077", "source_quote": "we introduce a novel TaintDroid based honeypot monitoring system for embedded device", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "e686610c19f09efc33323d8877cd79526d25c899532a3301c96fc101ae44af50", "source_title": "The TaintDroid Based Honeypot Monitoring System for Embedded Device", "tags": [], "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1088-1742-6596-2203-1-012077", "kind": "paper", "name": "The TaintDroid Based Honeypot Monitoring System for Embedded Device", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1088-1742-6596-2203-1-012077", "source_url": "https://doi.org/10.1088/1742-6596/2203/1/012077", "status": "published", "summary_en": "The authors describe a TaintDroid-based honeypot monitoring system for embedded devices, in which TaintDroid marks attackers who break into the honeypot and their behavior is then monitored and recorded. The work also reports a feasibility test of the system built by the authors.", "summary_es": "Los autores describen un sistema de monitoreo para honeypots basado en TaintDroid, orientado a dispositivos embebidos, en el que TaintDroid marca a los atacantes que penetran en el honeypot y luego se monitorean y registran sus comportamientos. El trabajo también informa sobre una prueba de factibilidad del sistema construido por los autores.", "updated_at": "2026-10-13", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["E Satria", "T P S Huda", "M Iqbal", "F W Sarjana"], "doi": "10.1088/1755-1315/644/1/012031", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "943d08aa0ee0692d6a4f001a02097826a0851d7f4794c15e1deee568d78537b7", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "IOP Conference Series: Earth and Environmental Science", "limitations_en": "This review is based only on the Crossref-deposited abstract; the full text was not reviewed and the reported results were not independently validated.", "limitations_es": "La revisión se basa únicamente en el resumen depositado en Crossref; no se verificó el texto completo ni se validaron de forma independiente los resultados reportados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1088/1755-1315/644/1/012031", "source_quote": "In this study, Snort acts as an intrusion prevention system and Cowrie Honeypot as a tool to investigate anomalous behavior that occurs when a brute force attack happened.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "4e445029f2598574b50d1b4f5847f6b2dcbc04f601700563d52138b1564c59b2", "source_title": "The investigation on cowrie honeypot logs in establishing rule signature snort", "tags": [], "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1088-1755-1315-644-1-012031", "kind": "paper", "name": "The investigation on cowrie honeypot logs in establishing rule signature snort", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1088-1755-1315-644-1-012031", "source_url": "https://doi.org/10.1088/1755-1315/644/1/012031", "status": "published", "summary_en": "The study, attributed to the authors, examines Cowrie Honeypot logs to inform the improvement of Snort rule signatures against brute force attacks. Snort acts as an intrusion prevention system and Cowrie as a tool to investigate anomalous behavior during such attacks; the authors report packet-matching processing times in microseconds for Hydra, Medusa and Ncrack attacks.", "summary_es": "El estudio, atribuido a los autores, examina registros de Cowrie Honeypot para orientar la mejora de firmas de reglas de Snort frente a ataques de fuerza bruta. Snort actúa como sistema de prevención de intrusiones y Cowrie como herramienta de investigación del comportamiento anómalo durante esos ataques; los autores reportan tiempos de procesamiento en microsegundos al hacer coincidir paquetes en ataques Hydra, Medusa y Ncrack.", "updated_at": "2026-10-13", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["N R Fitri", "A H S Budi", "I Kustiawan", "S E Suwono"], "doi": "10.1088/1757-899x/850/1/012037", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "45683e1e5b37780ed1341ad66856bee2023008250734eab236fa025ecedff240", "environments": ["Network", "Application"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "IOP Conference Series: Materials Science and Engineering", "limitations_en": "Review based only on the Crossref deposited abstract; the full text was not consulted and the results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se consultó el texto completo ni se verificaron de forma independiente los resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1088/1757-899x/850/1/012037", "source_quote": "most packets are discarded and directed to the honeypot without the attacker’s knowledge", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "d397a26fef5dc442327b26d5cdb9016f67fcdba0b1310a191f99f28003dca28d", "source_title": "Low interaction honeypot as the defense mechanism against Slowloris attack on the web server", "tags": [], "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1088-1757-899x-850-1-012037", "kind": "paper", "name": "Low interaction honeypot as the defense mechanism against Slowloris attack on the web server", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1088-1757-899x-850-1-012037", "source_url": "https://doi.org/10.1088/1757-899x/850/1/012037", "status": "published", "summary_en": "The authors describe how they used experiments to evaluate a defense mechanism based on the low interaction honeypot HoneyPy against Slowloris attacks on an Apache web server. According to the deposited abstract, most packets are discarded and directed to the honeypot without the attacker's knowledge, reducing the Slowloris attacks that reach the web server.", "summary_es": "Los autores describen cómo, mediante experimentos, evaluaron un mecanismo de defensa basado en el honeypot de baja interacción HoneyPy frente a ataques Slowloris contra un servidor web Apache. Según el resumen depositado, los paquetes dirigidos al servidor se descartan en su mayoría y se redirigen al honeypot sin conocimiento del atacante, lo que reduce los ataques que llegan al servidor web.", "updated_at": "2026-10-13", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Jarot S. Suroso", "Caesario Putra Prastya"], "doi": "10.1088/1757-899x/874/1/012008", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "45683e1e5b37780ed1341ad66856bee2023008250734eab236fa025ecedff240", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "IOP Conference Series: Materials Science and Engineering", "limitations_en": "Review based only on the abstract deposited in Crossref; neither full text was examined nor results independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se verificó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1088/1757-899x/874/1/012008", "source_quote": "The application of Security Information Event Management (SIEM) to cyber security systems to detect incoming threat alerts and block access to suspicious threats.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "74589721c534717dad241e1c8c0c3450380b393ce62d5af6bf607d4c8dd9b0af", "source_title": "Cyber Security System With SIEM And Honeypot In Higher Education", "tags": [], "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1088-1757-899x-874-1-012008", "kind": "paper", "name": "Cyber Security System With SIEM And Honeypot In Higher Education", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1088-1757-899x-874-1-012008", "source_url": "https://doi.org/10.1088/1757-899x/874/1/012008", "status": "published", "summary_en": "The paper describes deploying a Security Information Event Management (SIEM) system and a honeypot at a government higher education agency referred to as XYZ, aiming to detect incoming threat alerts and block suspicious access, while the honeypot is intended to deceive attackers into a fake system and learn their tactics. The authors report that testing this implementation allowed real-time monitoring of information- and data-related threats, and helped deter and deflect cyber-attacks to protect information security.", "summary_es": "El artículo describe la aplicación de un sistema de gestión de eventos e información de seguridad (SIEM) y un honeypot en una agencia gubernamental de educación superior denominada XYZ, con el fin de detectar alertas de amenazas y bloquear accesos sospechosos, mientras el honeypot busca engañar a los atacantes hacia un sistema falso y aprender sus tácticas. Los autores reportan que las pruebas de esta implementación permitieron monitorear en tiempo real amenazas relacionadas con la información y los datos, además de disuadir y desviar ciberataques para proteger la seguridad de la información.", "updated_at": "2026-10-13", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["B. R. TapasBapu", "V. Nagaraju", "M. Ramesh", "S. K. Rajesh Kanna", "P Sailaja"], "doi": "10.1088/1757-899x/993/1/012069", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "45683e1e5b37780ed1341ad66856bee2023008250734eab236fa025ecedff240", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "IOP Conference Series: Materials Science and Engineering", "limitations_en": "Review based only on the Crossref-deposited abstract and associated metadata; the full text was not consulted and the results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref y en los metadatos asociados; no se consultó el texto completo ni se verificaron de forma independiente los resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1088/1757-899x/993/1/012069", "source_quote": "The methodology in this study utilizes strategies for i. Hub verification, ii. Self Healing, iii. Mistake Correction.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "77bd07528d34173220cac1dc5c7b3f7959ce3a2f6f9cef8dbe8fadf2569e3834", "source_title": "Establishing self-healing and error correction in wireless sensor networks using honeypot database", "tags": [], "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1088-1757-899x-993-1-012069", "kind": "paper", "name": "Establishing self-healing and error correction in wireless sensor networks using honeypot database", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1088-1757-899x-993-1-012069", "source_url": "https://doi.org/10.1088/1757-899x/993/1/012069", "status": "published", "summary_en": "The work proposes a three-stage methodology for deploying honeypots in wireless sensor networks, aimed at detecting malicious activity and isolating malicious nodes. According to the abstract, the stages are node verification, self-healing and error correction, with the system relying on a server, a real database and honeypot-based data to monitor network traffic.", "summary_es": "El trabajo propone una metodología de tres etapas para desplegar honeypots en redes de sensores inalámbricas, con el fin de detectar actividad maliciosa y aislar nodos maliciosos. Según el resumen, las etapas son verificación de nodos, autocuración y corrección de errores, y el sistema se apoya en un servidor, una base de datos real y datos basados en honeypot para vigilar el tráfico de la red.", "updated_at": "2026-10-13", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Özkan Zeybek", "Hasan Güler"], "doi": "10.1088/2631-8695/ae9b66", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "45683e1e5b37780ed1341ad66856bee2023008250734eab236fa025ecedff240", "environments": ["Network", "IoT"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Engineering Research Express", "limitations_en": "Review limited to the publisher-deposited Crossref abstract; the full text was not read and the results, software, and effectiveness of the system were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado en Crossref por el editor; no se ha leído el texto completo ni se han validado de forma independiente los resultados, el software ni la eficacia del sistema.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1088/2631-8695/ae9b66", "source_quote": "An architecture comparison across five random seeds shows that a simple convolutional neural network (CNN)-AE performs similarly to a CNN-long short-term memory-AE (mean ROC-AUC difference of −0.0195 ± 0.0194); the hybrid is less stable and slower.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "f79a6ffde0cb65f7866bad386ca45f747302a7bb503a95a190aaa4b58dc8ce8d", "source_title": "Unsupervised deep learning for IoT botnet detection in a surveillance VLAN via multi-source traffic, threat intelligence and honeypot corroboration", "tags": [], "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1088-2631-8695-ae9b66", "kind": "paper", "name": "Unsupervised deep learning for IoT botnet detection in a surveillance VLAN via multi-source traffic, threat intelligence and honeypot corroboration", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1088-2631-8695-ae9b66", "source_url": "https://doi.org/10.1088/2631-8695/ae9b66", "status": "published", "summary_en": "The study proposes an unsupervised detection system built on autoencoder-family models that learn normal traffic behavior and flag anomalies through reconstruction error (MSE), applied to multi-source metadata (Wireshark, firewall logs, and a T-Pot honeypot) collected over fifteen days from a real enterprise VLAN. The authors incorporate external threat intelligence (AbuseIPDB, OTX) and a multi-dimensional scoring system (MDSS) to convert raw detections into prioritized risk scores, and validate anomalies through two MITRE ATT&CK pipelines.", "summary_es": "El estudio propone un sistema de detección no supervisado basado en modelos de la familia autoencoder que aprenden el comportamiento normal del tráfico y señalan anomalías mediante el error de reconstrucción (MSE), aplicado a metadatos de múltiples fuentes (Wireshark, registros de cortafuegos y honeypot T-Pot) recogidos durante quince días en una VLAN empresarial real. Los autores incorporan inteligencia de amenazas externa (AbuseIPDB, OTX) y un sistema de puntuación multidimensional (MDSS) para convertir las detecciones en puntuaciones de riesgo priorizadas, y validan las anomalías mediante dos canalizaciones MITRE ATT&CK.", "updated_at": "2026-10-13", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "authors": ["Vincent E. Urias", "William M.S. Stout", "Jean Luc-Watson", "Cole Grim", "Lorie Liebrock", "Monzy Merza"], "doi": "10.1109/ccst.2017.8167793", "environments": ["Network"], "journal": "2017 International Carnahan Conference on Security Technology (ICCST)", "review_basis": "publisher-metadata", "source_title": "Technologies to enable cyber deception", "tags": ["DOI"], "techniques": ["Decoy"]}, "evidence": "publisher-metadata", "id": "doi-10-1109-ccst-2017-8167793", "kind": "paper", "name": "Technologies to enable cyber deception", "organization": "Vincent E. Urias, William M.S. Stout", "reviewed_at": "2026-09-15", "slug": "doi-10-1109-ccst-2017-8167793", "source_url": "https://doi.org/10.1109/ccst.2017.8167793", "status": "published", "summary_en": "Bibliographic record on technologies enabling deception. The abstract and findings still require review.", "summary_es": "Registro bibliográfico sobre tecnologías habilitadoras de deception. El resumen y los resultados aún requieren lectura.", "updated_at": "2026-09-15", "year": 2017}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "authors": ["Denis Lavrov", "Veronique Blanchet", "Shaoning Pang", "Muyang He", "Abdolhossein Sarrafzadeh"], "doi": "10.1109/cloud.2016.0134", "environments": ["Cloud"], "journal": "2016 IEEE 9th International Conference on Cloud Computing (CLOUD)", "review_basis": "publisher-metadata", "source_title": "COR-Honeypot: Copy-On-Risk, Virtual Machine as Honeypot in the Cloud", "tags": ["DOI"], "techniques": ["Honeypot"]}, "evidence": "publisher-metadata", "id": "doi-10-1109-cloud-2016-0134", "kind": "paper", "name": "COR-Honeypot: Copy-On-Risk, Virtual Machine as Honeypot in the Cloud", "organization": "Denis Lavrov, Veronique Blanchet", "reviewed_at": "2026-09-15", "slug": "doi-10-1109-cloud-2016-0134", "source_url": "https://doi.org/10.1109/cloud.2016.0134", "status": "published", "summary_en": "Bibliographic record on decoy virtual machines in cloud. The abstract and findings still require review.", "summary_es": "Registro bibliográfico sobre máquinas virtuales señuelo en cloud. El resumen y los resultados aún requieren lectura.", "updated_at": "2026-09-15", "year": 2016}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "authors": ["Maxine Major", "Sunny Fugate", "Justin Mauger", "Kimberly Ferguson-Walter"], "doi": "10.1109/cogmi48466.2019.00023", "environments": ["Network"], "journal": "2019 IEEE First International Conference on Cognitive Machine Intelligence (CogMI)", "review_basis": "publisher-metadata", "source_title": "Creating Cyber Deception Games", "tags": ["DOI"], "techniques": ["Adversary engagement"]}, "evidence": "publisher-metadata", "id": "doi-10-1109-cogmi48466-2019-00023", "kind": "paper", "name": "Creating Cyber Deception Games", "organization": "Maxine Major, Sunny Fugate", "reviewed_at": "2026-09-15", "slug": "doi-10-1109-cogmi48466-2019-00023", "source_url": "https://doi.org/10.1109/cogmi48466.2019.00023", "status": "published", "summary_en": "Bibliographic record on cyber deception games. The abstract and findings still require review.", "summary_es": "Registro bibliográfico sobre juegos de cyberdeception. El resumen y los resultados aún requieren lectura.", "updated_at": "2026-09-15", "year": 2019}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "authors": ["Michael Kouremetis", "Ron Alford", "Dean Lawrence"], "doi": "10.1109/csnet59123.2023.10339776", "environments": ["Network"], "journal": "2023 7th Cyber Security in Networking Conference (CSNet)", "review_basis": "publisher-metadata", "source_title": "Mirage: Cyber Deception against Autonomous Cyber Attacks", "tags": ["DOI"], "techniques": ["Decoy"]}, "evidence": "publisher-metadata", "id": "doi-10-1109-csnet59123-2023-10339776", "kind": "paper", "name": "Mirage: Cyber Deception against Autonomous Cyber Attacks", "organization": "Michael Kouremetis, Ron Alford", "reviewed_at": "2026-09-15", "slug": "doi-10-1109-csnet59123-2023-10339776", "source_url": "https://doi.org/10.1109/csnet59123.2023.10339776", "status": "published", "summary_en": "Bibliographic record on deception against autonomous attacks. The abstract and findings still require review.", "summary_es": "Registro bibliográfico sobre engaño frente a ataques autónomos. El resumen y los resultados aún requieren lectura.", "updated_at": "2026-09-15", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "authors": ["ZiHan Wang", "Xu Wu", "ChaoGe Liu", "QiXu Liu", "JiaLai Zhang"], "doi": "10.1109/dsc.2018.00040", "environments": ["Endpoint"], "journal": "2018 IEEE Third International Conference on Data Science in Cyberspace (DSC)", "review_basis": "publisher-metadata", "source_title": "RansomTracer: Exploiting Cyber Deception for Ransomware Tracing", "tags": ["DOI"], "techniques": ["Decoy"]}, "evidence": "publisher-metadata", "id": "doi-10-1109-dsc-2018-00040", "kind": "paper", "name": "RansomTracer: Exploiting Cyber Deception for Ransomware Tracing", "organization": "ZiHan Wang, Xu Wu", "reviewed_at": "2026-09-15", "slug": "doi-10-1109-dsc-2018-00040", "source_url": "https://doi.org/10.1109/dsc.2018.00040", "status": "published", "summary_en": "Bibliographic record on ransomware tracing through deception. The abstract and findings still require review.", "summary_es": "Registro bibliográfico sobre trazabilidad de ransomware con deception. El resumen y los resultados aún requieren lectura.", "updated_at": "2026-09-15", "year": 2018}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "authors": ["Mario Kahlhofer", "Stefan Rass"], "design_en": "Technical review of 19 methods for adding application deception without source-code changes.", "design_es": "Revisión técnica de 19 métodos para introducir deception en aplicaciones sin modificar su código fuente.", "doi": "10.1109/eurospw61312.2024.00053", "environments": ["Application"], "finding_en": "Classifies options by container, kernel, network, platform and supporting methods.", "finding_es": "Clasifica opciones por contenedor, kernel, red, plataforma y métodos auxiliares.", "full_text_reviewed_at": "2026-09-16", "journal": "2024 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)", "limits_en": "It compares mechanisms but does not measure one common implementation under load or attack.", "limits_es": "Es una comparación de mecanismos; no mide una implementación común bajo carga o ataque.", "review_basis": "full-text", "source_title": "Application Layer Cyber Deception Without Developer Interaction", "tags": ["DOI"], "techniques": ["Decoy"]}, "evidence": "full-text-review", "id": "doi-10-1109-eurospw61312-2024-00053", "kind": "paper", "name": "Application Layer Cyber Deception Without Developer Interaction", "organization": "Mario Kahlhofer, Stefan Rass", "reviewed_at": "2026-09-16", "slug": "doi-10-1109-eurospw61312-2024-00053", "source_url": "https://doi.org/10.1109/eurospw61312.2024.00053", "status": "published", "summary_en": "Bibliographic record on application-layer deception. The abstract and findings still require review.", "summary_es": "Registro bibliográfico sobre deception en capa de aplicación. El resumen y los resultados aún requieren lectura.", "updated_at": "2026-09-18", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "authors": ["Aliou Badra Sarr", "Ahmed H. Anwar", "Charles Kamhoua", "Nandi Leslie", "Jaime Acosta"], "doi": "10.1109/globecom42002.2020.9348122", "environments": ["Network"], "journal": "GLOBECOM 2020 - 2020 IEEE Global Communications Conference", "review_basis": "publisher-metadata", "source_title": "Software Diversity for Cyber Deception", "tags": ["DOI"], "techniques": ["Moving target defense"]}, "evidence": "publisher-metadata", "id": "doi-10-1109-globecom42002-2020-9348122", "kind": "paper", "name": "Software Diversity for Cyber Deception", "organization": "Aliou Badra Sarr, Ahmed H. Anwar", "reviewed_at": "2026-09-15", "slug": "doi-10-1109-globecom42002-2020-9348122", "source_url": "https://doi.org/10.1109/globecom42002.2020.9348122", "status": "published", "summary_en": "Bibliographic record on software diversity for deception. The abstract and findings still require review.", "summary_es": "Registro bibliográfico sobre diversidad de software como señuelo. El resumen y los resultados aún requieren lectura.", "updated_at": "2026-09-15", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "authors": ["Junaid Haseeb", "Masood Mansoori", "Ian Welch"], "doi": "10.1109/lcn52139.2021.9525010", "environments": ["IoT"], "journal": "2021 IEEE 46th Conference on Local Computer Networks (LCN)", "review_basis": "publisher-metadata", "source_title": "Failure Modes and Effects Analysis (FMEA) of Honeypot-Based Cybersecurity Experiment for IoT", "tags": ["DOI"], "techniques": ["Honeypot"]}, "evidence": "publisher-metadata", "id": "doi-10-1109-lcn52139-2021-9525010", "kind": "paper", "name": "Failure Modes and Effects Analysis (FMEA) of Honeypot-Based Cybersecurity Experiment for IoT", "organization": "Junaid Haseeb, Masood Mansoori", "reviewed_at": "2026-09-15", "slug": "doi-10-1109-lcn52139-2021-9525010", "source_url": "https://doi.org/10.1109/lcn52139.2021.9525010", "status": "published", "summary_en": "Bibliographic record on failure analysis in IoT experiments. The abstract and findings still require review.", "summary_es": "Registro bibliográfico sobre análisis de fallas en experimentos IoT. El resumen y los resultados aún requieren lectura.", "updated_at": "2026-09-15", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "authors": ["Cho-Yu J. Chiang", "Yitzchak M. Gottlieb", "Shridatt James Sugrim", "Ritu Chadha", "Constantin Serban", "Alex Poylisher", "Lisa M. Marvel", "Jonathan Santos"], "doi": "10.1109/milcom.2016.7795427", "environments": ["Network"], "journal": "MILCOM 2016 - 2016 IEEE Military Communications Conference", "review_basis": "publisher-metadata", "source_title": "ACyDS: An adaptive cyber deception system", "tags": ["DOI"], "techniques": ["Decoy"]}, "evidence": "publisher-metadata", "id": "doi-10-1109-milcom-2016-7795427", "kind": "paper", "name": "ACyDS: An adaptive cyber deception system", "organization": "Cho-Yu J. Chiang, Yitzchak M. Gottlieb", "reviewed_at": "2026-09-15", "slug": "doi-10-1109-milcom-2016-7795427", "source_url": "https://doi.org/10.1109/milcom.2016.7795427", "status": "published", "summary_en": "Bibliographic record on an adaptive deception system. The abstract and findings still require review.", "summary_es": "Registro bibliográfico sobre un sistema adaptativo de deception. El resumen y los resultados aún requieren lectura.", "updated_at": "2026-09-15", "year": 2016}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "authors": ["Cliff Wang", "Zhuo Lu"], "doi": "10.1109/msp.2018.1870866", "environments": ["Network"], "journal": "IEEE Security & Privacy", "review_basis": "publisher-metadata", "source_title": "Cyber Deception: Overview and the Road Ahead", "tags": ["DOI"], "techniques": ["Decoy"]}, "evidence": "publisher-metadata", "id": "doi-10-1109-msp-2018-1870866", "kind": "paper", "name": "Cyber Deception: Overview and the Road Ahead", "organization": "Cliff Wang, Zhuo Lu", "reviewed_at": "2026-09-15", "slug": "doi-10-1109-msp-2018-1870866", "source_url": "https://doi.org/10.1109/msp.2018.1870866", "status": "published", "summary_en": "Bibliographic record on cyber deception overview and challenges. The abstract and findings still require review.", "summary_es": "Registro bibliográfico sobre panorama y desafíos de cyberdeception. El resumen y los resultados aún requieren lectura.", "updated_at": "2026-09-15", "year": 2018}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "authors": ["Amal Rami", "Adrien Fégar", "Salam Doumiati", "Ayman Alfalou"], "doi": "10.1109/noms69089.2026.11668367", "environments": ["Network"], "journal": "NOMS 2026-2026 IEEE Network Operations and Management Symposium", "review_basis": "publisher-metadata", "source_title": "CowLLMpot: Toward an LLM-Based Honeypot Fine-Tuned Using Cowrie Honeypot Data", "tags": ["DOI"], "techniques": ["Honeypot"]}, "evidence": "publisher-metadata", "id": "doi-10-1109-noms69089-2026-11668367", "kind": "paper", "name": "CowLLMpot: Toward an LLM-Based Honeypot Fine-Tuned Using Cowrie Honeypot Data", "organization": "Amal Rami, Adrien Fégar", "reviewed_at": "2026-09-15", "slug": "doi-10-1109-noms69089-2026-11668367", "source_url": "https://doi.org/10.1109/noms69089.2026.11668367", "status": "published", "summary_en": "Bibliographic record on language-model honeypot tuned on Cowrie data. The abstract and findings still require review.", "summary_es": "Registro bibliográfico sobre honeypot con modelo ajustado a datos de Cowrie. El resumen y los resultados aún requieren lectura.", "updated_at": "2026-09-15", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "authors": ["Hind Alrubaish", "Walid Aljoby", "Ahmed Aldeek", "Mohammed Alkubaish", "Daisuke Mashima"], "doi": "10.1109/ojcs.2026.3669021", "environments": ["Network"], "journal": "IEEE Open Journal of the Computer Society", "review_basis": "publisher-metadata", "source_title": "Toward Realistic and Efficient Cyber Deception", "tags": ["DOI"], "techniques": ["Decoy"]}, "evidence": "publisher-metadata", "id": "doi-10-1109-ojcs-2026-3669021", "kind": "paper", "name": "Toward Realistic and Efficient Cyber Deception", "organization": "Hind Alrubaish, Walid Aljoby", "reviewed_at": "2026-09-15", "slug": "doi-10-1109-ojcs-2026-3669021", "source_url": "https://doi.org/10.1109/ojcs.2026.3669021", "status": "published", "summary_en": "Bibliographic record on realism and efficiency of deception. The abstract and findings still require review.", "summary_es": "Registro bibliográfico sobre realismo y eficiencia de deception. El resumen y los resultados aún requieren lectura.", "updated_at": "2026-09-15", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "authors": ["Md Mazharul Islam", "Ehab Al-Shaer"], "doi": "10.1109/secdev45635.2020.00023", "environments": ["Application"], "journal": "2020 IEEE Secure Development (SecDev)", "review_basis": "publisher-metadata", "source_title": "Active Deception Framework: An Extensible Development Environment for Adaptive Cyber Deception", "tags": ["DOI"], "techniques": ["Decoy"]}, "evidence": "publisher-metadata", "id": "doi-10-1109-secdev45635-2020-00023", "kind": "paper", "name": "Active Deception Framework: An Extensible Development Environment for Adaptive Cyber Deception", "organization": "Md Mazharul Islam, Ehab Al-Shaer", "reviewed_at": "2026-09-15", "slug": "doi-10-1109-secdev45635-2020-00023", "source_url": "https://doi.org/10.1109/secdev45635.2020.00023", "status": "published", "summary_en": "Bibliographic record on an adaptive deception framework. The abstract and findings still require review.", "summary_es": "Registro bibliográfico sobre un framework adaptable de deception. El resumen y los resultados aún requieren lectura.", "updated_at": "2026-09-15", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "authors": ["Sushil Jajodia", "Noseong Park", "Fabio Pierazzi", "Andrea Pugliese", "Edoardo Serra", "Gerardo I. Simari", "V. S. Subrahmanian"], "doi": "10.1109/tifs.2017.2710945", "environments": ["Network"], "journal": "IEEE Transactions on Information Forensics and Security", "review_basis": "publisher-metadata", "source_title": "A Probabilistic Logic of Cyber Deception", "tags": ["DOI"], "techniques": ["Decoy"]}, "evidence": "publisher-metadata", "id": "doi-10-1109-tifs-2017-2710945", "kind": "paper", "name": "A Probabilistic Logic of Cyber Deception", "organization": "Sushil Jajodia, Noseong Park", "reviewed_at": "2026-09-15", "slug": "doi-10-1109-tifs-2017-2710945", "source_url": "https://doi.org/10.1109/tifs.2017.2710945", "status": "published", "summary_en": "Bibliographic record on probabilistic logic of deception. The abstract and findings still require review.", "summary_es": "Registro bibliográfico sobre lógica probabilística de deception. El resumen y los resultados aún requieren lectura.", "updated_at": "2026-09-15", "year": 2017}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "authors": ["Cristiano De Faveri", "Ana Moreira"], "doi": "10.1109/vlhcc.2018.8506515", "environments": ["Network"], "journal": "2018 IEEE Symposium on Visual Languages and Human-Centric Computing (VL/HCC)", "review_basis": "publisher-metadata", "source_title": "Visual Modeling of Cyber Deception", "tags": ["DOI"], "techniques": ["Decoy"]}, "evidence": "publisher-metadata", "id": "doi-10-1109-vlhcc-2018-8506515", "kind": "paper", "name": "Visual Modeling of Cyber Deception", "organization": "Cristiano De Faveri, Ana Moreira", "reviewed_at": "2026-09-15", "slug": "doi-10-1109-vlhcc-2018-8506515", "source_url": "https://doi.org/10.1109/vlhcc.2018.8506515", "status": "published", "summary_en": "Bibliographic record on visual modeling of deception. The abstract and findings still require review.", "summary_es": "Registro bibliográfico sobre modelado visual de deception. El resumen y los resultados aún requieren lectura.", "updated_at": "2026-09-15", "year": 2018}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "adjudication_status": "not performed", "authors": ["Md Ali Reza Al Amin", "Sachin Shetty", "Charles Kamhoua"], "design_en": "CyberBattleSim ToyCTF simulation with two attacker types and DQN and tabular Q-learning agents; compares decoy counts with an explicit penalty for connecting to a decoy.", "design_es": "Simulación con CyberBattleSim ToyCTF, dos tipos de atacante y agentes DQN y Q-learning tabular; compara diferentes cantidades de nodos señuelo con una penalización explícita por conexión.", "doi": "10.1109/wsc57314.2022.10015347", "environments": ["Network"], "extraction_status": "single-reviewer source-bounded full-text synthesis", "finding_en": "In the simulated scenarios, more decoys reduced the attacker agent’s episode win percentage and increased the steps needed to win.", "finding_es": "En los escenarios simulados, más señuelos redujeron el porcentaje de episodios ganados por el agente atacante y aumentaron los pasos hasta ganar.", "full_text_reviewed_at": "2026-10-02", "full_text_source_url": "https://informs-sim.org/wsc22papers/043.pdf", "journal": "2022 Winter Simulation Conference (WSC)", "limitations_en": "The setting is a toy network with a predefined reward function. No autonomous defender, uncertainty intervals or field outcomes are reported; the curves do not establish effectiveness in real networks.", "limitations_es": "El entorno es un grafo de laboratorio con función de recompensa predefinida. No se empleó un defensor autónomo ni se informan intervalos de incertidumbre o resultados de campo; las curvas no prueban eficacia en redes reales.", "limits_en": "The setting is a toy network with a predefined reward function. No autonomous defender, uncertainty intervals or field outcomes are reported; the curves do not establish effectiveness in real networks.", "limits_es": "El entorno es un grafo de laboratorio con función de recompensa predefinida. No se empleó un defensor autónomo ni se informan intervalos de incertidumbre o resultados de campo; las curvas no prueban eficacia en redes reales.", "page_anchors": ["PDF pp. 7–10, Sections 6.1–7, Figures 2–3"], "provenance_note_en": "The full text was examined and locators were retained. Single-reviewer synthesis without independent extraction or formal quality appraisal.", "provenance_note_es": "Se examinó el texto completo y se conservaron localizadores. Síntesis de un revisor, sin extracción independiente ni evaluación formal de calidad.", "review_basis": "full-text", "source_title": "Cyber Deception Metrics For Interconnected Complex Systems", "tags": ["DOI"], "techniques": ["Adversary engagement"]}, "evidence": "full-text-review", "id": "doi-10-1109-wsc57314-2022-10015347", "kind": "paper", "name": "Cyber Deception Metrics For Interconnected Complex Systems", "organization": "Md Ali Reza Al Amin, Sachin Shetty", "reviewed_at": "2026-10-02", "slug": "doi-10-1109-wsc57314-2022-10015347", "source_url": "https://doi.org/10.1109/wsc57314.2022.10015347", "status": "published", "summary_en": "In the simulated scenarios, more decoys reduced the attacker agent’s episode win percentage and increased the steps needed to win.", "summary_es": "En los escenarios simulados, más señuelos redujeron el porcentaje de episodios ganados por el agente atacante y aumentaron los pasos hasta ganar.", "updated_at": "2026-10-02", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Edward A. Cranford", "Cleotilde Gonzalez", "Palvi Aggarwal", "Milind Tambe", "Sarah Cooney", "Christian Lebiere"], "doi": "10.1111/cogs.13013", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "761991c3c1fb2466527a7539806ee1661b2a92888ecbe4f6a68c1e1ebe3e85af", "environments": [], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Cognitive Science", "limitations_en": "Review based solely on the deposited Crossref abstract; no access to the full text and no independent validation of results.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se accedió al texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1111/cogs.13013", "source_quote": "Our results show that the defense algorithm is more effective at reducing the probability of attack and protecting assets when using deceptive signaling, compared to no signaling, but is less effective than predicted against a perfectly rational adversary.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "7e6112f08e1bf5f5e239891e48d085505d15f5b26f6540958299803e5312952c", "source_title": "Towards a Cognitive Theory of Cyber Deception", "tags": [], "techniques": []}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1111-cogs-13013", "kind": "paper", "name": "Towards a Cognitive Theory of Cyber Deception", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1111-cogs-13013", "source_url": "https://doi.org/10.1111/cogs.13013", "status": "published", "summary_en": "This work is an initial step toward a cognitive theory of cyber deception, focusing on the cyber domain where physical cues are unavailable. The authors use an abstract cybersecurity game (Insider Attack Game) with behavioral experiments and an instance-based learning model within the ACT-R cognitive architecture to examine how human attackers make decisions under deceptive signaling and to compare outcomes with a perfectly rational adversary.", "summary_es": "Este trabajo presenta un paso inicial hacia una teoría cognitiva del engaño en el ciberespacio, centrándose en el dominio digital donde no existen señales físicas. Los autores emplean un juego abstracto de ciberseguridad (Insider Attack Game) con experimentos de comportamiento y un modelo de aprendizaje basado en instancias dentro de la arquitectura cognitiva ACT-R para examinar cómo los atacantes humanos toman decisiones ante señales engañosas y comparar los resultados con un adversario perfectamente racional.", "updated_at": "2026-10-13", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Nitin Naik", "Changjing Shang", "Paul Jenkins", "Qiang Shen"], "doi": "10.1111/exsy.12557", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "761991c3c1fb2466527a7539806ee1661b2a92888ecbe4f6a68c1e1ebe3e85af", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Expert Systems", "limitations_en": "Review based only on the publisher-deposited abstract; no full text was consulted and the results, implementation or effectiveness of the system were not independently verified.", "limitations_es": "Revisión basada únicamente en el resumen depositado por el editor; no se consultó el texto completo ni se verificaron de forma independiente los resultados, la implementación o la eficacia del sistema.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1111/exsy.12557", "source_quote": "A honeypot is a vital part of any security infrastructure for directly investigating attacks and attackers in real‐time to strengthen the overall security of the network.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "ed0b465de0684fd60eafec6fe9d6a80bdf5afb51debeaebfd403bc8085aeb1fd", "source_title": "Building a cognizant honeypot for detecting active fingerprinting attacks using dynamic fuzzy rule interpolation", "tags": [], "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1111-exsy-12557", "kind": "paper", "name": "Building a cognizant honeypot for detecting active fingerprinting attacks using dynamic fuzzy rule interpolation", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1111-exsy-12557", "source_url": "https://doi.org/10.1111/exsy.12557", "status": "published", "summary_en": "The article offers an approach to building a cognizant honeypot for detecting active fingerprinting attacks through the use of the established dynamic fuzzy rule interpolation (D-FRI) technique, relying on a sparse rule base while remaining capable of detecting such attacks when no matching rules are found. The system learns from current network conditions and provides a dynamic rule base intended to facilitate more accurate and efficient detection, as described by the authors.", "summary_es": "El artículo propone un enfoque para construir un honeypot consciente que detecte ataques activos de fingerprinting mediante la técnica establecida de interpolación dinámica de reglas difusas (D-FRI), empleando una base de reglas dispersa que sigue siendo capaz de detectar dichos ataques cuando no se encuentran reglas coincidentes. El sistema aprende de las condiciones actuales de la red y ofrece una base de reglas dinámica para facilitar una detección más precisa y eficiente, según los autores.", "updated_at": "2026-10-13", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["ÁLVARO HERRERO", "URKO ZURUTUZA", "EMILIO CORCHADO"], "doi": "10.1142/s0129065712500050", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "761991c3c1fb2466527a7539806ee1661b2a92888ecbe4f6a68c1e1ebe3e85af", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "International Journal of Neural Systems", "limitations_en": "Review limited to the Crossref-deposited abstract; the full text was not read and the results, implementations or effectiveness of the system were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se ha leído el texto completo ni se han validado de forma independiente los resultados, las implementaciones o la eficacia del sistema.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1142/s0129065712500050", "source_quote": "the use of different neural projection and unsupervised methods for the visual inspection of honeypot data", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "c004d01961f1be062dd1fd9df49b0b06e846eb5e819fea06532e000f71c17160", "source_title": "A NEURAL-VISUALIZATION IDS FOR HONEYNET DATA", "tags": [], "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1142-s0129065712500050", "kind": "paper", "name": "A NEURAL-VISUALIZATION IDS FOR HONEYNET DATA", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1142-s0129065712500050", "source_url": "https://doi.org/10.1142/s0129065712500050", "status": "published", "summary_en": "This work proposes the use of unsupervised neural models, based on neural projection methods, to generate an intuitive visualization of traffic captured from honeypot data rather than network statistics alone. The authors position the system as a complementary network security tool that supports security personnel in visually inspecting traffic events and in assessing Snort performance through the visualization of attack patterns.", "summary_es": "Este trabajo propone el uso de modelos neuronales no supervisados, basados en métodos de proyección neuronal, para generar una visualización intuitiva del tráfico capturado en datos de honeypot, en lugar de mostrar únicamente estadísticas de red. Los autores plantean este sistema como una herramienta complementaria de seguridad que facilite a los analistas la inspección visual de los eventos de tráfico y la evaluación del rendimiento de Snort mediante la visualización de patrones de ataque.", "updated_at": "2026-10-13", "year": 2012}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Xingyun Liu"], "doi": "10.1142/s0218194026410032", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "761991c3c1fb2466527a7539806ee1661b2a92888ecbe4f6a68c1e1ebe3e85af", "environments": ["Application"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "International Journal of Software Engineering and Knowledge Engineering", "limitations_en": "Review based solely on the abstract deposited in the Crossref metadata; the full text was not examined and the reported results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en los metadatos de Crossref; no se examinó el texto completo ni se validaron de forma independiente los resultados reportados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1142/s0218194026410032", "source_quote": "This study designs and implements a high-interaction LLM honeypot system for the effective detection and in-depth behavioral analysis of LLM-based attacks.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "1fa35d46b57262fd943dbe629dd0b2725dd3e395a2c34b3c80a6d25501080f85", "source_title": "Puzzle Pot: Challenge Based Honeypot Framework for Detecting and Defending Against Autonomous LLM Agents", "tags": [], "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1142-s0218194026410032", "kind": "paper", "name": "Puzzle Pot: Challenge Based Honeypot Framework for Detecting and Defending Against Autonomous LLM Agents", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1142-s0218194026410032", "source_url": "https://doi.org/10.1142/s0218194026410032", "status": "published", "summary_en": "The work describes the design and implementation of a high-interaction LLM honeypot system intended to detect and analyze the behavior of LLM-based attacks. The authors propose a strategy that embeds hidden puzzles in webpage source code to consume LLM tokens, alongside multi-dimensional heuristic detection and token heatmap visualization.", "summary_es": "El trabajo describe el diseño e implementación de un sistema honeypot de interacción alta para LLM, orientado a detectar y analizar el comportamiento de ataques basados en modelos de lenguaje. Los autores proponen una estrategia que inserta acertijos ocultos en el código fuente de páginas web para consumir tokens del LLM, junto con detección heurística multidimensional y visualización mediante mapas de calor de tokens.", "updated_at": "2026-10-13", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Xiaohui Zhang", "Wenhao Ji", "Tao Fen", "Jiafang Wei", "Bing Yao"], "doi": "10.1142/s1793830926500382", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "761991c3c1fb2466527a7539806ee1661b2a92888ecbe4f6a68c1e1ebe3e85af", "environments": ["Identity"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Discrete Mathematics, Algorithms and Applications", "limitations_en": "Review limited to the Crossref-deposited abstract; no full text, security-proof soundness, software operation or result effectiveness was verified.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se verificó el texto completo, la solidez de la prueba de seguridad, el funcionamiento del software ni la efectividad de los resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1142/s1793830926500382", "source_quote": "achieving security protection through a honeywords generation algorithm with high smoothness characteristics", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "4561521e466d2c877bc3e04dd29f3d0eb3dbc98f96861a7666133cdbf9696418", "source_title": "Novel honeywords Generation Mechanism Driven By Pythagorean Graph Sequences", "tags": [], "techniques": ["Honeytoken"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1142-s1793830926500382", "kind": "paper", "name": "Novel honeywords Generation Mechanism Driven By Pythagorean Graph Sequences", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1142-s1793830926500382", "source_url": "https://doi.org/10.1142/s1793830926500382", "status": "published", "summary_en": "The paper proposes a password-leak detection method based on Pythagorean triples, generating honeywords from a special graph-structure sequence built using number-theoretic properties of those triples. The authors describe a generation algorithm with a flat distribution and report a security proof and comparative experiments aimed at brute-force resistance and storage efficiency.", "summary_es": "El artículo propone un método de detección de filtraciones de contraseñas basado en ternas pitagóricas, que genera 'honeywords' a partir de una secuencia de estructura gráfica construida con propiedades numéricas de dichas ternas. Los autores describen un algoritmo de generación con distribución uniforme y presentan una prueba de seguridad y experimentos comparativos orientados a la resistencia a ataques de fuerza bruta y a la eficiencia de almacenamiento.", "updated_at": "2026-10-13", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Michael Vrable", "Justin Ma", "Jay Chen", "David Moore", "Erik Vandekieft", "Alex C. Snoeren", "Geoffrey M. Voelker", "Stefan Savage"], "doi": "10.1145/1095809.1095825", "doi_aliases": ["10.1145/1095810.1095825"], "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "761991c3c1fb2466527a7539806ee1661b2a92888ecbe4f6a68c1e1ebe3e85af", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "reviewed-registered-reciprocal-doi-alias-against-v2026.10.2", "identity_resolution_sha256": "556030e10786713cfd87d9d20b387861f5c28effd75ef4bd67c1d51117931a29", "journal": "ACM SIGOPS Operating Systems Review", "limitations_en": "Review limited to the deposited abstract and Crossref bibliographic metadata; the full text was not examined, and the results, prototype, or its effectiveness were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado y a los metadatos bibliográficos de Crossref; no se examinó el texto completo ni se validaron de forma independiente los resultados, el prototipo o su eficacia.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1145/1095809.1095825", "source_quote": "In this paper, we describe an approach to minimize this tension and improve honeypot scalability by up to six orders of magnitude while still closely emulating the execution behavior of individual Internet hosts.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "d703288b54ea332bfc8e194a862e3030a9fb461611906e7ef1e741cdce9da642", "source_title": "Scalability, fidelity, and containment in the potemkin virtual honeyfarm", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1145-1095809-1095825", "kind": "paper", "name": "Scalability, fidelity, and containment in the potemkin virtual honeyfarm", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1145-1095809-1095825", "source_url": "https://doi.org/10.1145/1095809.1095825", "status": "published", "summary_en": "The paper addresses the tension between scalability and fidelity in network honeypots used to gather intelligence on malware, and proposes reducing it through a prototype honeyfarm system called Potemkin. According to the authors, Potemkin uses virtual machines, aggressive memory sharing, and late binding of resources to emulate the execution behavior of individual hosts at large scale.", "summary_es": "El artículo aborda la tensión entre escalabilidad y fidelidad en las honeypots de red para la recolección de inteligencia sobre malware, y propone reducirla mediante un sistema prototipo de honeyfarm llamado Potemkin. Según los autores, Potemkin emplea máquinas virtuales, compartición agresiva de memoria y enlace tardío de recursos para emular el comportamiento de hosts individuales a gran escala.", "updated_at": "2026-10-13", "year": 2005}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Ryan Talabis"], "doi": "10.1145/1138403.1138445", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "761991c3c1fb2466527a7539806ee1661b2a92888ecbe4f6a68c1e1ebe3e85af", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "ACM SIGCSE Bulletin", "limitations_en": "Review based solely on the Crossref-deposited abstract; the full text was not read and results or educational application were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se leyó el texto completo ni se validaron de forma independiente los resultados o la aplicación didáctica.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1145/1138403.1138445", "source_quote": "we shall propose an alternative approach to learning and teaching IT Security called Honeynet Learning which uses the Honeynet as a tool and resource to augment both student and instructor learning", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "45a61e5f4e301c33214dc308e6929f23759c901a1be9e70a45426e21a4276afb", "source_title": "Honeynet learning", "tags": [], "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1145-1138403-1138445", "kind": "paper", "name": "Honeynet learning", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1145-1138403-1138445", "source_url": "https://doi.org/10.1145/1138403.1138445", "status": "published", "summary_en": "The author proposes an alternative approach to learning and teaching IT security called Honeynet Learning, which uses the honeynet as a tool and resource to augment both student and instructor learning. The approach incorporates discovery, feedback, and \"real world\" experience, and illustrates a methodology that can be applied in a typical IT security course.", "summary_es": "El autor propone un enfoque alternativo para enseñar y aprender seguridad informática llamado Honeynet Learning, que utiliza la honeynet como herramienta y recurso para complementar el aprendizaje del estudiante y del instructor. El enfoque incorpora descubrimiento, retroalimentación y experiencia del \"mundo real\", e ilustra una metodología aplicable a un curso típico de seguridad informática.", "updated_at": "2026-10-13", "year": 2006}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Matthias Wählisch", "Sebastian Trapp", "Christian Keil", "Jochen Schönfelder", "Thomas C. schmidt", "Jochen Schiller"], "doi": "10.1145/2377677.2377743", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "e6481b4d86dece094a95ea9f8f45dfa766b33b626b110035cdfb599d5078459b", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "ACM SIGCOMM Computer Communication Review", "limitations_en": "Review limited to the Crossref-deposited abstract; the full text was not read and results were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se consultó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1145/2377677.2377743", "source_quote": "We present a comparative study that analyzes to what extent those attacks depend on the network access, in particular if an adversary targets specifically on mobile or non-mobile devices.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "bc28046b71943e3760ab1908d59f3cc7e9513a162a384fa45b9fb4893a15ca35", "source_title": "First insights from a mobile honeypot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1145-2377677-2377743", "kind": "paper", "name": "First insights from a mobile honeypot", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1145-2377677-2377743", "source_url": "https://doi.org/10.1145/2377677.2377743", "status": "published", "summary_en": "The authors present a comparative study, based on a mobile honeypot that extracts first statistical results, to analyze to what extent malicious transport contacts depend on the type of network access, particularly whether an adversary specifically targets mobile or non-mobile devices. Their findings indicate that a few topological domains of the Internet have started to place particular focus on attacking mobile networks.", "summary_es": "Los autores presentan un estudio comparativo, basado en un honeypot móvil que extrae resultados estadísticos iniciales, para analizar en qué medida los contactos de transporte maliciosos dependen del tipo de acceso a la red, en particular si un adversario ataca específicamente dispositivos móviles o no móviles. Según sus hallazgos, algunos dominios topológicos de Internet habrían comenzado a centrarse en atacar redes móviles.", "updated_at": "2026-10-13", "year": 2012}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Asaf Shabtai", "Maya Bercovitch", "Lior Rokach", "Ya'akov (Kobi) Gal", "Yuval Elovici", "Erez Shmueli"], "doi": "10.1145/2854152", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "e6481b4d86dece094a95ea9f8f45dfa766b33b626b110035cdfb599d5078459b", "environments": [], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "ACM Transactions on Information and System Security", "limitations_en": "This entry is based only on the deposited abstract and archived Crossref metadata, not on full-text reading or independent validation of results.", "limitations_es": "Esta entrada se basa únicamente en el resumen depositado y los metadatos archivados de Crossref, no en la lectura del texto completo ni en una validación independiente de los resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1145/2854152", "source_quote": "Active honeytokens are fake digital data objects planted among real data objects and used in an attempt to detect data misuse by insiders.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "6363584cd3f5ef10352c29729867e4dac9c8d8c0f75128c8d4fbac5e330df6ed", "source_title": "Behavioral Study of Users When Interacting with Active Honeytokens", "tags": [], "techniques": ["Honeytoken"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1145-2854152", "kind": "paper", "name": "Behavioral Study of Users When Interacting with Active Honeytokens", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1145-2854152", "source_url": "https://doi.org/10.1145/2854152", "status": "published", "summary_en": "This article studies how users, such as employees, interact with active honeytokens, meaning fake data objects planted among real data to detect data misuse by insiders. The authors describe an automated, generic method for generating those honeytokens and present two behavioral studies examining whether users can distinguish them from real objects and whether user behavior changes when users are informed that monitored honeytokens are present.", "summary_es": "Este artículo estudia cómo los usuarios, por ejemplo empleados, interactúan con honeytokens activos, es decir, objetos de datos falsos plantados entre datos reales para detectar el mal uso de datos por parte de personas internas. Los autores describen un método automatizado y genérico para generar esos honeytokens y presentan dos estudios de comportamiento sobre si los usuarios pueden distinguirlos de objetos reales y si su comportamiento cambia al saber que existen honeytokens monitorizados.", "updated_at": "2026-10-13", "year": 2016}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "authors": ["Quanyan Zhu"], "doi": "10.1145/3314058.3314067", "environments": ["Network"], "journal": "Proceedings of the 6th Annual Symposium on Hot Topics in the Science of Security", "review_basis": "publisher-metadata", "source_title": "Game theory for cyber deception", "tags": ["DOI"], "techniques": ["Adversary engagement"]}, "evidence": "publisher-metadata", "id": "doi-10-1145-3314058-3314067", "kind": "paper", "name": "Game theory for cyber deception", "organization": "Quanyan Zhu", "reviewed_at": "2026-09-15", "slug": "doi-10-1145-3314058-3314067", "source_url": "https://doi.org/10.1145/3314058.3314067", "status": "published", "summary_en": "Bibliographic record on game theory applied to deception. The abstract and findings still require review.", "summary_es": "Registro bibliográfico sobre teoría de juegos aplicada a deception. El resumen y los resultados aún requieren lectura.", "updated_at": "2026-09-15", "year": 2019}
{"critical_reading": null, "data": {"access_date": "2026-10-16", "authors": ["Manolis Stamatogiannakis", "Herbert Bos", "Paul Groth"], "doi": "10.1145/3380786.3391396", "doi_aliases": [], "draft_review_basis": "deepseek-original-draft; codex-source-correction-and-independent-claude-review", "environments": ["Network"], "full_text_reviewed": false, "journal": "Proceedings of the 13th European workshop on Systems Security", "limitations_en": "Abstract-only reading depth: the full paper was not reviewed, no performance or independent verification is inferred, and no Atlas deployment is described.", "limitations_es": "Leído solo a nivel de resumen: no se evaluó el texto completo, no se infiere rendimiento ni verificación independiente, y no se describe despliegue en Atlas.", "metadata_sha256": "6e5a5f3080e2d83bec4b842ec090036ca4f511ee252039c55400efbb9d2d34a5", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "source-page", "review_depth": "institutional publication metadata and abstract; full paper unavailable", "reviewed_metadata_url": "https://api.crossref.org/works/10.1145/3380786.3391396", "selection_report": "data/coverage/recovered-institutional-paper-review-2026-10-16.json", "selection_report_sha256": "e31df91e151a93514465ed03dd6189f82f14ddd2ba2ca61942886ed7b482394a", "source_correction_input_sha256": "1dcdd16b926b55fb6873172d3ffe3bf1c93b4d84b6b6cb3234da0b43ad2d8540", "source_document_url": "https://research.vu.nl/en/publications/pandacap-a-framework-for-streamlining-collection-of-full-system-t/", "source_packet_sha256": "e22f3c25f35d4dac34856fcdd40e8dbf1284b1ef180b7652d3515e73c8467afc", "source_quote": "As a demonstration, we have used PANDAcap to deploy an ssh honeypot aiming to study the actions of brute-force ssh attacks.", "source_quote_locator": {"field": "institutional publication abstract", "source_url": "https://research.vu.nl/en/publications/pandacap-a-framework-for-streamlining-collection-of-full-system-t/"}, "source_sha256": "390a69d910a1e373a89ef4ee3031fde738de6209b09b654e05631fdb91da8f87", "source_title": "PANDAcap: A framework for streamlining collection of full-system traces", "source_type": "institutional publication metadata and abstract; full paper unavailable", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-source-passages", "id": "doi-10-1145-3380786-3391396", "kind": "paper", "name": "PANDAcap: A framework for streamlining collection of full-system traces", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-1145-3380786-3391396", "source_url": "https://doi.org/10.1145/3380786.3391396", "status": "published", "summary_en": "The paper presents PANDAcap, a framework for automating full-system deterministic trace collection and preparing repeatable experiments. The authors describe its use in an SSH honeypot to study the actions of brute-force attacks.", "summary_es": "El paper presenta PANDAcap, un framework para automatizar la captura de trazas deterministas de sistema completo y preparar experimentos repetibles. Los autores describen su uso en un honeypot SSH para estudiar las acciones de ataques de fuerza bruta.", "updated_at": "2026-10-16", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Mengmeng Ge", "Jin-Hee Cho", "Dongseong Kim", "Gaurav Dixit", "Ing-Ray Chen"], "doi": "10.1145/3467021", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "e6481b4d86dece094a95ea9f8f45dfa766b33b626b110035cdfb599d5078459b", "environments": ["IoT", "Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "ACM Transactions on Internet Technology", "limitations_en": "Review limited to the Crossref-deposited abstract only; the full text was not read and the results were not independently validated.", "limitations_es": "Revisión limitada únicamente al resumen depositado en Crossref; no se ha leído el texto completo ni se han validado de forma independiente los resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1145/3467021", "source_quote": "we propose an integrated defense technique to achieve intrusion prevention by leveraging cyberdeception (i.e., a decoy system) and moving target defense (i.e., network topology shuffling)", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "6bfaab311bbe11d77a0eb40b515b66f8f38c64abd75d24e5e64e2b896a7bd095", "source_title": "Proactive Defense for Internet-of-things: Moving Target Defense With Cyberdeception", "tags": [], "techniques": ["Decoy", "Moving target defense"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1145-3467021", "kind": "paper", "name": "Proactive Defense for Internet-of-things: Moving Target Defense With Cyberdeception", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1145-3467021", "source_url": "https://doi.org/10.1145/3467021", "status": "published", "summary_en": "The work addresses the protection of vulnerable components in Internet-of-Things (IoT) networks through an intrusion prevention technique that combines cyberdeception (a decoy system) and moving target defense (network topology shuffling). The authors analytically evaluate effectiveness and efficiency using a graphical security model in an SDN-based IoT network, defining strategies for when and how to perform topology shuffling to pursue goals such as prolonging system lifetime, increasing attack complexity on critical nodes, or maintaining service availability.", "summary_es": "El trabajo aborda la protección de componentes vulnerables en redes de Internet de las Cosas (IoT) mediante una técnica de prevención de intrusiones que combina ciberdecepción (un sistema señuelo) y defensa de objetivo móvil (reordenamiento de la topología de red). Los autores evalúan analíticamente la efectividad y eficiencia con un modelo gráfico de seguridad en una red IoT basada en SDN, definiendo estrategias sobre cuándo y cómo realizar el reordenamiento de topología para alcanzar objetivos como prolongar la vida útil del sistema, aumentar la complejidad del ataque a nodos críticos o mantener la disponibilidad del servicio.", "updated_at": "2026-10-13", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "authors": ["Fei Fang"], "doi": "10.1145/3474370.3485656", "environments": ["Network"], "journal": "Proceedings of the 8th ACM Workshop on Moving Target Defense", "review_basis": "publisher-metadata", "source_title": "Game Theoretic Models for Cyber Deception", "tags": ["DOI"], "techniques": ["Adversary engagement"]}, "evidence": "publisher-metadata", "id": "doi-10-1145-3474370-3485656", "kind": "paper", "name": "Game Theoretic Models for Cyber Deception", "organization": "Fei Fang", "reviewed_at": "2026-09-15", "slug": "doi-10-1145-3474370-3485656", "source_url": "https://doi.org/10.1145/3474370.3485656", "status": "published", "summary_en": "Bibliographic record on game-theoretic deception models. The abstract and findings still require review.", "summary_es": "Registro bibliográfico sobre modelos de teoría de juegos para deception. El resumen y los resultados aún requieren lectura.", "updated_at": "2026-09-15", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Shanto Roy", "Nazia Sharmin", "Jaime C. Acosta", "Christopher Kiekintveld", "Aron Laszka"], "doi": "10.1145/3538704", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "e6481b4d86dece094a95ea9f8f45dfa766b33b626b110035cdfb599d5078459b", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "ACM Computing Surveys", "limitations_en": "Review based only on the Crossref deposited abstract; the full text was not examined and results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se examinó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1145/3538704", "source_quote": "We summarize and analyze the methods, tactics, and tools that adversaries use to conduct reconnaissance activities throughout the attack process.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "302b681854775c36496897a6effa400e6d140b3b0ad249fb90f9a7b9933d15fe", "source_title": "Survey and Taxonomy of Adversarial Reconnaissance Techniques", "tags": [], "techniques": ["Decoy"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1145-3538704", "kind": "paper", "name": "Survey and Taxonomy of Adversarial Reconnaissance Techniques", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1145-3538704", "source_url": "https://doi.org/10.1145/3538704", "status": "published", "summary_en": "The authors summarize and analyze the methods, tactics, and tools adversaries use to conduct reconnaissance activities throughout the attack process, discussing what types of information they seek and how and when they can obtain it. They provide a taxonomy of adversarial reconnaissance techniques categorized by source, as third-party and human- and system-based information gathering, aiming to help understand and model this aspect of cyber attacks and offer insights for improving defensive strategies such as cyber deception.", "summary_es": "Los autores revisan y analizan los métodos, tácticas y herramientas que los adversarios emplean para realizar actividades de reconocimiento a lo largo del proceso de ataque, examinando qué tipos de información buscan y cómo y cuándo pueden obtenerla. Proponen una taxonomía de técnicas de reconocimiento basada en la fuente, distinguiendo entre la recopilación de información por terceros y la obtenida de personas y sistemas, con el fin de comprender y modelar este aspecto de los ciberataques y aportar ideas para mejorar estrategias defensivas como el engaño cibernético.", "updated_at": "2026-10-13", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Nilesh Chakraborty", "Jianqiang Li", "Victor C. M. Leung", "Samrat Mondal", "Yi Pan", "Chengwen Luo", "Mithun Mukherjee"], "doi": "10.1145/3552431", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "e6481b4d86dece094a95ea9f8f45dfa766b33b626b110035cdfb599d5078459b", "environments": ["Identity"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "ACM Computing Surveys", "limitations_en": "Review based solely on the Crossref deposited abstract; the full text was not consulted and the described findings were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se consultó el texto completo ni se validaron de forma independiente los resultados descritos.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1145/3552431", "source_quote": "This paper aims to present a comprehensive survey of the relevant research and technological developments in honeyword-based authentication techniques.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "877a83fdd9aa26ddf43c7c8492f15a24d87a636d87fc3c76818ff273303e01f2", "source_title": "Honeyword-based Authentication Techniques for Protecting Passwords: A Survey", "tags": [], "techniques": ["Decoy", "Honeytoken"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1145-3552431", "kind": "paper", "name": "Honeyword-based Authentication Techniques for Protecting Passwords: A Survey", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1145-3552431", "source_url": "https://doi.org/10.1145/3552431", "status": "published", "summary_en": "This survey reviews twenty-three honeyword (decoy password) based authentication techniques introduced by Juels and Rivest in 2013, which aim to detect server-side threats on password files and notify the administrator when an attacker attempts to exploit a compromised file. The authors compare existing approaches and identify remaining gaps and emergent research opportunities.", "summary_es": "Esta encuesta revisa veintitrés técnicas de autenticación basadas en honeywords (contraseñas señuelo), introducidas por Juels y Rivest en 2013, que buscan detectar amenazas del lado del servidor sobre los archivos de contraseñas y notificar al administrador cuando un atacante intenta explotar un archivo comprometido. Los autores comparan los enfoques existentes e identifican lagunas y oportunidades de investigación pendientes.", "updated_at": "2026-10-13", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Md Sajidul Islam Sajid", "Jinpeng Wei", "Ehab Al-Shaer", "Qi Duan", "Basel Abdeen", "Latifur Khan"], "doi": "10.1145/3624568", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "3370288d1979bf50bfe0ebb002fe7cb65078b6ec8cc377a0a37a16de00293033", "environments": ["Endpoint"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "ACM Transactions on Privacy and Security", "limitations_en": "Review based only on the Crossref-deposited abstract; the full text was not consulted and the authors' reported results, such as accuracy, recall, or precision figures, were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se consultó el texto completo ni se validaron de forma independiente los resultados, como las cifras de exactitud, exhaustividad o precisión reportadas por los autores.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1145/3624568", "source_quote": "symbSODA extracts Malicious Sub-graphs (MSGs) consisting of WinAPIs from real-world malware and maps them to tactics and techniques using the ATT&CK framework to facilitate the construction of meaningful user-defined deception playbooks.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "cadfba2ff8f2daafdc27a66944949b2ae5e94b26465f5ceea9d195f24adc5e9d", "source_title": "symbSODA: Configurable and Verifiable Orchestration Automation for Active Malware Deception", "tags": [], "techniques": ["Decoy", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1145-3624568", "kind": "paper", "name": "symbSODA: Configurable and Verifiable Orchestration Automation for Active Malware Deception", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1145-3624568", "source_url": "https://doi.org/10.1145/3624568", "status": "published", "summary_en": "The authors describe symbSODA, an active cyber deception system that analyzes real-world malware using multipath execution to extract Malicious Sub-graphs composed of WinAPIs and map them to ATT&CK tactics and techniques, in order to construct and execute customized deception playbooks. Its stated purpose is to let users create conflict-free deception plans and automate deception orchestration within a deceptive environment.", "summary_es": "Los autores describen symbSODA, un sistema de decepción ciberactiva que analiza malware real mediante ejecución de rutas múltiples para extraer subgrafos maliciosos compuestos por WinAPIs y mapearlos a tácticas y técnicas del marco ATT&CK, con el fin de construir y ejecutar planes de decepción personalizados. El propósito declarado es permitir a los usuarios configurar planes de decepción sin conflictos y automatizar la orquestación de la decepción dentro de un entorno engañoso.", "updated_at": "2026-10-13", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Venkata Sai Charan Putrevu", "Subhasis Mukhopadhyay", "Subhajit Manna", "Nanda Rani", "Ansh Vaid", "Hrushikesh Chunduri", "Mohan Anand Putrevu", "Sandeep Shukla"], "doi": "10.1145/3651991", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "3370288d1979bf50bfe0ebb002fe7cb65078b6ec8cc377a0a37a16de00293033", "environments": ["Network", "Application"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Digital Threats: Research and Practice", "limitations_en": "This entry is based only on the title and abstract deposited in Crossref metadata; the full text was not reviewed, and the actual deployment, reported results, and effectiveness of the system were not independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y el resumen depositados en los metadatos de Crossref; no se revisó el texto completo, ni se verificaron de forma independiente el despliegue real, los resultados reportados ni la eficacia del sistema.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1145/3651991", "source_quote": "Deployed for 100 days, our orchestrated honeypot recorded 13,906,945 hits from 4,238 unique IP addresses.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "fd0769c1d446b2f51aaa7972226847efc1dd4fc9fd5047ac9d02d0fb9f83ce68", "source_title": "ADAPT: Adaptive Camouflage Based Deception Orchestration For Trapping Advanced Persistent Threats", "tags": [], "techniques": ["Honeypot", "Decoy", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1145-3651991", "kind": "paper", "name": "ADAPT: Adaptive Camouflage Based Deception Orchestration For Trapping Advanced Persistent Threats", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1145-3651991", "source_url": "https://doi.org/10.1145/3651991", "status": "published", "summary_en": "The authors address the difficulty that traditional honeypot implementations are evaded by advanced adversaries such as APT groups, and propose designing and deploying a customized honeypot network based on adaptive camouflaging techniques. The work describes orchestrating a behavioral honeypot network tailored to three APT groups, with attack paths aligned with their tactics, techniques, and procedures, and includes a camouflaged chatterbox application deployed for 100 days; according to the deposited abstract, the setup recorded 13,906,945 hits from 4,238 unique IP addresses and was used to categorize attackers.", "summary_es": "Los autores abordan la dificultad de que las implementaciones tradicionales de honeypots sean eludidas por atacantes avanzados como los grupos APT, y proponen diseñar y desplegar una red de honeypots personalizada basada en técnicas de camuflaje adaptativo. El trabajo describe la orquestación de una red de honeypots de comportamiento orientada a tres grupos APT, con rutas de ataque alineadas con sus tácticas, técnicas y procedimientos, e incluye una aplicación de chat camuflada desplegada durante 100 días; según el resumen depositado, el sistema registró 13.906.945 impactos de 4.238 direcciones IP únicas y permitió categorizar a los atacantes.", "updated_at": "2026-10-13", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Zelin Wan", "Jin-Hee Cho", "Mu Zhu", "Ahmed Anwar", "Charles Kamhoua", "Munindar Singh"], "doi": "10.1145/3701233", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "3370288d1979bf50bfe0ebb002fe7cb65078b6ec8cc377a0a37a16de00293033", "environments": [], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "ACM Transactions on Internet Technology", "limitations_en": "Review based only on the Crossref-deposited abstract; no full text was read and no results were independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se verificó el texto completo ni los resultados del estudio.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1145/3701233", "source_quote": "we introduce the concept of cyber deception using honey drones (HDs) to protect the mission system from DoS attacks", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "7815be06fe059718e62e1bc3887b6844f2808169de07ea92fbbbbca2619d5906", "source_title": "Optimizing Effectiveness and Defense of Drone Surveillance Missions via Honey Drones", "tags": [], "techniques": ["Honeypot", "Decoy", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1145-3701233", "kind": "paper", "name": "Optimizing Effectiveness and Defense of Drone Surveillance Missions via Honey Drones", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1145-3701233", "source_url": "https://doi.org/10.1145/3701233", "status": "published", "summary_en": "This work aims to develop a drone-based surveillance mission system when Denial-of-Service (DoS) attacks disrupt normal operations. The authors introduce cyber deception via honey drones (HDs) that exhibit fake vulnerabilities and use stronger signal strengths to lure DoS attacks, formulate an optimization problem over HD and mission drone signal strengths, and solve it using deep reinforcement learning (DRL) with the Asynchronous Advantage Actor-Critic (A3C) algorithm, evaluated in a physical engine-based simulation testbed.", "summary_es": "Este trabajo busca desarrollar un sistema de misión de vigilancia con vehículos aéreos no tripulados (drones) cuando hay ataques de denegación de servicio (DoS) que interrumpen las operaciones. Los autores introducen el concepto de ciberengaño mediante drones señuelo (honey drones, HD) que exhiben vulnerabilidades falsas y emplean potencias de señal mayores para atraer ataques DoS, y formulan un problema de optimización de potencias de señal que resuelven con aprendizaje por refuerzo profundo (DRL) y el algoritmo Asynchronous Advantage Actor-Critic (A3C), evaluado en un banco de pruebas de simulación con motor físico.", "updated_at": "2026-10-13", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Roelien Timmer", "David Liebowitz", "Surya Nepal", "Salil Kanhere"], "doi": "10.1145/3763792", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "3370288d1979bf50bfe0ebb002fe7cb65078b6ec8cc377a0a37a16de00293033", "environments": [], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "ACM Transactions on Privacy and Security", "limitations_en": "Review based solely on the Crossref deposited abstract; the full text was not consulted and the results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se consultó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1145/3763792", "source_quote": "Metrics to quantify honeyfile attributes are thus essential to creating and evaluating effective deceptions.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "ecc55b55b23eea379f5d5df592ac3d4b6e7ef3e7e507770ea18695ba368282a3", "source_title": "Evaluating Honeyfile Realism and Enticement Metrics", "tags": [], "techniques": ["Honeytoken", "Decoy"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1145-3763792", "kind": "paper", "name": "Evaluating Honeyfile Realism and Enticement Metrics", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1145-3763792", "source_url": "https://doi.org/10.1145/3763792", "status": "published", "summary_en": "The study compares proposed metrics for honeyfile attributes—Common Token Count and Topic Semantic Matching for enticement, and coherence and cohesion for realism—against human users' perceptions as they judged text samples in a simulated data breach scenario on a crowd-sourcing platform. The authors report that Topic Semantic Matching aligned with perceived enticement, whereas results for Common Token Count were inconsistent and inconclusive, and coherence and cohesion did not consistently align with perceived realism.", "summary_es": "El estudio compara métricas propuestas para atributos de archivos señuelo (honeyfiles) —Common Token Count y Topic Semantic Matching para el atractivo, y coherencia y cohesión para el realismo— con las percepciones de usuarios humanos que juzgaron muestras de texto en un escenario simulado de brecha de datos en una plataforma de crowdsourcing. Los autores informan que Topic Semantic Matching se alineó con el atractivo percibido, mientras que los resultados para Common Token Count fueron inconsistentes y no concluyentes, y la coherencia y la cohesión no se alinearon de forma consistente con el realismo percibido.", "updated_at": "2026-10-13", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Saurabh Chamotra", "Ferdous Barbhuiya"], "doi": "10.1145/3769011", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "3370288d1979bf50bfe0ebb002fe7cb65078b6ec8cc377a0a37a16de00293033", "environments": ["IoT"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "ACM Transactions on Internet of Things", "limitations_en": "Review limited to the Crossref-deposited abstract and bibliographic metadata; the full text was not consulted and the described results, software, or effectiveness were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado en Crossref y a los metadatos bibliográficos; no se consultó el texto completo ni se validaron de forma independiente los resultados, el software o la eficacia descritos.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1145/3769011", "source_quote": "For undefined requests, GraphRAG retrieval selects relevant protocol knowledge from knowledge graphs and integrates it with FSM-derived contextual information, enabling the Large Language Model (LLM) to generate coherent and deception-resilient responses.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "8d7e77d0e2abd9f91f43b97a9dffd302b32dec65d44c2f6d0f7dd6fdfb9a8800", "source_title": "SAGE: An Adaptive IoT Honeypot with FSM-Driven Protocol Emulation and GraphRAG-Powered Response Generation", "tags": [], "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1145-3769011", "kind": "paper", "name": "SAGE: An Adaptive IoT Honeypot with FSM-Driven Protocol Emulation and GraphRAG-Powered Response Generation", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1145-3769011", "source_url": "https://doi.org/10.1145/3769011", "status": "published", "summary_en": "The article presents SAGE, an adaptive Internet of Things (IoT) honeypot that combines Finite-State Machine (FSM)-driven protocol emulation with GraphRAG-enhanced retrieval to model stateful IoT protocols and generate responses using a Large Language Model (LLM). The authors also describe a fact-checking engine and a feedback mechanism intended to refine responses and progressively expand state-response mappings based on observed adversarial interactions.", "summary_es": "El artículo presenta SAGE, un honeypot adaptativo para ecosistemas de Internet de las Cosas (IoT) que combina emulación de protocolos guiada por máquinas de estados finitos (FSM) con recuperación aumentada mediante GraphRAG, para modelar protocolos IoT con estado y generar respuestas mediante un modelo de lenguaje grande (LLM). Los autores describen además un motor de verificación de hechos y un mecanismo de retroalimentación destinados a refinar las respuestas y ampliar progresivamente las correspondencias estado-respuesta a partir de las interacciones observadas con adversarios.", "updated_at": "2026-10-13", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Charles Lim", "Kevin Hobert"], "doi": "10.1145/3820169", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "3370288d1979bf50bfe0ebb002fe7cb65078b6ec8cc377a0a37a16de00293033", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Digital Threats: Research and Practice", "limitations_en": "Review based solely on the Crossref deposited abstract; the full text was not read, results were not replicated, and the method's effectiveness was not independently validated.", "limitations_es": "Evaluación basada únicamente en el resumen depositado en Crossref; no se revisó el texto completo, no se replicaron los resultados ni se validó de forma independiente la eficacia del método.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1145/3820169", "source_quote": "To capture true operational semantics, this paper presents a novel behavior-driven profiling framework based on empirical data collected from SSH honeypot deployments.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_quote_normalization": "longest-contiguous-substring-from-frozen-source", "source_sha256": "63d42b1eabdaa72c2e60dc02336dc956d21a5045351a786d6a04c36507b12e7e", "source_title": "Enhancing Honeypot-based Cyber Attribution using Hierarchical Clustering", "tags": [], "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1145-3820169", "kind": "paper", "name": "Enhancing Honeypot-based Cyber Attribution using Hierarchical Clustering", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1145-3820169", "source_url": "https://doi.org/10.1145/3820169", "status": "published", "summary_en": "This paper presents a behavior-driven attacker profiling framework built from empirical data collected in SSH honeypot deployments. The methodology parses complex command chains to identify behavioral patterns, organize them into hierarchical clusters, and map them to the MITRE ATT&CK framework for structured threat interpretation.", "summary_es": "Este trabajo presenta un marco de perfilado de atacantes basado en su comportamiento, construido a partir de datos empíricos recogidos en despliegues de honeypots SSH. El método analiza cadenas de comandos para identificar patrones de conducta, agruparlos jerárquicamente y mapearlos al marco MITRE ATT&CK con el fin de atribuir y analizar amenazas.", "updated_at": "2026-10-13", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Christian Kreibich", "Jon Crowcroft"], "doi": "10.1145/972374.972384", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "b5c8ea35b7c2138281cdfb87b3f00bb3cd5e389afb2047b7d43fe1ae0d174ba7", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "ACM SIGCOMM Computer Communication Review", "limitations_en": "Review based only on the Crossref deposited abstract, not on the full text or independent validation of results.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref, no en el texto completo ni en una validación independiente de los resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1145/972374.972384", "source_quote": "Our system applies pattern-matching techniques and protocol conformance checks on multiple levels in the protocol hierarchy to network traffic captured a honeypot system.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "df8c8f4b6b6c562754c499da3d19f79581544d80e4216c119ca4d710a66666ce", "source_title": "Honeycomb", "tags": [], "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1145-972374-972384", "kind": "paper", "name": "Honeycomb", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1145-972374-972384", "source_url": "https://doi.org/10.1145/972374.972384", "status": "published", "summary_en": "The paper describes a system for generating attack signatures for network intrusion detection systems, applying pattern-matching techniques and protocol conformance checks at multiple levels of the protocol hierarchy to network traffic captured at a honeypot system. The authors report results from running the system for 24 hours on an unprotected cable modem connection, where it created precise traffic signatures.", "summary_es": "El trabajo describe un sistema que genera firmas de ataque para sistemas de detección de intrusiones en red, aplicando técnicas de coincidencia de patrones y comprobaciones de conformidad de protocolo en varios niveles de la jerarquía de protocolos sobre tráfico de red capturado en un sistema honeypot. Los autores presentan resultados de ejecutar el sistema durante 24 horas en una conexión de módem de cable sin protección, donde generó firmas de tráfico precisas.", "updated_at": "2026-10-13", "year": 2004}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Frank Yeong-Sung Lin", "Yu-Shun Wang", "Ming-Yang Huang"], "doi": "10.1155/2013/518213", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "b5c8ea35b7c2138281cdfb87b3f00bb3cd5e389afb2047b7d43fe1ae0d174ba7", "environments": ["Network", "Cloud"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Journal of Applied Mathematics", "limitations_en": "Assessment based only on the Crossref-deposited abstract; the full text was not consulted and results were not independently verified.", "limitations_es": "Evaluación basada únicamente en el resumen depositado en Crossref; no se consultó el texto completo ni se verificaron de forma independiente los resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1155/2013/518213", "source_quote": "the attack-defense scenario is formulated as a mathematical model where the defender applies both proactive and reactive defense mechanisms against attackers with different attack strategies", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "6c02e090f7c7baedbf2564732b606d20ba49b9f3828087573136115eff75959f", "source_title": "Effective Proactive and Reactive Defense Strategies against Malicious Attacks in a Virtualized Honeynet", "tags": [], "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1155-2013-518213", "kind": "paper", "name": "Effective Proactive and Reactive Defense Strategies against Malicious Attacks in a Virtualized Honeynet", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1155-2013-518213", "source_url": "https://doi.org/10.1155/2013/518213", "status": "published", "summary_en": "The paper formulates an attack-defense scenario as a mathematical model in which the defender applies both proactive and reactive defense mechanisms against attackers with different attack strategies, assuming attackers have incomplete information and imperfect knowledge of the target network. The authors report that, based on their experiment results, a proactive defense strategy is suitable against aggressive attackers under \"winner takes all\" circumstances, while a reactive strategy works better against less aggressive attackers under \"fight to win or die\" circumstances.", "summary_es": "El artículo formula un escenario de ataque-defensa como un modelo matemático en el que el defensor aplica mecanismos de defensa proactivos y reactivos contra atacantes con distintas estrategias, suponiendo que los atacantes tienen información incompleta y conocimiento imperfecto de la red objetivo. Los autores informan que, según sus resultados experimentales, una estrategia proactiva resulta adecuada frente a atacantes agresivos bajo circunstancias de \"winner takes all\", mientras que una estrategia reactiva funciona mejor contra atacantes menos agresivos bajo circunstancias de \"fight to win or die\".", "updated_at": "2026-10-13", "year": 2013}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Dileep Basam", "J. Scot Ransbottom", "Randy Marchany", "Joseph G. Tront"], "doi": "10.1155/2016/5212314", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "b5c8ea35b7c2138281cdfb87b3f00bb3cd5e389afb2047b7d43fe1ae0d174ba7", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Journal of Electrical and Computer Engineering", "limitations_en": "Review limited to the Crossref deposited abstract; the full text was not consulted and the results, software, or effectiveness of the solution were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se consultó el texto completo ni se validaron de forma independiente los resultados, el software o la eficacia de la solución.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1155/2016/5212314", "source_quote": "demonstrates the ability to deploy a honeypot on a virtual LXC (Linux Container) on-demand based on any interesting traffic pattern observed on a discarded address", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "a0d69437ed6f2a0c24a60099e1fc588abd0318772147d1a8d14e99d85a20b98d", "source_title": "Strengthening MT6D Defenses with LXC-Based Honeypot Capabilities", "tags": [], "techniques": ["Honeypot", "Moving target defense"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1155-2016-5212314", "kind": "paper", "name": "Strengthening MT6D Defenses with LXC-Based Honeypot Capabilities", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1155-2016-5212314", "source_url": "https://doi.org/10.1155/2016/5212314", "status": "published", "summary_en": "The paper presents an architecture that extends a previous system for tracking IPv6 addresses discarded by MT6D nodes, adding automation and database integration. According to the authors, the solution can deploy a honeypot on demand in an LXC container based on traffic patterns observed on a discarded address, and it lets an MT6D host query the solution database for activity on its relinquished addresses as a JSON object in order to adjust MT6D scheme parameters; the authors report a proof-of-concept and an analysis of feasibility and scalability.", "summary_es": "El artículo presenta una arquitectura que amplía un sistema previo de seguimiento de las direcciones IPv6 descartadas por nodos MT6D, añadiendo automatización e integración con base de datos. Según los autores, la solución puede desplegar bajo demanda un honeypot en un contenedor LXC a partir de patrones de tráfico observados en una dirección descartada, y permite que un host MT6D consulte la base de datos sobre la actividad de sus direcciones cedidas como objeto JSON para ajustar los parámetros del esquema MT6D; los autores informan de un proof-of-concept y de un análisis de viabilidad y escalabilidad.", "updated_at": "2026-10-13", "year": 2016}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Cheng Huang", "Jiaxuan Han", "Xing Zhang", "Jiayong Liu"], "doi": "10.1155/2019/2627608", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "b5c8ea35b7c2138281cdfb87b3f00bb3cd5e389afb2047b7d43fe1ae0d174ba7", "environments": ["Network", "Application"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Security and Communication Networks", "limitations_en": "Review limited to the Crossref-deposited abstract; full text was not read and results were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se consultó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1155/2019/2627608", "source_quote": "the paper proposed a new automatic identification model based on random forest algorithm with three group features: application-layer feature, network-layer feature, and other system-layer feature.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "f65a51bcf23530d7a24e20fc9cd06f2c241b5de5fa5c8533f67b1ac99e690451", "source_title": "Automatic Identification of Honeypot Server Using Machine Learning Techniques", "tags": [], "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1155-2019-2627608", "kind": "paper", "name": "Automatic Identification of Honeypot Server Using Machine Learning Techniques", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1155-2019-2627608", "source_url": "https://doi.org/10.1155/2019/2627608", "status": "published", "summary_en": "The authors propose an automatic identification model based on a random forest algorithm with three feature groups—application-layer, network-layer, and other system-layer features—to remotely check whether a server runs a honeypot service. The experiment datasets were collected from public known platforms, and the authors report that the model achieved an AUC value of 0.93.", "summary_es": "Los autores proponen un modelo de identificación automática basado en el algoritmo de bosque aleatorio, con tres grupos de características (de capa de aplicación, de capa de red y del sistema), para comprobar de forma remota si un servidor ejecuta un servicio de honeypot. Los conjuntos de datos del experimento se recopilan de plataformas públicas conocidas y, según los autores, el modelo alcanzó un valor AUC de 0,93.", "updated_at": "2026-10-13", "year": 2019}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Yongjin Hu", "Han Zhang", "Yuanbo Guo", "Tao Li", "Jun Ma"], "doi": "10.1155/2020/8850356", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "b5c8ea35b7c2138281cdfb87b3f00bb3cd5e389afb2047b7d43fe1ae0d174ba7", "environments": ["IoT"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Wireless Communications and Mobile Computing", "limitations_en": "Review based only on the publisher-deposited abstract; the full text was not examined and results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado por el editor; no se verificó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1155/2020/8850356", "source_quote": "In our work, the signaling game model is extended to a novel two-way signaling game model to describe the game from the perspectives of both the defender and the attacker.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "de5fe045fdaaa894908a99847310a91890cdc75fbf5e6924b714b5755e3ce122", "source_title": "A Novel Attack-and-Defense Signaling Game for Optimal Deceptive Defense Strategy Choice", "tags": [], "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1155-2020-8850356", "kind": "paper", "name": "A Novel Attack-and-Defense Signaling Game for Optimal Deceptive Defense Strategy Choice", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1155-2020-8850356", "source_url": "https://doi.org/10.1155/2020/8850356", "status": "published", "summary_en": "The authors extend the signaling game model into a two-way signaling game that represents the confrontation between defender and attacker, formally define the model, and propose an algorithm for identifying the refined Bayesian equilibrium. Based on calculated benefits, they analyze strategy choice and conduct a simulation to evaluate the model, with the aim of examining the use of deception-based defenses such as honeypots to improve IoT network security.", "summary_es": "Los autores extienden el modelo de juego de señalización a un modelo bidireccional que representa la confrontación entre defensor y atacante, definen formalmente el modelo y proponen un algoritmo para identificar el equilibrio bayesiano refinado. A partir de los beneficios calculados, analizan la elección de estrategias y realizan una simulación para evaluar el modelo, con el objetivo de examinar el uso de defensas con engaño, como los honeypots, para mejorar la seguridad en redes IoT.", "updated_at": "2026-10-13", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Nadiya El Kamel", "Mohamed Eddabbah", "Youssef Lmoumen", "Raja Touahni"], "doi": "10.1155/2020/8865474", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "b5c8ea35b7c2138281cdfb87b3f00bb3cd5e389afb2047b7d43fe1ae0d174ba7", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Security and Communication Networks", "limitations_en": "This review is limited to the Crossref-deposited abstract; the full text was not accessed, and the proposed agent's results and effectiveness were not independently evaluated.", "limitations_es": "La revisión se limita al resumen depositado en Crossref; no se accedió al texto completo y no se evaluaron de forma independiente los resultados ni la eficacia del agente propuesto.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1155/2020/8865474", "source_quote": "we design a smart agent for cyber-attack prevention and prediction", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "81c319c0b46f88a20dee6b071fbd098cf3b18e19c8a7f754afb4d1bc8a783c0a", "source_title": "A Smart Agent Design for Cyber Security Based on Honeypot and Machine Learning", "tags": [], "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1155-2020-8865474", "kind": "paper", "name": "A Smart Agent Design for Cyber Security Based on Honeypot and Machine Learning", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1155-2020-8865474", "source_url": "https://doi.org/10.1155/2020/8865474", "status": "published", "summary_en": "The paper describes how configuration shortcomings and limited security awareness expose connected hosts, and presents an introduction to honeypot systems and machine learning. Drawing on these technologies, the authors design a smart agent aimed at cyber-attack prevention and prediction.", "summary_es": "El artículo describe cómo las deficiencias de configuración y la falta de conciencia de seguridad exponen a los hosts conectados, y presenta una introducción a los sistemas de honeypot y al aprendizaje automático. A partir de estas tecnologías, los autores diseñan un agente inteligente orientado a la prevención y predicción de ciberataques.", "updated_at": "2026-10-13", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Yazhuo Gao", "Guomin Zhang", "Changyou Xing"], "doi": "10.1155/2021/6378218", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "b5c8ea35b7c2138281cdfb87b3f00bb3cd5e389afb2047b7d43fe1ae0d174ba7", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Security and Communication Networks", "limitations_en": "Assessment based solely on the Crossref-deposited abstract; full text, replication of results and validity of reported figures were not verified.", "limitations_es": "Evaluación basada únicamente en el resumen depositado en Crossref; no se verificó el texto completo, la replicación de resultados ni la validez de las cifras reportadas.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1155/2021/6378218", "source_quote": "we propose a multiphase dynamic deployment mechanism of virtualized honeypots (MD2VH) based on the intelligent attack path prediction method", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "993f5d7a2e119dc99db68dbe7c2d5a3cd803bfab6023e4a819bfa130e4189b7a", "source_title": "A Multiphase Dynamic Deployment Mechanism of Virtualized Honeypots Based on Intelligent Attack Path Prediction", "tags": [], "techniques": ["Honeypot", "Moving target defense"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1155-2021-6378218", "kind": "paper", "name": "A Multiphase Dynamic Deployment Mechanism of Virtualized Honeypots Based on Intelligent Attack Path Prediction", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1155-2021-6378218", "source_url": "https://doi.org/10.1155/2021/6378218", "status": "published", "summary_en": "The authors propose a multiphase dynamic deployment mechanism for virtualized honeypots (MD2VH) based on intelligent attack path prediction, modeling attack and defense characteristics with a Bayesian state attack graph and a multiphase deployment optimization model based on an extended Markov decision process, and generating deployment strategies by combining online and offline reinforcement learning. They implement a prototype system on software-defined networking and virtualization containers and report experiments on capture rate under simple and complex topologies.", "summary_es": "Los autores proponen un mecanismo de despliegue dinámico multifase de honeypots virtualizados (MD2VH) basado en predicción inteligente de rutas de ataque, que modela las características de ataque y defensa mediante un grafo de estados de ataque bayesiano y un modelo de optimización de despliegue basado en un proceso de decisión de Markov extendido, generando estrategias de despliegue mediante aprendizaje por refuerzo en línea y fuera de línea. Implementan un sistema prototipo sobre red definida por software y contenedores de virtualización y reportan experimentos sobre la tasa de captura en topologías simples y complejas.", "updated_at": "2026-10-13", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Tahir Alyas", "Khalid Alissa", "Mohammed Alqahtani", "Tauqeer Faiz", "Suleiman Ali Alsaif", "Nadia Tabassum", "Hafiz Hasan Naqvi"], "doi": "10.1155/2022/2600712", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "61261e8e744c75b3cea2834f3dc7cffa49f4588e50d3d369857fac5985524cb9", "environments": ["Cloud", "Network", "IoT"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Mobile Information Systems", "limitations_en": "Assessment based only on the Crossref deposited abstract, not on the full text or independent validation of results.", "limitations_es": "Evaluación basada únicamente en el resumen depositado en Crossref, no en el texto completo ni en una validación independiente de los resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1155/2022/2600712", "source_quote": "The purpose is to gain more time to analyze the attack and mitigate the intrusion without compromises.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "c895a6348e485686813362d1d4fd9b72c54391f03f3d8be6b43bc45af006b990", "source_title": "Multi-Cloud Integration Security Framework Using Honeypots", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1155-2022-2600712", "kind": "paper", "name": "Multi-Cloud Integration Security Framework Using Honeypots", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1155-2022-2600712", "source_url": "https://doi.org/10.1155/2022/2600712", "status": "published", "summary_en": "The paper describes a security framework for multi-cloud environments aimed at diverting an attacker and gaining time to analyze and mitigate intrusions. The proposed mechanism consists of modules for managing the multi-cloud platform, an intrusion detection and prevention system, and honeypots, with detection results compared in a two-phase scenario.", "summary_es": "El artículo describe un marco de seguridad para entornos multi-nube orientado a desviar la atención del atacante y ganar tiempo para analizar y mitigar intrusiones. El mecanismo propuesto se compone de módulos para gestionar la plataforma multi-nube, un sistema de detección y prevención de intrusiones y honeypots, con resultados de detección comparados en un escenario de dos fases.", "updated_at": "2026-10-13", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Chungang Gao", "Yongjie Wang", "Xinli Xiong"], "doi": "10.1155/2022/3949292", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "61261e8e744c75b3cea2834f3dc7cffa49f4588e50d3d369857fac5985524cb9", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Security and Communication Networks", "limitations_en": "Review based only on the Crossref member-deposited abstract; the full text was not consulted and results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref por el editor; no se consultó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1155/2022/3949292", "source_quote": "we propose a moving target defense (MTD) enhanced cyber deception defense mechanism", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "ef0c6ffc8c258975de48c7abd3c4c56d1603b31d8074a1a5d009dbad035e4384", "source_title": "A Cyber Deception Defense Method Based on Signal Game to Deal with Network Intrusion", "tags": [], "techniques": ["Moving target defense", "Decoy"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1155-2022-3949292", "kind": "paper", "name": "A Cyber Deception Defense Method Based on Signal Game to Deal with Network Intrusion", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1155-2022-3949292", "source_url": "https://doi.org/10.1155/2022/3949292", "status": "published", "summary_en": "The authors propose a cyber deception defense method based on a signal game, aimed at dealing with network intrusions. The work describes a moving target defense (MTD) enhanced deception mechanism and a signal game model with an equilibrium solution method to guide defense strategy selection, evaluated by the authors through experimental results.", "summary_es": "Los autores proponen un método de defensa mediante engaño cibernético basado en un juego de señales, con el objetivo de hacer frente a intrusiones en la red. El trabajo describe un mecanismo de engaño reforzado con defensa de objetivo móvil (MTD) y un modelo de juego de señales con una solución de equilibrio para guiar la selección de la estrategia de defensa, evaluado según los autores mediante resultados experimentales.", "updated_at": "2026-10-13", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Murat Odemis", "Cagatay Yucel", "Ahmet Koltuksuz"], "doi": "10.1155/2022/7620125", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "61261e8e744c75b3cea2834f3dc7cffa49f4588e50d3d369857fac5985524cb9", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Security and Communication Networks", "limitations_en": "Review limited to the bibliographic metadata deposited in Crossref and the deposited abstract; the full text was not examined and the described results were not independently validated.", "limitations_es": "Revisión limitada al metadato bibliográfico depositado en Crossref y al resumen depositado; no se examinó el texto completo ni se validaron de forma independiente los resultados descritos.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1155/2022/7620125", "source_quote": "Our Honeypsy system is composed of a Big-5 personality test, a cyber expertise test, and a capture-the-flag (CTF) event to collect logs with honeypot applied in this sequence.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "2e9416c7750e1f03a724ca21c69c6a2dc22c991269f2cb4ee5701747cd61bad7", "source_title": "Detecting User Behavior in Cyber Threat Intelligence: Development of Honeypsy System", "tags": [], "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1155-2022-7620125", "kind": "paper", "name": "Detecting User Behavior in Cyber Threat Intelligence: Development of Honeypsy System", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1155-2022-7620125", "source_url": "https://doi.org/10.1155/2022/7620125", "status": "published", "summary_en": "The paper describes an experiment design in which a hacker infiltrates a server and escalates privileges, and presents the Honeypsy system to correlate the hacker's recorded actions with experience, personality, and psychology. The system combines a Big-5 personality test, a cyber expertise test, and a capture-the-flag (CTF) event with a deployed honeypot to collect activity logs, with the stated aim of predicting the expertise and personality of unknown hackers and supporting the development of defense strategies.", "summary_es": "El artículo describe el diseño de un experimento en el que un atacante accede a un servidor y eleva privilegios, y presenta el sistema Honeypsy para correlacionar las acciones registradas del atacante con su experiencia, personalidad y psicología. El sistema combina una prueba de personalidad Big-5, una prueba de experiencia en ciberseguridad y un evento capture-the-flag (CTF) con un honeypot desplegado para recopilar registros de actividad, con el objetivo declarado de predecir la experiencia y la personalidad de atacantes desconocidos y apoyar la definición de estrategias de defensa.", "updated_at": "2026-10-13", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Yasser A. Yasser", "Ahmed T. Sadiq", "Wasim AlHamdani"], "doi": "10.1155/2022/9607550", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "61261e8e744c75b3cea2834f3dc7cffa49f4588e50d3d369857fac5985524cb9", "environments": ["Identity"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Advances in Human-Computer Interaction", "limitations_en": "Review based solely on the Crossref-deposited abstract; the full text was not read and the experimental results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se leyó el texto completo ni se verificaron de forma independiente los resultados experimentales.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1155/2022/9607550", "source_quote": "If the attacker signs in using a honeyword, a silent alarm trigger shows that the honeyword system might be compromised.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "6efa97b2b230da22d19d765b504216cb31c880b299d393189695bf8ec8a54326", "source_title": "A Proposed Harmony Search Algorithm for Honeyword Generation", "tags": [], "techniques": ["Honeytoken"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1155-2022-9607550", "kind": "paper", "name": "A Proposed Harmony Search Algorithm for Honeyword Generation", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1155-2022-9607550", "source_url": "https://doi.org/10.1155/2022/9607550", "status": "published", "summary_en": "The paper proposes using the harmony search algorithm (HSA), a music-inspired metaheuristic, to generate honeywords (false passwords that accompany the true password) within a password-cracking detection system. The authors review prior honeyword generation techniques, present their method, and compare experimental results with earlier approaches.", "summary_es": "El artículo propone emplear el algoritmo de búsqueda de armonía (HSA), un algoritmo metaheurístico inspirado en la música, para generar honeywords (contraseñas falsas que acompañan a la contraseña verdadera) dentro de un sistema de detección de descifrado de contraseñas. Los autores describen técnicas previas de generación de honeywords, presentan su método y comparan los resultados experimentales con enfoques anteriores.", "updated_at": "2026-10-13", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Weizhen He", "Jinglei Tan", "Yunfei Guo", "Ke Shang", "Guanhua Kong"], "doi": "10.1155/2023/5560416", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "61261e8e744c75b3cea2834f3dc7cffa49f4588e50d3d369857fac5985524cb9", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "International Journal of Intelligent Systems", "limitations_en": "This review is based only on the Crossref deposited abstract; the full text was not examined and results were not independently validated. Effectiveness and advantages mentioned are as attributed by the authors.", "limitations_es": "Esta revisión se basa únicamente en el resumen depositado en Crossref; no se examinó el texto completo ni se validaron de forma independiente los resultados. La eficacia y las ventajas mencionadas son atribuidas por los autores.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1155/2023/5560416", "source_quote": "we propose a concept of moving deception attack surface and analyze the characteristics of deception attack and defense interaction behaviors based on the Flipit game model", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "d7ff3d7a465e68de2034d86e70524d7a0bfae800718fe2c544d92f062e316430", "source_title": "Flipit Game Deception Strategy Selection Method Based on Deep Reinforcement Learning", "tags": [], "techniques": ["Decoy", "Moving target defense"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1155-2023-5560416", "kind": "paper", "name": "Flipit Game Deception Strategy Selection Method Based on Deep Reinforcement Learning", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-1155-2023-5560416", "source_url": "https://doi.org/10.1155/2023/5560416", "status": "published", "summary_en": "The authors present a method for selecting cyber deception strategies using a multi-stage Flipit game, aiming to account for defense timing alongside spatial strategy selection. The approach constructs a spatiotemporal decision-making model, introduces a discount factor and transition probabilities, and applies a Proximal Policy Optimization algorithm to compute defender strategies.", "summary_es": "Los autores proponen un método para seleccionar estrategias de engaño en ciberseguridad mediante un modelo de juego Flipit multi-etapa, con el fin de incorporar la temporización de la defensa además de la elección espacial de estrategias. El método construye un modelo de decisión espaciotemporal, introduce un factor de descuento y probabilidades de transición, y emplea un algoritmo de optimización de políticas proximales para calcular estrategias defensivas.", "updated_at": "2026-10-13", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Marlon A. Naagas", "Anazel P. Gamilla", "Mary Camille D. Rabang"], "doi": "10.11591/eei.v15i3.11299", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "61261e8e744c75b3cea2834f3dc7cffa49f4588e50d3d369857fac5985524cb9", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "Bulletin of Electrical Engineering and Informatics", "limitations_en": "Review based only on the title and abstract deposited in Crossref; the full text was not consulted and results were not independently validated.", "limitations_es": "Revisión basada únicamente en el título y el resumen depositados en Crossref; no se consultó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.11591/eei.v15i3.11299", "source_quote": "The proposed model incorporates decoy resources managed through a centralized deception mechanism to mislead attackers", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "e0931258db9a910f09fc22eecc741252c746d9d476c880beb5d489761e97c03e", "source_title": "Leveraging defense-in-depth through a deception-driven security model for smart university", "tags": [], "techniques": ["Decoy", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-11591-eei-v15i3-11299", "kind": "paper", "name": "Leveraging defense-in-depth through a deception-driven security model for smart university", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-11591-eei-v15i3-11299", "source_url": "https://doi.org/10.11591/eei.v15i3.11299", "status": "published", "summary_en": "The study implements a deception-driven security model (D-DSM) for a campus network environment, with decoy resources managed through a centralized deception mechanism. It aims to divert malicious activity away from critical assets, provide indicators of attack behavior, and complement existing defense-in-depth controls by improving visibility of advanced and lateral attacks while helping reduce false alerts.", "summary_es": "El estudio implementa un modelo de seguridad basado en engaño (D-DSM) para un entorno de red de campus, con recursos señuelo gestionados mediante un mecanismo centralizado de engaño. El objetivo es desviar las actividades maliciosas de los activos críticos, ofrecer indicadores del comportamiento de ataque y complementar los controles de defensa en profundidad existentes mejorando la visibilidad de ataques avanzados y laterales y ayudando a reducir las alertas falsas.", "updated_at": "2026-10-13", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Fauzi Dwi Setiawan Sumadi", "Christian Sri Kusuma Aditya", "Ahmad Akbar Maulana", "Syaifuddin Syaifuddin", "Vera Suryani"], "doi": "10.11591/ijai.v11.i3.pp1094-1100", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report_sha256": "61261e8e744c75b3cea2834f3dc7cffa49f4588e50d3d369857fac5985524cb9", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.1-and-declared-families", "journal": "IAES International Journal of Artificial Intelligence (IJ-AI)", "limitations_en": "Review limited to the Crossref-deposited abstract; full text was not accessed and results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se accedió al texto completo ni se verificaron de forma independiente los resultados.", "publication_basis": "source-reviewed-deposited-batch-2026-10-13", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.11591/ijai.v11.i3.pp1094-1100", "source_quote": "This paper proposed an integration method between the honeypot sensor and software defined network (SDN) (SD-honeypot network).", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "b0a5188cc2bf793a609688d2f3f152fb7594f70bd03d49e9b4eb926ea4bdb39b", "source_title": "Semi-supervised approach for detecting distributed denial of service in SD-honeypot network environment", "tags": [], "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-11591-ijai-v11-i3-pp1094-1100", "kind": "paper", "name": "Semi-supervised approach for detecting distributed denial of service in SD-honeypot network environment", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-11591-ijai-v11-i3-pp1094-1100", "source_url": "https://doi.org/10.11591/ijai.v11.i3.pp1094-1100", "status": "published", "summary_en": "The work proposes integrating a honeypot sensor with a software-defined network (SDN) and classifying distributed denial-of-service attacks via semi-supervised learning, combining a pseudo-labelling model based on a support vector machine with subsequent classification using Adaptive Boosting. The evaluation reported by the authors uses monitoring data from the Suricata sensor and examines accuracy, precision, recall, CPU usage, and flow-rule mitigation times.", "summary_es": "El trabajo propone integrar un sensor honeypot con una red definida por software (SDN) y clasificar ataques de denegación de servicio distribuido mediante aprendizaje semisupervisado, combinando un modelo de pseudo-etiquetado basado en máquinas de vectores de soporte con una clasificación posterior mediante Adaptive Boosting. La evaluación reportada por los autores usa datos de monitorización del sensor Suricata y examina exactitud, precisión, exhaustividad, uso de CPU y tiempos de mitigación de reglas de flujo.", "updated_at": "2026-10-13", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Mwaffaq Abualhija", "Nid’a Al-Shaf’i", "Nidal M. Turab", "Abdelrahman Hussein"], "doi": "10.11591/ijece.v13i6.pp7056-7064", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-011-2026-10-16.json", "eligibility_selection_report_sha256": "46cb65fa43b8d9df59a316b95b2ea5f5077e85a2dca4589977122e099b3ca628", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "International Journal of Electrical and Computer Engineering (IJECE)", "limitations_en": "Review limited to the title and abstract deposited in Crossref; the full text was not examined, and results, effectiveness or any implementation were not independently verified.", "limitations_es": "Revisión limitada únicamente al título y al resumen depositados en Crossref; no se examinó el texto completo ni se verificaron de forma independiente los resultados, la eficacia o una posible implementación.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.11591/ijece.v13i6.pp7056-7064", "source_quote": "This study aims to merge AI and honeypot with intrusion prevention system (IPS) to detect social engineering attacks, threaten the attacker, and restrict his session to keep users away from these manipulation tactics.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "bddb4d04910c587cea14a2930bf6e1768920e7c3d525feeb5c959c869670c7b6", "source_title": "Encountering social engineering activities with a novel honeypot mechanism", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-11591-ijece-v13i6-pp7056-7064", "kind": "paper", "name": "Encountering social engineering activities with a novel honeypot mechanism", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-11591-ijece-v13i6-pp7056-7064", "source_url": "https://doi.org/10.11591/ijece.v13i6.pp7056-7064", "status": "published", "summary_en": "The study addresses social engineering attacks, which the authors say exploit human psychology and user awareness, and proposes an automated prevention mechanism that combines honeypots with artificial intelligence and an intrusion prevention system. The stated aim is to detect such attacks, threaten the attacker and restrict his session to keep users away from these manipulation tactics.", "summary_es": "El estudio aborda los ataques de ingeniería social, que según los autores explotan la psicología y la falta de concienciación del usuario, y propone un mecanismo automatizado de prevención que combina honeypots con inteligencia artificial y un sistema de prevención de intrusiones. El objetivo declarado es detectar dichos ataques, amenazar al atacante y restringir su sesión para alejar a los usuarios de estas tácticas de manipulación.", "updated_at": "2026-10-16", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "authors": ["Oumaima El Kouari", "Saiida Lazaar", "Tarik Achoughi"], "design_en": "Conceptual IIoT architecture integrating honeypots and threat intelligence across Industry 4.0 levels.", "design_es": "Arquitectura conceptual de IIoT que integra honeypots y threat intelligence a niveles de Industria 4.0.", "doi": "10.11591/ijece.v15i1.pp1089-1098", "environments": ["OT/ICS"], "finding_en": "Describes an automated flow for collecting observations and sharing intelligence.", "finding_es": "Describe un flujo automatizado para reunir observaciones y compartir inteligencia.", "full_text_reviewed_at": "2026-09-16", "journal": "International Journal of Electrical and Computer Engineering (IJECE)", "limits_en": "Empirical validation and operational safety in a specific plant are not established.", "limits_es": "La validación empírica y la seguridad operacional de una planta concreta no quedan demostradas.", "review_basis": "full-text", "source_title": "Fortifying industrial cybersecurity: a novel industrial internet of things architecture enhanced by honeypot integration", "tags": ["DOI"], "techniques": ["Honeypot"]}, "evidence": "full-text-review", "id": "doi-10-11591-ijece-v15i1-pp1089-1098", "kind": "paper", "name": "Fortifying industrial cybersecurity: a novel industrial internet of things architecture enhanced by honeypot integration", "organization": "Oumaima El Kouari, Saiida Lazaar", "reviewed_at": "2026-09-16", "slug": "doi-10-11591-ijece-v15i1-pp1089-1098", "source_url": "https://doi.org/10.11591/ijece.v15i1.pp1089-1098", "status": "published", "summary_en": "Bibliographic record on honeypot integration in industrial IoT. The abstract and findings still require review.", "summary_es": "Registro bibliográfico sobre integración de honeypots en IIoT. El resumen y los resultados aún requieren lectura.", "updated_at": "2026-09-18", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Anazel P. Gamilla", "Thelma D. Palaoag", "Marlon A. Naagas"], "doi": "10.11591/ijeecs.v36.i3.pp1631-1639", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-011-2026-10-16.json", "eligibility_selection_report_sha256": "46cb65fa43b8d9df59a316b95b2ea5f5077e85a2dca4589977122e099b3ca628", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Indonesian Journal of Electrical Engineering and Computer Science", "limitations_en": "Review based only on the Crossref-deposited abstract; the full text was not consulted and results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se consultó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.11591/ijeecs.v36.i3.pp1631-1639", "source_quote": "The study shows that the two-layered approach effectively defends the network within the multiple layers using a combination of decoys, honeypots, and deceptive network segments.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "1c491ff0898495a1a9886a4525201084cc2799ac4348a6fe9dcb727b7364f259", "source_title": "Probing the depths: assessing the efficacy of the two-tier deception-driven security model", "techniques": ["Honeypot", "Decoy"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-11591-ijeecs-v36-i3-pp1631-1639", "kind": "paper", "name": "Probing the depths: assessing the efficacy of the two-tier deception-driven security model", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-11591-ijeecs-v36-i3-pp1631-1639", "source_url": "https://doi.org/10.11591/ijeecs.v36.i3.pp1631-1639", "status": "published", "summary_en": "The study describes a two-tier deception-driven security model intended to mislead potential attackers and protect network resources using decoys, honeypots, and deceptive network segments. The authors report on deploying and testing the model to assess its efficacy and feasibility in practice, and argue that integrating deception techniques into cybersecurity frameworks can provide a protective layer.", "summary_es": "El estudio describe un modelo de seguridad de dos capas basado en engaño, cuyo propósito es desviar a posibles atacantes y proteger recursos de red mediante señuelos, honeypots y segmentos de red engañosos. Los autores informan sobre el despliegue y las pruebas del modelo para evaluar su eficacia y viabilidad en la práctica, y sostienen que este enfoque integra técnicas de engaño en marcos de ciberseguridad como una capa de protección.", "updated_at": "2026-10-16", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Farizqi Panduardi", "Herman Yuliandoko", "Agus Priyo Utomo"], "doi": "10.11594/10.11594/ijer.02.02.04", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-011-2026-10-16.json", "eligibility_selection_report_sha256": "46cb65fa43b8d9df59a316b95b2ea5f5077e85a2dca4589977122e099b3ca628", "environments": ["Network", "Application"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Indonesian Journal of Engineering Research", "limitations_en": "Review limited to the Crossref deposited abstract; the full text was not read and neither the results nor the system's operation were independently validated.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se leyó el texto completo ni se validaron de forma independiente los resultados ni el funcionamiento del sistema.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.11594/10.11594/ijer.02.02.04", "source_quote": "This application can monitor an attack on the server by installing a honeypot tool into the server as an attack detector, then the honeypot log is used as a Rest API using Django framework with MongoDB database.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "68dafd9806cd92e9bd69d77ef0870a5585093e6a3cdc603d58dd7d93360dab4a", "source_title": "Network Security Using Honeypot and Attack Detection with Android Application", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-11594-10-11594-ijer-02-02-04", "kind": "paper", "name": "Network Security Using Honeypot and Attack Detection with Android Application", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-11594-10-11594-ijer-02-02-04", "source_url": "https://doi.org/10.11594/10.11594/ijer.02.02.04", "status": "published", "summary_en": "The authors describe installing a honeypot on a server as an attack detector, with its logs exposed through a REST API built with the Django framework and a MongoDB database, so that an Android application can show whether the server is under attack and block the attacker's IP address. The work is framed around network security and the monitoring of attacks on a resource.", "summary_es": "Los autores describen el uso de un honeypot instalado en un servidor como detector de ataques, cuyos registros se exponen mediante una API REST construida con el framework Django y una base de datos MongoDB, para que una aplicación Android permita conocer si hay un ataque en el servidor y bloquear la dirección IP del atacante. El trabajo se plantea en el contexto de la seguridad de redes y del seguimiento de ataques a un recurso.", "updated_at": "2026-10-16", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Aditya Nimmagadda", "Shideh Mehr"], "doi": "10.11648/j.ijiis.20251404.11", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-011-2026-10-16.json", "eligibility_selection_report_sha256": "46cb65fa43b8d9df59a316b95b2ea5f5077e85a2dca4589977122e099b3ca628", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "International Journal of Intelligent Information Systems", "limitations_en": "Review based solely on the Crossref-deposited abstract; the full text was not consulted and results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se ha consultado el texto completo ni verificado de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.11648/j.ijiis.20251404.11", "source_quote": "Honeypots, specifically the Cowrie honeypot, are deployed to lure attackers and collect rich behavioral data", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "546929993ffe6c0976533b7621390cc617f8935928f9e44ab195aceb70e3838d", "source_title": "AI-Powered Intrusion Detection System with Honeypot Integration", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-11648-j-ijiis-20251404-11", "kind": "paper", "name": "AI-Powered Intrusion Detection System with Honeypot Integration", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-11648-j-ijiis-20251404-11", "source_url": "https://doi.org/10.11648/j.ijiis.20251404.11", "status": "published", "summary_en": "The paper describes an intrusion detection system based on machine learning, enhanced by integrating the Cowrie honeypot to capture attacker behavioral data and thereby improve detection of indicators of compromise and attack patterns. The authors present an isolated multi-VM architecture, supervised and unsupervised models (Random Forest, Logistic Regression, Isolation Forest), a Flask API for real-time classification, and Kibana and Power BI dashboards, aiming to detect both known and unknown threats.", "summary_es": "El trabajo describe un sistema de detección de intrusiones basado en aprendizaje automático, complementado con la integración del honeypot Cowrie para capturar datos de comportamiento de atacantes y así mejorar la detección de indicadores de compromiso y patrones de ataque. Los autores presentan una arquitectura multi-VM aislada, modelos supervisados y no supervisados (Random Forest, Logistic Regression, Isolation Forest), una API en Flask para clasificación en tiempo real y cuadros de mando en Kibana y Power BI, con el propósito de detectar tanto amenazas conocidas como desconocidas.", "updated_at": "2026-10-16", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Thomas E. Dearden", "Andréanne Bergeron"], "doi": "10.1177/08944393261416786", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-011-2026-10-16.json", "eligibility_selection_report_sha256": "46cb65fa43b8d9df59a316b95b2ea5f5077e85a2dca4589977122e099b3ca628", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Social Science Computer Review", "limitations_en": "Review limited to the Crossref-deposited abstract and bibliographic metadata; the full text was not consulted and the results were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado en Crossref y a los metadatos bibliográficos; no se consultó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1177/08944393261416786", "source_quote": "We found that higher unemployment rates and lower education expenditures correlate with an increase in the mean number of breach attempts per country.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "432f5ea30253257d7d2511ae23245d94807ed15ec24fa7d6173680a45365acc5", "source_title": "International Differences in Windows Remote Desktop Hacking: An Analysis of Honeypot Data", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1177-08944393261416786", "kind": "paper", "name": "International Differences in Windows Remote Desktop Hacking: An Analysis of Honeypot Data", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-1177-08944393261416786", "source_url": "https://doi.org/10.1177/08944393261416786", "status": "published", "summary_en": "This study examines international differences in hacking attempts using honeypot data, analyzing 504,877 login attempts from 314 unique IP addresses over a 3-month period. The authors test hypotheses based on socio-economic factors — unemployment, poverty, GDP and education expenditures — and attribute to higher unemployment and lower education expenditures a correlation with more breach attempts per country, and to lower education expenditures a correlation with higher success rates of breach attempts.", "summary_es": "Este estudio analiza diferencias internacionales en intentos de hacking a partir de datos de honeypot, examinando 504.877 intentos de inicio de sesión procedentes de 314 direcciones IP únicas durante un período de 3 meses. Los autores contrastan hipótesis basadas en factores socioeconómicos —desempleo, pobreza, PIB y gasto educativo— y atribuyen al mayor desempleo y al menor gasto educativo una correlación con más intentos de brecha por país, y al menor gasto educativo una correlación con mayores tasas de éxito.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Verica Buchanan", "Ashley R. Chinzi", "Nicholas C. Day", "Lidija A. Buchanan", "Rachel Specht", "Nancy J. Cooke"], "doi": "10.1177/1071181319631132", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-011-2026-10-16.json", "eligibility_selection_report_sha256": "46cb65fa43b8d9df59a316b95b2ea5f5077e85a2dca4589977122e099b3ca628", "environments": [], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Proceedings of the Human Factors and Ergonomics Society Annual Meeting", "limitations_en": "This description is based only on the abstract deposited in Crossref metadata; it does not imply full-text reading, replication of results, or independent validation.", "limitations_es": "Esta descripción se basa únicamente en el resumen depositado en los metadatos de Crossref; no implica lectura del texto completo, replicación de resultados ni validación independiente.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1177/1071181319631132", "source_quote": "Deception was significantly higher in the divider condition.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "00448909232e278bf1b5fc4df8fb0d7a021942efa4e5f00e9286d6146400280e", "source_title": "An Abstraction of Cyber Inception: Using a Modified Version of Battleship to Study Strategies and Behavior of Deception", "techniques": []}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1177-1071181319631132", "kind": "paper", "name": "An Abstraction of Cyber Inception: Using a Modified Version of Battleship to Study Strategies and Behavior of Deception", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-1177-1071181319631132", "source_url": "https://doi.org/10.1177/1071181319631132", "status": "published", "summary_en": "The authors abstract the cyber deception task using a modified version of Battleship, played either face-to-face or with a divider, in order to study deception from the human point of view of attacker and defender. According to the deposited abstract, deception was higher in the divider condition and patterns such as blatant lies, diversion, and honeypots were observed, along with behavioral cues including variations in tone of voice, less eye contact, and lower response time.", "summary_es": "Los autores abstraen la tarea de decepción cibernética mediante una versión modificada del juego Battleship, jugada cara a cara o con un separador, con el fin de estudiar la decepción desde el punto de vista humano del atacante y defensor. Según el resumen depositado, la decepción fue mayor en la condición con separador y se observaron patrones como mentiras evidentes, distracción y honeypots, junto con señales conductuales como variaciones en el tono de voz, menor contacto visual y menor tiempo de respuesta.", "updated_at": "2026-10-16", "year": 2019}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Palvi Aggarwal", "Omkar Thakoor", "Aditya Mate", "Milind Tambe", "Edward A. Cranford", "Christian Lebiere", "Cleotilde Gonzalez"], "doi": "10.1177/1071181320641100", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-011-2026-10-16.json", "eligibility_selection_report_sha256": "46cb65fa43b8d9df59a316b95b2ea5f5077e85a2dca4589977122e099b3ca628", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Proceedings of the Human Factors and Ergonomics Society Annual Meeting", "limitations_en": "The review is limited to the Crossref-deposited abstract; the full text was not read and the results were not independently validated, and no working software implementation or validated effectiveness is implied.", "limitations_es": "La revisión se limita al resumen depositado en Crossref; no se ha leído el texto completo ni se han validado de forma independiente los resultados, y no se implica la implementación de software operativo ni una eficacia comprobada.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1177/1071181320641100", "source_quote": "we present an exploratory experiment to test the effectiveness of a masking strategy (compared to a random masking strategy) to reduce the utility of attackers", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "ade11d4cc8faebb378970d51d72ccbbf8b83052c56d3748b64156e6fc1b40933", "source_title": "An Exploratory Study of a Masking Strategy of Cyberdeception Using CyberVAN", "techniques": ["Decoy"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1177-1071181320641100", "kind": "paper", "name": "An Exploratory Study of a Masking Strategy of Cyberdeception Using CyberVAN", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-1177-1071181320641100", "source_url": "https://doi.org/10.1177/1071181320641100", "status": "published", "summary_en": "The study presents an exploratory experiment with 30 human participants acting as attackers to test a masking strategy (compared with a random masking strategy) aimed at reducing attackers' utility during network reconnaissance. The authors observed that attackers appeared more successful in launching attacks in the optimal condition, that the attackers' total score did not differ between masking strategies, and a generalized tendency to act according to certainty bias or risk aversion.", "summary_es": "El estudio realiza un experimento exploratorio con 30 participantes en rol de atacantes para probar una estrategia de enmascaramiento (frente a un enmascaramiento aleatorio) destinada a reducir la utilidad de los atacantes durante el reconocimiento de red. Los autores observaron que los atacantes parecían tener más éxito al lanzar ataques en la condición óptima, que la puntuación total no difería entre estrategias y una tendencia generalizada a actuar conforme al sesgo de certeza o aversión al riesgo.", "updated_at": "2026-10-16", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Harsh Katakwar", "Shashank Uttrani", "Palvi Aggarwal", "Varun Dutt"], "doi": "10.1177/1071181322661120", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-012-2026-10-16.json", "eligibility_selection_report_sha256": "da96ff88b88d451bf8c102cc9352fa88b61130a73b60e3cbf37fc773c6a219ce", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Proceedings of the Human Factors and Ergonomics Society Annual Meeting", "limitations_en": "Review limited to the abstract deposited in Crossref; the full text was not consulted, results were not independently validated, and no working software was evaluated.", "limitations_es": "Revisión limitada únicamente al resumen depositado en Crossref; no se consultó el texto completo, no se verificaron los resultados de forma independiente y no se evaluó software en funcionamiento.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1177/1071181322661120", "source_quote": "With an increase in the proportion of honeypots, the honeypot and no-attack actions increased dramatically.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "c36558953e88933e8338dba6e343326ceda19b618e4c486227082e9a6ff120d1", "source_title": "Influence of different honeypot proportions on adversarial decisions in a deception game", "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1177-1071181322661120", "kind": "paper", "name": "Influence of different honeypot proportions on adversarial decisions in a deception game", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-1177-1071181322661120", "source_url": "https://doi.org/10.1177/1071181322661120", "status": "published", "summary_en": "This study examines how the proportion of honeypots deployed in a network influences an adversary's decisions, using a deception game with two consecutive stages: probe and attack. Participants were randomly assigned to conditions with small, medium, or large honeypot proportions, and the authors report that as the honeypot proportion increased, honeypot-directed and no-attack actions increased dramatically.", "summary_es": "Este estudio examina cómo la proporción de honeypots desplegados en una red influye en las decisiones de un adversario, empleando un juego de engaño con dos etapas consecutivas: sondeo y ataque. Los participantes fueron asignados aleatoriamente a condiciones con proporciones pequeña, media o grande de honeypots, y los autores describen que al aumentar dicha proporción las acciones dirigidas a honeypots y de no ataque aumentaron notablemente.", "updated_at": "2026-10-16", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Shubham Sharma", "Shubham Thakur", "Megha Sharma", "Ranik Goyal", "Shashank Uttrani", "Harsh Katakwar", "Palvi Aggarwal", "Kuldeep Singh", "Varun Dutt"], "doi": "10.1177/10711813251372531", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-012-2026-10-16.json", "eligibility_selection_report_sha256": "da96ff88b88d451bf8c102cc9352fa88b61130a73b60e3cbf37fc773c6a219ce", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Proceedings of the Human Factors and Ergonomics Society Annual Meeting", "limitations_en": "Review based only on the Crossref-deposited abstract; the full text was not consulted and the results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se consultó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1177/10711813251372531", "source_quote": "We conducted a human-subject experiment with 88 computer science students who were instructed to exploit mock networks without honeypot placement information.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "1b0558964703d21109f9ed5478eee81b1ebfd22aa59efcad86dac51fefc8e61b", "source_title": "Exposing Cyberthreats: How Attack Patterns Are Shaped by Network Topologies and Honeypot Techniques", "techniques": ["Honeypot", "Decoy"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1177-10711813251372531", "kind": "paper", "name": "Exposing Cyberthreats: How Attack Patterns Are Shaped by Network Topologies and Honeypot Techniques", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-1177-10711813251372531", "source_url": "https://doi.org/10.1177/10711813251372531", "status": "published", "summary_en": "This work uses HackIT, a cybersecurity simulation tool, and a human-subject experiment with 88 computer science students to examine how attacker behavior varies across network topologies (ring vs. star) and honeypot densities (50% vs. 75%). The reported outcomes indicate that increased honeypot density maximized decoy interaction but also led to more real-system attacks in centralized (star) networks, whereas decentralized (ring) networks were more robust with fewer honeypots.", "summary_es": "Este trabajo estudia, mediante el simulador de ciberseguridad HackIT y un experimento con 88 estudiantes de informática, cómo el comportamiento de los atacantes varía según la topología de red (anillo frente a estrella) y la densidad de honeypots (50 % frente a 75 %). Los resultados indican que una mayor densidad de honeypots aumentó la interacción con señuelos, pero también los ataques a sistemas reales en redes de topología centralizada (estrella), mientras que las redes descentralizadas (anillo) resistieron mejor con menos honeypots.", "updated_at": "2026-10-16", "year": 2025}
{"critical_reading": null, "data": {"abstract_source_doi": "10.1177/1747016115583380", "access_date": "2026-10-16", "authors": ["David Dittrich"], "creator_name_aliases_inferred": false, "doi": "10.1177/1747016115583380", "doi_aliases": ["10.2139/ssrn.2184997"], "draft_review_basis": "deepseek-draft-and-independent-claude-review", "environments": ["Application"], "family_resource_count": 1, "family_scope_basis": [{"batch": 12, "candidate_id": "doi:10.1177/1747016115583380", "catalog_decision": null, "doi": "10.1177/1747016115583380", "existing_identifier_matches": [], "existing_title_matches": [], "identity_status": "deposited-title-family-review-needed", "selection_report": "data/coverage/bibliography-deposited-third-crossref-012-2026-10-16.json", "selection_report_sha256": "da96ff88b88d451bf8c102cc9352fa88b61130a73b60e3cbf37fc773c6a219ce", "source_sha256": "d4a492f61eeae41dfbecbd30640db9ddcfa36449d6f8c983f5e604cb423f875a", "title": "The ethics of social honeypots", "year": 2015}], "full_text_equality_claimed": false, "full_text_reviewed": false, "identity_report": "data/coverage/deposited-followup-family-review-2026-10-16.json", "identity_report_sha256": "d8486dc729d6c0aa6a91da335c385db7fbbce91367b6f1514f6601698918bdf8", "journal": "Research Ethics", "limitations_en": "Reading is limited to the deposited abstract and version metadata; no full text was analyzed and no results were independently validated.", "limitations_es": "La lectura se limita al resumen depositado y a los metadatos de versión; no se analizó el texto completo ni se validaron resultados de forma independiente.", "metadata_sha256": "d4a492f61eeae41dfbecbd30640db9ddcfa36449d6f8c983f5e604cb423f875a", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "source-page", "review_depth": "deposited abstract of DOI 10.1177/1747016115583380; version identity metadata; no full-text analysis", "reviewed_metadata_url": "https://api.crossref.org/works/10.1177/1747016115583380", "selection_report": "data/coverage/bibliography-deposited-third-crossref-012-2026-10-16.json", "selection_report_sha256": "da96ff88b88d451bf8c102cc9352fa88b61130a73b60e3cbf37fc773c6a219ce", "source_document_url": "https://doi.org/10.1177/1747016115583380", "source_packet_sha256": "9eedd684cf0e353f7ac79cb3ca441ee94bc717235fb60152cc2f99795233d907", "source_quote": "Should researchers have an obligation to try to find research methods that do not involve deception to achieve the same research results?", "source_quote_locator": {"abstract_source_doi": "10.1177/1747016115583380", "field": "deposited abstract (HTML normalized)"}, "source_sha256": "d4a492f61eeae41dfbecbd30640db9ddcfa36449d6f8c983f5e604cb423f875a", "source_title": "The ethics of social honeypots", "source_type": "deposited abstract of DOI 10.1177/1747016115583380; version identity metadata; no full-text analysis", "tags": [], "techniques": ["Honeypot"], "version_history": [{"creators": [{"affiliation": [{"name": "University of Washington, USA"}], "family": "Dittrich", "given": "David", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "first"}], "doi": "10.1177/1747016115583380", "issued": {"date-parts": [[2015, 5, 22]]}, "metadata_sha256": "d4a492f61eeae41dfbecbd30640db9ddcfa36449d6f8c983f5e604cb423f875a", "titles": ["The ethics of social honeypots"]}, {"creators": [{"affiliation": [], "family": "Dittrich", "given": "David", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "first"}], "doi": "10.2139/ssrn.2184997", "issued": {"date-parts": [[2012]]}, "metadata_sha256": "5793c1a31ee6142bf040efc6a3452ae4738efd12cad17da28f8b3d62921b5868", "titles": ["The Ethics of Social Honeypots"]}]}, "evidence": "primary-source-passages", "id": "doi-10-1177-1747016115583380", "kind": "paper", "name": "The ethics of social honeypots", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-1177-1747016115583380", "source_url": "https://doi.org/10.1177/1747016115583380", "status": "published", "summary_en": "This paper examines ethical issues in studying malicious activity in social networks using social honeypots combined with deception. Its purpose is to clarify how this area fits within human subjects research and whether researchers should seek deception-free methods.", "summary_es": "Este artículo examina cuestiones éticas en el estudio de actividad maliciosa en redes sociales mediante honeypots sociales combinados con engaño. Su propósito es aclarar cómo esta área encaja en la investigación con sujetos humanos y si los investigadores deberían buscar métodos sin engaño.", "updated_at": "2026-10-16", "year": 2015}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Qingwang Chen", "Yuling Liu", "Ru Tan", "Ze Jin", "Juxin Xiao", "Xiao Wang", "Fangjiao Zhang", "Qixu Liu"], "doi": "10.1186/s42400-025-00372-7", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-012-2026-10-16.json", "eligibility_selection_report_sha256": "da96ff88b88d451bf8c102cc9352fa88b61130a73b60e3cbf37fc773c6a219ce", "environments": ["Cloud", "Application"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Cybersecurity", "limitations_en": "Assessment based solely on the abstract deposited in Crossref metadata; the full text was not examined and the reported results were not independently validated.", "limitations_es": "Evaluación basada únicamente en el resumen depositado en los metadatos de Crossref; no se examinó el texto completo ni se validaron de forma independiente los resultados comunicados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1186/s42400-025-00372-7", "source_quote": "ShadowKube integrates behavioral monitoring with shadow honeypots to effectively detect and neutralize anomalous behavior.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "3520e4ea60e8ed0e373b7efe8eb8117650e22ae858790b169675b76d238bd5e3", "source_title": "Shadowkube: enhancing Kubernetes security with behavioral monitoring and honeypot integration", "techniques": ["Honeypot", "Decoy", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1186-s42400-025-00372-7", "kind": "paper", "name": "Shadowkube: enhancing Kubernetes security with behavioral monitoring and honeypot integration", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-1186-s42400-025-00372-7", "source_url": "https://doi.org/10.1186/s42400-025-00372-7", "status": "published", "summary_en": "The authors present ShadowKube, an active defense framework for Kubernetes that integrates behavioral monitoring with shadow honeypots to detect and neutralize anomalous behavior. The approach establishes behavioral baselines to identify deviations and converts compromised nodes into honeypots, with the stated purpose of isolating and trapping attackers in intrusions targeting container orchestration.", "summary_es": "Los autores presentan ShadowKube, un marco de defensa activa para Kubernetes que combina el monitoreo de comportamiento con honeypots señuelo para detectar y neutralizar conductas anómalas. El enfoque establece líneas base de comportamiento para identificar desviaciones y convierte los nodos comprometidos en honeypots, con el propósito declarado de aislar y atrapar a los atacantes en ataques dirigidos a la orquestación de contenedores.", "updated_at": "2026-10-16", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Francesco Sanna Passino", "Anastasia Mantziou", "Daniyar Ghani", "Philip Thiede", "Ross Bevington", "Nicholas A. Heard"], "doi": "10.1214/24-aoas1974", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-012-2026-10-16.json", "eligibility_selection_report_sha256": "da96ff88b88d451bf8c102cc9352fa88b61130a73b60e3cbf37fc773c6a219ce", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "The Annals of Applied Statistics", "limitations_en": "Review based only on the Crossref-deposited abstract; the full text was not read and results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se ha leído el texto completo ni se han validado de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1214/24-aoas1974", "source_quote": "This article explores Dirichlet distribution topic models for clustering terminal session commands collected from honeypots", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "15a6b8ed8d6275a3dd14b75a35442d5271c9ab18d4c5a8d54c1f8d51782cae15", "source_title": "Nested Dirichlet models for unsupervised attack pattern detection in honeypot data", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1214-24-aoas1974", "kind": "paper", "name": "Nested Dirichlet models for unsupervised attack pattern detection in honeypot data", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-1214-24-aoas1974", "source_url": "https://doi.org/10.1214/24-aoas1974", "status": "published", "summary_en": "The article explores Dirichlet distribution topic models for clustering terminal session commands collected from honeypots, aiming to find groups of attacks sharing a common intent and to identify outliers. The authors introduce primary and secondary topics, and session-level and command-level topics, and extend the methods in a Bayesian nonparametric fashion to allow unbounded vocabulary size and number of latent intents.", "summary_es": "El artículo explora modelos de tema basados en la distribución Dirichlet para agrupar los comandos de sesiones de terminal recogidos en honeypots, con el fin de encontrar grupos de ataques con intención similar y detectar valores atípicos. Los autores introducen conceptos de temas primarios y secundarios, y de temas a nivel de sesión y de comando, y extienden los métodos de forma bayesiana no paramétrica para permitir vocabulario y número de intenciones latentes sin límite.", "updated_at": "2026-10-16", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Βασίλειος Παπασπύρου"], "doi": "10.12681/eadd/62642", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-012-2026-10-16.json", "eligibility_selection_report_sha256": "da96ff88b88d451bf8c102cc9352fa88b61130a73b60e3cbf37fc773c6a219ce", "environments": ["Identity", "Application"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "", "limitations_en": "Assessment based solely on the Crossref-deposited abstract; full text was not reviewed and results were not independently verified.", "limitations_es": "Evaluación basada únicamente en el resumen depositado en Crossref; no se revisó el texto completo ni se verificaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.12681/eadd/62642", "source_quote": "Η δεύτερη επεκτείνει αυτή την έννοια εισάγοντας τον μηχανισμό Two-Factor Honeytoken Authentication (2FHA), ο οποίος συνδυάζει κωδικούς πρόσβασης μίας χρήσης (με το Google Authenticator) και honeytokens για την αύξηση της αβεβαιότητας του επιτιθέμενου, διατηρώντας παράλληλα την ευχρηστία.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "e94070f04ecbdae062a433a0f22acf22dfdfc3ee12f7524b6061998b57f0b331", "source_title": "Two factor honeytoken authentication (2FHA)", "techniques": ["Honeytoken", "Decoy", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-12681-eadd-62642", "kind": "paper", "name": "Two factor honeytoken authentication (2FHA)", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-12681-eadd-62642", "source_url": "https://doi.org/10.12681/eadd/62642", "status": "published", "summary_en": "The thesis proposes an authentication framework combining multi-factor authentication with honeytoken-based deception techniques. It describes three successive architectures: static honeytokens to improve detection of compromised credentials, the 2FHA mechanism combining one-time passwords (Google Authenticator) with honeytokens, and a final architecture with session-bound honeytokens, blockchain-supported auditing, and smart contracts on Ethereum.", "summary_es": "La tesis propone un marco de autenticación que combina autenticación de múltiples factores con técnicas de engaño basadas en honeytokens. Describe tres arquitecturas sucesivas: honeytokens estáticos para detectar credenciales comprometidas, el mecanismo 2FHA que combina contraseñas de un solo uso (Google Authenticator) con honeytokens, y una arquitectura final con honeytokens vinculados a la sesión, auditoría basada en blockchain y contratos inteligentes en Ethereum.", "updated_at": "2026-10-16", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Sudesh Pahal", "Preity Priya"], "doi": "10.12723/mjs.63.6", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-012-2026-10-16.json", "eligibility_selection_report_sha256": "da96ff88b88d451bf8c102cc9352fa88b61130a73b60e3cbf37fc773c6a219ce", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Mapana Journal of Sciences", "limitations_en": "Review based solely on the Crossref deposited abstract; the full text was not read and the data, results or described software were not independently validated.", "limitations_es": "Evaluación basada únicamente en el resumen depositado en Crossref; no se revisó el texto completo ni se verificaron de forma independiente los datos, resultados o el software descrito.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.12723/mjs.63.6", "source_quote": "The low-interaction, user-friendly honeypot created is capable of running without manual intervention, and without interfering with parallelly running processes.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "3499c5ba84027b6b2e15139b62a2a978ee3d67f708582131b508753c622984e6", "source_title": "A Comprehensive Research Study on Low-Interaction Secure Shell Honeypot", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-12723-mjs-63-6", "kind": "paper", "name": "A Comprehensive Research Study on Low-Interaction Secure Shell Honeypot", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-12723-mjs-63-6", "source_url": "https://doi.org/10.12723/mjs.63.6", "status": "published", "summary_en": "This paper describes information acquired from a Secure Shell honeypot, including plaintext login credentials and attack data. The authors present a low-interaction honeypot aimed at organizations with limited resources that records, analyzes and sends notifications about suspicious network traffic, with the stated goal of encouraging the development and adoption of practical honeypot solutions.", "summary_es": "Este trabajo describe la información obtenida de un honeypot de Secure Shell, incluidas credenciales de inicio de sesión en texto plano y datos de ataques. Los autores presentan un honeypot de baja interacción orientado a organizaciones con recursos limitados, que registra, analiza y notifica tráfico de red sospechoso, y su objetivo es fomentar el desarrollo y la adopción de soluciones de honeypot prácticas.", "updated_at": "2026-10-16", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Ann Zeki Ablahd Magdacy Jerjes"], "doi": "10.12732/ijam.v38i4s.237", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-013-2026-10-16.json", "eligibility_selection_report_sha256": "de372745ab4d9b16de6be2dd22d0792e655f3f56d39abb847a69e36c2029db3d", "environments": ["Network", "Endpoint"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "International Journal of Applied Mathematics", "limitations_en": "Review limited to the Crossref deposited abstract; the full text was not read and the results, software and system effectiveness were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se ha leído el texto completo ni se han validado de forma independiente los resultados, el software ni la eficacia del sistema.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.12732/ijam.v38i4s.237", "source_quote": "A proactive defense element is also included in the system when it is connected to a VMware virtualised environment, which is managed with the vboxapi or pyvmomi Python libraries and allows a higher degree of early threat detection as well as increased network resilience based on comprehensive attacker profiling.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "a0aa0e228a985d10dfad8bc435b1d2bc8f48eecdbba631dbdeace8540abd3822", "source_title": "HYBRID CYBER DECEPTION FRAMEWORK FOR PROACTIVE AND INTELLIGENT NETWORK", "techniques": ["Honeypot", "Honeytoken", "Decoy", "Moving target defense"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-12732-ijam-v38i4s-237", "kind": "paper", "name": "HYBRID CYBER DECEPTION FRAMEWORK FOR PROACTIVE AND INTELLIGENT NETWORK", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-12732-ijam-v38i4s-237", "source_url": "https://doi.org/10.12732/ijam.v38i4s.237", "status": "published", "summary_en": "The authors present the Hybrid Cyber Deception System (HCDS), described as a Python-developed proactive tool that combines honeypots and honeytokens in a dynamically adaptive mode to simulate realistic services and redirect attackers in controlled, instrumented settings. The system integrates a deception-driven alerts correlation engine built on Python, Pandas and Scikit-learn, along with Moving Target Defense principles for continuous modulation of network parameters and decoy distribution, and was tested in a simulated environment with Windows and Ubuntu servers to profile attackers and detect complex attack vectors.", "summary_es": "Los autores presentan el Hybrid Cyber Deception System (HCDS), descrito como una herramienta proactiva desarrollada en Python que combina honeypots y honeytokens en modalidad adaptable para simular servicios realistas y redirigir a los atacantes en entornos instrumentados. El sistema integra un motor de correlación de alertas guiado por decepción, basado en Python, Pandas y Scikit-learn, junto con principios de Moving Target Defense para modular continuamente parámetros de red y distribución de señuelos, y fue probado en un entorno simulado con servidores Windows y Ubuntu para perfilar atacantes y detectar vectores de ataque complejos.", "updated_at": "2026-10-16", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Cristian Sandescu", "Razvan Rughinis", "Octavian Grigorescu"], "doi": "10.12753/2066-026x-17-075", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-013-2026-10-16.json", "eligibility_selection_report_sha256": "de372745ab4d9b16de6be2dd22d0792e655f3f56d39abb847a69e36c2029db3d", "environments": ["Cloud"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "eLearning and Software for Education", "limitations_en": "Review based solely on the Crossref-deposited abstract; the full text was not read and results were not independently validated, and the abstract provides no details on actual implementation or effectiveness.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se leyó el texto completo ni se validaron de forma independiente los resultados, y el resumen no aporta detalles sobre implementación real ni eficacia.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.12753/2066-026x-17-075", "source_quote": "In this paper we build on existing results to quickly categorize attacks, map the attacker persona and focus on targeted attacks.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "c338c34c1a885109b0f7249a6bd1a916b4e32022c6e34d7596b61af8f27d04a3", "source_title": "HUNT : USING HONEYTOKENS TO UNDERSTAND AND INFLUENCE THE EXECUTION OF AN ATTACK", "techniques": ["Honeypot", "Honeytoken", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-12753-2066-026x-17-075", "kind": "paper", "name": "HUNT : USING HONEYTOKENS TO UNDERSTAND AND INFLUENCE THE EXECUTION OF AN ATTACK", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-12753-2066-026x-17-075", "source_url": "https://doi.org/10.12753/2066-026x-17-075", "status": "published", "summary_en": "The authors address the difficulty of distinguishing large-scale non-directional attacks from advanced persistent threats (APTs) and propose implementing honeytokens and honeypots as an intrusion detection system by deliberately placing traps within existing environments. They describe deploying a series of interconnected honeytokens, each with an exploitation difficulty level, to categorize attacks, profile the attacker and steer the execution flow into a maze-like scenario aimed at distracting, gathering forensic evidence and potentially identifying or deterring the attacker.", "summary_es": "Los autores abordan la dificultad de distinguir entre ataques masivos no dirigidos y amenazas persistentes avanzadas (APT), y proponen implementar honeytokens y honeypots como sistema de detección de intrusiones mediante trampas colocadas deliberadamente en entornos existentes. Describen el despliegue de una serie de honeytokens interconectados, con distintos grados de dificultad de explotación, para categorizar ataques, perfilar al atacante y guiar el flujo de ejecución hacia un escenario tipo 'laberinto', con el fin de distraer, recopilar evidencia forense y, potencialmente, identificar o disuadir al atacante.", "updated_at": "2026-10-16", "year": 2017}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Ionutdaniel Barbu", "Gabriel Petrica", "Sabinadaniela Axinte", "Ioan Bacivarov"], "doi": "10.12753/2066-026x-17-226", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-013-2026-10-16.json", "eligibility_selection_report_sha256": "de372745ab4d9b16de6be2dd22d0792e655f3f56d39abb847a69e36c2029db3d", "environments": ["Cloud", "Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "eLearning and Software for Education", "limitations_en": "Assessment based only on the Crossref deposited abstract, not on the full text or independent validation of results.", "limitations_es": "Evaluación basada únicamente en el resumen depositado en Crossref, no en el texto completo ni en una validación independiente de los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.12753/2066-026x-17-226", "source_quote": "the tools used among the experiment were open-source or free for educational purposes", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "184ef6eb2f131aa080f609f442c47f935f8f0a5b5c9f45dba4a482f1c8de9c63", "source_title": "ANALYZING CYBER THREAT ACTORS OF E-LEARNING PLATFORMS BY THE USE OF A HONEYNET CLOUD BASED INFRASTRUCTURE", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-12753-2066-026x-17-226", "kind": "paper", "name": "ANALYZING CYBER THREAT ACTORS OF E-LEARNING PLATFORMS BY THE USE OF A HONEYNET CLOUD BASED INFRASTRUCTURE", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-12753-2066-026x-17-226", "source_url": "https://doi.org/10.12753/2066-026x-17-226", "status": "published", "summary_en": "The authors describe deploying a honeynet of low-interaction and high-interaction SSH honeypots across three geographic regions of a public cloud environment in order to gather threat intelligence and obtain tailored indicators of compromise for e-learning platforms. The collected logs are analyzed through log collectors and parsers that translate the data into real-time dashboards, with the aim of understanding attackers' tactics according to time zones and geolocations and helping the education landscape prepare for emerging threats.", "summary_es": "Los autores describen el despliegue de una red de honeypots SSH de interacción baja y alta en tres regiones geográficas de un entorno de nube pública, con el propósito de recopilar inteligencia sobre amenazas y obtener indicadores de compromiso adaptados a las plataformas de e-learning. Los registros recolectados se analizan mediante servidores colectores y analizadores de registros que convierten los datos en paneles de control en tiempo real, con el fin de entender las tácticas de los atacantes según zonas horarias y ubicaciones geográficas y ayudar al sector educativo a prepararse frente a amenazas emergentes.", "updated_at": "2026-10-16", "year": 2017}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Noven Indra Prasetya", "Supeno Djanali", "Muchammad Husni"], "doi": "10.12962/j24068535.v12i2.a324", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-013-2026-10-16.json", "eligibility_selection_report_sha256": "de372745ab4d9b16de6be2dd22d0792e655f3f56d39abb847a69e36c2029db3d", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "JUTI: Jurnal Ilmiah Teknologi Informasi", "limitations_en": "Review based solely on the Crossref-deposited abstract (bibliographic metadata); the full text was not reviewed and the reported results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref (metadata bibliográfica); no se verificó el texto completo ni se validaron de forma independiente los resultados reportados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.12962/j24068535.v12i2.a324", "source_quote": "Pada penelitian ini, diajukan suatu bentuk Kolaborasi IDS dengan teknologi keamanan jaringan, yaitu dengan Honeypot.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "00a7f609709ad699ecfad0ac01aa281f90599ee42348df0835883dbe9203e5c2", "source_title": "VERIFIKASI SIGNATURE PADA KOLABORASI SISTEM DETEKSI INTRUSI JARINGAN TERSEBAR DENGAN HONEYPOT", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-12962-j24068535-v12i2-a324", "kind": "paper", "name": "VERIFIKASI SIGNATURE PADA KOLABORASI SISTEM DETEKSI INTRUSI JARINGAN TERSEBAR DENGAN HONEYPOT", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-12962-j24068535-v12i2-a324", "source_url": "https://doi.org/10.12962/j24068535.v12i2.a324", "status": "published", "summary_en": "The authors propose a collaboration between network intrusion detection systems (IDS) and honeypot technology, together with a mechanism to correct signatures based on honeypot analysis, aiming to reduce erroneous alerts and improve detection of zero-day attacks. Across fifteen evaluated attack scenarios, the authors report that this approach reduced false alerts and zero-day attacks by 85%.", "summary_es": "Los autores proponen una colaboración entre sistemas de detección de intrusos (IDS) de red y honeypot, junto con un mecanismo para corregir firmas (signatures) a partir del análisis del honeypot, con el fin de reducir alertas erróneas y mejorar la detección de ataques de día cero. En quince escenarios de ataque evaluados, los autores informan que este enfoque redujo las alertas falsas y los ataques de día cero en un 85%.", "updated_at": "2026-10-16", "year": 2014}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Eric Chambareau"], "doi": "10.12968/s1353-4858(22)70001-3", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-013-2026-10-16.json", "eligibility_selection_report_sha256": "de372745ab4d9b16de6be2dd22d0792e655f3f56d39abb847a69e36c2029db3d", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Network Security", "limitations_en": "Review based only on the abstract deposited with Crossref, not on the full text or independent result validation; no software or effectiveness evaluation was performed.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref, no en el texto completo ni en una validación independiente de resultados; no se evaluó el software ni su eficacia.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.12968/s1353-4858%2822%2970001-3", "source_quote": "One solution is a honeypot.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "8ca51adbc56aa1783f810658f7f07bea78e84aaa26d647851ff3fadfc48d3c13", "source_title": "Deceptive security to protect your business", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-12968-s1353-4858-22-70001-3", "kind": "paper", "name": "Deceptive security to protect your business", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-12968-s1353-4858-22-70001-3", "source_url": "https://doi.org/10.12968/s1353-4858(22)70001-3", "status": "published", "summary_en": "Amid information systems' growing exposure to cyber attacks, intrusion attempts and sophisticated malware, the author frames a need for organisations to better understand the actors behind threats and the methods they employ in order to improve their threat intelligence strategy. The article presents the use of a honeypot as one solution for gathering information about the specific cyberthreats an organisation faces.", "summary_es": "Ante la creciente exposición de los sistemas de información a ciberataques, intentos de intrusión y malware sofisticado, el autor plantea que las organizaciones necesitan comprender mejor a los actores de las amenazas y sus métodos para mejorar su estrategia de inteligencia de amenazas. El artículo presenta el uso de un honeypot como una solución para recopilar información sobre las ciberamenazas específicas que enfrentan las organizaciones.", "updated_at": "2026-10-16", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["A. Aswin Kumar", "Ashok Kumar Mohan", "P. P. Amritha"], "doi": "10.13052/2245-1439.7114", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-013-2026-10-16.json", "eligibility_selection_report_sha256": "de372745ab4d9b16de6be2dd22d0792e655f3f56d39abb847a69e36c2029db3d", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Journal of Cyber Security and Mobility", "limitations_en": "This entry is based solely on the abstract deposited in Crossref; the full text was not reviewed and the results were not independently validated.", "limitations_es": "Esta ficha se basa únicamente en el resumen depositado en Crossref; no se revisó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.13052/2245-1439.7114", "source_quote": "With cyber deception strategy, we can gather information about the malicious activity by placing honeypots that can act as a trap to lure the attacker.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "a6d5ca224d81a899248b2ea44dfd5f5ad201dbfa74e122bc427b302e6951d2dc", "source_title": "Deceiving Attackers in Wireless Local Area Networks Using Decoys", "techniques": ["Honeypot", "Decoy", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-13052-2245-1439-7114", "kind": "paper", "name": "Deceiving Attackers in Wireless Local Area Networks Using Decoys", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-13052-2245-1439-7114", "source_url": "https://doi.org/10.13052/2245-1439.7114", "status": "published", "summary_en": "This work proposes applying a cyber deception strategy in wireless local area networks, using decoys that are honeypots, to detect and characterize malicious activity such as the evil twin access point. The authors further describe how the same approach can be used to gather attacker activity information and to detect SSL stripping and DNS spoofing attacks.", "summary_es": "Este trabajo propone aplicar una estrategia de engaño cibernético en redes de área local inalámbricas, mediante señuelos que son honeypots, para detectar y caracterizar actividad maliciosa como el acceso point de gemelo malvado. Los autores describen además cómo la misma aproximación puede emplearse para recopilar información sobre la actividad del atacante y para detectar ataques de SSL stripping y DNS spoofing.", "updated_at": "2026-10-16", "year": 2018}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Lionel Metongnon", "Ramin Sadre"], "doi": "10.13052/2245-1439.832", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-013-2026-10-16.json", "eligibility_selection_report_sha256": "de372745ab4d9b16de6be2dd22d0792e655f3f56d39abb847a69e36c2029db3d", "environments": ["IoT", "Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Journal of Cyber Security and Mobility", "limitations_en": "Review is limited to the Crossref deposited abstract; the full text was not read and the results were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se leyó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.13052/2245-1439.832", "source_quote": "In this paper, we present a measurement study on attacks against or based on those protocols.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "6fe028ff6f819ca78a3c5c41e9b991e3095454a1a37ab589679cf8e105c319fc", "source_title": "Prevalence of IoT Protocols in Telescope and Honeypot Measurements", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-13052-2245-1439-832", "kind": "paper", "name": "Prevalence of IoT Protocols in Telescope and Honeypot Measurements", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-13052-2245-1439-832", "source_url": "https://doi.org/10.13052/2245-1439.832", "status": "published", "summary_en": "The authors describe a measurement study of attacks against or based on IoT protocols, using data obtained from a /15 network telescope and three honeypots with 15 IPv4 addresses. The study reports that telnet-based malware is still widely used, that infected devices are employed not only for DDoS attacks but also for crypto-currency mining, and that attackers look for IoT-specific services using MQTT, CoAP, UPnP, and HNAP, and target vulnerabilities of routers and cameras with HTTP.", "summary_es": "Los autores describen un estudio de medición sobre ataques dirigidos a protocolos de IoT o basados en ellos, usando datos de un telescopio de red /15 y tres honeypots con 15 direcciones IPv4. El estudio informa que el malware basado en telnet sigue siendo ampliamente utilizado, que los dispositivos infectados se emplean también para criptominería además de DDoS, y que los atacantes buscan servicios específicos de IoT mediante MQTT, CoAP, UPnP y HNAP, así como vulnerabilidades de routers y cámaras por HTTP.", "updated_at": "2026-10-16", "year": 2018}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Gustavo José Neves da Silva", "Rafael Obelheiro"], "doi": "10.14210/cotb.v11n1.p000-003", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-014-2026-10-16.json", "eligibility_selection_report_sha256": "207b4a10c263bd5dcc3ff987e4fc3fb64a55f3bb254800d6f1adabb8d9f48f97", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Anais do XI Computer on the Beach - COTB '20", "limitations_en": "Review limited to the publisher-deposited abstract in Crossref only; the full text was not consulted and the described results or software operation were not independently validated.", "limitations_es": "Revisión limitada únicamente al resumen depositado por el editor en Crossref; no se consultó el texto completo ni se validaron de forma independiente los resultados o el funcionamiento del software descrito.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.14210/cotb.v11n1.p000-003", "source_quote": "We introduce a platform for the periodic automated processing ofdata collected by honeypots.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "6bf8882e634c80f906d0a6cd4639953903fca5d60309a55f805100408ecf8e03", "source_title": "Plataforma para Análise de Dados de Honeypots no Curto Prazo", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-14210-cotb-v11n1-p000-003", "kind": "paper", "name": "Plataforma para Análise de Dados de Honeypots no Curto Prazo", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-14210-cotb-v11n1-p000-003", "source_url": "https://doi.org/10.14210/cotb.v11n1.p000-003", "status": "published", "summary_en": "The authors introduce a platform for the periodic automated processing of data collected by honeypots, generating statistics and graphs from a set of traffic capture files in PCAP format. The stated purpose is to reduce the delay in perceiving atypical occurrences and trend changes that manual processing and analysis of monitoring data introduces, with a modular design that allows the platform to be easily extended and adapted to produce different outputs.", "summary_es": "Los autores presentan una plataforma para el procesamiento automático y periódico de datos recogidos por honeypots, que genera estadísticas y gráficos a partir de un conjunto de archivos de captura de tráfico en formato PCAP. El objetivo declarado es reducir el retraso en la percepción de sucesos atípicos y cambios de tendencia que implica el procesamiento y análisis manual de los datos de monitoreo, con un diseño modular que permite extender y adaptar la plataforma para producir diferentes salidas.", "updated_at": "2026-10-16", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Shajulin Benedict"], "doi": "10.14232/actacyb.293319", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-014-2026-10-16.json", "eligibility_selection_report_sha256": "207b4a10c263bd5dcc3ff987e4fc3fb64a55f3bb254800d6f1adabb8d9f48f97", "environments": ["IoT", "Cloud"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Acta Cybernetica", "limitations_en": "Review limited to the publisher-deposited Crossref abstract; the full text was not consulted and results were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado en Crossref por el editor; no se consultó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.14232/actacyb.293319", "source_quote": "This article proposes an explainable AI-assisted permissioned blockchain framework named EA-POT for predicting potential defaulters' IP addresses.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "43d6c0b1149f1491c67f0edbaaab1311d03a146ec504e4190178d0a910e44872", "source_title": "EA-POT: An Explainable AI Assisted Blockchain Framework for HoneyPot IP Predictions", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-14232-actacyb-293319", "kind": "paper", "name": "EA-POT: An Explainable AI Assisted Blockchain Framework for HoneyPot IP Predictions", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-14232-actacyb-293319", "source_url": "https://doi.org/10.14232/actacyb.293319", "status": "published", "summary_en": "The article proposes EA-POT, an explainable AI-assisted permissioned blockchain framework for predicting potential defaulters' IP addresses, registering those IPs in a blockchain database based on explainable AI suggestions and IP authorizer approval to enhance immutability. The authors carried out experiments in an IoT Cloud research laboratory using three prediction models (Random Forest, Linear Regression, and SVM) and describe a procedure that incorporates interpretable knowledge while blacklisting IPs that reach HoneyPots.", "summary_es": "El artículo propone EA-POT, un marco de blockchain permisionada asistido por IA explicable para predecir direcciones IP de posibles infractores, registrando esas IP en una base de datos blockchain a partir de las sugerencias de la IA explicable y la aprobación de autorizadores de IP para mejorar la inmutabilidad. Los autores realizaron experimentos en un laboratorio de IoT Cloud con tres modelos de predicción (Random Forest, Regresión Lineal y SVM) y describen un procedimiento que incorpora conocimiento interpretable al incluir en listas negras las IP que alcanzan HoneyPots.", "updated_at": "2026-10-16", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Sai Sudha Gadde", "Rama Krishna Srinivas Ganta", "ASALG Gopala Gupta", "Raghava Rao K", "KRR Mohan Rao"], "doi": "10.14419/ijet.v7i2.7.11075", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-014-2026-10-16.json", "eligibility_selection_report_sha256": "207b4a10c263bd5dcc3ff987e4fc3fb64a55f3bb254800d6f1adabb8d9f48f97", "environments": ["IoT", "Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "International Journal of Engineering and Technology", "limitations_en": "Review limited to the Crossref-deposited abstract; no full text was read and results or effectiveness were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se ha leído el texto completo ni se han validado de forma independiente los resultados o la eficacia.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.14419/ijet.v7i2.7.11075", "source_quote": "we use honeypot which serves as a decoy based technology in a network", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "32eacc7cfff2c224daa2f4c708b71e0516d8f191d5f4bcda74cb6205f71cbb0b", "source_title": "Securing Internet of Things(IoT) Using HoneyPots", "techniques": ["Honeypot", "Decoy"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-14419-ijet-v7i2-7-11075", "kind": "paper", "name": "Securing Internet of Things(IoT) Using HoneyPots", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-14419-ijet-v7i2-7-11075", "source_url": "https://doi.org/10.14419/ijet.v7i2.7.11075", "status": "published", "summary_en": "The authors describe the use of honeypots as a decoy-based technology deployed in a network, aimed at defending IoT devices from attacks and gathering information about the attacker's device. The paper presents how honeypots, acting as cost-effective deception models, entice attackers in order to preserve information against attacks.", "summary_es": "Los autores describen el uso de honeypots como tecnología de señuelo desplegada en una red, con el propósito de defender dispositivos IoT de ataques y recopilar información sobre el dispositivo del atacante. El trabajo presenta cómo los honeypots, al actuar como modelos de engaño de bajo coste, atraen a los atacantes para preservar la información frente a ataques.", "updated_at": "2026-10-16", "year": 2018}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Nooreen Fatima Khan", "M Mohan"], "doi": "10.14419/ijet.v7i2.8.10418", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-014-2026-10-16.json", "eligibility_selection_report_sha256": "207b4a10c263bd5dcc3ff987e4fc3fb64a55f3bb254800d6f1adabb8d9f48f97", "environments": ["Cloud"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "International Journal of Engineering and Technology", "limitations_en": "Review based only on the Crossref-deposited abstract; the full text was not examined and results were not independently validated, and no working prototype is confirmed to exist.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se examinó el texto completo ni se validaron de forma independiente los resultados, y no se confirma que exista un prototipo funcional.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.14419/ijet.v7i2.8.10418", "source_quote": "a high-interaction based self-acting spontaneous honey pot, abbreviated as SAS HP, which can dynamically change its behavior after learning from an attacker, is proposed and its architecture is given", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "632f871b7094250e62b9199ef76e6692bd06d42169960c479b69dd80d7426418", "source_title": "Cloud security using self-acting spontaneous honeypots", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-14419-ijet-v7i2-8-10418", "kind": "paper", "name": "Cloud security using self-acting spontaneous honeypots", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-14419-ijet-v7i2-8-10418", "source_url": "https://doi.org/10.14419/ijet.v7i2.8.10418", "status": "published", "summary_en": "The authors propose a high-interaction, self-acting spontaneous honeypot (SAS HP) whose behavior can dynamically change after learning from an attacker, and present its architecture for deployment in cloud environments to analyze attack patterns and secure cloud systems. They also describe how instances of the honeypot could be made available as a service to customers and how it could be deployed within the cloud, with the stated aim of developing a working prototype.", "summary_es": "Los autores proponen un honeypot de alta interacción y comportamiento autónomo y espontáneo (SAS HP) cuyo comportamiento puede cambiar dinámicamente tras aprender de un atacante, y presentan su arquitectura para despliegue en entornos de nube con el fin de analizar patrones de ataque y proteger sistemas en la nube. También describen cómo sus instancias podrían ofrecerse como servicio al cliente y cómo desplegarlo dentro de la nube, con el objetivo declarado de desarrollar un prototipo funcional.", "updated_at": "2026-10-16", "year": 2018}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Muhammad Iqbal", "Arini - Arini", "Hendra Bayu Suseno"], "doi": "10.14421/csecurity.2020.3.1.1933", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-014-2026-10-16.json", "eligibility_selection_report_sha256": "207b4a10c263bd5dcc3ff987e4fc3fb64a55f3bb254800d6f1adabb8d9f48f97", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Cyber Security dan Forensik Digital", "limitations_en": "Review based only on the Crossref-deposited abstract; the full text was not read and results, working software, or effectiveness were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se leyó el texto completo ni se validaron de forma independiente los resultados, el software en funcionamiento o la eficacia.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.14421/csecurity.2020.3.1.1933", "source_quote": "Honeypot untuk mengalihkan server port pada port tiruan dan sengaja terbuka agar kita tahu apa saja upaya yang dilakukan untuk memasuki server, dan ICMP berfungsi sebagai ping request dari client terhadap server.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "ee00ba20f538e8a6953f6504ee8720d92f186b737e593e140354fa34dcb0a687", "source_title": "ANALISA DAN SIMULASI KEAMANAN JARINGAN UBUNTU SERVER DENGAN PORT KNOCKING, HONEYPOT, IPTABLES, ICMP", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-14421-csecurity-2020-3-1-1933", "kind": "paper", "name": "ANALISA DAN SIMULASI KEAMANAN JARINGAN UBUNTU SERVER DENGAN PORT KNOCKING, HONEYPOT, IPTABLES, ICMP", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-14421-csecurity-2020-3-1-1933", "source_url": "https://doi.org/10.14421/csecurity.2020.3.1.1933", "status": "published", "summary_en": "The work reports an analysis and simulation of network security for an Ubuntu server in which the authors combine port knocking with a honeypot, IPtables, and ICMP. The stated purpose is to filter and refuse packets on exposed ports, require a secret knock sequence to reach services, and divert access attempts to decoy ports in order to observe actions directed at the server.", "summary_es": "El trabajo presenta un análisis y una simulación de seguridad de red para un servidor Ubuntu en el que los autores combinan port knocking con honeypot, IPtables e ICMP. El propósito es filtrar y denegar paquetes en puertos expuestos, requerir una secuencia secreta de toques para acceder a los servicios y desviar intentos de acceso hacia puertos simulados para observar las acciones dirigidas contra el servidor.", "updated_at": "2026-10-16", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Allan Desi Alexander", "Ratna Salkiawat", "Joni Warta"], "doi": "10.14421/csecurity.2021.4.1.2379", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-014-2026-10-16.json", "eligibility_selection_report_sha256": "207b4a10c263bd5dcc3ff987e4fc3fb64a55f3bb254800d6f1adabb8d9f48f97", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Cyber Security dan Forensik Digital", "limitations_en": "Review limited to the title and abstract deposited in Crossref; the full text, implementation, and effectiveness of results were not verified.", "limitations_es": "Revisión limitada al título y al resumen depositados en Crossref; no se verificó el texto completo, la implementación ni la eficacia de los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.14421/csecurity.2021.4.1.2379", "source_quote": "Honeypot system sering digunakan sebagai bagian dari system pendeteksi serangan (IDS, Intrusion Detection System) yang mampu mendeteksi ancaman yang terjadi pada sebuah jaringan komputer", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "6bc46cb1faacf78a0faf4b0d6aecf07cc03dc967ea26961d1c2091dc112ea270", "source_title": "PERANCANGAN INTRUSION DETECTION SYSTEM MENGGUNAKAN HONEYPOT PADA UNIVERSITAS BHAYANGKARA JAKARTA RAYA", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-14421-csecurity-2021-4-1-2379", "kind": "paper", "name": "PERANCANGAN INTRUSION DETECTION SYSTEM MENGGUNAKAN HONEYPOT PADA UNIVERSITAS BHAYANGKARA JAKARTA RAYA", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-14421-csecurity-2021-4-1-2379", "source_url": "https://doi.org/10.14421/csecurity.2021.4.1.2379", "status": "published", "summary_en": "The work describes the design of a honeypot-based intrusion detection system (IDS) for the computer network of Universitas Bhayangkara Jakarta Raya. According to the authors, the honeypot simulates weak points to attract malware, records attacker activity, and produces logs that can be analyzed for handling and recovery during and after an attack.", "summary_es": "El trabajo describe el diseño de un sistema de detección de intrusiones (IDS) basado en honeypot para la red informática de la Universidad Bhayangkara Jakarta Raya. Según los autores, el honeypot simula puntos débiles para atraer malware, registra la actividad de los atacantes y produce registros que pueden analizarse para la gestión y recuperación durante y después de un ataque.", "updated_at": "2026-10-16", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Daifallah Zaid Alotaibe"], "doi": "10.14569/ijacsa.2026.0170694", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-014-2026-10-16.json", "eligibility_selection_report_sha256": "207b4a10c263bd5dcc3ff987e4fc3fb64a55f3bb254800d6f1adabb8d9f48f97", "environments": ["Network", "IoT", "OT/ICS"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "International Journal of Advanced Computer Science and Applications", "limitations_en": "Review limited to the Crossref-deposited abstract; the full text was not examined and the results were not independently validated, and the authors themselves describe the figures as preliminary evidence of operational viability rather than fully characterized performance bounds.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se examinó el texto completo ni se validaron de forma independiente los resultados, y los propios autores describen las cifras como evidencia preliminar de viabilidad operativa más que como límites de rendimiento plenamente caracterizados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.14569/ijacsa.2026.0170694", "source_quote": "This study presents QuantumGuard, a proactive cybersecurity framework that inverts the conventional defender posture by integrating cognitive honeynets, post-quantum-secured intelligence channels, and reinforcement-learning-driven deception adaptation across 6G-enabled cyber-physical environments.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "5173bb1471a928dd8e3a49cff5e89b5f89fe8cefa2c20ba931dacba85531f8a4", "source_title": "QuantumGuard: A Post-Quantum Resilient Deception-Driven Framework for Proactive Threat Hunting and Cognitive Honeynet Orchestration in 6G-Enabled Cyber-Physical Systems", "techniques": ["Honeypot", "Decoy", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-14569-ijacsa-2026-0170694", "kind": "paper", "name": "QuantumGuard: A Post-Quantum Resilient Deception-Driven Framework for Proactive Threat Hunting and Cognitive Honeynet Orchestration in 6G-Enabled Cyber-Physical Systems", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-14569-ijacsa-2026-0170694", "source_url": "https://doi.org/10.14569/ijacsa.2026.0170694", "status": "published", "summary_en": "The study proposes QuantumGuard, a proactive cybersecurity framework that combines cognitive honeynets, post-quantum-secured intelligence channels and reinforcement-learning-driven deception adaptation across 6G-enabled cyber-physical environments. The authors aim to integrate a cognitive honeynet orchestrator, a deception policy engine operating under partial observability, a transformer-based MITRE ATT&CK attribution network and a post-quantum federated intelligence bus into a single closed-loop control architecture, and they report a preliminary evaluation on benchmark datasets and a 320-endpoint testbed.", "summary_es": "El estudio propone QuantumGuard, un marco de ciberseguridad proactiva que combina redes trampa cognitivas, canales de inteligencia protegidos con criptografía post-cuántica y adaptación de engaño guiada por aprendizaje por refuerzo en entornos ciberfísicos habilitados para 6G. Los autores buscan integrar en una única arquitectura de control en lazo cerrado un orquestador de redes trampa cognitivas, un motor de políticas de engaño bajo observabilidad parcial, una red de atribución de técnicas MITRE ATT&CK basada en transformadores y un bus federado de inteligencia post-cuántico, y presentan una evaluación preliminar sobre conjuntos de datos de referencia y un banco de pruebas de 320 puntos finales.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Amal M.R.", "Venkadesh P."], "doi": "10.14704/web/v19i1/web19370", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-015-2026-10-16.json", "eligibility_selection_report_sha256": "af375d978332a923a7410c3d4401b519264eab1c6defce1397011ebdffb60829", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Webology", "limitations_en": "Review based only on the Crossref deposited abstract, not on the full text or independent validation of results; no working honeypot system was evaluated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref, no en el texto completo ni en una validación independiente de los resultados; no se evaluó ningún sistema honeypot en funcionamiento.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.14704/web/v19i1/web19370", "source_quote": "Honeypot, also known as Intrusion Detection Technology, is a type of security technology that screens devices to prevent unwanted activities.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "4d2187e593f9bfec5e8ab82ce2055416f19cf0e6922414f4583c17055a6daf0c", "source_title": "Review of Cyber Attack Detection: Honeypot System", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-14704-web-v19i1-web19370", "kind": "paper", "name": "Review of Cyber Attack Detection: Honeypot System", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-14704-web-v19i1-web19370", "source_url": "https://doi.org/10.14704/web/v19i1/web19370", "status": "published", "summary_en": "Review article that provides an overview of cyber security and discusses machine learning, cyber threats and honeypot system-based techniques for intrusion detection and the study of network attacks. The authors describe honeypots as conceptual traps intended to block unauthorised access and to give analysts insights into the origins and behaviours of such attacks.", "summary_es": "Artículo de revisión que presenta una visión general de la ciberseguridad y analiza el aprendizaje automático, las amenazas cibernéticas y las técnicas basadas en sistemas honeypot para la detección de intrusiones y el estudio de ataques en red. Los autores describen los honeypots como trampas conceptuales destinadas a bloquear el acceso no autorizado y a aportar a los analistas información sobre el origen y el comportamiento de dichos ataques.", "updated_at": "2026-10-16", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Giovanni Carlos Lorusso Montiel"], "doi": "10.15381/rpcs.v8i1.33613", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-015-2026-10-16.json", "eligibility_selection_report_sha256": "af375d978332a923a7410c3d4401b519264eab1c6defce1397011ebdffb60829", "environments": ["Cloud"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Revista peruana de computación y sistemas", "limitations_en": "Review limited to the Crossref-deposited abstract; no full text was accessed and results were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se accedió al texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.15381/rpcs.v8i1.33613", "source_quote": "Se realizó una evaluación experimental de seis honeypots de código abierto —tres tradicionales y tres ML-enhanced— desplegados simultáneamente durante 60 días sobre infraestructura Hetzner Cloud.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "6fbe6616c11dcc2e9ddc52c48a00b1cc21c96cae0eadd63bddc4af4d7cdfc6f7", "source_title": "Análisis Comparativo del Rendimiento, Consumo de Recursos y Costos Operacionales de Honeypots Tradicionales y Modernos con Aprendizaje Automático", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-15381-rpcs-v8i1-33613", "kind": "paper", "name": "Análisis Comparativo del Rendimiento, Consumo de Recursos y Costos Operacionales de Honeypots Tradicionales y Modernos con Aprendizaje Automático", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-15381-rpcs-v8i1-33613", "source_url": "https://doi.org/10.15381/rpcs.v8i1.33613", "status": "published", "summary_en": "The study compares, under homogeneous conditions, the technical performance, resource consumption and operational costs of traditional honeypots versus honeypots that incorporate machine learning to improve realism and hinder fingerprinting. The authors deployed six open-source honeypots simultaneously (three traditional and three ML-enhanced) for 60 days on Hetzner Cloud infrastructure, reporting differences in useful interaction, fingerprinting and return on investment.", "summary_es": "El estudio compara, bajo condiciones homogéneas, el rendimiento técnico, el consumo de recursos y los costos operacionales de honeypots tradicionales frente a honeypots que incorporan aprendizaje automático para mejorar el realismo y dificultar el fingerprinting. Los autores desplegaron simultáneamente seis honeypots de código abierto (tres tradicionales y tres con aprendizaje automático) durante 60 días sobre infraestructura Hetzner Cloud y reportan diferencias en interacción útil, fingerprinting y retorno de inversión.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Josef Kaderka"], "doi": "10.15516/cje.v14i0.463", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-015-2026-10-16.json", "eligibility_selection_report_sha256": "af375d978332a923a7410c3d4401b519264eab1c6defce1397011ebdffb60829", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Croatian Journal of Education  -  Hrvatski časopis za odgoj i obrazovanje", "limitations_en": "Review limited to the Crossref-deposited abstract; the full text was not examined and the described experiments or results were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se examinó el texto completo ni se validaron de forma independiente los experimentos o resultados descritos.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.15516/cje.v14i0.463", "source_quote": "The paper acquaints you with honeypots as a tool for security related research.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "9f9d21860ddb6ac50a0df9eaa86b0bf92081cdd49aba9d6bf91cf0e3a4549c25", "source_title": "Honeypots as a Cyber Defence Research Tools", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-15516-cje-v14i0-463", "kind": "paper", "name": "Honeypots as a Cyber Defence Research Tools", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-15516-cje-v14i0-463", "source_url": "https://doi.org/10.15516/cje.v14i0.463", "status": "published", "summary_en": "The author introduces honeypots as a tool for security-related research, lists and characterizes several selected honeypot solutions, and presents results of practical experiments carried out at the University of Defence, including graphs and tables. The stated purpose is to acquaint the reader with the use of honeypots in security research.", "summary_es": "El autor presenta los honeypots como herramienta para la investigación en seguridad, enumera y describe varias soluciones seleccionadas de honeypot, y expone los resultados de experimentos prácticos realizados en la University of Defence, con gráficos y tablas. El propósito declarado es familiarizar al lector con el uso de honeypots en la investigación relacionada con la seguridad.", "updated_at": "2026-10-16", "year": 2012}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Anna Korchenko", "Vladyslav Breslavskyi", "Serhii Yevseiev", "Nazym Zhumangalieva", "Anatolii Zvarych", "Svitlana Kazmirchuk", "Oleg Kurchenko", "Oleksandr Laptiev", "Оleksand Sievierinov", "Sirhii Tkachuk"], "doi": "10.15587/1729-4061.2021.225346", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-015-2026-10-16.json", "eligibility_selection_report_sha256": "af375d978332a923a7410c3d4401b519264eab1c6defce1397011ebdffb60829", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Eastern-European Journal of Enterprise Technologies", "limitations_en": "Review limited to the deposited bibliographic metadata and abstract archived in Crossref; the full text was not examined and results were not independently validated.", "limitations_es": "Revisión limitada al metadato bibliográfico depositado y al resumen archivado en Crossref; no se examinó el texto completo ni se verificaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.15587/1729-4061.2021.225346", "source_quote": "The method is based on the formation of a Honeypots set, subsets of characteristics and identifier values of linguistic estimates of the Honeypot characteristics, a base and derived frequency matrix, as well as on the construction of fuzzy terms and reference fuzzy numbers with their visualization.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "ad1daefef4c5f9aceb865017328e8f9936a3ac236df98dc0647343659bcf85dc", "source_title": "Development of a method for constructing linguistic standards for multi-criteria assessment of honeypot efficiency", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-15587-1729-4061-2021-225346", "kind": "paper", "name": "Development of a method for constructing linguistic standards for multi-criteria assessment of honeypot efficiency", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-15587-1729-4061-2021-225346", "source_url": "https://doi.org/10.15587/1729-4061.2021.225346", "status": "published", "summary_en": "The work addresses the selection and classification of honeypots (virtual decoys, online traps) by their effectiveness, using characteristics such as installation and configuration, usage and support, data collection, logging level, simulation level and interaction level. The authors describe a method that forms a set of honeypots, subsets of characteristics and identifier values of linguistic estimates, base and derived frequency matrices, and fuzzy terms and reference fuzzy numbers with their visualization, in order to construct linguistic standards for multi-criteria assessment.", "summary_es": "El trabajo aborda la selección y clasificación de honeypots (señuelos virtuales) según su eficacia, empleando características como la instalación, la configuración, el uso, el soporte, la recogida de datos, el registro, la simulación y la interacción. Los autores describen un método que forma conjuntos de honeypots, subconjuntos de características y valores identificadores de estimaciones lingüísticas, matrices de frecuencia base y derivadas, y términos difusos y números difusos de referencia con su visualización, con el fin de construir estándares lingüísticos para la evaluación multicriterio.", "updated_at": "2026-10-16", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["1,2 Department of Network and Information Security, Al-Ahliyya Amman University, Jordan", "Heba Othman"], "doi": "10.15849/ijasca.240330.07", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-015-2026-10-16.json", "eligibility_selection_report_sha256": "af375d978332a923a7410c3d4401b519264eab1c6defce1397011ebdffb60829", "environments": ["Endpoint"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "International Journal of Advances in Soft Computing and its Applications", "limitations_en": "Review based only on the Crossref-deposited abstract and bibliographic metadata; the full text was not consulted and results, reproducibility, or software were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref y en los metadatos bibliográficos; no se consultó el texto completo ni se validaron de forma independiente los resultados, la reproducibilidad o el software.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.15849/ijasca.240330.07", "source_quote": "we propose an innovative method that combines swarm intelligence through Particle Swarm Optimization (PSO) with the fuzzy logic of the fuzzyKNN model", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "5a8c7b9ecefae5a89b9d335a568b238a81c05ea3822a1e1960071b172663e95c", "source_title": "Innovative Malware Detection: Practical Swarm Optimization and fuzzyKNN Model in Honeypot Environment", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-15849-ijasca-240330-07", "kind": "paper", "name": "Innovative Malware Detection: Practical Swarm Optimization and fuzzyKNN Model in Honeypot Environment", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-15849-ijasca-240330-07", "source_url": "https://doi.org/10.15849/ijasca.240330.07", "status": "published", "summary_en": "The study proposes a malware detection system that combines Particle Swarm Optimization (PSO) with a fuzzyKNN model, using PSO to select a feature set from a malware dataset and employing a honeypot as a controlled environment for collecting samples and training the model. The authors compare their method against standard detection techniques and report that the PSO-fuzzyKNN approach enhances malware detection accuracy.", "summary_es": "El estudio propone un sistema de detección de malware que combina la optimización por enjambre de partículas (PSO) con un modelo fuzzyKNN, usando PSO para seleccionar un conjunto de características a partir de un conjunto de datos de malware y empleando un honeypot como entorno controlado para recopilar muestras y entrenar el modelo. Los autores comparan su método con técnicas de detección estándar e informan que el enfoque PSO-fuzzyKNN mejora la precisión de la detección de malware.", "updated_at": "2026-10-16", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Nazia Sharmin"], "doi": "10.1609/aaai.v37i13.27022", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-015-2026-10-16.json", "eligibility_selection_report_sha256": "af375d978332a923a7410c3d4401b519264eab1c6defce1397011ebdffb60829", "environments": ["Endpoint", "Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Proceedings of the AAAI Conference on Artificial Intelligence", "limitations_en": "Review limited to the Crossref deposited abstract; the full text was not consulted and results were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se consultó el texto completo ni se verificaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1609/aaai.v37i13.27022", "source_quote": "We propose a model-driven decision support system (DSS) based on a Bayesian belief network (BBN) to support cyber deception based on a detailed model of attacker beliefs.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "11740dc9525f46c3f5d3293e50f668cc7026ff3e365ca9da25f4abb7219bd53c", "source_title": "Bayesian Models for Targeted Cyber Deception Strategies (Student Abstract)", "techniques": ["Decoy"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1609-aaai-v37i13-27022", "kind": "paper", "name": "Bayesian Models for Targeted Cyber Deception Strategies (Student Abstract)", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-1609-aaai-v37i13-27022", "source_url": "https://doi.org/10.1609/aaai.v37i13.27022", "status": "published", "summary_en": "The work proposes a decision support system based on a Bayesian belief network to guide cyber deception strategies from a detailed model of attacker beliefs, illustrated with a case study using passively observed operating system fingerprinting data. The authors compare the model's prediction accuracy with a sequential artificial neural network and introduce a deception algorithm to select a minimal set of features whose modification would make a system appear as a different operating system.", "summary_es": "El trabajo propone un sistema de apoyo a la decisión basado en una red de creencias bayesiana para orientar estrategias de engaño cibernético a partir de un modelo detallado de las creencias del atacante, ilustrado mediante un caso de estudio con datos de identificación pasiva de sistemas operativos. Los autores comparan la precisión de predicción del modelo con una red neuronal artificial secuencial y presentan un algoritmo de engaño para seleccionar un conjunto mínimo de características cuya modificación haría aparecer un sistema operativo distinto.", "updated_at": "2026-10-16", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Tim Pappa", "Darin Roberts"], "doi": "10.1609/aaaiss.v9i1.42942", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-016-2026-10-16.json", "eligibility_selection_report_sha256": "e02d2f1381a400d8bc3e4cf4a31d41daa20fe26c44e1b4a1a0c51fbbc2af9aac", "environments": ["Network", "Endpoint"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Proceedings of the AAAI Symposium Series", "limitations_en": "Assessment based only on the Crossref deposited abstract; the full text was not reviewed and results, claims, or effectiveness of the approach were not independently verified.", "limitations_es": "Evaluación basada únicamente en el resumen depositado en Crossref; no se revisó el texto completo ni se verificaron de forma independiente los resultados, las afirmaciones o la eficacia del enfoque.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1609/aaaiss.v9i1.42942", "source_quote": "We will visualize the use of HoneyContent based on an industry cyber deception scenario that demonstrated anecdotally how this integrated design and content creation model could make deception functions look more real.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "4973837e8257556e20aa9b543fb527ff6033f07447196a2f582f2edbfc73654d", "source_title": "HoneyContent: Wrapping Deception Storyline Content to Warrant Human and LLM Agent Attacker Evaluations of Deception Functions and Effects", "techniques": ["Decoy"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1609-aaaiss-v9i1-42942", "kind": "paper", "name": "HoneyContent: Wrapping Deception Storyline Content to Warrant Human and LLM Agent Attacker Evaluations of Deception Functions and Effects", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-1609-aaaiss-v9i1-42942", "source_url": "https://doi.org/10.1609/aaaiss.v9i1.42942", "status": "published", "summary_en": "This position paper suggests that presenting deception storyline content can influence how human attackers and Large Language Model (LLM) Agent attackers evaluate the authenticity of deception functions and effects on a network or host. The authors introduce HoneyContent, a practiced industry cyber deception model for designing and creating deception storyline content to 'wrap' or embed deception functions, integrating warranting theory and signaling theory, and visualize its use in an industry cyber deception scenario.", "summary_es": "Este trabajo de posición propone que presentar contenido de historias de engaño puede influir en cómo atacantes humanos y agentes basados en modelos grandes de lenguaje (LLM) evalúan la autenticidad de funciones y efectos de engaño en una red o host. Los autores describen su modelo industrial HoneyContent para diseñar y crear contenido de historias de engaño que 'envuelva' o incruste funciones de engaño, integrando teoría de garantía (warranting) y teoría de señales (signaling), y visualizan su uso en un escenario industrial de engaño cibernético.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Sunny Fugate", "Kimberly Ferguson‐Walter"], "doi": "10.1609/aimag.v40i1.2849", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-016-2026-10-16.json", "eligibility_selection_report_sha256": "e02d2f1381a400d8bc3e4cf4a31d41daa20fe26c44e1b4a1a0c51fbbc2af9aac", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "AI Magazine", "limitations_en": "Review based only on the Crossref-deposited abstract; the full text was not read, results were not replicated, and the actual effectiveness of the proposed techniques was not evaluated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se leyó el texto completo, no se replicaron resultados ni se evaluó la eficacia real de las técnicas propuestas.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.1609/aimag.v40i1.2849", "source_quote": "Traditional cyber security techniques have led to an asymmetric disadvantage for defenders.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "7d9b3f9829fe82cacb47df69fbbe7cf031da624947acc664d0cb72cb3532df97", "source_title": "Artificial Intelligence and Game Theory Models for Defending Critical Networks with Cyber Deception", "techniques": ["Decoy", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-1609-aimag-v40i1-2849", "kind": "paper", "name": "Artificial Intelligence and Game Theory Models for Defending Critical Networks with Cyber Deception", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-1609-aimag-v40i1-2849", "source_url": "https://doi.org/10.1609/aimag.v40i1.2849", "status": "published", "summary_en": "The article discusses how cyber deception can change an attacker's perception of the network environment and lead attackers to false beliefs about which systems contain critical information. The authors introduce game theory models and discuss techniques combining artificial intelligence algorithms with those models to estimate hidden states of the attacker using feedback through payoffs, in order to learn how best to defend the system using cyber deception.", "summary_es": "El artículo describe cómo la ciberdecepción puede modificar la percepción del atacante sobre el entorno de red y conducirlo a falsas creencias sobre qué sistemas contienen información crítica. Los autores proponen modelos de teoría de juegos y técnicas que combinan algoritmos de inteligencia artificial para estimar estados ocultos del atacante mediante retroalimentación a través de pagos, con el fin de aprender a defender el sistema usando ciberdecepción.", "updated_at": "2026-10-16", "year": 2019}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Novosibirsk State Technical University, Russian Federation", "Anastasiya Arkhipova", "Danila Karevskiy", "Novosibirsk State Technical University, Russian Federation"], "doi": "10.17212/2782-2230-2021-2-122-135", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-016-2026-10-16.json", "eligibility_selection_report_sha256": "e02d2f1381a400d8bc3e4cf4a31d41daa20fe26c44e1b4a1a0c51fbbc2af9aac", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Digital Technology Security", "limitations_en": "Review based solely on the deposited Crossref abstract; the full text was not accessed and results were not independently verified. The abstract does not describe an implementation, experimental validation, or effectiveness evaluation.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se accedió al texto completo ni se verificaron de forma independiente los resultados. El resumen no describe una implementación, validación experimental ni evaluación de eficacia.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.17212/2782-2230-2021-2-122-135", "source_quote": "the theoretical aspects of honeypot systems were considered, and the classification of honeypots on various grounds was presented", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "c0cb8fee06af05902c72e6d281dda8df225b322af13f836e485b9339d21e9830", "source_title": "Honeypot as a tool for creating an effective secure system", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-17212-2782-2230-2021-2-122-135", "kind": "paper", "name": "Honeypot as a tool for creating an effective secure system", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-17212-2782-2230-2021-2-122-135", "source_url": "https://doi.org/10.17212/2782-2230-2021-2-122-135", "status": "published", "summary_en": "The authors review theoretical aspects of honeypot systems and present a classification of honeypots on various grounds. They also describe the architecture of a honeypot system intended to investigate an attacker's behavior after penetration into the corporate system, as a tool for an organizational secure system.", "summary_es": "Los autores revisan los aspectos teóricos de los sistemas honeypot y presentan una clasificación de honeypots según distintos criterios. Asimismo, describen la arquitectura de un sistema honeypot orientado a investigar el comportamiento de un atacante tras su penetración en el sistema corporativo, como herramienta para una supuesta solución de seguridad integral de la organización.", "updated_at": "2026-10-16", "year": 2021}
{"critical_reading": null, "data": {"abstract_source_doi": "10.17694/bajece.1506554", "access_date": "2026-10-16", "authors": ["Melike Başer", "Ebu Yusuf Güven", "Muhammed Ali Aydın"], "creator_name_aliases_inferred": false, "doi": "10.17694/bajece.1506554", "doi_aliases": ["10.21203/rs.3.rs-3733937/v1"], "draft_review_basis": "deepseek-original-draft; codex-source-correction-and-independent-claude-review", "environments": ["Cloud"], "family_resource_count": 1, "family_scope_basis": [{"batch": 16, "candidate_id": "doi:10.17694/bajece.1506554", "catalog_decision": null, "doi": "10.17694/bajece.1506554", "existing_identifier_matches": [], "existing_title_matches": [], "identity_status": "declared-version-family-review-needed", "selection_report": "data/coverage/bibliography-deposited-third-crossref-016-2026-10-16.json", "selection_report_sha256": "e02d2f1381a400d8bc3e4cf4a31d41daa20fe26c44e1b4a1a0c51fbbc2af9aac", "source_sha256": "c9e440a116ebcecb2a0ce77a644d2c7bc8da42cb5528052eba1305dbe76e79de", "title": "Analysis of Malicious Files Gathering via Honeypot Trap System and Benchmark of Anti-Virus Software", "year": 2025}, {"batch": 20, "candidate_id": "doi:10.21203/rs.3.rs-3733937/v1", "catalog_decision": null, "doi": "10.21203/rs.3.rs-3733937/v1", "existing_identifier_matches": [], "existing_title_matches": [], "identity_status": "declared-version-family-review-needed", "selection_report": "data/coverage/bibliography-deposited-third-crossref-020-2026-10-16.json", "selection_report_sha256": "517f1960e8d694cc2f48b90ba7ca0dd17f64936113acd9ce5d63e0204616a34f", "source_sha256": "8bbeb69bc2df15eb85bde16b55f0c76cbf960881adf37ef76e674cf8f625a77d", "title": "Analysis of Malicious Files Gathering via Honeypot Trap System and Benchmark of Anti-Virus Software", "year": 2023}], "full_text_equality_claimed": false, "full_text_reviewed": false, "identity_report": "data/coverage/deposited-followup-family-review-2026-10-16.json", "identity_report_sha256": "d8486dc729d6c0aa6a91da335c385db7fbbce91367b6f1514f6601698918bdf8", "journal": "Balkan Journal of Electrical and Computer Engineering", "limitations_en": "Deposited abstract and version metadata; no full-text reading and no independent validation of the benchmark results.", "limitations_es": "Resumen depositado y metadatos de versión; no se leyó el texto completo ni se verificaron de forma independiente los resultados del benchmark.", "metadata_sha256": "c9e440a116ebcecb2a0ce77a644d2c7bc8da42cb5528052eba1305dbe76e79de", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "source-page", "review_depth": "deposited abstract of DOI 10.17694/bajece.1506554; version identity metadata; no full-text analysis", "reviewed_metadata_url": "https://api.crossref.org/works/10.17694/bajece.1506554", "selection_report": "data/coverage/bibliography-deposited-third-crossref-016-2026-10-16.json", "selection_report_sha256": "e02d2f1381a400d8bc3e4cf4a31d41daa20fe26c44e1b4a1a0c51fbbc2af9aac", "source_correction_input_sha256": "4fa4115afa49d4af38c167374ead455ecb37fc881172813a4370d6980e0f15e5", "source_document_url": "https://doi.org/10.17694/bajece.1506554", "source_packet_sha256": "4ece3fc8b6b0004105d4f0223e102b5f412af6acd99e2a0b2ccc2481f17c9d06", "source_quote": "Using a honeypot trap system on Google Cloud, suspicious files uploaded by attackers were analyzed.", "source_quote_locator": {"abstract_source_doi": "10.17694/bajece.1506554", "field": "deposited abstract (HTML normalized)"}, "source_sha256": "c9e440a116ebcecb2a0ce77a644d2c7bc8da42cb5528052eba1305dbe76e79de", "source_title": "Analysis of Malicious Files Gathering via Honeypot Trap System and Benchmark of Anti-Virus Software", "source_type": "deposited abstract of DOI 10.17694/bajece.1506554; version identity metadata; no full-text analysis", "tags": [], "techniques": ["Honeypot"], "version_history": [{"creators": [{"ORCID": "https://orcid.org/0000-0003-0175-5045", "affiliation": [{"name": "İSTANBUL ÜNİVERSİTESİ-CERRAHPAŞA"}], "authenticated-orcid": true, "family": "Başer", "given": "Melike", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "first"}, {"ORCID": "https://orcid.org/0000-0002-7587-3127", "affiliation": [{"name": "İSTANBUL ÜNİVERSİTESİ-CERRAHPAŞA"}], "authenticated-orcid": true, "family": "Güven", "given": "Ebu Yusuf", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}, {"ORCID": "https://orcid.org/0000-0002-1846-6090", "affiliation": [{"name": "İSTANBUL ÜNİVERSİTESİ-CERRAHPAŞA"}], "authenticated-orcid": true, "family": "Aydın", "given": "Muhammed Ali", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}], "doi": "10.17694/bajece.1506554", "issued": {"date-parts": [[2025, 1, 7]]}, "metadata_sha256": "c9e440a116ebcecb2a0ce77a644d2c7bc8da42cb5528052eba1305dbe76e79de", "titles": ["Analysis of Malicious Files Gathering via Honeypot Trap System and Benchmark of Anti-Virus Software"]}, {"creators": [{"affiliation": [{"name": "Istanbul University Cerrahpaşa"}], "family": "BASER", "given": "Melike", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "first"}, {"affiliation": [{"name": "Istanbul University Cerrahpaşa"}], "family": "GUVEN", "given": "Ebu Yusuf", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}, {"affiliation": [{"name": "Istanbul University Cerrahpaşa"}], "family": "AYDIN", "given": "Muhammed Ali", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}], "doi": "10.21203/rs.3.rs-3733937/v1", "issued": {"date-parts": [[2023, 12, 14]]}, "metadata_sha256": "8bbeb69bc2df15eb85bde16b55f0c76cbf960881adf37ef76e674cf8f625a77d", "titles": ["Analysis of Malicious Files Gathering via Honeypot Trap System and Benchmark of Anti-Virus Software"]}]}, "evidence": "primary-source-passages", "id": "doi-10-17694-bajece-1506554", "kind": "paper", "name": "Analysis of Malicious Files Gathering via Honeypot Trap System and Benchmark of Anti-Virus Software", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-17694-bajece-1506554", "source_url": "https://doi.org/10.17694/bajece.1506554", "status": "published", "summary_en": "The paper studies files uploaded by attackers to a cloud honeypot and uses them to compare signature-based detection by antivirus programs.", "summary_es": "El artículo estudia archivos cargados por atacantes en un honeypot en la nube y los utiliza para comparar la detección basada en firmas de programas antivirus.", "updated_at": "2026-10-16", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["I.O. Sushyn", "D.A. Minochkin"], "doi": "10.17721/2519-481x/2020/68-08", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-016-2026-10-16.json", "eligibility_selection_report_sha256": "e02d2f1381a400d8bc3e4cf4a31d41daa20fe26c44e1b4a1a0c51fbbc2af9aac", "environments": ["IoT"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Collection of scientific works of the Military Institute of Kyiv National Taras Shevchenko University", "limitations_en": "This entry is based solely on the author-deposited abstract; the full text was not consulted and the described results or artifacts were not independently validated.", "limitations_es": "Esta entrada se basa únicamente en el resumen depositado por los autores; no se ha consultado el texto completo ni se han validado de forma independiente los resultados o artefactos descritos.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.17721/2519-481x/2020/68-08", "source_quote": "Therefore, it was proposed to create a method that can solve a set of problems simultaneously by combining PKI secure authentication and honeypots.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "56752afe43231ceabb7fc38feb5219c37a17fb820920749ef46cbdef8a7c7925", "source_title": "IOT HONEYPOT WITH USING SECURE AUTHENTICATION", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-17721-2519-481x-2020-68-08", "kind": "paper", "name": "IOT HONEYPOT WITH USING SECURE AUTHENTICATION", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-17721-2519-481x-2020-68-08", "source_url": "https://doi.org/10.17721/2519-481x/2020/68-08", "status": "published", "summary_en": "The authors propose a method that combines PKI secure authentication and honeypots with the aim of addressing several IoT security problems together, including detecting vulnerabilities and attacks and building attacker profiles. The work frames this in the context of resource-limited IoT devices and large-scale networks, where private-key management is difficult.", "summary_es": "Los autores proponen un método que combina la autenticación segura mediante PKI con honeypots con el objetivo de abordar de forma conjunta varios problemas de seguridad en el Internet de las Cosas, incluida la detección de vulnerabilidades y ataques y la creación de perfiles de atacantes. El trabajo sitúa el método en el contexto de dispositivos IoT con recursos limitados y grandes redes, donde la gestión de claves privadas resulta difícil.", "updated_at": "2026-10-16", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["S. Hakhovych", "T. Babych", "T. Savchenko", "Ye. Derkach"], "doi": "10.17721/2519-481x/2026/90-06", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-016-2026-10-16.json", "eligibility_selection_report_sha256": "e02d2f1381a400d8bc3e4cf4a31d41daa20fe26c44e1b4a1a0c51fbbc2af9aac", "environments": ["Network", "Endpoint"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Collection of scientific works of the Military Institute of Kyiv National Taras Shevchenko University", "limitations_en": "This entry relies only on the title and abstract deposited in Crossref metadata; the full text was not read and the described results were not independently verified.", "limitations_es": "Esta ficha se basa únicamente en el título y el resumen depositados en los metadatos de Crossref; no se leyó el texto completo y no se verificaron de forma independiente los resultados descritos.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.17721/2519-481x/2026/90-06", "source_quote": "An architecture of a laboratory environment based on a virtual infrastructure using the Cowrie honeypot system is proposed.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "4c2c42df97ee84f84a41e5bcbec34c4301d473f372f1918545e9535998a99710", "source_title": "AUTOMATED SYSTEM OF ISOLATED EMULATION ENVIRONMENTS FOR CYBER THREAT RESEARCH", "techniques": ["Honeypot", "Decoy", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-17721-2519-481x-2026-90-06", "kind": "paper", "name": "AUTOMATED SYSTEM OF ISOLATED EMULATION ENVIRONMENTS FOR CYBER THREAT RESEARCH", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-17721-2519-481x-2026-90-06", "source_url": "https://doi.org/10.17721/2519-481x/2026/90-06", "status": "published", "summary_en": "The article examines the application of Cyber Deception technologies to the investigation of current cyber threats and the behavior of potential attackers, arguing for the usefulness of honeypot systems in collecting information on unauthorized access attempts and cyberattack techniques. Its authors propose a laboratory architecture based on a virtual infrastructure using the Cowrie honeypot system, aimed at automated event log collection and continuous monitoring of unauthorized access attempts, authentication processes, executed commands, and subsequent analysis of attacker activity.", "summary_es": "El artículo analiza el uso de tecnologías de Cyber Deception (engaño cibernético) para el estudio de amenazas actuales y el comportamiento de posibles atacantes, y sostiene la utilidad de los sistemas honeypot para recopilar información sobre intentos de acceso no autorizado y técnicas de ciberataque. Sus autores proponen una arquitectura de laboratorio basada en infraestructura virtual con el sistema honeypot Cowrie, orientada a la recolección automatizada de registros de eventos y la monitorización continua de intentos de acceso, procesos de autenticación, comandos ejecutados y análisis posterior de la actividad de los atacantes.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Nguyen Canh Thang", "Minho Park", "Yang Ick Joo"], "doi": "10.17762/ijcnis.v12i3.4701", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-017-2026-10-16.json", "eligibility_selection_report_sha256": "6f45142455132999c7fa519e62e280b1957289ce0ae5b0ceccbaaa67dd9f2f16", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "International Journal of Communication Networks and Information Security (IJCNIS)", "limitations_en": "Review based only on the Crossref deposited abstract; the full text was not examined and results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se verificó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.17762/ijcnis.v12i3.4701", "source_quote": "It uses a network-intrusion-detection system (NIDS) at the border of the network to detect attacks, leverages the advantages of SDN and NFV to flexibly generate honeypots, and connects attackers to these honeypots by using a moving-target defense mechanism.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "600011c88afff66b6d47b18dd23ba1bd9bc03259d339edf0f2f845fc3765e3d2", "source_title": "EVHS - Elastic Virtual Honeypot System for SDNFV-Based Networks", "techniques": ["Honeypot", "Moving target defense"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-17762-ijcnis-v12i3-4701", "kind": "paper", "name": "EVHS - Elastic Virtual Honeypot System for SDNFV-Based Networks", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-17762-ijcnis-v12i3-4701", "source_url": "https://doi.org/10.17762/ijcnis.v12i3.4701", "status": "published", "summary_en": "This work proposes EVHS, an elastic virtual honeypot system for SDNFV-based networks, aimed at flexibly managing and controlling honeypots. The system uses a network intrusion detection system at the network border to detect attacks, leverages SDN and NFV to generate honeypots, and employs a moving-target defense mechanism to connect attackers to these honeypots, while also reusing available honeypots after attacks are handled.", "summary_es": "Este trabajo propone EVHS, un sistema de honeypots virtuales elásticos para redes basadas en SDNFV, cuyo objetivo es gestionar y controlar honeypots de forma flexible. El sistema usa un sistema de detección de intrusiones de red en el borde para detectar ataques, aprovecha SDN y NFV para generar honeypots y emplea un mecanismo de defensa de objetivo móvil para conectar a los atacantes con dichos honeypots, además de reutilizar los honeypots disponibles tras gestionar los ataques.", "updated_at": "2026-10-16", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Mangesh D. Salunke", "Subhash G. Rathod", "Hemantkumar B. Jadhav", "Meghna Yashwante", "Vaibhav D. Rewaskar", "Pranjali V. Deshmukh"], "doi": "10.17762/ijritcc.v11i8s.7673", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-017-2026-10-16.json", "eligibility_selection_report_sha256": "6f45142455132999c7fa519e62e280b1957289ce0ae5b0ceccbaaa67dd9f2f16", "environments": [], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "International Journal on Recent and Innovation Trends in Computing and Communication", "limitations_en": "Assessment limited to the Crossref-deposited abstract; the full text was not reviewed and the results, implementation, and effectiveness of the system were not independently verified.", "limitations_es": "Evaluación limitada al resumen depositado en Crossref; no se revisó el texto completo ni se verificaron de forma independiente los resultados, la implementación ni la eficacia del sistema.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.17762/ijritcc.v11i8s.7673", "source_quote": "we build pretend files and directories for nefarious behaviours", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "cd2c5b931a5c4079226b71635106bd6bc9f9e8117f832f97c38a8d2a341b72cb", "source_title": "Implementation of Decoy Deception based Detection System for Ransomware Attack", "techniques": ["Decoy"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-17762-ijritcc-v11i8s-7673", "kind": "paper", "name": "Implementation of Decoy Deception based Detection System for Ransomware Attack", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-17762-ijritcc-v11i8s-7673", "source_url": "https://doi.org/10.17762/ijritcc.v11i8s.7673", "status": "published", "summary_en": "The authors propose a ransomware detection method based on behavior and deception, using decoy files and directories to reveal malicious activity. The paper describes a pilot study with Locky.", "summary_es": "Los autores proponen un método de detección de ransomware basado en comportamiento y engaño que utiliza archivos y directorios señuelo para revelar actividad maliciosa. El paper describe una prueba piloto con Locky.", "updated_at": "2026-10-16", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Fransiska Sisilia Mukti", "R. Muhammad Sukmawan"], "doi": "10.17933/jppi.v11i1.336", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-017-2026-10-16.json", "eligibility_selection_report_sha256": "6f45142455132999c7fa519e62e280b1957289ce0ae5b0ceccbaaa67dd9f2f16", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Jurnal Penelitian Pos dan Informatika", "limitations_en": "Review based only on the member-deposited Crossref abstract; full text was not accessed and results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref por el miembro editor; no se accedió al texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.17933/jppi.v11i1.336", "source_quote": "Five testing schemes were carried out to provide a comparative study between the low interaction honeypot Cowrie and Dionaea.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "4504dad7053207e15dc7470890ebd412a77d294ad5ae62568d9d283e59922996", "source_title": "Integration of Low Interaction Honeypot and ELK Stack as Attack Detection Systems on Servers", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-17933-jppi-v11i1-336", "kind": "paper", "name": "Integration of Low Interaction Honeypot and ELK Stack as Attack Detection Systems on Servers", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-17933-jppi-v11i1-336", "source_url": "https://doi.org/10.17933/jppi.v11i1.336", "status": "published", "summary_en": "The work proposes integrating low interaction honeypots with the ELK Stack as a server attack detection system, aiming to divert attacker access and to help administrators analyze the generated logs through visualization. The authors carried out five testing schemes comparing the Cowrie and Dionaea honeypots, and report that Cowrie delivered real-time detection with an average delay time of 3.75 seconds, while ELK provided better monitoring results for administrators through its visualization.", "summary_es": "El trabajo propone integrar honeypots de baja interacción con el ELK Stack como sistema de detección de ataques en servidores, con el fin de desviar el acceso de atacantes y facilitar a los administradores el análisis de los registros generados mediante visualización. Los autores realizan cinco esquemas de prueba para comparar los honeypots Cowrie y Dionaea, e informan que Cowrie ofreció una detección en tiempo real con un tiempo de retardo promedio de 3,75 segundos, mientras que ELK proporcionó mejores resultados de monitoreo a través de su visualización.", "updated_at": "2026-10-16", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Akshay Mudgal", "Shaveta Bhatia"], "doi": "10.18280/ijsse.120610", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-017-2026-10-16.json", "eligibility_selection_report_sha256": "6f45142455132999c7fa519e62e280b1957289ce0ae5b0ceccbaaa67dd9f2f16", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "International Journal of Safety and Security Engineering", "limitations_en": "Review based solely on the Crossref-deposited abstract; the full text was not read and the results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se ha leído el texto completo ni se han validado de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.18280/ijsse.120610", "source_quote": "To evaluate the methodology, a spark-based honeypot strategy has been designed, put into practice, and tested in this study.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "eb2ea0ae571de5e1de262dbf0930b26682c3f6e1e6d11bc9b8078fb7209aff62", "source_title": "Spark-Based Network Security Honeypot System: Detailed Performance Analysis", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-18280-ijsse-120610", "kind": "paper", "name": "Spark-Based Network Security Honeypot System: Detailed Performance Analysis", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-18280-ijsse-120610", "source_url": "https://doi.org/10.18280/ijsse.120610", "status": "published", "summary_en": "The authors describe a Spark-based honeypot system designed, implemented, and tested on a campus network over several days, intended to draw intruders toward a resource that simulates a fully resourced computer or vault. The study presents a performance analysis of that deployment based on parameters defined by the authors.", "summary_es": "Los autores describen un sistema honeypot basado en Spark diseñado, implementado y probado en una red de campus durante varios días, con el propósito de atraer intrusos hacia un recurso que simula ser un equipo o almacén totalmente equipado. El estudio presenta un análisis de rendimiento de ese despliegue mediante parámetros definidos por los autores.", "updated_at": "2026-10-16", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Jayakrishnan Anilakkad Raman", "Vasanthi Varadharajan"], "doi": "10.18280/isi.260309", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-017-2026-10-16.json", "eligibility_selection_report_sha256": "6f45142455132999c7fa519e62e280b1957289ce0ae5b0ceccbaaa67dd9f2f16", "environments": ["IoT", "Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Ingénierie des systèmes d information", "limitations_en": "Review based solely on the Crossref-deposited abstract; the full text was not consulted and the model's results or effectiveness were not independently verified.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se consultó el texto completo ni se verificaron de forma independiente los resultados o la eficacia del modelo.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.18280/isi.260309", "source_quote": "This paper derives a comprehensive preventive cyber forensic process model with honeypots for the digital IoT investigation process which is formal, that can assist in the court of law in defining the reliability of the investigative process.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "2ad667e145fdaddf7be22284d14e784e9c5494fcbd1b335ab4022182269f6bd9", "source_title": "HoneyNetCloud Investigation Model, A Preventive Process Model for IoT Forensics", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-18280-isi-260309", "kind": "paper", "name": "HoneyNetCloud Investigation Model, A Preventive Process Model for IoT Forensics", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-18280-isi-260309", "source_url": "https://doi.org/10.18280/isi.260309", "status": "published", "summary_en": "The authors propose HIM, a preventive forensic process model for investigating IoT network incidents that uses honeypots to record attacks over one year. The model aims to cover the entire lifecycle of IoT forensic investigation and address the needs of forensic analysts and the legal community, and the authors report it was validated using various methods.", "summary_es": "Los autores proponen HIM, un modelo de proceso forense preventivo para la investigación de incidentes en redes de IoT que emplea honeypots para registrar ataques durante un año. El modelo busca cubrir el ciclo de vida completo de la investigación forense y responder a requisitos de analistas forenses y del ámbito legal, y los autores informan que fue validado mediante varios métodos.", "updated_at": "2026-10-16", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Venkatasubramanian Srinivasan"], "doi": "10.18280/isi.260605", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-017-2026-10-16.json", "eligibility_selection_report_sha256": "6f45142455132999c7fa519e62e280b1957289ce0ae5b0ceccbaaa67dd9f2f16", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Ingénierie des systèmes d information", "limitations_en": "Review based only on the Crossref-deposited abstract; the full text was not examined and the results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se examinó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.18280/isi.260605", "source_quote": "honeypots are roaming virtual software managers that create Route Request (RREQ) packets to attract and entrap black hole attackers", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "4f0dd733a52d309a2a886a947d021c9ac2f3fab7aa8ebb28ec654af5b10b46dc", "source_title": "Detection of Black Hole Attack Using Honeypot Agent-Based Scheme with Deep Learning Technique on MANET", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-18280-isi-260605", "kind": "paper", "name": "Detection of Black Hole Attack Using Honeypot Agent-Based Scheme with Deep Learning Technique on MANET", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-18280-isi-260605", "source_url": "https://doi.org/10.18280/isi.260605", "status": "published", "summary_en": "The paper describes the use of honeypot agents that generate Route Request (RREQ) packets to attract and entrap black hole attackers in mobile ad hoc networks (MANETs), together with a deep learning technique based on Long-Short Term Memory (LSTM). The authors evaluate the proposed scheme, named HPAS-LSTM, through ns-2 simulations and compare its results with other black hole detection methods in terms of throughput, packet loss rate, packet delivery ratio and total network delay.", "summary_es": "El artículo describe el uso de agentes honeypot que generan paquetes Route Request (RREQ) para atraer y capturar atacantes de agujero negro en redes móviles ad hoc (MANET), junto con una técnica de aprendizaje profundo basada en memoria de corto y largo plazo (LSTM). Los autores evalúan el esquema propuesto, denominado HPAS-LSTM, mediante simulaciones en ns-2 y comparan sus resultados con otros métodos de detección de agujero negro en términos de rendimiento, pérdida de paquetes, tasa de entrega de paquetes y retardo total de red.", "updated_at": "2026-10-16", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Samara National Research University, Moskovskoe Shosse, 34А, Samara, Russia, 443086", "Danila Shkirdov", "Evgeny Sagatov", "Samara National Research University, Moskovskoe Shosse, 34А, Samara, Russia, 443086", "Pavel Dmitrenko", "V.I. Vernadsky Crimean Federal University, Prospekt Vernadskogo, 4, Simferopol, Russia, 295007"], "doi": "10.18287/1613-0073-2019-2416-189-198", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-018-2026-10-16.json", "eligibility_selection_report_sha256": "0d4c8e4dd83826c29510b63c3be15bf7d1705607bb8e7011f2aa9ea9a0851d39", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Proceedings of the V International conference Information Technology and Nanotechnology 2019", "limitations_en": "Review based solely on the Crossref-deposited abstract; the full text was not examined and results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se examinó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.18287/1613-0073-2019-2416-189-198", "source_quote": "Methods for processing statistics are discussed in detail for secure remote access SSH.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "ad1f7305071f33641259c9a327b36b93ad796eb0438281189374a4309a16c9b6", "source_title": "Trap method in ensuring data security", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-18287-1613-0073-2019-2416-189-198", "kind": "paper", "name": "Trap method in ensuring data security", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-18287-1613-0073-2019-2416-189-198", "source_url": "https://doi.org/10.18287/1613-0073-2019-2416-189-198", "status": "published", "summary_en": "The authors present a data analysis of records from a geographically distributed honeypot server network deployed in Samara, Rostov-on-Don, Crimea and the USA, with methods for processing statistics discussed in detail for secure remote access SSH. Lists of attacking addresses are highlighted and their geographical affiliation determined, and request intensity to each of the 10 installed services is then calculated using rank distributions.", "summary_es": "Los autores presentan un análisis de datos procedentes de una red geográficamente distribuida de servidores honeypot desplegados en Samara, Rostov del Don, Crimea y Estados Unidos, con métodos de procesamiento de estadísticas detallados para el acceso remoto seguro SSH. Se identifican listas de direcciones atacantes y su afiliación geográfica, y se calcula la intensidad de peticiones a cada uno de los 10 servicios instalados mediante distribuciones de rangos.", "updated_at": "2026-10-16", "year": 2019}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "authors": ["Yibo Hu", "Yu Lin", "Erick Skorupa Parolin", "Latifur Khan", "Kevin Hamlen"], "design_en": "Mask-then-infill generation evaluated on technical abstracts, patents and news with automatic and human evaluation.", "design_es": "Generación mask-then-infill evaluada en abstracts técnicos, patentes y noticias, con evaluación automática y humana.", "doi": "10.18653/v1/2022.findings-emnlp.486", "environments": ["Identity"], "finding_en": "FDI aims to preserve plausibility while changing critical information and exceeds reported baselines.", "finding_es": "FDI busca preservar plausibilidad mientras modifica información crítica y supera los baselines reportados.", "full_text_reviewed_at": "2026-09-16", "journal": "Findings of the Association for Computational Linguistics: EMNLP 2022", "limits_en": "Human evaluation was costly, had little reviewer overlap and did not allow Kappa agreement calculation.", "limits_es": "La evaluación humana fue costosa, tuvo poco solapamiento entre revisores y no permitió calcular acuerdo Kappa.", "review_basis": "full-text", "source_title": "Controllable Fake Document Infilling for Cyber Deception", "tags": ["DOI"], "techniques": ["Honeytoken"]}, "evidence": "full-text-review", "id": "doi-10-18653-v1-2022-findings-emnlp-486", "kind": "paper", "name": "Controllable Fake Document Infilling for Cyber Deception", "organization": "Yibo Hu, Yu Lin", "reviewed_at": "2026-09-16", "slug": "doi-10-18653-v1-2022-findings-emnlp-486", "source_url": "https://doi.org/10.18653/v1/2022.findings-emnlp.486", "status": "published", "summary_en": "Bibliographic record on controllable fake documents. The abstract and findings still require review.", "summary_es": "Registro bibliográfico sobre documentos falsos controlables. El resumen y los resultados aún requieren lectura.", "updated_at": "2026-09-18", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Georges Bell Bitjoka", "Antoine Elang"], "doi": "10.19030/jcr.v3i1.10226", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-018-2026-10-16.json", "eligibility_selection_report_sha256": "0d4c8e4dd83826c29510b63c3be15bf7d1705607bb8e7011f2aa9ea9a0851d39", "environments": ["Network", "Application"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Journal of Cybersecurity Research (JCR)", "limitations_en": "Assessment based only on the Crossref-deposited abstract; the full text was not consulted and results, software, or effectiveness were not independently verified.", "limitations_es": "Evaluación basada únicamente en el resumen depositado en Crossref; no se consultó el texto completo ni se verificaron de forma independiente los resultados, el software o su eficacia.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.19030/jcr.v3i1.10226", "source_quote": "a honeypot system was designed to study the techniques used by attackers", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "31c185222f1d6746be45456bae973bb5e57cba6d129ffe7b630790e5376dcc5d", "source_title": "Network Malware Laboratory BasedOn Honeypots Technologies", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-19030-jcr-v3i1-10226", "kind": "paper", "name": "Network Malware Laboratory BasedOn Honeypots Technologies", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-19030-jcr-v3i1-10226", "source_url": "https://doi.org/10.19030/jcr.v3i1.10226", "status": "published", "summary_en": "This paper describes the design and implementation of a malware analysis laboratory based on honeypot technology in a controlled environment, aimed at studying the techniques used by attackers and analyzing security incidents. The authors also designed an administration interface to control and analyze the gathered information, and tested the system for several weeks to collect statistics about attacks and their perpetrators.", "summary_es": "Este trabajo describe el diseño e implementación de un laboratorio de análisis de malware basado en tecnología de honeypots en un entorno controlado, con el fin de estudiar las técnicas empleadas por los atacantes y analizar incidentes de seguridad. Los autores también diseñaron una interfaz de administración para controlar y analizar la información recopilada, y probaron el sistema durante varias semanas para reunir estadísticas sobre los ataques y sus responsables.", "updated_at": "2026-10-16", "year": 2018}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Winda Andrini Wulandari"], "doi": "10.20527/jtiulm.v2i2.17", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-018-2026-10-16.json", "eligibility_selection_report_sha256": "0d4c8e4dd83826c29510b63c3be15bf7d1705607bb8e7011f2aa9ea9a0851d39", "environments": ["Cloud", "Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Jurnal Teknologi Informasi Universitas Lambung Mangkurat (JTIULM)", "limitations_en": "Review limited to the Crossref-deposited abstract; the full text was not consulted and results were not independently verified.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se consultó el texto completo ni se verificaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.20527/jtiulm.v2i2.17", "source_quote": "The results suggest that honeynet as a way to protect and monitor the security of public cloud computing networks, and analyze its datalog through the k-means method approach to recognize cyber profilling DDoS attacks based on the timestamp recorded in the data.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "a9f738a0967cd834ba9b207a6425c83a0d82770fd51dbbd26663d4fb0a8a593f", "source_title": "THE USE OF K-MEANS ALGORITHM ON DATALOG HONEYNET FOR PROFILING DDOS ATTACKS", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-20527-jtiulm-v2i2-17", "kind": "paper", "name": "THE USE OF K-MEANS ALGORITHM ON DATALOG HONEYNET FOR PROFILING DDOS ATTACKS", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-20527-jtiulm-v2i2-17", "source_url": "https://doi.org/10.20527/jtiulm.v2i2.17", "status": "published", "summary_en": "Based on cooperation with AWN University and the Indonesia Honeypot Project (IHP) of the Ministry of Communications and Informatics, the authors describe using a honeynet to protect and monitor public cloud computing networks, and analyzing its datalog through a k-means approach to profile DDoS attacks based on the timestamp recorded in the data.", "summary_es": "A partir de una colaboración con AWN University y el Indonesia Honeypot Project (IHP) del Ministerio de Comunicaciones e Informática, los autores describen el uso de una honeynet para proteger y monitorear redes de computación en la nube públicas, y el análisis de su datalog mediante un enfoque de k-means para perfilar ataques DDoS según la marca de tiempo registrada en los datos.", "updated_at": "2026-10-16", "year": 2017}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Winda Andrini Wulandari"], "doi": "10.20527/jtiulm.v3i1.24", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-018-2026-10-16.json", "eligibility_selection_report_sha256": "0d4c8e4dd83826c29510b63c3be15bf7d1705607bb8e7011f2aa9ea9a0851d39", "environments": ["Cloud", "Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Jurnal Teknologi Informasi Universitas Lambung Mangkurat (JTIULM)", "limitations_en": "Review is limited to the publisher-deposited abstract in Crossref; the full text was not consulted and results, implementation, or effectiveness were not independently verified.", "limitations_es": "Revisión limitada al resumen depositado por el editor en Crossref; no se consultó el texto completo ni se verificaron de forma independiente los resultados, la implementación o la eficacia.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.20527/jtiulm.v3i1.24", "source_quote": "K -means clustering method is implemented in this research to get categorization result of time of effective attack", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "25ee38e4b667f9841cd88555bce99aec11ab7885379c2c090ba85c362ce0c2e7", "source_title": "THE ANALYSIS NETWORK FORENSICS USING HONEYPOT ON PUBLIC CLOUD COMPUTING SERVICE NETWORK", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-20527-jtiulm-v3i1-24", "kind": "paper", "name": "THE ANALYSIS NETWORK FORENSICS USING HONEYPOT ON PUBLIC CLOUD COMPUTING SERVICE NETWORK", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-20527-jtiulm-v3i1-24", "source_url": "https://doi.org/10.20527/jtiulm.v3i1.24", "status": "published", "summary_en": "The work presents a dashboard visualization using honeypot log data from the AWN campus connected to IHP (Kemkominfo) Jakarta on a public cloud computing service network, aiming to categorize timestamps. The K-means clustering method is applied to categorize attacks into morning, noon, and night periods based on Western Indonesia Time and to identify ports 21, 80, 135, and 445 affected by DDoS attacks, with the stated expectation of supporting monitoring and anticipation of cloud network vulnerabilities.", "summary_es": "El trabajo presenta una visualización en panel a partir de datos de registro de un honeypot del campus AWN conectado a IHP (Kemkominfo) Jakarta en una red de servicios de computación en nube pública, con el fin de categorizar marcas de tiempo. El método de agrupamiento K-means se emplea para clasificar los ataques en franjas horarias (mañana, mediodía y noche, según la hora de Indonesia Occidental) y para identificar los puertos 21, 80, 135 y 445 afectados por ataques DDoS, con la expectativa de apoyar la monitorización y la anticipación de vulnerabilidades.", "updated_at": "2026-10-16", "year": 2018}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Shen Xin En", "Liu Si Ling", "Fan Cheng Hao"], "doi": "10.20944/preprints202109.0461.v1", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-018-2026-10-16.json", "eligibility_selection_report_sha256": "0d4c8e4dd83826c29510b63c3be15bf7d1705607bb8e7011f2aa9ea9a0851d39", "environments": ["IoT"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "", "limitations_en": "Review based solely on the Crossref-deposited abstract; the full text was not consulted and the results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se consultó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.20944/preprints202109.0461.v1", "source_quote": "The purpose of this article is to introduce honeypots, the rise of IoT devices, and how they can be exploited by attackers.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "a5f0e915351a0223e696670d5b30fac631c94dbdaea4a26790d5007c52a1b104", "source_title": "Honeypots for Internet of Things Research: An Effective Mitigation Tool", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-20944-preprints202109-0461-v1", "kind": "paper", "name": "Honeypots for Internet of Things Research: An Effective Mitigation Tool", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-20944-preprints202109-0461-v1", "source_url": "https://doi.org/10.20944/preprints202109.0461.v1", "status": "published", "summary_en": "This article aims to introduce honeypots in the context of the Internet of Things (IoT), describe how IoT devices can be exploited by attackers, and investigate honeypot ecosystems for capturing and analyzing information from attacks against these IoT devices. The authors also state that they provide insights into the attack vectors present in most IoT systems, into understanding attack patterns, and into leveraging proactive strategies for IoT security.", "summary_es": "El artículo tiene como propósito introducir los honeypots en el contexto del Internet de las Cosas (IoT), describir cómo los dispositivos IoT pueden ser explotados por atacantes y examinar ecosistemas de honeypots para la captura y el análisis de información procedente de ataques contra dichos dispositivos. Los autores también señalan que buscan ofrecer perspectivas sobre los vectores de ataque presentes en la mayoría de los sistemas IoT y sobre el entendimiento de los patrones de ataque, así como sobre el uso de estrategias proactivas de seguridad en IoT.", "updated_at": "2026-10-16", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Zlatan Moric", "Leo Mršić", "Zdravko Kunić", "Goran Đambić"], "doi": "10.20944/preprints202408.0946.v1", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-018-2026-10-16.json", "eligibility_selection_report_sha256": "0d4c8e4dd83826c29510b63c3be15bf7d1705607bb8e7011f2aa9ea9a0851d39", "environments": ["Network", "Cloud"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "", "limitations_en": "Review based only on the Crossref-deposited abstract; the full text was not examined and results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se examinó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.20944/preprints202408.0946.v1", "source_quote": "As a part of the research, it analyzes the latest progress and innovations in honeypot development", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "cd12ad7c57c9218a2c38501cee749bfdfb3278135f763edf575ce0801db9d0df", "source_title": "Honeypots in Cybersecurity: Their Analysis, Evaluation and Importance", "techniques": ["Honeypot", "Decoy"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-20944-preprints202408-0946-v1", "kind": "paper", "name": "Honeypots in Cybersecurity: Their Analysis, Evaluation and Importance", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-20944-preprints202408-0946-v1", "source_url": "https://doi.org/10.20944/preprints202408.0946.v1", "status": "published", "summary_en": "The paper assesses a specific group of honeypot systems based on criteria such as detection range, emulation accuracy, data quality, dependability, scalability, and ease of setup, and draws conclusions about their relative effectiveness in different situations. It also discusses recent developments in honeypot technology, including machine learning enhancements, increased automation, integration with other security tools, cloud-based honeypots, and deception technology, using simulated attacks to demonstrate how these systems log and record attack information.", "summary_es": "El artículo evalúa un grupo específico de sistemas honeypot según criterios como el rango de detección, la precisión de emulación, la calidad de los datos, la fiabilidad, la escalabilidad y la facilidad de configuración, y presenta conclusiones sobre su efectividad relativa en distintos escenarios. También describe avances recientes en el desarrollo de honeypots, como mejoras en aprendizaje automático, mayor automatización, integración con otras herramientas de seguridad, honeypots en la nube y tecnología de decepción, usando ataques simulados para mostrar cómo estos sistemas registran información de ataque.", "updated_at": "2026-10-16", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Adam Putra", "Ade Eviyanti"], "doi": "10.21070/pels.v3i0.1336", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-019-2026-10-16.json", "eligibility_selection_report_sha256": "c17facbe1e34cc3222432c3ff984e56fc94cd9bc3ba0bc4101bb4b159e55bdca", "environments": ["Application"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Procedia of Engineering and Life Science", "limitations_en": "Review limited to the Crossref-deposited abstract; the full text was not examined and results, implementation robustness, or actual effectiveness were not independently verified.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se examinó el texto completo ni se verificaron de forma independiente los resultados, la solidez de la implementación o la eficacia real.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.21070/pels.v3i0.1336", "source_quote": "One of the methods used to prevent website security attacks is Honeypot. Honeypot is a system or computer that is deliberately used as bait to become a target for attacks from attackers.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "c5a4ec5cba0238c23450757cb1b9efeff0c97f7cbcc56447e08f0aa74c68fa72", "source_title": "Implementation of the Honeypot Method in Form Input Security Against Sql-Injection Attacks", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-21070-pels-v3i0-1336", "kind": "paper", "name": "Implementation of the Honeypot Method in Form Input Security Against Sql-Injection Attacks", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-21070-pels-v3i0-1336", "source_url": "https://doi.org/10.21070/pels.v3i0.1336", "status": "published", "summary_en": "The paper by Adam Putra and Ade Eviyanti addresses the security of website form inputs against SQL-injection attacks, and describes the honeypot method as a system or computer deliberately used as bait to become a target for attackers. The authors present this method as a way to prevent website security attacks.", "summary_es": "El artículo de Adam Putra y Ade Eviyanti aborda la seguridad de las entradas de formularios en sitios web frente a ataques de inyección SQL, y describe el método honeypot como un sistema o computadora que se usa deliberadamente como señuelo para atraer a los atacantes. Los autores presentan este método como una forma de prevenir ataques a la seguridad de sitios web.", "updated_at": "2026-10-16", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Muhammad Hasim Siregar", "Rosi Dermawati"], "doi": "10.21107/edutic.v7i1.8660", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-019-2026-10-16.json", "eligibility_selection_report_sha256": "c17facbe1e34cc3222432c3ff984e56fc94cd9bc3ba0bc4101bb4b159e55bdca", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Edutic - Scientific Journal of Informatics Education", "limitations_en": "This entry is based only on the title and abstract deposited in Crossref; the full text was not consulted, and neither the actual implementation nor the effectiveness of the results was verified.", "limitations_es": "Esta entrada se basa únicamente en el título y el resumen depositados en Crossref; no se ha consultado el texto completo, no se ha verificado la implementación real ni la eficacia de los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.21107/edutic.v7i1.8660", "source_quote": "A honeypot is a fake system the signed to trap attacker, as if it were a real system.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "dc420ad25014c9499c6baea0de76e75435e7720fa68485e7dc7a5e97aded2f4d", "source_title": "IMPLEMENTASI HONEYPOT PADA JARINGAN INTERNET LABOR FAKULTAS TEKNIK UNIKS MENGGUNAKAN DIONAEA SEBAGAI KEAMANAN JARINGAN", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-21107-edutic-v7i1-8660", "kind": "paper", "name": "IMPLEMENTASI HONEYPOT PADA JARINGAN INTERNET LABOR FAKULTAS TEKNIK UNIKS MENGGUNAKAN DIONAEA SEBAGAI KEAMANAN JARINGAN", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-21107-edutic-v7i1-8660", "source_url": "https://doi.org/10.21107/edutic.v7i1.8660", "status": "published", "summary_en": "The authors address the limitations of network security based only on a firewall and IDS, noting that IDS produces many notifications for administrators and does not work well in encrypted or IPv6 environments, and propose complementing it with a Dionaea honeypot. The work is framed as an analysis and implementation of a Dionaea honeypot as a decoy system to trap attackers on the internet network of the UNIKS Faculty of Engineering laboratory.", "summary_es": "Los autores abordan las limitaciones de la seguridad de red basada solo en firewall e IDS, señalando que el IDS genera numerosas notificaciones y no funciona bien en entornos cifrados o IPv6, y proponen complementarla con un honeypot Dionaea. El trabajo se plantea como un análisis e implementación de un honeypot Dionaea como sistema señuelo para atrapar atacantes en la red de internet del laboratorio de la Facultad de Ingeniería de UNIKS.", "updated_at": "2026-10-16", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Yasser A. Yasser", "Ahmed T. Sadiq", "Wasim AlHamdani"], "doi": "10.21123/bsj.2022.6930", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-019-2026-10-16.json", "eligibility_selection_report_sha256": "c17facbe1e34cc3222432c3ff984e56fc94cd9bc3ba0bc4101bb4b159e55bdca", "environments": ["Identity"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "Baghdad Science Journal", "limitations_en": "Review based solely on the Crossref-deposited abstract; the full text was not consulted and the experimental results were not independently verified.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se consultó el texto completo ni se verificaron de forma independiente los resultados experimentales.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.21123/bsj.2022.6930", "source_quote": "A honeychecker is an auxiliary server that distinguishes the real password from the fake passwords and triggers an alarm if intruder signs in using a honeyword.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "c87ae9a06cb1c3dec10f329871affc266fe4d1da955f0562647a0d58f4fa4521", "source_title": "Honeyword Generation Using a Proposed Discrete Salp Swarm Algorithm", "techniques": ["Honeytoken", "Decoy"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-21123-bsj-2022-6930", "kind": "paper", "name": "Honeyword Generation Using a Proposed Discrete Salp Swarm Algorithm", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-21123-bsj-2022-6930", "source_url": "https://doi.org/10.21123/bsj.2022.6930", "status": "published", "summary_en": "The work addresses honeyword generation: fake passwords that accompany the real password (the \"sugarword\") in a password-cracking detection system, where a honeychecker distinguishes the real password from the fake ones. The authors describe a honeyword generation method based on a proposed discrete salp swarm algorithm (SSA), a bio-inspired metaheuristic, and present the proposed methodology alongside experimental results compared with previous strategies.", "summary_es": "El trabajo aborda la generación de honeywords, contraseñas falsas que acompañan a la contraseña real (\"sugarword\") en un sistema de detección de descifrado de contraseñas, donde un honeychecker distingue la contraseña real de las falsas. Los autores describen un método de generación de honeywords basado en un algoritmo discreto de enjambre de salpas (SSA), una metaheurística bioinspirada, y presentan la metodología propuesta junto con resultados experimentales comparados con estrategias anteriores.", "updated_at": "2026-10-16", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Vishalakshi Prabhu", "Shankaramma Malige", "Prathmesh Sayal", "Ishan Chitkarsh", "Dhanush J", "Bhaskar Datta Paramkusam"], "doi": "10.21203/rs.3.rs-10466246/v1", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-019-2026-10-16.json", "eligibility_selection_report_sha256": "c17facbe1e34cc3222432c3ff984e56fc94cd9bc3ba0bc4101bb4b159e55bdca", "environments": ["IoT", "Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "", "limitations_en": "Review based only on the abstract deposited with Crossref, not on the full text or independent validation of results.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref, no en el texto completo ni en una validación independiente de los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.21203/rs.3.rs-10466246/v1", "source_quote": "I introduce HoneyMed, a protocol aware honeypot framework which simulates popular healthcare and IoT services, collects malicious interactions, transforms them to machine learning features, identifies attack types in real time, collects ledger-ready evidence via hashing with SHA-256.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "a4745878ec3a437c345bb3f760038491db61e0829afc2e2ed21dbb7fe2ef57ea", "source_title": "Smart Honeypot for Threat Detection and Classification in IoMt Networks", "techniques": ["Honeypot", "Decoy"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-21203-rs-3-rs-10466246-v1", "kind": "paper", "name": "Smart Honeypot for Threat Detection and Classification in IoMt Networks", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-21203-rs-3-rs-10466246-v1", "source_url": "https://doi.org/10.21203/rs.3.rs-10466246/v1", "status": "published", "summary_en": "The authors introduce HoneyMed, a protocol-aware honeypot framework that simulates healthcare and IoT services in order to collect malicious interactions, transform them into machine-learning tabular features, and classify attack types in real time. Its stated purpose is to provide threat visibility for IoMT security testbeds using decoys, feature extraction and lightweight classifiers, without interacting with production medical assets.", "summary_es": "Los autores presentan HoneyMed, un framework de honeypot consciente de protocolos que simula servicios sanitarios y de IoT para recoger interacciones maliciosas, convertirlas en características tabulares para aprendizaje automático y clasificar tipos de ataque en tiempo real. El propósito declarado es ofrecer visibilidad de amenazas en entornos de prueba de seguridad de IoMT mediante señuelos, extracción de características y clasificadores ligeros, sin interactuar con activos médicos en producción.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Mohamed Anwar Basha M", "Praveen Kumar K", "Priyadharshan V", "Ram Prabhu K K"], "doi": "10.21203/rs.3.rs-10946218/v1", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-019-2026-10-16.json", "eligibility_selection_report_sha256": "c17facbe1e34cc3222432c3ff984e56fc94cd9bc3ba0bc4101bb4b159e55bdca", "environments": ["Network", "Endpoint", "Application", "Identity"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "", "limitations_en": "This entry is based only on the title and abstract deposited with Crossref; the full text was not reviewed and results were not independently validated. The abstract itself states that the current prototype implements all four deception layers and passes 96 automated tests, with two layers confirmed operating live end-to-end and remaining live verification in progress.", "limitations_es": "Esta entrada se basa únicamente en el título y el resumen depositados en Crossref; no se examinó el texto completo ni se validaron de forma independiente los resultados. El propio resumen indica que el prototipo actual implementa las cuatro capas y pasa 96 pruebas automatizadas, con dos capas confirmadas en funcionamiento en vivo de extremo a extremo y el resto de la verificación en vivo aún en curso.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.21203/rs.3.rs-10946218/v1", "source_quote": "a decoy-agnostic DecoyAlertEvent schema that normalizes heterogeneous observations from these mechanisms into a common representation", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "dc551ce8a37c0a75c585d1f3d6f12b4a043af8cffa5db4169cd10e9c36d10120", "source_title": "Mirage Mesh: A Multi-Layer Cyber Deception Framework for Linux Environments", "techniques": ["Honeypot", "Honeytoken", "Decoy", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-21203-rs-3-rs-10946218-v1", "kind": "paper", "name": "Mirage Mesh: A Multi-Layer Cyber Deception Framework for Linux Environments", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-21203-rs-3-rs-10946218-v1", "source_url": "https://doi.org/10.21203/rs.3.rs-10946218/v1", "status": "published", "summary_en": "The authors present Mirage Mesh, a lightweight cyber deception framework for Linux environments that applies deception-in-depth across four layers: an SSH decoy built on Cowrie, a system-layer decoy administrative account, a fake Flask web administration interface, and a data-layer honeytoken credential file. The work proposes a shared DecoyAlertEvent schema to normalize observations from these layers, process them through a Wazuh-based detection and active-response pipeline with Python orchestration, map them to cyber kill-chain stages and MITRE ATT&CK techniques, and evaluate them with a Deception Effectiveness Metric (DEM).", "summary_es": "Los autores presentan Mirage Mesh, un marco ligero de engaño cibernético para entornos Linux que despliega decepción en profundidad mediante cuatro capas: un señuelo SSH basado en Cowrie, una cuenta administrativa señuelo a nivel de sistema, una interfaz web de administración falsa en Flask y un archivo de credenciales honeytoken. El trabajo propone un esquema común DecoyAlertEvent para normalizar las observaciones de estas capas, procesarlas mediante una canalización con Wazuh y orquestación en Python, mapearlas a etapas del cyber kill-chain y técnicas de MITRE ATT&CK, y evaluarlas con una métrica de efectividad de decepción (DEM).", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Sebastián Vargas Yáñez", "Sergio Tobón"], "doi": "10.21203/rs.3.rs-11002112/v1", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-019-2026-10-16.json", "eligibility_selection_report_sha256": "c17facbe1e34cc3222432c3ff984e56fc94cd9bc3ba0bc4101bb4b159e55bdca", "environments": ["OT/ICS", "Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "", "limitations_en": "Review is limited to the deposited abstract, checked against archived Crossref metadata; the full text was not examined and results were not independently validated. The authors state that demonstrated properties concern local software behavior and exported data, and do not establish full-platform reproducibility, cross-protocol consistency, physical fidelity or defensive superiority.", "limitations_es": "La revisión se limita al resumen depositado, verificado contra metadatos archivados de Crossref; no se examinó el texto completo ni se validaron de forma independiente los resultados. Los autores señalan que las propiedades demostradas conciernen al comportamiento del software local y a los datos exportados, y no establecen reproducibilidad de la plataforma completa, consistencia entre protocolos, fidelidad física ni superioridad defensiva.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.21203/rs.3.rs-11002112/v1", "source_quote": "We distinguish the documented platform from a local implementation linking Modbus, a revised Rust water-treatment surrogate and SQLite.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "e490e001313d50bb94fd79fed7c2a22f65ff5f1549980b7e02b65e4d84b4f337", "source_title": "HIVE-OT: Design, Implementation, and Reproducible Evaluation of a Process-Coupled Industrial Honeypot", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-21203-rs-3-rs-11002112-v1", "kind": "paper", "name": "HIVE-OT: Design, Implementation, and Reproducible Evaluation of a Process-Coupled Industrial Honeypot", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-21203-rs-3-rs-11002112-v1", "source_url": "https://doi.org/10.21203/rs.3.rs-11002112/v1", "status": "published", "summary_en": "The authors present HIVE-OT's design and implementation and evaluate the evidence supported by its process-coupled research core and historical exports, distinguishing the documented platform from a local implementation linking Modbus, a revised Rust water-treatment surrogate and SQLite. The study tests protocol behavior, command application and retained outcome representations, and audits two deployment exports containing 273978 and 842638 events.", "summary_es": "Los autores presentan el diseño e implementación de HIVE-OT y evalúan la evidencia aportada por su núcleo de investigación acoplado a procesos y exportaciones históricas, distinguiendo la plataforma documentada de una implementación local que enlaza Modbus, un sustituto de tratamiento de agua revisado en Rust y SQLite. El estudio verifica comportamiento de protocolo, aplicación de comandos y representaciones de resultados retenidos, y audita dos exportaciones de despliegue con 273978 y 842638 eventos.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Abbasgholi Pashaei", "Mohammad Esmaeil Esmaeil Akbari", "‪Mina Zolfy Lighvan", "Asghar Charmin"], "doi": "10.21203/rs.3.rs-1122586/v1", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-020-2026-10-16.json", "eligibility_selection_report_sha256": "517f1960e8d694cc2f48b90ba7ca0dd17f64936113acd9ce5d63e0204616a34f", "environments": ["OT/ICS", "Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "", "limitations_en": "Review based only on the Crossref-deposited abstract; the full text was not consulted and the results or described software were not independently verified.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se ha consultado el texto completo ni verificado de forma independiente los resultados ni el software descrito.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.21203/rs.3.rs-1122586/v1", "source_quote": "This paper proposes a novel Honeypot enhanced industrial Early Intrusion Detection System (EIDS) incorporated with Machine Learning (ML) algorithms.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "85f2abe5dda674b9aef9812cfeed172463a44799e424baf2e131ec835e81246b", "source_title": "Machine Learning-Based Early Intrusion Detection System in Industrial LAN Networks Using Honeypots", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-21203-rs-3-rs-1122586-v1", "kind": "paper", "name": "Machine Learning-Based Early Intrusion Detection System in Industrial LAN Networks Using Honeypots", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-21203-rs-3-rs-1122586-v1", "source_url": "https://doi.org/10.21203/rs.3.rs-1122586/v1", "status": "published", "summary_en": "The paper proposes an industrial Early Intrusion Detection System (EIDS) that combines honeypots with machine learning algorithms. The authors describe collecting data from honeypot and industrial device sensors, storing it in a database and analyzing it to alert on intrusions in industrial control networks.", "summary_es": "El artículo propone un sistema industrial de detección temprana de intrusiones (EIDS) que combina honeypots con algoritmos de aprendizaje automático. Los autores describen la recogida de datos de sensores de honeypots y de dispositivos industriales, su almacenamiento en una base de datos y su análisis para alertar sobre intrusiones en redes de control industrial.", "updated_at": "2026-10-16", "year": 2021}
{"critical_reading": null, "data": {"abstract_source_doi": "10.21203/rs.3.rs-1333285/v2", "access_date": "2026-10-16", "authors": ["Obieda Ananbeh"], "creator_name_aliases_inferred": false, "doi": "10.21203/rs.3.rs-1333285/v2", "doi_aliases": ["10.21203/rs.3.rs-1333285/v1"], "draft_review_basis": "deepseek-original-draft; codex-source-correction-and-independent-claude-review", "environments": ["OT/ICS"], "family_resource_count": 1, "family_scope_basis": [{"batch": 20, "candidate_id": "doi:10.21203/rs.3.rs-1333285/v1", "catalog_decision": null, "doi": "10.21203/rs.3.rs-1333285/v1", "existing_identifier_matches": [], "existing_title_matches": [], "identity_status": "declared-version-family-review-needed", "selection_report": "data/coverage/bibliography-deposited-third-crossref-020-2026-10-16.json", "selection_report_sha256": "517f1960e8d694cc2f48b90ba7ca0dd17f64936113acd9ce5d63e0204616a34f", "source_sha256": "bb7496862958d17be289a948f8110ec28931d58513e3ff1812e7af23f7d10bea", "title": "Improving ICS security through Honeynets and Machine Learning techniques", "year": 2022}, {"batch": 20, "candidate_id": "doi:10.21203/rs.3.rs-1333285/v2", "catalog_decision": null, "doi": "10.21203/rs.3.rs-1333285/v2", "existing_identifier_matches": [], "existing_title_matches": [], "identity_status": "declared-version-family-review-needed", "selection_report": "data/coverage/bibliography-deposited-third-crossref-020-2026-10-16.json", "selection_report_sha256": "517f1960e8d694cc2f48b90ba7ca0dd17f64936113acd9ce5d63e0204616a34f", "source_sha256": "92bf0544e98b5774443a0bc2ceec81e6ecfd515ac5da9cfa9240ad38a94abe59", "title": "Improving ICS security through Honeynets and Machine Learning techniques", "year": 2025}], "full_text_equality_claimed": false, "full_text_reviewed": false, "identity_report": "data/coverage/deposited-followup-family-review-2026-10-16.json", "identity_report_sha256": "d8486dc729d6c0aa6a91da335c385db7fbbce91367b6f1514f6601698918bdf8", "journal": null, "limitations_en": "Deposited abstract only; no full text was examined or results validated, and the contribution is presented as work in development.", "limitations_es": "Resumen depositado únicamente; no se examinó el texto completo ni se validaron resultados, y la contribución se presenta como trabajo en desarrollo.", "metadata_sha256": "92bf0544e98b5774443a0bc2ceec81e6ecfd515ac5da9cfa9240ad38a94abe59", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "source-page", "review_depth": "deposited abstract of DOI 10.21203/rs.3.rs-1333285/v2; version identity metadata; no full-text analysis", "reviewed_metadata_url": "https://api.crossref.org/works/10.21203/rs.3.rs-1333285/v2", "selection_report": "data/coverage/bibliography-deposited-third-crossref-020-2026-10-16.json", "selection_report_sha256": "517f1960e8d694cc2f48b90ba7ca0dd17f64936113acd9ce5d63e0204616a34f", "source_correction_input_sha256": "4fa4115afa49d4af38c167374ead455ecb37fc881172813a4370d6980e0f15e5", "source_document_url": "https://doi.org/10.21203/rs.3.rs-1333285/v2", "source_packet_sha256": "5489b82815bd468ee526cacf7f8d3e855f0173750e3941f15b7db6a750556525", "source_quote": "in this research, we are developing a new solution that improves the architecture of SCADA (An ICS System) by adding CamouflageNet Honeynet into it and ML techniques", "source_quote_locator": {"abstract_source_doi": "10.21203/rs.3.rs-1333285/v2", "field": "deposited abstract (HTML normalized)"}, "source_sha256": "92bf0544e98b5774443a0bc2ceec81e6ecfd515ac5da9cfa9240ad38a94abe59", "source_title": "Improving ICS security through Honeynets and Machine Learning techniques", "source_type": "deposited abstract of DOI 10.21203/rs.3.rs-1333285/v2; version identity metadata; no full-text analysis", "tags": [], "techniques": ["Honeypot"], "version_history": [{"creators": [{"affiliation": [{"name": "Oakland University"}], "family": "Ananbeh", "given": "Obieda", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "first"}, {"affiliation": [{"name": "Oakland University"}], "family": "Alomari", "given": "Rund", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}, {"affiliation": [{"name": "Oakland University"}], "family": "Daniell", "given": "Austin", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}], "doi": "10.21203/rs.3.rs-1333285/v1", "issued": {"date-parts": [[2022, 2, 8]]}, "metadata_sha256": "bb7496862958d17be289a948f8110ec28931d58513e3ff1812e7af23f7d10bea", "titles": ["Improving ICS security through Honeynets and Machine Learning techniques"]}, {"creators": [{"affiliation": [{"name": "Oakland University"}], "family": "Ananbeh", "given": "Obieda", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "first"}], "doi": "10.21203/rs.3.rs-1333285/v2", "issued": {"date-parts": [[2025, 8, 15]]}, "metadata_sha256": "92bf0544e98b5774443a0bc2ceec81e6ecfd515ac5da9cfa9240ad38a94abe59", "titles": ["Improving ICS security through Honeynets and Machine Learning techniques"]}]}, "evidence": "primary-source-passages", "id": "doi-10-21203-rs-3-rs-1333285-v2", "kind": "paper", "name": "Improving ICS security through Honeynets and Machine Learning techniques", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-21203-rs-3-rs-1333285-v2", "source_url": "https://doi.org/10.21203/rs.3.rs-1333285/v2", "status": "published", "summary_en": "Proposal describing the addition of a CamouflageNet honeynet and machine learning techniques into the SCADA architecture of an ICS system, aiming to improve defense and the ability to gather information about attackers.", "summary_es": "Propuesta que describe la incorporación de una honeynet CamouflageNet y técnicas de aprendizaje automático en la arquitectura SCADA de un sistema ICS, con el fin de mejorar la defensa y la capacidad de obtener información sobre los atacantes.", "updated_at": "2026-10-16", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Haroon Arif", "Farazul Hoda", "Aashesh Kumar"], "doi": "10.21203/rs.3.rs-3463725/v1", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-020-2026-10-16.json", "eligibility_selection_report_sha256": "517f1960e8d694cc2f48b90ba7ca0dd17f64936113acd9ce5d63e0204616a34f", "environments": ["Cloud"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-reviewed-followups-with-declared-families-checked", "journal": "", "limitations_en": "Review limited to the Crossref-deposited abstract; the full text was not examined and the described results or software were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se examinó el texto completo ni se validaron de forma independiente los resultados o el software descrito.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.21203/rs.3.rs-3463725/v1", "source_quote": "Using honeypots enhances cloud security, specifically focusing on implementing a honeypot on Azure Services.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "b1210bc9ff01f60eec12b7bf6d9c7687ee9d18ecec5bdd966b0c652a54eae73b", "source_title": "Establishing Cloud Security by Setting up Honeypot on Azure Services", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-21203-rs-3-rs-3463725-v1", "kind": "paper", "name": "Establishing Cloud Security by Setting up Honeypot on Azure Services", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-21203-rs-3-rs-3463725-v1", "source_url": "https://doi.org/10.21203/rs.3.rs-3463725/v1", "status": "published", "summary_en": "The paper describes implementing a honeypot on Azure Services as a supplement to customary cloud security measures, listing advantages such as prompt attack detection, recognition of attack methods, and safeguarding critical data. The authors outline steps including selecting a virtual machine, installing and configuring honeypot software, deploying monitoring and logging, establishing security groups, running a penetration test, and consistently monitoring the honeypot.", "summary_es": "El artículo describe la implementación de un honeypot en Azure Services como complemento a las medidas de seguridad en la nube, y enumera ventajas como la detección temprana de ataques, la identificación de métodos de ataque y la protección de datos críticos. Los autores detallan pasos como la selección de una máquina virtual, la instalación y configuración del software de honeypot, la implementación de monitoreo y registro, la creación de grupos de seguridad, la ejecución de una prueba de penetración y la vigilancia continua.", "updated_at": "2026-10-16", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Md Abu Sayed", "Ahmed Hemida", "Christopher Kiekintveld", "Charles Kamhoua"], "doi": "10.21203/rs.3.rs-3960163/v1", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/crossref-021-full-followup-review-2026-10-16.json", "eligibility_selection_report_sha256": "44e5892fd676e61ff5b701a7032a9f8bb95f18222e858fdac6e6f1906ba04cbd", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "", "limitations_en": "Assessment based solely on the Crossref-deposited abstract, without full-text reading or independent validation of results.", "limitations_es": "Evaluación basada únicamente en el resumen depositado en Crossref, sin lectura del texto completo ni validación independiente de los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.21203/rs.3.rs-3960163/v1", "source_quote": "Honeypots play a crucial role in implementing various cyber deception techniques as they can mislead attackers and divert them away from valuable assets.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "d790c5a8a4187a4a0aba1c5451ca62c68939174c8f9676f5d4eb587877a00247", "source_title": "Strategic Honeypot Allocation in Dynamic Networks: A Game-Theoretic Approach for Enhanced Cybersecurity", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-21203-rs-3-rs-3960163-v1", "kind": "paper", "name": "Strategic Honeypot Allocation in Dynamic Networks: A Game-Theoretic Approach for Enhanced Cybersecurity", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-21203-rs-3-rs-3960163-v1", "source_url": "https://doi.org/10.21203/rs.3.rs-3960163/v1", "status": "published", "summary_en": "The authors formulate a two-player dynamic game to model honeypot allocation in tactical networks whose connectivity changes with node mobility. They propose an iterative algorithm to find Nash equilibria and assess scalability through compact states and sensitivity analysis under imperfect information.", "summary_es": "Los autores formulan un juego dinámico de dos jugadores para modelar la asignación de honeypots en redes tácticas cuya conectividad cambia con la movilidad. Proponen un algoritmo iterativo para hallar equilibrios de Nash y evalúan su escalabilidad mediante estados compactos y análisis de sensibilidad ante información imperfecta.", "updated_at": "2026-10-16", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-16", "authors": ["Anand Kumar Mishra", "Amit Kumar Tyagi", "Shrikant Tiwari"], "creator_metadata_correction": null, "deposited_creators": [{"affiliation": [{"name": "NIIT University Neemrana, Rajasthan"}], "family": "Mishra", "given": "Anand Kumar", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "first"}, {"affiliation": [{"name": "National Institute of Fashion Technology New Delhi"}], "family": "Tyagi", "given": "Amit Kumar", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}, {"affiliation": [{"name": "Galgotias University, Greater Noida"}], "family": "Tiwari", "given": "Shrikant", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}], "doi": "10.21203/rs.3.rs-4156488/v1", "doi_aliases": [], "draft_review_basis": "deepseek-original-draft; codex-source-correction-and-independent-claude-review", "environments": ["Network"], "full_text_reviewed": false, "journal": null, "limitations_en": "Only selected pages (page 13) of the primary PDF were read; no full-text analysis or effectiveness testing.", "limitations_es": "Solo se leyeron páginas seleccionadas (página 13) del PDF primario; no hay análisis completo ni pruebas de eficacia.", "metadata_sha256": "6534ef4117f3ce34c477737761538f528fcd20a1d53246484501357bd533671d", "pdf_pages_read": [13], "pdf_source_sha256": "6f212360ae9e5f6dea33d43f81b7ae1fdc2ebcac4c44b8358eec275d586cae5a", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "source-page", "review_depth": "verified primary PDF, selected method/aim pages; not full-text analysis", "reviewed_metadata_url": "https://api.crossref.org/works/10.21203/rs.3.rs-4156488/v1", "selection_report": "data/coverage/crossref-wave2-pdf-source-review-2026-10-16.json", "selection_report_sha256": "0462d1abccf75269f1669fecacfabc11eb11383763a97c77bfbcfea7c3bebe46", "source_correction_input_sha256": "3968841e105306a227b72ecb8d61f9e1326e6507da91b619b896be4bf6cb8fae", "source_document_url": "https://assets-eu.researchsquare.com/files/rs-4156488/v1_covered_0bdcec8b-8b7a-4c06-b25c-775e0552f721.pdf?c=1711422349", "source_packet_sha256": "0a09a03dc02fd9cc05176d0b2c35d4b9cf2a1a217fa99fbab588415205907af8", "source_quote": "A honeypot is a security mechanism used to detect and deflect potential attackers or intruders", "source_quote_locator": {"normalization": "whitespace reflow", "pdf_page": 13, "pdf_sha256": "6f212360ae9e5f6dea33d43f81b7ae1fdc2ebcac4c44b8358eec275d586cae5a"}, "source_sha256": "6f212360ae9e5f6dea33d43f81b7ae1fdc2ebcac4c44b8358eec275d586cae5a", "source_title": "An Energy Efficient based Optical Network using Cloud Computing Techniques under an Improved Layer of Honeypots for Security", "source_type": "verified primary PDF, selected method/aim pages; not full-text analysis", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "primary-source-passages", "id": "doi-10-21203-rs-3-rs-4156488-v1", "kind": "paper", "name": "An Energy Efficient based Optical Network using Cloud Computing Techniques under an Improved Layer of Honeypots for Security", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-21203-rs-3-rs-4156488-v1", "source_url": "https://doi.org/10.21203/rs.3.rs-4156488/v1", "status": "published", "summary_en": "The paper proposes a honeypot layer to support security in an optical network with cloud services. The decoys simulate vulnerable resources to attract attackers and observe their behavior.", "summary_es": "El paper propone una capa de honeypots para apoyar la seguridad de una red óptica con servicios de nube. Los señuelos simulan recursos vulnerables para atraer atacantes y observar su comportamiento.", "updated_at": "2026-10-16", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["M Karthigha", "L Latha", "Sripriyan K"], "doi": "10.21203/rs.3.rs-4370529/v1", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/crossref-021-full-followup-review-2026-10-16.json", "eligibility_selection_report_sha256": "44e5892fd676e61ff5b701a7032a9f8bb95f18222e858fdac6e6f1906ba04cbd", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "", "limitations_en": "Review based only on the Crossref-deposited abstract, not the full text or independent validation of results.", "limitations_es": "Revisión basada solo en el resumen depositado en Crossref, no en el texto completo ni en validación independiente de resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.21203/rs.3.rs-4370529/v1", "source_quote": "A network design is proposed for the correct placement of a honeypot in the network.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "5dcbdcefbf447f42e7cebbafb59c17adc4c80e9785ed44770eb794f954fa68aa", "source_title": "Intelligent Honeypot-based IDS for Cyber Attack Detection using Generative Adversarial Networks", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-21203-rs-3-rs-4370529-v1", "kind": "paper", "name": "Intelligent Honeypot-based IDS for Cyber Attack Detection using Generative Adversarial Networks", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-21203-rs-3-rs-4370529-v1", "source_url": "https://doi.org/10.21203/rs.3.rs-4370529/v1", "status": "published", "summary_en": "The authors propose a network design for honeypot placement and an intrusion detection system aimed at identifying and alerting on illicit access, using traffic logs. They use datasets derived from a honeypot implementation and KDD-99, trained with generative adversarial networks, a deep learning-based generative model.", "summary_es": "Los autores proponen un diseño de red para colocar un honeypot y un sistema de detección de intrusiones orientado a identificar y alertar sobre accesos ilícitos, usando registros de tráfico. Emplean conjuntos de datos obtenidos de un honeypot y KDD-99, entrenados con redes generativas adversarias, un modelo generativo de aprendizaje profundo.", "updated_at": "2026-10-16", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Movva Sai Chaithanya", "Suresh Nikudiya", "Varsha S Basanaik", "Damodar Reddy", "Hanumanthu Bhukya"], "doi": "10.21203/rs.3.rs-670906/v1", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/crossref-021-full-followup-review-2026-10-16.json", "eligibility_selection_report_sha256": "44e5892fd676e61ff5b701a7032a9f8bb95f18222e858fdac6e6f1906ba04cbd", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "", "limitations_en": "Review based only on the Crossref deposited abstract; full text, reproducibility, and actual effectiveness were not verified.", "limitations_es": "Revisión basada solo en el resumen depositado en Crossref; no se verificó el texto completo, la reproducibilidad ni la eficacia real.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.21203/rs.3.rs-670906/v1", "source_quote": "a Venus fly-trap optimization algorithm has been used for implementing the honeypot system along with Intrusion Detection System", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "2487821742b43a3712fb9957501c0900a31bbb6b7bb4d9fe87d151d5b2b6ef35", "source_title": "Intelligent IDS: Venus Fly-trap Optimization with Honeypot Approach for Intrusion Detection and Prevention", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-21203-rs-3-rs-670906-v1", "kind": "paper", "name": "Intelligent IDS: Venus Fly-trap Optimization with Honeypot Approach for Intrusion Detection and Prevention", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-21203-rs-3-rs-670906-v1", "source_url": "https://doi.org/10.21203/rs.3.rs-670906/v1", "status": "published", "summary_en": "The paper proposes implementing a honeypot system alongside an Intrusion Detection System, using a Venus fly-trap optimization algorithm to interact with the attacker. The authors introduce a fitness function to estimate attacker size and compare their model with prior work through remote-to-local, probing, and DoS attacks.", "summary_es": "El artículo propone implementar un sistema honeypot junto con un Sistema de Detección de Intrusiones, empleando un algoritmo de optimización inspirado en la Venus atrapamoscas para interactuar con el atacante. Los autores presentan una función de aptitud para estimar el tamaño del atacante y comparan su modelo con trabajos previos mediante ataques remoto-a-local, de sondeo y DoS.", "updated_at": "2026-10-16", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Safieeldin Nasr Mohamed", "RAGHDA R. G. SHAFIQ", "Ahmed ESSAM", "Ahmed YASER", "ESRAA A. ALGOHARY", "Ezz OSMAN", "Mohamed AZAB", "Mohamed MOSBEH", "Saif HALAWA", "WAFAA F. MOHAMMED"], "doi": "10.21203/rs.3.rs-6719113/v1", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/crossref-021-full-followup-review-2026-10-16.json", "eligibility_selection_report_sha256": "44e5892fd676e61ff5b701a7032a9f8bb95f18222e858fdac6e6f1906ba04cbd", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "", "limitations_en": "Review limited to the Crossref-deposited abstract; the full text was not read, and results, implementation or software were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se leyó el texto completo ni se validaron de forma independiente los resultados, la implementación o el software.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.21203/rs.3.rs-6719113/v1", "source_quote": "SD-WAN enables advanced routing of critical traffic while concomitantly routing anomalous activity into Cowrie, a decoy environment that purports to replicate vulnerable services.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "4d20c0964679b90d23e1a96e536a03ae16bd7d1613580b3f422938961047c248", "source_title": "SD-WAN and Cowrie Honeypot Synergy in Modern Networks - From Traffic Optimization to Threat Trapping", "techniques": ["Honeypot", "Decoy"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-21203-rs-3-rs-6719113-v1", "kind": "paper", "name": "SD-WAN and Cowrie Honeypot Synergy in Modern Networks - From Traffic Optimization to Threat Trapping", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-21203-rs-3-rs-6719113-v1", "source_url": "https://doi.org/10.21203/rs.3.rs-6719113/v1", "status": "published", "summary_en": "The study integrates a honeypot into an SD-WAN architecture to combine traffic management and threat observation. The proposal routes anomalous activity into a decoy environment that simulates vulnerable services.", "summary_es": "El estudio integra un honeypot en una arquitectura SD-WAN para combinar gestión del tráfico y observación de amenazas. La propuesta desvía actividad anómala hacia un entorno señuelo que simula servicios vulnerables.", "updated_at": "2026-10-16", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Shang E. Tsai", "Ting T. Tsai", "Meng H. Aun"], "doi": "10.21203/rs.3.rs-9003091/v1", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/crossref-021-full-followup-review-2026-10-16.json", "eligibility_selection_report_sha256": "44e5892fd676e61ff5b701a7032a9f8bb95f18222e858fdac6e6f1906ba04cbd", "environments": ["Cloud", "Network", "Application"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "", "limitations_en": "Review limited to the deposited abstract; full text was not accessed and results were not validated.", "limitations_es": "Revisión limitada al resumen depositado; no se accedió al texto completo ni se validaron resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.21203/rs.3.rs-9003091/v1", "source_quote": "This paper presents an LLM-enabled, cloud-native dynamic honeypot architecture that treats the LLM as a strictly text-only synthesizer behind deterministic policy gating and state verification.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "e71a7d68be4cc4dc82816a7f5f5fb43fba691c204d9138affe9f8cddad2153ce", "source_title": "LLM-Enabled Cloud-Native Dynamic Honeypot Systems: Architecture, Ethical Governance, and Empirical Evaluation", "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-21203-rs-3-rs-9003091-v1", "kind": "paper", "name": "LLM-Enabled Cloud-Native Dynamic Honeypot Systems: Architecture, Ethical Governance, and Empirical Evaluation", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-21203-rs-3-rs-9003091-v1", "source_url": "https://doi.org/10.21203/rs.3.rs-9003091/v1", "status": "published", "summary_en": "The paper proposes an LLM-enabled cloud-native dynamic honeypot architecture in which the model acts only as a text synthesizer behind policy gating and state verification. The authors describe a session broker that classifies attacker commands rather than executing them, alongside ethical governance controls and an evaluation protocol.", "summary_es": "El artículo propone una arquitectura de honeypot dinámico nativo de la nube asistido por LLM, donde el modelo actúa solo como sintetizador de texto tras control de políticas y verificación de estado. Los autores describen un broker de sesión que clasifica comandos de atacantes y no los ejecuta, junto con controles de gobernanza ética y un protocolo de evaluación.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Iqra Hussain", "Monther Aldwairi", "Azka Wani"], "doi": "10.21203/rs.3.rs-9065129/v1", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/crossref-021-full-followup-review-2026-10-16.json", "eligibility_selection_report_sha256": "44e5892fd676e61ff5b701a7032a9f8bb95f18222e858fdac6e6f1906ba04cbd", "environments": ["Network", "Cloud", "IoT", "Application"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "", "limitations_en": "Review based only on the Crossref-deposited abstract; the full text was not read and results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se leyó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.21203/rs.3.rs-9065129/v1", "source_quote": "A dynamic AI-powered honeypot framework is proposed that integrates three capabilities into a single closed-loop defense pipeline", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "12775e467a8363b3314342aa48d8da4f70e2291c5142d61ce3b81894063d9507", "source_title": "AI-Driven Cyber Deception: A Reinforcement Learning Honeypot Framework with Threat Intelligence and Automated Containment", "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-21203-rs-3-rs-9065129-v1", "kind": "paper", "name": "AI-Driven Cyber Deception: A Reinforcement Learning Honeypot Framework with Threat Intelligence and Automated Containment", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-21203-rs-3-rs-9065129-v1", "source_url": "https://doi.org/10.21203/rs.3.rs-9065129/v1", "status": "published", "summary_en": "The authors propose a dynamic honeypot framework combining a reinforcement-learning deception agent (tabular Q-learning, formalized as an MDP), threat-intelligence fusion via indicators of compromise, and automated containment actions. Its purpose is to adapt the honeypot's exposed persona and guide deception decisions, evaluated in an isolated virtualized testbed.", "summary_es": "Los autores proponen un framework de honeypot dinámico que combina un agente de decepción con aprendizaje por refuerzo (Q-learning tabular, formalizado como MDP), fusión de inteligencia de amenazas mediante indicadores de compromiso y acciones automatizadas de contención. Su propósito es adaptar la persona expuesta del honeypot y guiar las decisiones de decepción, evaluándose en un testbed virtualizado aislado.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Utsav Goyal", "Abhishek Krishna", "Ankit Kumar", "Kapil Sharma"], "doi": "10.2139/ssrn.4157345", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-022-2026-10-16.json", "eligibility_selection_report_sha256": "8a462a8e4d352529155fdffa0ed9d75e7e0875f90f9697a352a81530b81856b4", "environments": ["IoT"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "", "limitations_en": "Review limited to the Crossref-deposited abstract; the full text was not examined and results were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se examinó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.2139/ssrn.4157345", "source_quote": "This study aims to secure IoT devices by using raspberry pi as a honeypot to imitate the IoT devices and check the user’s intent, analyze different attack patterns, and prevent IoT devices from existing attacks.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "51b4157e41c41306c09a9093104a4dbdd7262392f29430988aea012b4fadbb91", "source_title": "Detection And Prevention Of Cyber Attacks On Multi-purpose IoT Devices Using Honeypot", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-2139-ssrn-4157345", "kind": "paper", "name": "Detection And Prevention Of Cyber Attacks On Multi-purpose IoT Devices Using Honeypot", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-2139-ssrn-4157345", "source_url": "https://doi.org/10.2139/ssrn.4157345", "status": "published", "summary_en": "The study aims to secure IoT devices by using a Raspberry Pi as a honeypot to imitate those devices, check user intent, and analyze attack patterns. The authors implemented the Cowrie, Dionaea, and Glastopf honeypots on Raspberry Pi 4B to cover vulnerable protocols and record attacks.", "summary_es": "El estudio busca proteger dispositivos IoT usando una Raspberry Pi como honeypot para imitar dichos dispositivos, examinar la intención del usuario y analizar patrones de ataque. Los autores implementaron los honeypots Cowrie, Dionaea y Glastopf en Raspberry Pi 4B para cubrir protocolos vulnerables y registrar ataques.", "updated_at": "2026-10-16", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Xingsheng qin", "Frank Jiang", "Mingcan Cen", "Robin Doss"], "doi": "10.2139/ssrn.4302960", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-022-2026-10-16.json", "eligibility_selection_report_sha256": "8a462a8e4d352529155fdffa0ed9d75e7e0875f90f9697a352a81530b81856b4", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "", "limitations_en": "Review limited to the Crossref-deposited abstract only; the full text was not examined and results or implementations were not validated.", "limitations_es": "Revisión limitada únicamente al resumen depositado en Crossref; no se examinó el texto completo ni se validaron resultados o implementaciones.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.2139/ssrn.4302960", "source_quote": "This survey paper aims to provide a comprehensive understanding of the defensive approaches based on honey-X for cyber defense.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "a8c428c9b0570042d46a9d8e7fe124c528573e1ba4daf535ee1a113e0d614dcf", "source_title": "Hybrid Cyber Defense Strategies Using Honey-X: A Survey", "techniques": ["Honeypot", "Honeytoken", "Decoy", "Moving target defense"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-2139-ssrn-4302960", "kind": "paper", "name": "Hybrid Cyber Defense Strategies Using Honey-X: A Survey", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-2139-ssrn-4302960", "source_url": "https://doi.org/10.2139/ssrn.4302960", "status": "published", "summary_en": "This survey reviews and categorizes honey-X-based defense strategies, such as honeypots and honeytokens, which use deception to gather threat intelligence and protect networks. The authors also examine their combination with moving target defense, game theory and machine learning, and outline security quantification, challenges and future directions.", "summary_es": "Esta revisión revisa y clasifica estrategias defensivas basadas en honey-X, como honeypots y honeytokens, que emplean engaño para obtener inteligencia de amenazas y proteger redes. Los autores también examinan su combinación con defensa de objetivo móvil, teoría de juegos y aprendizaje automático, y presentan la cuantificación de seguridad y desafíos futuros.", "updated_at": "2026-10-16", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Aparna Tiwari"], "doi": "10.2139/ssrn.4306515", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-022-2026-10-16.json", "eligibility_selection_report_sha256": "8a462a8e4d352529155fdffa0ed9d75e7e0875f90f9697a352a81530b81856b4", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "", "limitations_en": "Review based only on the Crossref-deposited abstract; it does not imply full-text reading or independent validation of results.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no implica lectura del texto completo ni validación independiente de resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.2139/ssrn.4306515", "source_quote": "This paper gives an introduction about the honeypots, their classification based on purpose and interaction and also compares them on various aspects.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "2dc63b195f0eb2a50efb4fcbe882fbf1f9d9d373cfdb80b6f25215ed7a61139e", "source_title": "Comparitive Analysis of Various Honeypot Tools on the Basis of Their Classification and Features", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-2139-ssrn-4306515", "kind": "paper", "name": "Comparitive Analysis of Various Honeypot Tools on the Basis of Their Classification and Features", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-2139-ssrn-4306515", "source_url": "https://doi.org/10.2139/ssrn.4306515", "status": "published", "summary_en": "The paper introduces honeypots, their classification by purpose and interaction, and compares open-source tools across various aspects. Its purpose is to help readers protect resources from intruders using freely available network security tools.", "summary_es": "El artículo presenta los honeypots, su clasificación según propósito e interacción, y compara herramientas de código abierto en distintos aspectos. Su finalidad es ayudar a los lectores a proteger recursos frente a intrusos usando herramientas de seguridad de red disponibles gratuitamente.", "updated_at": "2026-10-16", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Tanuja Anantam"], "doi": "10.2139/ssrn.4484320", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-022-2026-10-16.json", "eligibility_selection_report_sha256": "8a462a8e4d352529155fdffa0ed9d75e7e0875f90f9697a352a81530b81856b4", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "", "limitations_en": "Review based only on the Crossref-deposited abstract; no full text was examined and no results were independently validated.", "limitations_es": "Revisión basada solo en el resumen depositado en Crossref; no se examinó el texto completo ni se verificaron resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.2139/ssrn.4484320", "source_quote": "In this report I will be discussing the concepts and types of honeypots then will discuss the challenges of deploying honeypots, advantages, and disadvantages.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "9270f7f9103577fa5151ba7aaec44cdba412e71b5f815e0cc73794a67f6bbccd", "source_title": "Honeypots: Concepts, Types and Challenges", "techniques": ["Honeypot", "Decoy"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-2139-ssrn-4484320", "kind": "paper", "name": "Honeypots: Concepts, Types and Challenges", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-2139-ssrn-4484320", "source_url": "https://doi.org/10.2139/ssrn.4484320", "status": "published", "summary_en": "This report reviews the concepts and types of honeypots, which organizations use as decoy networks to lure attackers, and discusses challenges of deploying them along with advantages and disadvantages.", "summary_es": "Este informe revisa los conceptos y tipos de honeypots, que las organizaciones usan como redes señuelo para atraer a atacantes, y discute los retos de su despliegue junto con ventajas y desventajas.", "updated_at": "2026-10-16", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Kartikey Ojha", "Vinay Bhardwaj", "Anurag Ranjan", "Pooja Das Mohapatra"], "doi": "10.2139/ssrn.4490357", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-022-2026-10-16.json", "eligibility_selection_report_sha256": "8a462a8e4d352529155fdffa0ed9d75e7e0875f90f9697a352a81530b81856b4", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "", "limitations_en": "This review is limited to the Crossref-deposited abstract; the full text was not examined and results were not independently validated.", "limitations_es": "La revisión se limita al resumen depositado en Crossref; no se examinó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.2139/ssrn.4490357", "source_quote": "All contacts with a honey pot are deemed to be hostile since there is no known way for actual clients to access one.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "2fe54d08f8a534d8c4a0e6df2ea2e4969f313c44a5edbcbe878c4e8a69bee24b", "source_title": "Honeypot: A Review", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-2139-ssrn-4490357", "kind": "paper", "name": "Honeypot: A Review", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-2139-ssrn-4490357", "source_url": "https://doi.org/10.2139/ssrn.4490357", "status": "published", "summary_en": "Review of the honeypot as a decoy system simulating an isolated real system on a network to entice attackers and detect, block or foresee attempts at unauthorized access. The authors describe a monitoring arrangement linking honeypot, main network and system-admin so hostile activity is detected before the main network is affected.", "summary_es": "Revisión sobre el honeypot como sistema señuelo que simula un sistema real y aislado en la red para atraer atacantes y detectar, bloquear o anticipar intentos de acceso no autorizado. Los autores describen un esquema de vigilancia que coordina honeypot, red principal y administrador para que la actividad hostil sea detectada antes de afectar la red.", "updated_at": "2026-10-16", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Mohammed A. Abdelmaguid", "Hossam Hassanein", "Mohammad Zulkernine"], "doi": "10.2139/ssrn.4918503", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-022-2026-10-16.json", "eligibility_selection_report_sha256": "8a462a8e4d352529155fdffa0ed9d75e7e0875f90f9697a352a81530b81856b4", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "", "limitations_en": "Review limited to the Crossref-deposited abstract; full text, reproducibility and actual effectiveness were not verified.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se verificó el texto completo, la reproducibilidad ni la eficacia real.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.2139/ssrn.4918503", "source_quote": "Combining Machine Learning (ML) algorithms with honeypots, we offer a comprehensive defense for Vehicular Ad-hoc Networks (VANETs), adept at detecting anticipated and unexpected attacks through attack rate analysis.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "47e25e40cce0681a689b1c0497a8694b12ffe24d30b7c5b0888b9d08610b509a", "source_title": "Securing the Unforeseen: Enhancing Vanet Security with Dynamic Honeypots and Attack Rate Analysis", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-2139-ssrn-4918503", "kind": "paper", "name": "Securing the Unforeseen: Enhancing Vanet Security with Dynamic Honeypots and Attack Rate Analysis", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-2139-ssrn-4918503", "source_url": "https://doi.org/10.2139/ssrn.4918503", "status": "published", "summary_en": "The paper examines the origin of trust in trust management systems by linking it to the network attack rate, aiming to refine trust assessments and predict new attacks. The authors describe a strategy combining machine learning and dynamic honeypots to detect prepared-for attacks and predict unprepared-for attacks in vehicular ad hoc networks (VANETs).", "summary_es": "El artículo examina el origen de la confianza en sistemas de gestión de confianza vinculándolo a la tasa de ataques de red, con el fin de refinar evaluaciones y predecir ataques nuevos. Los autores describen una estrategia que combina aprendizaje automático y honeypots dinámicos para detectar ataques anticipados y predecir los no anticipados en redes vehiculares ad hoc (VANET).", "updated_at": "2026-10-16", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Mohit Garg", "Aryendra Dalal", "Mukul Mangla", "Lav Upadhyay", "Mukesh Soni", "Keshav Kaushik"], "doi": "10.2139/ssrn.5881902", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-023-2026-10-16.json", "eligibility_selection_report_sha256": "08311c53c1d05afbb655e55b1e0b890c9e94c0994040c0762e6845e416f17b35", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "", "limitations_en": "Review based only on the abstract deposited in Crossref, without full-text access or independent validation of results.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref, sin acceso al texto completo ni validación independiente de resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.2139/ssrn.5881902", "source_quote": "Because it uses deep neural networks for pattern recognition with symbolic reasoning, the approach marries data-driven and interpretative logic-based techniques to identify, predict, and respond to complex cyber adversaries.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "1b979d8ce7d06998d6282d0dadd77d81c03a205283bd750b46e2b713ca559064", "source_title": "Neuro-Symbolic Fusion for Cognitive Threat Reasoning in Cyber Deception Environments", "techniques": ["Decoy", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-2139-ssrn-5881902", "kind": "paper", "name": "Neuro-Symbolic Fusion for Cognitive Threat Reasoning in Cyber Deception Environments", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-2139-ssrn-5881902", "source_url": "https://doi.org/10.2139/ssrn.5881902", "status": "published", "summary_en": "The authors propose a neuro-symbolic fusion approach for cognitive threat reasoning in cyber deception environments. It combines deep neural networks with symbolic reasoning, using knowledge graphs, probabilistic logic, and reinforcement learning to identify, predict, and respond to adversaries and to optimize deception strategies.", "summary_es": "Los autores proponen un enfoque de fusión neuro-simbólica para el razonamiento cognitivo de amenazas en entornos de engaño cibernético. Combina redes neuronales profundas con razonamiento simbólico, usando grafos de conocimiento, lógica probabilística y aprendizaje por refuerzo para identificar, predecir y responder a adversarios y optimizar estrategias de engaño.", "updated_at": "2026-10-16", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Dongyoung Park", "Gaby Dagher"], "doi": "10.2139/ssrn.6172023", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-023-2026-10-16.json", "eligibility_selection_report_sha256": "08311c53c1d05afbb655e55b1e0b890c9e94c0994040c0762e6845e416f17b35", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "", "limitations_en": "Review based only on the Crossref-deposited abstract; the full text was not examined and results or implementation were not validated.", "limitations_es": "Revisión basada solo en el resumen depositado en Crossref; no se examinó el texto completo ni se validaron resultados o implementación.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.2139/ssrn.6172023", "source_quote": "The defender maintains a posterior over attacker types from noisy IDS/honeypot observations and, at each round, re-optimizes the defense by solving a DOBSS-style multi-follower mixed-integer linear program (MILP) under the current belief state.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "334d40b692fe5e34562f97cc13c9a5896649d9bbd97f1fb008f699cd69b9712b", "source_title": "Adaptive Honeypot Allocation in Multi‑Attacker Networks via Bayesian Stackelberg Games", "techniques": ["Honeypot", "Decoy", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-2139-ssrn-6172023", "kind": "paper", "name": "Adaptive Honeypot Allocation in Multi‑Attacker Networks via Bayesian Stackelberg Games", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-2139-ssrn-6172023", "source_url": "https://doi.org/10.2139/ssrn.6172023", "status": "published", "summary_en": "The authors present a multi-attacker Bayesian Stackelberg framework for allocating honeypots in a directed network, modeling each attacker as a follower with a latent type and the defender as replanning via a DOBSS-style mixed-integer linear program under posterior beliefs. They aim to scale defense to realistic graphs using layered structures and pruning.", "summary_es": "Los autores presentan un marco bayesiano de Stackelberg con múltiples atacantes para asignar honeypots en una red dirigida, modelando a cada atacante como seguidor con tipo latente y al defensor reoptimizando mediante un programa lineal entero mixto estilo DOBSS bajo creencias posteriores. Buscan escalar la defensa a grafos realistas mediante estructuras por capas y poda.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["David Tom Foss"], "doi": "10.2139/ssrn.6196620", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-023-2026-10-16.json", "eligibility_selection_report_sha256": "08311c53c1d05afbb655e55b1e0b890c9e94c0994040c0762e6845e416f17b35", "environments": ["OT/ICS", "Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "", "limitations_en": "Review based only on the Crossref deposited abstract; the full text was not examined and the results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se examinó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.2139/ssrn.6196620", "source_quote": "We deploy a maritime SCADA honeypot simulating a North Sea pipeline monitoring gateway across six protocols (Modbus TCP, SNMP, HTTP/HMI, NMEA 0183, MQTT, SSH)", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "17313a5d8d2c74de5bca9d74649fb0f94e5997be9b58eb4b594735d08cd60ecd", "source_title": "HoneyPrompt: Multi-Sensor Fusion for Detection and Classification of Autonomous AI Agents in Maritime Industrial Control Systems", "techniques": ["Honeypot", "Honeytoken", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-2139-ssrn-6196620", "kind": "paper", "name": "HoneyPrompt: Multi-Sensor Fusion for Detection and Classification of Autonomous AI Agents in Maritime Industrial Control Systems", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-2139-ssrn-6196620", "source_url": "https://doi.org/10.2139/ssrn.6196620", "status": "published", "summary_en": "The work presents HoneyPrompt, a multi-sensor fusion architecture for detecting and classifying autonomous AI agents that interact with industrial control systems. The authors deploy a maritime SCADA honeypot simulating a pipeline monitoring gateway across six protocols and instrument it with a graduated prompt injection acting as a sensor array.", "summary_es": "El trabajo presenta HoneyPrompt, una arquitectura de fusión multisensor para detectar y clasificar agentes de IA autónomos que interactúan con sistemas de control industrial. Los autores despliegan un honeypot SCADA marítimo que simula una pasarela de monitoreo de oleoductos en seis protocolos y lo instrumentan con una inyección de prompts graduada como matriz de sensores.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Pedro Beltrán", "Manuel Gil Pérez", "Pantaleone Nespoli"], "doi": "10.2139/ssrn.6223241", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-023-2026-10-16.json", "eligibility_selection_report_sha256": "08311c53c1d05afbb655e55b1e0b890c9e94c0994040c0762e6845e416f17b35", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "", "limitations_en": "Review limited to the Crossref deposited abstract; the full text, software and independent validity of results were not examined, and results are the authors' claims.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se examinó el texto completo, el software ni la validez independiente de los resultados, que son afirmaciones de los autores.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.2139/ssrn.6223241", "source_quote": "These signals are continuously analyzed to infer threat actor profiles, allowing the system to anticipate actions and support proactive decisions.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "55e01cb2e0caa1c97437387cf73e4043880fd5309e79c154ae194710bf11951a", "source_title": "Enhancing Strategic Decision-Making via Semantic Inference: An Antifragile Framework for Deception-Based Threat Profiling", "techniques": ["Decoy", "Adversary engagement", "Moving target defense"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-2139-ssrn-6223241", "kind": "paper", "name": "Enhancing Strategic Decision-Making via Semantic Inference: An Antifragile Framework for Deception-Based Threat Profiling", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-2139-ssrn-6223241", "source_url": "https://doi.org/10.2139/ssrn.6223241", "status": "published", "summary_en": "The authors propose an antifragile framework that uses cyber deception with adaptive decoys and dynamic network movements to generate adversarial signals, infer threat actor profiles and support proactive decisions. A cyber threat intelligence ontology and a knowledge graph with semantic attributes represent tactical and strategic relationships between attackers and targets.", "summary_es": "Los autores proponen un marco antifrágil que emplea engaño cibernético con señuelos adaptativos y movimientos dinámicos de red para generar señales adversarias, inferir perfiles de actores de amenaza y apoyar decisiones proactivas. Una ontología de inteligencia de amenazas y un grafo de conocimiento con atributos semánticos representan relaciones tácticas y estratégicas entre atacantes y objetivos.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Bhoomika Manjunath", "Nidhi S", "Yashwitha A", "Seema C K"], "doi": "10.2139/ssrn.6462120", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-024-2026-10-16.json", "eligibility_selection_report_sha256": "01825d05891d08ec6f2297a9f49773c4a251b11ece974b6c2ec999663ba29af5", "environments": ["IoT"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "", "limitations_en": "Review based only on the Crossref-deposited abstract; the full text was not examined and results were not independently validated.", "limitations_es": "Revisión basada solo en el resumen depositado en Crossref; no se verificó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.2139/ssrn.6462120", "source_quote": "HIVE-O deploys lightweight, distributed honeypot nodes that collaboratively capture, analyze, and share attack intelligence without relying on a single point of control.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "00a2532f35400a22e5c60178b35dbaac7406422f5ec04fa8c399aaf56a86208e", "source_title": "HIVE-O: A Decentralized Honeypot Framework for IoT Devices", "techniques": ["Honeypot", "Decoy"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-2139-ssrn-6462120", "kind": "paper", "name": "HIVE-O: A Decentralized Honeypot Framework for IoT Devices", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-2139-ssrn-6462120", "source_url": "https://doi.org/10.2139/ssrn.6462120", "status": "published", "summary_en": "The paper proposes HIVE-O, a decentralized honeypot framework for IoT ecosystems, with lightweight distributed nodes that capture, analyze and share attack intelligence without a single point of control. The authors describe emulation of IoT services and protocols and an experimental evaluation of reconnaissance, exploitation and denial-of-service attempts.", "summary_es": "El artículo propone HIVE-O, un marco de honeypots descentralizado para ecosistemas IoT, con nodos ligeros y distribuidos que capturan, analizan y comparten inteligencia de ataques sin un único punto de control. Los autores describen la emulación de servicios y protocolos IoT y una evaluación experimental de intentos de reconocimiento, explotación y denegación de servicio.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Abraham Itzhak Weinberg"], "doi": "10.2139/ssrn.6710478", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-024-2026-10-16.json", "eligibility_selection_report_sha256": "01825d05891d08ec6f2297a9f49773c4a251b11ece974b6c2ec999663ba29af5", "environments": [], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "", "limitations_en": "Review limited to the Crossref deposited abstract; no full text was examined, results were not replicated, and real-world effectiveness is not validated.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se examinó el texto completo, no se replicaron resultados y no se valida la eficacia real del sistema.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.2139/ssrn.6710478", "source_quote": "We formalise honeytoken quality through a four-component Believability Score that captures syntactic validity, semantic coherence, statistical plausibility, and human acceptance.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "1df87e765e6aa7d437a8fa294b5b4fa9dd9e2cd3e8954a7d4539aeffd1a2852d", "source_title": "<div> PHANTOM: Polymorphic Honeytoken Adaptation with Narrative-tailored Organisational Mimicry&nbsp; </div> <div> Contextually Convincing Cyber Deception at Scale </div>", "techniques": ["Honeytoken", "Decoy"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-2139-ssrn-6710478", "kind": "paper", "name": "<div> PHANTOM: Polymorphic Honeytoken Adaptation with Narrative-tailored Organisational Mimicry&nbsp; </div> <div> Contextually Convincing Cyber Deception at Scale </div>", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-2139-ssrn-6710478", "source_url": "https://doi.org/10.2139/ssrn.6710478", "status": "published", "summary_en": "The paper presents PHANTOM, a framework that generates honeytokens by encoding organisation-specific knowledge (domain names, service naming conventions, technology-stack idioms and realistic secret-value distributions) into a multi-component pipeline. The authors formalise a four-component believability score and use it to compare PHANTOM against a template-based baseline.", "summary_es": "El artículo presenta PHANTOM, un marco que genera honeytokens codificando conocimiento específico de la organización (nombres de dominio, convenciones de servicios, lenguajes tecnológicos y distribuciones realistas de secretos) en una tubería multicomponente. Los autores formalizan una puntuación de credibilidad de cuatro componentes y la usan para comparar PHANTOM con una línea base de plantillas.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Prosper Yeng", "Mattias  Tsegaye Gebrie", "Livinus  Obiora Nweke", "John-Bosco Diekuu", "Mohamed Elhadad"], "doi": "10.2139/ssrn.6915106", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-024-2026-10-16.json", "eligibility_selection_report_sha256": "01825d05891d08ec6f2297a9f49773c4a251b11ece974b6c2ec999663ba29af5", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "", "limitations_en": "This is an abstract-depth review only; the full text was not read, and stated reproducibility or effectiveness was not independently verified.", "limitations_es": "Revisión limitada al resumen depositado; no se leyó el texto completo ni se verificaron la reproducibilidad o la efectividad declarada.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.2139/ssrn.6915106", "source_quote": "This paper presents TrustFed-Honeypot, a reliability-aware hybrid federated-retraining framework for honeypot-based IDS.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "ec3c05cdbbd1814217d0ffd69be72cd9779091d3e2150a7da8171c0aace4015f", "source_title": "TrustFed-Honeypot: Multi-Signal Trust-Aware Federated IntrusionDetection", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-2139-ssrn-6915106", "kind": "paper", "name": "TrustFed-Honeypot: Multi-Signal Trust-Aware Federated IntrusionDetection", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-2139-ssrn-6915106", "source_url": "https://doi.org/10.2139/ssrn.6915106", "status": "published", "summary_en": "The paper presents TrustFed-Honeypot, a hybrid federated-retraining framework for honeypot-based IDS. Clients train locally, and the server retrains a global logistic model on samples weighted by a multi-signal behavioral trust model, aiming to reshape the retraining distribution.", "summary_es": "El artículo presenta TrustFed-Honeypot, un marco híbrido federado con reentrenamiento para IDS basados en honeypots. Los clientes entrenan localmente y el servidor reentrena un modelo logístico global sobre muestras ponderadas por un modelo de confianza conductual multis señal, con el fin de remodelar la distribución de reentrenamiento.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Francesco  Aurelio Pironti", "Angelo Furfaro", "Francesco Blefari", "Carmelo Felicetti", "Matteo Lupinacci", "Francesco Romeo"], "doi": "10.2139/ssrn.7115976", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-024-2026-10-16.json", "eligibility_selection_report_sha256": "01825d05891d08ec6f2297a9f49773c4a251b11ece974b6c2ec999663ba29af5", "environments": ["OT/ICS", "Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "", "limitations_en": "Review based only on the Crossref-deposited abstract; full text, implementation and independent results were not verified.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se verificaron el texto completo, la implementación ni resultados independientes.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.2139/ssrn.7115976", "source_quote": "we introduce a modular honeynet framework named ICSLure", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "a7e15b68eb688cdbc13aeb2bff3028ababb7ca8736fc96de1106ab8278be80e9", "source_title": "ICSLure: A Very High Interaction Honeynet for PLC-based Industrial Control Systems", "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-2139-ssrn-7115976", "kind": "paper", "name": "ICSLure: A Very High Interaction Honeynet for PLC-based Industrial Control Systems", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-2139-ssrn-7115976", "source_url": "https://doi.org/10.2139/ssrn.7115976", "status": "published", "summary_en": "The authors introduce ICSLure, a modular honeynet framework intended to emulate realistic industrial control system environments. It integrates physical PLCs with live data sources over industrial protocols and virtualized network components, with monitoring to log attacker interactions.", "summary_es": "Los autores presentan ICSLure, un marco modular de honeynet destinado a emular entornos realistas de sistemas de control industrial. Integra PLC físicos con fuentes de datos en vivo mediante protocolos industriales y componentes de red virtualizados, con monitorización para registrar interacciones de atacantes.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Arshad Iqbal", "Sohail Asghar"], "doi": "10.2139/ssrn.7116726", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-024-2026-10-16.json", "eligibility_selection_report_sha256": "01825d05891d08ec6f2297a9f49773c4a251b11ece974b6c2ec999663ba29af5", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "", "limitations_en": "Review based only on the deposited abstract; the full text was not read and results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado; no se leyó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.2139/ssrn.7116726", "source_quote": "Deception-based Moving Target Defense (MTD) is widely used to reverse the attacker-defender asymmetry in cyberspace", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "d4634a6d1b3658c09a60d54829baf29c003988ef403ce96b6fcafdd13a4142ab", "source_title": "A Unified Game-Theoretic and Transformer-Learned Framework for Quantifying, Modeling, and Optimizing Cyber Deception", "techniques": ["Decoy", "Moving target defense"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-2139-ssrn-7116726", "kind": "paper", "name": "A Unified Game-Theoretic and Transformer-Learned Framework for Quantifying, Modeling, and Optimizing Cyber Deception", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-2139-ssrn-7116726", "source_url": "https://doi.org/10.2139/ssrn.7116726", "status": "published", "summary_en": "The paper proposes a framework combining game theory with transformer-based components to quantify, model, and optimize cyber deception. The authors define deception attack-surface metrics and embed them in a signaling game, aiming to guide adaptive deception strategies.", "summary_es": "El artículo propone un marco que combina teoría de juegos con componentes basados en transformers para cuantificar, modelar y optimizar el engaño cibernético. Los autores definen métricas de superficie de ataque engañosa y las integran en un juego de señalización, con el fin de orientar estrategias de decepción adaptativas.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Mathis DURAND", "Yvon KERMARREC", "Marc-Oliver Pahl"], "doi": "10.2139/ssrn.7134023", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-024-2026-10-16.json", "eligibility_selection_report_sha256": "01825d05891d08ec6f2297a9f49773c4a251b11ece974b6c2ec999663ba29af5", "environments": [], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "", "limitations_en": "Review limited to the deposited Crossref abstract; no full text was accessed and findings were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se accedió al texto completo ni se validaron los resultados de forma independiente.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.2139/ssrn.7134023", "source_quote": "Honeypots are widely used to observe, analyze, and deflect malicious activity, yet their value depends on remaining indistinguishable from real systems.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "552066391c92673d01baba91198f5080d663ad9865524d0deef3a0065508c5ed", "source_title": "From Evasion to Resilience: Mapping Anti‐Honeypot Strategies and Their Mitigation", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-2139-ssrn-7134023", "kind": "paper", "name": "From Evasion to Resilience: Mapping Anti‐Honeypot Strategies and Their Mitigation", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-2139-ssrn-7134023", "source_url": "https://doi.org/10.2139/ssrn.7134023", "status": "published", "summary_en": "The authors conduct a systematic literature review and introduce a taxonomy characterizing honeypot detection techniques across contextual and technical dimensions, framing detection as identifying inconsistencies between observable system properties and attacker expectations. They map existing evasion and detection methods to this taxonomy, analyze the gap between academic techniques and those used in practice, and outline mitigation strategies and design principles aimed at improving honeypot resilience.", "summary_es": "Los autores realizan una revisión sistemática de la literatura y proponen una taxonomía que caracteriza las técnicas de detección de honeypots según dimensiones contextuales y técnicas, enmarcándolas como la identificación de inconsistencias entre propiedades observables y expectativas del atacante. Asimismo, mapean métodos de evasión y detección, analizan la brecha entre técnicas académicas y prácticas, y delinean estrategias de mitigación y principios de diseño para la resiliencia de honeypots.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Joshua S. Gans"], "doi": "10.2139/ssrn.7284061", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-025-2026-10-16.json", "eligibility_selection_report_sha256": "d093663b26c60e005750c243427a287bcd2f21b05d461e63d89cc17bc86ebcef", "environments": [], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "", "limitations_en": "Review based only on the abstract deposited in Crossref; the full text was not consulted and the results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se consultó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.2139/ssrn.7284061", "source_quote": "A honeytoken-a decoy credential or record whose use reveals an intruder-produces defence intelligence only if an adversary sometimes treats it as genuine.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "809a0320fa090f20d34b486b974f197ee22030b148a645bfe2cec6816628703b", "source_title": "Calibrated Bait: Defensive Information Design under Adversarial Fingerprinting", "techniques": ["Honeytoken", "Decoy"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-2139-ssrn-7284061", "kind": "paper", "name": "Calibrated Bait: Defensive Information Design under Adversarial Fingerprinting", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-2139-ssrn-7284061", "source_url": "https://doi.org/10.2139/ssrn.7284061", "status": "published", "summary_en": "The author models honeytokens as an information design problem followed by receiver information acquisition, where an adversary can pay to fingerprint the bait. The analysis examines how installed trap prevalence, fingerprinting costs, and adjustment costs affect bait calibration and trap activation.", "summary_es": "El autor modela los honeytokens como un problema de diseño de información seguido de adquisición de información por el adversario, quien puede pagar por identificarlos mediante fingerprinting. Analiza cómo la prevalencia de trampas instaladas, los costos de fingerprinting y los costos de ajuste afectan la calibración del señuelo y la activación de trampas.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Po-Yu Chen", "Hsiang-Wen Hsing", "Jinwoo Oh", "Nathan Lau", "Brandon Beltz", "Jim Doty", "Stoney Trent", "Yvonne Fonken", "Peggy Wu", "Kunal Srivastava", "Nikolos Gurney", "Quanyan Zhu"], "doi": "10.2139/ssrn.7372012", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-025-2026-10-16.json", "eligibility_selection_report_sha256": "d093663b26c60e005750c243427a287bcd2f21b05d461e63d89cc17bc86ebcef", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "", "limitations_en": "Review based solely on the Crossref deposited abstract, not on the full text or independent validation of results.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref, no en el texto completo ni en validación independiente de resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.2139/ssrn.7372012", "source_quote": "Current cyber defense emphasizes technical hardening, overlooking the cognitive vulnerabilities of the human attackers in mitigating impacts of the cyber-attacks.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "41d0bbb24198a37962710105919321d38eff35864587fc0ab3b0a5eac6a93343", "source_title": "Exploiting Type I Cognitive Processing with Bias Triggers for Cyber Defense: Effects on Network Penetration and Attack Resource Allocation", "techniques": ["Decoy", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-2139-ssrn-7372012", "kind": "paper", "name": "Exploiting Type I Cognitive Processing with Bias Triggers for Cyber Defense: Effects on Network Penetration and Attack Resource Allocation", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-2139-ssrn-7372012", "source_url": "https://doi.org/10.2139/ssrn.7372012", "status": "published", "summary_en": "The study investigates whether psychologically engineered \"bias triggers\" can exploit human attackers' Type I heuristic processing to degrade their performance. The authors use a high-fidelity cyber range where participants conduct network penetration with and without these triggers, analyzing operational telemetry.", "summary_es": "El estudio investiga si los \"bias triggers\" (disparadores de sesgo) diseñados psicológicamente pueden explotar el procesamiento heurístico tipo I de atacantes humanos para degradar su desempeño. Los autores emplean un rango cibernético de alta fidelidad donde participantes realizan penetración de red con y sin estos disparadores, y analizan telemetría operativa.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Cherin Lim", "John Diaz", "Bleema Rosenfeld", "Sridhar Venkatesan", "John Banya", "Jonathan Pfautz", "Palvi Aggarwal", "Cleotilde Gonzalez", "Prashanth Rajivan"], "doi": "10.2139/ssrn.7438602", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-025-2026-10-16.json", "eligibility_selection_report_sha256": "d093663b26c60e005750c243427a287bcd2f21b05d461e63d89cc17bc86ebcef", "environments": ["Network", "Endpoint"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "", "limitations_en": "Review limited to the Crossref deposited abstract; full text was not accessed and results were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se accedió al texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.2139/ssrn.7438602", "source_quote": "Using two experiments, this study examines how anchoring effects would influence attackers’ decisions in specific cyberattack scenarios.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "12e6c264fa14cedbaa78811408b0159a607f10ae001dc25be7c31326e940ebf1", "source_title": "Anchoring Cyber Deception: Evaluating Anchoring Effects in Attacker Choices", "techniques": ["Decoy", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-2139-ssrn-7438602", "kind": "paper", "name": "Anchoring Cyber Deception: Evaluating Anchoring Effects in Attacker Choices", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-2139-ssrn-7438602", "source_url": "https://doi.org/10.2139/ssrn.7438602", "status": "published", "summary_en": "This study examines how anchoring effects influence attackers' decisions in specific cyberattack scenarios through two experiments. Experiment 1 compares anchoring measurement methods in Crontab and Hostname tasks; Experiment 2 embeds bias triggers within an end-to-end cyber kill chain scenario.", "summary_es": "Este estudio examina cómo los efectos de anclaje influyen en las decisiones de los atacantes en escenarios de ciberataque, mediante dos experimentos. El primero compara métodos de medición del anclaje en tareas de Crontab y nombres de host; el segundo integra disparadores de sesgo en una cadena de ataque de extremo a extremo.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Kuban State Technological University", "MIKHAIL M PUTYATO", "ALEKSANDR S. MAKARYAN", "Kuban State Technological University", "SHAMIL M. CHICH", "Kuban State Technological University", "VALENTINA K. MARKOVA", "Kuban State Technological University"], "doi": "10.21672/2074-1707.2020.52.4.085-098", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-025-2026-10-16.json", "eligibility_selection_report_sha256": "d093663b26c60e005750c243427a287bcd2f21b05d461e63d89cc17bc86ebcef", "environments": ["IoT"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "CASPIAN JOURNAL: Control and High Technologies", "limitations_en": "Review limited to the Crossref-deposited abstract; the full text was not read and the described results were not independently verified.", "limitations_es": "Evaluación limitada al resumen depositado en Crossref; no se leyó el texto completo ni se verificaron de forma independiente los resultados descritos.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.21672/2074-1707.2020.52.4.085-098", "source_quote": "The essence of the honeypot technology is to emulate or implement the functionality of existing devices, services, and protocols, with the accumulation of data about malicious activity of an attacker.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "2576798355a4cb643362c50184c91dbe0a6b5181bb7c83be61693e776dfa6610", "source_title": "RESEARCH ON THE USE OF DECEPTION TECHNOLOGY TO PREVENT CYBERSECURITY THREATS", "techniques": ["Honeypot", "Decoy"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-21672-2074-1707-2020-52-4-085-098", "kind": "paper", "name": "RESEARCH ON THE USE OF DECEPTION TECHNOLOGY TO PREVENT CYBERSECURITY THREATS", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-21672-2074-1707-2020-52-4-085-098", "source_url": "https://doi.org/10.21672/2074-1707.2020.52.4.085-098", "status": "published", "summary_en": "The paper reviews the use of deception technology, specifically honeypot systems, to address threats against IoT devices. The authors compare the most popular existing honeypot systems, identify their strengths and weaknesses, and attempt to adapt them to operate at the level of Internet of things devices.", "summary_es": "El artículo revisa el uso de tecnología de engaño, en concreto sistemas honeypot, para hacer frente a amenazas contra dispositivos IoT. Los autores comparan los sistemas honeypot más populares, señalan sus fortalezas y debilidades e intentan adaptarlos al nivel de los dispositivos de Internet de las cosas.", "updated_at": "2026-10-16", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Dinesh S. Kapse", "Vijay Bagdi"], "doi": "10.21863/ijsse/2015.3.2.006", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-025-2026-10-16.json", "eligibility_selection_report_sha256": "d093663b26c60e005750c243427a287bcd2f21b05d461e63d89cc17bc86ebcef", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "International Journal of System and Software Engineering", "limitations_en": "Review based only on the Crossref deposited abstract; the full text was not examined and results were not validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se examinó el texto completo ni se validaron resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.21863/ijsse/2015.3.2.006", "source_quote": "Honeypot can be deployed at victims site to attract and divert an attacker from their intended source or targets.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "d0cffdfbb5f58869347c1a33bf9fcdb7fcb1fbf16deca807f6d2337c4df0d2e8", "source_title": "Efficient Security Services of Honeypot using Kerberos for Detecting Intruders", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-21863-ijsse-2015-3-2-006", "kind": "paper", "name": "Efficient Security Services of Honeypot using Kerberos for Detecting Intruders", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-21863-ijsse-2015-3-2-006", "source_url": "https://doi.org/10.21863/ijsse/2015.3.2.006", "status": "published", "summary_en": "The authors describe honeypots as a security mechanism that attracts and diverts attackers, logs network bytes, and correlates data to locate the attack source. They present honeypot types and uses and introduce Kerberos, concluding with a look at the future.", "summary_es": "Los autores describen los honeypots como mecanismo de seguridad que atrae y desvía a atacantes, registra bytes de red y correlaciona datos para localizar el origen del ataque. Presentan tipos y usos de honeypots e introducen Kerberos, concluyendo con líneas de trabajo futuras.", "updated_at": "2026-10-16", "year": 2015}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Alif Subardono", "Imron Kadafi Hariri"], "doi": "10.22146/jise.v2i1.1778", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-025-2026-10-16.json", "eligibility_selection_report_sha256": "d093663b26c60e005750c243427a287bcd2f21b05d461e63d89cc17bc86ebcef", "environments": ["Network", "Endpoint"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "Journal of Internet and Software Engineering", "limitations_en": "Review based only on the Crossref-deposited abstract; no full text was accessed and results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se accedió al texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.22146/jise.v2i1.1778", "source_quote": "From monitoring the Honeypot System shows the Honeypot sensor deviceoverloaded in memory.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "a0b3e7a926fd55ba2bdeac566a0e6fde355400ff9b99ab9807f12686e7560427", "source_title": "Monitoring and Analysis of Honeypot System Performance using Simple Network Management Protocol (SNMP)", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-22146-jise-v2i1-1778", "kind": "paper", "name": "Monitoring and Analysis of Honeypot System Performance using Simple Network Management Protocol (SNMP)", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-22146-jise-v2i1-1778", "source_url": "https://doi.org/10.22146/jise.v2i1.1778", "status": "published", "summary_en": "The authors describe monitoring honeypot sensors deployed on Raspberry Pi devices integrated with Modern Honey Network, using SNMP as a network management function. The aim is to observe system resources and analyze how the number of attacks affects sensor performance.", "summary_es": "Los autores describen la monitorización de sensores honeypot desplegados en dispositivos Raspberry Pi integrados con Modern Honey Network, usando SNMP como función de gestión de red. El objetivo es observar recursos del sistema y analizar la influencia del número de ataques en el rendimiento del sensor.", "updated_at": "2026-10-16", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Dharma Kurniawan", "Yuris Mulya Saputra"], "doi": "10.22146/jise.v5i2.10007", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-025-2026-10-16.json", "eligibility_selection_report_sha256": "d093663b26c60e005750c243427a287bcd2f21b05d461e63d89cc17bc86ebcef", "environments": ["Cloud"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "Journal of Internet and Software Engineering", "limitations_en": "Review based only on the Crossref-deposited abstract; the full text was not examined and results were not independently validated.", "limitations_es": "Revisión basada solo en el resumen depositado en Crossref; no se examinó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.22146/jise.v5i2.10007", "source_quote": "penelitian ini bertujuan untuk melakukan otomasi proses honeypot deployment dengan menggunakan alat manajemen konfigurasi yang populer yang dikenal sebagai Ansible", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "82f4d7f2ca39194249770f41e8ac3eee10dbc95cd7857263225740a6fd08e33b", "source_title": "Implementasi Ansible pada Otomasi Honeypot Deployment Berbasis Web", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-22146-jise-v5i2-10007", "kind": "paper", "name": "Implementasi Ansible pada Otomasi Honeypot Deployment Berbasis Web", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-22146-jise-v5i2-10007", "source_url": "https://doi.org/10.22146/jise.v5i2.10007", "status": "published", "summary_en": "The work addresses automating honeypot deployment using Ansible and a web application that also monitors the process. The authors describe their purpose of reducing the time and resources of manual deployment and report tests on sensors running on Google Cloud Platform.", "summary_es": "El trabajo aborda la automatización del despliegue de honeypots mediante Ansible y una aplicación web que también monitorea el proceso. Los autores describen su propósito de reducir el tiempo y los recursos del despliegue manual y reportan pruebas en sensores sobre Google Cloud Platform.", "updated_at": "2026-10-16", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Prof. Suvarna Aranjo", "Sachin Maurya", "Chandrakant Thakur", "Melvin Raju"], "doi": "10.22214/ijraset.2022.41016", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-026-2026-10-16.json", "eligibility_selection_report_sha256": "3bb95b95d8178cb2f73ef95b7744cfdf65b70f6a65e8ec493b3bdd38c46a6c83", "environments": ["Cloud"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "International Journal for Research in Applied Science and Engineering Technology", "limitations_en": "Review limited to the Crossref deposited abstract; the full text was not consulted and results were not independently verified.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se consultó el texto completo ni se verificaron resultados de forma independiente.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.22214/ijraset.2022.41016", "source_quote": "Machine learning on the other hand can be used to make quicker decisions and narrow down different types of attacks faster", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "7afc7ed36212889f94d257960a01a0f1ef50e0ca24c7f7fa9f30201010438181", "source_title": "Threat Prediction using Honeypot and Machine Learning", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-22214-ijraset-2022-41016", "kind": "paper", "name": "Threat Prediction using Honeypot and Machine Learning", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-22214-ijraset-2022-41016", "source_url": "https://doi.org/10.22214/ijraset.2022.41016", "status": "published", "summary_en": "The paper describes setting up a honeypot on a cloud service and analyzing the activity it captures. It then applies machine learning algorithms to predict the type of threat detected in the honeypots.", "summary_es": "El artículo describe el despliegue de un honeypot en un servicio de nube y el análisis de las interacciones registradas. Después emplea algoritmos de aprendizaje automático para predecir el tipo de amenaza detectada en los honeypots.", "updated_at": "2026-10-16", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["N Shivathmika"], "doi": "10.22214/ijraset.2022.45091", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-026-2026-10-16.json", "eligibility_selection_report_sha256": "3bb95b95d8178cb2f73ef95b7744cfdf65b70f6a65e8ec493b3bdd38c46a6c83", "environments": ["Cloud", "Application"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "International Journal for Research in Applied Science and Engineering Technology", "limitations_en": "Review based only on the Crossref-deposited abstract; the full text was not read and results were not independently verified.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se leyó el texto completo ni se verificaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.22214/ijraset.2022.45091", "source_quote": "A way to divert malicious traffic away from systems is by using Honeypot.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "0f9393dc162350b05911358c7938aa0d2f8748a0e824251d9ddc9cd8edfb5793", "source_title": "Intrusion Detection and Prevention Using Honeypot Network for Cloud Security", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-22214-ijraset-2022-45091", "kind": "paper", "name": "Intrusion Detection and Prevention Using Honeypot Network for Cloud Security", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-22214-ijraset-2022-45091", "source_url": "https://doi.org/10.22214/ijraset.2022.45091", "status": "published", "summary_en": "The paper addresses intrusion detection and cloud security and proposes using honeypots to divert malicious traffic away from systems. The authors describe implementing the honeypot concept in a file-sharing application deployed on a cloud server, aiming to detect attacks and improve security in that environment.", "summary_es": "El artículo aborda la detección de intrusiones y la seguridad en entornos de nube, y propone el uso de honeypots para desviar tráfico malicioso. Los autores describen la implementación del concepto de honeypot en una aplicación para compartir archivos desplegada en un servidor en la nube, con el fin de detectar ataques y mejorar la seguridad.", "updated_at": "2026-10-16", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Mr. R. Rajasekhar"], "doi": "10.22214/ijraset.2026.78013", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-026-2026-10-16.json", "eligibility_selection_report_sha256": "3bb95b95d8178cb2f73ef95b7744cfdf65b70f6a65e8ec493b3bdd38c46a6c83", "environments": ["Application", "Identity"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "International Journal for Research in Applied Science and Engineering Technology", "limitations_en": "Review limited to the Crossref-deposited abstract; no full text was accessed and results, software, or effectiveness were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se accedió al texto completo ni se validaron de forma independiente los resultados, el software o su eficacia.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.22214/ijraset.2026.78013", "source_quote": "the malicious user is automatically redirected to a decoy system, thus effectively isolating malicious traffic from the actual web application", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "73fe9762ed374cb0eaedd6d68b8abd2117cf8397ee167d531581233aff682f15", "source_title": "Honeypot- Enabled Authentication System", "techniques": ["Honeypot", "Decoy", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-22214-ijraset-2026-78013", "kind": "paper", "name": "Honeypot- Enabled Authentication System", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-22214-ijraset-2026-78013", "source_url": "https://doi.org/10.22214/ijraset.2026.78013", "status": "published", "summary_en": "The abstract describes Honey Shield, a deception-driven cybersecurity paradigm for web authentication systems. It proposes a centralized security service interface offering defenses such as honeypot redirection and SQL injection protection, redirecting malicious users to a decoy system and logging incidents for later analysis.", "summary_es": "El resumen describe Honey Shield, un paradigma de ciberseguridad basado en engaño para sistemas de autenticación web. Propone una interfaz centralizada de servicios de defensa, como redirección a honeypot y protección contra inyección SQL, que redirige al usuario malicioso a un sistema señuelo y registra los incidentes para su análisis posterior.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Vivekkumar Chauhan"], "doi": "10.22214/ijraset.2026.78511", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-026-2026-10-16.json", "eligibility_selection_report_sha256": "3bb95b95d8178cb2f73ef95b7744cfdf65b70f6a65e8ec493b3bdd38c46a6c83", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "International Journal for Research in Applied Science and Engineering Technology", "limitations_en": "Review limited to the deposited abstract; full text was not accessed and results were not independently verified.", "limitations_es": "Revisión limitada al resumen depositado; no se accedió al texto completo ni se verificaron resultados de forma independiente.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.22214/ijraset.2026.78511", "source_quote": "our project proposes a radical shift to a proactive, intelligence-driven defence centered around a highinteraction honeypot", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "a28973929d8d0f41f39bdf8e84e93d89a27b029a313e6a872794b14fd600c364", "source_title": "Fortifying Cyber Defense: Honeypot-Driven Strategies for DDoS Detection and Prevention", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-22214-ijraset-2026-78511", "kind": "paper", "name": "Fortifying Cyber Defense: Honeypot-Driven Strategies for DDoS Detection and Prevention", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-22214-ijraset-2026-78511", "source_url": "https://doi.org/10.22214/ijraset.2026.78511", "status": "published", "summary_en": "The paper proposes a proactive defense approach using a high-interaction honeypot for DDoS detection and prevention. The honeypot captures IP addresses, malware and attacker tactics, feeding firewalls and traffic filters to block similar threats across the network.", "summary_es": "El artículo propone un enfoque de defensa proactiva basado en un honeypot de alta interacción para detectar y prevenir ataques DDoS. El honeypot captura direcciones IP, malware y tácticas de los atacantes, y retroalimenta firewalls y filtros de tráfico para bloquear amenazas similares en la red.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Gadhe Vijayendar Reddy"], "doi": "10.22214/ijraset.2026.78940", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-026-2026-10-16.json", "eligibility_selection_report_sha256": "3bb95b95d8178cb2f73ef95b7744cfdf65b70f6a65e8ec493b3bdd38c46a6c83", "environments": ["Cloud"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "International Journal for Research in Applied Science and Engineering Technology", "limitations_en": "Review based solely on the Crossref-deposited abstract; the full text was not accessed and the described results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se accedió al texto completo ni se validaron de forma independiente los resultados descritos.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.22214/ijraset.2026.78940", "source_quote": "This paper introduces an advanced honeypot frame- work deployed in a cloud environment to improve cyber threat detection and facilitate efficient incident response.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "db934d3081589bf7a8ee7abc472021da82c93354086837fc4f2f716f4848b9b9", "source_title": "Cloud-Based Honeypot for Cyber Threat Intelligence and Incident Response", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-22214-ijraset-2026-78940", "kind": "paper", "name": "Cloud-Based Honeypot for Cyber Threat Intelligence and Incident Response", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-22214-ijraset-2026-78940", "source_url": "https://doi.org/10.22214/ijraset.2026.78940", "status": "published", "summary_en": "The paper describes the design of a honeypot framework deployed in a cloud environment to support threat detection and incident response. According to the authors, it integrates Microsoft Azure services to monitor and analyze malicious behavior, using telemetry, threat intelligence and automated workflows.", "summary_es": "El artículo describe el diseño de un marco de honeypot desplegado en la nube para apoyar la detección de amenazas y la respuesta a incidentes. Según los autores, integra servicios de Microsoft Azure para monitorear y analizar comportamientos maliciosos, con telemetría, inteligencia de amenazas y flujos automatizados.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Naja Sherin M"], "doi": "10.22214/ijraset.2026.80912", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-026-2026-10-16.json", "eligibility_selection_report_sha256": "3bb95b95d8178cb2f73ef95b7744cfdf65b70f6a65e8ec493b3bdd38c46a6c83", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "International Journal for Research in Applied Science and Engineering Technology", "limitations_en": "Review based solely on the Crossref-deposited abstract; it does not imply full-text reading, replication, or independent validation of results.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no implica lectura del texto completo, replicación ni validación independiente de resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.22214/ijraset.2026.80912", "source_quote": "DecoyShield leverages multi- service honeypot environments to simulate realistic network services and lure attackers into controlled decoy systems", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "9039ab4a6dc7fe3fd1d78eccc2f980a16644311f75d31157381ee894611c4105", "source_title": "DecoyShield: A Deception-Based Framework for Proactive Threat Detection and Cyber Defense", "techniques": ["Honeypot", "Decoy", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-22214-ijraset-2026-80912", "kind": "paper", "name": "DecoyShield: A Deception-Based Framework for Proactive Threat Detection and Cyber Defense", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-22214-ijraset-2026-80912", "source_url": "https://doi.org/10.22214/ijraset.2026.80912", "status": "published", "summary_en": "The work proposes DecoyShield, a deception-based cybersecurity framework for proactive detection. It leverages multi-service honeypot environments that simulate network services, capture attacker behavior, and integrate behavioral analysis, threat intelligence, and dynamic risk scoring to classify severity and deploy adaptive responses.", "summary_es": "El trabajo propone DecoyShield, un marco de ciberseguridad basado en engaño para detección proactiva. Emplea entornos de honeypots multiservicio que simulan servicios de red, capturan comportamiento del atacante e integran análisis conductual, inteligencia de amenazas y puntuación dinámica de riesgo para clasificar severidad y desplegar respuestas adaptativas.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Shinimol Y"], "doi": "10.22214/ijraset.2026.81247", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-026-2026-10-16.json", "eligibility_selection_report_sha256": "3bb95b95d8178cb2f73ef95b7744cfdf65b70f6a65e8ec493b3bdd38c46a6c83", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "International Journal for Research in Applied Science and Engineering Technology", "limitations_en": "Review based only on the deposited abstract; results, implementation, and actual effectiveness were not verified.", "limitations_es": "Revisión basada únicamente en el resumen depositado; no se verificaron resultados, implementación ni eficacia real.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.22214/ijraset.2026.81247", "source_quote": "building a wireless and portable honeypot using a Raspberry Pi, specifically designed to detect and analyze SSH brute-force attacks", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "b18b067958a28bd338746b4bc23ad96ef4c8733d5c10618dece6ed849f3cd490", "source_title": "Pi-Pot:Portable Wireless SSH Honeypot using Raspberry Pi", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-22214-ijraset-2026-81247", "kind": "paper", "name": "Pi-Pot:Portable Wireless SSH Honeypot using Raspberry Pi", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-22214-ijraset-2026-81247", "source_url": "https://doi.org/10.22214/ijraset.2026.81247", "status": "published", "summary_en": "The work describes the design of a portable wireless honeypot using a Raspberry Pi to detect and analyze SSH brute-force attacks. By simulating a vulnerable SSH service with the Cowrie honeypot, the system logs login attempts and attacker behavior in real time to study attack patterns and improve security measures.", "summary_es": "El trabajo describe el diseño de un honeypot inalámbrico y portátil basado en Raspberry Pi para detectar y analizar ataques de fuerza bruta SSH. Mediante la simulación de un servicio SSH vulnerable con el honeypot Cowrie, el sistema registra intentos de inicio de sesión y comportamiento de atacantes en tiempo real para estudiar patrones de ataque y mejorar medidas de seguridad.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Yenumula Sri Kanyaka Parameswari"], "doi": "10.22214/ijraset.2026.81864", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-027-2026-10-16.json", "eligibility_selection_report_sha256": "e7b878ae06f0c6690f48a73f5790790717a84d2ce2d26aa0a9090339d8141c29", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "International Journal for Research in Applied Science and Engineering Technology", "limitations_en": "Review based only on the abstract deposited with Crossref; the full text was not examined and the results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se examinó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.22214/ijraset.2026.81864", "source_quote": "a real-time Docker-based honeypot that automatically deploys when something suspicious is spotted", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "2c64cd5b153b355158f84279d08fbb3bac67436684dc46b7159197be3a5d9654", "source_title": "Real-Time Network Intrusion Detection and Active Honeypot Deployment Using Machine Learning on KDD-Based Traffic Classification", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-22214-ijraset-2026-81864", "kind": "paper", "name": "Real-Time Network Intrusion Detection and Active Honeypot Deployment Using Machine Learning on KDD-Based Traffic Classification", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-22214-ijraset-2026-81864", "source_url": "https://doi.org/10.22214/ijraset.2026.81864", "status": "published", "summary_en": "The paper describes a hybrid intrusion detection system combining a supervised classifier trained on the NSL-KDD dataset with a Docker-based honeypot that deploys automatically when suspicious activity is detected. Traffic is classified into five categories, with a voting ensemble of three classifiers producing the detection.", "summary_es": "El artículo describe un sistema híbrido de detección de intrusiones que combina un clasificador supervisado entrenado con el conjunto NSL-KDD y un honeypot Docker que se despliega automáticamente ante tráfico sospechoso. El tráfico se clasifica en cinco categorías y un ensemble de votación de tres clasificadores genera la detección.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Amal Murali"], "doi": "10.22214/ijraset.2026.81886", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-027-2026-10-16.json", "eligibility_selection_report_sha256": "e7b878ae06f0c6690f48a73f5790790717a84d2ce2d26aa0a9090339d8141c29", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "International Journal for Research in Applied Science and Engineering Technology", "limitations_en": "Review limited to the deposited Crossref abstract; full text, software, and effectiveness were not verified.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se verificó el texto completo, el software ni la eficacia.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.22214/ijraset.2026.81886", "source_quote": "Instead of relying on machine learning models, the system uses predefined rules such as abnormal packet size, high request frequency, and repeated login attempts to detect suspicious activities.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "cc3c6111ba1e5178e1a512ad7048e714685ff58e62a06891663f211a20c781d3", "source_title": "Explainable AI-Based Intrusion Detection System Using Rule-Based Anomaly Detection and Honeypot Mechanism Implementation", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-22214-ijraset-2026-81886", "kind": "paper", "name": "Explainable AI-Based Intrusion Detection System Using Rule-Based Anomaly Detection and Honeypot Mechanism Implementation", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-22214-ijraset-2026-81886", "source_url": "https://doi.org/10.22214/ijraset.2026.81886", "status": "published", "summary_en": "The paper describes an intrusion detection system that monitors live packets and uses predefined rules to detect suspicious activity rather than machine learning models. It includes a honeypot module with a fake login interface and human-readable explanations for detected anomalies.", "summary_es": "El artículo describe un sistema de detección de intrusiones que monitorea paquetes en vivo y usa reglas predefinidas para detectar actividad sospechosa en lugar de modelos de aprendizaje automático. Incluye un módulo honeypot con una interfaz de inicio de sesión falsa y explicaciones legibles para las anomalías detectadas.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Shubhangi V. Muneshwar"], "doi": "10.22214/ijraset.2026.82075", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-027-2026-10-16.json", "eligibility_selection_report_sha256": "e7b878ae06f0c6690f48a73f5790790717a84d2ce2d26aa0a9090339d8141c29", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "International Journal for Research in Applied Science and Engineering Technology", "limitations_en": "Review limited to the Crossref-deposited abstract; the full text was not read and reported results were not independently verified.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se leyó el texto completo ni se verificaron de forma independiente los resultados reportados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.22214/ijraset.2026.82075", "source_quote": "The ability to change deception strategies in real time according to the attacker's behaviour is a key feature of AEGIS-AI.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "23a73c6677497c3766a621e4f17e952cd8621e3650e8746aabbd279c55a6a4c7", "source_title": "AEGIS-AI: Autonomous Threat Deception and Detection Using Honeypot Networks", "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-22214-ijraset-2026-82075", "kind": "paper", "name": "AEGIS-AI: Autonomous Threat Deception and Detection Using Honeypot Networks", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-22214-ijraset-2026-82075", "source_url": "https://doi.org/10.22214/ijraset.2026.82075", "status": "published", "summary_en": "The work proposes AEGIS-AI, a framework combining honeypots with reinforcement learning and deep neural networks to automate deception and detection of malicious activity. The authors describe real-time adaptive deception strategies via Markov Decision Processes and federated learning, and present formulas for evaluating deception effectiveness.", "summary_es": "El trabajo propone AEGIS-AI, un marco que combina honeypots con aprendizaje por refuerzo y redes neuronales profundas para automatizar el engaño y la detección de actividad maliciosa. Los autores describen estrategias de decepción adaptables en tiempo real mediante procesos de decisión de Markov y aprendizaje federado, y presentan fórmulas para evaluar la efectividad del engaño.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Krishnanshu Khilare"], "doi": "10.22214/ijraset.2026.83214", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-027-2026-10-16.json", "eligibility_selection_report_sha256": "e7b878ae06f0c6690f48a73f5790790717a84d2ce2d26aa0a9090339d8141c29", "environments": ["Cloud", "Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "International Journal for Research in Applied Science and Engineering Technology", "limitations_en": "Review based only on Crossref-deposited metadata and abstract; full text and results were not independently verified.", "limitations_es": "Revisión basada únicamente en metadatos depositados y el resumen de Crossref; no se verificó el texto completo ni los resultados de forma independiente.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.22214/ijraset.2026.83214", "source_quote": "To bridge this critical knowledge gap, this paper presents the design, implementation, and evaluation of a Cloud Honeypot Monitoring System deployed on Amazon Web Services that attracts, records, and analyzes malicious interactions within a fully isolated and controlled cloud environment.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "9801c438d7497b4a0beaf3ad0d816383ac950eb9e89d35806a2b770d0d46cbcf", "source_title": "Cloud Honeypot Monitoring System: A Framework for Real-Time Attack Detection and Behavioral Analysis in Cloud Environments", "techniques": ["Honeypot", "Decoy"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-22214-ijraset-2026-83214", "kind": "paper", "name": "Cloud Honeypot Monitoring System: A Framework for Real-Time Attack Detection and Behavioral Analysis in Cloud Environments", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-22214-ijraset-2026-83214", "source_url": "https://doi.org/10.22214/ijraset.2026.83214", "status": "published", "summary_en": "Presents the design, implementation, and evaluation of a honeypot monitoring system deployed on AWS that emulates SSH, HTTP, and HTTPS services on EC2 instances within an isolated virtual private cloud. The system aims to attract, record, and analyze malicious interactions, using a Python/Flask backend and a React/D3.js dashboard for attack visualization.", "summary_es": "Presenta el diseño, implementación y evaluación de un sistema de monitoreo con honeypot desplegado en AWS, que emula servicios SSH, HTTP y HTTPS en instancias EC2 dentro de una nube privada virtual aislada. El sistema busca atraer, registrar y analizar interacciones maliciosas, usando un backend en Python con Flask y un panel React/D3.js para visualizar ataques.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Daniel Ward"], "doi": "10.22214/ijraset.2026.83810", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-027-2026-10-16.json", "eligibility_selection_report_sha256": "e7b878ae06f0c6690f48a73f5790790717a84d2ce2d26aa0a9090339d8141c29", "environments": ["OT/ICS"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "International Journal for Research in Applied Science and Engineering Technology", "limitations_en": "Review limited to the deposited abstract; the full text was not read and results were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado; no se leyó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.22214/ijraset.2026.83810", "source_quote": "deception readiness depends less on tool availability alone and more on the alignment of ownership, safe placement, alert routing, staff capability, and operational approval", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "965ae4108e26f12ddf92bbb320d439bd01cef35cfb69406d701af338f76e848b", "source_title": "A Deception Readiness Index for ICS and OT Cybersecurity Programs", "techniques": ["Decoy"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-22214-ijraset-2026-83810", "kind": "paper", "name": "A Deception Readiness Index for ICS and OT Cybersecurity Programs", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-22214-ijraset-2026-83810", "source_url": "https://doi.org/10.22214/ijraset.2026.83810", "status": "published", "summary_en": "The paper proposes a Deception Readiness Index (DRI) for ICS and OT cybersecurity programs. Using design science and qualitative analysis of public standards and guidance, it scores readiness across governance, architecture, monitoring, workforce, and operational safety domains, and applies the index to three synthetic critical-infrastructure profiles to identify gaps before deployment.", "summary_es": "El artículo propone un Índice de Preparación para el Engaño (DRI) para programas de ciberseguridad de ICS y OT. Mediante diseño científico y análisis cualitativo de estándares y guías públicas, puntúa la preparación en gobernanza, arquitectura, monitoreo, personal y seguridad operativa, y lo aplica a tres perfiles sintéticos de infraestructura crítica para detectar brechas antes del despliegue.", "updated_at": "2026-10-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Irmawati Feren Kilwalaga", "Fauzi Dwi Setiawan Sumadi", "Syaifuddin Syaifuddin"], "doi": "10.22219/kinetik.v5i3.1058", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-027-2026-10-16.json", "eligibility_selection_report_sha256": "e7b878ae06f0c6690f48a73f5790790717a84d2ce2d26aa0a9090339d8141c29", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "Kinetik: Game Technology, Information System, Computer Network, Computing, Electronics, and Control", "limitations_en": "Review limited to the Crossref deposited abstract; the full text was not consulted and the reported results were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se consultó el texto completo ni se validaron de forma independiente los resultados reportados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.22219/kinetik.v5i3.1058", "source_quote": "To overcome this problem, this paper proposes detection and mitigation using the Modern Honey Network (MHN) integration in SDN and then makes reactive applications outside the controller using the entropy method.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "7d64efc3f78998871249e8862c2a2ba997a01b47d2b56ae6175201b830656b1e", "source_title": "SDN-Honeypot Integration for DDoS Detection Scheme Using Entropy", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-22219-kinetik-v5i3-1058", "kind": "paper", "name": "SDN-Honeypot Integration for DDoS Detection Scheme Using Entropy", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-22219-kinetik-v5i3-1058", "source_url": "https://doi.org/10.22219/kinetik.v5i3.1058", "status": "published", "summary_en": "The paper addresses detection and mitigation of DDoS attacks, specifically ICMP Flood, in Software Defined Networks (SDN), where controller centralization creates a vulnerability. The authors propose integrating the Modern Honey Network (MHN) into SDN and using a reactive application outside the controller based on entropy, computed from source IP, destination IP and protocol, to identify anomalous traffic.", "summary_es": "El artículo aborda la detección y mitigación de ataques DDoS, en particular ICMP Flood, en redes definidas por software (SDN), donde la centralización del controlador crea una vulnerabilidad. Los autores proponen integrar la Modern Honey Network (MHN) en SDN y usar una aplicación reactiva externa al controlador basada en entropía, calculada a partir de IP origen, IP destino y protocolo, para identificar tráfico anómalo.", "updated_at": "2026-10-16", "year": 2020}
{"critical_reading": null, "data": {"abstract_source_doi": "10.22219/repositor.v2i10.1047", "access_date": "2026-10-17", "authors": ["Novandha Yudyanto", "Syaifuddin Syaifuddin", "Yufis Azhar"], "creator_name_aliases_inferred": false, "doi": "10.22219/repositor.v2i10.1047", "doi_aliases": ["10.22219/repositor.v2i10.30885"], "draft_review_basis": "deepseek-original-draft; codex-source-correction-and-independent-claude-review", "environments": ["Network"], "family_resource_count": 1, "family_scope_basis": [{"batch": 27, "candidate_id": "doi:10.22219/repositor.v2i10.1047", "catalog_decision": null, "doi": "10.22219/repositor.v2i10.1047", "existing_identifier_matches": [], "existing_title_matches": [], "identity_status": "deposited-title-family-review-needed", "matching_abstract_dois": ["10.22219/repositor.v2i10.1047", "10.22219/repositor.v2i10.30885"], "selection_report": "data/coverage/bibliography-deposited-third-crossref-027-2026-10-16.json", "selection_report_sha256": "e7b878ae06f0c6690f48a73f5790790717a84d2ce2d26aa0a9090339d8141c29", "source_sha256": "c3bfea0901d0b0edbc6c823796f1a9be375e40cd12c2baa91dbe65bcd6ed02f6", "title": "Integrasi Modern Honey Network Dengan Grafana Untuk Visualisasi", "year": 2020}, {"batch": 28, "candidate_id": "doi:10.22219/repositor.v2i10.30885", "catalog_decision": null, "doi": "10.22219/repositor.v2i10.30885", "existing_identifier_matches": [], "existing_title_matches": [], "identity_status": "deposited-title-family-review-needed", "matching_abstract_dois": ["10.22219/repositor.v2i10.1047", "10.22219/repositor.v2i10.30885"], "selection_report": "data/coverage/bibliography-deposited-third-crossref-028-2026-10-16.json", "selection_report_sha256": "c6edbbb62f8ac08c24d629d82d3a16b059843fb29a96975154c8a3c1be6ac1c8", "source_sha256": "4985a4c78a41afadad54162559195e47ad872d6d0ff41b3a57c8ba9e0fcd0ee0", "title": "Integrasi Modern Honey Network Dengan Grafana Untuk Visualisasi", "year": 2024}], "full_text_equality_claimed": false, "full_text_reviewed": false, "identity_report": "data/coverage/wave2-identity-handoff-2026-10-17.json", "identity_report_sha256": "6b7d19fea50548780838f2ca5a72a6c8c456a64f2c5d549a61ebd57953237cb3", "journal": "Jurnal Repositor", "limitations_en": "Deposited abstract and bibliographic metadata; no full-text was analyzed, so the proposal's details and outcomes cannot be assessed.", "limitations_es": "Resumen depositado y metadatos bibliográficos; no se analizó el texto completo, por lo que no puede evaluarse el detalle de la propuesta ni sus resultados.", "metadata_sha256": "c3bfea0901d0b0edbc6c823796f1a9be375e40cd12c2baa91dbe65bcd6ed02f6", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "source-page", "review_depth": "deposited abstract and bibliographic version metadata; no full-text analysis", "reviewed_metadata_url": "https://api.crossref.org/works/10.22219/repositor.v2i10.1047", "selection_report": "data/coverage/bibliography-deposited-third-crossref-027-2026-10-16.json", "selection_report_sha256": "e7b878ae06f0c6690f48a73f5790790717a84d2ce2d26aa0a9090339d8141c29", "source_correction_input_sha256": "a520a3a6c2ed1e7da214bf22493bb57f312b861bfb4a7c6aadfca5980445a097", "source_document_url": "https://doi.org/10.22219/repositor.v2i10.1047", "source_packet_sha256": "4969c4f3f3b274580d38cd6dac2357c54ed1909aeb7e6a5ab273faa679d57fd9", "source_quote": "Dalam penelitian ini Grafana digunakan untuk visualisasi log pada MHN.", "source_quote_locator": {"abstract_source_doi": "10.22219/repositor.v2i10.1047", "field": "deposited abstract (HTML normalized)"}, "source_sha256": "c3bfea0901d0b0edbc6c823796f1a9be375e40cd12c2baa91dbe65bcd6ed02f6", "source_title": "Integrasi Modern Honey Network Dengan Grafana Untuk Visualisasi", "source_type": "deposited abstract and bibliographic version metadata; no full-text analysis", "tags": [], "techniques": ["Honeypot"], "version_history": [{"creators": [{"affiliation": [], "family": "Yudyanto", "given": "Novandha", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "first"}, {"affiliation": [], "family": "Syaifuddin", "given": "Syaifuddin", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}, {"affiliation": [], "family": "Azhar", "given": "Yufis", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}], "deposited_descriptions": null, "doi": "10.22219/repositor.v2i10.1047", "issue": "10", "issued": {"date-parts": [[2020, 9, 21]]}, "journal": ["Jurnal Repositor"], "metadata_sha256": "c3bfea0901d0b0edbc6c823796f1a9be375e40cd12c2baa91dbe65bcd6ed02f6", "metadata_url": "https://api.crossref.org/works/10.22219/repositor.v2i10.1047", "page": "1380-1389", "relations": null, "resource_type": null, "titles": ["Integrasi Modern Honey Network Dengan Grafana Untuk Visualisasi"], "volume": "2"}, {"creators": [{"affiliation": [], "family": "Yudyanto", "given": "Novandha", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "first"}, {"affiliation": [], "family": "Syaifuddin", "given": "Syaifuddin", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}, {"affiliation": [], "family": "Azhar", "given": "Yufis", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}], "deposited_descriptions": null, "doi": "10.22219/repositor.v2i10.30885", "issue": "10", "issued": {"date-parts": [[2024, 1, 16]]}, "journal": ["Jurnal Repositor"], "metadata_sha256": "4985a4c78a41afadad54162559195e47ad872d6d0ff41b3a57c8ba9e0fcd0ee0", "metadata_url": "https://api.crossref.org/works/10.22219/repositor.v2i10.30885", "page": null, "relations": null, "resource_type": null, "titles": ["Integrasi Modern Honey Network Dengan Grafana Untuk Visualisasi"], "volume": "2"}]}, "evidence": "primary-source-passages", "id": "doi-10-22219-repositor-v2i10-1047", "kind": "paper", "name": "Integrasi Modern Honey Network Dengan Grafana Untuk Visualisasi", "organization": null, "reviewed_at": "2026-10-17", "slug": "doi-10-22219-repositor-v2i10-1047", "source_url": "https://doi.org/10.22219/repositor.v2i10.1047", "status": "published", "summary_en": "The paper describes integrating Grafana with Modern Honey Network to visualize logs collected by its honeypots. The work aims to make recorded activity easier to read and analyze.", "summary_es": "El artículo describe la integración de Grafana con Modern Honey Network para visualizar los registros recogidos por sus honeypots. El trabajo busca facilitar la lectura y el análisis de la actividad registrada.", "updated_at": "2026-10-17", "year": 2020}
{"critical_reading": null, "data": {"abstract_source_doi": "10.22219/repositor.v2i4.114", "access_date": "2026-10-17", "authors": ["Ilfan Arif Romadhan", "Syaifudin Syaifudin", "Denar Regata Akbi"], "creator_name_aliases_inferred": false, "doi": "10.22219/repositor.v2i4.114", "doi_aliases": ["10.22219/repositor.v2i4.30525"], "draft_review_basis": "deepseek-original-draft; codex-source-correction-and-independent-claude-review", "environments": ["Network"], "family_resource_count": 1, "family_scope_basis": [{"batch": 28, "candidate_id": "doi:10.22219/repositor.v2i4.114", "catalog_decision": null, "doi": "10.22219/repositor.v2i4.114", "existing_identifier_matches": [], "existing_title_matches": [], "identity_status": "abstract-identity-review-needed", "matching_abstract_dois": ["10.22219/repositor.v2i4.114", "10.22219/repositor.v2i4.30525"], "selection_report": "data/coverage/bibliography-deposited-third-crossref-028-2026-10-16.json", "selection_report_sha256": "c6edbbb62f8ac08c24d629d82d3a16b059843fb29a96975154c8a3c1be6ac1c8", "source_sha256": "0c54cf995e0e6d91bfb01e52eb61ad57a4d7b2e6a0d365fe46e3f67fac86acb1", "title": "Implementasi Multiple Honeypot pada Raspberry Pi dan Visualisasi Log Honeypot Menggunakan ELK Stack", "year": 2020}, {"batch": 28, "candidate_id": "doi:10.22219/repositor.v2i4.30525", "catalog_decision": null, "doi": "10.22219/repositor.v2i4.30525", "existing_identifier_matches": [], "existing_title_matches": [], "identity_status": "abstract-identity-review-needed", "matching_abstract_dois": ["10.22219/repositor.v2i4.114", "10.22219/repositor.v2i4.30525"], "selection_report": "data/coverage/bibliography-deposited-third-crossref-028-2026-10-16.json", "selection_report_sha256": "c6edbbb62f8ac08c24d629d82d3a16b059843fb29a96975154c8a3c1be6ac1c8", "source_sha256": "ae9769b614c5560be1a52ada32fce474acb07bfdd37abafb5067225a2992ebc4", "title": "Implementasi Multiple Honeypot pada Raspberry Pi dan Visualisasi Log Honeypot Menggunakan ELK Stack", "year": 2024}], "full_text_equality_claimed": false, "full_text_reviewed": false, "identity_report": "data/coverage/wave2-identity-handoff-2026-10-17.json", "identity_report_sha256": "6b7d19fea50548780838f2ca5a72a6c8c456a64f2c5d549a61ebd57953237cb3", "journal": "Jurnal Repositor", "limitations_en": "Only the deposited abstract was available; implementation details and results were not verified against the full text.", "limitations_es": "Solo se dispone del resumen depositado; los detalles de implementación y resultados no se verificaron en el texto completo.", "metadata_sha256": "0c54cf995e0e6d91bfb01e52eb61ad57a4d7b2e6a0d365fe46e3f67fac86acb1", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "source-page", "review_depth": "deposited abstract and bibliographic version metadata; no full-text analysis", "reviewed_metadata_url": "https://api.crossref.org/works/10.22219/repositor.v2i4.114", "selection_report": "data/coverage/bibliography-deposited-third-crossref-028-2026-10-16.json", "selection_report_sha256": "c6edbbb62f8ac08c24d629d82d3a16b059843fb29a96975154c8a3c1be6ac1c8", "source_correction_input_sha256": "a520a3a6c2ed1e7da214bf22493bb57f312b861bfb4a7c6aadfca5980445a097", "source_document_url": "https://doi.org/10.22219/repositor.v2i4.114", "source_packet_sha256": "0d1215281e9c39752eba95518df1ab37b3fb0c0f0e30cbaf0523d3d6e3e5ba70", "source_quote": "Penelitian ini menerapkan beberapa honeypot menggunakan Raspberry pi dan ELK stack untuk monitoring hasil yang didapatkan oleh honeypot.", "source_quote_locator": {"abstract_source_doi": "10.22219/repositor.v2i4.114", "field": "deposited abstract (HTML normalized)"}, "source_sha256": "0c54cf995e0e6d91bfb01e52eb61ad57a4d7b2e6a0d365fe46e3f67fac86acb1", "source_title": "Implementasi Multiple Honeypot pada Raspberry Pi dan Visualisasi Log Honeypot Menggunakan ELK Stack", "source_type": "deposited abstract and bibliographic version metadata; no full-text analysis", "tags": [], "techniques": ["Honeypot"], "version_history": [{"creators": [{"affiliation": [], "family": "Romadhan", "given": "Ilfan Arif", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "first"}, {"affiliation": [], "family": "Syaifudin", "given": "Syaifudin", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}, {"affiliation": [], "family": "Akbi", "given": "Denar Regata", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}], "deposited_descriptions": null, "doi": "10.22219/repositor.v2i4.114", "issue": "4", "issued": {"date-parts": [[2020, 3, 5]]}, "journal": ["Jurnal Repositor"], "metadata_sha256": "0c54cf995e0e6d91bfb01e52eb61ad57a4d7b2e6a0d365fe46e3f67fac86acb1", "metadata_url": "https://api.crossref.org/works/10.22219/repositor.v2i4.114", "page": "475-484", "relations": null, "resource_type": null, "titles": ["Implementasi Multiple Honeypot pada Raspberry Pi dan Visualisasi Log Honeypot Menggunakan ELK Stack"], "volume": "2"}, {"creators": [{"affiliation": [], "family": "Romadhan", "given": "Ilfan Arif", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "first"}, {"affiliation": [], "family": "Syaifudin", "given": "Syaifudin", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}, {"affiliation": [], "family": "Akbi", "given": "Denar Regata", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}], "deposited_descriptions": null, "doi": "10.22219/repositor.v2i4.30525", "issue": "4", "issued": {"date-parts": [[2024, 1, 16]]}, "journal": ["Jurnal Repositor"], "metadata_sha256": "ae9769b614c5560be1a52ada32fce474acb07bfdd37abafb5067225a2992ebc4", "metadata_url": "https://api.crossref.org/works/10.22219/repositor.v2i4.30525", "page": null, "relations": null, "resource_type": null, "titles": ["Implementasi Multiple Honeypot pada Raspberry Pi dan Visualisasi Log Honeypot Menggunakan ELK Stack"], "volume": "2"}]}, "evidence": "primary-source-passages", "id": "doi-10-22219-repositor-v2i4-114", "kind": "paper", "name": "Implementasi Multiple Honeypot pada Raspberry Pi dan Visualisasi Log Honeypot Menggunakan ELK Stack", "organization": null, "reviewed_at": "2026-10-17", "slug": "doi-10-22219-repositor-v2i4-114", "source_url": "https://doi.org/10.22219/repositor.v2i4.114", "status": "published", "summary_en": "The paper describes implementing multiple honeypots on Raspberry Pi and centralizing and visualizing their logs with the ELK Stack to support detection and analysis of network attacks.", "summary_es": "El artículo describe la implementación de varios honeypots en Raspberry Pi y la centralización y visualización de sus registros mediante ELK Stack, para apoyar la detección y el análisis de ataques en la red.", "updated_at": "2026-10-17", "year": 2020}
{"critical_reading": null, "data": {"abstract_source_doi": "10.22219/repositor.v2i5.440", "access_date": "2026-10-17", "authors": ["Denni Septian Hermawan", "Syaifuddin Syaifuddin", "Diah Risqiwati"], "creator_name_aliases_inferred": false, "doi": "10.22219/repositor.v2i5.440", "doi_aliases": ["10.22219/repositor.v2i5.30638"], "draft_review_basis": "deepseek-original-draft; codex-source-correction-and-independent-claude-review", "environments": ["Network"], "family_resource_count": 1, "family_scope_basis": [{"batch": 28, "candidate_id": "doi:10.22219/repositor.v2i5.30638", "catalog_decision": null, "doi": "10.22219/repositor.v2i5.30638", "existing_identifier_matches": [], "existing_title_matches": [], "identity_status": "abstract-identity-review-needed", "matching_abstract_dois": ["10.22219/repositor.v2i5.30638", "10.22219/repositor.v2i5.440"], "selection_report": "data/coverage/bibliography-deposited-third-crossref-028-2026-10-16.json", "selection_report_sha256": "c6edbbb62f8ac08c24d629d82d3a16b059843fb29a96975154c8a3c1be6ac1c8", "source_sha256": "0735134d9e8530537602e34b1a51326fbda1fda2557f6a959169a4197a6aaa92", "title": "Analisa Real-Time Data log honeypot menggunakan Algoritma K-Means pada serangan Distributed Denial of Service", "year": 2024}, {"batch": 28, "candidate_id": "doi:10.22219/repositor.v2i5.440", "catalog_decision": null, "doi": "10.22219/repositor.v2i5.440", "existing_identifier_matches": [], "existing_title_matches": [], "identity_status": "abstract-identity-review-needed", "matching_abstract_dois": ["10.22219/repositor.v2i5.30638", "10.22219/repositor.v2i5.440"], "selection_report": "data/coverage/bibliography-deposited-third-crossref-028-2026-10-16.json", "selection_report_sha256": "c6edbbb62f8ac08c24d629d82d3a16b059843fb29a96975154c8a3c1be6ac1c8", "source_sha256": "70de351153c1cfa6e3e362d0ee92ef5f12aba4f86a3aedddad722c0d2cecda13", "title": "Analisa Real-Time Data log honeypot menggunakan Algoritma K-Means pada serangan Distributed Denial of Service", "year": 2020}], "full_text_equality_claimed": false, "full_text_reviewed": false, "identity_report": "data/coverage/wave2-identity-handoff-2026-10-17.json", "identity_report_sha256": "6b7d19fea50548780838f2ca5a72a6c8c456a64f2c5d549a61ebd57953237cb3", "journal": "Jurnal Repositor", "limitations_en": "Assessment based only on a deposited abstract; no full-text reading.", "limitations_es": "Evaluación basada únicamente en resumen depositado; sin lectura del texto completo.", "metadata_sha256": "70de351153c1cfa6e3e362d0ee92ef5f12aba4f86a3aedddad722c0d2cecda13", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "source-page", "review_depth": "deposited abstract and bibliographic version metadata; no full-text analysis", "reviewed_metadata_url": "https://api.crossref.org/works/10.22219/repositor.v2i5.440", "selection_report": "data/coverage/bibliography-deposited-third-crossref-028-2026-10-16.json", "selection_report_sha256": "c6edbbb62f8ac08c24d629d82d3a16b059843fb29a96975154c8a3c1be6ac1c8", "source_correction_input_sha256": "a520a3a6c2ed1e7da214bf22493bb57f312b861bfb4a7c6aadfca5980445a097", "source_document_url": "https://doi.org/10.22219/repositor.v2i5.440", "source_packet_sha256": "1e42887722bda1970c8f1ab24b314a1a1eac0736d355b9e08c3c936d7d736c8d", "source_quote": "Pembagian kelompok pada titik cluster akan menghasilkan output ip penyerang", "source_quote_locator": {"abstract_source_doi": "10.22219/repositor.v2i5.440", "field": "deposited abstract (HTML normalized)"}, "source_sha256": "70de351153c1cfa6e3e362d0ee92ef5f12aba4f86a3aedddad722c0d2cecda13", "source_title": "Analisa Real-Time Data log honeypot menggunakan Algoritma K-Means pada serangan Distributed Denial of Service", "source_type": "deposited abstract and bibliographic version metadata; no full-text analysis", "tags": [], "techniques": ["Honeypot"], "version_history": [{"creators": [{"affiliation": [], "family": "Hermawan", "given": "Denni Septian", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "first"}, {"affiliation": [], "family": "Syaifuddin", "given": "Syaifuddin", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}, {"affiliation": [], "family": "Risqiwati", "given": "Diah", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}], "deposited_descriptions": null, "doi": "10.22219/repositor.v2i5.30638", "issue": "5", "issued": {"date-parts": [[2024, 1, 16]]}, "journal": ["Jurnal Repositor"], "metadata_sha256": "0735134d9e8530537602e34b1a51326fbda1fda2557f6a959169a4197a6aaa92", "metadata_url": "https://api.crossref.org/works/10.22219/repositor.v2i5.30638", "page": null, "relations": null, "resource_type": null, "titles": ["Analisa Real-Time Data log honeypot menggunakan Algoritma K-Means pada serangan Distributed Denial of Service"], "volume": "2"}, {"creators": [{"affiliation": [], "family": "Hermawan", "given": "Denni Septian", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "first"}, {"affiliation": [], "family": "Syaifuddin", "given": "Syaifuddin", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}, {"affiliation": [], "family": "Risqiwati", "given": "Diah", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}], "deposited_descriptions": null, "doi": "10.22219/repositor.v2i5.440", "issue": "5", "issued": {"date-parts": [[2020, 3, 6]]}, "journal": ["Jurnal Repositor"], "metadata_sha256": "70de351153c1cfa6e3e362d0ee92ef5f12aba4f86a3aedddad722c0d2cecda13", "metadata_url": "https://api.crossref.org/works/10.22219/repositor.v2i5.440", "page": "541-552", "relations": null, "resource_type": null, "titles": ["Analisa Real-Time Data log honeypot menggunakan Algoritma  K-Means pada serangan Distributed Denial of Service"], "volume": "2"}]}, "evidence": "primary-source-passages", "id": "doi-10-22219-repositor-v2i5-440", "kind": "paper", "name": "Analisa Real-Time Data log honeypot menggunakan Algoritma K-Means pada serangan Distributed Denial of Service", "organization": null, "reviewed_at": "2026-10-17", "slug": "doi-10-22219-repositor-v2i5-440", "source_url": "https://doi.org/10.22219/repositor.v2i5.440", "status": "published", "summary_en": "The paper describes using K-Means to group attacks from honeypot logs collected in real time through MHN and identify attacker IP addresses. It aims to support administrators in analyzing network attacks.", "summary_es": "El artículo describe el uso de K-Means para agrupar ataques a partir de registros de honeypots recogidos en tiempo real mediante MHN e identificar direcciones IP de atacantes. Busca apoyar al administrador en el análisis de ataques en la red.", "updated_at": "2026-10-17", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Melia Mispriatin", "Jaffaruddin Gusti Amri Ginting", "Bongga Arifwidodo"], "doi": "10.22236/teknoka.v6i1.448", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-029-2026-10-16.json", "eligibility_selection_report_sha256": "687cb1948560b1f4e07968562c99ec71bf6a00235ac36fab4a7fccf800b06949", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "Prosiding Seminar Nasional Teknoka", "limitations_en": "Review based only on the deposited abstract; the full text was not read and the results were not independently verified.", "limitations_es": "Revisión basada únicamente en el resumen depositado; no se leyó el texto completo ni se verificaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.22236/teknoka.v6i1.448", "source_quote": "Honeypot merupakan sistem keamanan untuk memantau dan menganalisis setiap aktivitas serangan yang masuk ke sistem.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "bfe8d74793cf879ffb2f74c99fea2bffe942bd1341f38912ddbdc41b4700fd51", "source_title": "Analisis Kinerja Honeypot Dionaea Dan Cowrie Dalam Mendeteksi Serangan", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-22236-teknoka-v6i1-448", "kind": "paper", "name": "Analisis Kinerja Honeypot Dionaea Dan Cowrie Dalam Mendeteksi Serangan", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-22236-teknoka-v6i1-448", "source_url": "https://doi.org/10.22236/teknoka.v6i1.448", "status": "published", "summary_en": "The authors compare the low-interaction honeypot Dionaea and the medium-interaction honeypot Cowrie against port scanning, SSH brute force and DoS. The study aims to assess attack capture, interaction with the attacker, and effects on network metrics and resource usage.", "summary_es": "Los autores comparan el honeypot de baja interacción Dionaea y el de interacción media Cowrie frente a escaneo de puertos, fuerza bruta SSH y DoS. El estudio busca evaluar la captura de ataques, la interacción con el atacante y el efecto en métricas de red y consumo de recursos.", "updated_at": "2026-10-16", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Carlos Enrique Montenegro Marín", "Paulo Alonso Gaona García", "Julio Barón Velandia"], "doi": "10.22335/rlct.v8i1.344", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-029-2026-10-16.json", "eligibility_selection_report_sha256": "687cb1948560b1f4e07968562c99ec71bf6a00235ac36fab4a7fccf800b06949", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "Revista Logos Ciencia &amp; Tecnología", "limitations_en": "Review based only on the abstract deposited in Crossref; the full text was not consulted and results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se consultó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.22335/rlct.v8i1.344", "source_quote": "El propósito del siguiente artículo es llevar a cabo el planteamiento de un modelo ontológico para la identificación de tipos de ataques más comunes a partir del uso de honeynets, y su implementación sobre escenarios de trabajo.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "0aade771c24a8ce5dfc7fe5ab9bc4894b40b7e0f9e357903468fc8ef59c13ade", "source_title": "Modelo ontológico para la predicción de ataques informáticos a partir de Honeynets virtualizadas", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-22335-rlct-v8i1-344", "kind": "paper", "name": "Modelo ontológico para la predicción de ataques informáticos a partir de Honeynets virtualizadas", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-22335-rlct-v8i1-344", "source_url": "https://doi.org/10.22335/rlct.v8i1.344", "status": "published", "summary_en": "The work proposes an ontological model for identifying the most common types of attacks from the use of honeynets, and outlines its implementation in working scenarios. Its purpose is to support decision-making about the placement of computer elements and components within an organization.", "summary_es": "El trabajo propone un modelo ontológico para identificar los tipos de ataques más comunes a partir del uso de honeynets, y plantea su implementación en escenarios de trabajo. Su propósito es facilitar la toma de decisiones sobre la ubicación de elementos y componentes informáticos en una organización.", "updated_at": "2026-10-16", "year": 2016}
{"critical_reading": null, "data": {"abstract_source_doi": "10.22399/ijcesen.5010", "access_date": "2026-10-16", "authors": ["Sai Yeswanth Maturi"], "creator_name_aliases_inferred": false, "doi": "10.22399/ijcesen.5010", "doi_aliases": ["10.20944/preprints202512.1997.v1"], "draft_review_basis": "deepseek-draft-and-independent-claude-review", "environments": ["Network"], "family_resource_count": 1, "family_scope_basis": [{"batch": 19, "candidate_id": "doi:10.20944/preprints202512.1997.v1", "catalog_decision": null, "doi": "10.20944/preprints202512.1997.v1", "existing_identifier_matches": [], "existing_title_matches": [], "identity_status": "declared-version-family-review-needed", "selection_report": "data/coverage/bibliography-deposited-third-crossref-019-2026-10-16.json", "selection_report_sha256": "c17facbe1e34cc3222432c3ff984e56fc94cd9bc3ba0bc4101bb4b159e55bdca", "source_sha256": "60d16a4a03a9e10ee0cb849effe7e762950d738f5fe4f300b1a4ac920bdc346a", "title": "Decoy Data Nexus: Graph-Based Integration and Analysis of Synthetic Honeypot Logs Through Structured Threat Intelligence", "year": 2025}], "full_text_equality_claimed": false, "full_text_reviewed": false, "identity_report": "data/coverage/deposited-followup-family-review-2026-10-16.json", "identity_report_sha256": "d8486dc729d6c0aa6a91da335c385db7fbbce91367b6f1514f6601698918bdf8", "journal": "International Journal of Computational and Experimental Science and Engineering", "limitations_en": "Deposited abstract and version metadata only; no full text was analyzed and results were not independently verified. The journal record has no abstract of its own, so this summary is based on the explicitly linked preprint abstract.", "limitations_es": "Resumen depositado y metadatos de versión únicamente; no se analizó el texto completo ni se verificaron de forma independiente los resultados. El registro de revista no tiene resumen propio, por lo que este resumen se basa en el resumen del preprint enlazado explícitamente.", "metadata_sha256": "08bf18f1c0985ff2319c4a03ce72ab861aea8fb2f839dd2d085ae0273ab6728c", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "source-page", "review_depth": "deposited abstract of DOI 10.22399/ijcesen.5010; version identity metadata; no full-text analysis", "reviewed_metadata_url": "https://api.crossref.org/works/10.22399/ijcesen.5010", "selection_report": "data/coverage/bibliography-deposited-third-crossref-019-2026-10-16.json", "selection_report_sha256": "c17facbe1e34cc3222432c3ff984e56fc94cd9bc3ba0bc4101bb4b159e55bdca", "source_document_url": "https://doi.org/10.22399/ijcesen.5010", "source_packet_sha256": "40eefba4da8999ad08933bf0c7d98893ea991b90ea08e69e5e64f8c0d9da53de", "source_quote": "simulate, transform, and integrate synthetic honeypot logs into a graph database using the Structured Threat Information Expression (STIX) data model", "source_quote_locator": {"abstract_source_doi": "10.22399/ijcesen.5010", "field": "deposited abstract (HTML normalized)"}, "source_sha256": "08bf18f1c0985ff2319c4a03ce72ab861aea8fb2f839dd2d085ae0273ab6728c", "source_title": "Decoy Data Nexus: Graph-Based Integration and Analysis of Synthetic Honeypot Logs Through Structured Threat Intelligence", "source_type": "deposited abstract of DOI 10.22399/ijcesen.5010; version identity metadata; no full-text analysis", "tags": [], "techniques": ["Honeypot"], "version_history": [{"creators": [{"affiliation": [], "family": "Maturi", "given": "Sai Yeswanth", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "first"}], "doi": "10.20944/preprints202512.1997.v1", "issued": {"date-parts": [[2025, 12, 23]]}, "metadata_sha256": "60d16a4a03a9e10ee0cb849effe7e762950d738f5fe4f300b1a4ac920bdc346a", "titles": ["Decoy Data Nexus: Graph-Based Integration and Analysis of Synthetic Honeypot Logs Through Structured Threat Intelligence"]}, {"creators": [{"affiliation": [], "family": "Maturi", "given": "Sai Yeswanth", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "first"}], "doi": "10.22399/ijcesen.5010", "issued": {"date-parts": [[2024, 12, 30]]}, "metadata_sha256": "08bf18f1c0985ff2319c4a03ce72ab861aea8fb2f839dd2d085ae0273ab6728c", "titles": ["Decoy Data Nexus: Graph-Based Integration and Analysis of Synthetic Honeypot Logs Through Structured Threat Intelligence"]}]}, "evidence": "primary-source-passages", "id": "doi-10-22399-ijcesen-5010", "kind": "paper", "name": "Decoy Data Nexus: Graph-Based Integration and Analysis of Synthetic Honeypot Logs Through Structured Threat Intelligence", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-22399-ijcesen-5010", "source_url": "https://doi.org/10.22399/ijcesen.5010", "status": "published", "summary_en": "It proposes simulating, transforming and integrating synthetic honeypot logs into a graph database using the STIX model, aiming to convert attack data into interconnected threat intelligence objects for visualization and exploration. The purpose is to provide security operations centers with a standardized platform that enhances situational awareness and decision-making support.", "summary_es": "Propone simular, transformar e integrar registros sintéticos de honeypot en una base de datos de grafos mediante el modelo STIX, con el fin de convertir datos de ataque en objetos de inteligencia de amenazas interconectados para su visualización y exploración. El objetivo es ofrecer a los centros de operaciones de seguridad una plataforma estandarizada que mejore la conciencia situacional y el apoyo a la toma de decisiones.", "updated_at": "2026-10-16", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-16", "authors": ["Hafsat Muhammad", "Olumide B. Longe", "Abimbola Baale", "U-O Ekpo Antai"], "creator_metadata_correction": "Affiliation-only organizational contributor omitted from personal author list after comparison with PDF page 1; raw deposited creators preserved.", "deposited_creators": [{"affiliation": [], "name": "1,3,4Doctoral Programme in Cyber Security,  African Centre of Excellence for Technology Enhanced Learning (ACETEL)  National Open University of Nigeria, Abuja, Nigeria  2Faculty of Computational Sciences & Informatics, academic City University, Accra, Ghana", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "first"}, {"affiliation": [], "family": "Muhammad", "given": "Hafsat", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "first"}, {"affiliation": [], "family": "Longe", "given": "Olumide .B", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}, {"affiliation": [], "family": "Baale,", "given": "Abimbola", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}, {"affiliation": [], "family": "Antai", "given": "U-O Ekpo", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}], "doi": "10.22624/aims/accrabespoke2022/v34p4", "doi_aliases": [], "draft_review_basis": "deepseek-original-draft; codex-source-correction-and-independent-claude-review", "environments": ["Application", "Network"], "full_text_reviewed": false, "journal": "Advances in Multidisciplinary and scientific Research Journal Publication", "limitations_en": "Reading limited to pages 2 and 5 (page 1 visually checked); no replication, metrics or effectiveness validation.", "limitations_es": "Lectura limitada a las páginas 2 y 5 (página 1 verificada visualmente); sin replicación, métricas ni validación de eficacia.", "metadata_sha256": "35956b82a8a51168647e25ae6ef615542638c183f666c89158bc069c03e1f317", "pdf_pages_read": [2, 5], "pdf_source_sha256": "1fa17d17eb4f2525fe378d1004d5c3c08d8f086241cc988d6747c594ac221460", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "source-page", "review_depth": "verified primary PDF, selected method/aim pages; not full-text analysis", "reviewed_metadata_url": "https://api.crossref.org/works/10.22624/aims/accrabespoke2022/v34p4", "selection_report": "data/coverage/crossref-wave2-pdf-source-review-2026-10-16.json", "selection_report_sha256": "0462d1abccf75269f1669fecacfabc11eb11383763a97c77bfbcfea7c3bebe46", "source_correction_input_sha256": "3968841e105306a227b72ecb8d61f9e1326e6507da91b619b896be4bf6cb8fae", "source_document_url": "https://fcc08321-8158-469b-b54d-f591e0bd3df4.filesusr.com/ugd/185b0a_58d65b48ce8a463ab086f646c0a9bbfe.pdf", "source_packet_sha256": "62fbef80b40827ff4a393e9e012fe4dcb4344496caac1fe34081385825596f91", "source_quote": "Honeypots will be design and integrated into the website in other to lewd the malicious software", "source_quote_locator": {"normalization": "whitespace reflow", "pdf_page": 2, "pdf_sha256": "1fa17d17eb4f2525fe378d1004d5c3c08d8f086241cc988d6747c594ac221460"}, "source_sha256": "1fa17d17eb4f2525fe378d1004d5c3c08d8f086241cc988d6747c594ac221460", "source_title": "Towards the Development of a Machine Learning Enhanceed Framework for Honeypot and CAPTCHA Intrusion Detection Systems", "source_type": "verified primary PDF, selected method/aim pages; not full-text analysis", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "primary-source-passages", "id": "doi-10-22624-aims-accrabespoke2022-v34p4", "kind": "paper", "name": "Towards the Development of a Machine Learning Enhanceed Framework for Honeypot and CAPTCHA Intrusion Detection Systems", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-22624-aims-accrabespoke2022-v34p4", "source_url": "https://doi.org/10.22624/aims/accrabespoke2022/v34p4", "status": "published", "summary_en": "The paper proposes an intrusion detection framework combining CAPTCHA, honeypots and supervised learning. Honeypots would be integrated into a website to lure malicious software, and the diagram sketches realistic decoy pages and decoy fields.", "summary_es": "El artículo propone un marco de detección de intrusiones que combina CAPTCHA, honeypots y aprendizaje supervisado. Los honeypots se integrarían en un sitio web para atraer software malicioso, y el diagrama esboza páginas señuelo realistas y campos trampa.", "updated_at": "2026-10-16", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["1,2Department of Computer Science, Faculty of Computing University of Delta, Agbor, Delta State, Nigeria, , 3Department of Computer Science, Faculty of Physical Science University of Calabar, Calabar, Nigeria", "Bridget Malasowe", "Fideli Aghware", "Bassey Edim Edim"], "doi": "10.22624/aims/cisdi/v15n1p2", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-029-2026-10-16.json", "eligibility_selection_report_sha256": "687cb1948560b1f4e07968562c99ec71bf6a00235ac36fab4a7fccf800b06949", "environments": ["Application"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "Advances in Multidisciplinary &amp; Scientific Research Journal Publications", "limitations_en": "Review limited to the Crossref-deposited abstract; no full text was reviewed and results were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se verificó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.22624/aims/cisdi/v15n1p2", "source_quote": "We explore a deep learning deception-based honeypot to minimize breaches by adversaries.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "b8a4c5e106723ebdd9a3ecf8648d947fbc0a722fba577f05c5403c6d3ddfd4e8", "source_title": "Pilot Study on Web Server HoneyPot Integration Using Injection Approach for Malware Intrusion Detection", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-22624-aims-cisdi-v15n1p2", "kind": "paper", "name": "Pilot Study on Web Server HoneyPot Integration Using Injection Approach for Malware Intrusion Detection", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-22624-aims-cisdi-v15n1p2", "source_url": "https://doi.org/10.22624/aims/cisdi/v15n1p2", "status": "published", "summary_en": "Pilot study exploring a deception-based honeypot using deep learning, integrated via an injection approach on web servers, aiming to minimize security breaches and detect intrusive malware activity. The authors report identification capabilities as the system learns and defends a user system against intrusive actions.", "summary_es": "Estudio piloto que explora un honeypot basado en decepción y aprendizaje profundo, integrado mediante un enfoque de inyección en servidores web, con el propósito de reducir brechas de seguridad y detectar actividades intrusivas dirigidas a malware. Los autores reportan capacidades de identificación mientras el sistema aprende y defiende un sistema de usuario.", "updated_at": "2026-10-16", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Matej Zuzcák", "Petr Bujok"], "doi": "10.2298/csis200715040z", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-029-2026-10-16.json", "eligibility_selection_report_sha256": "687cb1948560b1f4e07968562c99ec71bf6a00235ac36fab4a7fccf800b06949", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "Computer Science and Information Systems", "limitations_en": "Review based only on the abstract deposited with Crossref; the full text was not accessed and results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se accedió al texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.2298/csis200715040z", "source_quote": "This article presents multiple methods for using a time series, based on real-world data, to predict these attacks.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "ce4b731b07cf7a49f36ab1c25a002206af93532a30567e847945e2fb3a860a89", "source_title": "Using honeynet data and a time series to predict the number of cyber attacks", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-2298-csis200715040z", "kind": "paper", "name": "Using honeynet data and a time series to predict the number of cyber attacks", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-2298-csis200715040z", "source_url": "https://doi.org/10.2298/csis200715040z", "status": "published", "summary_en": "The authors describe using honeynet data and time series to predict SSH attacks, covering overall activity and attacks from specific geographical regions. They apply ARIMA, SARIMA, GARCH and Bootstrapping with real-world data, presenting the viability, precision and usefulness of each approach across areas of IT security.", "summary_es": "Los autores describen el uso de datos de una honeynet y series temporales para predecir ataques SSH, incluyendo la actividad general y la de regiones geográficas específicas. Emplean ARIMA, SARIMA, GARCH y Bootstrapping con datos reales, y presentan la viabilidad, precisión y utilidad de cada enfoque para distintas áreas de seguridad informática.", "updated_at": "2026-10-16", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Docente de la Universidad Politécnica Estatal del Carchi", "Milton Gabriel Del Hierro Mosquera", "Tulcán, Ecuador."], "doi": "10.23857/pc.v10i10.10542", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-029-2026-10-16.json", "eligibility_selection_report_sha256": "687cb1948560b1f4e07968562c99ec71bf6a00235ac36fab4a7fccf800b06949", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "Polo del Conocimiento", "limitations_en": "Review limited to the abstract deposited in Crossref; the full text was not consulted and results were not independently verified.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se consultó el texto completo ni se verificaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.23857/pc.v10i10.10542", "source_quote": "La herramienta utilizada para la recolección de datos es un honeypot montado con la plataforma t-pot, elastic seach kibana y suricata", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "6fc65e66a2399350dc10dcca041402a70ce439d84f24caf425b71c76e27864f5", "source_title": "Clasificación de las CVE según su vulnerabilidad más explotada con datos obtenidos de T-pot honeypot", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-23857-pc-v10i10-10542", "kind": "paper", "name": "Clasificación de las CVE según su vulnerabilidad más explotada con datos obtenidos de T-pot honeypot", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-23857-pc-v10i10-10542", "source_url": "https://doi.org/10.23857/pc.v10i10.10542", "status": "published", "summary_en": "The work addresses classifying CVE vulnerabilities by which are most frequently exploited, using data collected from a T-pot honeypot. The authors describe a data-collection and analysis plan using Elasticsearch, Kibana and Suricata, aimed at identifying vulnerabilities attractive to malicious actors and the risk they pose to Universidad Politécnica Estatal del Carchi.", "summary_es": "El trabajo aborda la clasificación de vulnerabilidades CVE según cuáles se explotan con más frecuencia, usando datos recogidos de un honeypot T-pot. Los autores describen un plan de recopilación y análisis con Elasticsearch, Kibana y Suricata, orientado a identificar vulnerabilidades atractivas para actores maliciosos y su riesgo para la Universidad Politécnica Estatal del Carchi.", "updated_at": "2026-10-16", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Universidad Politécnica Estatal del Carchi Ecuador", "Milton Gabriel Del Hierro Mosquera"], "doi": "10.23857/pc.v10i10.10543", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-030-2026-10-16.json", "eligibility_selection_report_sha256": "463bb62ffd7e18f49fd699e38a454b9631fd6e60e062d539977b9c7a548e8478", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "Polo del Conocimiento", "limitations_en": "Review limited to the Crossref-deposited abstract; no full text was accessed and results were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se accedió al texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.23857/pc.v10i10.10543", "source_quote": "utilizando para ello una versión modificada de T-Pot Honeypot, una plataforma compuesta por múltiples honeypots desplegados en contenedores Docker que emulaban diversos servicios vulnerables", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "dd08f4168df57b73319df97ca95428ff79a6308a0aa715b01f91a0f406be183a", "source_title": "Análisis de los patrones y tácticas de los atacantes mediante una T-pot honeypot", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-23857-pc-v10i10-10543", "kind": "paper", "name": "Análisis de los patrones y tácticas de los atacantes mediante una T-pot honeypot", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-23857-pc-v10i10-10543", "source_url": "https://doi.org/10.23857/pc.v10i10.10543", "status": "published", "summary_en": "The study analyzes malicious actors' patterns and tactics using a modified T-Pot Honeypot, with multiple honeypots in Docker containers emulating vulnerable services. It aims to collect and analyze exploitation, evasion and credential attempts to characterize threats and inform cyberdefense adjustments.", "summary_es": "El estudio analiza patrones y tácticas de actores maliciosos mediante una versión modificada de T-Pot Honeypot, con múltiples honeypots en contenedores Docker que emulan servicios vulnerables. Busca recopilar y analizar intentos de explotación, evasión y credenciales para caracterizar amenazas y ajustar la ciberdefensa.", "updated_at": "2026-10-16", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Sahlan Zain"], "doi": "10.23960/jpi.v6n2.222", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-030-2026-10-16.json", "eligibility_selection_report_sha256": "463bb62ffd7e18f49fd699e38a454b9631fd6e60e062d539977b9c7a548e8478", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "Jurnal Profesi Insinyur Universitas Lampung", "limitations_en": "Review based only on the Crossref-deposited abstract; the full text was not examined and results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se examinó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.23960/jpi.v6n2.222", "source_quote": "Honeypot digunakan untuk menjebak serta memonitor aktivitas penyerang, sementara Network Obfuscation menyamarkan struktur jaringan asli dan mengarahkan lalu lintas mencurigakan ke sistem honeypot.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "bc528aaba067ce6eb5319b3e4ffde851b2b51b4955749ec59df0c941a43f2d78", "source_title": "Penerapan Honeypot Dan Network Obfuscation Sebagai Sistem Pertahanan Aktif Dalam Keamanan Jaringan", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-23960-jpi-v6n2-222", "kind": "paper", "name": "Penerapan Honeypot Dan Network Obfuscation Sebagai Sistem Pertahanan Aktif Dalam Keamanan Jaringan", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-23960-jpi-v6n2-222", "source_url": "https://doi.org/10.23960/jpi.v6n2.222", "status": "published", "summary_en": "The authors describe designing and implementing an active defense system on a DATANET server that combines a honeypot to lure and monitor attacker activity with network obfuscation to mask the real network structure and redirect suspicious traffic. They report that the system detected and diverted attacks without disrupting the main service.", "summary_es": "Los autores describen el diseño e implementación de un sistema de defensa activa en un servidor DATANET que combina un honeypot para atraer y monitorear la actividad de atacantes con la ofuscación de red para ocultar la estructura real y redirigir tráfico sospechoso. Reportan que el sistema detectó y desvió ataques sin interrumpir el servicio principal.", "updated_at": "2026-10-16", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Fabián Ranulfo Cuesta Quintero", "Luis Anderson Coronel Rojas", "Dewar Rico Bautista", "Edwin Barrientos Avendaño", "Oscar José Montañez vergel", "Carlos Mario Páez Noriega"], "doi": "10.24054/16927257.v33.n33.2019.3328", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-030-2026-10-16.json", "eligibility_selection_report_sha256": "463bb62ffd7e18f49fd699e38a454b9631fd6e60e062d539977b9c7a548e8478", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "REVISTA COLOMBIANA DE TECNOLOGIAS DE AVANZADA (RCTA)", "limitations_en": "Review based only on the deposited abstract; the full text was not examined and results were not independently validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado; no se verificó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.24054/16927257.v33.n33.2019.3328", "source_quote": "Esta herramienta es usada en el ámbito de la seguridad informática con la finalidad de atraer y analizar el comportamiento de los atacantes en internet.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "3db410181fbb3f97a2338acfe37c231e0c3806d7c7c8c08cc882ca76abaf7614", "source_title": "SISTEMA DE DETECCIÓN DE INTRUSOS A TRAVÉS DE UNA RED HONEYNET PARA ENTORNOS DE RED CABLEADA SOBRE IPV6", "techniques": ["Honeypot", "Decoy"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-24054-16927257-v33-n33-2019-3328", "kind": "paper", "name": "SISTEMA DE DETECCIÓN DE INTRUSOS A TRAVÉS DE UNA RED HONEYNET PARA ENTORNOS DE RED CABLEADA SOBRE IPV6", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-24054-16927257-v33-n33-2019-3328", "source_url": "https://doi.org/10.24054/16927257.v33.n33.2019.3328", "status": "published", "summary_en": "The authors present experimental tests of common attacks on wired IPv6 networks and describe the design and implementation of a Honeynet with different operating systems. They use tools such as 6Guard, Snort and Wireshark to attract, detect and analyze attacker behavior.", "summary_es": "Los autores presentan pruebas experimentales de ataques comunes en redes cableadas IPv6 y describen el diseño e implementación de una red Honeynet con distintos sistemas operativos. Emplean herramientas como 6Guard, Snort y Wireshark para atraer, detectar y analizar el comportamiento de los atacantes.", "updated_at": "2026-10-16", "year": 2019}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Iman Hazwam Bin Abd Halim", "Nur Muhammad Irfan Bin Abu Hassan", "Tajul Rosli Razak", "Muhammad Nabil Fikri bin Jamaluddin", "Mohammad Hafiz Bin Ismail"], "doi": "10.24191/jcrinn.v4i1.114", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-030-2026-10-16.json", "eligibility_selection_report_sha256": "463bb62ffd7e18f49fd699e38a454b9631fd6e60e062d539977b9c7a548e8478", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "Journal of Computing Research and Innovation", "limitations_en": "Review limited to the Crossref-deposited abstract; full text was not read and results were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se leyó el texto completo ni se validaron de forma independiente los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.24191/jcrinn.v4i1.114", "source_quote": "we propose an approach to decrease the log size that is by using a Cron job that will run with a Perl-script", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "5e552a2b959ca97a0aa2096d9a602ed21746e304d9a6acb6f2d5b80d9ca800cc", "source_title": "Reducing Honeypot Log Storage Capacity Consumption – Cron Job with Perl-Script Approach", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-24191-jcrinn-v4i1-114", "kind": "paper", "name": "Reducing Honeypot Log Storage Capacity Consumption – Cron Job with Perl-Script Approach", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-24191-jcrinn-v4i1-114", "source_url": "https://doi.org/10.24191/jcrinn.v4i1.114", "status": "published", "summary_en": "The authors propose using a Cron job with a Perl script to periodically parse collected data into a database, aiming to reduce the size of logs generated by a honeypot under heavy traffic such as DDoS attacks. They report three DDoS attack cases to illustrate log growth.", "summary_es": "Los autores proponen usar una tarea Cron con un script Perl para analizar periódicamente los datos recogidos y pasarlos a una base de datos, con el fin de reducir el tamaño de los registros generados por un honeypot durante tráfico intenso, como ataques DDoS. Presentan tres casos de ataque DDoS para ilustrar el crecimiento del registro.", "updated_at": "2026-10-16", "year": 2019}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Alja Aminanto", "Wiwin Sulistyo"], "doi": "10.24246/aiti.v16i2.135-150", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-030-2026-10-16.json", "eligibility_selection_report_sha256": "463bb62ffd7e18f49fd699e38a454b9631fd6e60e062d539977b9c7a548e8478", "environments": ["Network"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "AITI", "limitations_en": "Review based solely on the Crossref-deposited abstract, not the full text or independent validation of results.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref, no en el texto completo ni en una validación independiente de los resultados.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.24246/aiti.v16i2.135-150", "source_quote": "when the attack has been identified, IPS Snort will deny the access (block) and log of all data packets identified", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "2704ed7d095060fdefa5c9742b76fe58fd8d8376b54e620f7636ee61c2997434", "source_title": "Simulasi Sistem Keamanan Jaringan Komputer Berbasis IPS Snort dan Honeypot Artilery", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-24246-aiti-v16i2-135-150", "kind": "paper", "name": "Simulasi Sistem Keamanan Jaringan Komputer Berbasis IPS Snort dan Honeypot Artilery", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-24246-aiti-v16i2-135-150", "source_url": "https://doi.org/10.24246/aiti.v16i2.135-150", "status": "published", "summary_en": "The study simulates a network defense combining IPS Snort, which examines packets and blocks access identified as attacks, with Honeypot Artillery, which detects intrusion attempts through open ports and records attacker information in a database viewable through a web interface.", "summary_es": "El estudio simula una defensa de red que combina el IPS Snort, que examina paquetes y bloquea accesos identificados como ataques, con Honeypot Artillery, que detecta intentos de intrusión por puertos abiertos y registra información sobre el atacante en una base de datos consultable por interfaz web.", "updated_at": "2026-10-16", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "authors": ["Edward Cranford", "Cleotilde Gonzalez", "Palvi Aggarwal", "Sarah Cooney", "Milind Tambe", "Christian Lebiere"], "design_en": "Adaptive signaling model informed by a cognitive model and attacker experience.", "design_es": "Modelo de señalización adaptativa informado por un modelo cognitivo y experiencia del atacante.", "doi": "10.24251/hicss.2020.232", "environments": ["Network"], "finding_en": "Proposes adapting signals to exploit and preserve attacker belief instead of assuming perfect rationality.", "finding_es": "Propone ajustar señales para explotar y conservar la creencia del atacante en lugar de asumir racionalidad perfecta.", "full_text_reviewed_at": "2026-09-16", "journal": "Proceedings of the Annual Hawaii International Conference on System Sciences", "limits_en": "The contribution is mainly modeling; transfer to real adversaries and operations needs further experiments.", "limits_es": "El aporte es principalmente modelado; la transferencia a adversarios y operaciones reales requiere experimentos adicionales.", "review_basis": "full-text", "source_title": "Adaptive Cyber Deception: Cognitively Informed Signaling for Cyber Defense", "tags": ["DOI"], "techniques": ["Decoy"]}, "evidence": "full-text-review", "id": "doi-10-24251-hicss-2020-232", "kind": "paper", "name": "Adaptive Cyber Deception: Cognitively Informed Signaling for Cyber Defense", "organization": "Edward Cranford, Cleotilde Gonzalez", "reviewed_at": "2026-09-16", "slug": "doi-10-24251-hicss-2020-232", "source_url": "https://doi.org/10.24251/hicss.2020.232", "status": "published", "summary_en": "Bibliographic record on adaptive signaling for cyber defense. The abstract and findings still require review.", "summary_es": "Registro bibliográfico sobre señales adaptativas para defensa. El resumen y los resultados aún requieren lectura.", "updated_at": "2026-09-18", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "authors": ["Amirreza Niakanlahiji", "Jafar Haadi Jafarian", "Bei-Tseng Chu", "Ehab Al-Shaer"], "doi": "10.24251/hicss.2020.233", "environments": ["Application"], "journal": "Proceedings of the Annual Hawaii International Conference on System Sciences", "review_basis": "publisher-metadata", "source_title": "HoneyBug: Personalized Cyber Deception for Web Applications", "tags": ["DOI"], "techniques": ["Decoy"]}, "evidence": "publisher-metadata", "id": "doi-10-24251-hicss-2020-233", "kind": "paper", "name": "HoneyBug: Personalized Cyber Deception for Web Applications", "organization": "Amirreza Niakanlahiji, Jafar Haadi Jafarian", "reviewed_at": "2026-09-15", "slug": "doi-10-24251-hicss-2020-233", "source_url": "https://doi.org/10.24251/hicss.2020.233", "status": "published", "summary_en": "Bibliographic record on personalized web-application deception. The abstract and findings still require review.", "summary_es": "Registro bibliográfico sobre deception personalizado en aplicaciones web. El resumen y los resultados aún requieren lectura.", "updated_at": "2026-09-15", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "authors": ["Debi Ashenden", "Rob Black", "Iain Reid", "Simon Henderson"], "design_en": "Exploratory use of design thinking to synthesize deception concepts from multiple domains.", "design_es": "Aplicación exploratoria de design thinking para sintetizar conceptos de engaño de varios dominios.", "doi": "10.24251/hicss.2021.240", "environments": ["Network"], "finding_en": "Produces concepts and an ideation process to broaden the defender repertoire.", "finding_es": "Produce conceptos y un proceso de ideación para ampliar el repertorio del defensor.", "full_text_reviewed_at": "2026-09-16", "journal": "Proceedings of the Annual Hawaii International Conference on System Sciences", "limits_en": "Concepts are not evaluated as deployed controls or through security metrics.", "limits_es": "Los conceptos no se evalúan como controles desplegados ni mediante métricas de seguridad.", "review_basis": "full-text", "source_title": "Design Thinking for Cyber Deception", "tags": ["DOI"], "techniques": ["Decoy"]}, "evidence": "full-text-review", "id": "doi-10-24251-hicss-2021-240", "kind": "paper", "name": "Design Thinking for Cyber Deception", "organization": "Debi Ashenden, Rob Black", "reviewed_at": "2026-09-16", "slug": "doi-10-24251-hicss-2021-240", "source_url": "https://doi.org/10.24251/hicss.2021.240", "status": "published", "summary_en": "Bibliographic record on design thinking for cyber deception. The abstract and findings still require review.", "summary_es": "Registro bibliográfico sobre design thinking para cyberdeception. El resumen y los resultados aún requieren lectura.", "updated_at": "2026-09-18", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "authors": ["Jason Landsborough", "Luke Carpenter", "Braulio Coronado", "Sunny Fugate", "Kimberly Ferguson-Walter", "Dirk Van Bruggen"], "design_en": "Autonomic system comparing no deception, static decoys and adaptive tactics against an automated attacker.", "design_es": "Sistema autonómico que compara ausencia de deception, señuelos estáticos y tácticas adaptativas contra un atacante automatizado.", "doi": "10.24251/hicss.2021.244", "environments": ["Network"], "finding_en": "Experiments report defender advantage from decoys and goal-guided adaptation.", "finding_es": "Los experimentos reportan ventaja defensiva con señuelos y adaptación guiada por objetivos.", "full_text_reviewed_at": "2026-09-16", "journal": "Proceedings of the Annual Hawaii International Conference on System Sciences", "limits_en": "The attacker is automated and tactics and scenarios are limited; effects against human teams are not established.", "limits_es": "El atacante es automatizado y las tácticas y escenarios son acotados; no demuestra efecto frente a equipos humanos.", "review_basis": "full-text", "source_title": "Towards Self-Adaptive Cyber Deception for Defense", "tags": ["DOI"], "techniques": ["Decoy"]}, "evidence": "full-text-review", "id": "doi-10-24251-hicss-2021-244", "kind": "paper", "name": "Towards Self-Adaptive Cyber Deception for Defense", "organization": "Jason Landsborough, Luke Carpenter", "reviewed_at": "2026-09-16", "slug": "doi-10-24251-hicss-2021-244", "source_url": "https://doi.org/10.24251/hicss.2021.244", "status": "published", "summary_en": "Bibliographic record on self-adaptive deception. The abstract and findings still require review.", "summary_es": "Registro bibliográfico sobre deception autoadaptativo. El resumen y los resultados aún requieren lectura.", "updated_at": "2026-09-18", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Dr.Hanaa Mohsin Ahmed", "Dr. Nidaa Flaih Hassan", "Assmaa A. Fahad"], "doi": "10.24297/ijct.v11i4.3131", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-030-2026-10-16.json", "eligibility_selection_report_sha256": "463bb62ffd7e18f49fd699e38a454b9631fd6e60e062d539977b9c7a548e8478", "environments": ["Endpoint"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "INTERNATIONAL JOURNAL OF COMPUTERS &amp; TECHNOLOGY", "limitations_en": "Review based only on the Crossref-deposited abstract; the full text was not examined, and results, implementations, or effectiveness were not validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se examinó el texto completo ni se validaron resultados, implementaciones o eficacia.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.24297/ijct.v11i4.3131", "source_quote": "This paper presents a survey on recent researches in Smartphone honeypot.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "b50f65f0eabae3785db679dad4326e832259cdd92b8ae7cd83f24f13eb547190", "source_title": "A Survey on SmartPhone Honeypot", "techniques": ["Honeypot"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-24297-ijct-v11i4-3131", "kind": "paper", "name": "A Survey on SmartPhone Honeypot", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-24297-ijct-v11i4-3131", "source_url": "https://doi.org/10.24297/ijct.v11i4.3131", "status": "published", "summary_en": "The paper surveys recent research on smartphone honeypots. The authors describe challenges in setting up a smartphone honeypot, the methods used to build it, and the results and recommendations obtained.", "summary_es": "El artículo revisa investigaciones recientes sobre honeypots para teléfonos inteligentes. Los autores describen los retos de desplegar un honeypot en este entorno, los métodos empleados para construirlo y los resultados y recomendaciones obtenidos.", "updated_at": "2026-10-16", "year": 2013}
{"critical_reading": null, "data": {"access_date": "2026-10-11", "authors": ["Yasser A. Yasser", "Ahmed T. Sadiq", "Wasim AlHamdani"], "doi": "10.2478/cait-2022-0003", "draft_review_basis": "deepseek-draft-and-independent-claude-review", "eligibility_selection_report": "data/coverage/bibliography-deposited-third-crossref-030-2026-10-16.json", "eligibility_selection_report_sha256": "463bb62ffd7e18f49fd699e38a454b9631fd6e60e062d539977b9c7a548e8478", "environments": ["Identity"], "full_text_reviewed": false, "identity_proposal": "new-draft-candidate-against-v2026.10.2-and-83-reviewed-followups-with-abstract-and-declared-family-checks", "journal": "Cybernetics and Information Technologies", "limitations_en": "Review limited to the Crossref deposited abstract; full text was not accessed and experimental results or method effectiveness were not independently validated.", "limitations_es": "Revisión limitada al resumen depositado en Crossref; no se accedió al texto completo ni se validaron de forma independiente los resultados experimentales o la eficacia del método.", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.2478/cait-2022-0003", "source_quote": "This article proposes a novel method to generate honeyword using the meerkat clan intelligence algorithm, a metaheuristic swarm intelligence algorithm.", "source_quote_locator": "Crossref.message.abstract (HTML normalized)", "source_sha256": "e761ac63a6767e8011f5a4b4344f09a025c792926b6ce9bd1a7abd82d5895710", "source_title": "A Proposal for Honeyword Generation via Meerkat Clan Algorithm", "techniques": ["Honeytoken"]}, "evidence": "publisher-deposited-abstract", "id": "doi-10-2478-cait-2022-0003", "kind": "paper", "name": "A Proposal for Honeyword Generation via Meerkat Clan Algorithm", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-2478-cait-2022-0003", "source_url": "https://doi.org/10.2478/cait-2022-0003", "status": "published", "summary_en": "The paper proposes a method for generating honeywords using the meerkat clan intelligence algorithm, a metaheuristic swarm intelligence algorithm, aiming to improve the generation process, honeyword properties, and address issues of prior methods. The authors present previous methods, explain the proposed method, and compare experimental results.", "summary_es": "El artículo propone un método para generar honeywords usando el algoritmo de inteligencia de clan de suricatas, una metaheurística de enjambre, con el fin de mejorar el proceso de generación, las propiedades de los honeywords y resolver problemas de métodos previos. Los autores describen métodos anteriores, explican el método propuesto y comparan resultados experimentales.", "updated_at": "2026-10-16", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-15", "authors": ["Naufal Arkaan", "Dolly Virgian Shaka Yudha Sakti"], "doi": "10.25077/teknosi.v5i2.2019.112-120", "doi_aliases": [], "draft_review_basis": "deepseek-original-draft; codex-source-correction-and-independent-claude-review", "environments": ["Network"], "full_text_reviewed": false, "journal": "Jurnal Nasional Teknologi dan Sistem Informasi", "limitations_en": "Review based only on the deposited abstract; results were not validated and the full text was not consulted.", "limitations_es": "Revisión basada únicamente en el resumen depositado; no se validaron resultados ni se consultó el texto completo.", "metadata_sha256": "d0b9411738e03df0b29508a6e9e547885881b8d6346307d86d989ca5b9d86c2e", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "source-page", "review_depth": "Crossref member-deposited bibliographic metadata with abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.25077/teknosi.v5i2.2019.112-120", "selection_report": "data/coverage/educational-scope-third-review-2026-10-13.json", "selection_report_sha256": "51793eb87f113136572518fc4b6516e2c019f3714ebc6d160a68220f1c6706e3", "source_correction_input_sha256": "b0917c58b5d8f7bafac94a890b747835206318b7f6f08611e0bff408b75034ed", "source_document_url": "https://api.crossref.org/works/10.25077/teknosi.v5i2.2019.112-120", "source_packet_sha256": "1944266a282b031fa6829ce7e1da62a198df189e7a7aa4c79ffb81ff4e7b7ec7", "source_quote": "Honeypot ini berjenis low interaction yang dibuat menggunakan bahasa pemrograman python yang memanfaatkan konsep network programming.", "source_quote_locator": {"field": "Crossref.message.abstract (HTML normalized)"}, "source_sha256": "d0b9411738e03df0b29508a6e9e547885881b8d6346307d86d989ca5b9d86c2e", "source_title": "Implementasi Low Interaction Honeypot Untuk Analisa Serangan Pada Protokol SSH", "source_type": "Crossref member-deposited bibliographic metadata with abstract", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-source-passages", "id": "doi-10-25077-teknosi-v5i2-2019-112-120", "kind": "paper", "name": "Implementasi Low Interaction Honeypot Untuk Analisa Serangan Pada Protokol SSH", "organization": null, "reviewed_at": "2026-10-15", "slug": "doi-10-25077-teknosi-v5i2-2019-112-120", "source_url": "https://doi.org/10.25077/teknosi.v5i2.2019.112-120", "status": "published", "summary_en": "The paper describes a low-interaction Python honeypot that presents a fake SSH service to observe attacker behavior and authentication attempts while hiding the real SSH service.", "summary_es": "El artículo describe un honeypot de baja interacción en Python que presenta un servicio SSH falso para observar el comportamiento de los atacantes y los intentos de autenticación, mientras oculta el servicio SSH real.", "updated_at": "2026-10-15", "year": 2019}
{"critical_reading": null, "data": {"access_date": "2026-10-15", "authors": ["Kalyani Akshay Kulkarni"], "doi": "10.29121/shodhkosh.v5.i6.2024.5967", "doi_aliases": [], "draft_review_basis": "deepseek-original-draft; codex-source-correction-and-independent-claude-review", "environments": [], "full_text_reviewed": false, "journal": "ShodhKosh: Journal of Visual and Performing Arts", "limitations_en": "Only a short primary body passage plus a deposited abstract was read.", "limitations_es": "Solo se leyó un breve pasaje del cuerpo principal del PDF y el resumen depositado en Crossref.", "metadata_sha256": "1909365f0871fe213192ab7d658ddff91ccaa0622c6c208947e5c8e2660cd6d4", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "source-page", "review_depth": "manually preserved short PDF body passage from web PDF reader; original PDF bytes unavailable", "reviewed_metadata_url": "https://api.crossref.org/works/10.29121/shodhkosh.v5.i6.2024.5967", "selection_report": "data/coverage/educational-final-source-followup-review-2026-10-15.json", "selection_report_sha256": "e74f2be42efe49ddb3d0710e0bb130ef1b817b4e9593aa51f9eaa4f428f2b5a7", "source_correction_input_sha256": "900064e042ff0afc9381636882c20d3b2d749aec9f48ecf93702d48c8e1bf2c0", "source_document_url": "https://www.granthaalayahpublication.org/Arts-Journal/ShodhKosh/article/download/5967/5434/31217", "source_packet_sha256": "eb60681636c691e1c8023f782c53b425bada2d66fba1d08e76916cee5a84fa38", "source_quote": "honeypots, which attract attackers into controlled settings to observe their tactics.", "source_quote_locator": {"pdf_bytes_verified": false, "pdf_page": 4}, "source_sha256": "21752adc6dc480e183650ff51faa5ac48d18bea17b717e3d69a24ab71e4eca4b", "source_title": "CYBERSECURITY THROUGH THE LENS OF CHANAKYA: STRATEGIC WISDOM FROM THE ARTHASHASTRA FOR MODERN DIGITAL DEFENSE", "source_type": "manually preserved short PDF body passage from web PDF reader; original PDF bytes unavailable", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-source-passages", "id": "doi-10-29121-shodhkosh-v5-i6-2024-5967", "kind": "paper", "name": "CYBERSECURITY THROUGH THE LENS OF CHANAKYA: STRATEGIC WISDOM FROM THE ARTHASHASTRA FOR MODERN DIGITAL DEFENSE", "organization": null, "reviewed_at": "2026-10-15", "slug": "doi-10-29121-shodhkosh-v5-i6-2024-5967", "source_url": "https://doi.org/10.29121/shodhkosh.v5.i6.2024.5967", "status": "published", "summary_en": "The article connects strategic principles from Chanakya's Arthashastra with digital defense and presents honeypots as a means of attracting attackers into controlled environments to observe their tactics.", "summary_es": "El artículo relaciona principios estratégicos del Arthashastra de Chanakya con la defensa digital y presenta los honeypots como un medio de atraer atacantes a entornos controlados para observar sus tácticas.", "updated_at": "2026-10-15", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-15", "authors": ["Joel Scanlan", "Paul A. Watters", "Jeremy Prichard", "Charlotte Hunn", "Caroline Spiranovic", "Richard Wortley"], "doi": "10.3390/fi14040121", "doi_aliases": [], "draft_review_basis": "deepseek-original-draft; codex-source-correction-and-independent-claude-review", "environments": ["Application"], "full_text_reviewed": false, "journal": "Future Internet", "limitations_en": "The deposited abstract and primary body passages on the architecture were read; the full text was not reviewed in its entirety.", "limitations_es": "El resumen depositado y los pasajes principales del cuerpo del artículo sobre la arquitectura fueron leídos; el texto completo no se revisó en su totalidad.", "metadata_sha256": "802bfad3d3d6ba2dfe00633f3c19bdf7fc0a20fc583cb9d47a3860ce55609cb8", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "source-page", "review_depth": "PDF identity page and all pages matching scope terms; not result validation", "reviewed_metadata_url": "https://api.crossref.org/works/10.3390/fi14040121", "selection_report": "data/coverage/educational-remaining-source-review-2026-10-15.json", "selection_report_sha256": "f150cf246dc42fd13fe8ce9768179e7b0980f505882f4d9f8c23ad41521b6c37", "source_correction_input_sha256": "900064e042ff0afc9381636882c20d3b2d749aec9f48ecf93702d48c8e1bf2c0", "source_document_url": "https://discovery.ucl.ac.uk/id/eprint/10146876/1/Scalan%20et%20al%202022%20futureinternet.pdf", "source_packet_sha256": "e378272232eb26a788ec62f7ca80c4121268909ea4df089e402e398f1322345c", "source_quote": "In this study, two\nhoneypot websites were created to then facilitate warning messages to be applied to any\ninternet user who attempted to visit them.", "source_quote_locator": {"pdf_bytes_verified": true, "pdf_page": 6}, "source_sha256": "2359bcfb04d3fe01e8560f4d69ff7dc9cd6995c78625b2c0f02e61ee320f5fda", "source_title": "Creating Honeypots to Prevent Online Child Exploitation", "source_type": "PDF identity page and all pages matching scope terms; not result validation", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-source-passages", "id": "doi-10-3390-fi14040121", "kind": "paper", "name": "Creating Honeypots to Prevent Online Child Exploitation", "organization": null, "reviewed_at": "2026-10-15", "slug": "doi-10-3390-fi14040121", "source_url": "https://doi.org/10.3390/fi14040121", "status": "published", "summary_en": "The paper describes a honeypot architecture combining social-network recruitment, decoy websites and warning messages to study prevention of online child exploitation. The authors document educational studies using legal content without hosting child exploitation material.", "summary_es": "El artículo describe una arquitectura de honeypots que combina captación en redes sociales, sitios web señuelo y mensajes de advertencia para estudiar la prevención de la explotación infantil en línea. Los autores documentan estudios educativos con contenido legal, sin alojar material de explotación infantil.", "updated_at": "2026-10-15", "year": 2022}
{"critical_reading": null, "data": {"abstract_source_doi": "10.3390/iot5040033", "access_date": "2026-10-16", "authors": ["Amira Hossam Eldin Omar", "Hassan Soubra", "Donatien Koulla Moulla", "Alain Abran"], "creator_name_aliases_inferred": false, "doi": "10.3390/iot5040033", "doi_aliases": ["10.20944/preprints202407.1498.v1"], "draft_review_basis": "deepseek-draft-and-independent-claude-review", "environments": ["IoT"], "family_resource_count": 1, "family_scope_basis": [{"batch": 18, "candidate_id": "doi:10.20944/preprints202407.1498.v1", "catalog_decision": null, "doi": "10.20944/preprints202407.1498.v1", "existing_identifier_matches": [], "existing_title_matches": [], "identity_status": "declared-version-family-review-needed", "selection_report": "data/coverage/bibliography-deposited-third-crossref-018-2026-10-16.json", "selection_report_sha256": "0d4c8e4dd83826c29510b63c3be15bf7d1705607bb8e7011f2aa9ea9a0851d39", "source_sha256": "ebd4fd2ea028eec0352dd476e69e5c156008a282029a39b6fd54bfc1a255b2cd", "title": "An Innovative Honeypot Architecture for Detecting and Mitigating Hardware Trojans in IoT Devices", "year": 2024}], "full_text_equality_claimed": false, "full_text_reviewed": false, "identity_report": "data/coverage/deposited-followup-family-review-2026-10-16.json", "identity_report_sha256": "d8486dc729d6c0aa6a91da335c385db7fbbce91367b6f1514f6601698918bdf8", "journal": "IoT", "limitations_en": "Summary based only on the deposited abstract and version metadata; full text was not read and results were not independently validated.", "limitations_es": "Resumen basado únicamente en el resumen depositado y en metadatos de versión; no se leyó el texto completo ni se validaron los resultados de forma independiente.", "metadata_sha256": "e8324df474a9f846fdddfe20d0fb0cebd370277e884f08e691515d84ad883275", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "source-page", "review_depth": "deposited abstract of DOI 10.3390/iot5040033; version identity metadata; no full-text analysis", "reviewed_metadata_url": "https://api.crossref.org/works/10.3390/iot5040033", "selection_report": "data/coverage/bibliography-deposited-third-crossref-018-2026-10-16.json", "selection_report_sha256": "0d4c8e4dd83826c29510b63c3be15bf7d1705607bb8e7011f2aa9ea9a0851d39", "source_document_url": "https://doi.org/10.3390/iot5040033", "source_packet_sha256": "bbd01053612b9a9ff9fa8bc9245bebd84dedded5d47b8922a5f60f2bb618b2e5", "source_quote": "This paper introduces a novel approach utilizing hardware honeypots as an additional defensive layer against hardware vulnerabilities, particularly hardware Trojans (HTs).", "source_quote_locator": {"abstract_source_doi": "10.3390/iot5040033", "field": "deposited abstract (HTML normalized)"}, "source_sha256": "e8324df474a9f846fdddfe20d0fb0cebd370277e884f08e691515d84ad883275", "source_title": "An Innovative Honeypot Architecture for Detecting and Mitigating Hardware Trojans in IoT Devices", "source_type": "deposited abstract of DOI 10.3390/iot5040033; version identity metadata; no full-text analysis", "tags": [], "techniques": ["Honeypot"], "version_history": [{"creators": [{"affiliation": [], "family": "Houssam", "given": "Amira", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "first"}, {"ORCID": "https://orcid.org/0000-0003-0056-6015", "affiliation": [], "authenticated-orcid": false, "family": "Soubra", "given": "Hassan", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}, {"ORCID": "https://orcid.org/0000-0001-6594-8378", "affiliation": [], "authenticated-orcid": false, "family": "Moulla", "given": "Donatien Koulla", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}, {"ORCID": "https://orcid.org/0000-0003-2670-9061", "affiliation": [], "authenticated-orcid": false, "family": "Abran", "given": "Alain", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}], "doi": "10.20944/preprints202407.1498.v1", "issued": {"date-parts": [[2024, 7, 18]]}, "metadata_sha256": "ebd4fd2ea028eec0352dd476e69e5c156008a282029a39b6fd54bfc1a255b2cd", "titles": ["An Innovative Honeypot Architecture for Detecting and Mitigating Hardware Trojans in IoT Devices"]}, {"creators": [{"affiliation": [{"name": "Department of Computer Science and Engineering, German University in Cairo, New Cairo 4721301, Egypt"}], "family": "Omar", "given": "Amira Hossam Eldin", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "first"}, {"ORCID": "https://orcid.org/0000-0003-0056-6015", "affiliation": [{"name": "Department of Computer Engineering, Ecole Centrale d’Electronique-ECE Lyon, 24 rue Salomon Reinach, 69007 Lyon, France"}], "authenticated-orcid": false, "family": "Soubra", "given": "Hassan", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}, {"ORCID": "https://orcid.org/0000-0001-6594-8378", "affiliation": [{"name": "Centre for Augmented Intelligence and Data Science, School of Computing, University of South Africa, Johannesburg 1709, South Africa"}], "authenticated-orcid": false, "family": "Moulla", "given": "Donatien Koulla", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}, {"ORCID": "https://orcid.org/0000-0003-2670-9061", "affiliation": [{"name": "Department of Software Engineering and Information Technology, Ecole de Technologie Supérieure, Montréal, QC H3C 1K3, Canada"}], "authenticated-orcid": false, "family": "Abran", "given": "Alain", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}], "doi": "10.3390/iot5040033", "issued": {"date-parts": [[2024, 10, 31]]}, "metadata_sha256": "e8324df474a9f846fdddfe20d0fb0cebd370277e884f08e691515d84ad883275", "titles": ["An Innovative Honeypot Architecture for Detecting and Mitigating Hardware Trojans in IoT Devices"]}]}, "evidence": "primary-source-passages", "id": "doi-10-3390-iot5040033", "kind": "paper", "name": "An Innovative Honeypot Architecture for Detecting and Mitigating Hardware Trojans in IoT Devices", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-3390-iot5040033", "source_url": "https://doi.org/10.3390/iot5040033", "status": "published", "summary_en": "Proposes using hardware honeypots as an additional defensive layer to detect and mitigate hardware Trojans in IoT devices, aiming to protect them from operational failures, denial of service, or data leakage.", "summary_es": "Propone el uso de honeypots de hardware como capa defensiva adicional para detectar y mitigar troyanos de hardware en dispositivos IoT, con el fin de protegerlos frente a fallos operativos, denegación de servicio o fuga de datos.", "updated_at": "2026-10-16", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-15", "authors": ["Venny Gustina DM", "Ananda Ananda"], "doi": "10.35143/jkt.v10i1.6247", "doi_aliases": [], "draft_review_basis": "deepseek-original-draft; codex-source-correction-and-independent-claude-review", "environments": ["Network", "OT/ICS"], "full_text_reviewed": false, "journal": "Jurnal Komputer Terapan", "limitations_en": "The consulted source was the PDF identity page and all pages matching scope terms, not a result validation; the honeypot experiments and comparative performance are reported as cited references rather than the authors' own work.", "limitations_es": "La fuente consultada fue la página de identidad del PDF y todas las páginas que coincidían con términos de alcance, no una validación de resultados; los experimentos con honeypots y el rendimiento comparativo se reportan como referencias citadas, no como trabajo propio.", "metadata_sha256": "f366144b22ad784debb3a19a4dc81dec919f94d2c0e4838d3a79251515e8452a", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "source-page", "review_depth": "PDF identity page and all pages matching scope terms; not result validation", "reviewed_metadata_url": "https://api.crossref.org/works/10.35143/jkt.v10i1.6247", "selection_report": "data/coverage/educational-remaining-source-review-2026-10-15.json", "selection_report_sha256": "f150cf246dc42fd13fe8ce9768179e7b0980f505882f4d9f8c23ad41521b6c37", "source_correction_input_sha256": "900064e042ff0afc9381636882c20d3b2d749aec9f48ecf93702d48c8e1bf2c0", "source_document_url": "https://jurnal.pcr.ac.id/index.php/jkt/article/download/6247/2172", "source_packet_sha256": "b6724366ee561574137f46b94a84fb625a2ebbf87835e41c42d0b16af0290134", "source_quote": "Teknologi penipuan dan honeypot, yang dapat memberikan rasa kerentanan palsu kepada \npenyerang dan mengumpulkan informasi intelijen tentang metode ancaman", "source_quote_locator": {"pdf_bytes_verified": true, "pdf_page": 3}, "source_sha256": "8f85f1ab4b679d8abbd26968c6fe3501fc70dfbdc030176c308d59cc64835365", "source_title": "Kecerdasan Buatan untuk Security Orchestration, Automation and Response: Tinjauan Cakupan", "source_type": "PDF identity page and all pages matching scope terms; not result validation", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-source-passages", "id": "doi-10-35143-jkt-v10i1-6247", "kind": "paper", "name": "Kecerdasan Buatan untuk Security Orchestration, Automation and Response: Tinjauan Cakupan", "organization": null, "reviewed_at": "2026-10-15", "slug": "doi-10-35143-jkt-v10i1-6247", "source_url": "https://doi.org/10.35143/jkt.v10i1.6247", "status": "published", "summary_en": "The review examines AI integration with SOAR, including dynamic orchestration of honeypots that present an apparent vulnerability and collect intelligence on attacker methods.", "summary_es": "La revisión examina la integración de IA en SOAR e incluye la orquestación dinámica de honeypots que presentan una apariencia de vulnerabilidad para recopilar información sobre los métodos del atacante.", "updated_at": "2026-10-15", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-13", "authors": ["Siti Rodiyah", "Samuel Mahesa Sinulingga", "Farrel Reyhan Putra", "Muhammad Fathi Aryasatya", "Ardo Kusdaryanto", "Rovy Sulistiyono", "Bambang Irawan"], "doi": "10.36378/jtos.v8i2.4633", "doi_aliases": [], "draft_review_basis": "deepseek-draft-and-independent-claude-review", "environments": ["Application"], "full_text_reviewed": false, "journal": "JURNAL TEKNOLOGI DAN OPEN SOURCE", "limitations_en": "Review of selected PDF pages (identity and scope); results and code were not independently validated.", "limitations_es": "Revisión de páginas seleccionadas del PDF (identidad y alcance); no se validaron de forma independiente los resultados ni el código.", "metadata_sha256": "1456e0bb10f5c8762d8deadaac78bc51ce7fe1c9e4a7ebd9a0928200e74d2475", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "source-page", "review_depth": "selected primary PDF pages", "reviewed_metadata_url": "https://api.crossref.org/works/10.36378/jtos.v8i2.4633", "selection_report_sha256": "8c94e41ae3ef31103ef600a77351f1f63b7db35c1f540eb9848e267d4c71297b", "software_executed": false, "source_document_url": "https://ejournal.uniks.ac.id/index.php/JTOS/article/download/4633/3452", "source_packet_sha256": "35d20cae822f14245e251f56744abb2dcf02bbabb0390d0eb3a8a8b1157eb740", "source_quote": "a \"honeypot\" field has been implemented wit hin this booking form. This is a hidden field that is invisible to human users but can be automatically filled in if a bot attempts to submit the form.", "source_quote_locator": {"pdf_page": 10}, "source_sha256": "f0056f95a131379e7ce0eda04c21a082d3af4f3806228ac2a793196a6e01c031", "source_title": "Implementation of an Information System for Classroom Reservation at Esa Unggul University", "tags": [], "techniques": ["Decoy"]}, "evidence": "primary-document-passages", "id": "doi-10-36378-jtos-v8i2-4633", "kind": "paper", "name": "Implementation of an Information System for Classroom Reservation at Esa Unggul University", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-36378-jtos-v8i2-4633", "source_url": "https://doi.org/10.36378/jtos.v8i2.4633", "status": "published", "summary_en": "The authors describe a web-based classroom reservation system in which they implement a hidden honeypot field in the booking form: invisible to humans but fillable by bots, so submissions with that field completed are rejected.", "summary_es": "Los autores describen un sistema web de reserva de aulas en el que implementan un campo oculto tipo honeypot en el formulario de reserva: invisible para personas, pero rellenable por bots, de modo que las solicitudes con ese campo completado se rechazan.", "updated_at": "2026-10-13", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Eric Alata", "Vincent Nicomette", "Mohamed Kaâniche", "Marc Dacier", "Matthieu Herrb"], "doi": "10.48550/arxiv.0704.0858", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry was drafted solely from the available title and abstract; the full text was not reviewed and the methodology or results were not independently validated.", "limitations_es": "Esta entrada se elaboró únicamente a partir del título y resumen disponibles; no se revisó el texto completo ni se validó de forma independiente la metodología o resultados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "experimental study and the lessons learned from the observation of the attackers", "source_sha256": "d2a0aaf513c22199ce7875028936f3b67579203fba223053f1767bef77f69cd6", "source_title": "Lessons Learned from the deployment of a high-interaction honeypot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-0704-0858", "kind": "paper", "name": "Lessons Learned from the deployment of a high-interaction honeypot", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-0704-0858", "source_url": "https://arxiv.org/abs/0704.0858", "status": "published", "summary_en": "This paper presents an experimental study and lessons learned by the authors from observing attackers logged onto a compromised machine. According to the abstract, results are based on a six-month controlled experiment with a high-interaction honeypot, correlated with findings from a worldwide distributed low-interaction honeypot system.", "summary_es": "Este artículo presenta un estudio experimental y las lecciones aprendidas por los autores a partir de la observación de atacantes conectados a una máquina comprometida. Según el resumen, los resultados se basan en un periodo de seis meses de experimento controlado con un honeypot de alta interacción, correlacionando los hallazgos con un sistema distribuido mundial de honeypots de baja interacción.", "updated_at": "2026-10-04", "year": 2007}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Mohamed Kaaniche", "Y. Deswarte", "Eric Alata", "Marc Dacier", "Vincent Nicomette"], "doi": "10.48550/arxiv.0704.0861", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry was drafted solely from the available title and abstract; the full text was not reviewed and the methodology or results were not independently validated.", "limitations_es": "Esta entrada se elaboró únicamente a partir del título y resumen disponibles; no se revisó el texto completo ni se validó de forma independiente la metodología o resultados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "empirical analyses based on the data collected from the Leurr{é}.com honeypot platforms", "source_sha256": "72d76460e749fa9c2283a3700bcaad8bd488cd67f656567a642643533d54a082", "source_title": "Empirical analysis and statistical modeling of attack processes based on honeypots", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-0704-0861", "kind": "paper", "name": "Empirical analysis and statistical modeling of attack processes based on honeypots", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-0704-0861", "source_url": "https://arxiv.org/abs/0704.0861", "status": "published", "summary_en": "According to the abstract, the authors present empirical analyses based on data collected from the Leurré.com honeypot platforms deployed on the Internet, along with preliminary modeling studies aimed at characterizing attack processes, in order to better understand attacker strategies and techniques.", "summary_es": "Según el resumen, los autores presentan análisis empíricos basados en datos recolectados de las plataformas de honeypots Leurré.com desplegadas en Internet, junto con estudios preliminares de modelado orientados a caracterizar los procesos de ataque, con el fin de comprender mejor las estrategias y técnicas empleadas por los atacantes.", "updated_at": "2026-10-04", "year": 2007}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Ram Kumar Singh", "Prof. T. Ramajujam"], "doi": "10.48550/arxiv.0906.5031", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed and the effectiveness of the described system has not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se ha verificado de forma independiente la eficacia del sistema descrito.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "Using honeypots provides effective solution to increase the security.", "source_sha256": "164372ca53ffbc9f43d754df8971f119cbbdce6871ef19c19be2c275f801bfbb", "source_title": "Intrusion Detection System Using Advanced Honeypots", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-0906-5031", "kind": "paper", "name": "Intrusion Detection System Using Advanced Honeypots", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-0906-5031", "source_url": "https://arxiv.org/abs/0906.5031", "status": "published", "summary_en": "The authors present an implementation of an intrusion detection system using advanced honeypots to distinguish legitimate client traffic from attacker traffic, aiming to reduce latency and improve security on public servers. According to the abstract, results of stress and scalability tests are reported, along with suggested potential uses for the system.", "summary_es": "Los autores presentan una implementación de un sistema de detección de intrusiones que utiliza honeypots avanzados para distinguir el tráfico legítimo de clientes del tráfico de atacantes, con el objetivo de reducir la latencia y mejorar la seguridad en servidores públicos. Según el resumen, se reportan resultados de pruebas de estrés y escalabilidad, y se sugieren posibles usos del sistema.", "updated_at": "2026-10-04", "year": 2009}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Shishir Kumar", "Durgesh Pant"], "doi": "10.48550/arxiv.0912.2293", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "Endpoint"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed and the effectiveness of the proposed system has not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se ha verificado de forma independiente la eficacia del sistema propuesto.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "We intend to use honeypots for generating and broadcasting instant cures for new and unknown malware in a network", "source_sha256": "2520664872a2ddebc786c4da38f884bc91414794367bd3647325965e32361785", "source_title": "Detection and Prevention of New and Unknown Malware using Honeypots", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-0912-2293", "kind": "paper", "name": "Detection and Prevention of New and Unknown Malware using Honeypots", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-0912-2293", "source_url": "https://arxiv.org/abs/0912.2293", "status": "published", "summary_en": "The authors propose a system that uses honeypots not only to detect malicious traffic but also to generate and broadcast on-the-fly anti-malware signatures for new and unknown malware in a network, mimicking the way malware itself spreads. According to the abstract, this would allow effective initial control over viruses not yet identified by established security firms.", "summary_es": "Los autores proponen un sistema que utiliza honeypots no solo para detectar tráfico malicioso, sino para generar y difundir firmas antimalware instantáneas ante nuevo malware desconocido en una red, imitando el modo en que se propaga el propio malware. Según el resumen, esto permitiría un control inicial efectivo frente a virus aún no identificados por firmas de seguridad establecidas.", "updated_at": "2026-10-04", "year": 2009}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Natarajan Meghanathan", "Sumanth Reddy Allam", "Loretta A. Moore"], "doi": "10.48550/arxiv.1004.0570", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-pdf", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available abstract rather than a full-text reading of the paper, so the validation or effectiveness of the described techniques cannot be confirmed.", "limitations_es": "Esta entrada se basa únicamente en el resumen disponible y no en una lectura completa del artículo, por lo que no se puede confirmar la validación o efectividad de las técnicas descritas.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "We also discuss the use of Honeypots and Honeynets that gather intelligence about the enemy and the tools and tactics of network intruders.", "source_sha256": "9ef6feb29f65b3f93c404e8bb461933ef182dbc2205e5c7e7ea4dc0ae93fd39a", "source_title": "Tools and techniques for Network Forensics", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-1004-0570", "kind": "paper", "name": "Tools and techniques for Network Forensics", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-1004-0570", "source_url": "https://arxiv.org/abs/1004.0570", "status": "published", "summary_en": "This paper describes tools and techniques used in network forensics to capture, record and analyze network events for investigating security attacks. According to the authors, it surveys tools such as email trackers, packet sniffers and IP traceback techniques, and discusses the use of honeypots and honeynets to gather intelligence on intruders.", "summary_es": "Este artículo describe herramientas y técnicas utilizadas en forense de redes para capturar, registrar y analizar eventos de red con fines de investigación de ataques de seguridad. Según los autores, se revisan herramientas como rastreadores de correo, analizadores de paquetes y técnicas de IP traceback, además de discutir el uso de honeypots y honeynets para recopilar inteligencia sobre intrusos.", "updated_at": "2026-10-04", "year": 2010}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Jonathan White", "Nilanjan Banerjee"], "doi": "10.48550/arxiv.1006.5502", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["IoT"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available abstract rather than a full-text reading of the paper, so the reported effectiveness of the system cannot be independently confirmed.", "limitations_es": "Esta entrada se basa únicamente en el resumen disponible y no en una lectura completa del artículo, por lo que no se puede confirmar de manera independiente la efectividad reportada del sistema.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "Mirage uses additional programmable low cost passive RFID tags called honeytokens to inject noise in retail store inven-torying.", "source_sha256": "33e611ad5777cbd6587dbe4ae3f497d98207e6d93c9d0ec1b240446f0bbbc9f4", "source_title": "Mirage: Mitigating Illicit Inventorying in a RFID Enabled Retail Environment", "tags": [], "techniques": ["Honeytoken"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-1006-5502", "kind": "paper", "name": "Mirage: Mitigating Illicit Inventorying in a RFID Enabled Retail Environment", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-1006-5502", "source_url": "https://arxiv.org/abs/1006.5502", "status": "published", "summary_en": "This paper presents Mirage, a low-cost system designed by the authors to mitigate corporate espionage in RFID-enabled retail environments. According to the authors, Mirage uses programmable RFID tags as honeytokens to inject noise into inventory data, randomizing sales and restocking trends observable by potential attackers.", "summary_es": "Este trabajo presenta Mirage, un sistema de bajo costo diseñado por los autores para mitigar el espionaje corporativo en entornos minoristas habilitados con RFID. Según los autores, Mirage utiliza etiquetas RFID programables como honeytokens para inyectar ruido en los datos de inventario, aleatorizando las tendencias de ventas y reabastecimiento observadas por posibles atacantes.", "updated_at": "2026-10-04", "year": 2010}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Konstantinos Pelechrinis", "Prashant Krishnamurthy", "Ke Zhang"], "doi": "10.48550/arxiv.1210.4517", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Application"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text was not reviewed and no validated effectiveness can be confirmed.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se puede confirmar la efectividad validada del método.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "honeypot venue-based solution, enhanced with a challenge-response scheme", "source_sha256": "1962987a75afcc0e9128a64afd7a6e21eb41330400bf3dbd2a09c450ff44b32e", "source_title": "Gaming the Game: Honeypot Venues Against Cheaters in Location-based Social Networks", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-1210-4517", "kind": "paper", "name": "Gaming the Game: Honeypot Venues Against Cheaters in Location-based Social Networks", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-1210-4517", "source_url": "https://arxiv.org/abs/1210.4517", "status": "published", "summary_en": "According to the authors' abstract, this work addresses fake check-ins in location-based social networks (LBSNs). The authors propose and analyze a honeypot venue-based solution, enhanced with a challenge-response scheme, to flag users generating fake spatial information.", "summary_es": "Este trabajo, según el resumen de los autores, aborda el problema de los check-ins falsos en redes sociales basadas en localización (LBSN). Los autores proponen y analizan una solución basada en venues señuelo (honeypot), combinada con un esquema de desafío-respuesta, para detectar usuarios que generan información espacial fraudulenta.", "updated_at": "2026-10-04", "year": 2012}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["S. Kumar", "R. Sehgal", "P. Singh", "Ankit Chaudhary"], "doi": "10.48550/arxiv.1303.3071", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text was not reviewed and no validated effectiveness can be confirmed.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se puede confirmar la efectividad validada del método.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "deploying the nepenthes honeypots", "source_sha256": "64da576bce33d34a8b223dd10a4f570d689898ecc2e774b626cc2a2cbf447def", "source_title": "Nepenthes Honeypots based Botnet Detection", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-1303-3071", "kind": "paper", "name": "Nepenthes Honeypots based Botnet Detection", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-1303-3071", "source_url": "https://arxiv.org/abs/1303.3071", "status": "published", "summary_en": "According to the authors' abstract, this work shares experience in botnet detection by deploying Nepenthes honeypots in private and public networks. The authors describe an automated framework for malware collection using Nepenthes and analysis via anti-virus scanning, presenting experimental results of known bot detection in their network.", "summary_es": "Según el resumen de los autores, este trabajo comparte experiencias de detección de botnets mediante el despliegue de honeypots Nepenthes en redes privadas y públicas. Los autores describen un marco automatizado para la recolección de malware mediante Nepenthes y su análisis con escaneo antivirus, presentando resultados experimentales de detección de bots conocidos en su red.", "updated_at": "2026-10-04", "year": 2013}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Ashraf A. Shahin"], "doi": "10.48550/arxiv.1409.1654", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Cloud"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed and the effectiveness of the approach has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha validado de forma independiente la eficacia del enfoque.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "proposed high-interactive honeypot to collect payloads of zero-day polymorphic worms", "source_sha256": "c1506e49bd2e671fb5dca2427585871dcc5cf8f98528766f984e0f10a749d861", "source_title": "Polymorphic Worms Collection in Cloud Computing", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-1409-1654", "kind": "paper", "name": "Polymorphic Worms Collection in Cloud Computing", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-1409-1654", "source_url": "https://arxiv.org/abs/1409.1654", "status": "published", "summary_en": "This work addresses the challenge of detecting and collecting payloads of zero-day polymorphic worms in homogeneous and heterogeneous cloud computing platforms. The authors propose a high-interaction honeypot that inspects VM memory and disk images using open-source forensic tools. According to the authors, experiments show the proposed approach overcomes the identified challenges.", "summary_es": "Este trabajo aborda el desafío de detectar y recolectar payloads de gusanos polimórficos de día cero en plataformas de computación en la nube homogéneas y heterogéneas. Los autores proponen un honeypot de alta interacción que inspecciona memoria y disco de máquinas virtuales usando herramientas forense de código abierto. Según los autores, los experimentos muestran que el enfoque propuesto supera los desafíos identificados.", "updated_at": "2026-10-04", "year": 2014}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Emiliano De Cristofaro", "Arik Friedman", "Guillaume Jourjon", "Mohamed Ali Kaafar", "M. Zubair Shafiq"], "doi": "10.48550/arxiv.1409.2097", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Application"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed and the effectiveness of the approach has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha validado de forma independiente la eficacia del enfoque.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "We deploy a set of honeypot pages, promote them using both methods, and analyze garnered likes", "source_sha256": "8959b0514a243f020cd042c2f65a05ec11e9682f666f52d1db39f9fb439fe461", "source_title": "Paying for Likes? Understanding Facebook Like Fraud Using Honeypots", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-1409-2097", "kind": "paper", "name": "Paying for Likes? Understanding Facebook Like Fraud Using Honeypots", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-1409-2097", "source_url": "https://arxiv.org/abs/1409.2097", "status": "published", "summary_en": "The study presents a comparative measurement of Facebook page promotion methods via ads and like farm services. The authors deploy honeypot pages, promote them through both methods, and analyze the demographic, temporal, and social characteristics of garnered likes. According to the authors, findings indicate differences in behavior among like farms, with some apparently bot-operated and others mimicking real users.", "summary_es": "El estudio presenta un análisis comparativo de métodos de promoción de páginas de Facebook mediante anuncios y servicios de 'like farms'. Los autores despliegan páginas honeypot, las promocionan por ambos métodos y analizan las características demográficas, temporales y sociales de los likes obtenidos. Según los autores, se identifican diferencias en el comportamiento de distintas granjas de likes, algunas operadas por bots y otras imitando usuarios reales.", "updated_at": "2026-10-04", "year": 2014}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Jeffrey Pawlick", "Quanyan Zhu"], "doi": "10.48550/arxiv.1503.05458", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the validity of the results has not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha verificado de forma independiente la validez de los resultados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "implementation of honeypots for network defense", "source_sha256": "ddb1d738e8a1a11ce1e3b60a2ea8cc6c60246f60a511556dc0766bf92a7c40aa", "source_title": "Deception by Design: Evidence-Based Signaling Games for Network Defense", "tags": [], "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-1503-05458", "kind": "paper", "name": "Deception by Design: Evidence-Based Signaling Games for Network Defense", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-1503-05458", "source_url": "https://arxiv.org/abs/1503.05458", "status": "published", "summary_en": "The authors propose a game-theoretic model for mechanism design in deception-based defense, applied specifically to honeypots in network defense. They analyze cheap-talk games and an extended version with evidence, where the receiver can detect deception with some probability. According to the authors, the model generalizes traditional signaling games and complete-information games, showing numerically that deception detection can eliminate pure-strategy equilibria.", "summary_es": "Los autores proponen un modelo de teoría de juegos para el diseño de mecanismos de defensa basados en engaño, aplicado específicamente a honeypots en defensa de redes. Analizan juegos de 'cheap-talk' y una versión extendida con evidencia, donde el receptor puede detectar el engaño con cierta probabilidad. Según los autores, el modelo generaliza juegos de señalización tradicionales y de información completa, mostrando numéricamente que la detección de engaño puede eliminar equilibrios en estrategias puras.", "updated_at": "2026-10-04", "year": 2015}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Christoph Pohl", "Michael Meier", "Hans-Joachim Hof"], "doi": "10.48550/arxiv.1507.03117", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Endpoint"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the official arXiv title and abstract; the full text has not been reviewed and the effectiveness of the described module has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen oficiales de arXiv; no se ha revisado el texto completo ni se ha validado de forma independiente la eficacia del módulo descrito.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "Apate can be used to build and harden High Interaction Honeypots.", "source_sha256": "860c2eed541658496b24f4dda1dc89130fcde22c86935caef3829494c1a0ef81", "source_title": "Apate - A Linux Kernel Module for High Interaction Honeypots", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-1507-03117", "kind": "paper", "name": "Apate - A Linux Kernel Module for High Interaction Honeypots", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-1507-03117", "source_url": "https://arxiv.org/abs/1507.03117", "status": "published", "summary_en": "This paper presents Apate, a Linux Kernel Module that logs, blocks, and manipulates system calls based on configurable conditions such as PID or UID. According to the authors, Apate serves as a building block to harden high-interaction honeypots and extend attacker interaction without introducing new vulnerabilities.", "summary_es": "Este artículo presenta Apate, un módulo de kernel de Linux que registra, bloquea y manipula llamadas al sistema según condiciones configurables como PID o UID. Según los autores, Apate sirve como bloque de construcción para endurecer honeypots de alta interacción y prolongar la interacción con el atacante sin abrir nuevas vulnerabilidades.", "updated_at": "2026-10-04", "year": 2015}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Zhenxin Zhan", "Maochao Xu", "Shouhuai Xu"], "doi": "10.48550/arxiv.1603.07433", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the official arXiv title and abstract; the full text has not been reviewed and the statistical framework or case study has not been independently replicated or validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen oficiales de arXiv; no se ha revisado el texto completo ni se ha replicado o validado de forma independiente el marco estadístico o el caso de estudio.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "The case study finds, for the first time, that Long-Range Dependence (LRD) is exhibited by honeypot-captured cyber attacks", "source_sha256": "bf938ddb920a3d072dfa6cd6ecd2d378559cf0143c06ac0358aafb4d84a0bcd4", "source_title": "Characterizing Honeypot-Captured Cyber Attacks: Statistical Framework and Case Study", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-1603-07433", "kind": "paper", "name": "Characterizing Honeypot-Captured Cyber Attacks: Statistical Framework and Case Study", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-1603-07433", "source_url": "https://arxiv.org/abs/1603.07433", "status": "published", "summary_en": "The authors propose a statistical framework for rigorously analyzing honeypot-captured cyber attack data, built on the concept of a stochastic cyber attack process. According to the presented case study, low-interaction honeypot data exhibits Long-Range Dependence, which the authors state could enable prediction of attack rates with good accuracy.", "summary_es": "Los autores proponen un marco estadístico para analizar rigurosamente datos de ataques cibernéticos capturados por honeypots, basado en el concepto de proceso estocástico de ciberataque. Según el estudio de caso presentado, los datos de un honeypot de baja interacción exhiben dependencia de largo alcance, lo que según los autores permitiría predecir tasas de ataque con buena precisión.", "updated_at": "2026-10-04", "year": 2016}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Marcin Nawrocki", "Matthias Wählisch", "Thomas C. Schmidt", "Christian Keil", "Jochen Schönfelder"], "doi": "10.48550/arxiv.1608.06249", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract, without access to the full text of the paper.9", "limitations_es": "Esta ficha se basa únicamente en el título y resumen disponibles, sin acceso al texto completo del artículo.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "we give an extensive overview on honeypots", "source_sha256": "0c45a1c43ef19b4146cd7c049fabbe412b6a63e810e520440c50cf3f58e2be74", "source_title": "A Survey on Honeypot Software and Data Analysis", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-1608-06249", "kind": "paper", "name": "A Survey on Honeypot Software and Data Analysis", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-1608-06249", "source_url": "https://arxiv.org/abs/1608.06249", "status": "published", "summary_en": "According to the authors, this work provides an extensive overview of honeypots, covering both available software and the methodologies used to analyze data collected by these systems.", "summary_es": "Este trabajo, según sus autores, ofrece una revisión extensa sobre honeypots, abarcando tanto el software disponible como las metodologías empleadas para analizar los datos recolectados por estos sistemas.", "updated_at": "2026-10-04", "year": 2016}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Abdeljalil Agnaou", "Anas Abou El Kalam", "Abdellah Ait Ouahman", "Mina De Montfort"], "doi": "10.48550/arxiv.1611.03252", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract, without access to the full text of the paper or independent validation of its effectiveness.", "limitations_es": "Esta ficha se basa únicamente en el título y resumen disponibles, sin acceso al texto completo del artículo ni validación independiente de su efectividad.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "we use a set of data related to malicious traffic captured using a network of honeypots", "source_sha256": "127d9f9f04afbb91e15da9fc52509fa76c34dd6be1031cc0f8239288d631369e", "source_title": "Reduce positive and negative falses from attacks collected from the deployment of distributed honeypot network", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-1611-03252", "kind": "paper", "name": "Reduce positive and negative falses from attacks collected from the deployment of distributed honeypot network", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-1611-03252", "source_url": "https://arxiv.org/abs/1611.03252", "status": "published", "summary_en": "According to the authors, this paper describes an automated algorithm designed to detect attacks before they occur and reduce false positive and negative rates, using malicious traffic data captured through a distributed honeypot network.", "summary_es": "Según los autores, este artículo describe un algoritmo automatizado diseñado para detectar ataques antes de que ocurran y reducir las tasas de falsos positivos y negativos, utilizando datos de tráfico malicioso capturados mediante una red distribuida de honeypots.", "updated_at": "2026-10-04", "year": 2016}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Juan Guarnizo", "Amit Tambe", "Suman Sankar Bhunia", "Martín Ochoa", "Nils Tippenhauer", "Asaf Shabtai", "Yuval Elovici"], "doi": "10.48550/arxiv.1701.02446", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["IoT", "Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the title and abstract as published by the authors; the full text has not been reviewed, and the architecture or reported results have not been independently verified or replicated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados por los autores; no se ha revisado el texto completo ni se ha verificado o replicado de forma independiente la arquitectura o resultados reportados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "Scalable high-Interaction Honeypot platform for IoT devices", "source_sha256": "9436526fe2236abc99b271fce4af86bbe47c783027f55a2f3cdbd16562cef07e", "source_title": "SIPHON: Towards Scalable High-Interaction Physical Honeypots", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-1701-02446", "kind": "paper", "name": "SIPHON: Towards Scalable High-Interaction Physical Honeypots", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-1701-02446", "source_url": "https://arxiv.org/abs/1701.02446", "status": "published", "summary_en": "This work proposes SIPHON, a scalable high-interaction physical honeypot architecture for IoT devices. According to the authors, the design uses geographically distributed 'wormholes' to expose a few physical devices across many Internet IP addresses. The authors describe a large-scale experiment with real devices (IP cameras, an NVR, and an IP printer) deployed across multiple cities and countries, recording traffic and login attempts over two months.", "summary_es": "Este trabajo propone SIPHON, una arquitectura de honeypots físicos de alta interacción escalable para dispositivos IoT. Según los autores, el diseño emplea 'wormholes' distribuidos geográficamente para exponer pocos dispositivos físicos bajo múltiples direcciones IP de Internet. Los autores describen un experimento a gran escala con dispositivos reales (cámaras IP, un NVR y una impresora IP) desplegados en varias ciudades y países, registrando tráfico e intentos de inicio de sesión durante dos meses.", "updated_at": "2026-10-04", "year": 2017}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Lek Christopher", "Kim-Kwang Raymond Choo", "Ali Dehghantanha"], "doi": "10.48550/arxiv.1706.08043", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "Identity"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed, and the proposed conceptual model and honeypot analysis findings have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se ha verificado de forma independiente el modelo conceptual propuesto ni los hallazgos del análisis de honeypots.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "Two honeypots were deployed at a private university based in Singapore", "source_sha256": "20a62900db3f3e781ebdfa82594804cdbc29fc4c0af72677f9913e9793737e54", "source_title": "Honeypots for employee information security awareness and education training: A conceptual EASY training model", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-1706-08043", "kind": "paper", "name": "Honeypots for employee information security awareness and education training: A conceptual EASY training model", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-1706-08043", "source_url": "https://arxiv.org/abs/1706.08043", "status": "published", "summary_en": "This paper examines the use of honeypot data for employee information security awareness and education training. According to the authors, two honeypots were deployed at a private university in Singapore and the resulting data were analyzed. Drawing on Routine Activity Theory, they propose a conceptual training model called EASY (Engaging Stakeholders, Acceptable Behavior, Simple Teaching method, Yardstick) for designing security awareness programs.", "summary_es": "Este artículo examina el uso de datos de honeypots para la concienciación y formación en seguridad de la información de los empleados. Según los autores, se desplegaron dos honeypots en una universidad privada en Singapur y se analizaron los datos resultantes. A partir de la Teoría de las Actividades Rutinarias, proponen un modelo conceptual de formación denominado EASY (Engaging Stakeholders, Acceptable Behavior, Simple Teaching method, Yardstick) para diseñar programas de concienciación en seguridad.", "updated_at": "2026-10-04", "year": 2017}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Jeffrey Pawlick", "Thi Thu Hang Nguyen", "Edward Colbert", "Quanyan Zhu"], "doi": "10.48550/arxiv.1707.08031", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed and the effectiveness of the proposed policy has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad de la política propuesta.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "a powerful defender uses honeynets for active defense in order to observe an attacker who has penetrated the network", "source_sha256": "109ffcb9e8166737106f16ea9fd294a068e993c171b83f94b5cafdcf8692f3d5", "source_title": "Optimal Timing in Dynamic and Robust Attacker Engagement During Advanced Persistent Threats", "tags": [], "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-1707-08031", "kind": "paper", "name": "Optimal Timing in Dynamic and Robust Attacker Engagement During Advanced Persistent Threats", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-1707-08031", "source_url": "https://arxiv.org/abs/1707.08031", "status": "published", "summary_en": "This paper studies a scenario where a defender uses honeynets for active defense to observe an attacker who has penetrated the network. The authors propose an infinite-horizon Markov decision process over a continuous state space to model when to eject the attacker after gathering information, and analyze the robustness of this policy via a Stackelberg game, with simulations on a conceptual network.", "summary_es": "Este artículo estudia un escenario en el que un defensor usa honeynets para la defensa activa y observar a un atacante que ha penetrado la red. Los autores proponen un proceso de decisión de Markov de horizonte infinito sobre un espacio de estados continuo para modelar cuándo expulsar al atacante tras recolectar información, y analizan la robustez de esta política mediante un juego de Stackelberg, con simulaciones en una red conceptual.", "updated_at": "2026-10-04", "year": 2017}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Vivek Nigam", "Carolyn Talcott", "Abrãao Aires Urquiza"], "doi": "10.48550/arxiv.1801.04066", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-pdf", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed and the automation or efficacy of the proposed method has not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se ha verificado de forma independiente la automatización o eficacia del método propuesto.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "These properties may help intruders distinguish whether a system is a honeypot or concrete system", "source_quote_normalization": "case-only-from-frozen-source", "source_sha256": "cd8b57700f9e855f2bea40231fd3b22e1aaee21fc52f16ea6b3827596239dabf", "source_title": "Symbolic Timed Observational Equivalence", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-1801-04066", "kind": "paper", "name": "Symbolic Timed Observational Equivalence", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-1801-04066", "source_url": "https://arxiv.org/abs/1801.04066", "status": "published", "summary_en": "This paper addresses how intruders can exploit timing side channels to distinguish whether a system is a honeypot or a real system, potentially helping them evade defense mechanisms. The authors introduce a novel definition of timed observational equivalence using symbolic time constraints, enabling automation via SMT solvers.", "summary_es": "Este artículo aborda cómo los intrusos pueden explotar canales laterales de tiempo para distinguir si un sistema es un honeypot o un sistema real, lo que podría ayudarles a evadir mecanismos de defensa. Los autores introducen una nueva definición de equivalencia observacional temporizada que utiliza restricciones de tiempo simbólicas, permitiendo su automatización mediante solucionadores SMT.", "updated_at": "2026-10-04", "year": 2018}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Jeffrey Pawlick", "Edward Colbert", "Quanyan Zhu"], "doi": "10.48550/arxiv.1804.06831", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the effectiveness of the proposed model has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad del modelo propuesto.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "we extend signaling games by including a detector that gives off probabilistic warnings when the sender acts deceptively", "source_sha256": "2a5a95eb073d0f586db7ea4a5e548687a3334fb5623ee273bf7bedb8c13514e5", "source_title": "Modeling and Analysis of Leaky Deception using Signaling Games with Evidence", "tags": [], "techniques": ["Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-1804-06831", "kind": "paper", "name": "Modeling and Analysis of Leaky Deception using Signaling Games with Evidence", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-1804-06831", "source_url": "https://arxiv.org/abs/1804.06831", "status": "published", "summary_en": "The authors propose a game-theoretic model extending signaling games to include a probabilistic deception detector, applied to the design of defensive deception mechanisms in network security. The work analyzes pooling and partially-separating equilibria depending on detector quality.", "summary_es": "Los autores proponen un modelo de teoría de juegos que extiende los juegos de señalización para incorporar un detector probabilístico de engaño, aplicable al diseño de mecanismos de engaño defensivo en seguridad de redes. El trabajo analiza equilibrios de agrupamiento y separación parcial según la calidad del detector.", "updated_at": "2026-10-04", "year": 2018}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Abigail Paradise", "Dvir Cohen", "Asaf Shabtai", "Rami Puzis"], "doi": "10.48550/arxiv.1807.00125", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Identity", "Application"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the reported evaluation results have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha verificado de forma independiente los resultados de la evaluación reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "ProfileGen' creates honeypot profiles that are similar to actual data by extrapolating the characteristics and properties of real data items", "source_sha256": "403b3537ea6452151d2ec93ca56e120e6d551375740dadde8ec2588da845a129", "source_title": "Generation of Automatic and Realistic Artificial Profiles", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-1807-00125", "kind": "paper", "name": "Generation of Automatic and Realistic Artificial Profiles", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-1807-00125", "source_url": "https://arxiv.org/abs/1807.00125", "status": "published", "summary_en": "The authors present 'ProfileGen', a method for automatically generating realistic honeypot profiles for professional social networks, intended to attract malicious actors in online social networks. They report that an evaluation by domain experts confirmed the generated profiles were indistinguishable from real ones.", "summary_es": "Los autores presentan 'ProfileGen', un método para generar automáticamente perfiles honeypot realistas en redes sociales profesionales, con el fin de atraer a actores maliciosos en redes sociales en línea. Según reportan, una evaluación con expertos confirmó que los perfiles generados resultan indistinguibles de los reales.", "updated_at": "2026-10-04", "year": 2018}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Meng Wang", "Javier Santillan", "Fernando Kuipers"], "doi": "10.48550/arxiv.1807.04114", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["IoT"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed and findings or system effectiveness have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se han verificado de forma independiente los hallazgos o la efectividad del sistema.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "ThingPot is the first of its kind, since it focuses not only on the IoT application protocols themselves, but on the whole IoT platform.", "source_sha256": "ca1fc63e9f41190631a9d1b97bc61825923eda5e7401aa244a075a8c6ea89c0e", "source_title": "ThingPot: an interactive Internet-of-Things honeypot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-1807-04114", "kind": "paper", "name": "ThingPot: an interactive Internet-of-Things honeypot", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-1807-04114", "source_url": "https://arxiv.org/abs/1807.04114", "status": "published", "summary_en": "The authors propose ThingPot, an interactive IoT honeypot that, per the abstract, targets the whole IoT platform rather than just application protocols, with a proof-of-concept implementing XMPP and a REST API to mimic a Philips Hue smart lighting system. The abstract states it was deployed for 1.5 months, capturing data that revealed five types of attacks and attack vectors against smart devices.", "summary_es": "Los autores proponen ThingPot, un honeypot interactivo para IoT que, según el resumen, no solo imita protocolos de aplicación IoT sino la plataforma completa, implementando una prueba de concepto con XMPP y una API REST para simular un sistema de iluminación inteligente Philips Hue. El resumen indica que fue desplegado durante 1.5 meses, capturando datos que permitieron identificar cinco tipos de ataques y vectores de ataque contra dispositivos inteligentes.", "updated_at": "2026-10-04", "year": 2018}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Linan Huang", "Quanyan Zhu"], "doi": "10.48550/arxiv.1809.02013", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "OT/ICS"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed and the models or results presented have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se han verificado de forma independiente los modelos o resultados presentados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "the defender can adopt defensive deception techniques such as honey files and honeypots to create sufficient amount of uncertainties for the attacker", "source_sha256": "bbf08fac7a22ddebdb0225f7ca94e938db03ddd10da2eca1b5d88d8cb0b584a4", "source_title": "Dynamic Bayesian Games for Adversarial and Defensive Cyber Deception", "tags": [], "techniques": ["Honeypot", "Honeytoken", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-1809-02013", "kind": "paper", "name": "Dynamic Bayesian Games for Adversarial and Defensive Cyber Deception", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-1809-02013", "source_url": "https://arxiv.org/abs/1809.02013", "status": "published", "summary_en": "The authors use game theory, including static Bayesian games, signaling games, and multi-stage models, to model defender-attacker interactions in cybersecurity under uncertainty and asymmetric information. Per the abstract, the study examines a case involving Advanced Persistent Threats (APTs) and the Tennessee Eastman process, considering that defenders may employ deception techniques such as honey files and honeypots to create strategic uncertainty for attackers.", "summary_es": "Los autores utilizan teoría de juegos, incluyendo juegos bayesianos estáticos, juegos de señalización y modelos multietapa, para modelar interacciones entre defensores y atacantes en ciberseguridad bajo incertidumbre e información asimétrica. Según el resumen, el estudio analiza un caso de Amenazas Persistentes Avanzadas (APT) y el proceso Tennessee Eastman, considerando que los defensores pueden emplear técnicas de engaño como archivos señuelo (honey files) y honeypots para generar incertidumbre estratégica en los atacantes.", "updated_at": "2026-10-04", "year": 2018}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Mohamadreza Ahmadi", "Murat Cubuktepe", "Nils Jansen", "Sebastian Junges", "Joost-Pieter Katoen", "Ufuk Topcu"], "doi": "10.48550/arxiv.1810.00092", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed and the effectiveness of the described methods has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad de los métodos descritos.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "we use a two-player partially observable stochastic game (POSG) framework", "source_sha256": "b08260314d550a29b5ed3d6949017e6209becc5e7dcaaea99905d8abde36d694", "source_title": "The Partially Observable Games We Play for Cyber Deception", "tags": [], "techniques": ["Adversary engagement", "Moving target defense"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-1810-00092", "kind": "paper", "name": "The Partially Observable Games We Play for Cyber Deception", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-1810-00092", "source_url": "https://arxiv.org/abs/1810.00092", "status": "published", "summary_en": "The authors propose a partially observable stochastic game framework to model interactions between a fully-observing defender and a partially-observing infiltrator in cybersecurity. They formulate the deception strategy problem as a robust mixed-integer linear program and present a scalable approach using parametric Markov decision processes to compute finite-memory infiltration strategies, illustrating the approach on a network security model.", "summary_es": "Los autores proponen un marco de juego estocástico parcialmente observable para modelar interacciones entre un defensor con observabilidad total y un infiltrador con observabilidad parcial en ciberseguridad. Formulan el problema de encontrar una estrategia de engaño que minimice el costo esperado como un programa lineal entero mixto robusto, y presentan un método escalable basado en procesos de decisión de Markov paramétricos para calcular estrategias de infiltración de memoria finita. Ilustran el enfoque en un modelo de seguridad de red.", "updated_at": "2026-10-04", "year": 2018}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Tao Zhang", "Linan Huang", "Jeffrey Pawlick", "Quanyan Zhu"], "doi": "10.48550/arxiv.1902.03925", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed and the effectiveness of the described methods has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad de los métodos descritos.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "non-cooperative games become a natural choice of models to capture the adversarial interactions", "source_sha256": "da13402b056728abfe481f71c2095abaafc9c26a92d6ba9856585dfa0ccce201", "source_title": "Game-Theoretic Analysis of Cyber Deception: Evidence-Based Strategies and Dynamic Risk Mitigation", "tags": [], "techniques": ["Adversary engagement", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-1902-03925", "kind": "paper", "name": "Game-Theoretic Analysis of Cyber Deception: Evidence-Based Strategies and Dynamic Risk Mitigation", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-1902-03925", "source_url": "https://arxiv.org/abs/1902.03925", "status": "published", "summary_en": "The authors present an overview of cyber deception games across three environments, extending baseline signaling game models to include evidence via side-channel knowledge acquisition. They analyze deception in binary and continuous information spaces and explore a multi-stage incomplete-information Bayesian game model for defensive deception against advanced persistent threats, using perfect Bayesian Nash equilibrium as the solution concept.", "summary_es": "Los autores presentan una visión general de juegos de engaño cibernético en tres entornos distintos, extendiendo modelos base de juegos de señalización para incluir evidencia a través de conocimiento de canal lateral. Analizan el engaño en espacios de información binarios y continuos, y exploran un modelo bayesiano multietapa de información incompleta para el engaño defensivo frente a amenazas persistentes avanzadas (APT), usando el equilibrio bayesiano perfecto como concepto de solución.", "updated_at": "2026-10-04", "year": 2019}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Shishir Nagaraja", "Ryan Shah"], "doi": "10.48550/arxiv.1903.00733", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "Application"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the reported effectiveness has not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha verificado de forma independiente la efectividad reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "Malware detection systems including honeypots fail to stop click fraud apps", "source_sha256": "e1ad49d4dc02d58c7ce0171f8b0d4c2979b2a13d983e1d5157ef51b867948461", "source_title": "Clicktok: Click Fraud Detection using Traffic Analysis", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-1903-00733", "kind": "paper", "name": "Clicktok: Click Fraud Detection using Traffic Analysis", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-1903-00733", "source_url": "https://arxiv.org/abs/1903.00733", "status": "published", "summary_en": "According to the abstract, this work develops inference techniques to detect organic click fraud in advertising networks. The authors note that malware detection systems, including honeypots, fail to stop click fraud apps, and propose two defenses: a mimicry defence based on detecting click reuse patterns, and a bait-click defence that injects decoy clicks to trigger fraudulent app behavior.", "summary_es": "Este trabajo, según el resumen, presenta técnicas de inferencia para detectar fraude de clics orgánico en redes de publicidad. Los autores señalan que los sistemas de detección de malware, incluidos los honeypots, fallan en detener aplicaciones de fraude de clics, y proponen dos defensas: una basada en la detección de reutilización de clics (mimicry defence) y otra basada en la inyección de clics señuelo (bait-click defence) para activar comportamientos fraudulentos.", "updated_at": "2026-10-04", "year": 2019}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Zhen Cheng", "Xinrui Hou", "Runhuai Li", "Yajin Zhou", "Xiapu Luo", "Jinku Li", "Kui Ren"], "doi": "10.48550/arxiv.1904.01981", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "Application"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the authors' analysis has not been independently replicated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha replicado de forma independiente el análisis de los autores.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "we first designed and implemented a honeypot that could capture real attacks in the wild", "source_sha256": "3f47b85405a625cdc1d7768e32f894c2ec33fd237f127fcc65a4fb34fa9fe698", "source_title": "Towards a First Step to Understand the Cryptocurrency Stealing Attack on Ethereum", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-1904-01981", "kind": "paper", "name": "Towards a First Step to Understand the Cryptocurrency Stealing Attack on Ethereum", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-1904-01981", "source_url": "https://arxiv.org/abs/1904.01981", "status": "published", "summary_en": "According to the abstract, the authors conducted the first systematic study of an attack stealing cryptocurrencies via unprotected JSON-RPC endpoints in Ethereum nodes. They designed and deployed a honeypot to capture real-world attacks over six months, collecting millions of requests and analyzing attacker behavior and profits.", "summary_es": "Según el resumen, los autores realizaron el primer estudio sistemático de un ataque que roba criptomonedas mediante endpoints JSON-RPC desprotegidos en nodos de Ethereum. Diseñaron e implementaron un honeypot para capturar ataques reales durante seis meses, recopilando millones de solicitudes y analizando el comportamiento y las ganancias de los atacantes.", "updated_at": "2026-10-04", "year": 2019}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Soham Deshmukh", "Rahul Rade", "Faruk Kazi"], "doi": "10.48550/arxiv.1905.11824", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based only on the publicly available title and abstract; the full text has not been reviewed and the reported performance has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha validado de forma independiente el rendimiento reportado.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "real data attacks on a Cowrie honeypot system", "source_sha256": "65da35c9b599f027a281fca218771e9ab64d99d99de81f524c0ab22458ddb439", "source_title": "Attacker Behaviour Profiling using Stochastic Ensemble of Hidden Markov Models", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-1905-11824", "kind": "paper", "name": "Attacker Behaviour Profiling using Stochastic Ensemble of Hidden Markov Models", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-1905-11824", "source_url": "https://arxiv.org/abs/1905.11824", "status": "published", "summary_en": "According to the authors, this work proposes a framework for modeling attacker behavior to better predict future actions using a novel semi-supervised algorithm called Fusion Hidden Markov Model (FHMM). Experiments were conducted on real attack data captured from a Cowrie honeypot system, comparing FHMM's performance against Markov Chains, traditional HMMs, and deep recurrent neural network architectures.", "summary_es": "Según los autores, este trabajo propone un marco para modelar el comportamiento de atacantes y predecir mejor sus acciones futuras mediante un nuevo algoritmo semisupervisado llamado Fusion Hidden Markov Model (FHMM). Los experimentos se realizaron con datos de ataques reales capturados en un sistema honeypot Cowrie, comparando el rendimiento de FHMM con cadenas de Markov, HMM tradicionales y redes neuronales recurrentes profundas.", "updated_at": "2026-10-04", "year": 2019}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Celine Irvene", "David Formby", "Raheem Beyah"], "doi": "10.48550/arxiv.1905.12061", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["IoT", "OT/ICS"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed and the methodology or results have not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se ha validado de forma independiente la metodología o los resultados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "HoneyBot convincingly spoofed communications", "source_sha256": "6b01b75b87a52114c3b4a0f044dd0a9f87eee24d49932bbcdaa717a049fd3494", "source_title": "On Evaluating the Effectiveness of the HoneyBot: A Case Study", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-1905-12061", "kind": "paper", "name": "On Evaluating the Effectiveness of the HoneyBot: A Case Study", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-1905-12061", "source_url": "https://arxiv.org/abs/1905.12061", "status": "published", "summary_en": "According to the authors, this paper presents a user study with 40 participants evaluating HoneyBot, a hybrid-interaction honeypot designed for networked robotic systems that simulates unsafe actions while performing safe physical ones. The authors report that participants could not distinguish simulated sensor values from real ones.", "summary_es": "Según los autores, este artículo presenta un estudio de usuario con 40 participantes para evaluar HoneyBot, un honeypot híbrido de interacción diseñado para sistemas robóticos en red que simula acciones inseguras mientras realiza acciones físicas seguras. Los autores indican que los sujetos no pudieron distinguir entre valores de sensores simulados y reales.", "updated_at": "2026-10-04", "year": 2019}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Hui Lin"], "doi": "10.48550/arxiv.1905.13254", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["IoT", "Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed and the methodology or results have not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se ha validado de forma independiente la metodología o los resultados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "disrupt and mislead adversaries into exposures", "source_sha256": "0cc8c7b1770822e905096b5f1f5c61af0cb291b9ef188e9de342069deee102a4", "source_title": "SDN-based In-network Honeypot: Preemptively Disrupt and Mislead Attacks in IoT Networks", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-1905-13254", "kind": "paper", "name": "SDN-based In-network Honeypot: Preemptively Disrupt and Mislead Attacks in IoT Networks", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-1905-13254", "source_url": "https://arxiv.org/abs/1905.13254", "status": "published", "summary_en": "According to the authors, this paper proposes an SDN-based in-network honeypot that reroutes traffic from suspicious nodes and intelligently spoofs it with misleading information to confuse attackers in IoT environments, without requiring dedicated hardware. The authors state preliminary evaluations show little impact on network performance.", "summary_es": "Según los autores, este artículo propone un honeypot in-network basado en Redes Definidas por Software (SDN) que redirige el tráfico de nodos sospechosos y lo enmascara con información engañosa para confundir a atacantes en entornos IoT, sin requerir hardware dedicado. Los autores afirman que evaluaciones preliminares muestran un impacto mínimo en el rendimiento de la red.", "updated_at": "2026-10-04", "year": 2019}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Spiros Antonatos", "Stefano Braghin", "Naoise Holohan", "Pol MacAonghusa"], "doi": "10.48550/arxiv.1906.09829", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Application"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed nor has the reported effectiveness been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se ha verificado de forma independiente la efectividad reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "Records with high re-identification risk, called AnonTokens, are inserted into anonymized datasets.", "source_sha256": "7ba209df1a838fe31d86804b6cac66d594fe14b4fda73357e4d5eee4cb29055a", "source_title": "AnonTokens: tracing re-identification attacks through decoy records", "tags": [], "techniques": ["Honeytoken", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-1906-09829", "kind": "paper", "name": "AnonTokens: tracing re-identification attacks through decoy records", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-1906-09829", "source_url": "https://arxiv.org/abs/1906.09829", "status": "published", "summary_en": "According to the authors, this work proposes AnonTokens, an approach applying the honeytoken concept to the data privacy domain to trace re-identification attacks. High re-identification-risk decoy records are inserted into anonymized datasets to detect malicious users. The authors evaluate their approach using large-scale population datasets.", "summary_es": "Este trabajo, según sus autores, propone AnonTokens, un enfoque que aplica el concepto de honeytokens al dominio de la privacidad de datos para rastrear ataques de re-identificación. Se insertan registros señuelo con alto riesgo de re-identificación en conjuntos de datos anonimizados para detectar usuarios maliciosos. Los autores evalúan su propuesta con conjuntos de datos poblacionales a gran escala.", "updated_at": "2026-10-04", "year": 2019}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Linan Huang", "Quanyan Zhu"], "doi": "10.48550/arxiv.1907.01396", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed nor has the reported effectiveness been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se ha verificado de forma independiente la efectividad reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "defensive deception for detection and counter-deception, feedback-driven Moving Target Defense (MTD), and adaptive honeypot engagement", "source_sha256": "1545c285029538648de1153384ba90d029f7e5201de99f412a1dce3bed484988", "source_title": "Strategic Learning for Active, Adaptive, and Autonomous Cyber Defense", "tags": [], "techniques": ["Honeypot", "Moving target defense", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-1907-01396", "kind": "paper", "name": "Strategic Learning for Active, Adaptive, and Autonomous Cyber Defense", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-1907-01396", "source_url": "https://arxiv.org/abs/1907.01396", "status": "published", "summary_en": "According to the authors, this chapter presents three proactive defense schemes against advanced attackers: defensive deception for detection and counter-deception, feedback-driven Moving Target Defense (MTD), and adaptive honeypot engagement. The authors propose strategic learning schemes tailored to different levels of information uncertainty for these strategies.", "summary_es": "Según los autores, este capítulo presenta tres esquemas de defensa proactiva frente a atacantes avanzados: engaño defensivo para detección y contra-engaño, defensa de objetivos móviles (MTD) guiada por retroalimentación, y compromiso adaptativo con honeypots. Los autores proponen esquemas de aprendizaje estratégico adaptados a distintos niveles de incertidumbre informativa para estas estrategias.", "updated_at": "2026-10-04", "year": 2019}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Feng Xiao", "Qiang Xu"], "doi": "10.48550/arxiv.1912.12828", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["OT/ICS"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text was not reviewed and the model's effectiveness has not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se ha verificado de forma independiente la efectividad del modelo.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "evaluated basing on the attack data captured by the large-scale deployed honeypots for industrial control system", "source_sha256": "2401ae5f61914ae25b40602694d0bfe27d0d5aca3b5c785d09fdbaa468b1d466", "source_title": "ICSTrace: A Malicious IP Traceback Model for Attacking Data of Industrial Control System", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-1912-12828", "kind": "paper", "name": "ICSTrace: A Malicious IP Traceback Model for Attacking Data of Industrial Control System", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-1912-12828", "source_url": "https://arxiv.org/abs/1912.12828", "status": "published", "summary_en": "The authors propose ICSTrace, a model for tracing malicious IP addresses attacking industrial control systems without deploying new network services. The model extracts function codes and parameters from attack data according to the industrial control protocol format, transforms them into vectors using a short sequence probability method, and applies a clustering algorithm (Partial Seeded K-Means) to associate attacks with an organization. According to the authors, ICSTrace was evaluated using attack data captured by large-scale deployed honeypots for industrial control systems.", "summary_es": "Los autores proponen ICSTrace, un modelo para rastrear direcciones IP maliciosas que atacan sistemas de control industrial, sin necesidad de desplegar nuevos servicios de red. El modelo extrae códigos de función y parámetros de los datos de ataque según el formato del protocolo industrial, los transforma en vectores mediante un método de probabilidad de secuencias cortas, y aplica un algoritmo de agrupamiento (Partial Seeded K-Means) para asociar ataques con una organización. Según los autores, ICSTrace fue evaluado utilizando datos de ataque capturados por honeypots desplegados a gran escala para sistemas de control industrial.", "updated_at": "2026-10-04", "year": 2019}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Jaspreet Kaur"], "doi": "10.48550/arxiv.2001.07179", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-pdf", "environments": ["IoT", "Cloud", "Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the effectiveness of the proposed framework has not been verified.", "limitations_es": "Esta entrada se basa únicamente en el título y el resumen disponibles públicamente; no se ha revisado el texto completo ni se ha verificado la efectividad del marco propuesto.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "we propose a framework which prevent the ransomware attack more appropriately using various techniques as blockchain, honeypot, cloud & edge computing", "source_sha256": "a9fe4e2d7056288ca01ed63f75542035f1f70ab355a92089b52a99df3f4ad8db", "source_title": "A Secure and Smart Framework for Preventing Ransomware Attack", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2001-07179", "kind": "paper", "name": "A Secure and Smart Framework for Preventing Ransomware Attack", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2001-07179", "source_url": "https://arxiv.org/abs/2001.07179", "status": "published", "summary_en": "This paper proposes a framework for preventing ransomware attacks by combining blockchain, honeypot techniques, and cloud and edge computing. The authors state the framework is analyzed mainly on IoT devices, with potential generalization to other malware attacks.", "summary_es": "Este artículo propone un marco para prevenir ataques de ransomware combinando blockchain, honeypot y computación en la nube y en el borde. Los autores plantean que el marco se analiza principalmente sobre dispositivos IoT, con una posible generalización a otros tipos de malware.", "updated_at": "2026-10-04", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Jie Fu", "Abhishek N. Kulkarni", "Huan Luo", "Nandi O. Leslie", "Charles A. Kamhoua"], "doi": "10.48550/arxiv.2002.07025", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed, and the effectiveness of the proposed methods has not been independently replicated or validated.", "limitations_es": "Esta entrada se basa únicamente en el título y el resumen disponibles públicamente; no se ha revisado el texto completo ni se ha replicado o validado de forma independiente la efectividad de los métodos propuestos.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "directing the attacker to a high-fidelity honeypot", "source_sha256": "391b4ef75a8740591f3063af4590db769ccf4a362baabf35bb0745654344232f", "source_title": "Secure-by-synthesis network with active deception and temporal logic specifications", "tags": [], "techniques": ["Decoy", "Honeypot", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2002-07025", "kind": "paper", "name": "Secure-by-synthesis network with active deception and temporal logic specifications", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2002-07025", "source_url": "https://arxiv.org/abs/2002.07025", "status": "published", "summary_en": "This paper addresses the synthesis of active deception strategies in networks using two-player games with asymmetric information and temporal logic objectives, incorporating decoy systems and high-fidelity honeypots. The authors use a level-2 hypergame framework to model the attacker's incomplete perception and assess whether the defender can guarantee security properties.", "summary_es": "Este artículo aborda la síntesis de estrategias de engaño activo en redes mediante juegos entre dos jugadores con información asimétrica y objetivos en lógica temporal, incorporando sistemas señuelo y honeypots de alta fidelidad. Los autores utilizan el marco de hipertjuegos de nivel 2 para modelar la percepción incompleta del atacante y evaluar si el defensor puede garantizar propiedades de seguridad.", "updated_at": "2026-10-11", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Armin Ziaie Tabari", "Xinming Ou"], "doi": "10.48550/arxiv.2003.01218", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["IoT"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed nor has the effectiveness of the described honeypot ecosystem been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha verificado de forma independiente la efectividad del ecosistema de honeypots descrito.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "create a multiphased approach in building a honeypot ecosystem", "source_quote_normalization": "longest-contiguous-substring-from-frozen-source", "source_sha256": "19c0a1c21222d778a07d62f9fe609981e84c015d9baf50ba130a3fbdb0108707", "source_title": "A First Step Towards Understanding Real-world Attacks on IoT Devices", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2003-01218", "kind": "paper", "name": "A First Step Towards Understanding Real-world Attacks on IoT Devices", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2003-01218", "source_url": "https://arxiv.org/abs/2003.01218", "status": "published", "summary_en": "This paper describes the authors' initial efforts to build a honeypot ecosystem to gather and analyze real-world attack data against IoT devices. According to the abstract, they develop a multiphased approach that gradually increases the sophistication of low-interaction honeypots, deployed both on-premise and in the cloud, including a specific honeypot for IoT cameras called Honeycamera. The authors report observing attackers explicitly targeting IoT devices, with some activities appearing to involve direct human interaction.", "summary_es": "Este trabajo describe los esfuerzos iniciales de los autores para construir un ecosistema de honeypots destinado a recopilar y analizar datos de ataques reales contra dispositivos IoT. Según el resumen, desarrollan un enfoque multifásico que incrementa gradualmente la sofisticación de honeypots de baja interacción, desplegados tanto localmente como en la nube, incluyendo un honeypot específico para cámaras IoT llamado Honeycamera. Los autores indican que observaron atacantes dirigiéndose explícitamente a dispositivos IoT, con algunas actividades que parecen involucrar interacción humana directa.", "updated_at": "2026-10-04", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Mengmeng Ge", "Jin-Hee Cho", "Dong Seong Kim", "Gaurav Dixit", "Ing-Ray Chen"], "doi": "10.48550/arxiv.2005.04220", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["IoT", "Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed nor has the analytical effectiveness reported by the authors been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad analítica reportada por los autores.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "integrated defense technique to achieve intrusion prevention by leveraging cyberdeception (i.e., a decoy system) and moving target defense", "source_sha256": "9a501e841270d850fb2cd4fde358f3edc806dfc6ed46346e80c9730e77a3b3a1", "source_title": "Proactive Defense for Internet-of-Things: Integrating Moving Target Defense with Cyberdeception", "tags": [], "techniques": ["Moving target defense", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2005-04220", "kind": "paper", "name": "Proactive Defense for Internet-of-Things: Integrating Moving Target Defense with Cyberdeception", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2005-04220", "source_url": "https://arxiv.org/abs/2005.04220", "status": "published", "summary_en": "The authors propose an integrated defense technique combining cyberdeception via decoy systems with moving target defense through network topology shuffling, applied to SDN-based IoT networks. According to the abstract, they develop and compare several strategies for deciding when and how to reshuffle network topology in the presence of decoys, analytically evaluating effectiveness through a graphical security model. The authors report that their approach prolongs system lifetime, increases attack complexity, and maintains service availability compared to a network without the technique.", "summary_es": "Los autores proponen una técnica de defensa integrada que combina cyberdecepción mediante sistemas señuelo y defensa de objetivo móvil a través del reordenamiento de la topología de red, aplicada a redes IoT basadas en SDN. Según el resumen, desarrollan y comparan varias estrategias para decidir cuándo y cómo reconfigurar la topología de red en presencia de señuelos, evaluando analíticamente su efectividad mediante un modelo gráfico de seguridad. Los autores reportan que su enfoque prolonga la vida útil del sistema, aumenta la complejidad de ataque y mantiene la disponibilidad del servicio en comparación con una red sin esta técnica.", "updated_at": "2026-10-04", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Aditya Shinde", "Prashant Doshi", "Omid Setayeshfar"], "doi": "10.48550/arxiv.2007.09512", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "Endpoint"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text was not reviewed and the reported effectiveness was not independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha verificado de forma independiente la efectividad reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "we focus on engaging with them to learn their intent", "source_sha256": "698c6406fec6eab38a6ae12af38eead15d6499cc18d31f8a9f64ae07d2077e85", "source_title": "Active Deception using Factored Interactive POMDPs to Recognize Cyber Attacker's Intent", "tags": [], "techniques": ["Honeypot", "Decoy", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2007-09512", "kind": "paper", "name": "Active Deception using Factored Interactive POMDPs to Recognize Cyber Attacker's Intent", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2007-09512", "source_url": "https://arxiv.org/abs/2007.09512", "status": "published", "summary_en": "This paper, according to its authors, presents an adaptive agent that uses active deception to recognize a cyber attacker's intent, modeling the problem as a two-agent sequential decision process via factored I-POMDPs. The authors describe using honeypots and decoys across multiple attack phases to refine predictions about attacker behavior, rather than merely delaying or confusing attackers.", "summary_es": "Este trabajo, según sus autores, presenta un agente adaptativo que emplea decepción activa para reconocer la intención de un atacante cibernético, modelando el problema como un proceso de decisión secuencial de dos agentes mediante I-POMDPs factorizados. Los autores describen el uso de honeypots y decoys en múltiples fases del ataque para refinar las predicciones sobre el comportamiento del atacante, en lugar de solo retrasarlo o confundirlo.", "updated_at": "2026-10-04", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Linan Huang", "Quanyan Zhu"], "doi": "10.48550/arxiv.2007.13981", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text was not reviewed and the reported effectiveness was not independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha verificado de forma independiente la efectividad reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "We design cognitive honeypots at idle production nodes and disguise honey links as service links", "source_sha256": "d26b23304716b710962e14de3750db46075b57182cff33aa3910cdf2c5059efe", "source_title": "Farsighted Risk Mitigation of Lateral Movement Using Dynamic Cognitive Honeypots", "tags": [], "techniques": ["Honeypot", "Decoy", "Moving target defense"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2007-13981", "kind": "paper", "name": "Farsighted Risk Mitigation of Lateral Movement Using Dynamic Cognitive Honeypots", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2007-13981", "source_url": "https://arxiv.org/abs/2007.13981", "status": "published", "summary_en": "According to the authors, this study proposes a time-expanded random network to model adversarial lateral movement in enterprise networks, along with dynamic cognitive honeypots placed at idle production nodes and honey links disguised as service links. The authors describe an approach aimed at reducing long-term vulnerability through honeypot policies whose location changes randomly.", "summary_es": "Según los autores, este estudio propone una red aleatoria expandida en el tiempo para modelar el movimiento lateral adversario en redes empresariales, junto con honeypots cognitivos dinámicos ubicados en nodos de producción inactivos y enlaces señuelo disfrazados como enlaces de servicio. Los autores describen un enfoque orientado a reducir la vulnerabilidad a largo plazo mediante políticas de honeypot que cambian de ubicación aleatoriamente.", "updated_at": "2026-10-04", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Abhishek N. Kulkarni", "Jie Fu"], "doi": "10.48550/arxiv.2008.03210", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based only on the available title and abstract; the full text was not reviewed and the effectiveness of the proposal was not independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se ha verificado de forma independiente la efectividad de la propuesta.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "we introduce a class of hypergames to model asymmetric information created by decoys in the attacker-defender interactions", "source_sha256": "39de1a17355dde0623b09400af80f09594f715a2731d4f2c91439a28801d5099", "source_title": "A Theory of Hypergames on Graphs for Synthesizing Dynamic Cyber Defense with Deception", "tags": [], "techniques": ["Decoy", "Moving target defense", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2008-03210", "kind": "paper", "name": "A Theory of Hypergames on Graphs for Synthesizing Dynamic Cyber Defense with Deception", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2008-03210", "source_url": "https://arxiv.org/abs/2008.03210", "status": "published", "summary_en": "The authors propose a formal-methods approach to synthesize reactive defense strategies in networks equipped with decoy systems. They generalize attack graphs to incorporate defender countermeasures in an attack-defend game model, and introduce a class of hypergames to model asymmetric information created by decoys. According to the authors, this framework enables synthesis of effective defense strategies exploiting the attacker's misperception.", "summary_es": "Los autores proponen un enfoque de métodos formales para sintetizar estrategias de defensa reactiva en redes equipadas con sistemas señuelo. Generalizan los grafos de ataque para incorporar contramedidas del defensor en un modelo de juego ataque-defensa, e introducen una clase de hiperjuegos para modelar la información asimétrica creada por los decoys. Según los autores, este marco permite sintetizar estrategias de defensa efectivas basadas en la desinformación del atacante.", "updated_at": "2026-10-04", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Dayong Ye", "Tianqing Zhu", "Shen Sheng", "Wanlei Zhou"], "doi": "10.48550/arxiv.2008.05629", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based only on the available title and abstract; the full text was not reviewed and the effectiveness of the proposal was not independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se ha verificado de forma independiente la efectividad de la propuesta.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "a defender adopts differential privacy mechanisms to strategically change the number of systems and obfuscate the configurations of systems", "source_sha256": "1240d2c9400791deadc06161caacdd8b817e67306763e990015cec85e04dd145", "source_title": "A Differentially Private Game Theoretic Approach for Deceiving Cyber Adversaries", "tags": [], "techniques": ["Decoy", "Moving target defense"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2008-05629", "kind": "paper", "name": "A Differentially Private Game Theoretic Approach for Deceiving Cyber Adversaries", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2008-05629", "source_url": "https://arxiv.org/abs/2008.05629", "status": "published", "summary_en": "The authors present a differentially private game theoretic approach to cyber deception, aiming to overcome limitations of prior approaches that assume a fixed number of systems and simplified attackers. The defender uses differential privacy mechanisms to strategically change the number of systems and obfuscate configurations, while the attacker uses Bayesian inference. According to the authors, experimental results demonstrate the effectiveness of the proposed approach.", "summary_es": "Los autores presentan un enfoque de teoría de juegos con privacidad diferencial para el engaño cibernético, orientado a superar limitaciones de enfoques previos que asumen un número fijo de sistemas y atacantes simplificados. El defensor usa mecanismos de privacidad diferencial para cambiar estratégicamente el número de sistemas y ofuscar sus configuraciones, mientras el atacante usa inferencia bayesiana. Según los autores, los resultados experimentales demuestran la efectividad del enfoque propuesto.", "updated_at": "2026-10-04", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Nicholas Carlini"], "doi": "10.48550/arxiv.2009.10975", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Application"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed nor has the attack's replication been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha verificado independientemente la reproducción del ataque.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "We break the baseline version of this defense by reducing the detection true positive rate to 0\\% and the detection AUC to 0.02", "source_sha256": "82dc0cf1a55298d1602a0924d3e2d0f0db4b26db53c2186f195d32871bd7029e", "source_title": "A Partial Break of the Honeypots Defense to Catch Adversarial Attacks", "tags": [], "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2009-10975", "kind": "paper", "name": "A Partial Break of the Honeypots Defense to Catch Adversarial Attacks", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2009-10975", "source_url": "https://arxiv.org/abs/2009.10975", "status": "published", "summary_en": "According to the authors, this paper presents an attack that partially breaks a defense that injects 'honeypots' into neural networks to detect adversarial attacks. They report reducing the detection true positive rate to 0% and detection AUC to 0.02 while maintaining original distortion bounds, and note that the original defense authors later amended it to mitigate the attack.", "summary_es": "Según los autores, este trabajo presenta un ataque que rompe parcialmente una defensa basada en 'honeypots' insertados en redes neuronales para detectar ataques adversariales. Reportan que redujeron la tasa de detección de verdaderos positivos al 0% y el AUC de detección a 0.02, manteniendo los límites originales de distorsión, y mencionan que los autores de la defensa original la modificaron posteriormente para mitigar el ataque.", "updated_at": "2026-10-04", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Jason M. Pittman", "Kyle Hoffpauir", "Nathan Markle"], "doi": "10.48550/arxiv.2011.00582", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed nor has the tool's effectiveness been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad de la herramienta.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "this work introduces a tool for priming a target honeypot for evaluation", "source_sha256": "f4a7a6d9222024fcd70815e55d8b2a08c46a1f71b1a7fd275756caba889799c9", "source_title": "Primer -- A Tool for Testing Honeypot Measures of Effectiveness", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2011-00582", "kind": "paper", "name": "Primer -- A Tool for Testing Honeypot Measures of Effectiveness", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2011-00582", "source_url": "https://arxiv.org/abs/2011.00582", "status": "published", "summary_en": "According to the authors, this paper introduces 'Primer', a tool for priming and evaluating dynamic honeypots against previously developed measures of effectiveness related to environment fingerprinting, capturing adversary data, deception, and self-monitoring. The authors state they provide quantitative calibration results as a step toward automated effectiveness testing.", "summary_es": "Según los autores, este trabajo presenta 'Primer', una herramienta para preparar y evaluar honeypots dinámicos frente a medidas de efectividad previamente desarrolladas por los mismos autores, relacionadas con el fingerprinting del entorno, la captura de datos de adversarios, el engaño y la automonitorización. Los autores indican que proporcionan resultados de calibración cuantitativa como un paso hacia pruebas automatizadas de efectividad.", "updated_at": "2026-10-04", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Joao M. Ceron", "Christian Scholten", "Aiko Pras", "Elmer Lastdrager", "Jair Santanna"], "doi": "10.48550/arxiv.2011.01685", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "IoT"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed and findings have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se han verificado de forma independiente los hallazgos.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "By using a highly interactive honeypot that we developed, we collected more than 44 million packets over 120 days", "source_sha256": "71a84257166df979a4b4a0060b6c13eb6ee1e3bc4212e2bf9fa0c48fe4e2ede2", "source_title": "Characterising attacks targeting low-cost routers: a MikroTik case study (Extended)", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2011-01685", "kind": "paper", "name": "Characterising attacks targeting low-cost routers: a MikroTik case study (Extended)", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2011-01685", "source_url": "https://arxiv.org/abs/2011.01685", "status": "published", "summary_en": "The authors present a long-term investigation of attacks targeting MikroTik routers, using a highly interactive honeypot deployed across six countries. According to the abstract, they collected over 44 million packets over 120 days, classifying traffic by known CVEs to identify activities such as cryptocurrency mining, DNS server redirection, and eavesdropping tunnels.", "summary_es": "Los autores presentan una investigación de largo plazo sobre ataques dirigidos a routers MikroTik, utilizando un honeypot de alta interactividad desplegado en seis países. Según el resumen, recolectaron más de 44 millones de paquetes en 120 días, clasificando el tráfico según vulnerabilidades conocidas (CVE) para identificar actividades como minería de criptomonedas, redirección de servidores DNS y túneles usados para espionaje.", "updated_at": "2026-10-04", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Thai Le", "Noseong Park", "Dongwon Lee"], "doi": "10.48550/arxiv.2011.10492", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Application"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed and findings have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se han verificado de forma independiente los hallazgos.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "we borrow the \"honeypot\" concept from the cybersecurity community and propose DARCY, a honeypot-based defense framework against UniTrigger", "source_sha256": "7fd3e997c880b8745fd5bbfd27fd882fad5378921667beebf51c238ba9d7abd5", "source_title": "A Sweet Rabbit Hole by DARCY: Using Honeypots to Detect Universal Trigger's Adversarial Attacks", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2011-10492", "kind": "paper", "name": "A Sweet Rabbit Hole by DARCY: Using Honeypots to Detect Universal Trigger's Adversarial Attacks", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2011-10492", "source_url": "https://arxiv.org/abs/2011.10492", "status": "published", "summary_en": "According to the abstract, the authors propose DARCY, a defense framework adapting the honeypot concept from cybersecurity to detect Universal Trigger textual adversarial attacks. DARCY injects multiple trapdoors into a neural network model to bait and detect such attacks, reporting high detection rates in experiments across four public datasets.", "summary_es": "Según el resumen, los autores proponen DARCY, un marco de defensa basado en el concepto de honeypot adaptado del ámbito de ciberseguridad, para detectar ataques adversariales textuales conocidos como Universal Trigger. DARCY inserta múltiples trampas (trapdoors) en un modelo de red neuronal para atraer y detectar dichos ataques, reportando altas tasas de detección en experimentos con cuatro conjuntos de datos públicos.", "updated_at": "2026-10-04", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Daniel Schneider", "Daniel Fraunholz", "Daniel Krohmer"], "doi": "10.48550/arxiv.2101.02102", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed and the methodology or results have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha verificado la metodología o resultados de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "able to handle commands in a non-standard way by blocking them or replying with an insult to the attacker", "source_sha256": "54073521732ab949563fd17b0a50cbd0dbb546f5d9af5f8a8a66f30cad2e86d7", "source_title": "A Qualitative Empirical Analysis of Human Post-Exploitation Behavior", "tags": [], "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2101-02102", "kind": "paper", "name": "A Qualitative Empirical Analysis of Human Post-Exploitation Behavior", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2101-02102", "source_url": "https://arxiv.org/abs/2101.02102", "status": "published", "summary_en": "The authors present a low-cost honeypot capable of blocking commands or replying with insults to attackers, modeling the attacker-defender interaction as a Bayesian two-player game. According to the abstract, three honeypot instances were deployed and over 200 sessions were captured for a qualitative analysis of post-exploitation behavior.", "summary_es": "Los autores presentan un honeypot de bajo costo capaz de bloquear comandos o responder con insultos a los atacantes, modelando la interacción atacante-defensor como un juego bayesiano de dos jugadores. Según el resumen, desplegaron tres instancias del honeypot y capturaron más de 200 sesiones para un análisis cualitativo del comportamiento post-explotación.", "updated_at": "2026-10-04", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Zelin Wan", "Jin-Hee Cho", "Mu Zhu", "Ahmed H. Anwar", "Charles Kamhoua", "Munindar P. Singh"], "doi": "10.48550/arxiv.2101.02863", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed and the methodology or results have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha verificado la metodología o resultados de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "Defensive deception techniques have emerged as a promising proactive defense mechanism to mislead an attacker", "source_sha256": "37d19de82a5291c8f9a34fb291ba6253affcc70f4e84c760cf3aeedfadb070f5", "source_title": "Foureye: Defensive Deception based on Hypergame Theory Against Advanced Persistent Threats", "tags": [], "techniques": ["Adversary engagement", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2101-02863", "kind": "paper", "name": "Foureye: Defensive Deception based on Hypergame Theory Against Advanced Persistent Threats", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2101-02863", "source_url": "https://arxiv.org/abs/2101.02863", "status": "published", "summary_en": "According to the abstract, the authors propose a hypergame framework between an attacker and a defender where each can interpret the situation differently based on asymmetric beliefs, applied to advanced persistent threats (APT) across the cyber kill chain. The work evaluates through simulations how defensive deception strategies can manipulate attacker beliefs.", "summary_es": "Según el resumen, los autores proponen un marco de hiperjuego entre un atacante y un defensor en el que cada uno puede interpretar la situación de forma distinta según creencias asimétricas, aplicándolo a amenazas persistentes avanzadas (APT) a lo largo de la cadena de ataque. El trabajo evalúa mediante simulaciones cómo las estrategias de engaño defensivo pueden manipular las creencias del atacante.", "updated_at": "2026-10-04", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Mu Zhu", "Ahmed H. Anwar", "Zelin Wan", "Jin-Hee Cho", "Charles Kamhoua", "Munindar P. Singh"], "doi": "10.48550/arxiv.2101.10121", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed and no reported findings or effectiveness have been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha validado de forma independiente ningún hallazgo o eficacia reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "This survey paper focuses on defensive deception research centered on game theory and machine learning", "source_sha256": "af6ce656f0dd974aa714cd85df204cc17565001581eb48ec8466b9c7da65f002", "source_title": "Game-Theoretic and Machine Learning-based Approaches for Defensive Deception: A Survey", "tags": [], "techniques": ["Adversary engagement", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2101-10121", "kind": "paper", "name": "Game-Theoretic and Machine Learning-based Approaches for Defensive Deception: A Survey", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2101-10121", "source_url": "https://arxiv.org/abs/2101.10121", "status": "published", "summary_en": "This paper is a survey examining defensive deception approaches grounded in game theory and machine learning within cyber defense research. According to the authors, it analyzes key components, underlying principles, and tradeoffs of different approaches across various problem settings. The work compiles insights, lessons, and limitations from prior research and proposes future directions to address existing gaps.", "summary_es": "Este artículo es una encuesta que examina enfoques de engaño defensivo (defensive deception) basados en teoría de juegos y aprendizaje automático dentro de la investigación en ciberdefensa. Según los autores, se analizan los componentes clave, principios subyacentes y compensaciones de distintos enfoques en diversos escenarios de problemas. El trabajo recopila hallazgos, lecciones y limitaciones de investigaciones previas y propone direcciones futuras para abordar vacíos existentes.", "updated_at": "2026-10-04", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Daniel Reti", "Norman Becker"], "doi": "10.48550/arxiv.2104.03651", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "Cloud"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed and no reported findings or effectiveness have been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha validado de forma independiente ningún hallazgo o eficacia reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "introduces the concept of simulating container escapes as a deception technique", "source_sha256": "5caab783ea4151527acc90b45455f37236a7a3cfd414af2638dc058b0685decc", "source_title": "Escape the Fake: Introducing Simulated Container-Escapes for Honeypots", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2104-03651", "kind": "paper", "name": "Escape the Fake: Introducing Simulated Container-Escapes for Honeypots", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2104-03651", "source_url": "https://arxiv.org/abs/2104.03651", "status": "published", "summary_en": "This paper presents an approach to container-based honeypots that simulate container escapes as a deception technique in the context of cloud computing virtualization. According to the authors, it investigates the possibilities of container-based honeypots to imitate legitimate network targets and raise alerts on attacker interactions, allowing study of attacker techniques.", "summary_es": "Este artículo presenta un enfoque de honeypots basados en contenedores que simulan escapes de contenedor como técnica de engaño en el contexto de la virtualización en la nube. Según los autores, se investigan las posibilidades de los honeypots basados en contenedores para imitar objetivos legítimos en la red y generar alertas ante interacciones de atacantes, permitiendo estudiar sus técnicas.", "updated_at": "2026-10-04", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Valentino Crespi", "Wes Hardaker", "Sami Abu-El-Haija", "Aram Galstyan"], "doi": "10.48550/arxiv.2104.10232", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been read, and the technique's effectiveness has not been independently verified or replicated.", "limitations_es": "Esta entrada se basa únicamente en el título y el resumen disponibles públicamente; no se ha leído el texto completo ni se ha verificado o replicado de forma independiente la efectividad de la técnica.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "we investigate novel applications of Natural Language Processing (NLP) methods to detect and correlate botnet behaviors through the analysis of honeypot data", "source_sha256": "cf9ccbd2de297582db9d15b27ce65da69aec82631efba81d7ae454de8f328570", "source_title": "Identifying botnet IP address clusters using natural language processing techniques on honeypot command logs", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2104-10232", "kind": "paper", "name": "Identifying botnet IP address clusters using natural language processing techniques on honeypot command logs", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2104-10232", "source_url": "https://arxiv.org/abs/2104.10232", "status": "published", "summary_en": "The authors propose applying natural language processing techniques to shell commands captured via honeypots to detect and correlate botnet behaviors. The approach reduces command sequences to stochastic processes, then processed with machine learning to build classifiers and predictors that cluster botnet source IP addresses, even when attackers attempt to obfuscate intrusion attempts through rapid or random permutation techniques.", "summary_es": "Los autores proponen aplicar técnicas de procesamiento de lenguaje natural a comandos de shell capturados en honeypots para detectar y correlacionar comportamientos de botnets. El enfoque reduce las secuencias de comandos a procesos estocásticos, procesados luego con aprendizaje automático para construir clasificadores y predictores que permitan agrupar direcciones IP de origen de botnets, incluso cuando los atacantes intentan ofuscar sus intentos de intrusión mediante permutaciones rápidas o aleatorias.", "updated_at": "2026-10-04", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Ron Alford", "Andy Applebaum"], "doi": "10.48550/arxiv.2104.10575", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been read, and the technique's effectiveness has not been independently verified or replicated.", "limitations_es": "Esta entrada se basa únicamente en el título y el resumen disponibles públicamente; no se ha leído el texto completo ni se ha verificado o replicado de forma independiente la efectividad de la técnica.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "decoy generation can slow an automated agent's decision process", "source_sha256": "4257e66b663e3eab5766e94f5e2d723dbc9280ab8f97f67c1ca6fe022a1ab258", "source_title": "Towards Causal Models for Adversary Distractions", "tags": [], "techniques": ["Decoy", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2104-10575", "kind": "paper", "name": "Towards Causal Models for Adversary Distractions", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2104-10575", "source_url": "https://arxiv.org/abs/2104.10575", "status": "published", "summary_en": "This work examines how decoy generation can slow the decision process of automated agents in adversary emulation scenarios. The authors show, according to their study, that the degree of inhibition greatly depends on the types of decoy objects used, pointing to the need to explicitly evaluate decoy generation and placement strategies against fast-moving automated adversaries.", "summary_es": "Este trabajo examina cómo la generación de señuelos (decoys) puede ralentizar el proceso de decisión de agentes automatizados en escenarios de emulación de adversarios. Los autores muestran, según su estudio, que el grado de inhibición depende en gran medida del tipo de objetos señuelo utilizados, señalando la necesidad de evaluar explícitamente las estrategias de generación y colocación de señuelos frente a adversarios automatizados rápidos.", "updated_at": "2026-10-04", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Sevvandi Kandanaarachchi", "Hideya Ochiai", "Asha Rao"], "doi": "10.48550/arxiv.2105.02526", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed nor have the experimental results been independently replicated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni replicado los resultados experimentales.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "Honeyboost identifies most anomalous nodes before they access the honeypot aiding early detection and prediction", "source_sha256": "c4aeee455a08201bfd7103c83277bc4d8b0d1c87d94e4b3edb7f7a32a57e8e05", "source_title": "Honeyboost: Boosting honeypot performance with data fusion and anomaly detection", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2105-02526", "kind": "paper", "name": "Honeyboost: Boosting honeypot performance with data fusion and anomaly detection", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2105-02526", "source_url": "https://arxiv.org/abs/2105.02526", "status": "published", "summary_en": "The authors present Honeyboost, an unsupervised framework combining honeypots with network anomaly detection to identify suspicious nodes before they reach the honeypot. The approach fuses horizontal (per-node time series) and vertical (per-protocol) analysis, using extreme value theory to reduce false positives, as described in the abstract.", "summary_es": "Los autores presentan Honeyboost, un marco no supervisado que combina honeypots con detección de anomalías en red para identificar nodos sospechosos antes de que accedan al honeypot. El enfoque fusiona análisis horizontal (series temporales por nodo) y vertical (por espacio de protocolo), usando teoría de valores extremos para reducir falsos positivos, según se describe en el resumen.", "updated_at": "2026-10-04", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Rajat Gupta", "Madhu Viswanatham V.", "Manikandan K"], "doi": "10.48550/arxiv.2105.04773", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Application"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed nor has the effectiveness of the proposed system been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni validado de forma independiente la efectividad del sistema propuesto.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "low interaction, adaptive, and dynamic web application honeypot that imitates the vulnerabilities through HTTP events", "source_sha256": "76789ae09070cacd55a3fe1dceda0799cb8bbe461ec3af25a57601955f46e591", "source_title": "An Innovative Security Strategy using Reactive Web Application Honeypot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2105-04773", "kind": "paper", "name": "An Innovative Security Strategy using Reactive Web Application Honeypot", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2105-04773", "source_url": "https://arxiv.org/abs/2105.04773", "status": "published", "summary_en": "The authors propose a low-interaction, adaptive and dynamic web application honeypot that imitates vulnerabilities through HTTP events, using the SNARE and TANNER tools to generate the attack surface and analyze/classify incoming requests, as described in the abstract.", "summary_es": "Los autores proponen un honeypot de aplicación web de baja interacción, adaptativo y dinámico que imita vulnerabilidades mediante eventos HTTP, utilizando las herramientas SNARE y TANNER para generar la superficie de ataque y analizar/clasificar las solicitudes recibidas, según se describe en el resumen.", "updated_at": "2026-10-04", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Yunhan Huang", "Linan Huang", "Quanyan Zhu"], "doi": "10.48550/arxiv.2107.00783", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-pdf", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the effectiveness of the described mechanisms has not been independently verified.", "limitations_es": "Esta ficha se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha verificado independientemente la efectividad de los mecanismos descritos.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "We introduce three application domains of CRMs: moving target defense, defensive cyber deception, and assistive human security technologies.", "source_sha256": "dfe292dfb5cb15d00fcf1d07e131967e8e3adea5cc15f620902a9a6af7f308b8", "source_title": "Reinforcement Learning for Feedback-Enabled Cyber Resilience", "tags": [], "techniques": ["Moving target defense", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2107-00783", "kind": "paper", "name": "Reinforcement Learning for Feedback-Enabled Cyber Resilience", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2107-00783", "source_url": "https://arxiv.org/abs/2107.00783", "status": "published", "summary_en": "This work reviews the literature on using reinforcement learning (RL) as a feedback architecture for cyber-resilient mechanisms. The authors discuss resilience against posture-related, information-related, and human-related vulnerabilities, introducing three application domains: moving target defense, defensive cyber deception, and assistive human security technologies. They also examine vulnerabilities of RL itself to attacks on rewards, state observations, and action commands.", "summary_es": "Este trabajo revisa la literatura sobre el uso de aprendizaje por refuerzo (RL) como arquitectura de retroalimentación para mecanismos de resiliencia cibernética. Los autores analizan la resiliencia frente a vulnerabilidades de postura, información y humanas, e introducen tres dominios de aplicación: defensa de objetivo móvil, engaño cibernético defensivo y tecnologías asistivas de seguridad humana. También examinan vulnerabilidades del propio RL ante ataques a recompensas, observaciones de estado y comandos de acción.", "updated_at": "2026-10-04", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Yunian Pan", "Quanyan Zhu"], "doi": "10.48550/arxiv.2107.13632", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the theoretical or experimental analysis presented has not been replicated.", "limitations_es": "Esta ficha se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha replicado el análisis teórico o experimental presentado.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "We use a dynamic honeypot allocation game as a case study to illustrate and corroborate our results.", "source_sha256": "354be0fd697c62d74bfba302a7ef49e5057a0776cda41dd6473baa6154d8c901", "source_title": "Efficient Episodic Learning of Nonstationary and Unknown Zero-Sum Games Using Expert Game Ensembles", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2107-13632", "kind": "paper", "name": "Efficient Episodic Learning of Nonstationary and Unknown Zero-Sum Games Using Expert Game Ensembles", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2107-13632", "source_url": "https://arxiv.org/abs/2107.13632", "status": "published", "summary_en": "The authors propose OFULinMat, an episodic learning algorithm for repeated zero-sum games with unknown, time-varying payoff matrices, leveraging an ensemble of game models as prior information. The algorithm achieves a sublinear bound on saddle-point regret. As a case study, they use a dynamic honeypot allocation game to illustrate and corroborate their theoretical results.", "summary_es": "Los autores proponen OFULinMat, un algoritmo de aprendizaje episódico para juegos repetidos de suma cero con matrices de pago desconocidas y variables en el tiempo, usando un conjunto de modelos de juego como información previa. El algoritmo logra un límite sublineal de arrepentimiento de punto de silla. Como caso de estudio, utilizan un juego de asignación dinámica de honeypots para ilustrar y corroborar sus resultados teóricos.", "updated_at": "2026-10-04", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Palvi Aggarwal", "Yinuo Du", "Kuldeep Singh", "Cleotilde Gonzalez"], "doi": "10.48550/arxiv.2108.11037", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text was not reviewed and the reported effectiveness has not been independently validated.", "limitations_es": "Esta ficha se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "we study two-sided deception, where we manipulate the observed configuration of both honeypots and real machines", "source_sha256": "30a2a4905e1592d8cfc12ebb54cab4038cfae47975422a7dcb9832c8435d925a", "source_title": "Decoys in Cybersecurity: An Exploratory Study to Test the Effectiveness of 2-sided Deception", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2108-11037", "kind": "paper", "name": "Decoys in Cybersecurity: An Exploratory Study to Test the Effectiveness of 2-sided Deception", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2108-11037", "source_url": "https://arxiv.org/abs/2108.11037", "status": "published", "summary_en": "According to the authors, this work studies two-sided deception in cybersecurity by manipulating the observable configuration of both honeypots and real machines. Using an experiment with a 40-machine network (20 honeypots) and an experimental testbed, the authors compare three feature-concealment conditions against human attackers.", "summary_es": "Este trabajo, según sus autores, estudia la decepción de doble vía en ciberseguridad, manipulando tanto las configuraciones observables de honeypots como de máquinas reales. Mediante un experimento con una red de 40 máquinas (20 honeypots) y un testbed experimental, los autores comparan tres condiciones de ocultación de características frente a atacantes humanos.", "updated_at": "2026-10-04", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Farhan Sadique", "Shamik Sengupta"], "doi": "10.48550/arxiv.2108.12479", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "IoT"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text was not reviewed and the reported prediction accuracy has not been independently replicated.", "limitations_es": "Esta ficha se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha replicado de forma independiente la precisión de predicción reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "We have deployed several honeypots to simulate Linux shells and allowed attackers access to the shells.", "source_sha256": "fdcd5a8ddbb1251c27a799ad6c5c83dec496845be5ddfce39451ac6693b63423", "source_title": "Modeling and Analyzing Attacker Behavior in IoT Botnet using Temporal Convolution Network (TCN)", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2108-12479", "kind": "paper", "name": "Modeling and Analyzing Attacker Behavior in IoT Botnet using Temporal Convolution Network (TCN)", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2108-12479", "source_url": "https://arxiv.org/abs/2108.12479", "status": "published", "summary_en": "According to the authors, this study deploys honeypots simulating Linux shells to collect heterogeneous threat event data (network traffic, file downloads, SSH logins, and attacker commands) and models attacker behavior using a Temporal Convolutional Network (TCN), comparing it against LSTM and GRU.", "summary_es": "Según los autores, este estudio despliega honeypots que simulan shells Linux para recopilar eventos heterogéneos de amenazas (tráfico de red, descargas, inicios de sesión SSH y comandos) y modela el comportamiento de atacantes mediante una red neuronal convolucional temporal (TCN), comparándola con LSTM y GRU.", "updated_at": "2026-10-04", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Erich Walter", "Kimberly Ferguson-Walter", "Ahmad Ridley"], "doi": "10.48550/arxiv.2108.13980", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed and reported effectiveness has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se ha validado independientemente la efectividad reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "Deceptive elements, including honeypots and decoys, were incorporated into the Microsoft CyberBattleSim experimentation and research platform.", "source_sha256": "8d00b78c887e0785cda423ecd1dc7da9ee777bb02c3877ec3949d922bac7d95d", "source_title": "Incorporating Deception into CyberBattleSim for Autonomous Defense", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2108-13980", "kind": "paper", "name": "Incorporating Deception into CyberBattleSim for Autonomous Defense", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2108-13980", "source_url": "https://arxiv.org/abs/2108.13980", "status": "published", "summary_en": "This paper describes the incorporation of deceptive elements, including honeypots and decoys, into Microsoft's CyberBattleSim experimentation platform. According to the authors, they tested the defensive capabilities of these elements against reinforcement-learning-based attackers in a capture-the-flag environment, finding that attacker progress depended on the number and location of deceptive elements.", "summary_es": "Este trabajo describe la incorporación de elementos de engaño, incluyendo honeypots y señuelos, en la plataforma de experimentación CyberBattleSim de Microsoft. Según los autores, probaron las capacidades defensivas de estos elementos frente a atacantes basados en aprendizaje por refuerzo dentro de un entorno de captura de bandera, observando que el progreso del atacante dependía del número y ubicación de los elementos de engaño.", "updated_at": "2026-10-04", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Maxine Major", "Brian Souza", "Joseph DiVita", "Kimberly Ferguson-Walter"], "doi": "10.48550/arxiv.2109.00066", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": [], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed and reported effectiveness has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se ha validado independientemente la efectividad reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "exploring the potential to use Inverse Reinforcement Learning (IRL) to gain insight into attacker actions", "source_sha256": "5664c913ec1b1b5673d6669d6044d930e2ff33fe40064abdc1acfdcab035bff2", "source_title": "Informing Autonomous Deception Systems with Cyber Expert Performance Data", "tags": [], "techniques": ["Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2109-00066", "kind": "paper", "name": "Informing Autonomous Deception Systems with Cyber Expert Performance Data", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2109-00066", "source_url": "https://arxiv.org/abs/2109.00066", "status": "published", "summary_en": "This paper discusses methods for improving the realism and ecological validity of AI used for autonomous cyber defense, exploring the use of Inverse Reinforcement Learning (IRL) to understand attacker actions and utilities that cyber deception could thwart. According to the authors, the Tularosa study provides experimental data on real-world attacker techniques and tools that can inform autonomous defense systems.", "summary_es": "Este artículo discute métodos para mejorar el realismo y la validez ecológica de la inteligencia artificial usada en defensa cibernética autónoma, explorando el uso de Aprendizaje por Refuerzo Inverso (IRL) para comprender las acciones y utilidades de los atacantes que podrían ser frustradas mediante engaño cibernético. Según los autores, el estudio Tularosa proporciona datos experimentales de técnicas y herramientas reales utilizadas por atacantes, que pueden informar sistemas de defensa autónomos.", "updated_at": "2026-10-11", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Marcin Nawrocki", "Mattijs Jonker", "Thomas C. Schmidt", "Matthias Wählisch"], "doi": "10.48550/arxiv.2109.01104", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed and the methodology or findings have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y el resumen publicados; no se ha revisado el texto completo ni se ha verificado de forma independiente la metodología o los hallazgos.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "IXPs and honeypots observe mostly disjoint sets of attacks: 96% of IXP-inferred attacks were invisible to a sizable honeypot platform", "source_sha256": "99b9c1733b8bdd3e1df14e29dae3e4ee27bfac78f1b1ad31b93bccd538cb46c7", "source_title": "The Far Side of DNS Amplification: Tracing the DDoS Attack Ecosystem from the Internet Core", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2109-01104", "kind": "paper", "name": "The Far Side of DNS Amplification: Tracing the DDoS Attack Ecosystem from the Internet Core", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2109-01104", "source_url": "https://arxiv.org/abs/2109.01104", "status": "published", "summary_en": "This paper studies the DNS amplification attack ecosystem through a passive detection methodology at Internet exchange points (IXPs), combined with other measurement sources. According to the authors, IXPs and honeypots observe largely disjoint sets of attacks, and the study examines the effectiveness of observed attacks and the behavior of a dominant attacking entity.", "summary_es": "Este trabajo estudia el ecosistema de ataques de amplificación DNS mediante una metodología de detección pasiva en puntos de intercambio de Internet (IXPs), combinada con otras fuentes de medición. Según los autores, los IXPs y los honeypots observan en gran medida conjuntos distintos de ataques, y el estudio analiza la efectividad de los ataques observados y el comportamiento de una entidad atacante dominante.", "updated_at": "2026-10-04", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Febrian Setianto", "Erion Tsani", "Fatima Sadiq", "Georgios Domalis", "Dimitris Tsakalidis", "Panos Kostakos"], "doi": "10.48550/arxiv.2109.06595", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "Endpoint"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed and the methodology or findings have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y el resumen publicados; no se ha revisado el texto completo ni se ha verificado de forma independiente la metodología o los hallazgos.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "fine-tuned model achieves 89\\% inference accuracy in the new domain", "source_sha256": "65078443d9605a1ade2e2fa01ec605f434a46742d1a843ce52266319e8c7f916", "source_title": "GPT-2C: A GPT-2 parser for Cowrie honeypot logs", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2109-06595", "kind": "paper", "name": "GPT-2C: A GPT-2 parser for Cowrie honeypot logs", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2109-06595", "source_url": "https://arxiv.org/abs/2109.06595", "status": "published", "summary_en": "The authors present GPT-2C, a run-time system that leverages the pre-trained GPT-2 model to parse dynamic logs generated by a Cowrie SSH honeypot, addressing interoperability limitations with EDR and SIEM technologies. According to the abstract, the fine-tuned model achieves 89% inference accuracy in the new domain with acceptable execution latency.", "summary_es": "Los autores presentan GPT-2C, un sistema en tiempo de ejecución que utiliza el modelo preentrenado GPT-2 para analizar registros dinámicos generados por un honeypot SSH Cowrie, abordando limitaciones de interoperabilidad con tecnologías EDR y SIEM. Según el resumen, el modelo ajustado logra una precisión de inferencia del 89% en el nuevo dominio con una latencia de ejecución aceptable.", "updated_at": "2026-10-04", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Shreyas Srinivasa", "Jens Myrup Pedersen", "Emmanouil Vasilomanolakis"], "doi": "10.48550/arxiv.2109.10652", "doi_aliases": ["10.1145/3584976"], "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed and the effectiveness of the findings has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad de los hallazgos.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "we revisit the honeypot identification field, by providing a holistic framework", "source_sha256": "2c3d872d21f46b0c3f324052a0482ef63cd5629065b26ca180e74498af2c364b", "source_title": "Gotta catch 'em all: a Multistage Framework for honeypot fingerprinting", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2109-10652", "kind": "paper", "name": "Gotta catch 'em all: a Multistage Framework for honeypot fingerprinting", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2109-10652", "source_url": "https://arxiv.org/abs/2109.10652", "status": "published", "summary_en": "This paper, according to its authors, revisits the honeypot fingerprinting field by proposing a multistage framework combining existing and novel techniques. Through large-scale IPv4 address scans, the authors report identifying thousands of honeypot instances as well as non-honeypot vulnerable systems, and discuss countermeasures against fingerprinting.", "summary_es": "Este trabajo, según sus autores, revisa el campo de identificación de honeypots proponiendo un marco multietapa que combina técnicas existentes y nuevas para fingerprinting. Mediante escaneos a gran escala de direcciones IPv4, los autores afirman haber identificado miles de instancias de honeypots y además sistemas vulnerables no honeypot, discutiendo también posibles contramedidas.", "updated_at": "2026-10-04", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Sakshyam Panda", "Stefan Rass", "Sotiris Moschoyiannis", "Kaitai Liang", "George Loukas", "Emmanouil Panaousis"], "doi": "10.48550/arxiv.2111.02364", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["IoT", "Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed and the effectiveness of the proposed framework has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad del marco propuesto.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "HoneyCar, a novel decision support framework for honeypot deception in IoV", "source_sha256": "ac56272be2d9647977aa65e12c31b23ac929fc112698466afd09d6cd773f963f", "source_title": "HoneyCar: A Framework to Configure Honeypot Vulnerabilities on the Internet of Vehicles", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2111-02364", "kind": "paper", "name": "HoneyCar: A Framework to Configure Honeypot Vulnerabilities on the Internet of Vehicles", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2111-02364", "source_url": "https://arxiv.org/abs/2111.02364", "status": "published", "summary_en": "According to the authors, HoneyCar is a decision support framework for configuring honeypots in the Internet of Vehicles, based on known vulnerabilities from the NVD/CVE database. The approach models adversarial interaction as a repeated imperfect-information zero-sum game, aiming to compute optimal honeypot configuration strategies for threat intelligence collection.", "summary_es": "Según los autores, HoneyCar es un marco de apoyo a la decisión para configurar honeypots en el Internet de los Vehículos, basado en vulnerabilidades conocidas de la base de datos NVD/CVE. El enfoque modela la interacción adversarial como un juego de suma cero de información imperfecta repetido, buscando estrategias óptimas de configuración de honeypots para recopilar inteligencia de amenazas.", "updated_at": "2026-10-04", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Daniel Fraunholz", "Marc Zimmermann", "Hans D. Schotten"], "doi": "10.48550/arxiv.2111.03884", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the effectiveness of the proposed method has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad del método propuesto.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "a method for a dynamic honeypot configuration, deployment and maintenance strategy based on machine learning techniques", "source_sha256": "62fa1e7035acfc53294d00168caddb71d2d57b1d6e4902a43c7611724aec73c9", "source_title": "An Adaptive Honeypot Configuration, Deployment and Maintenance Strategy", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2111-03884", "kind": "paper", "name": "An Adaptive Honeypot Configuration, Deployment and Maintenance Strategy", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2111-03884", "source_url": "https://arxiv.org/abs/2111.03884", "status": "published", "summary_en": "This paper presents, according to its authors, a machine learning-based method for dynamic configuration, deployment and maintenance of honeypots in networks. The approach identifies and clusters machines and devices to intelligently deploy honeypots, reducing the need for manual configuration.", "summary_es": "Este trabajo presenta, según sus autores, un método basado en técnicas de aprendizaje automático para la configuración, despliegue y mantenimiento dinámico de honeypots en redes. El enfoque identifica y agrupa máquinas y dispositivos en la red para desplegar honeypots de forma inteligente, reduciendo la necesidad de configuración manual.", "updated_at": "2026-10-04", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Alexandre Dey", "Benjamin Costé", "Éric Totel", "Adrien Bécue"], "doi": "10.48550/arxiv.2111.11785", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "Endpoint"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the effectiveness of the proposed method has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad del método propuesto.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "improving the credibility of attacker analysis platforms (e.g., honeynets)", "source_sha256": "19c7cd6d5be4cd141229dd9a07d9702e77d2ae2bdeb9a15cc4cba0e35a9b6018", "source_title": "Realistic simulation of users for IT systems in cyber ranges", "tags": [], "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2111-11785", "kind": "paper", "name": "Realistic simulation of users for IT systems in cyber ranges", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2111-11785", "source_url": "https://arxiv.org/abs/2111.11785", "status": "published", "summary_en": "According to the authors, this paper proposes an approach to generate realistic user activity on IT systems, combining deterministic and deep learning-based methods through an external agent instrumented on each machine. The aim is to improve the credibility of attacker analysis platforms, such as honeynets, and facilitate the creation of coherent scenarios.", "summary_es": "Según los autores, este artículo propone un enfoque para generar actividad de usuario realista en sistemas de TI, combinando métodos deterministas y de aprendizaje profundo mediante un agente externo instrumentado en cada máquina. El objetivo es mejorar la credibilidad de plataformas de análisis de atacantes, como los honeynets, y facilitar la creación de escenarios coherentes.", "updated_at": "2026-10-04", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Armin Ziaie Tabari", "Xinming Ou", "Anoop Singhal"], "doi": "10.48550/arxiv.2112.10974", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["IoT"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed and the methodology or results have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha verificado de forma independiente la metodología o los resultados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "a new approach to creating a multi-phased, multi-faceted honeypot ecosystem", "source_sha256": "b7cb4776f451a43be884fabdbf37810c445e83694e203c54e764d6e9bf381d91", "source_title": "What are Attackers after on IoT Devices? An approach based on a multi-phased multi-faceted IoT honeypot ecosystem and data clustering", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2112-10974", "kind": "paper", "name": "What are Attackers after on IoT Devices? An approach based on a multi-phased multi-faceted IoT honeypot ecosystem and data clustering", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2112-10974", "source_url": "https://arxiv.org/abs/2112.10974", "status": "published", "summary_en": "The authors present a multi-phased IoT honeypot ecosystem that gradually increases interaction sophistication with adversaries, including a low-interaction camera honeypot. According to the abstract, they applied data analytics to cluster observed attack activity over three years to identify attacker goals and patterns.", "summary_es": "Los autores presentan un ecosistema de honeypots de IoT de múltiples fases que incrementa gradualmente la sofisticación de la interacción con adversarios, incluyendo un honeypot de baja interacción para cámaras. Según el resumen, usaron análisis de datos para agrupar comportamientos de ataque observados durante más de tres años con el fin de identificar objetivos y patrones de los atacantes.", "updated_at": "2026-10-04", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Navod Neranjan Thilakrathne", "Rohan Samarasinghe", "Madhuka Priyashan"], "doi": "10.48550/arxiv.2201.02506", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["IoT", "Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed and the methodology or results have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha verificado de forma independiente la metodología o los resultados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "it acts as a Honeypot device where we can log and retrieve all login attempt requests received", "source_sha256": "791c8b10090088bb4a240b40dc1f5997fe73547263b42380af531be337059945", "source_title": "Evaluation of Cyber Attacks Targeting Internet Facing IoT : An Experimental Evaluation", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2201-02506", "kind": "paper", "name": "Evaluation of Cyber Attacks Targeting Internet Facing IoT : An Experimental Evaluation", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2201-02506", "source_url": "https://arxiv.org/abs/2201.02506", "status": "published", "summary_en": "According to the abstract, the authors exposed an SSH service on an internet-connected Raspberry Pi device for over six days to act as a honeypot, logging received login attempts. The study provides an analysis of request origins and intruder focus areas.", "summary_es": "Según el resumen, los autores exponen un servicio SSH en un dispositivo Raspberry Pi conectado a Internet durante más de seis días para que funcione como honeypot, registrando los intentos de inicio de sesión recibidos. El estudio ofrece un análisis del origen de las solicitudes y las áreas de interés de los intrusos.", "updated_at": "2026-10-04", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Roelien C. Timmer", "David Liebowitz", "Surya Nepal", "Salil Kanhere"], "doi": "10.48550/arxiv.2203.07580", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Endpoint"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text was not reviewed and the effectiveness of the metric was not independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad de la métrica.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "TSM is the first measure to use NLP techniques to quantify the enticement of honeyfile content", "source_sha256": "a12166011a758e29a4f67d038eab862ae8ed3b6ffa62584fd50db546b9b5591a", "source_title": "TSM: Measuring the Enticement of Honeyfiles with Natural Language Processing", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2203-07580", "kind": "paper", "name": "TSM: Measuring the Enticement of Honeyfiles with Natural Language Processing", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2203-07580", "source_url": "https://arxiv.org/abs/2203.07580", "status": "published", "summary_en": "This paper introduces TSM (Topic Semantic Matching), a metric based on topic modelling and semantic matching in embedding spaces to measure the enticement of honeyfiles relative to local content. According to the authors, it is the first measure using NLP techniques to quantify this enticement robustly against paraphrasing, supported by a honeyfile corpus built with various NLP methods.", "summary_es": "Este trabajo presenta TSM (Topic Semantic Matching), una métrica basada en modelado de temas y comparación semántica en espacios de embeddings para medir el atractivo (enticement) de honeyfiles respecto al contenido local. Según los autores, es la primera medida que usa técnicas de NLP para cuantificar este atractivo de forma robusta frente a paráfrasis, apoyada en un corpus de honeyfiles creado con distintos métodos de NLP.", "updated_at": "2026-10-04", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Yuhui Zhu", "Zhenxiang Chen", "Qiben Yan", "Shanshan Wang", "Enlong Li", "Lizhi Peng", "Chuan Zhao"], "doi": "10.48550/arxiv.2206.00385", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text was not reviewed and the findings were not independently replicated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se han replicado de forma independiente los hallazgos.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "We leverage high interaction honeypots to collect request logs and define eight families of bot loaders", "source_sha256": "30f1ea1ecb10c29fee7f37ccb1f8171b65e135ef00394553ced52a4904a5534f", "source_title": "Mining Function Homology of Bot Loaders from Honeypot Logs", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2206-00385", "kind": "paper", "name": "Mining Function Homology of Bot Loaders from Honeypot Logs", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2206-00385", "source_url": "https://arxiv.org/abs/2206.00385", "status": "published", "summary_en": "The authors propose a text-based method to investigate and analyze bot loaders using high-interaction honeypots. They collect request logs, define eight loader families via agglomerative clustering, and analyze functional homology using sequence alignment techniques, revealing, according to the study, evolutionary relationships among botnet infrastructures such as Mirai.", "summary_es": "Los autores proponen un método basado en texto para investigar y analizar los loaders de bots (botnets) utilizando honeypots de alta interacción. Recopilan registros de solicitudes, definen ocho familias de loaders mediante agrupamiento jerárquico y analizan su homología funcional usando técnicas de alineamiento de secuencias, revelando según el estudio relaciones evolutivas entre infraestructuras de botnets como Mirai.", "updated_at": "2026-10-04", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Zain Shamsi", "Daniel Zhang", "Daehyun Kyoung", "Alex Liu"], "doi": "10.48550/arxiv.2206.13614", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the clustering results have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se han verificado de forma independiente los resultados del clustering.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "Network honeypots are often used by information security teams to measure the threat landscape", "source_sha256": "6d8f254d14053e9728776888e6211487c716565cf58036a012da1fbac7364e2c", "source_title": "Measuring and Clustering Network Attackers using Medium-Interaction Honeypots", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2206-13614", "kind": "paper", "name": "Measuring and Clustering Network Attackers using Medium-Interaction Honeypots", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2206-13614", "source_url": "https://arxiv.org/abs/2206.13614", "status": "published", "summary_en": "This paper describes the deployment of medium-interaction honeypots across five different protocols on the public Internet to study the intent and sophistication of observed attacks. The authors propose a clustering approach that identifies correlations in attacker behavior to detect IP addresses likely controlled by a single operator, highlighting the usefulness of these honeypots for data collection.", "summary_es": "Este artículo describe el despliegue de honeypots de interacción media en cinco protocolos distintos en Internet pública para estudiar la intención y sofisticación de los ataques observados. Los autores proponen un enfoque de clustering que identifica correlaciones en el comportamiento de los atacantes para detectar direcciones IP probablemente controladas por un mismo operador, destacando la utilidad de estos honeypots para la recolección de datos.", "updated_at": "2026-10-04", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Wong Yan Shen", "Selvakumar Manickam", "Mahmood A. Al-Shareeda"], "doi": "10.48550/arxiv.2207.12936", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-pdf", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the coverage of the review has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo del artículo ni se ha validado de forma independiente la cobertura de la revisión.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "A crawler is an active mechanism while sensor and Honeypot are the passive mechanisms.", "source_sha256": "3b17ec7aa86f2044adecd7af4c6245d9376e7f32aaddac420d8c5529cf1f4b79", "source_title": "Review of Advanced Monitoring Mechanisms in Peer-to-Peer (P2P) Botnets", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2207-12936", "kind": "paper", "name": "Review of Advanced Monitoring Mechanisms in Peer-to-Peer (P2P) Botnets", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2207-12936", "source_url": "https://arxiv.org/abs/2207.12936", "status": "published", "summary_en": "This paper reviews existing tools for monitoring P2P botnets, categorizing mechanisms as active (crawlers) and passive (sensors and honeypots). According to the authors, the purpose is to study ways to monitor a botnet and how these monitoring mechanisms work, presenting prior work on each approach.", "summary_es": "Este artículo revisa herramientas existentes para monitorizar botnets P2P, categorizando los mecanismos en activos (crawlers) y pasivos (sensores y honeypots). Según los autores, el objetivo es estudiar las formas de monitorizar un botnet y cómo funcionan estos mecanismos, presentando trabajos previos sobre cada enfoque.", "updated_at": "2026-10-04", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Yuntao Wang", "Zhou Su", "Abderrahim Benslimane", "Qichao Xu", "Minghui Dai", "Ruidong Li"], "doi": "10.48550/arxiv.2209.13815", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "IoT"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the title and abstract; the full text has not been reviewed and the simulation results described by the authors have not been independently validated.", "limitations_es": "Esta ficha se basa únicamente en el título y resumen; no se ha revisado el texto completo ni se han validado de forma independiente los resultados de las simulaciones descritas por los autores.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "Low/medium-interaction honeypot is regarded as a promising lightweight defense to actively protect mobile Internet of things", "source_sha256": "f6d4488d05570b495d586857cdb47b65a1d59f11e1de4591d342bed266eed2bd", "source_title": "A Learning-based Honeypot Game for Collaborative Defense in UAV Networks", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2209-13815", "kind": "paper", "name": "A Learning-based Honeypot Game for Collaborative Defense in UAV Networks", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2209-13815", "source_url": "https://arxiv.org/abs/2209.13815", "status": "published", "summary_en": "The authors propose a game-based collaborative defense approach for UAV networks, using low/medium-interaction honeypots and contract-based incentive mechanisms combined with reinforcement learning to encourage UAVs to share captured attack data.", "summary_es": "Los autores proponen un enfoque de defensa colaborativa basado en teoría de juegos para redes de drones (UAV), empleando honeypots de baja/media interacción y mecanismos de incentivo basados en contratos y aprendizaje por refuerzo para motivar el intercambio de datos de ataques capturados entre drones.", "updated_at": "2026-10-04", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Lening Li", "Haoxiang Ma", "Shuo Han", "Jie Fu"], "doi": "10.48550/arxiv.2210.07385", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-pdf", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed and the validity of the results has not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se ha verificado de forma independiente la validez de los resultados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "we investigate how to allocate a bounded number of sensors in each configuration to optimize the attack detection rate", "source_sha256": "84cb0ab3f0b0d2829f7f12a0a283c23a35336403ade715781ce088eba77e1c47", "source_title": "Synthesis of Proactive Sensor Placement In Probabilistic Attack Graphs", "tags": [], "techniques": ["Decoy", "Moving target defense"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2210-07385", "kind": "paper", "name": "Synthesis of Proactive Sensor Placement In Probabilistic Attack Graphs", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2210-07385", "source_url": "https://arxiv.org/abs/2210.07385", "status": "published", "summary_en": "This paper studies the joint deployment of moving target defense (MTD) and deception against multi-stage cyberattacks. The authors propose a two-step optimization approach to allocate intrusion detectors (observable by the attacker) and stealthy sensors (unobservable), aiming to optimize attack detection rate. They illustrate the method's effectiveness through a cyber defense example.", "summary_es": "Este artículo estudia el despliegue conjunto de defensa de objetivo móvil (MTD) y técnicas de engaño frente a ataques cibernéticos de múltiples etapas. Los autores proponen un enfoque de optimización en dos pasos para asignar sensores de detección de intrusión (observables por el atacante) y sensores sigilosos (no observables), con el fin de optimizar la tasa de detección de ataques. Ilustran la efectividad del método mediante un ejemplo de defensa cibernética.", "updated_at": "2026-10-04", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Siddhant Bhambri", "Purv Chauhan", "Frederico Araujo", "Adam Doupé", "Subbarao Kambhampati"], "doi": "10.48550/arxiv.2210.15011", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Application"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed and the validity of the results has not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se ha verificado de forma independiente la validez de los resultados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "application-level deceptions are an optimal mitigation strategy against targeted attacks", "source_sha256": "204cdad7a1dc867f15579fd85f72f71d9ef3c7b262072bc2eae6b04054ba2707", "source_title": "Using Deception in Markov Game to Understand Adversarial Behaviors through a Capture-The-Flag Environment", "tags": [], "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2210-15011", "kind": "paper", "name": "Using Deception in Markov Game to Understand Adversarial Behaviors through a Capture-The-Flag Environment", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2210-15011", "source_url": "https://arxiv.org/abs/2210.15011", "status": "published", "summary_en": "This work models attacker-defender engagements as Markov Games to understand human adversarial behaviors and optimize defensive strategy. The authors validate their approach using a Capture-The-Flag (CTF) setup and user studies across varying skill levels. According to the authors, application-level deceptions are an optimal mitigation strategy against targeted attacks, outperforming classic defensive maneuvers, and they present an analysis of attacker behavior when trapped in an embedded honeypot environment.", "summary_es": "Este trabajo modela los enfrentamientos entre atacante y defensor como juegos de Markov para comprender comportamientos adversarios humanos y optimizar la estrategia defensiva. Los autores validan su enfoque mediante un entorno Capture-The-Flag (CTF) y estudios con usuarios de distintos niveles de habilidad. Según los autores, los engaños a nivel de aplicación resultan una estrategia de mitigación óptima frente a ataques dirigidos, superando a maniobras defensivas clásicas, y presentan un análisis del comportamiento atacante al quedar atrapado en un entorno honeypot embebido.", "updated_at": "2026-10-04", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Suhyeon Lee", "Kwangsoo Cho", "Seungjoo Kim"], "doi": "10.48550/arxiv.2210.17399", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text was not reviewed and the reported effectiveness has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "Do You Really Need to Disguise Normal Servers as Honeypots?", "source_sha256": "7b8d489e26451c979a0fc1ae94a7a8dded0f1f8802fd43d4aaac10953af10607", "source_title": "Do You Really Need to Disguise Normal Servers as Honeypots?", "tags": [], "techniques": ["Honeypot", "Decoy", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2210-17399", "kind": "paper", "name": "Do You Really Need to Disguise Normal Servers as Honeypots?", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2210-17399", "source_url": "https://arxiv.org/abs/2210.17399", "status": "published", "summary_en": "According to the authors' abstract, this paper uses attack-defense games to examine whether disguising normal servers as honeypots is beneficial. It compares three scenarios with varying levels of deception techniques and concludes, per the authors, that disguising real servers does not always yield better defender rewards and may increase the cost of maintaining normal nodes.", "summary_es": "Este trabajo, según el resumen de los autores, analiza mediante juegos de ataque-defensa la conveniencia de disfrazar servidores normales como honeypots. Compara tres escenarios con distintos niveles de técnicas de engaño y concluye, según los autores, que disfrazar servidores reales no siempre mejora la recompensa del defensor y puede incrementar el costo de mantener nodos normales.", "updated_at": "2026-10-04", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Yuntao Wang", "Zhou Su", "Abderrahim Benslimane", "Qichao Xu", "Minghui Dai", "Ruidong Li"], "doi": "10.48550/arxiv.2211.01772", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "IoT"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text was not reviewed and the simulation-based effectiveness claims have not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad reportada en las simulaciones.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "Collaborative Honeypot Defense in UAV Networks: A Learning-Based Game Approach", "source_sha256": "845949727be4c839e4684c56cc32a85a30731eb264a8021286e93081881229a4", "source_title": "Collaborative Honeypot Defense in UAV Networks: A Learning-Based Game Approach", "tags": [], "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2211-01772", "kind": "paper", "name": "Collaborative Honeypot Defense in UAV Networks: A Learning-Based Game Approach", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2211-01772", "source_url": "https://arxiv.org/abs/2211.01772", "status": "published", "summary_en": "According to the authors' abstract, this paper proposes a game-theoretic and reinforcement learning approach to incentivize collaboration among UAVs in low/medium interaction honeypot defense, addressing optimal contract design under partial and complete information asymmetry. The authors state that simulations show improved cooperation and defensive effectiveness compared to conventional schemes.", "summary_es": "Según el resumen de los autores, este artículo propone un enfoque de teoría de juegos y aprendizaje por refuerzo para incentivar la colaboración entre drones (UAV) en la defensa mediante honeypots de baja/media interacción, abordando el diseño de contratos óptimos bajo asimetría de información parcial y completa. Los autores afirman que simulaciones muestran mejoras en la cooperación y efectividad defensiva frente a esquemas convencionales.", "updated_at": "2026-10-04", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Daniel Zielinski", "Hisham A. Kholidy"], "doi": "10.48550/arxiv.2301.00045", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed and the system's effectiveness has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad del sistema.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "deploying a cyber honeypot system to learn how cyber defenders can use a honeypot system as a deception mechanism to gather intelligence", "source_sha256": "0d4fa65d5bdfa95b8e28a603dbad6132f19fc3dedc5429cb7a942b8e14bbada5", "source_title": "An Analysis of Honeypots and their Impact as a Cyber Deception Tactic", "tags": [], "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2301-00045", "kind": "paper", "name": "An Analysis of Honeypots and their Impact as a Cyber Deception Tactic", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2301-00045", "source_url": "https://arxiv.org/abs/2301.00045", "status": "published", "summary_en": "This paper explores deploying a honeypot system as a deception mechanism to gather intelligence about attackers. According to the authors, the system can capture information such as the attacker's autonomous system, penetration techniques, attack types, executed commands, and downloaded malware. The authors demonstrate a reproducible experiment using open-source tools to implement such a system.", "summary_es": "Este artículo explora el despliegue de un sistema de honeypot como mecanismo de engaño para recopilar inteligencia sobre atacantes. Según los autores, el sistema permite obtener información como el sistema autónomo de la IP del atacante, las técnicas de penetración empleadas, los tipos de ataques, los comandos ejecutados y el malware descargado. Los autores demuestran un experimento reproducible usando herramientas de código abierto para implementar dicho sistema.", "updated_at": "2026-10-04", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Stefan Machmeier"], "doi": "10.48550/arxiv.2301.00710", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Cloud", "Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed and the system's effectiveness has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad del sistema.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "A honeypot helps to collect information about an attacker by pretending to be a vulnerable target", "source_sha256": "f7eb314a24c89ff4783ee857b5c4969f97fb2c0488bf6b86961c3b2a3b2c3506", "source_title": "Honeypot Implementation in a Cloud Environment", "tags": [], "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2301-00710", "kind": "paper", "name": "Honeypot Implementation in a Cloud Environment", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2301-00710", "source_url": "https://arxiv.org/abs/2301.00710", "status": "published", "summary_en": "This thesis presents a honeypot solution to investigate malicious activity in the heiCLOUD environment, showing according to the author a significant increase in attacks. A new concept is proposed to detect firewall leaks in restricted network zones, along with a method for detecting honeypots at the transport level from an attacker's perspective. A customized OpenSSH server is also presented as an intermediary instance to mitigate such efforts.", "summary_es": "Esta tesis presenta una solución de honeypot para investigar actividades maliciosas en el entorno heiCLOUD, mostrando según el autor un aumento significativo de ataques. Se propone un nuevo concepto para detectar fugas en el firewall en zonas de red restringidas, así como un método para la detección de honeypots a nivel de transporte desde la perspectiva del atacante. Además, se presenta un servidor OpenSSH personalizado como instancia intermediaria para mitigar estos esfuerzos.", "updated_at": "2026-10-04", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Forrest McKee", "David Noever"], "doi": "10.48550/arxiv.2301.03771", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "Endpoint"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed and the approach's effectiveness has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad del enfoque.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "Question-and-answer agents like ChatGPT offer a novel tool for use as a potential honeypot interface in cyber security.", "source_sha256": "d6ac64e4384acda7dd1f84c38bf0ab4896f620e42cb619716b8ece24f86e0050", "source_title": "Chatbots in a Honeypot World", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2301-03771", "kind": "paper", "name": "Chatbots in a Honeypot World", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2301-03771", "source_url": "https://arxiv.org/abs/2301.03771", "status": "published", "summary_en": "This paper explores using ChatGPT-style conversational agents as a dynamic honeypot interface, imitating Linux, Mac, and Windows terminal commands and tools like TeamViewer, nmap, and ping. The authors present ten feasibility tasks intended for defensive teams to simulate honeypot interfaces with minimal risk, aiming to delay or understand attacker tactics, techniques, and procedures.", "summary_es": "Este trabajo explora el uso de agentes conversacionales tipo ChatGPT como interfaz dinámica de honeypot, imitando comandos de terminal de Linux, Mac y Windows y herramientas como TeamViewer, nmap y ping. Los autores presentan diez tareas de viabilidad diseñadas para que equipos defensivos simulen interfaces de honeypot con riesgos mínimos, buscando retrasar o entender las tácticas, técnicas y procedimientos de atacantes.", "updated_at": "2026-10-04", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Quanyan Zhu"], "doi": "10.48550/arxiv.2302.13362", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed and the approach's effectiveness has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad del enfoque.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "This work focuses on the ethics of using defensive deception in cyberspace, proposing a doctrine of cyber effect", "source_sha256": "be06988b898b58048404fb8f5d0960d6475196455bf75e358a864490d3d139ad", "source_title": "The Doctrine of Cyber Effect: An Ethics Framework for Defensive Cyber Deception", "tags": [], "techniques": ["Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2302-13362", "kind": "paper", "name": "The Doctrine of Cyber Effect: An Ethics Framework for Defensive Cyber Deception", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2302-13362", "source_url": "https://arxiv.org/abs/2302.13362", "status": "published", "summary_en": "The paper proposes an ethics framework, termed the doctrine of cyber effect, to guide the design of defensive cyber deception. It incorporates five ethical principles (goodwill, deontology, no-harm, transparency, and fairness) and presents the game of ethical duplicity as a reasoning framework applicable to designing defensive cyber deception techniques.", "summary_es": "El artículo propone un marco ético, denominado doctrina del efecto cibernético, para guiar el diseño de engaño defensivo en el ciberespacio. Incorpora cinco principios éticos (buena voluntad, deontología, no causar daño, transparencia y equidad) y presenta el juego de la duplicidad ética como marco de razonamiento aplicable al diseño de técnicas de engaño cibernético defensivo.", "updated_at": "2026-10-04", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Brittany Cates", "Anagha Kulkarni", "Sarath Sreedharan"], "doi": "10.48550/arxiv.2303.00822", "doi_aliases": ["10.1609/icaps.v33i1.27182"], "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the reported empirical results have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se han verificado de forma independiente los resultados empíricos reportados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "Such a defense strategy is highly useful in real world systems like honeypots or honeynets", "source_sha256": "544320a3243749a15b8ec079d557711a26cbbc15d99d763302f93c6f17f9d7ec", "source_title": "Planning for Attacker Entrapment in Adversarial Settings", "tags": [], "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2303-00822", "kind": "paper", "name": "Planning for Attacker Entrapment in Adversarial Settings", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2303-00822", "source_url": "https://arxiv.org/abs/2303.00822", "status": "published", "summary_en": "The authors propose a planning framework to generate a defense strategy that covertly guides an attacker toward a trap state, formulating the problem as an infinite-horizon discounted MDP whose optimal policy serves as the defender's strategy. According to the abstract, this formulation is applicable to systems such as honeypots or honeynets, and the authors report empirically evaluating the merits of their approach.", "summary_es": "Los autores proponen un marco de planificación para generar una estrategia defensiva que guíe de forma encubierta a un atacante hacia un estado trampa, formulando el problema como un MDP con descuento a horizonte infinito, cuya política óptima constituye la estrategia del defensor. Según el resumen, esta formulación resulta aplicable a sistemas como honeypots o honeynets, y los autores informan haber evaluado empíricamente los méritos de su propuesta.", "updated_at": "2026-10-04", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Volviane Saphir Mfogo", "Alain Zemkoho", "Laurent Njilla", "Marcellin Nkenlifack", "Charles Kamhoua"], "doi": "10.48550/arxiv.2303.12367", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["IoT"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the reported effectiveness of the system has not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha verificado de forma independiente la efectividad reportada del sistema.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "we propose a honeypot for IoT devices that uses machine learning techniques to learn and interact with attackers automatically", "source_sha256": "fc8af5a1e4b113263fbe9f2fd32e6a4a75062dd2d023f1f6c9d5f91fb9f19615", "source_title": "AIIPot: Adaptive Intelligent-Interaction Honeypot for IoT Devices", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2303-12367", "kind": "paper", "name": "AIIPot: Adaptive Intelligent-Interaction Honeypot for IoT Devices", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2303-12367", "source_url": "https://arxiv.org/abs/2303.12367", "status": "published", "summary_en": "The authors propose a honeypot for IoT devices that uses machine learning techniques to automatically learn and interact with attackers, aiming to overcome the limitations of manually crafting low- and high-interaction honeypots given device heterogeneity. According to the abstract, evaluation of the proposed model indicates improvements in session length with attackers and in capturing more attacks on the IoT network.", "summary_es": "Los autores proponen un honeypot para dispositivos IoT que emplea técnicas de aprendizaje automático para aprender e interactuar automáticamente con atacantes, buscando superar las limitaciones de crear manualmente honeypots de baja y alta interacción dada la heterogeneidad de estos dispositivos. Según el resumen, la evaluación del modelo propuesto indica mejoras en la duración de las sesiones con atacantes y en la captura de ataques en la red IoT.", "updated_at": "2026-10-04", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Enrico Cambiaso", "Luca Caviglione"], "doi": "10.48550/arxiv.2303.13521", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Application"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the title and abstract; the full text was not reviewed and the described effectiveness is not independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen; no se ha revisado el texto completo ni se valida la efectividad descrita.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "ChatGPT is able to decoy scammers", "source_sha256": "cf729cb3f500922fa24a897ce5ba2bab939571444409236c7894ce61b70e0279", "source_title": "Scamming the Scammers: Using ChatGPT to Reply Mails for Wasting Time and Resources", "tags": [], "techniques": ["Decoy", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2303-13521", "kind": "paper", "name": "Scamming the Scammers: Using ChatGPT to Reply Mails for Wasting Time and Resources", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2303-13521", "source_url": "https://arxiv.org/abs/2303.13521", "status": "published", "summary_en": "The authors investigate using ChatGPT to automatically reply to scam emails in order to waste scammers' time and resources through pointless communications. According to the abstract, preliminary results show ChatGPT can decoy scammers.", "summary_es": "Los autores investigan el uso de ChatGPT para generar respuestas automáticas a correos de estafadores, con el objetivo de hacerles perder tiempo y recursos mediante comunicaciones pointless. Según el resumen, resultados preliminares muestran que ChatGPT puede engañar (decoy) a los estafadores.", "updated_at": "2026-10-04", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Joseph Bao", "Murat Kantarcioglu", "Yevgeniy Vorobeychik", "Charles Kamhoua"], "doi": "10.48550/arxiv.2305.00925", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["IoT", "Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the title and abstract; the full text was not reviewed and the reported effectiveness is not independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen; no se ha revisado el texto completo ni se valida de forma independiente la efectividad reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "significantly outperforms state of the art sequence and packet generators", "source_sha256": "d8e56777f3b7253a0750683eb5bf9f35822fffdb1550dba95c8d23cf2142b8a2", "source_title": "IoTFlowGenerator: Crafting Synthetic IoT Device Traffic Flows for Cyber Deception", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2305-00925", "kind": "paper", "name": "IoTFlowGenerator: Crafting Synthetic IoT Device Traffic Flows for Cyber Deception", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2305-00925", "source_url": "https://arxiv.org/abs/2305.00925", "status": "published", "summary_en": "The authors propose a deep learning based method to generate synthetic IoT device traffic flows mimicking real traffic, aiming to improve IoT honeypots against attacker detection. According to the abstract, the generator outperforms prior approaches in remaining indistinguishable from real traffic.", "summary_es": "Los autores proponen un método basado en aprendizaje profundo para generar flujos de tráfico sintético de dispositivos IoT que imiten tráfico real, con el fin de mejorar los honeypots IoT frente a la detección por atacantes. Según el resumen, el generador supera a enfoques previos en indistinguibilidad del tráfico real.", "updated_at": "2026-10-04", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Veronica Valeros", "Maria Rigaki", "Sebastian Garcia"], "doi": "10.48550/arxiv.2305.01346", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed and the methodology or results have not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha validado de forma independiente la metodología o los resultados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "Results show that the location of honeypots helps identify attack patterns and build profiles for the attackers.", "source_sha256": "80c0b1e65be415f407196a6971a2be97649aaab7d112a428b40206bcbcdb3717", "source_title": "Attacker Profiling Through Analysis of Attack Patterns in Geographically Distributed Honeypots", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2305-01346", "kind": "paper", "name": "Attacker Profiling Through Analysis of Attack Patterns in Geographically Distributed Honeypots", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2305-01346", "source_url": "https://arxiv.org/abs/2305.01346", "status": "published", "summary_en": "This paper examines attack patterns in a large public dataset of geographically distributed honeypots, addressing methodological questions and building attacker behavioural profiles. According to the authors, results show honeypot location helps identify attack patterns and profiles, concluding that not all collected intelligence is equally valuable and that an effective early warning system may be built with only two distributed honeypots and a production server.", "summary_es": "Este trabajo examina patrones de ataque en un amplio conjunto de datos público de honeypots distribuidos geográficamente, abordando cuestiones metodológicas y construyendo perfiles de comportamiento de atacantes. Según los autores, los resultados muestran que la ubicación de los honeypots ayuda a identificar patrones de ataque y perfiles, y concluyen que no toda la inteligencia recopilada es igualmente valiosa, sugiriendo que un sistema de alerta temprana eficaz puede construirse con solo dos honeypots distribuidos y un servidor de producción.", "updated_at": "2026-10-04", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Chongqi Guan", "Heting Liu", "Guohong Cao", "Sencun Zhu", "Thomas La Porta"], "doi": "10.48550/arxiv.2305.06430", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["IoT"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed and the methodology or results have not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha validado de forma independiente la metodología o los resultados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "we develop an adaptive high-interaction honeypot for IoT devices, called HoneyIoT", "source_sha256": "de72d1ccc89de326e4ea0dfcb59ffac9a14838076bbf0e12d734e0324b9de8de", "source_title": "HoneyIoT: Adaptive High-Interaction Honeypot for IoT Devices Through Reinforcement Learning", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2305-06430", "kind": "paper", "name": "HoneyIoT: Adaptive High-Interaction Honeypot for IoT Devices Through Reinforcement Learning", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2305-06430", "source_url": "https://arxiv.org/abs/2305.06430", "status": "published", "summary_en": "The authors present HoneyIoT, an adaptive high-interaction honeypot for IoT devices that uses a real-device attack trace collection system and reinforcement learning to model and generate convincing responses. According to the paper, differential analysis techniques mutate response values for high fidelity, and after deployment on the public Internet, reported experiments show the system evades pre-attack checks and honeypot detection tools.", "summary_es": "Los autores presentan HoneyIoT, un honeypot adaptativo de alta interacción para dispositivos IoT que emplea un sistema de recolección de trazas de ataque en dispositivos reales y aprendizaje por refuerzo para modelar y generar respuestas convincentes. Según el artículo, se usan técnicas de análisis diferencial para mutar valores de respuesta y lograr alta fidelidad, y tras su despliegue en Internet pública los experimentos reportados muestran que el sistema evade verificaciones previas al ataque y herramientas de detección de honeypots.", "updated_at": "2026-10-04", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Olusesi Balogun", "Daniel Takabi"], "doi": "10.48550/arxiv.2305.19477", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-pdf", "environments": ["Identity", "Application"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text was not reviewed and the reported effectiveness was not independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha verificado de forma independiente la efectividad reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "combine MTD, deception, and attribute-based access control to make it more difficult and expensive for an insider to gain unauthorized access", "source_sha256": "2b5b5a5df7cf8b3ab083deec4db1a4a95deb602db4038dd64556f512bf3e65f8", "source_title": "An Insider Threat Mitigation Framework Using Attribute Based Access Control", "tags": [], "techniques": ["Moving target defense", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2305-19477", "kind": "paper", "name": "An Insider Threat Mitigation Framework Using Attribute Based Access Control", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2305-19477", "source_url": "https://arxiv.org/abs/2305.19477", "status": "published", "summary_en": "The authors propose a framework combining moving target defense (MTD), deception, and attribute-based access control (ABAC) to make unauthorized insider access more difficult and costly. They introduce correlated attributes into ABAC and generate mutated policies from them. According to the authors, evaluation results show the framework effectively identifies correlated attributes and produces adequate mutated policies without affecting system usability.", "summary_es": "Los autores proponen un marco que combina defensa de blanco móvil (MTD), engaño y control de acceso basado en atributos (ABAC) para dificultar el acceso no autorizado por parte de insiders. Introducen el concepto de atributos correlacionados en ABAC y generan políticas mutadas a partir de ellos. Según los autores, la evaluación muestra que el marco identifica atributos correlacionados y produce políticas mutadas adecuadas sin afectar la usabilidad del sistema.", "updated_at": "2026-10-04", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Shanto Roy", "Nazia Sharmin", "Mohammad Sujan Miah", "Jaime C Acosta", "Christopher Kiekintveld", "Aron Laszka"], "doi": "10.48550/arxiv.2306.06769", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text was not reviewed and the proposed model was not independently replicated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha replicado el modelo propuesto.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "defenders can employ cyber deception techniques, such as deploying honeypots", "source_sha256": "f39b6f67fb6587202bccef8dbdddfec31e53f3385bffeae3bde79df8d3a17c37", "source_title": "Adversarial Reconnaissance Mitigation and Modeling", "tags": [], "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2306-06769", "kind": "paper", "name": "Adversarial Reconnaissance Mitigation and Modeling", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2306-06769", "source_url": "https://arxiv.org/abs/2306.06769", "status": "published", "summary_en": "This work examines adversarial reconnaissance mitigation techniques, including deception strategies such as honeypots, and reviews the literature on deception games from the perspective of modeling adversarial reconnaissance. The authors highlight aspects of reconnaissance they state have not been adequately captured in prior work, and present a probability-theory based model of adversaries' belief formation, illustrated with numerical examples.", "summary_es": "Este trabajo examina técnicas de mitigación del reconocimiento adversario, incluidas estrategias de engaño como los honeypots, y revisa la literatura sobre juegos de engaño desde la perspectiva del modelado del reconocimiento adversario. Los autores destacan aspectos del reconocimiento que, según indican, no han sido capturados adecuadamente en trabajos previos y presentan un modelo basado en teoría de probabilidad para la formación de creencias de los adversarios, ilustrado con ejemplos numéricos.", "updated_at": "2026-10-04", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Vasilis Papaspirou", "Leandros Maglaras", "Ioanna Kantzavelou", "Naghmeh Moradpoor", "Sokratis Katsikas"], "doi": "10.48550/arxiv.2307.05047", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Identity"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the title and abstract; the full text has not been reviewed and the validity of the results has not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen; no se ha revisado el texto completo ni se ha verificado de forma independiente la validez de los resultados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "integrating blockchain into the Honeytoken method could improve performance and operational efficiency", "source_sha256": "303b2e429796ea1306487c86b3b461adf4634079d43be40a8cb02a0373f4f6f2", "source_title": "A Blockchain-based two Factor Honeytoken Authentication System", "tags": [], "techniques": ["Honeytoken"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2307-05047", "kind": "paper", "name": "A Blockchain-based two Factor Honeytoken Authentication System", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2307-05047", "source_url": "https://arxiv.org/abs/2307.05047", "status": "published", "summary_en": "This paper, according to its authors, extends a previously introduced two-factor Honeytoken authentication method by incorporating blockchain technology. The stated goal is to strengthen the method against tampering attacks. The authors report evaluation results suggesting improved performance and operational efficiency when integrating blockchain.", "summary_es": "Este trabajo, según sus autores, extiende un método previo de autenticación de dos factores basado en honeytokens incorporando tecnología blockchain. El objetivo declarado es fortalecer el método frente a ataques de manipulación. Los autores reportan resultados de evaluación que sugieren mejoras de rendimiento y eficiencia operativa al integrar blockchain.", "updated_at": "2026-10-04", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Jason M. Pittman", "Shaho Alaee"], "doi": "10.48550/arxiv.2307.11038", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the title and abstract; the full text has not been reviewed and the methodology or findings have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen; no se ha revisado el texto completo ni se ha verificado de forma independiente la metodología o los hallazgos.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "self-optimization appeared prominently in the literature", "source_sha256": "f6f7a84c937588c59e46bd2195a17c59521380ca2fcea35ec875abdbd2bb6382", "source_title": "To What Extent Are Honeypots and Honeynets Autonomic Computing Systems?", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2307-11038", "kind": "paper", "name": "To What Extent Are Honeypots and Honeynets Autonomic Computing Systems?", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2307-11038", "source_url": "https://arxiv.org/abs/2307.11038", "status": "published", "summary_en": "This study, according to its authors, investigates whether honeypots and honeynets described in the literature actually incorporate autonomic computing principles, beyond the use of terms like adaptive or intelligent. The authors analyze the frequency of keywords related to self-configuration, self-healing, self-protection, and self-optimization in a literature sample, finding low presence of the first three and notable presence of the latter.", "summary_es": "Este estudio, según los autores, investiga si los honeypots y honeynets descritos en la literatura realmente incorporan principios de computación autónoma, más allá del uso de términos como adaptativo o inteligente. Analizan la frecuencia de palabras clave relacionadas con autoconfiguración, autocuración, autoprotección y autooptimización en una muestra de artículos, encontrando baja presencia de las tres primeras y una presencia notable de la última.", "updated_at": "2026-10-04", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Md Abu Sayed", "Ahmed H. Anwar", "Christopher Kiekintveld", "Charles Kamhoua"], "doi": "10.48550/arxiv.2308.11817", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text was not reviewed and the reported effectiveness has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "game-theoretic approach that generates optimal honeypot allocation strategies within an attack/defense scenario", "source_sha256": "2341fafe59e2dc01e0d29b49982ff88eb350c4947b56033e442c2259fe6451f0", "source_title": "Honeypot Allocation for Cyber Deception in Dynamic Tactical Networks: A Game Theoretic Approach", "tags": [], "techniques": ["Honeypot", "Decoy", "Moving target defense"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2308-11817", "kind": "paper", "name": "Honeypot Allocation for Cyber Deception in Dynamic Tactical Networks: A Game Theoretic Approach", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2308-11817", "source_url": "https://arxiv.org/abs/2308.11817", "status": "published", "summary_en": "The authors propose a game-theoretic approach for optimal honeypot allocation in tactical networks with dynamic connectivity. They model a two-player dynamic game accounting for future network state evolution, aiming to maximize the attacker's likelihood of hitting a honeypot while minimizing reconfiguration costs. They present an iterative algorithm to find Nash equilibrium strategies and evaluate its scalability through simulations.", "summary_es": "Los autores proponen un enfoque de teoría de juegos para la asignación óptima de honeypots en redes tácticas con conectividad dinámica. Modelan un juego dinámico de dos jugadores que considera la evolución futura de la red, buscando maximizar la probabilidad de que el atacante caiga en un honeypot mientras se minimizan los costos de reconfiguración. Presentan un algoritmo iterativo para encontrar estrategias de equilibrio de Nash y evalúan su escalabilidad mediante simulaciones.", "updated_at": "2026-10-04", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Massimiliano Baldo", "Tommaso Bianchi", "Mauro Conti", "Alessio Trevisan", "Federico Turrin"], "doi": "10.48550/arxiv.2309.06077", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["IoT", "OT/ICS"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text was not reviewed and the reported effectiveness has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "HoneyEVSE can successfully evade the Shodan honeyscore metric while attracting a high number of interactions", "source_sha256": "762516ed179ab6562139e0b7e3900625ab9bb411667bf9f1d1dfddde02249e3f", "source_title": "HoneyEVSE: An Honeypot to emulate Electric Vehicle Supply Equipments", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2309-06077", "kind": "paper", "name": "HoneyEVSE: An Honeypot to emulate Electric Vehicle Supply Equipments", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2309-06077", "source_url": "https://arxiv.org/abs/2309.06077", "status": "published", "summary_en": "The authors present HoneyEVSE, a honeypot designed to simulate Electric Vehicle Supply Equipment (EVSE) within the Vehicle-to-Grid paradigm. The system emulates the charging process and login pages with high fidelity to increase attacker engagement. They exposed the honeypot for 30 days on the Internet and report it successfully evaded the Shodan Honeyscore metric while attracting numerous interactions.", "summary_es": "Los autores presentan HoneyEVSE, un honeypot diseñado para simular equipos de suministro para vehículos eléctricos (EVSE) dentro del paradigma Vehicle-to-Grid. El sistema emula con alta fidelidad el proceso de carga y páginas de inicio de sesión para aumentar el engagement de los atacantes. Expusieron el honeypot durante 30 días en Internet y, según reportan, logró evadir la métrica Shodan Honeyscore mientras atraía numerosas interacciones.", "updated_at": "2026-10-04", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Yinan Hu", "Quanyan Zhu"], "doi": "10.48550/arxiv.2309.13403", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Identity"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the method's effectiveness has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha validado la eficacia del método de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "Decoy-based Psychological Cyber Deception for Proactive Human Agents", "source_sha256": "19817941c1d38dc8bb62e8421290c4e6341c7f06febc80483e5eb4a50debc5cb", "source_title": "Game of Travesty: Decoy-based Psychological Cyber Deception for Proactive Human Agents", "tags": [], "techniques": ["Decoy", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2309-13403", "kind": "paper", "name": "Game of Travesty: Decoy-based Psychological Cyber Deception for Proactive Human Agents", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2309-13403", "source_url": "https://arxiv.org/abs/2309.13403", "status": "published", "summary_en": "The authors propose a signaling game framework between a defender and an insider human agent, using quantum decision theory to exploit cognitive biases and counter insider attacks. The defender deceives the attacker by luring them toward decoy sensors via generators that produce perceptions of classical signals. According to the authors, results show that strategically designed generators can worsen the attacker's ability to identify decoys compared to schemes without generators.", "summary_es": "Los autores proponen un marco de juego de señalización entre un defensor y un agente humano interno, utilizando teoría cuántica de la decisión para explotar sesgos cognitivos y combatir ataques internos. El defensor engaña al atacante induciéndolo a acceder a sensores señuelo mediante generadores que producen percepciones de señales clásicas. Según los autores, los resultados muestran que generadores diseñados estratégicamente pueden empeorar la capacidad del atacante para identificar señuelos en comparación con esquemas sin generadores.", "updated_at": "2026-10-04", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Md Abu Sayed", "Mohammad Ariful Islam Khan", "Bryant A Allsup", "Joshua Zamora", "Palvi Aggarwal"], "doi": "10.48550/arxiv.2310.10662", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the method's effectiveness has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha validado la eficacia del método de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "Deception, which includes leading cyber-attackers astray with false information, has shown to be an effective method of thwarting cyber-attacks.", "source_sha256": "b2eb3bbe9789b97d7b004d075fa0dea0b08c047bf806118196774e4155917ce2", "source_title": "Assessing the Influence of Different Types of Probing on Adversarial Decision-Making in a Deception Game", "tags": [], "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2310-10662", "kind": "paper", "name": "Assessing the Influence of Different Types of Probing on Adversarial Decision-Making in a Deception Game", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2310-10662", "source_url": "https://arxiv.org/abs/2310.10662", "status": "published", "summary_en": "This study examines how different probing costs affect adversarial decision-making in a deception game, using an IBLT model with delayed feedback to simulate human behavior. According to the authors, probing slightly decreased as its cost increased, while the proportion of attacks remained relatively stable. The authors conclude that different probing costs do not significantly affect the proportion of attacks but have a slight impact on the proportion of probing.", "summary_es": "Este estudio examina cómo distintos costos de sondeo afectan la toma de decisiones de adversarios en un juego de engaño (deception game), usando un modelo IBLT con retroalimentación retardada para simular el comportamiento humano. Según los autores, el sondeo disminuyó levemente al aumentar su costo, mientras que la proporción de ataques se mantuvo relativamente estable. Los autores concluyen que los distintos costos de sondeo no afectan significativamente la proporción de ataques, pero sí tienen un impacto leve sobre la proporción de sondeos.", "updated_at": "2026-10-04", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Kate Highnam", "Zach Hanif", "Ellie Van Vogt", "Sonali Parbhoo", "Sergio Maffeis", "Nicholas R. Jennings"], "doi": "10.48550/arxiv.2310.13224", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed and the methodology or results reported by the authors have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha verificado de forma independiente la metodología o los resultados reportados por los autores.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "we run the first controlled and adaptive honeypot deployment study, identifying the causal relationship between an ssh vulnerability and the rate of server exploitation", "source_sha256": "18b2e9ea845caf78cfe94bfd7fff3584d306e4154933fb06f6241c086ab58bea", "source_title": "Adaptive Experimental Design for Intrusion Data Collection", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2310-13224", "kind": "paper", "name": "Adaptive Experimental Design for Intrusion Data Collection", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2310-13224", "source_url": "https://arxiv.org/abs/2310.13224", "status": "published", "summary_en": "This paper proposes an adaptive experimental design (AD) method, inspired by randomized clinical trials, to study causal relationships between the design of intrusion data collection environments (such as honeypots) and the data observed. The authors state they conducted the first controlled and adaptive honeypot deployment study to measure how an SSH vulnerability affects server exploitation rates, reporting reductions in deployment time and resources needed.", "summary_es": "Este artículo propone un método de diseño experimental adaptativo (AD), inspirado en ensayos clínicos aleatorizados, para estudiar relaciones causales entre el diseño de entornos de recolección de datos de intrusión (como honeypots) y los datos observados. Los autores afirman haber realizado el primer despliegue controlado y adaptativo de honeypots para medir cómo una vulnerabilidad SSH afecta la tasa de explotación de servidores, reportando reducciones en tiempo y recursos necesarios.", "updated_at": "2026-10-04", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Ruixiang Tang", "Jiayi Yuan", "Yiming Li", "Zirui Liu", "Rui Chen", "Xia Hu"], "doi": "10.48550/arxiv.2310.18633", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Application"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed and the methodology or experimental results reported by the authors have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha verificado de forma independiente la metodología o los resultados experimentales reportados por los autores.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "we propose and integrate a honeypot module into the original PLM, specifically designed to absorb backdoor information exclusively", "source_sha256": "059d0220ec812bf202ca80811e6d480570b8d88d81b93f386df70a4c25e9d6fd", "source_title": "Setting the Trap: Capturing and Defeating Backdoors in Pretrained Language Models through Honeypots", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2310-18633", "kind": "paper", "name": "Setting the Trap: Capturing and Defeating Backdoors in Pretrained Language Models through Honeypots", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2310-18633", "source_url": "https://arxiv.org/abs/2310.18633", "status": "published", "summary_en": "The authors propose a backdoor-resistant fine-tuning procedure for pretrained language models, integrating a 'honeypot' module designed to exclusively absorb backdoor information present in poisoned training samples. By penalizing the information captured by this module during fine-tuning, the authors report a reduction in backdoor attack success rate compared to prior methods.", "summary_es": "Los autores proponen un procedimiento de ajuste fino resistente a puertas traseras para modelos de lenguaje preentrenados, integrando un módulo 'honeypot' diseñado para absorber exclusivamente la información de puertas traseras presente en muestras de entrenamiento envenenadas. Según los autores, al penalizar la información capturada por este módulo durante el ajuste fino, se reduce la tasa de éxito de ataques de puerta trasera en comparación con métodos previos.", "updated_at": "2026-10-04", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Huy Quang Ngo", "Mingyu Guo", "Hung Nguyen"], "doi": "10.48550/arxiv.2312.16820", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Identity", "Network"], "full_text_reviewed": false, "limitations_en": "This summary is based solely on the published title and abstract; the full text was not reviewed, and the effectiveness of the proposed algorithms has not been independently verified or replicated.", "limitations_es": "Este resumen se basa únicamente en el título y el resumen publicados; no se ha revisado el texto completo ni se ha verificado o replicado de forma independiente la efectividad de los algoritmos propuestos.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "We study a Stackelberg game between an attacker and a defender on large Active Directory (AD) attack graphs where the defender employs a set of honeypots", "source_sha256": "9aa3f218ea78820bdb353a063580c2e28d3ff0e01a467cc5a349c76277f71e2b", "source_title": "Catch Me if You Can: Effective Honeypot Placement in Dynamic AD Attack Graphs", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2312-16820", "kind": "paper", "name": "Catch Me if You Can: Effective Honeypot Placement in Dynamic AD Attack Graphs", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2312-16820", "source_url": "https://arxiv.org/abs/2312.16820", "status": "published", "summary_en": "According to its authors, this paper studies a Stackelberg game between attacker and defender over large, dynamic Active Directory (AD) attack graphs, where the defender deploys honeypots to prevent the attacker from reaching high-value targets. The authors propose a mixed-integer programming (MIP) formulation and a clustering-based approach (dyMIP(m)) to handle large dynamic graph instances, reporting near-optimal results under realistic conditions.", "summary_es": "Este trabajo, según sus autores, estudia un juego de Stackelberg entre atacante y defensor sobre grafos de ataque de Active Directory (AD) de gran escala y dinámicos, donde el defensor utiliza honeypots para impedir que el atacante alcance objetivos de alto valor. Los autores proponen una formulación de programación entera mixta (MIP) y un enfoque basado en clustering (dyMIP(m)) para manejar grafos dinámicos a gran escala, mostrando resultados cercanos al óptimo en condiciones realistas.", "updated_at": "2026-10-04", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Md Mahabub Uz Zaman", "Liangde Tao", "Mark Maldonado", "Chang Liu", "Ahmed Sunny", "Shouhuai Xu", "Lin Chen"], "doi": "10.48550/arxiv.2401.06763", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This summary is based solely on the published title and abstract; the full text was not reviewed, and the actual effectiveness of the proposed method has not been independently validated.", "limitations_es": "Este resumen se basa únicamente en el título y el resumen publicados; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad real del método propuesto.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "How should the defender blend honeypot computers into production computers to maximize the utility", "source_sha256": "af19f5733fab57f3083d87a2043d0ed3bb60c564054529e27fadf0b91627b69f", "source_title": "Optimally Blending Honeypots into Production Networks: Hardness and Algorithms", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2401-06763", "kind": "paper", "name": "Optimally Blending Honeypots into Production Networks: Hardness and Algorithms", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2401-06763", "source_url": "https://arxiv.org/abs/2401.06763", "status": "published", "summary_en": "According to the authors, this paper initiates a systematic study of a new honeypot deployment paradigm that blends honeypot computers into production computers. They formalize the Honeypot Deployment (HD) problem as a combinatorial optimization problem, prove its NP-hardness, propose a near-optimal algorithm (a polynomial-time approximation scheme), and conduct simulations to assess the impact of attacker capabilities.", "summary_es": "Según los autores, este trabajo inicia un estudio sistemático sobre un nuevo paradigma de despliegue de honeypots que consiste en mezclar computadoras honeypot con computadoras de producción. Formalizan el problema de Despliegue de Honeypots (HD) como un problema de optimización combinatoria, demuestran su NP-dureza, proponen un algoritmo casi óptimo (un esquema de aproximación en tiempo polinomial) y realizan simulaciones para evaluar el impacto de las capacidades del atacante.", "updated_at": "2026-10-04", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Pedro Beltran Lopez", "Pantaleone Nespoli", "Manuel Gil Perez"], "doi": "10.48550/arxiv.2402.09191", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract, without access to the full text or independent verification of the reported experimental results.", "limitations_es": "Esta ficha se basa únicamente en el título y resumen disponibles públicamente, sin acceso al texto completo ni verificación independiente de los resultados experimentales reportados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "TCP Stealth Redirection to On-Demand Honeypots", "source_sha256": "64a13bc22ba17e017343d361ec481e55e2f4af3a3c251d8da45a3c80eefe8207", "source_title": "Cyber Deception Reactive: TCP Stealth Redirection to On-Demand Honeypots", "tags": [], "techniques": ["Honeypot", "Decoy", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2402-09191", "kind": "paper", "name": "Cyber Deception Reactive: TCP Stealth Redirection to On-Demand Honeypots", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2402-09191", "source_url": "https://arxiv.org/abs/2402.09191", "status": "published", "summary_en": "According to the authors, this paper proposes a cyber deception mechanism that stealthily redirects TCP communications to an on-demand honeypot server cloned to resemble the victim asset. The stated goal is to make attackers focus on the decoy server, enabling threat intelligence collection while protecting the real asset.", "summary_es": "Este artículo, según sus autores, propone un mecanismo de engaño cibernético que redirige de forma sigilosa comunicaciones TCP hacia un servidor honeypot generado bajo demanda que clona las características del activo víctima. El objetivo declarado es que el atacante enfoque sus acciones sobre el servidor señuelo, permitiendo recolectar inteligencia de amenazas mientras se protege el activo real.", "updated_at": "2026-10-04", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Naoto Watanabe", "Taku Yamazaki", "Takumi Miyoshi", "Ryo Yamamoto", "Masataka Nakahara", "Norihiro Okui", "Ayumu Kubota"], "doi": "10.48550/arxiv.2403.02744", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["IoT", "Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract, without access to the full text or independent verification of the reported experimental results.", "limitations_es": "Esta ficha se basa únicamente en el título y resumen disponibles públicamente, sin acceso al texto completo ni verificación independiente de los resultados experimentales reportados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "The proposed system comprises a honeypot server and a gateway.", "source_sha256": "31c24d428082a4b6b783dcda8b2a4a30b0e8b59b16f30bc58097235607ee767d", "source_title": "Self-adaptive Traffic Anomaly Detection System for IoT Smart Home Environments", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2403-02744", "kind": "paper", "name": "Self-adaptive Traffic Anomaly Detection System for IoT Smart Home Environments", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2403-02744", "source_url": "https://arxiv.org/abs/2403.02744", "status": "published", "summary_en": "According to the authors, this paper presents a self-adaptive traffic anomaly detection system for IoT smart home environments, consisting of a honeypot server and a gateway. The honeypot continuously captures traffic and adaptively generates a detection model used by the gateway to identify anomalous traffic, including unknown attacks.", "summary_es": "Según los autores, este trabajo presenta un sistema de detección de anomalías de tráfico autoadaptativo para entornos IoT de hogar inteligente, compuesto por un servidor honeypot y una pasarela. El honeypot captura tráfico continuamente y genera de forma adaptativa un modelo de detección que la pasarela utiliza para identificar tráfico anómalo, incluyendo ataques desconocidos.", "updated_at": "2026-10-04", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Tao Li", "Quanyan Zhu"], "doi": "10.48550/arxiv.2403.10570", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text was not reviewed and the effectiveness of the proposed methods was not validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se revisó el texto completo ni se validó la efectividad de los métodos propuestos.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "the symbiotic relationship between these methodologies, and explores relevant applications", "source_sha256": "7e1b247e35cd36615d2b8a38f67f121f87c87706a43c1ea2d8371fb3245bc5ff", "source_title": "Symbiotic Game and Foundation Models for Cyber Deception Operations in Strategic Cyber Warfare", "tags": [], "techniques": ["Adversary engagement", "Decoy", "Moving target defense"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2403-10570", "kind": "paper", "name": "Symbiotic Game and Foundation Models for Cyber Deception Operations in Strategic Cyber Warfare", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2403-10570", "source_url": "https://arxiv.org/abs/2403.10570", "status": "published", "summary_en": "According to the authors, this chapter examines the combined use of game-theoretic models and foundation models (FMs) to analyze, design, and implement cyber deception tactics across tactical, operational, and strategic warfare levels. It proposes MANSCOL (multi-agent neurosymbolic conjectural learning) to let defenders predict adversarial behaviors and design adaptive deceptive defenses, and discusses challenges of applying FMs in cybersecurity.", "summary_es": "Este capítulo, según sus autores, examina el uso combinado de modelos de teoría de juegos y modelos fundacionales (FMs) para analizar, diseñar e implementar tácticas de engaño cibernético en los niveles táctico, operacional y estratégico. Propone el enfoque MANSCOL (aprendizaje conjetural neurosimbólico multiagente) para que el defensor prediga comportamientos adversarios y diseñe tácticas de engaño defensivo adaptativas. También discute los retos de aplicar FMs en ciberseguridad.", "updated_at": "2026-10-04", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Luís Sousa", "José Cecílio", "Pedro Ferreira", "Alan Oliveira"], "doi": "10.48550/arxiv.2404.04385", "doi_aliases": ["10.1145/3706601.3706617"], "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["OT/ICS"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text was not reviewed and actual implementation or validation of the system was not confirmed.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se revisó el texto completo ni se confirmó la implementación o validación real del sistema.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "a scalable and reconfigurable honeynet for cyber-physical systems", "source_sha256": "01351c7328504ae1c9e2c1e0a38153c9da40f713f2b9ca6cd813a6ec575bc486", "source_title": "Reconfigurable and Scalable Honeynet for Cyber-Physical Systems", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2404-04385", "kind": "paper", "name": "Reconfigurable and Scalable Honeynet for Cyber-Physical Systems", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2404-04385", "source_url": "https://arxiv.org/abs/2404.04385", "status": "published", "summary_en": "According to the authors, this work proposes a reconfigurable and scalable honeynet for cyber-physical systems, focused on industrial control systems (ICS). The approach includes automatic generation of attacks to test and validate the honeynet, aiming to serve as a basis for producing datasets to train attack detection and classification algorithms.", "summary_es": "Según los autores, este trabajo propone un honeynet reconfigurable y escalable para sistemas ciberfísicos, enfocado en sistemas de control industrial (ICS). El enfoque incluye la generación automática de ataques para probar y validar el honeynet, con el objetivo de servir como base para producir conjuntos de datos destinados al entrenamiento de algoritmos de detección y clasificación de ataques.", "updated_at": "2026-10-04", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["David D. Nguyen", "David Liebowitz", "Surya Nepal", "Salil S. Kanhere", "Sharif Abuadbba"], "doi": "10.48550/arxiv.2404.04854", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Endpoint"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the paper's title and abstract as provided; the full text has not been reviewed and reported effectiveness has not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen del artículo según lo proporcionado; no se ha revisado el texto completo ni se ha verificado de forma independiente la efectividad reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "Honeyfiles are security assets designed to attract and detect intruders on compromised systems.", "source_sha256": "b581d93fd57e1838058a0567631fef46dcde8cb28231c4f36449bea8dc373f69", "source_title": "Contextual Chart Generation for Cyber Deception", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2404-04854", "kind": "paper", "name": "Contextual Chart Generation for Cyber Deception", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2404-04854", "source_url": "https://arxiv.org/abs/2404.04854", "status": "published", "summary_en": "This paper addresses automated content generation for honeyfiles, decoy documents designed to detect intruders. The authors focus on generating realistic charts within such documents, combining a multitask Transformer for captions and plot text with a specialized autoencoder for underlying tabular data. They also introduce a new dataset and a metric (Keyword Semantic Matching) to evaluate semantic consistency of generated content.", "summary_es": "Este trabajo aborda la generación automática de contenido para honeyfiles, documentos señuelo diseñados para detectar intrusos. Los autores se centran en la generación de gráficos realistas dentro de estos documentos, combinando un Transformer multitarea para generar títulos y texto de gráficos con un autoencoder especializado para generar los datos tabulares subyacentes. También proponen un nuevo conjunto de datos y una métrica (Keyword Semantic Matching) para evaluar la consistencia semántica del contenido generado.", "updated_at": "2026-10-04", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Christoforos Vasilatos", "Dunia J. Mahboobeh", "Hithem Lamri", "Manaar Alam", "Michail Maniatakos"], "doi": "10.48550/arxiv.2405.05999", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["OT/ICS", "Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the paper's title and abstract as provided; the full text has not been reviewed and reported effectiveness has not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen del artículo según lo proporcionado; no se ha revisado el texto completo ni se ha verificado de forma independiente la efectividad reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "honeypots play a vital role by acting as decoy targets within ICS networks", "source_sha256": "0080cb3d5fc1f42f41bdd5756be30379bfe886e21c044da7538c39c55f373a52", "source_title": "LLMPot: Dynamically Configured LLM-based Honeypot for Industrial Protocol and Physical Process Emulation", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2405-05999", "kind": "paper", "name": "LLMPot: Dynamically Configured LLM-based Honeypot for Industrial Protocol and Physical Process Emulation", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2405-05999", "source_url": "https://arxiv.org/abs/2405.05999", "status": "published", "summary_en": "The authors propose LLMPot, an approach for designing honeypots in Industrial Control System (ICS) networks using large language models (LLMs). The goal is to automate the creation of realistic, vendor-agnostic honeypots capable of emulating industrial protocols and PLC control logic, reducing the manual effort traditionally required in this domain.", "summary_es": "Los autores proponen LLMPot, un enfoque para diseñar honeypots en redes de Sistemas de Control Industrial (ICS) utilizando modelos de lenguaje de gran tamaño (LLM). El objetivo es automatizar la creación de honeypots realistas con configuraciones independientes del fabricante, capaces de emular protocolos industriales y lógica de control de PLC, reduciendo el esfuerzo manual tradicionalmente requerido en este dominio.", "updated_at": "2026-10-04", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Jacob Quibell"], "doi": "10.48550/arxiv.2405.11497", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the validity of the system's predictions has not been independently verified.id", "limitations_es": "Esta ficha se basa únicamente en el título y el resumen disponibles públicamente; no se ha revisado el texto completo ni se ha verificado de forma independiente la validez de las predicciones del sistema.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "the system outputs a prediction on the attacker's motive", "source_sha256": "20e5c76025dc20ba2906733ac016492125d7518456e4344ada7452aa84c20be8", "source_title": "Towards in-situ Psychological Profiling of Cybercriminals Using Dynamically Generated Deception Environments", "tags": [], "techniques": ["Decoy", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2405-11497", "kind": "paper", "name": "Towards in-situ Psychological Profiling of Cybercriminals Using Dynamically Generated Deception Environments", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2405-11497", "source_url": "https://arxiv.org/abs/2405.11497", "status": "published", "summary_en": "This paper presents a proof-of-concept (POC) cyber deception system that dynamically generates deception material based on observed attacker behaviour during a simulated real-time attack. The system analyzes attacker interaction with the deception material to predict the attacker's motive, and the authors explore expanding this POC to infer other profile features such as psychological characteristics.", "summary_es": "Este artículo presenta un sistema de prueba de concepto (POC) de engaño cibernético que genera dinámicamente material de decepción basado en el comportamiento observado del atacante durante un ataque simulado en tiempo real. El sistema analiza la interacción del atacante con el material para predecir su motivo, y los autores exploran la posibilidad de ampliarlo para inferir otras características del perfil del atacante, como rasgos psicológicos.", "updated_at": "2026-10-04", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Cheng Wang", "Christopher Redino", "Ryan Clark", "Abdul Rahman", "Sal Aguinaga", "Sathvik Murli", "Dhruv Nandakumar", "Roland Rao", "Lanxiao Huang", "Daniel Radke", "Edward Bowen"], "doi": "10.48550/arxiv.2406.17576", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "Endpoint"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the reported effectiveness of the approach has not been independently replicated.", "limitations_es": "Esta ficha se basa únicamente en el título y el resumen disponibles públicamente; no se ha revisado el texto completo ni se ha replicado de forma independiente la eficacia reportada del enfoque.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "evading honeyfiles (decoy files strategically placed to detect unauthorized access)", "source_sha256": "da5c3beda3bec85fed71f0adc82d8f59af85eee732e0fe1f40f3a430a735b49b", "source_title": "Leveraging Reinforcement Learning in Red Teaming for Advanced Ransomware Attack Simulations", "tags": [], "techniques": ["Decoy", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2406-17576", "kind": "paper", "name": "Leveraging Reinforcement Learning in Red Teaming for Advanced Ransomware Attack Simulations", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2406-17576", "source_url": "https://arxiv.org/abs/2406.17576", "status": "published", "summary_en": "This paper proposes a reinforcement learning (RL) approach to simulate ransomware attacks within an environment mirroring real-world networks, aiming to streamline traditional red teaming exercises. According to the authors, experimental results on a 152-host example network show the RL agent's capability to discover and orchestrate attacks on high-value targets while evading honeyfiles (decoy files placed to detect unauthorized access).", "summary_es": "Este artículo propone un enfoque basado en aprendizaje por refuerzo (RL) para simular ataques de ransomware en un entorno que imita redes reales, con el fin de agilizar los ejercicios tradicionales de red teaming. Según los autores, los resultados experimentales en una red de ejemplo de 152 hosts muestran que el agente RL es capaz de descubrir y orquestar ataques hacia objetivos de alto valor mientras evade honeyfiles (archivos señuelo colocados para detectar accesos no autorizados).", "updated_at": "2026-10-04", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Abdullatif Albaseer", "Nima Abdi", "Mohamed Abdallah", "Marwa Qaraqe", "Saif Alkuwari"], "doi": "10.48550/arxiv.2407.02845", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["OT/ICS", "IoT"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the reported results have not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se han validado de forma independiente los resultados reportados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "Honeypot technologies provide an effective defense strategy for the Industrial Internet of Things (IIoT)", "source_sha256": "f21731142c0ccaa6bc8ff2d7c2433a2330a1a0a2979f4ccca025f4223b1c896e", "source_title": "FedPot: A Quality-Aware Collaborative and Incentivized Honeypot-Based Detector for Smart Grid Networks", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2407-02845", "kind": "paper", "name": "FedPot: A Quality-Aware Collaborative and Incentivized Honeypot-Based Detector for Smart Grid Networks", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2407-02845", "source_url": "https://arxiv.org/abs/2407.02845", "status": "published", "summary_en": "This work, according to its authors, addresses security in Advanced Metering Infrastructure (AMI) for smart grids using honeypots combined with federated learning. They propose FedPot, which includes a data quality measure and a fair incentive mechanism allowing small power suppliers to share locally trained models with traditional retailers without exposing confidential data. The authors report, via simulations on realistic microgrid log datasets, improvements over state-of-the-art techniques in both the security model and reward distribution.", "summary_es": "Este trabajo, según sus autores, aborda la seguridad de la infraestructura de medición avanzada (AMI) en redes eléctricas inteligentes mediante honeypots combinados con aprendizaje federado. Proponen FedPot, que incluye una medida de calidad de datos y un mecanismo de incentivos justo para que pequeños proveedores de energía compartan modelos entrenados localmente con minoristas tradicionales sin exponer datos confidenciales. Los autores reportan, mediante simulaciones con datos de registros de microrredes, mejoras frente a técnicas existentes tanto en el modelo de seguridad como en la distribución de recompensas.", "updated_at": "2026-10-04", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Ryan Gabrys", "Daniel Silva", "Mark Bilinski"], "doi": "10.48550/arxiv.2407.07292", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the effectiveness of the proposed approach has not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha verificado de forma independiente la efectividad del enfoque propuesto.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "no prior attempts have been made to utilize GANs specifically for generating decoy configurations", "source_sha256": "0f07fa76d02c2297df75ba5c06684e0224aac73585e5b856aad1bb2e869a4f42", "source_title": "HoneyGAN Pots: A Deep Learning Approach for Generating Honeypots", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2407-07292", "kind": "paper", "name": "HoneyGAN Pots: A Deep Learning Approach for Generating Honeypots", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2407-07292", "source_url": "https://arxiv.org/abs/2407.07292", "status": "published", "summary_en": "According to the authors, this paper explores the use of Generative Adversarial Networks (GANs) to generate decoy configurations for cyber defense. They note that existing approaches rely on maintained lists of configurations or pre-configured images with limited adaptability, and present what they describe as the first attempt to use GANs specifically for generating decoy configurations, aiming to provide defenders with a tool to strengthen network defenses.", "summary_es": "Según los autores, este artículo explora el uso de redes generativas antagónicas (GAN) para generar configuraciones señuelo en el contexto de la defensa cibernética. Señalan que los enfoques existentes dependen de listas de configuraciones o imágenes preconfiguradas, con limitada adaptabilidad, y presentan lo que describen como el primer intento de emplear GANs específicamente para la generación de configuraciones de decoy, con el fin de proporcionar una herramienta para reforzar las defensas de red.", "updated_at": "2026-10-04", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Zuquan Peng", "Yuanyuan He", "Jianbing Ni", "Ben Niu"], "doi": "10.48550/arxiv.2409.03183", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Application"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the source title and abstract; the full text has not been reviewed and the reported effectiveness has not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen de la fuente; no se ha revisado el texto completo ni se ha verificado de forma independiente la eficacia reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "DARCY borrows the \"honeypot\" concept to bait multiple trapdoors, effectively detecting the adversarial examples generated by UAT", "source_sha256": "7b00aff99596036785af0d7ac1c031d5c1de9c4677e10d2bd7a0d56f68fcade9", "source_title": "Bypassing DARCY Defense: Indistinguishable Universal Adversarial Triggers", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2409-03183", "kind": "paper", "name": "Bypassing DARCY Defense: Indistinguishable Universal Adversarial Triggers", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2409-03183", "source_url": "https://arxiv.org/abs/2409.03183", "status": "published", "summary_en": "According to the authors, this paper introduces IndisUAT, a new method for generating universal adversarial triggers (UAT) against NLP models that bypasses DARCY, a honeypot-based defense that baits multiple trapdoors to detect adversarial examples. The authors state that IndisUAT produces adversarial examples whose feature distribution is indistinguishable from benign examples, reducing DARCY's detection effectiveness and that of other defenses across several models.", "summary_es": "Este trabajo, según sus autores, presenta IndisUAT, un nuevo método para generar disparadores adversarios universales (UAT) en modelos de PLN que evade DARCY, una defensa basada en el concepto de honeypot que coloca múltiples trampillas para detectar ejemplos adversarios. Los autores afirman que IndisUAT crea ejemplos cuya distribución de características es indistinguible de la de ejemplos benignos, reduciendo la eficacia de detección de DARCY y de otras defensas en varios modelos.", "updated_at": "2026-10-04", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Jamal Al-Karaki", "Muhammad Al-Zafar Khan", "Marwan Omar"], "doi": "10.48550/arxiv.2409.07587", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-pdf", "environments": ["Endpoint"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the source title and abstract; the full text has not been reviewed and the reported effectiveness has not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen de la fuente; no se ha revisado el texto completo ni se ha verificado de forma independiente la eficacia reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "We examine five specific applications of LLMs: Malware honeypots, identification of text-based threats, code analysis for detecting malicious intent, trend analysis of malware, and detection of non-standard disguised malware", "source_sha256": "b8e60a66109b7556ff031b535db0193324adac6a886c1067196a6a1197c4ecdf", "source_title": "Exploring LLMs for Malware Detection: Review, Framework Design, and Countermeasure Approaches", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2409-07587", "kind": "paper", "name": "Exploring LLMs for Malware Detection: Review, Framework Design, and Countermeasure Approaches", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2409-07587", "source_url": "https://arxiv.org/abs/2409.07587", "status": "published", "summary_en": "According to the authors, this paper reviews the use of large language models (LLMs) in malware detection, including applications to malware honeypots, text-based threat identification, code analysis, and trend detection. The authors propose a classification scheme, performance metrics, and an LLM-based risk mitigation framework, evaluating its performance against LLM-enabled malware.", "summary_es": "Según los autores, este artículo revisa el uso de modelos de lenguaje grandes (LLMs) en la detección de malware, incluyendo su aplicación en honeypots de malware, identificación de amenazas basadas en texto, análisis de código y detección de tendencias. Los autores proponen un esquema de clasificación, métricas de rendimiento y un marco de mitigación de riesgos basado en LLMs, evaluando su desempeño frente a malware habilitado por estos modelos.", "updated_at": "2026-10-04", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": [" Reworr", "Dmitrii Volkov"], "doi": "10.48550/arxiv.2410.13919", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the title and abstract available from the source; the full text has not been reviewed and the effectiveness of the described system has not been independently verified.", "limitations_es": "Esta ficha se basa únicamente en el título y resumen disponibles en la fuente; no se ha revisado el texto completo ni se ha verificado de forma independiente la eficacia del sistema descrito.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "augmenting a standard SSH honeypot with prompt injection and time-based analysis techniques", "source_sha256": "5e1aa201c2136d1ae4e63c70d864cf919ecdd968a0b005b332386e539f7b39e4", "source_title": "LLM Agent Honeypot: Monitoring AI Hacking Agents in the Wild", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2410-13919", "kind": "paper", "name": "LLM Agent Honeypot: Monitoring AI Hacking Agents in the Wild", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2410-13919", "source_url": "https://arxiv.org/abs/2410.13919", "status": "published", "summary_en": "The authors present LLM Honeypot, a system that augments a standard SSH honeypot with prompt injection and time-based analysis techniques to distinguish autonomous AI agents among attackers. Over a roughly three-month trial deployment in a public environment, they recorded millions of hacking attempts and identified a small number of potential AI agents. The work aims to serve as an early warning of malicious LLM agent usage in the wild.", "summary_es": "Los autores presentan LLM Honeypot, un sistema que amplía un honeypot SSH estándar con técnicas de inyección de prompts y análisis temporal para distinguir agentes de IA autónomos entre los atacantes. Durante un despliegue de prueba de aproximadamente tres meses en un entorno público, registraron millones de intentos de ataque e identificaron un número reducido de posibles agentes de IA. El trabajo busca servir como alerta temprana sobre el uso de agentes LLM maliciosos.", "updated_at": "2026-10-04", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Travis Cuvelier", "Sean Ha", "Maretta Morovitz"], "doi": "10.48550/arxiv.2410.14168", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["OT/ICS", "Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the title and abstract available from the source; the full text has not been reviewed and the validity of the presented numerical results has not been independently verified.", "limitations_es": "Esta ficha se basa únicamente en el título y resumen disponibles en la fuente; no se ha revisado el texto completo ni se ha verificado de forma independiente la validez de los resultados numéricos presentados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "directs the adversary towards a ``honeypot\" that emulates a real control system", "source_sha256": "7d7c3d0f762c32f090af04659bc75a3d5791c21641dd7ad3b2e1b53c84a7aee7", "source_title": "Elements of disinformation theory: cyber engagement via increasing adversary information consumption", "tags": [], "techniques": ["Honeypot", "Adversary engagement", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2410-14168", "kind": "paper", "name": "Elements of disinformation theory: cyber engagement via increasing adversary information consumption", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2410-14168", "source_url": "https://arxiv.org/abs/2410.14168", "status": "published", "summary_en": "The authors address a scenario where a defender of a networked control system has isolated an intruder and redirects them toward a honeypot emulating the real system without connection to a physical plant. They propose an adversary engagement strategy within this decoy environment to increase the attacker's information-processing costs by spoofing sensor readings based on cyber threat intelligence. They perform a numerical comparison between cases of perfect and imperfect threat intelligence.", "summary_es": "Los autores abordan un escenario en el que un defensor de un sistema de control en red ha aislado a un intruso y lo dirige hacia un honeypot que emula el sistema real sin conexión a una planta física. Proponen una estrategia de involucramiento del adversario dentro de este entorno señuelo para incrementar el coste de procesamiento de información del atacante, falsificando lecturas de sensores basándose en inteligencia de amenazas cibernéticas. Comparan numéricamente los casos de inteligencia de amenazas perfecta e imperfecta.", "updated_at": "2026-10-04", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Sathvik Prasad", "Aleksandr Nahapetyan", "Bradley Reaves"], "doi": "10.48550/arxiv.2410.17361", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed and the authors' reported findings have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se han verificado de manera independiente los hallazgos reportados por los autores.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "industry and academic voice honeypots to public enforcement and consumer complaints", "source_sha256": "813b29c796317c21cf21f5dbc36e3ffd34424f47164169bc69886a1c23797f31", "source_title": "Characterizing Robocalls with Multiple Vantage Points", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2410-17361", "kind": "paper", "name": "Characterizing Robocalls with Multiple Vantage Points", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2410-17361", "source_url": "https://arxiv.org/abs/2410.17361", "status": "published", "summary_en": "The authors analyze robocall data from multiple independent vantage points, including academic and industry voice honeypots, to study the effectiveness of telephone spam prevention and mitigation efforts. The work compares disparate data sources over more than 5 years, including audio and transcripts from millions of calls, to assess trends and spammer adaptation to authentication schemes like STIR/SHAKEN.", "summary_es": "Los autores analizan datos de robollamadas provenientes de múltiples fuentes independientes, incluyendo honeypots de voz académicos e industriales, para estudiar la efectividad de las medidas de prevención y mitigación de spam telefónico. El trabajo compara datos dispares de más de 5 años, incluyendo audio y transcripciones de millones de llamadas, con el fin de evaluar tendencias y la adaptación de los spammers a esquemas de autenticación como STIR/SHAKEN.", "updated_at": "2026-10-04", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Jacob Williams", "Matthew Edwards", "Joseph Gardiner"], "doi": "10.48550/arxiv.2410.17731", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["OT/ICS", "Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed and the authors' reported findings have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se han verificado de manera independiente los hallazgos reportados por los autores.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "a side-channel method of covertly identifying ICS honeypots using the time-to-live (TTL) values", "source_sha256": "33e1e3482fde8fa767df7564585e736cc7ac5643a9857b397fb1698fb18eed4d", "source_title": "Time-to-Lie: Identifying Industrial Control System Honeypots Using the Internet Control Message Protocol", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2410-17731", "kind": "paper", "name": "Time-to-Lie: Identifying Industrial Control System Honeypots Using the Internet Control Message Protocol", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2410-17731", "source_url": "https://arxiv.org/abs/2410.17731", "status": "published", "summary_en": "The authors present a side-channel method for covertly identifying industrial control system (ICS) honeypots using time-to-live (TTL) values in the ICMP protocol. In a study of over 8,000 devices presenting as ICS systems, they compare their approach to existing honeypot detection methods and describe what their methodology reveals about the current population of live ICS honeypots.", "summary_es": "Los autores presentan un método de canal lateral para identificar de forma encubierta honeypots de sistemas de control industrial (ICS) utilizando valores de tiempo de vida (TTL) en el protocolo ICMP. En un estudio de más de 8,000 dispositivos que se presentan como sistemas ICS, comparan su enfoque con métodos existentes de detección de honeypots y describen lo que revela su metodología sobre la población actual de honeypots ICS activos.", "updated_at": "2026-10-04", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Olaf Sassnick", "Georg Schäfer", "Thomas Rosenstatter", "Stefan Huber"], "doi": "10.48550/arxiv.2410.21574", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["OT/ICS"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; no full-text reading or independent verification of the authors' reported results was performed.", "limitations_es": "Esta ficha se basa únicamente en el título y el resumen disponibles públicamente; no se realizó lectura del texto completo ni verificación independiente de los resultados reportados por los autores.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "a generative model-based honeypot designed to mimic industrial OPC UA communication", "source_sha256": "22e515382f3b202cfc14a9860e2fbd85dbb7c4ab1bd20d9a43e8fec57b06945f", "source_title": "A Generative Model Based Honeypot for Industrial OPC UA Communication", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2410-21574", "kind": "paper", "name": "A Generative Model Based Honeypot for Industrial OPC UA Communication", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2410-21574", "source_url": "https://arxiv.org/abs/2410.21574", "status": "published", "summary_en": "The authors present a generative model-based honeypot (using an LSTM network) designed to mimic industrial OPC UA communication in operational technology (OT) systems. The model learns the characteristics of a cyclic mechatronic system from recorded state space trajectories. The work proposes a proof-of-concept and publishes a dataset of a cyclic industrial process to support future research.", "summary_es": "Los autores presentan un honeypot basado en un modelo generativo (red LSTM) diseñado para imitar la comunicación industrial OPC UA en sistemas de tecnología operativa (OT). El modelo aprende las características de un sistema mecatrónico cíclico a partir de trayectorias de estado registradas. El trabajo propone una prueba de concepto y publica un conjunto de datos de un proceso industrial cíclico para apoyar investigaciones futuras.", "updated_at": "2026-10-04", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Scott Seidenberger", "Anindya Maiti"], "doi": "10.48550/arxiv.2411.14623", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; no full-text reading or independent verification of the authors' reported results was performed.", "limitations_es": "Esta ficha se basa únicamente en el título y el resumen disponibles públicamente; no se realizó lectura del texto completo ni verificación independiente de los resultados reportados por los autores.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "deploying a series of honeypots alongside actual Ethereum nodes across globally distributed vantage points", "source_sha256": "7b17a3adb33ba2e5c60624ac77a295e4c587008fa62b0d8c5c2d707f633cfaa0", "source_title": "Initial Evidence of Elevated Reconnaissance Attacks Against Nodes in P2P Overlay Networks", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2411-14623", "kind": "paper", "name": "Initial Evidence of Elevated Reconnaissance Attacks Against Nodes in P2P Overlay Networks", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2411-14623", "source_url": "https://arxiv.org/abs/2411.14623", "status": "published", "summary_en": "The authors investigate whether peer-to-peer (P2P) overlay network nodes, specifically Ethereum network nodes, attract heightened reconnaissance attacks due to their visibility and sustained uptime. They deploy a series of honeypots alongside real Ethereum nodes across globally distributed vantage points. The authors report findings on specific attack types targeting particular ports and services, extending the analysis through port scans on other reachable peers.", "summary_es": "Los autores investigan si los nodos de redes superpuestas peer-to-peer (P2P), concretamente nodos de la red Ethereum, son objetivo de ataques de reconocimiento más intensos debido a su visibilidad y disponibilidad sostenida. Para ello despliegan una serie de honeypots junto a nodos reales de Ethereum en ubicaciones distribuidas globalmente. Los autores reportan hallazgos sobre tipos específicos de ataques dirigidos a puertos y servicios particulares, y extienden el análisis mediante escaneos de puertos a otros pares alcanzables de la red.", "updated_at": "2026-10-04", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Jason Landsborough", "Neil C. Rowe", "Thuy D. Nguyen", "Sunny Fugate"], "doi": "10.48550/arxiv.2412.16430", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "Endpoint"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text was not reviewed and the effectiveness of the described prototype has not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha verificado de forma independiente la eficacia del prototipo descrito.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "We are studying implementation of deception-in-depth strategies with initially three logical layers: network, host, and data.", "source_sha256": "7a58efb1990e1408603546bbea1c7f44e45e16f1dc7e894db7b58d122bda6b6f", "source_title": "WiP: Deception-in-Depth Using Multiple Layers of Deception", "tags": [], "techniques": ["Honeypot", "Decoy", "Moving target defense"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2412-16430", "kind": "paper", "name": "WiP: Deception-in-Depth Using Multiple Layers of Deception", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2412-16430", "source_url": "https://arxiv.org/abs/2412.16430", "status": "published", "summary_en": "This work-in-progress paper studies the implementation of deception-in-depth strategies with three initial logical layers: network, host, and data. The authors draw on ideas from military deception, network orchestration, software deception, file deception, fake honeypots, and moving-target defenses, and are building a prototype to test in adversarial environments. According to the authors, the goal is to show that deploying a broad range of deception techniques can better protect systems than single techniques, with a focus on discouraging attacks rather than encouraging attacker engagement.", "summary_es": "Este trabajo en progreso estudia la implementación de estrategias de engaño en profundidad con tres capas lógicas iniciales: red, host y datos. Los autores combinan ideas de engaño militar, orquestación de red, engaño de software, engaño de archivos, honeypots falsos y defensas de objetivo móvil, construyendo un prototipo que será probado en entornos adversarios. Según los autores, el objetivo es mostrar que desplegar un amplio rango de técnicas de engaño puede proteger mejor los sistemas que usar técnicas aisladas, enfocándose en desalentar ataques en lugar de fomentar la interacción activa del atacante.", "updated_at": "2026-10-04", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Shihab Ahmed", "A B M Mohaimenur Rahman", "Md Morshed Alam", "Md Sajidul Islam Sajid"], "doi": "10.48550/arxiv.2501.00940", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Endpoint", "Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text was not reviewed and the reported results have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se han verificado de forma independiente los resultados reportados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "We introduce a systematic framework (SPADE) to address inherent challenges large language models (LLMs) pose to adaptive deceptions", "source_sha256": "654ec59e4e1cbfcd120a1bbf7f135cc7f8276e1309780def1e92afe10952c6d9", "source_title": "SPADE: Enhancing Adaptive Cyber Deception Strategies with Generative AI and Structured Prompt Engineering", "tags": [], "techniques": ["Adversary engagement", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2501-00940", "kind": "paper", "name": "SPADE: Enhancing Adaptive Cyber Deception Strategies with Generative AI and Structured Prompt Engineering", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2501-00940", "source_url": "https://arxiv.org/abs/2501.00940", "status": "published", "summary_en": "This study proposes SPADE, a framework that uses generative AI models alongside structured prompt engineering to automate the creation of adaptive cyber deception strategies against dynamic malware. According to the authors, the framework addresses challenges of large language models such as generalized outputs, ambiguity, and scalability constraints, and was evaluated across diverse malware scenarios using metrics like Recall, Exact Match, BLEU, and expert quality assessments, identifying ChatGPT-4o as the top performer.", "summary_es": "Este estudio propone SPADE, un marco que utiliza modelos de IA generativa junto con ingeniería de prompts estructurada para automatizar la creación de estrategias adaptativas de engaño cibernético frente a malware dinámico. Según los autores, el marco aborda desafíos de los modelos de lenguaje grandes como salidas generalizadas, ambigüedad y escalabilidad, y fue evaluado en escenarios de malware diversos usando métricas como Recall, Exact Match, BLEU y evaluaciones de expertos, identificando a ChatGPT-4o como el de mejor desempeño.", "updated_at": "2026-10-04", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Yixu Wang", "Tianle Gu", "Yan Teng", "Yingchun Wang", "Xingjun Ma"], "doi": "10.48550/arxiv.2501.01090", "doi_aliases": ["10.1609/aaai.v39i8.32872"], "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Application"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text was not reviewed and the reported effectiveness has not been independently verified.", "limitations_es": "Esta ficha se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha verificado de forma independiente la efectividad reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "replaces the classification layer of the victim model with a honeypot layer", "source_sha256": "d378c0ba6cf10ee5a31bb1f1480f05f6d798a9e666360c7592c49512429bf028", "source_title": "HoneypotNet: Backdoor Attacks Against Model Extraction", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2501-01090", "kind": "paper", "name": "HoneypotNet: Backdoor Attacks Against Model Extraction", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2501-01090", "source_url": "https://arxiv.org/abs/2501.01090", "status": "published", "summary_en": "According to the authors, this work proposes a defense paradigm called 'attack as defense' against model extraction attacks. They introduce HoneypotNet, which replaces the victim model's classification layer with a honeypot layer fine-tuned via bi-level optimization to poison any substitute model trained on its outputs, while preserving original performance.", "summary_es": "Este trabajo, según sus autores, propone un paradigma de defensa llamado 'ataque como defensa' contra ataques de extracción de modelos. Introducen HoneypotNet, un método que reemplaza la capa de clasificación del modelo víctima por una capa trampa (honeypot) ajustada mediante optimización bi-nivel para envenenar la salida de cualquier modelo sustituto entrenado con ella, manteniendo el rendimiento original.", "updated_at": "2026-10-04", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Anthony Cheuk Tung Lai", "Siu Ming Yiu", "Ping Fan Ke", "Alan Ho"], "doi": "10.48550/arxiv.2502.02230", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text was not reviewed and the described experiment has not been replicated.", "limitations_es": "Esta ficha se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha replicado el experimento descrito.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "realistic honeypots with very similar business context as the real system are deployed to trap the attackers", "source_sha256": "83ecc31a3c079d832806624b3af4ad100724249246dbdd3c6f0f99fba1992938", "source_title": "An Attack-Driven Incident Response and Defense System (ADIRDS)", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2502-02230", "kind": "paper", "name": "An Attack-Driven Incident Response and Defense System (ADIRDS)", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2502-02230", "source_url": "https://arxiv.org/abs/2502.02230", "status": "published", "summary_en": "The authors present ADIRDS, an online monitoring system that models the real system as a graph and monitors critical assets, deploying realistic honeypots with business context similar to the real system to trap attackers and collect evidence when logs are insufficient. According to the authors, they applied the system to a real case, capturing 38 unique attacker IP addresses.", "summary_es": "Los autores presentan ADIRDS, un sistema de monitoreo en línea que modela el sistema real como un grafo y vigila activos críticos, desplegando honeypots realistas con contexto empresarial similar al sistema real para atrapar atacantes y recolectar evidencia cuando los registros son insuficientes. Según los autores, aplicaron el sistema a un caso real capturando 38 direcciones IP de atacantes únicas.", "updated_at": "2026-10-04", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Mario Kahlhofer", "Matteo Golinelli", "Stefan Rass"], "doi": "10.48550/arxiv.2504.02431", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Cloud", "Application"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed and the authors' claims have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se han verificado de forma independiente las afirmaciones de los autores.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "facilitates the setup, rotation, monitoring, and removal of traps in Kubernetes", "source_sha256": "b3c8c5329574d87cb2b63b7aa781b035c898fbced64ac31e5c5e3d6807449c6d", "source_title": "Koney: A Cyber Deception Orchestration Framework for Kubernetes", "tags": [], "techniques": ["Decoy", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2504-02431", "kind": "paper", "name": "Koney: A Cyber Deception Orchestration Framework for Kubernetes", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2504-02431", "source_url": "https://arxiv.org/abs/2504.02431", "status": "published", "summary_en": "The authors present Koney, a Kubernetes operator that orchestrates cyber deception technology deployment through deception policy documents described as code. Using cloud-native technologies such as service meshes and eBPF, the system adds traps to containerized applications without source code access, facilitating setup, rotation, monitoring, and removal of traps, emphasizing maintainability, scalability, and operational simplicity.", "summary_es": "Los autores presentan Koney, un operador de Kubernetes que orquesta la implementación de tecnología de engaño cibernético mediante documentos de política de engaño descritos como código. Utilizando tecnologías cloud-native como mallas de servicio y eBPF, el sistema agrega trampas a aplicaciones contenedorizadas sin acceso al código fuente, facilitando la configuración, rotación, monitoreo y eliminación de trampas, con énfasis en mantenibilidad, escalabilidad y simplicidad operativa.", "updated_at": "2026-10-04", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Dongyoung Park", "Gaby G. Dagher"], "doi": "10.48550/arxiv.2505.16049", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed and the authors' claims have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se han verificado de forma independiente las afirmaciones de los autores.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "the values of network nodes and the costs of deploying honeypots", "source_sha256": "78ca8bcce494c3a903f1b09c16eb07bbfcd34ba92bbf459ae58135bb1bfb02dd", "source_title": "A Non-Zero-Sum Game Model for Optimal Cyber Defense Strategies", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2505-16049", "kind": "paper", "name": "A Non-Zero-Sum Game Model for Optimal Cyber Defense Strategies", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2505-16049", "source_url": "https://arxiv.org/abs/2505.16049", "status": "published", "summary_en": "The authors propose a non-zero-sum game theoretical model to represent strategic interactions between cyber attackers and defenders, incorporating payoff functions that consider exploit probabilities and costs, network node values, and honeypot deployment costs. Through simulations, they derive Nash equilibria to inform strategic defense decisions, finding that high-probability, low-cost exploits like phishing require prioritized defense mechanisms.", "summary_es": "Los autores proponen un modelo teórico de juegos de suma no nula para representar las interacciones estratégicas entre atacantes y defensores cibernéticos, incorporando funciones de pago que consideran probabilidades y costos de exploits, valores de nodos de red y costos de despliegue de honeypots. Mediante simulaciones, derivan equilibrios de Nash para informar decisiones estratégicas de defensa, encontrando que exploits de alta probabilidad y bajo costo como phishing requieren mecanismos de defensa priorizados.", "updated_at": "2026-10-04", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Scott Seidenberger", "Anindya Maiti"], "doi": "10.48550/arxiv.2505.18290", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the study's effectiveness or conclusions have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha verificado de forma independiente la efectividad o conclusiones del estudio.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "integrating detailed Ethereum node metrics, network traffic metadata, and honeypot interaction logs", "source_sha256": "3e066e32a49f1cf8b7d7d1850b155c031489ac8b5c93d92928cc02d660b532e3", "source_title": "EtherBee: A Global Dataset of Ethereum Node Performance Measurements Coupled with Honeypot Interactions and Full Network Sessions", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2505-18290", "kind": "paper", "name": "EtherBee: A Global Dataset of Ethereum Node Performance Measurements Coupled with Honeypot Interactions and Full Network Sessions", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2505-18290", "source_url": "https://arxiv.org/abs/2505.18290", "status": "published", "summary_en": "According to the authors, this work introduces EtherBee, a global dataset integrating Ethereum node metrics, network traffic metadata, and honeypot interaction logs collected from ten geographically diverse vantage points over three months. The stated purpose is to correlate node data with network sessions and security events to study benign and malicious activity, node stability, and network-level threats, as well as a case study on geographic concentration from client optimizations.", "summary_es": "Según los autores, este trabajo presenta EtherBee, un conjunto de datos global que integra métricas de nodos Ethereum, metadatos de tráfico de red y registros de interacción con honeypots, recolectados desde diez puntos geográficos durante tres meses. El objetivo declarado es correlacionar datos de nodos con sesiones de red y eventos de seguridad para estudiar actividad benigna y maliciosa, estabilidad de nodos y amenazas a nivel de red, además de analizar cómo ciertas optimizaciones de clientes pueden concentrar geográficamente la red.", "updated_at": "2026-10-04", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Ya-Ting Yang", "Quanyan Zhu"], "doi": "10.48550/arxiv.2505.21244", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the study's effectiveness or conclusions have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha verificado de forma independiente la efectividad o conclusiones del estudio.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "strategic timing for cyber deception", "source_sha256": "ab62c9ccfd3d87f29b9118ed0c89772ddf9e10c0c34b9e8244c373eae8bc32d6", "source_title": "When to Deceive: A Cross-Layer Stackelberg Game Framework for Strategic Timing of Cyber Deception", "tags": [], "techniques": ["Adversary engagement", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2505-21244", "kind": "paper", "name": "When to Deceive: A Cross-Layer Stackelberg Game Framework for Strategic Timing of Cyber Deception", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2505-21244", "source_url": "https://arxiv.org/abs/2505.21244", "status": "published", "summary_en": "According to the authors, this study proposes a Stackelberg game-based framework for strategically timing cyber deception, combining a tactical layer modeling attacker-defender dynamics via a one-sided information Markov game with a strategic layer optimizing deception timing and selection through a stopping-time decision process. Numerical experiments, as reported by the authors, suggest that strategically timed deception can improve the defender's expected utility compared to baseline strategies.", "summary_es": "Según los autores, este estudio propone un marco basado en juegos de Stackelberg para diseñar el momento estratégico de aplicación de técnicas de engaño cibernético, con una capa táctica que modela la dinámica atacante-defensor mediante un juego de Markov con información unilateral, y una capa estratégica que optimiza el momento y selección de técnicas de engaño mediante un proceso de decisión de tiempo de parada. Los experimentos numéricos, según indican los autores, sugieren que el engaño cronometrado estratégicamente puede mejorar la utilidad esperada del defensor frente a estrategias base.", "updated_at": "2026-10-04", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Yueyue Xu", "Yuewei Chen", "Lin Wang", "Zhaoyang Cheng", "Xiaoming Hu"], "doi": "10.48550/arxiv.2507.11113", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": [], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the reported effectiveness has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "develop a discrete-time fictitious-play algorithm that couples Bayesian belief updates with empirical best responses", "source_sha256": "a5e335c0a5e37b6e689897871e427c826b4b7099485ae8371cdf8efb071893ac", "source_title": "Optimal Honeypot Ratio and Convergent Fictitious-Play Learning in Signaling Games for CPS Defense", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2507-11113", "kind": "paper", "name": "Optimal Honeypot Ratio and Convergent Fictitious-Play Learning in Signaling Games for CPS Defense", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2507-11113", "source_url": "https://arxiv.org/abs/2507.11113", "status": "published", "summary_en": "This paper models honeypot deployment in cyber-physical systems (CPS) as a signaling game with a fixed gamma ratio, deriving perfect Bayesian-Nash equilibria and proposing a fictitious-play algorithm to determine the optimal honeypot ratio that maximizes defense utility. The authors report numerical results that, as they state, confirm the method's effectiveness.", "summary_es": "Este artículo modela el despliegue de honeypots en sistemas ciberfísicos (CPS) como un juego de señalización con ratio gamma fijo, derivando equilibrios bayesianos perfectos y proponiendo un algoritmo de juego ficticio para determinar la proporción óptima de honeypots que maximiza la utilidad de defensa. Los autores presentan resultados numéricos que, según indican, confirman la efectividad del método propuesto.", "updated_at": "2026-10-11", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Junling Fan", "David Koblah", "Domenic Forte"], "doi": "10.48550/arxiv.2508.08462", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Endpoint"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the reported effectiveness has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "integrates cryptic and mimetic cyber deception principles to enhance IC security against RE", "source_sha256": "649836425efe101df2cfae4b09e9b7d9afa83c01f6966d28f202cf69d6618efb", "source_title": "Designing with Deception: ML- and Covert Gate-Enhanced Camouflaging to Thwart IC Reverse Engineering", "tags": [], "techniques": ["Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2508-08462", "kind": "paper", "name": "Designing with Deception: ML- and Covert Gate-Enhanced Camouflaging to Thwart IC Reverse Engineering", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2508-08462", "source_url": "https://arxiv.org/abs/2508.08462", "status": "published", "summary_en": "This work presents a machine learning-driven methodology combining cryptic and mimetic cyber deception principles to protect integrated circuits against reverse engineering attacks, using a variational autoencoder (AIG-VAE) and new covert gate variants. The authors report that experiments show effectiveness in maintaining functionality while achieving high camouflage and similarity scores.", "summary_es": "Este trabajo presenta una metodología impulsada por aprendizaje automático que combina principios de engaño cibernético críptico y mimético para proteger circuitos integrados frente a ataques de ingeniería inversa, utilizando un autoencoder variacional (AIG-VAE) y nuevas variantes de puertas encubiertas. Los autores informan que los experimentos muestran efectividad en mantener la funcionalidad mientras se logran altas puntuaciones de camuflaje y similitud.", "updated_at": "2026-10-04", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Pranjay Malhotra"], "doi": "10.48550/arxiv.2509.01463", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "Endpoint"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the reported system effectiveness has not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha verificado de forma independiente la efectividad reportada del sistema.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "an SSH honeypot that leverages Large Language Models (LLMs) to generate realistic, dynamic command outputs", "source_sha256": "06d1270167f88cc82c380e8c2cf880ed295cfbef0ed9844d79a54a0ad0843b7c", "source_title": "LLMHoney: A Real-Time SSH Honeypot with Large Language Model-Driven Dynamic Response Generation", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2509-01463", "kind": "paper", "name": "LLMHoney: A Real-Time SSH Honeypot with Large Language Model-Driven Dynamic Response Generation", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2509-01463", "source_url": "https://arxiv.org/abs/2509.01463", "status": "published", "summary_en": "The authors present LLMHoney, an SSH honeypot that uses large language models (LLMs) to generate realistic, dynamic command outputs in real time, combining a dictionary-based virtual file system with LLMs for novel inputs. According to the abstract, the system was evaluated on 138 representative Linux commands across 13 LLM variants, reporting accuracy, latency, and memory metrics, while discussing challenges such as occasional hallucinated outputs.", "summary_es": "Los autores presentan LLMHoney, un honeypot SSH que utiliza modelos de lenguaje grandes (LLM) para generar respuestas de comandos dinámicas y realistas en tiempo real, combinando un sistema de archivos virtual basado en diccionario con LLMs para entradas novedosas. Según el resumen, evaluaron el sistema con 138 comandos Linux representativos y 13 variantes de LLM, reportando métricas de precisión, latencia y uso de memoria, además de discutir desafíos como alucinaciones ocasionales.", "updated_at": "2026-10-04", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Enis Karaarslan", "Esin Güler", "Efe Emir Yüce", "Cagatay Coban"], "doi": "10.48550/arxiv.2509.05306", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text was not reviewed and the method's effectiveness has not been independently validated.", "limitations_es": "Esta ficha se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad del método.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "We present a lightweight and automated approach to process Cowrie honeypot logs.", "source_sha256": "804563bebc0658b27cb84b6e6734cce77f9c1df5f0baa1a5f74fbf0577c5605f", "source_title": "Towards Log Analysis with AI Agents: Cowrie Case Study", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2509-05306", "kind": "paper", "name": "Towards Log Analysis with AI Agents: Cowrie Case Study", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2509-05306", "source_url": "https://arxiv.org/abs/2509.05306", "status": "published", "summary_en": "This study, as described by the authors, explores the use of AI agents to automate the analysis of logs generated by the Cowrie honeypot, addressing the scarcity of real-world attack data in cybersecurity research. The proposed approach uses AI agents to parse, summarize, and extract insights from unstructured data, while also considering the security implications of deploying such an autonomous system.", "summary_es": "Este estudio, según los autores, explora el uso de agentes de IA para automatizar el análisis de registros generados por el honeypot Cowrie, abordando el problema de la escasez de datos reales de ataques en la investigación en ciberseguridad. El enfoque propuesto emplea agentes de IA para analizar, resumir y extraer información de datos sin estructurar, considerando además las implicaciones de seguridad de un sistema autónomo de este tipo.", "updated_at": "2026-10-04", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Ya-Ting Yang", "Quanyan Zhu"], "doi": "10.48550/arxiv.2509.05498", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text was not reviewed and the method's effectiveness has not been independently validated.", "limitations_es": "Esta ficha se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad del método.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "the proposed bi-level cyber warfare game focuses on \"strategic-level\" design for defensive deception mechanisms", "source_sha256": "067545134aaf3990041d2d7eb0fe34169b461071c295fae92ebead9861076ed4", "source_title": "Bi-Level Game-Theoretic Planning of Cyber Deception for Cognitive Arbitrage", "tags": [], "techniques": ["Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2509-05498", "kind": "paper", "name": "Bi-Level Game-Theoretic Planning of Cyber Deception for Cognitive Arbitrage", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2509-05498", "source_url": "https://arxiv.org/abs/2509.05498", "status": "published", "summary_en": "According to the authors, this paper proposes a bi-level cyber warfare game framework for designing defensive deception mechanisms that exploit the cognitive vulnerabilities of Advanced Persistent Threat (APT) attackers. The approach combines strategic-level deception design with tactical and operational actions, and the authors report numerical improvements in defender rewards through strategically timed deception deployment.", "summary_es": "Según los autores, este artículo propone un marco de juego cibernético bi-nivel para diseñar mecanismos de engaño defensivo que exploten las vulnerabilidades cognitivas de atacantes persistentes avanzados (APT). El enfoque combina un diseño estratégico de defensas de decepción con acciones tácticas y operativas, y los autores reportan mejoras numéricas en las recompensas totales del defensor mediante el despliegue oportuno de técnicas de engaño.", "updated_at": "2026-10-04", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Hossein Siadati", "Haadi Jafarian", "Sima Jafarikhah"], "doi": "10.48550/arxiv.2509.08493", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Identity", "Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed and the reported effectiveness or replicability has not been independently verified.", "limitations_es": "Esta ficha se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha verificado independientemente la efectividad o replicabilidad de los resultados reportados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "a proactive and emerging strategy involves using conversational honeypots to engage scammers and extract actionable threat intelligence", "source_sha256": "3ade72c6c8c887fcdbcb278e6aa6d538bce67595c8cbc22ae73d598e0d440ad8", "source_title": "Send to which account? Evaluation of an LLM-based Scambaiting System", "tags": [], "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2509-08493", "kind": "paper", "name": "Send to which account? Evaluation of an LLM-based Scambaiting System", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2509-08493", "source_url": "https://arxiv.org/abs/2509.08493", "status": "published", "summary_en": "This paper presents, according to the authors, the first large-scale real-world evaluation of an LLM-based scambaiting system, designed as a conversational honeypot to engage scammers and extract actionable threat intelligence such as mule bank accounts. Over a five-month deployment, the system initiated thousands of engagements, reporting an information disclosure rate and strong alignment between LLM-generated responses and human operator preferences.", "summary_es": "Este trabajo presenta, según los autores, la primera evaluación a gran escala en entorno real de un sistema de scambaiting basado en modelos de lenguaje grandes (LLM), diseñado como honeypot conversacional para interactuar con estafadores y extraer inteligencia de amenazas accionable, como cuentas mula bancarias. Durante cinco meses de despliegue, el sistema inició miles de interacciones, reportando una tasa de divulgación de información y un alto grado de alineación entre las respuestas generadas por el LLM y las preferencias de operadores humanos.", "updated_at": "2026-10-04", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Javier Jiménez-Román", "Florina Almenares-Mendoza", "Alfonso Sánchez-Macián"], "doi": "10.48550/arxiv.2509.16682", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Identity", "Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed and the system's performance or realism has not been independently verified.", "limitations_es": "Esta ficha se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha verificado independientemente el rendimiento o la realismo del sistema propuesto.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "the design and implementation of an LLM-based honeypot to simulate an LDAP server", "source_sha256": "cc9a1aa58adc5809da5155fd7cd0c7393a43487b1ff6424a7ecd0687249b3ad6", "source_title": "Design and Development of an Intelligent LLM-based LDAP Honeypot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2509-16682", "kind": "paper", "name": "Design and Development of an Intelligent LLM-based LDAP Honeypot", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2509-16682", "source_url": "https://arxiv.org/abs/2509.16682", "status": "published", "summary_en": "According to the authors, this work proposes the design and implementation of an LLM-based honeypot simulating an LDAP server, a protocol critical to identity and access management in organizations. The proposed solution aims to offer a flexible and realistic tool capable of convincingly interacting with attackers, contributing to early detection and threat analysis.", "summary_es": "Según los autores, este trabajo propone el diseño e implementación de un honeypot basado en modelos de lenguaje grandes (LLM) que simula un servidor LDAP, protocolo crítico para la gestión de identidad y acceso en organizaciones. La solución busca ofrecer una herramienta flexible y realista capaz de interactuar de forma convincente con atacantes, contribuyendo a la detección temprana y al análisis de amenazas.", "updated_at": "2026-10-04", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Abrar Shahid", "Ibteeker Mahir Ishum", "AKM Tahmidul Haque", "M Sohel Rahman", "A. B. M. Alim Al Islam"], "doi": "10.48550/arxiv.2510.05157", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been read and the findings have not been independently verified.", "limitations_es": "Esta ficha se basa únicamente en el título y resumen publicados; no se ha leído el texto completo ni se han verificado de forma independiente los hallazgos.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "honeypot traps, and multi-level rate-limiting defenses", "source_sha256": "1c96e3979bf03cf6739b9c6ca1647752826215914ac9f99d994405a66a76bc61", "source_title": "Adversarial Reinforcement Learning for Offensive and Defensive Agents in a Simulated Zero-Sum Network Environment", "tags": [], "techniques": ["Honeypot", "Adversary engagement", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2510-05157", "kind": "paper", "name": "Adversarial Reinforcement Learning for Offensive and Defensive Agents in a Simulated Zero-Sum Network Environment", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2510-05157", "source_url": "https://arxiv.org/abs/2510.05157", "status": "published", "summary_en": "The authors present a simulated Gym-based environment for adversarial reinforcement learning in network security, where attacker and defender agents trained with DQN compete under a zero-sum reward framework. The environment models brute-force attacks and reactive defenses, including honeypot traps and adaptive rate-limiting, and the authors report that defender observability and trap effectiveness create substantial barriers to successful attacks.", "summary_es": "Los autores presentan un entorno simulado tipo Gym para el aprendizaje por refuerzo adversarial en seguridad de redes, en el que agentes atacantes y defensores entrenados con DQN compiten en un marco de recompensa de suma cero. El entorno modela ataques de fuerza bruta y defensas reactivas, incluyendo trampas tipo honeypot y limitación de tasa adaptativa, y los autores reportan que la observabilidad del defensor y la efectividad de las trampas crean barreras sustanciales frente a los ataques.", "updated_at": "2026-10-04", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["ChenYu Wu", "Yi Wang", "Yang Liao"], "doi": "10.48550/arxiv.2510.15017", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Application"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed and the effectiveness reported by the authors has not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se ha verificado de forma independiente la eficacia reportada por los autores.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "We propose a honeypot-based proactive guardrail system that transforms risk avoidance into risk utilization.", "source_sha256": "4ccfe28d71e49b91e069d9af6c6557878c47cb09c151576c6f4f7611f84fff8f", "source_title": "Active Honeypot Guardrail System: Probing and Confirming Multi-Turn LLM Jailbreaks", "tags": [], "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2510-15017", "kind": "paper", "name": "Active Honeypot Guardrail System: Probing and Confirming Multi-Turn LLM Jailbreaks", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2510-15017", "source_url": "https://arxiv.org/abs/2510.15017", "status": "published", "summary_en": "According to the abstract, the authors propose a honeypot-based guardrail system that fine-tunes a bait model to generate ambiguous, non-actionable responses used as lures to probe user intent during multi-turn interactions with LLMs. The work introduces metrics (HUS and DER) to evaluate bait attractiveness and the safety-usability tradeoff, with initial experiments on a multi-turn jailbreak dataset applied to GPT-4o.", "summary_es": "Según el resumen, los autores proponen un sistema de guardrail basado en honeypot que utiliza un modelo señuelo ajustado para generar respuestas ambiguas y no accionables que sirven de cebo para detectar intenciones maliciosas durante interacciones de múltiples turnos con LLMs. El trabajo introduce métricas (HUS y DER) para evaluar la atracción del cebo y el equilibrio entre seguridad y usabilidad, con experimentos iniciales sobre un conjunto de datos de jailbreak multi-turno aplicados a GPT-4o.", "updated_at": "2026-10-04", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["B. R. Turner", "O. Guidetti", "N. M. Karie", "R. Ryan", "Y. Yan"], "doi": "10.48550/arxiv.2512.03641", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the proposed model has not been experimentally validated according to the authors themselves, and the full text has not been reviewed.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; el modelo propuesto no ha sido validado experimentalmente según los propios autores, y no se ha revisado el texto completo.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "These experiments have not yet been conducted, and no experimental findings are presented in this paper.", "source_sha256": "35a9cc6eaacf54430b112cc63408c6e39bde908c3817bfd13cc500d631de4e97", "source_title": "A Descriptive Model for Modelling Attacker Decision-Making in Cyber-Deception", "tags": [], "techniques": ["Decoy", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2512-03641", "kind": "paper", "name": "A Descriptive Model for Modelling Attacker Decision-Making in Cyber-Deception", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2512-03641", "source_url": "https://arxiv.org/abs/2512.03641", "status": "published", "summary_en": "According to the abstract, the authors present a descriptive model incorporating psychological and strategic factors (belief, scepticism, deception fidelity, reconnaissance, and experience) to explain an attacker's initial decision to engage or withdraw from cyber-deception techniques. The authors state they have designed experiments using Capture the Flag activities and biometric observations to evaluate the model, but explicitly clarify that these experiments have not yet been conducted and no experimental findings are presented in the paper.", "summary_es": "Según el resumen, los autores presentan un modelo descriptivo que incorpora factores psicológicos y estratégicos (creencia, escepticismo, fidelidad del engaño, reconocimiento y experiencia) para explicar la decisión inicial de un atacante de comprometerse o retirarse frente a técnicas de ciberengaño. Los autores indican que han diseñado experimentos con actividades tipo Capture the Flag y observaciones biométricas para evaluar el modelo, pero aclaran explícitamente que estos experimentos aún no se han realizado y no se presentan resultados experimentales en el artículo.", "updated_at": "2026-10-04", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Darren Malvern Chin", "Bilal Isfaq", "Simon Yusuf Enoch"], "doi": "10.48550/arxiv.2512.05321", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Cloud", "Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the reported effectiveness has not been independently validated.", "limitations_es": "Esta ficha se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "leverages medium- to high-interaction honeypot telemetry to dynamically update firewall rules in real time", "source_sha256": "16cf4aa59821174359a7d4b431ff4e945fd568a1c178a8aff0ec729b0e88788c", "source_title": "A Practical Honeypot-Based Threat Intelligence Framework for Cyber Defence in the Cloud", "tags": [], "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2512-05321", "kind": "paper", "name": "A Practical Honeypot-Based Threat Intelligence Framework for Cyber Defence in the Cloud", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2512-05321", "source_url": "https://arxiv.org/abs/2512.05321", "status": "published", "summary_en": "This paper introduces an automated cloud defense framework that leverages medium- to high-interaction honeypot telemetry to dynamically update firewall rules in real time. According to the authors, the system integrates the Cowrie honeypot, Azure-native automation tools, and MITRE ATT&CK-aligned classification within a closed-loop feedback mechanism. The authors report an average Mean Time to Block of 0.86 seconds and classification of over 12,000 SSH attempts in experimental testing.", "summary_es": "Este artículo presenta un marco de defensa automatizado para entornos de nube que utiliza telemetría de honeypots de interacción media a alta para actualizar reglas de firewall en tiempo real. Según los autores, el sistema integra el honeypot Cowrie, herramientas nativas de Azure y clasificación alineada con MITRE ATT&CK dentro de un ciclo de retroalimentación cerrado. Los autores reportan un tiempo medio de bloqueo de 0.86 segundos y la clasificación de más de 12,000 intentos SSH en pruebas experimentales.", "updated_at": "2026-10-04", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Tonia Haikal", "Eman Hammad", "Shereen Ismail"], "doi": "10.48550/arxiv.2512.06557", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "IoT"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the described analysis has not been independently replicated.", "limitations_es": "Esta ficha se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha replicado de forma independiente el análisis descrito.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "HoneyTrap, an adaptive honeypot framework deployed across geographically distributed nodes to emulate vulnerable services", "source_sha256": "ef1b0b6a32562499bbab3ba4ca0da7819111541d27021a39deac2325dbcd7053", "source_title": "Characterizing Large-Scale Adversarial Activities Through Large-Scale Honey-Nets", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2512-06557", "kind": "paper", "name": "Characterizing Large-Scale Adversarial Activities Through Large-Scale Honey-Nets", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2512-06557", "source_url": "https://arxiv.org/abs/2512.06557", "status": "published", "summary_en": "This work presents a longitudinal analysis of attacker behavior using HoneyTrap, an adaptive honeypot framework deployed across geographically distributed nodes to emulate vulnerable services. According to the authors, more than 60.3 million events were collected over a 24-day window, with data transformed into Parquet format for scalable analytics. The authors report that HTTP/HTTPS traffic and SSH brute-force attacks were predominant, alongside activity targeting less common services like Minecraft and SMB.", "summary_es": "Este trabajo presenta un análisis longitudinal del comportamiento de atacantes mediante HoneyTrap, un marco de honeypots adaptativos desplegado en nodos distribuidos geográficamente para emular servicios vulnerables. Según los autores, se recopilaron más de 60.3 millones de eventos durante 24 días, con los datos transformados a formato Parquet para análisis escalable. Los autores informan que el tráfico HTTP/HTTPS y los ataques de fuerza bruta SSH fueron predominantes, junto con actividad dirigida a servicios menos comunes como Minecraft y SMB.", "updated_at": "2026-10-04", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Nawshad Ahmed Evan", "Md Raihan Uddin"], "doi": "10.48550/arxiv.2512.07180", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been read and the effectiveness of the implementation has not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha leído el texto completo ni se ha verificado de forma independiente la eficacia de la implementación.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "the honeypot stands out as a highly effective tool; it is designed to mimic both a scanner and an attacker", "source_sha256": "5f03648a93a4293cb2d452e4daa0a2467f44611dafff8d34f7076ed85b561fbf", "source_title": "Implementation of Honeynet and Honeypot in Network Infrastructure in Production Network", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2512-07180", "kind": "paper", "name": "Implementation of Honeynet and Honeypot in Network Infrastructure in Production Network", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2512-07180", "source_url": "https://arxiv.org/abs/2512.07180", "status": "published", "summary_en": "This paper presents the implementation of a honeynet in which a honeypot acts as a real resource within a production network environment, aiming to divert and mislead attackers and analyze their behavior. According to the authors, the honeypot mimics both scanners and attackers within a simulated, production-level environment.", "summary_es": "Este artículo presenta la implementación de un honeynet en el que un honeypot simula ser un recurso real dentro de un entorno de red de producción, con el objetivo de desviar y engañar a atacantes y analizar su comportamiento. Según los autores, el honeypot actúa como señuelo imitando tanto escáneres como atacantes dentro de un entorno simulado a nivel de producción.", "updated_at": "2026-10-04", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Lukas Johannes Möller"], "doi": "10.48550/arxiv.2512.07827", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the authors themselves state that field-scale validation is not claimed, and the full text has not been read.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; los propios autores indican que no se reivindica validación a escala real, y no se ha leído el texto completo del artículo.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "a functional prototype of the central decision mechanism, in which a reinforcement learning (RL) agent determines, in real time, when sessions should be escalated", "source_sha256": "d47168aeaf6f42f2a881aae93eaa998ade43c984f7fdfbd552598525e09c76dd", "source_title": "An Adaptive Multi-Layered Honeynet Architecture for Threat Behavior Analysis via Deep Learning", "tags": [], "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2512-07827", "kind": "paper", "name": "An Adaptive Multi-Layered Honeynet Architecture for Threat Behavior Analysis via Deep Learning", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2512-07827", "source_url": "https://arxiv.org/abs/2512.07827", "status": "published", "summary_en": "The authors propose ADLAH, a conceptual adaptive honeynet architecture using reinforcement learning to decide in real time when to escalate sessions from low-interaction sensors to dynamically provisioned high-interaction honeypots. It is described as a functional prototype of the central decision mechanism, without field-scale validation due to insufficient live data.", "summary_es": "Los autores proponen ADLAH, una arquitectura conceptual de honeynet adaptativo que emplea aprendizaje por refuerzo para decidir en tiempo real cuándo escalar sesiones desde sensores de baja interacción hacia honeypots de alta interacción provisionados dinámicamente. Se describe como un prototipo del mecanismo central de decisión, sin validación a escala real debido a la falta de datos en vivo suficientes.", "updated_at": "2026-10-04", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Siyuan Li", "Xi Lin", "Jun Wu", "Zehao Liu", "Haoyu Li", "Tianjie Ju", "Xiang Chen", "Jianhua Li"], "doi": "10.48550/arxiv.2601.04034", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Application"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed and no effectiveness claims have been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha verificado de forma independiente ninguna afirmación de eficacia.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "Unlike simple rejection, HoneyTrap strategically wastes attacker resources without impacting benign queries, improving MSR and ARC by 118.11% and 149.16%, respectively.", "source_sha256": "e1c0f9b3d02e7dec9f2dea52ebc866d78b73e48b3f3326d0943060638ec6a217", "source_title": "HoneyTrap: Deceiving Large Language Model Attackers to Honeypot Traps with Resilient Multi-Agent Defense", "tags": [], "techniques": ["Honeypot", "Adversary engagement", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2601-04034", "kind": "paper", "name": "HoneyTrap: Deceiving Large Language Model Attackers to Honeypot Traps with Resilient Multi-Agent Defense", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2601-04034", "source_url": "https://arxiv.org/abs/2601.04034", "status": "published", "summary_en": "According to the authors, HoneyTrap is a deceptive defense framework for large language models that employs four collaborative defender agents to counter multi-turn jailbreak attacks by directing attackers toward honeypot traps. The authors also introduce a progressive multi-turn jailbreak dataset (MTJ-Pro) and two new evaluation metrics for deceptive defense. They report reductions in attack success rates across several commercial and open-source models.", "summary_es": "Según los autores, HoneyTrap es un marco de defensa engañosa para modelos de lenguaje grandes (LLM) que utiliza cuatro agentes defensores colaborativos para contrarrestar ataques de jailbreak de múltiples turnos, dirigiendo a los atacantes hacia trampas tipo honeypot. Los autores introducen también un conjunto de datos de jailbreak progresivo multi-turno (MTJ-Pro) y dos métricas nuevas para evaluar la defensa engañosa. Reportan reducciones en la tasa de éxito de ataques en varios modelos comerciales y de código abierto.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Enrique Feito-Casares", "Ismael Gómez-Talal", "José-Luis Rojo-Álvarez"], "doi": "10.48550/arxiv.2601.05813", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Cloud", "Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the dataset's quality or representativeness has not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha verificado de forma independiente la calidad o representatividad del conjunto de datos.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "comprehensive, high-resolution honeynet dataset designed to support standalone analyses of global cyberattack behaviors", "source_sha256": "a5730fabc26bd420c56f5d2a56292d9cde832c52511e5d0f4418b0ebb6786895", "source_title": "Descriptor: Multi-Regional Cloud Honeypot Dataset (MURHCAD)", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2601-05813", "kind": "paper", "name": "Descriptor: Multi-Regional Cloud Honeypot Dataset (MURHCAD)", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2601-05813", "source_url": "https://arxiv.org/abs/2601.05813", "status": "published", "summary_en": "This data article presents MURHCAD, a high-resolution honeynet dataset collected over 72 hours in June 2025 on Microsoft Azure, using three honeypots (Cowrie, Dionaea, and SentryPeer) deployed across four geographically dispersed virtual machines. According to the authors, the dataset comprises 132,425 attack events with enriched metadata (timestamps, IPs, geolocation, ports, and protocols) intended to support anomaly detection, protocol-misuse studies, and threat intelligence research.", "summary_es": "Este artículo de datos presenta MURHCAD, un conjunto de datos de honeynet de alta resolución recolectado durante 72 horas en junio de 2025 sobre Microsoft Azure, utilizando tres honeypots (Cowrie, Dionaea y SentryPeer) desplegados en cuatro máquinas virtuales geográficamente dispersas. Según los autores, el conjunto incluye 132,425 eventos de ataque con metadatos enriquecidos (marcas temporales, IPs, geolocalización, puertos y protocolos) destinados a apoyar análisis de detección de anomalías, estudios de mal uso de protocolos e inteligencia de amenazas.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Elisa Botteghi", "Martino S. Centonze", "Davide Pastorello", "Daniele Tantari"], "doi": "10.48550/arxiv.2601.16805", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-pdf", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed nor the numerical findings independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni verificado de forma independiente los hallazgos numéricos.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "revealing patterns of resource allocation and cyber deception effects", "source_sha256": "4fb779ea3eff1c2062b505a16f1b5698033c4620839312999fbe9886f0cb554f", "source_title": "Network Security under Heterogeneous Cyber-Risk Profiles and Contagion", "tags": [], "techniques": ["Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2601-16805", "kind": "paper", "name": "Network Security under Heterogeneous Cyber-Risk Profiles and Contagion", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2601-16805", "source_url": "https://arxiv.org/abs/2601.16805", "status": "published", "summary_en": "The authors present a cyber-risk management framework for networked digital systems combining strategic game behavior with contagion dynamics. The study addresses optimal cybersecurity resource allocation considering heterogeneous node valuations by attackers and defenders, proposing contagion-path-based risk measures and analyzing cyber deception effects through numerical experiments.", "summary_es": "Los autores presentan un marco de gestión de ciber-riesgo para sistemas digitales en red que combina teoría de juegos estratégicos con dinámicas de contagio. El estudio aborda la asignación óptima de recursos de ciberseguridad considerando valoraciones heterogéneas de nodos por atacantes y defensores, proponiendo medidas de riesgo basadas en rutas de contagio y analizando efectos de la ciberengaño mediante experimentos numéricos.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Yuhao Wang", "Shengfang Zhai", "Guanghao Jin", "Yinpeng Dong", "Linyi Yang", "Jiaheng Zhang"], "doi": "10.48550/arxiv.2602.07517", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Application"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been read nor have the reported detection results been independently replicated or validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha leído el texto completo ni se han replicado o validado de forma independiente los resultados de detección reportados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "injecting optimized honeypots into the memory", "source_sha256": "840defdce3fa169c481612149a4b13ffd03963f5b1b42ddd86bfa51922b59f69", "source_title": "MemPot: Defending Against Memory Extraction Attack with Optimized Honeypots", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2602-07517", "kind": "paper", "name": "MemPot: Defending Against Memory Extraction Attack with Optimized Honeypots", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2602-07517", "source_url": "https://arxiv.org/abs/2602.07517", "status": "published", "summary_en": "The authors propose MemPot, a defense framework that injects optimized honeypots into the memory of large language model (LLM)-based agents to counter extraction attacks. Through a two-stage optimization process and a detection model based on Wald's Sequential Probability Ratio Test, the authors report improved detection performance over existing baselines in their experiments.", "summary_es": "Los autores proponen MemPot, un marco de defensa que inyecta honeypots optimizados en la memoria de agentes basados en modelos de lenguaje grande (LLM) para contrarrestar ataques de extracción. Mediante un proceso de optimización en dos etapas y un modelo basado en la prueba de razón de probabilidad secuencial de Wald, los autores afirman que el sistema mejora la detección frente a líneas base existentes, según sus experimentos.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Hao Yu", "Hui Li", "FengYuan Shi", "Wenjie Yu", "PinHan Ho", "Zehua Wang", "Bin Wang"], "doi": "10.48550/arxiv.2603.02963", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Application"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the reported results have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha verificado de forma independiente la validez de los resultados reportados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "constructing a high-quality request-response dataset via a multi-agent honeypot system", "source_sha256": "066ac9e67bbf1ecdbf07b67ad06c819cd2fd69fedb86c7e2555bc5f4c56eb022", "source_title": "Multi-Agent Honeypot-Based Request-Response Context Dataset for Improved SQL Injection Detection Performance", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2603-02963", "kind": "paper", "name": "Multi-Agent Honeypot-Based Request-Response Context Dataset for Improved SQL Injection Detection Performance", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2603-02963", "source_url": "https://arxiv.org/abs/2603.02963", "status": "published", "summary_en": "This paper presents a context-enriched SQL injection detection framework built via a multi-agent honeypot system that generates malicious/benign requests, mediates authentic database responses while protecting production data, and pairs requests with responses to create a labeled dataset of 140,973 pairs. The authors state that models trained on this dataset outperform payload-only counterparts.", "summary_es": "Este artículo presenta un marco de detección de inyección SQL enriquecido con contexto, construido mediante un sistema honeypot multi-agente que genera solicitudes maliciosas/benignas, media respuestas de base de datos auténticas protegiendo datos de producción, y empareja solicitudes con respuestas para crear un conjunto de datos etiquetado de 140,973 pares. Los autores afirman que modelos entrenados con este conjunto superan a los basados solo en payloads.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Yiling Tao", "Xinran Zheng", "Shuo Yang", "Meiling Tao", "Xingjun Wang"], "doi": "10.48550/arxiv.2603.13940", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Application"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the reported results have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha verificado de forma independiente la validez de los resultados reportados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "active honeypot inducement, and structural pruning, to identify and isolate collusive agents", "source_sha256": "5f26956d2f99fa365e0a27f77e826b6a1b82f0f3a7e26e348cf618b597921779", "source_title": "GroupGuard: A Framework for Modeling and Defending Collusive Attacks in Multi-Agent Systems", "tags": [], "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2603-13940", "kind": "paper", "name": "GroupGuard: A Framework for Modeling and Defending Collusive Attacks in Multi-Agent Systems", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2603-13940", "source_url": "https://arxiv.org/abs/2603.13940", "status": "published", "summary_en": "This paper proposes GroupGuard, a training-free defense framework against group collusive attacks in large language model-based multi-agent systems. The approach combines continuous graph-based monitoring, active honeypot inducement, and structural pruning to identify and isolate collusive agents. The authors report high detection accuracy across experiments with five datasets and four topologies.", "summary_es": "Este artículo propone GroupGuard, un marco de defensa sin entrenamiento contra ataques colusorios grupales en sistemas multi-agente basados en modelos de lenguaje grande. El enfoque combina monitoreo continuo basado en grafos, inducción activa mediante honeypots y poda estructural para identificar y aislar agentes colusorios. Los autores reportan alta precisión de detección en experimentos con cinco conjuntos de datos y cuatro topologías.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Abhijeet Sahu", "Shuva Paul", "Richard Macwan"], "doi": "10.48550/arxiv.2603.17272", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "OT/ICS"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed and the effectiveness of the described strategies has not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se ha verificado de forma independiente la efectividad de las estrategias descritas.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "leveraging the fusion of large language models (LLMs) and reinforcement learning(RL) in optimally learning these cyber deception strategies", "source_sha256": "a5514d56d121741ca0796fa4edb65581cf54bdea2e03285c92e5930e3a1c7704", "source_title": "Network and Device Level Cyber Deception for Contested Environments Using RL and LLMs", "tags": [], "techniques": ["Honeypot", "Decoy", "Moving target defense"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2603-17272", "kind": "paper", "name": "Network and Device Level Cyber Deception for Contested Environments Using RL and LLMs", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2603-17272", "source_url": "https://arxiv.org/abs/2603.17272", "status": "published", "summary_en": "This paper, according to its authors, reviews AI-based solutions for building network- and device-level cyber deception methods in contested environments. It focuses on combining large language models (LLMs) and reinforcement learning (RL) to optimize deception strategies such as honeypots and honeynets, and examines their validation against stealthy attacks on operational technology (OT) systems reported in the literature.", "summary_es": "Este trabajo revisa, según sus autores, soluciones basadas en IA para construir estrategias de engaño cibernético a nivel de red y dispositivo en entornos disputados. Se enfoca en la combinación de modelos de lenguaje de gran tamaño (LLMs) y aprendizaje por refuerzo (RL) para optimizar estas estrategias de engaño, incluyendo honeypots y honeynets, y examina su validación frente a ataques sigilosos contra sistemas de tecnología operativa (OT) reportados en la literatura.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Zelin Wan", "Jin-Hee Cho", "Mu Zhu", "Ahmed H. Anwar", "Charles Kamhoua", "Munindar P. Singh"], "doi": "10.48550/arxiv.2603.20981", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["IoT", "Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed and the reported performance of the HT-DRL approach has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se ha validado de forma independiente el desempeño reportado del enfoque HT-DRL.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "honey drones (HDs) are proposed to bait and divert attacks", "source_sha256": "4e3020399557aad86bab6db034bd4c172abe2e4e96b1fd6e2ab78e1facf19957", "source_title": "Cyber Deception for Mission Surveillance via Hypergame-Theoretic Deep Reinforcement Learning", "tags": [], "techniques": ["Decoy", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2603-20981", "kind": "paper", "name": "Cyber Deception for Mission Surveillance via Hypergame-Theoretic Deep Reinforcement Learning", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2603-20981", "source_url": "https://arxiv.org/abs/2603.20981", "status": "published", "summary_en": "The authors propose using honey drones as a deception strategy to defend unmanned aerial vehicle (UAV) mission systems against denial-of-service attacks. They formulate an attacker-defender optimization problem based on radio signal strength and present an approach called HT-DRL, combining hypergame theory with deep reinforcement learning to identify optimal deception strategies.", "summary_es": "Los autores proponen el uso de drones señuelo (honey drones) como estrategia de engaño para defender sistemas de misión de vehículos aéreos no tripulados (UAV) contra ataques de denegación de servicio. Formulan un problema de optimización entre atacante y defensor basado en la fuerza de señal de radio y presentan un enfoque llamado HT-DRL, que combina teoría de hiperjuegos con aprendizaje por refuerzo profundo para identificar estrategias de engaño óptimas.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Thamilvendhan Munirathinam"], "doi": "10.48550/arxiv.2604.18248", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Application"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed and the reported methodology or results have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y el resumen publicados; no se ha revisado el texto completo ni se ha verificado de forma independiente la metodología o los resultados reportados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "d034 honeypot tool definitions (new in v4.0)", "source_sha256": "0a3bb59d277888640596987f5656a96ab278ad3b0345b126002916b9b888bd2c", "source_title": "Beyond Pattern Matching: Seven Cross-Domain Techniques for Prompt Injection Detection", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2604-18248", "kind": "paper", "name": "Beyond Pattern Matching: Seven Cross-Domain Techniques for Prompt Injection Detection", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2604-18248", "source_url": "https://arxiv.org/abs/2604.18248", "status": "published", "summary_en": "This paper proposes seven prompt-injection detection techniques that adapt mechanisms from disciplines outside LLM security, including forensic linguistics, materials-fatigue analysis, deception technology, bioinformatics sequence alignment, mechanism design, spectral analysis, and taint tracking. According to the authors, four of the seven techniques were implemented in the prompt-shield v0.7.3 tool, including honeypot tool definitions, and evaluated through ablations across nine benchmarks totaling approximately 10,300 samples.", "summary_es": "Este trabajo propone siete técnicas de detección de inyección de prompts que adaptan mecanismos de disciplinas externas a la seguridad de LLM, como lingüística forense, análisis de fatiga de materiales, tecnología de engaño (deception), alineamiento de secuencias de bioinformática, diseño de mecanismos, análisis espectral y seguimiento de contaminación (taint tracking). Según los autores, cuatro de las siete técnicas se implementaron en la herramienta prompt-shield v0.7.3, incluyendo definiciones de herramientas honeypot, y se evaluaron mediante ablaciones en nueve bancos de pruebas con aproximadamente 10.300 muestras.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Abraham Itzhak Weinberg"], "doi": "10.48550/arxiv.2605.02992", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "Application"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed and the reported results have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y el resumen publicados; no se ha revisado el texto completo ni se ha verificado de forma independiente la validez de los resultados reportados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "PHANTOM (Polymorphic Honeytoken Adaptation with Narrative-Tailored Organisational Mimicry), a framework that generates contextually convincing honeytokens", "source_sha256": "e5ef65d93748fc2a3845dde05b638360afde2c803a8fa6fae55b7dfb9b825f8e", "source_title": "PHANTOM: Polymorphic Honeytoken Adaptation with Narrative-Tailored Organisational Mimicry", "tags": [], "techniques": ["Honeytoken"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2605-02992", "kind": "paper", "name": "PHANTOM: Polymorphic Honeytoken Adaptation with Narrative-Tailored Organisational Mimicry", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2605-02992", "source_url": "https://arxiv.org/abs/2605.02992", "status": "published", "summary_en": "This paper introduces PHANTOM, a framework for generating honeytokens that encode organisation-specific knowledge (domain names, naming conventions, technology idioms, and secret-value distributions) through a multi-component generation pipeline. The authors propose a four-component Believability Score and use it to compare PHANTOM against a template-based baseline across several token types and organisational contexts.", "summary_es": "Este trabajo presenta PHANTOM, un marco para generar honeytokens que incorporan conocimiento específico de la organización (dominios, convenciones de nomenclatura, idiomas tecnológicos y distribuciones de valores secretos) mediante un pipeline de generación multicomponente. Los autores proponen una métrica de 'Believability Score' de cuatro componentes y la usan para comparar PHANTOM frente a un enfoque basado en plantillas en varios tipos de tokens y contextos organizacionales.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Matt Mittelsteadt", "Jam Kraprayoon", "Robin Staes-Polet", "Oskar Galeev", "Jan Wehner", "Christopher Covino", "Shaun Ee"], "doi": "10.48550/arxiv.2605.21956", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-pdf", "environments": ["Network", "Cloud"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the effectiveness of the proposed mechanisms has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha validado de forma independiente la eficacia de los mecanismos propuestos.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "Agent Honeypots", "source_sha256": "9d1ce780922d232b5556d798ef4e64e228133b9796de89408b904c0866c57dd3", "source_title": "Detecting Offensive Cyber Agents: A Detection-in-Depth Approach", "tags": [], "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2605-21956", "kind": "paper", "name": "Detecting Offensive Cyber Agents: A Detection-in-Depth Approach", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2605-21956", "source_url": "https://arxiv.org/abs/2605.21956", "status": "published", "summary_en": "This report addresses the challenge of detecting AI-driven offensive cyber agents, proposing a strategic 'detection-in-depth' framework. According to the authors, five detection mechanisms are presented, including agent identifiers and agent honeypots, intended to support policymakers and industry against this emerging threat.", "summary_es": "Este informe aborda el reto de detectar agentes de ciberataque basados en IA, proponiendo un marco estratégico de 'detección en profundidad'. Según los autores, se presentan cinco mecanismos de detección, incluyendo identificadores de agentes y honeypots de agentes, destinados a apoyar a responsables políticos e industria frente a esta amenaza emergente.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Mark Vero", "Fabian Kaczmarczyck", "Ivan Petrov", "Ilia Shumailov", "Jamie Hayes", "Niels Heinen", "Tianqi Fan", "Luca Invernizzi", "Martin Vechev"], "doi": "10.48550/arxiv.2605.29963", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "Application"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the described experiments have not been independently replicated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha replicado de forma independiente los experimentos descritos.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "a comprehensive evaluation framework for LLM-powered HTTP honeypots", "source_sha256": "14a6f4e1481094ae9eaf1d378e950160cc389b04fe6530c79986cacc1b382d14", "source_title": "Honeyval: A Comprehensive Evaluation Framework for LLM-powered HTTP Honeypots", "tags": [], "techniques": ["Honeypot", "Decoy", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2605-29963", "kind": "paper", "name": "Honeyval: A Comprehensive Evaluation Framework for LLM-powered HTTP Honeypots", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2605-29963", "source_url": "https://arxiv.org/abs/2605.29963", "status": "published", "summary_en": "This work presents Honeyval, an evaluation framework for LLM-powered HTTP honeypots. According to the authors, the framework uses AI hacking agents as attackers and diverse backend applications to reproducibly evaluate the performance and detectability of these honeypots compared to prior limited evaluation methods.", "summary_es": "Este trabajo presenta Honeyval, un marco de evaluación para honeypots HTTP impulsados por modelos de lenguaje grandes (LLM). Según los autores, el marco utiliza agentes de IA como atacantes y aplicaciones backend diversas para evaluar de forma reproducible el rendimiento y la detectabilidad de estos honeypots frente a métodos de evaluación previos limitados.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Kargi Chauhan", "Pratibha Revankar"], "doi": "10.48550/arxiv.2606.04141", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Application", "Identity"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the methodology or results, which the authors themselves describe as preliminary, have not been independently validated.", "limitations_es": "Esta ficha se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha validado de forma independiente la metodología o los resultados, que los propios autores describen como preliminares.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "we construct honeytokens from format-specific character models and calibrate detection with split conformal prediction", "source_sha256": "89e282da5b53c9d15df2543360d4ee916d983bcf1134cd51757b8502c509d3dd", "source_title": "Caught in the Act(ivation): Toward Pre-Output and Multi-Turn Detection of Credential Exfiltration by LLM Agents", "tags": [], "techniques": ["Honeytoken"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2606-04141", "kind": "paper", "name": "Caught in the Act(ivation): Toward Pre-Output and Multi-Turn Detection of Credential Exfiltration by LLM Agents", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2606-04141", "source_url": "https://arxiv.org/abs/2606.04141", "status": "published", "summary_en": "This work studies credential exfiltration by LLM agents via indirect prompt injection, proposing three complementary defenses according to the authors: activation probes for pre-output detection, honeytokens calibrated via split conformal prediction, and a cumulative leakage budget tracked across multi-turn conversations. The authors report preliminary results from controlled experiments on open-weight models and a small in-house multi-turn synthetic suite.", "summary_es": "Este trabajo estudia la exfiltración de credenciales por agentes LLM mediante inyección indirecta de prompts, proponiendo tres defensas complementarias según los autores: sondas de activación para detección previa a la salida, honeytokens calibrados mediante predicción conforme dividida, y un presupuesto acumulado de fuga de información a lo largo de conversaciones de múltiples turnos. Los autores reportan resultados preliminares en experimentos controlados con modelos de pesos abiertos y un conjunto sintético de múltiples turnos de tamaño reducido.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Cameron V. Cogburn", "Casimer DeCusatis", "Evan Spillane"], "doi": "10.48550/arxiv.2606.09469", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text was not reviewed and the reported effectiveness has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "mapping honeypot traffic partitioning to a weighted MaxCut problem and solving the resulting graphs with variational quantum algorithms", "source_sha256": "cd1686d1bae3a5e9f361938a36bee6bfdb143e45c61dde6fd9dde7ce71038501", "source_title": "Hardware-Aware QAOA for Honeypot Traffic Partitioning on 100+ Qubit IBM Quantum Processors", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2606-09469", "kind": "paper", "name": "Hardware-Aware QAOA for Honeypot Traffic Partitioning on 100+ Qubit IBM Quantum Processors", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2606-09469", "source_url": "https://arxiv.org/abs/2606.09469", "status": "published", "summary_en": "This work, according to its authors, addresses DoS/DDoS mitigation by separating malicious from benign traffic using honeypots, framing the problem as a weighted MaxCut solved with variational quantum algorithms (QAOA). The authors describe a reproducible honeypot-to-QUBO pipeline, labeled temporal bipartite benchmark graphs, QAOA executions on IBM hardware, classical heuristic baselines, and a routing overhead analysis across quantum processor architectures.", "summary_es": "Este trabajo, según sus autores, aborda la mitigación de ataques DoS/DDoS mediante la separación de tráfico malicioso y benigno usando honeypots, formulando el problema como un MaxCut ponderado resuelto con algoritmos cuánticos variacionales (QAOA). Los autores describen una canalización reproducible de eventos de honeypot a QUBO, grafos de referencia bipartitos temporales etiquetados, ejecuciones de QAOA en hardware de IBM, líneas base heurísticas clásicas y un análisis de sobrecarga de enrutamiento entre arquitecturas de procesadores cuánticos.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Yuyang Dai", "Yushun Dong"], "doi": "10.48550/arxiv.2606.15810", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Application"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text was not reviewed and the reported effectiveness has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen publicados; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "redirects extraction attacks toward low-transferability knowledge through a \\emph{Honeypot Knowledge Graph}", "source_sha256": "14fa7042ef9db635e3ed58ed3f7c453b342baf3c551af7ebf8e1bd2c04250b83", "source_title": "Let Them Steal: Trapping Large Language Model Extraction Attacks with Knowledge Honeypot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2606-15810", "kind": "paper", "name": "Let Them Steal: Trapping Large Language Model Extraction Attacks with Knowledge Honeypot", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2606-15810", "source_url": "https://arxiv.org/abs/2606.15810", "status": "published", "summary_en": "According to the authors, this paper proposes 'Knowledge Trap', a defense against large language model extraction attacks that redirects attackers toward low-transferability knowledge using a honeypot-style knowledge graph and breadcrumb-guided exploration, rather than blocking queries or perturbing outputs. The authors report experiments in medical and financial domains showing reduced surrogate agreement without degrading legitimate-user performance.", "summary_es": "Según los autores, este artículo propone 'Knowledge Trap', una defensa contra ataques de extracción de modelos de lenguaje grandes que redirige a los atacantes hacia conocimiento de baja transferibilidad mediante un grafo de conocimiento tipo honeypot y una exploración guiada por migas de pan, en lugar de bloquear consultas o perturbar salidas. Los autores reportan experimentos en dominios médico y financiero que muestran una reducción del acuerdo del modelo sustituto sin afectar el rendimiento de usuarios legítimos.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Umberto Salviati", "Fabio De Gaspari", "Mauro Conti", "Luigi Vincenzo Mancini"], "doi": "10.48550/arxiv.2606.17986", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "Endpoint"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed and the reported effectiveness has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "ShellGames combines five complementary techniques", "source_sha256": "bf3d44290450a8ba669d3eef08b04ab032bece3dc17cc91959c90e61b9d9528c", "source_title": "ShellGames: Speculative LLM-Driven SSH Deception", "tags": [], "techniques": ["Honeypot", "Moving target defense"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2606-17986", "kind": "paper", "name": "ShellGames: Speculative LLM-Driven SSH Deception", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2606-17986", "source_url": "https://arxiv.org/abs/2606.17986", "status": "published", "summary_en": "This paper presents ShellGames, an SSH shell simulator based on large language models (LLMs) designed to sustain credible interactive deception sessions with adversaries. According to the authors, the system combines techniques such as chain-of-thought reasoning, memory management, speculative command execution, sandbox routing, and subversion detection to address common LLM limitations. The authors report improvements in accuracy, consistency, and state tracking over baselines, along with a user study indicating perceived realism comparable to a real shell.", "summary_es": "Este artículo presenta ShellGames, un simulador de shell SSH basado en modelos de lenguaje de gran tamaño (LLM) diseñado para sostener sesiones interactivas de engaño creíbles con adversarios. Según los autores, el sistema combina técnicas como razonamiento en cadena, gestión de memoria, ejecución especulativa de comandos, enrutamiento a entornos sandbox y detección de subversión para superar limitaciones comunes de los LLM. Los autores reportan mejoras en precisión, consistencia y seguimiento de estado frente a líneas base, y un estudio con usuarios que indica una realismo percibido comparable a un shell real.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Kerri Prinos", "Lilianne Brush", "Cameron Denton"], "doi": "10.48550/arxiv.2606.21037", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed and the reported effectiveness has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "we introduce an automated evaluation framework adapted from the Honeyquest instrument", "source_sha256": "8db2ff2a45c3c9b4b18b4ce2bf461d41fe2a491635daf221edb7fb69cb96ca8c", "source_title": "Honeyquest for LLMs: Rethinking Cyber Deception for AI Attackers", "tags": [], "techniques": ["Honeypot", "Decoy", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2606-21037", "kind": "paper", "name": "Honeyquest for LLMs: Rethinking Cyber Deception for AI Attackers", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2606-21037", "source_url": "https://arxiv.org/abs/2606.21037", "status": "published", "summary_en": "This paper adapts the Honeyquest instrument to automatically evaluate LLM-based attacker judgment against cyber deception techniques. According to the authors, a cohort of 21 models from various providers was compared against a human baseline on reconnaissance tasks, finding that LLMs fall for traps at higher rates than humans and show a gap between recognizing deception in their reasoning and acting accordingly. The authors conclude that human-centered deception hypotheses do not reliably transfer to AI attackers.", "summary_es": "Este artículo adapta el instrumento Honeyquest para evaluar de forma automatizada el juicio de atacantes basados en LLM frente a técnicas de engaño cibernético. Según los autores, un conjunto de 21 modelos de distintos proveedores fue comparado con una línea base humana en tareas de reconocimiento, encontrando que los LLM caen en trampas con mayor frecuencia que los humanos y muestran una brecha entre reconocer el engaño en su razonamiento y actuar en consecuencia. Los autores concluyen que las hipótesis de engaño centradas en humanos no se transfieren de forma fiable a atacantes de IA.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Syed Zeeshan Haider", "Anwar Shah", "Muneeb Arif", "Hamza Iftikhar", "Waqas Ali"], "doi": "10.48550/arxiv.2606.21422", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["IoT", "Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed and the reported effectiveness has not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se ha verificado de forma independiente la efectividad reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "an intelligent honeypot layer that converts redirected suspicious traffic into actionable threat intelligence", "source_sha256": "43f31579ba351c10161d07220997bb0c6184efb9dd2823e0b3dd5d8ea3793edd", "source_title": "Federated Temporal Attention Intelligence for Cyber-Resilient IoMT: Lightweight Digital Twins and PPO-Driven Honeypot Deception", "tags": [], "techniques": ["Honeypot", "Adversary engagement", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2606-21422", "kind": "paper", "name": "Federated Temporal Attention Intelligence for Cyber-Resilient IoMT: Lightweight Digital Twins and PPO-Driven Honeypot Deception", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2606-21422", "source_url": "https://arxiv.org/abs/2606.21422", "status": "published", "summary_en": "This paper presents LDT-FRL, a defense framework combining temporal attention encoders, lightweight digital twins, and a federated reinforcement learning (PPO) agent capable of redirecting suspicious traffic to honeypots in IoMT (Internet of Medical Things) environments. According to the authors, the system was evaluated on public network traffic benchmarks, achieving high classification metrics and explainability via techniques such as SHAP and Grad-CAM.", "summary_es": "Este artículo presenta LDT-FRL, un marco de defensa que combina codificadores de atención temporal, gemelos digitales ligeros y un agente de aprendizaje por refuerzo federado (PPO) que puede redirigir tráfico sospechoso hacia honeypots en entornos de IoMT (Internet de las Cosas Médicas). Según los autores, el sistema fue evaluado en benchmarks públicos de tráfico de red, obteniendo altas métricas de clasificación y explicabilidad mediante técnicas como SHAP y Grad-CAM.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Syed Zeeshan Haider", "Anwar Shah", "Muneeb Arif", "Hamza Iftikhar", "Waqas Ali"], "doi": "10.48550/arxiv.2606.21513", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["IoT", "Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed and the reported effectiveness has not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se ha verificado de forma independiente la efectividad reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "an enhanced honeypot layer converting suspicious traffic into threat intelligence with adaptive thresholds", "source_sha256": "969c03ce5e6dd2ddd5a4217f7604d5a31c5bd31fb945e4167952587d8b4466e2", "source_title": "Privacy-Preserving Federated Temporal Graph Learning with Digital Twin--Guided Adaptive Deception for Cyber-Resilient IoMT", "tags": [], "techniques": ["Honeypot", "Adversary engagement", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2606-21513", "kind": "paper", "name": "Privacy-Preserving Federated Temporal Graph Learning with Digital Twin--Guided Adaptive Deception for Cyber-Resilient IoMT", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2606-21513", "source_url": "https://arxiv.org/abs/2606.21513", "status": "published", "summary_en": "This work proposes Federated TGCN-A2C, an architecture integrating temporal graph convolutional networks, LSTM-based digital twins, and a federated actor-critic agent to decide between allowing, isolating, or redirecting traffic to honeypots in IoT/IoMT devices. The authors report evaluations on public cybersecurity datasets along with explainability analysis supporting the system's decision-making.", "summary_es": "Este trabajo propone Federated TGCN-A2C, una arquitectura que integra redes convolucionales de grafos temporales, gemelos digitales basados en LSTM y un agente de actor-crítico federado para decidir entre permitir, aislar o redirigir tráfico a honeypots en dispositivos IoT/IoMT. Los autores reportan evaluaciones en conjuntos de datos públicos de ciberseguridad y análisis de explicabilidad para respaldar la toma de decisiones del sistema.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Veronica Valeros", "Carlos Catania", "Viliam Lisý", "Harm Griffioen"], "doi": "10.48550/arxiv.2606.27966", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "Endpoint"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the rubric or its findings have not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha validado de forma independiente la rúbrica o sus resultados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "only 80 techniques (32%) admit a decoy the attacker could plausibly reach", "source_sha256": "6377296f67b7185609c8143cf4f91d6560ebe228662575e2cf30a6bc602df1c5", "source_title": "Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK", "tags": [], "techniques": ["Decoy", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2606-27966", "kind": "paper", "name": "Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2606-27966", "source_url": "https://arxiv.org/abs/2606.27966", "status": "published", "summary_en": "The authors examine the assumption that decoys can be placed wherever attacker behavior occurs, applying a four-criterion rubric to all 250 MITRE ATT&CK v18.1 techniques. They find only 32% of techniques admit a plausible decoy and describe two placement patterns, Sweep and Seek, offering a simple rule for decoy deployment.", "summary_es": "Los autores examinan la suposición de que los señuelos pueden situarse en cualquier punto donde exista comportamiento del atacante, aplicando una rúbrica de cuatro criterios a las 250 técnicas de MITRE ATT&CK v18.1. Concluyen que solo el 32% de las técnicas admiten un señuelo plausible y describen dos patrones de colocación denominados Sweep y Seek, ofreciendo una regla simple para el despliegue de señuelos.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Muris Sladić", "Eman Alibalić", "Veronica Valeros", "Carlos Catania", "Sebastian Garcia"], "doi": "10.48550/arxiv.2606.27990", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "Endpoint"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the reported effectiveness has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y el resumen disponibles públicamente; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "a multi-agent, multi-LLM architecture to address the limitations of the previous shelLM LLM honeypot", "source_sha256": "7d472c823b8305c46ada5f8b7491a72c0253d9d7210a714b3a44a6a82175588f", "source_title": "AdvancedShelLM: A Stateful Multi-Agent LLM Honeypot for SSH Deception", "tags": [], "techniques": ["Honeypot", "Decoy", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2606-27990", "kind": "paper", "name": "AdvancedShelLM: A Stateful Multi-Agent LLM Honeypot for SSH Deception", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2606-27990", "source_url": "https://arxiv.org/abs/2606.27990", "status": "published", "summary_en": "The authors present AdvancedShelLM, an LLM-based SSH honeypot using a multi-agent architecture (Manager and Worker) intended to improve command understanding and deceptive capability over its predecessor shelLM. According to the abstract, the system was evaluated through unit tests, an AI attacker, human attackers, and an Internet deployment.", "summary_es": "Los autores presentan AdvancedShelLM, un honeypot SSH basado en LLM que utiliza una arquitectura multiagente (Manager y Worker) para mejorar la comprensión de comandos y la capacidad de engaño respecto a su predecesor shelLM. Según el resumen, el sistema fue evaluado mediante pruebas unitarias, un atacante de IA, atacantes humanos y un despliegue en Internet.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Veronica Valeros", "Muris Sladić", "Sebastian Garcia"], "doi": "10.48550/arxiv.2606.28006", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the analysis has not been independently replicated.", "limitations_es": "Esta entrada se basa únicamente en el título y el resumen disponibles públicamente; no se ha revisado el texto completo ni se ha replicado de forma independiente el análisis.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "99.23% of sessions were non-interactive", "source_sha256": "17e084e83bb7eeaec0819a6493e095693cbdd5efc9844069e718a753e4305ee3", "source_title": "Ghost Without Shell: Measuring Non-Interactive SSH Attacks on Honeypots", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2606-28006", "kind": "paper", "name": "Ghost Without Shell: Measuring Non-Interactive SSH Attacks on Honeypots", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2606-28006", "source_url": "https://arxiv.org/abs/2606.28006", "status": "published", "summary_en": "The authors study attacker behavior across eleven SSH honeypots accepting both interactive and non-interactive sessions over fifteen days. According to the abstract, they found that the vast majority of authenticated sessions were non-interactive, challenging common assumptions in cyber deception research focused on interactive shells.", "summary_es": "Los autores analizan el comportamiento de los atacantes en once honeypots SSH que aceptaban sesiones interactivas y no interactivas durante quince días. Según el resumen, hallaron que la gran mayoría de las sesiones autenticadas fueron no interactivas, lo que cuestiona supuestos comunes en la investigación de engaño cibernético centrada en shells interactivos.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Bernhard Degen", "Bas Palinckx", "Mattijs Jonker", "Roland van Rijswijk-Deij", "Raffaele Sommese"], "doi": "10.48550/arxiv.2607.14832", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the methodology or results have not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha validado de forma independiente la metodología o los resultados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "leverages a global deployment of anycast amplification honeypots that attract requests from topologically nearby sources", "source_sha256": "21c0502e90aa1ab95fc2d953fad0d174cca9db1f58f6c18b5b6f5bc60191dd5b", "source_title": "Spoofer or Spoofers? Estimating a Lower Bound on the Number of DRDoS Sources Using Anycast Honeypots", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2607-14832", "kind": "paper", "name": "Spoofer or Spoofers? Estimating a Lower Bound on the Number of DRDoS Sources Using Anycast Honeypots", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2607-14832", "source_url": "https://arxiv.org/abs/2607.14832", "status": "published", "summary_en": "This paper presents a method to estimate a lower bound on the number of networks generating spoofed traffic in DRDoS attacks, using a global deployment of anycast amplification honeypots. The authors develop two estimators based on honeypot reception patterns and TTL variations, analyzing 287 days of amplification attacks. According to the authors, at least 21.0% of attacks originate from multiple network locations.", "summary_es": "Este trabajo presenta un método para estimar un límite inferior del número de redes que generan tráfico falsificado en ataques DRDoS, utilizando una infraestructura global de honeypots de amplificación anycast. Los autores desarrollan dos estimadores basados en honeypots receptores y variaciones de TTL, analizando 287 días de ataques de amplificación. Según los autores, al menos el 21.0% de los ataques se originan en múltiples ubicaciones de red.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Karina Elzer", "Alberto Mongardini", "Ricardo Yaben", "Georgios Theodoridis", "Alexandra Babanuta", "Nawras Mouala", "Emmanouil Vasilomanolakis"], "doi": "10.48550/arxiv.2607.15754", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "Application"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the methodology or results have not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha validado de forma independiente la metodología o los resultados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "emulates DICOM and PACS services using realistic interactions, dynamically populated medical records, and embedded honeytokens", "source_sha256": "94583f97a4f1d703f30f3a9a0092d5f3817fc8bbeaa2f1ba25a82bef1f349307", "source_title": "DICOMHawk: A Cyber Deception Framework for Medical Imaging Infrastructure", "tags": [], "techniques": ["Honeypot", "Honeytoken", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2607-15754", "kind": "paper", "name": "DICOMHawk: A Cyber Deception Framework for Medical Imaging Infrastructure", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2607-15754", "source_url": "https://arxiv.org/abs/2607.15754", "status": "published", "summary_en": "This paper presents DICOMHawk, a cyber-deception framework that emulates DICOM and PACS services with realistic interactions, dynamically populated medical records, and embedded honeytokens, designed to protect medical imaging infrastructure. According to the authors, in a 424-day deployment across multiple networks, DICOMHawk attracted more valid sessions than Dicompot, avoided honeypot detection, and captured 67 medical-related attacks from 15 unique IPs.", "summary_es": "Este artículo presenta DICOMHawk, un marco de engaño cibernético que emula servicios DICOM y PACS con interacciones realistas, registros médicos dinámicos y honeytokens incorporados, diseñado para proteger infraestructura de imágenes médicas. Según los autores, en un despliegue de 424 días en múltiples redes, DICOMHawk atrajo más sesiones válidas que Dicompot, evitó ser detectado como honeypot y capturó 67 ataques relacionados con el ámbito médico provenientes de 15 IPs únicas.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Ricardo Yaben", "Karina Elzer", "Alberto Maria Mongardini", "Emmanouil Vasilomanolakis"], "doi": "10.48550/arxiv.2607.15839", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "Application"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed nor the findings independently replicated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni replicado los hallazgos.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "a reproducible false-positive filtering method that identifies honeypots, telescopes, malformed responders, and other deception artifacts", "source_sha256": "35e101cd4dcc4a81174e40fa8b3de4ca46cbd6196e26521be93f2da66b372c68", "source_title": "Is That Really My X-Ray? Measuring Internet-Exposed DICOM Services in the Presence of Deception", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2607-15839", "kind": "paper", "name": "Is That Really My X-Ray? Measuring Internet-Exposed DICOM Services in the Presence of Deception", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2607-15839", "source_url": "https://arxiv.org/abs/2607.15839", "status": "published", "summary_en": "This paper presents a noise-aware measurement study of Internet-facing DICOM services, combining IPv4-wide active scanning with passive honeypot deployments. The authors introduce a reproducible method to filter false positives caused by honeypots, network telescopes, and other measurement artifacts, reducing apparent exposure by 39%. After filtering, they identify thousands of vulnerable deployments lacking encryption and authentication, finding that existing deception systems are insufficient to capture the actual risks.", "summary_es": "Este trabajo presenta un estudio de servicios DICOM expuestos a Internet, combinando escaneo activo a escala IPv4 con despliegues pasivos de honeypots. Los autores proponen un método reproducible para filtrar falsos positivos generados por honeypots, telescopios de red y otros artefactos de medición, reduciendo la exposición aparente en un 39%. Tras el filtrado, identifican miles de despliegues vulnerables que carecen de cifrado y autenticación, y observan que las medidas de deception existentes son insuficientes para capturar los riesgos reales.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Huy Q. Ngo"], "doi": "10.48550/arxiv.2607.22009", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Identity", "Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed nor has the effectiveness of the proposed models been validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni validado la efectividad de los modelos propuestos.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "we propose a honeypot/decoy placement model based on the principle of minimising the number of shortest paths", "source_sha256": "82287a55222f8f9e9974a9e90a6ab12b0313a419404bc04390803f1b5102134a", "source_title": "Practical Graph Optimisation and AI-Driven Models for Active Directory Security Hardening", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2607-22009", "kind": "paper", "name": "Practical Graph Optimisation and AI-Driven Models for Active Directory Security Hardening", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2607-22009", "source_url": "https://arxiv.org/abs/2607.22009", "status": "published", "summary_en": "This thesis proposes game-theoretic and optimisation-based models for hardening Active Directory attack graphs. According to the authors, it introduces a honeypot/decoy placement model that minimises shortest paths and Domain Admin-reachable nodes, along with strategies accounting for the dynamic nature of the graph and adaptive prioritisation models incorporating administrator feedback. The authors note that the underlying problems are computationally intractable.", "summary_es": "Esta tesis propone modelos de teoría de juegos y optimización para el endurecimiento de grafos de ataque en Active Directory. Según los autores, se introduce un modelo de colocación de honeypots/decoys basado en minimizar rutas cortas y nodos alcanzables por Domain Admin, además de estrategias que consideran la naturaleza dinámica del grafo y modelos de priorización adaptativa con retroalimentación del administrador. Los autores señalan que los problemas subyacentes son computacionalmente intratables.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Ryozo Masukawa", "Ian Bryant", "Armita Kazeminajafabadi", "Sanggeon Yun", "Hyunwoo Oh", "SungHeon Jeong", "Nathaniel D. Bastian", "Mahdi Imani", "Mohsen Imani"], "doi": "10.48550/arxiv.2608.04317", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the reported results have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y el resumen disponibles públicamente; no se ha revisado el texto completo ni se han verificado de forma independiente los resultados reportados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "discovering emergent behaviors such as decoy avoidance and adaptive state prioritization", "source_sha256": "67d5d6035441e08d288789d1546c12ce050e8d22028488522d6019839886b139", "source_title": "Trident : How to Break Deep Reinforcement Learning Cyber Defenses (Agentic)", "tags": [], "techniques": ["Decoy", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2608-04317", "kind": "paper", "name": "Trident : How to Break Deep Reinforcement Learning Cyber Defenses (Agentic)", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2608-04317", "source_url": "https://arxiv.org/abs/2608.04317", "status": "published", "summary_en": "The authors introduce Trident, an agentic LLM red teaming framework for evaluating the robustness of Deep Reinforcement Learning (DRL)-based cyber defenses. The work includes a dynamic benchmark, a dataset of red-blue interaction trajectories, and an agentic architecture that generates attack strategies and translates them into executable policies against DRL defenders. According to the authors, Trident substantially reduces defensive performance and uncovers emergent behaviors such as decoy avoidance.", "summary_es": "Los autores presentan Trident, un marco de red teaming basado en LLM agénticos para evaluar la robustez de defensas de ciberseguridad basadas en aprendizaje por refuerzo profundo (DRL). El trabajo incluye un banco de pruebas dinámico, un conjunto de datos de interacciones rojo-azul y una arquitectura agéntica que genera estrategias de ataque y las traduce en políticas ejecutables contra defensores DRL. Según los autores, Trident reduce significativamente el desempeño defensivo y descubre comportamientos emergentes como la evitación de señuelos.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Asif Rahman", "Md. Abu Sayed", "Ahmed Ann Noor Ryen", "Ahmed Hemida", "Charles A. Kamhoua", "Christopher Kiekintveld"], "doi": "10.48550/arxiv.2608.08865", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the reported results have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y el resumen disponibles públicamente; no se ha revisado el texto completo ni se han verificado de forma independiente los resultados reportados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "the purpose of the game is to induce uncertainty and mistakes", "source_sha256": "e017be461249448bbb7c37a29deb3a60a1ac15c210f47258c72c2690fe468df5", "source_title": "Beyond Best Response: Quantal Stackelberg Deception as Insurance Against Attacker Misspecification", "tags": [], "techniques": ["Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2608-08865", "kind": "paper", "name": "Beyond Best Response: Quantal Stackelberg Deception as Insurance Against Attacker Misspecification", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2608-08865", "source_url": "https://arxiv.org/abs/2608.08865", "status": "published", "summary_en": "The authors analyze Stackelberg Security Games (SSG) applied to cyber deception, proposing a Quantal Stackelberg Equilibrium (QSE) that models noisy attacker responses instead of a perfect best response. According to the authors, this approach serves as a form of insurance against model specification errors, and is empirically evaluated in a cybersecurity case study with real CVE/CVSS vulnerabilities, showing gains in defender utility over the classical Stackelberg approach.", "summary_es": "Los autores analizan los Juegos de Seguridad de Stackelberg (SSG) aplicados a engaño cibernético, proponiendo un Equilibrio Quantal de Stackelberg (QSE) que modela respuestas ruidosas del atacante en lugar de una respuesta óptima perfecta. Según los autores, este enfoque actúa como una forma de seguro frente a errores de especificación del modelo, y se evalúa empíricamente en un estudio de caso de ciberseguridad con vulnerabilidades reales de CVE/CVSS, mostrando ganancias en la utilidad del defensor respecto al enfoque Stackelberg clásico.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Yuhan Meng", "Shaofei Li", "Jionghao Huang", "Jiandong Jin", "Puyi Wang", "Hanlin Jiang", "Anis Yusof", "Peng Jiang", "Zhenkai Liang", "Yao Guo", "Ding Li"], "doi": "10.48550/arxiv.2608.15012", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed and the findings reported by the authors have not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se han validado de forma independiente los hallazgos reportados por los autores.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "When decoy endpoints are deployed in the range, agent timeouts triple and downstream completion disappears despite the success rates of initial accesses are unchanged.", "source_sha256": "c5d5873353e6843eb464a3e87e61df73ec941dcec863545dcca57b89ffd5923f", "source_title": "SysEvolve: An AI-native, safe, autonomous adversarial attack-defense co-evolutionary system", "tags": [], "techniques": ["Decoy", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2608-15012", "kind": "paper", "name": "SysEvolve: An AI-native, safe, autonomous adversarial attack-defense co-evolutionary system", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2608-15012", "source_url": "https://arxiv.org/abs/2608.15012", "status": "published", "summary_en": "According to the authors, this work presents SysEvolve, a system integrating three co-designed components (SysField, SysSpear, and SysArmor) to create a self-driven adversarial loop between LLM-based attack and defense agents. The authors describe the construction of realistic multi-host cyber ranges, attack scheme generation, and real-time interpretable defense. They also note that decoy endpoints deployed in the range affect LLM agent behavior.", "summary_es": "Según los autores, este trabajo presenta SysEvolve, un sistema que integra tres componentes co-diseñados (SysField, SysSpear y SysArmor) para crear un bucle adversarial autodirigido entre agentes de ataque y defensa basados en LLM. Los autores describen la construcción de rangos cibernéticos multi-host realistas, generación de esquemas de ataque y defensa interpretable en tiempo real. También señalan que los endpoints señuelo desplegados en el rango afectan el comportamiento de los agentes LLM.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Rohit Swami", "Tushar Singh", "Akash Warde", "Sri Muthu"], "doi": "10.48550/arxiv.2608.15407", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the available title and abstract; the full text has not been reviewed and the findings reported by the authors have not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles; no se ha revisado el texto completo ni se han validado de forma independiente los hallazgos reportados por los autores.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "Traditional honeypots share an invariant behavioral profile: a skilled adversary can confirm the presence of a deception environment within a few diagnostic commands", "source_sha256": "235f6901b01747df95fd2c839ab2eed32aef137e9e1695df0490bbe06f913f65", "source_title": "Chameleon: An Adaptive AI-Driven Honeypot Architecture Using Threat-Calibrated Particle Swarm Optimization and Semantic Deception Rapidly-Exploring Random Trees", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2608-15407", "kind": "paper", "name": "Chameleon: An Adaptive AI-Driven Honeypot Architecture Using Threat-Calibrated Particle Swarm Optimization and Semantic Deception Rapidly-Exploring Random Trees", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2608-15407", "source_url": "https://arxiv.org/abs/2608.15407", "status": "published", "summary_en": "According to the authors, Chameleon is an adaptive honeypot architecture combining a BiLSTM classifier, a locally deployed language model, and two metaheuristic engines (TC-PSO and S-RRT) to dynamically adjust connection-holding delays and deception schemas based on detected threat levels. The authors report performance comparisons against standard algorithms and note reduced operating costs compared to commercial alternatives.", "summary_es": "Según los autores, Chameleon es una arquitectura de honeypot adaptativo que combina un clasificador BiLSTM, un modelo de lenguaje local y dos motores metaheurísticos (TC-PSO y S-RRT) para ajustar dinámicamente retrasos de conexión y esquemas de engaño según el nivel de amenaza detectado. Los autores reportan comparaciones de rendimiento frente a algoritmos estándar y señalan costos operativos reducidos frente a alternativas comerciales.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Muris Sladić", "Veronica Valeros", "Eman Alibalić", "Sebastian Garcia"], "doi": "10.48550/arxiv.2608.18686", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "Endpoint"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the title and abstract of the source, without a full-text review, so the effectiveness and generalizability of the improvements reported by the authors cannot be independently confirmed.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen de la fuente, sin revisión del texto completo, por lo que no se puede confirmar de forma independiente la efectividad ni la generalización de las mejoras reportadas por los autores.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "This paper studies how to improve and evaluate the shell emulation accuracy of local LLM-based SSH honeypots using prompt design and supervised fine-tuning.", "source_sha256": "88d37229c1a0b168fce447d16400c3d42b63a800a9c7d79e1f2174928e67fe77", "source_title": "Improving LLM-Based SSH Honeypots Through Prompting and Fine-Tuning", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2608-18686", "kind": "paper", "name": "Improving LLM-Based SSH Honeypots Through Prompting and Fine-Tuning", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2608-18686", "source_url": "https://arxiv.org/abs/2608.18686", "status": "published", "summary_en": "This paper studies how to improve shell emulation accuracy of local open-weight LLM-based SSH honeypots through prompt design and supervised fine-tuning, comparing eight models against their base versions. Using 34 automated unit tests, the authors report that prompt design has a large effect and that fine-tuning effectiveness depends on dataset coverage, with an expanded dataset built from honeypot logs producing stronger local models according to their own measurements.", "summary_es": "Este artículo estudia cómo mejorar la precisión de emulación de shell en honeypots SSH basados en LLM locales de peso abierto, mediante diseño de prompts y ajuste fino supervisado, comparando ocho modelos frente a sus versiones base. Los autores reportan, usando 34 pruebas automatizadas, que el diseño de prompts tiene un efecto considerable y que el ajuste fino depende de la cobertura del conjunto de datos utilizado, con un conjunto de datos ampliado derivado de registros de honeypot produciendo modelos locales más robustos según sus propias mediciones.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Ethan Traister", "Ankit Raj", "Jiaqi Gan", "Xingyu Shen", "Tyler Wu", "Yuchen Zhou", "Tommy Duong", "Kidus Zewde", "Siying Chen", "Simiao Ren"], "doi": "10.48550/arxiv.2608.24127", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full paper has not been reviewed and the authors' reported findings have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el artículo completo ni se han verificado de forma independiente los hallazgos reportados por los autores.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "an AI voice-agent honeypot that answered callers and kept them talking", "source_sha256": "64bc06d11bc3bca981dbe0990063a4801393110c4f2098114a2ce4a443194635", "source_title": "Anatomy of a Scam Call: What 10,000 real scam and spam calls reveal about how phone scammers operate", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2608-24127", "kind": "paper", "name": "Anatomy of a Scam Call: What 10,000 real scam and spam calls reveal about how phone scammers operate", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2608-24127", "source_url": "https://arxiv.org/abs/2608.24127", "status": "published", "summary_en": "This study analyzes a corpus of 10,211 scam and spam calls collected via an AI voice-agent honeypot that answered calls and kept callers talking. The authors examine operational patterns of telephone fraud, including operating hours, script reuse, types of information solicited, and the influence of the target's simulated identity on scammer behavior. They also present an early-detection experiment based on the opening lines of calls.", "summary_es": "Este estudio analiza un corpus de 10,211 llamadas de spam y estafa recolectadas mediante un honeypot de agente de voz con IA que respondía a las llamadas y mantenía conversación con los llamantes. Los autores examinan patrones operativos de las estafas telefónicas, incluyendo horarios de operación, reutilización de guiones, tipos de información solicitada, y la influencia de la identidad simulada del objetivo en la conducta del estafador. También presentan un experimento de detección temprana basado en las primeras líneas de la llamada.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Xinhong Xie", "Piyush Nagasubramaniam", "Neeraj Karamchandani", "Sencun Zhu"], "doi": "10.48550/arxiv.2609.08093", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "Endpoint"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full paper has not been reviewed and the authors' reported findings have not been independently verified.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el artículo completo ni se han verificado de forma independiente los hallazgos reportados por los autores.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "a systematic study of honeypot-aware budget allocation for LLM attack agents", "source_sha256": "58ed669731025e2a8c7e38ed4be645729099603df4888eec5a87c92c67900817", "source_title": "LLM-Based Penetration Testing in the Presence of Honeypots", "tags": [], "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2609-08093", "kind": "paper", "name": "LLM-Based Penetration Testing in the Presence of Honeypots", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2609-08093", "source_url": "https://arxiv.org/abs/2609.08093", "status": "published", "summary_en": "This work studies how large language model (LLM)-based penetration testing agents can allocate their execution budget when encountering honeypots. The authors formalize the attacker's problem as a budgeted decision process in which the agent must decide whether to continue exploitation or skip a target upon honeypot suspicion, proposing a detector-guided policy evaluated in a controlled mixed-host testbed.", "summary_es": "Este trabajo estudia cómo agentes de pruebas de penetración basados en modelos de lenguaje grande (LLM) pueden asignar su presupuesto de ejecución al enfrentarse a honeypots. Los autores formalizan el problema del atacante como un proceso de decisión presupuestado en el que el agente debe decidir si continuar la explotación o descartar un objetivo ante sospecha de honeypot, proponiendo una política guiada por un detector en un entorno de prueba controlado con hosts mixtos.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Han Jin"], "doi": "10.48550/arxiv.2609.08306", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Application", "Cloud"], "full_text_reviewed": false, "limitations_en": "This entry is based only on the publicly available title and abstract; the full text was not reviewed and the reported effectiveness has not been independently validated.", "limitations_es": "Esta ficha se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "routes it to a dedicated honeypot model, shielding production while the adversary's interaction is continuously harvested for intelligence", "source_sha256": "25cbf8b5733d6d17d061f6b3e9ad7573e3713250c5febb1b07019de6f566bba4", "source_title": "HoneyRoute: Honeypot-Model Routing for Adversarial LLM Serving", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2609-08306", "kind": "paper", "name": "HoneyRoute: Honeypot-Model Routing for Adversarial LLM Serving", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2609-08306", "source_url": "https://arxiv.org/abs/2609.08306", "status": "published", "summary_en": "The authors present HoneyRoute, an inference-serving layer that detects malicious requests and routes them to a dedicated honeypot model, shielding the production model while harvesting attacker intelligence. The system combines a streaming router, a dual-implementation honeypot, and an analysis loop that feeds back into router retraining.", "summary_es": "Los autores presentan HoneyRoute, una capa de servicio de inferencia que detecta solicitudes maliciosas y las redirige a un modelo honeypot dedicado, protegiendo el modelo de producción mientras recopila información sobre el atacante. El sistema combina un router de streaming, un honeypot de doble implementación y un bucle de análisis que retroalimenta el entrenamiento del router.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Xingyu Shen", "Tommy Duong", "Muduo Xu", "Xiaodong An", "Jiaqi Gan", "Haoyuan Tang", "Jamey Z. Liang", "Siyu Zhang", "Yan Zhang", "Ethan Traister", "Simiao Ren"], "doi": "10.48550/arxiv.2609.11137", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based only on the publicly available title and abstract; the full text was not reviewed and the reported effectiveness has not been independently validated.", "limitations_es": "Esta ficha se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad reportada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "An interactive voice honeypot (language-model personas on real U.S. numbers, the caller recorded on its own track) recorded 10,987 calls over 66 days.", "source_sha256": "9e8665161f07943d9944808eecb6a46ab5dd8bbaf545806574029cd82d542c6c", "source_title": "The Machines Are Calling: Measuring Automated and Synthetic Voices in Unwanted Inbound Calls", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2609-11137", "kind": "paper", "name": "The Machines Are Calling: Measuring Automated and Synthetic Voices in Unwanted Inbound Calls", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2609-11137", "source_url": "https://arxiv.org/abs/2609.11137", "status": "published", "summary_en": "The authors use an interactive voice honeypot with language-model personas on real U.S. numbers to measure the prevalence of automated and synthetic voices in unwanted inbound calls, combining audio fingerprinting, a commercial synthetic-speech detector, and blinded listeners to characterize call traffic.", "summary_es": "Los autores emplean un honeypot de voz interactivo con personas basadas en modelos de lenguaje sobre números reales de EE.UU. para medir la prevalencia de voces automatizadas y sintéticas en llamadas no deseadas. Combinan huellas de audio, un detector comercial de voz sintética y evaluadores humanos para caracterizar el tráfico de llamadas.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Ethan Traister", "Dennis Tsang Ng", "Siyu Zhang", "Huaiyu Guo", "Tommy Duong", "Tyler Wu", "Yuchen Zhou", "Xingyu Shen", "Jiaqi Wu", "Simiao Ren"], "doi": "10.48550/arxiv.2609.29528", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "Identity"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed and the effectiveness of the described system has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y el resumen publicado; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad del sistema descrito.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "a dataset of real scam-call conversations collected by an active voice-agent honeypot", "source_sha256": "aacfa507adac26f09fe37652fa80b09e0790d61f93a7d51a36811dd44c205f73", "source_title": "A Corpus of Real Scam- and Spam-Call Conversations from an Active Voice-Agent Honeypot", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2609-29528", "kind": "paper", "name": "A Corpus of Real Scam- and Spam-Call Conversations from an Active Voice-Agent Honeypot", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2609-29528", "source_url": "https://arxiv.org/abs/2609.29528", "status": "published", "summary_en": "This paper presents a corpus of real scam- and spam-call conversations collected via an active voice-agent honeypot. According to the authors, the system adopts a plausible target persona to sustain interactions with fraudulent callers, recording audio, transcripts, and automatic labels. The study describes the collection system, record structure, and an evaluation of corpus realism and label quality, as well as benchmarking scam detectors trained on synthetic dialogue against real traffic.", "summary_es": "Este trabajo presenta un corpus de conversaciones reales de llamadas de estafa y spam recopiladas mediante un honeypot activo basado en un agente de voz conversacional. Según los autores, el sistema adopta una persona objetivo plausible para sostener interacciones con llamantes fraudulentos, registrando audio, transcripciones y etiquetas automáticas. El estudio describe el sistema de recolección, la estructura de los registros y una evaluación de la realismo y calidad de las etiquetas, además de comparar detectores de estafas entrenados con datos sintéticos frente a tráfico real.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Karina Elzer", "Niklas Netterstrøm Johansen", "Emmanouil Vasilomanolakis"], "doi": "10.48550/arxiv.2609.29757", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "Application", "Cloud"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the published title and abstract; the full text has not been reviewed and the effectiveness of the described system has not been independently validated.", "limitations_es": "Esta entrada se basa únicamente en el título y el resumen publicado; no se ha revisado el texto completo ni se ha validado de forma independiente la efectividad del sistema descrito.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "a low- and medium-interaction honeypot that emulates the Ollama API without a backend LLM", "source_sha256": "c1e634ac47e24a810884c5a6c939141da03e62d8ebf64efd5b91b4f38110ed07", "source_title": "OllamaDrama: Designing and Deploying a Honeypot to Measure Attacks on Exposed LLM Infrastructure", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2609-29757", "kind": "paper", "name": "OllamaDrama: Designing and Deploying a Honeypot to Measure Attacks on Exposed LLM Infrastructure", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2609-29757", "source_url": "https://arxiv.org/abs/2609.29757", "status": "published", "summary_en": "This paper presents Ollure, a low- and medium-interaction honeypot that emulates the Ollama API without a backend LLM, as described by the authors. Deployed across four locations over 84 days, it recorded hundreds of thousands of interactions from thousands of source IP addresses. The study documents automated discovery and fingerprinting activity, as well as concrete exploitation attempts against both the infrastructure and LLM layers.", "summary_es": "Este artículo presenta Ollure, un honeypot de interacción baja y media que emula la API de Ollama sin un modelo de lenguaje real en el backend, según describen los autores. Desplegado en cuatro ubicaciones durante 84 días, registró cientos de miles de interacciones y miles de direcciones IP de origen. El estudio documenta actividad automatizada de descubrimiento y huellas digitales, además de intentos de explotación concretos contra la infraestructura y la capa del modelo de lenguaje.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Pedro Beltrán-López", "Enrique Tomás Martínez Beltrán", "Pantaleone Nespoli", "Manuel Gil Pérez", "Alberto Huertas Celdrán"], "doi": "10.48550/arxiv.2609.36330", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network", "Application"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the title and abstract available in the preprint repository; no full-text reading or independent validation of the reported results was performed.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles en el repositorio de preprints; no se realizó una lectura completa del artículo ni una validación independiente de los resultados reportados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "deploys a mobile DecoyNode that generates decoy challenges using chaotic maps", "source_sha256": "2477de48ec3ee1b415221e52ea3c68d3ea476e1802a7905bad8c99052f69cdb4", "source_title": "DecoyTrace: Toxic Decoys for Active Defense in Decentralized Federated Learning", "tags": [], "techniques": ["Decoy", "Adversary engagement"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-2609-36330", "kind": "paper", "name": "DecoyTrace: Toxic Decoys for Active Defense in Decentralized Federated Learning", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-2609-36330", "source_url": "https://arxiv.org/abs/2609.36330", "status": "published", "summary_en": "This paper presents DecoyTrace, a proactive cyber deception-based defense designed for strictly serverless decentralized federated learning (DFL) environments. According to the authors, the system deploys a mobile DecoyNode that generates decoy challenges using chaotic maps, disseminates a dual model (clean vs. decoy) based on neighbor trust, and evaluates behavior using three-state semantic metrics to identify and contain malicious sources. The authors report evaluations on the NEBULA platform across multiple configurations, datasets, and topologies.", "summary_es": "Este artículo presenta DecoyTrace, una defensa basada en engaño cibernético proactivo diseñada para entornos de aprendizaje federado descentralizado (DFL) sin servidor. Según los autores, el sistema despliega un DecoyNode móvil que genera desafíos señuelo mediante mapas caóticos, difunde un modelo dual (limpio vs. señuelo) basado en confianza entre pares, y evalúa el comportamiento con métricas semánticas de tres estados para identificar y contener fuentes maliciosas. Los autores reportan evaluaciones en la plataforma NEBULA con múltiples configuraciones, conjuntos de datos y topologías.", "updated_at": "2026-10-04", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Maximillian Dornseif", "Sascha May"], "doi": "10.48550/arxiv.cs/0406057", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the title and abstract available in the preprint repository; no full-text reading or independent validation of the reported results was performed.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles en el repositorio de preprints; no se realizó una lectura completa del artículo ni una validación independiente de los resultados reportados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "We present a model for costs and benefits of so called Honeynets.", "source_sha256": "648d039a2224df8ddee2b6092577aec2c004c7d567b4fd27d26c18701233abab", "source_title": "Modelling the costs and benefits of Honeynets", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-cs-0406057", "kind": "paper", "name": "Modelling the costs and benefits of Honeynets", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-cs-0406057", "source_url": "https://arxiv.org/abs/cs/0406057", "status": "published", "summary_en": "This paper proposes a model for estimating the costs and benefits associated with deploying honeynet technology, an area where, according to the authors, a clear framework for optimal security resource allocation was lacking. The stated goal is to foster informed reasoning about the adoption of honeynets as an IT security measure.", "summary_es": "Este artículo propone un modelo para estimar los costos y beneficios asociados al despliegue de tecnología honeynet, un área en la que, según los autores, faltaba un marco claro para asignar recursos de seguridad de manera óptima. El objetivo declarado es fomentar un razonamiento informado sobre la adopción de honeynets como medida de seguridad de TI.", "updated_at": "2026-10-04", "year": 2004}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "authors": ["Maximillian Dornseif", "Felix C. Gaertner", "Thorsten Holz"], "doi": "10.48550/arxiv.cs/0406059", "draft_review_basis": "independent-second-provider-review", "eligibility_source_depth": "official-arxiv-title-abstract", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "This entry is based solely on the publicly available title and abstract; the full text has not been reviewed, and the setup and results described have not been independently verified or replicated.", "limitations_es": "Esta entrada se basa únicamente en el título y resumen disponibles públicamente; no se ha revisado el texto completo ni se ha verificado o replicado de forma independiente la configuración ni los resultados descritos.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "review_basis": "abstract", "source_quote": "Electronic bait (honeypots) are network resources whose value consists of being attacked and compromised.", "source_sha256": "335694bbe1a5b584919c7c48ef8137542d8951ee3076de5ee942d96531c291ae", "source_title": "Ermittlung von Verwundbarkeiten mit elektronischen Koedern", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-abstract", "id": "doi-10-48550-arxiv-cs-0406059", "kind": "paper", "name": "Ermittlung von Verwundbarkeiten mit elektronischen Koedern", "organization": "", "reviewed_at": "2026-10-04", "slug": "doi-10-48550-arxiv-cs-0406059", "source_url": "https://arxiv.org/abs/cs/0406059", "status": "published", "summary_en": "This paper provides an introduction to honeypots (electronic bait), network resources designed to be attacked and compromised, indistinguishable from regular systems. According to the authors, these systems can be interconnected into honeynets equipped with special software facilitating forensic analysis of incidents. The work describes the setup and first experiences of such a network deployed at RWTH Aachen University, aiming to learn about attacker behavior in networks.", "summary_es": "Este artículo presenta una introducción a los honeypots (cebos electrónicos), recursos de red diseñados para ser atacados y comprometidos, indistinguibles de sistemas regulares. Según los autores, estos sistemas pueden interconectarse en honeynets equipadas con software especial que facilita el análisis forense de incidentes. El trabajo describe la configuración y primeras experiencias de una red de este tipo desplegada en la Universidad RWTH Aachen, con el objetivo de aprender sobre el comportamiento de los atacantes en redes.", "updated_at": "2026-10-04", "year": 2004}
{"critical_reading": null, "data": {"access_date": "2026-10-15", "authors": ["Lara-Gutierrez, Antonio", "Zamorano, Juan", "Onieva, Jose A."], "dataset_files_analyzed": false, "deposited_version": "v2025-11-05", "doi": "10.5281/zenodo.17533747", "doi_aliases": ["10.5281/zenodo.17533746"], "draft_review_basis": "deepseek-draft-and-independent-claude-review", "environments": ["Network"], "full_text_reviewed": false, "identity_report_reference_refreshed": true, "identity_report_sha256": "b3f8aed210739c468aae86c80aa29cb7bf5d1a6e46e4db65711aacd7722c24d6", "identity_report_sha256_in_frozen_ai_input": "baa0aff2dea7f02eb0fbab32ef363b43954a2cc8505ac2a42cb2bbd972b20bb7", "journal": null, "limitations_en": "Only DataCite-deposited metadata/description was read; no code was executed and runtime behavior was not verified.", "limitations_es": "Solo se leyó metadatos/descripción depositados en DataCite; no se ejecutó código ni se verificó el funcionamiento en tiempo de ejecución.", "metadata_sha256": "2185b75346406096bceb021e66aa91719bdcb3ce60f9eb28391d077874bd4d6a", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "related_paper_catalog_id": "doi-10-1007-s10489-026-07442-4", "related_paper_doi": "10.1007/s10489-026-07442-4", "review_basis": "source-page", "review_depth": "DataCite repository-deposited DOI metadata with abstract", "reviewed_metadata_url": "https://api.datacite.org/dois/10.5281/zenodo.17533747", "selection_report": "data/coverage/educational-scope-third-review-2026-10-13.json", "selection_report_sha256": "51793eb87f113136572518fc4b6516e2c019f3714ebc6d160a68220f1c6706e3", "software_executed": false, "source_document_url": "https://api.datacite.org/dois/10.5281/zenodo.17533747", "source_packet_sha256": "72f6cf3a9083ba84f725840d5f30d70b90a7bbb6a304b0b17c5752a5f67d07fc", "source_quote": "GenPot is a generative honeypot architecture that integrates fine‑tuned language models, OpenCanary HTTP skins and a FastAPI service for deployment, evaluation and research.", "source_quote_locator": {"field": "DataCite.attributes.descriptions (HTML normalized)"}, "source_sha256": "2185b75346406096bceb021e66aa91719bdcb3ce60f9eb28391d077874bd4d6a", "source_title": "GenPot", "source_type": "DataCite repository-deposited DOI metadata with abstract", "tags": [], "techniques": ["Honeypot"]}, "evidence": "deposited-resource-description", "id": "doi-10-5281-zenodo-17533747", "kind": "software", "name": "GenPot", "organization": null, "reviewed_at": "2026-10-15", "slug": "doi-10-5281-zenodo-17533747", "source_url": "https://doi.org/10.5281/zenodo.17533747", "status": "published", "summary_en": "GenPot is a generative honeypot architecture integrating fine-tuned language models, OpenCanary HTTP skins and a FastAPI service for deployment, evaluation and research. It is an educational and experimental project.", "summary_es": "GenPot es una arquitectura de honeypot generativo que integra modelos de lenguaje ajustados, skins HTTP de OpenCanary y un servicio FastAPI para despliegue, evaluación e investigación. Es un proyecto educativo y experimental.", "updated_at": "2026-10-15", "year": 2025}
{"critical_reading": null, "data": {"abstract_source_doi": "10.5281/zenodo.18398464", "access_date": "2026-10-16", "authors": ["Heidi Melhem", "Yaroub Dayoub"], "creator_name_aliases_inferred": false, "doi": "10.5281/zenodo.18398464", "doi_aliases": ["10.5281/zenodo.18398463", "10.21203/rs.3.rs-2227881/v1"], "draft_review_basis": "deepseek-draft-and-independent-claude-review", "environments": ["Network"], "family_resource_count": 1, "family_scope_basis": [{"batch": 20, "candidate_id": "doi:10.21203/rs.3.rs-2227881/v1", "catalog_decision": null, "doi": "10.21203/rs.3.rs-2227881/v1", "existing_identifier_matches": [], "existing_title_matches": [], "identity_status": "deposited-title-family-review-needed", "selection_report": "data/coverage/bibliography-deposited-third-crossref-020-2026-10-16.json", "selection_report_sha256": "517f1960e8d694cc2f48b90ba7ca0dd17f64936113acd9ce5d63e0204616a34f", "source_sha256": "e80c7dcec15175399d10faa61df6d7931de75aac82bce397b3762b811ef9ff55", "title": "A hybrid honeypot framework for DDOS attacks detection and mitigation", "year": 2022}], "full_text_equality_claimed": false, "full_text_reviewed": false, "identity_report": "data/coverage/deposited-followup-family-review-2026-10-16.json", "identity_report_sha256": "d8486dc729d6c0aa6a91da335c385db7fbbce91367b6f1514f6601698918bdf8", "journal": "International Journal of Engineering Research & Technology", "limitations_en": "Assessment based only on the deposited abstract of the associated version; no full-text analysis or independent verification of results was performed.", "limitations_es": "Evaluación basada únicamente en el resumen depositado de la versión asociada; no se realizó análisis del texto completo ni verificación independiente de resultados.", "metadata_sha256": "18ba84ada6afa417ef055f0435337bcd4ba9cd898f9b33f0b8aed8a8c1f3d2da", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "source-page", "review_depth": "deposited abstract of DOI 10.5281/zenodo.18398464; version identity metadata; no full-text analysis", "reviewed_metadata_url": "https://api.datacite.org/dois/10.5281/zenodo.18398464", "selection_report": "data/coverage/bibliography-deposited-third-crossref-020-2026-10-16.json", "selection_report_sha256": "517f1960e8d694cc2f48b90ba7ca0dd17f64936113acd9ce5d63e0204616a34f", "source_document_url": "https://doi.org/10.5281/zenodo.18398464", "source_packet_sha256": "6fb93356c3c3870b71937d9365182805d59f2b6e5bfc183b13d8b18d2019bbf7", "source_quote": "Honeypot is a trap used to lure possible attackers and interact with them to detour, expose or prohibit per se attacks and to learn new attacker's techniques.", "source_quote_locator": {"abstract_source_doi": "10.5281/zenodo.18398464", "field": "deposited abstract (HTML normalized)"}, "source_sha256": "18ba84ada6afa417ef055f0435337bcd4ba9cd898f9b33f0b8aed8a8c1f3d2da", "source_title": "A Hybrid Honeypot Framework for DDOS Attacks Detection and Mitigation", "source_type": "deposited abstract of DOI 10.5281/zenodo.18398464; version identity metadata; no full-text analysis", "tags": [], "techniques": ["Honeypot"], "version_history": [{"creators": [{"affiliation": [{"name": "University of Tartous"}], "family": "Melhem", "given": "Heidi", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "first"}, {"affiliation": [{"name": "University of Tartous"}], "family": "Dayoub", "given": "Yaroub", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}], "doi": "10.21203/rs.3.rs-2227881/v1", "issued": {"date-parts": [[2022, 11, 8]]}, "metadata_sha256": "e80c7dcec15175399d10faa61df6d7931de75aac82bce397b3762b811ef9ff55", "titles": ["A hybrid honeypot framework for DDOS attacks detection and mitigation"]}, {"creators": [{"affiliation": ["University of Tartous"], "familyName": "Heidi Melhem", "name": "Heidi Melhem", "nameIdentifiers": [], "nameType": "Personal"}, {"affiliation": [], "familyName": "Yaroub Dayoub", "name": "Yaroub Dayoub", "nameIdentifiers": [], "nameType": "Personal"}], "doi": "10.5281/zenodo.18398463", "issued": 2022, "metadata_sha256": "de95465489ea79c1d1d052a190fb0809206f1ec3afce73bce35b59381109a090", "titles": [{"title": "A Hybrid Honeypot Framework for DDOS Attacks Detection and Mitigation"}]}, {"creators": [{"affiliation": ["University of Tartous"], "familyName": "Heidi Melhem", "name": "Heidi Melhem", "nameIdentifiers": [], "nameType": "Personal"}, {"affiliation": [], "familyName": "Yaroub Dayoub", "name": "Yaroub Dayoub", "nameIdentifiers": [], "nameType": "Personal"}], "doi": "10.5281/zenodo.18398464", "issued": 2022, "metadata_sha256": "18ba84ada6afa417ef055f0435337bcd4ba9cd898f9b33f0b8aed8a8c1f3d2da", "titles": [{"title": "A Hybrid Honeypot Framework for DDOS Attacks Detection and Mitigation"}]}]}, "evidence": "primary-source-passages", "id": "doi-10-5281-zenodo-18398464", "kind": "paper", "name": "A Hybrid Honeypot Framework for DDOS Attacks Detection and Mitigation", "organization": null, "reviewed_at": "2026-10-16", "slug": "doi-10-5281-zenodo-18398464", "source_url": "https://doi.org/10.5281/zenodo.18398464", "status": "published", "summary_en": "Proposes a hybrid framework with two types of honeypots to relieve the flaws of each type and offer the benefits of both, aiming to detect and mitigate DDoS attacks against a webserver.", "summary_es": "Propone un marco híbrido con dos tipos de honeypots para compensar las deficiencias de cada tipo y combinar sus ventajas, con el fin de detectar y mitigar ataques DDoS contra un servidor web.", "updated_at": "2026-10-16", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-15", "authors": ["K, Adhinan", "O, Karthik", "PT, Adil", "P P, Shanihk"], "doi": "10.5281/zenodo.18974259", "doi_aliases": ["10.5281/zenodo.18974258"], "draft_review_basis": "deepseek-original-draft; codex-source-correction-and-independent-claude-review", "environments": ["Network", "IoT"], "full_text_reviewed": false, "journal": null, "limitations_en": "The deposited PDF extraction was read to establish scope. Implementation and reported results were not verified.", "limitations_es": "Lectura del texto extraído del PDF depositado para determinar su alcance. No se comprobó la implementación ni se validaron los resultados.", "metadata_sha256": "c21d27d00db83487239a575cb95a8c5e644bed5223fbfa9670f8cb68eaa46e66", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "source-page", "review_depth": "complete deposited PDF text extraction with page labels", "reviewed_metadata_url": "https://zenodo.org/api/records/18974259", "selection_report": "data/coverage/educational-recovered-pdf-resolution-2026-10-15.json", "selection_report_sha256": "94e30d597ab8b7f306439a826e96c5e1af3e380c6bc760f1784049a99b4f03e0", "source_correction_input_sha256": "900064e042ff0afc9381636882c20d3b2d749aec9f48ecf93702d48c8e1bf2c0", "source_document_url": "https://zenodo.org/api/records/18974259/files/SecuPi__An_Intelligent_Raspberry_Pi_Based_Network_Security_and_Monitoring_System.pdf/content", "source_packet_sha256": "f7752a75d77a10dfc61832ff27edf7df9088ad6d55a3464c4d7585ee482ec5f8", "source_quote": "It has a secure web dash boarding system\nbased onDjango with multi-factor authentication and hardware\nalerts by proprietary ESP32 or arduino modules. Auto MTD\nBased Proactive defense is theautomatic update of firewall,\nhoneypots and Moving Target Defense (MTD).", "source_quote_locator": {"pdf_bytes_verified": true, "pdf_page": 1}, "source_sha256": "fc19254381b8a732b6cc7abe00407a5771406056861a57e53807794e3dc529ac", "source_title": "SecuPi: An Intelligent Raspberry Pi-Based Network Security and Monitoring System", "source_type": "complete deposited PDF text extraction with page labels", "tags": [], "techniques": ["Honeypot", "Moving target defense"]}, "evidence": "primary-source-passages", "id": "doi-10-5281-zenodo-18974259", "kind": "paper", "name": "SecuPi: An Intelligent Raspberry Pi-Based Network Security and Monitoring System", "organization": null, "reviewed_at": "2026-10-15", "slug": "doi-10-5281-zenodo-18974259", "source_url": "https://doi.org/10.5281/zenodo.18974259", "status": "published", "summary_en": "The authors propose SecuPi, a compact Raspberry Pi-based system that combines real-time traffic monitoring, hybrid intrusion detection (signature-based and machine learning) and automated threat response. As deception and proactive defense mechanisms, they propose the use of honeypots together with automatic firewall updates and Moving Target Defense (MTD).", "summary_es": "Los autores proponen SecuPi, un sistema compacto basado en Raspberry Pi que combina monitorización de tráfico en tiempo real, detección híbrida de intrusiones (firmas y aprendizaje automático) y respuesta automática a amenazas. Como mecanismos de engaño y defensa proactiva, plantean el uso de honeypots junto con actualizaciones automáticas de cortafuegos y defensa de objetivo móvil (MTD).", "updated_at": "2026-10-15", "year": 2026}
{"critical_reading": null, "data": {"abstract_source_doi": "10.5281/zenodo.20052407", "access_date": "2026-10-17", "authors": ["Boiko, Viktor", "Niiakyi, Oleksandr"], "creator_name_aliases_inferred": false, "doi": "10.5281/zenodo.20052407", "doi_aliases": ["10.2139/ssrn.6725183"], "draft_review_basis": "deepseek-draft-and-independent-claude-review", "environments": ["Network"], "family_resource_count": 1, "family_scope_basis": [{"batch": 24, "candidate_id": "doi:10.2139/ssrn.6725183", "catalog_decision": null, "doi": "10.2139/ssrn.6725183", "existing_identifier_matches": [], "existing_title_matches": [], "identity_status": "deposited-title-family-review-needed", "selection_report": "data/coverage/bibliography-deposited-third-crossref-024-2026-10-16.json", "selection_report_sha256": "01825d05891d08ec6f2297a9f49773c4a251b11ece974b6c2ec999663ba29af5", "source_sha256": "487c2f813b78aa3d62c14e8f60faf986a967931789e309b05b1a5ffc4a882b45", "title": "A 4-Month Dataset of Interactive SSH Honeypot Logs and Command Payloads [Preprint]", "year": 2026}], "full_text_equality_claimed": false, "full_text_reviewed": false, "identity_report": "data/coverage/wave2-identity-handoff-2026-10-17.json", "identity_report_sha256": "6b7d19fea50548780838f2ca5a72a6c8c456a64f2c5d549a61ebd57953237cb3", "journal": null, "limitations_en": "Analysis based only on the deposited abstract; the full text was not reviewed and the associated dataset or software files were not examined.", "limitations_es": "Análisis basado únicamente en el resumen depositado; no se revisó el texto completo ni se examinaron los archivos del conjunto de datos o del software asociados.", "metadata_sha256": "64edc16904bb566eb7f45e1313e2a560a1256fb10676a2e6366037d72be52598", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "source-page", "review_depth": "deposited abstract and bibliographic version metadata; no full-text analysis", "reviewed_metadata_url": "https://api.datacite.org/dois/10.5281/zenodo.20052407", "selection_report": "data/coverage/bibliography-deposited-third-crossref-024-2026-10-16.json", "selection_report_sha256": "01825d05891d08ec6f2297a9f49773c4a251b11ece974b6c2ec999663ba29af5", "source_document_url": "https://doi.org/10.5281/zenodo.20052407", "source_packet_sha256": "a1ad93e82cee4d27f071e3a550e44237b7d8f68f0d4d9bf67db87e08d5066128", "source_quote": "records the full spectrum of adversary activity, including initial connection attempts, authentication brute-forcing, and post-authentication command execution", "source_quote_locator": {"abstract_source_doi": "10.5281/zenodo.20052407", "field": "deposited abstract (HTML normalized)"}, "source_sha256": "64edc16904bb566eb7f45e1313e2a560a1256fb10676a2e6366037d72be52598", "source_title": "A 4-Month Dataset of Interactive SSH Honeypot Logs and Command Payloads [Preprint]", "source_type": "deposited abstract and bibliographic version metadata; no full-text analysis", "tags": [], "techniques": ["Honeypot"], "version_history": [{"creators": [{"ORCID": "https://orcid.org/0000-0001-5929-657X", "affiliation": [], "authenticated-orcid": true, "family": "Boiko", "given": "Viktor", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "first"}, {"ORCID": "https://orcid.org/0009-0005-1025-1617", "affiliation": [], "authenticated-orcid": true, "family": "Niiakyi", "given": "Oleksandr", "role": [{"role": "author", "vocabulary": "crossref"}], "sequence": "additional"}], "deposited_descriptions": null, "doi": "10.2139/ssrn.6725183", "issue": null, "issued": {"date-parts": [[2026]]}, "journal": [], "metadata_sha256": "487c2f813b78aa3d62c14e8f60faf986a967931789e309b05b1a5ffc4a882b45", "metadata_url": "https://api.crossref.org/works/10.2139/ssrn.6725183", "page": null, "relations": null, "resource_type": null, "titles": ["A 4-Month Dataset of Interactive SSH Honeypot Logs and Command Payloads [Preprint]"], "volume": null}, {"creators": [{"affiliation": ["National University Odesa Law Academy"], "familyName": "Boiko", "givenName": "Viktor", "name": "Boiko, Viktor", "nameIdentifiers": [{"nameIdentifier": "0000-0001-5929-657X", "nameIdentifierScheme": "ORCID"}], "nameType": "Personal"}, {"affiliation": ["National University Odesa Law Academy"], "familyName": "Niiakyi", "givenName": "Oleksandr", "name": "Niiakyi, Oleksandr", "nameIdentifiers": [{"nameIdentifier": "0009-0005-1025-1617", "nameIdentifierScheme": "ORCID"}], "nameType": "Personal"}], "deposited_descriptions": [{"description": "This article describes a longitudinal dataset of high-interaction SSH honeypot logs collected over a four-month period from July to November 2025. The data was captured using a custom modular multi-threaded honeypot developed in Python 3.10, utilizing the Paramiko library to simulate an interactive SSHv2 environment. Unlike low-interaction systems, this dataset records the full spectrum of adversary activity, including initial connection attempts, authentication brute-forcing, and post-authentication command execution. The resulting dataset contains 145,425 security events, structured to support session reconstruction via unique identifiers. The telemetry includes source IPv4 addresses, credential pairs, and granular command-line payloads, featuring rare instances of file-less exploitation via bash sockets. This data provides a ground-truth source for training machine learning models for anomaly detection, enhancing SIEM rule-sets, and conducting empirical research into botnet orchestration and manual intrusion tactics in cloud infrastructures.\n\nThis is a preprint of a paper submitted to Data in Brief.\n\nThis preprint describes the dataset available at DOI: 10.5281/zenodo.19815504 and utilizes the software framework archived at DOI: 10.5281/zenodo.19817625.", "descriptionType": "Abstract"}], "doi": "10.5281/zenodo.20052407", "issue": null, "issued": 2026, "journal": null, "metadata_sha256": "64edc16904bb566eb7f45e1313e2a560a1256fb10676a2e6366037d72be52598", "metadata_url": "https://api.datacite.org/dois/10.5281/zenodo.20052407", "page": null, "relations": [{"relatedIdentifier": "10.5281/zenodo.19629700", "relatedIdentifierType": "DOI", "relationType": "Describes", "resourceTypeGeneral": "Dataset"}, {"relatedIdentifier": "10.5281/zenodo.19763025", "relatedIdentifierType": "DOI", "relationType": "IsSupplementTo", "resourceTypeGeneral": "Software"}, {"relatedIdentifier": "10.5281/zenodo.20052406", "relatedIdentifierType": "DOI", "relationType": "IsVersionOf"}], "resource_type": {"bibtex": "misc", "citeproc": "article", "resourceType": "", "resourceTypeGeneral": "Preprint", "ris": "GEN", "schemaOrg": "CreativeWork"}, "titles": [{"title": "A 4-Month Dataset of Interactive SSH Honeypot Logs and Command Payloads [Preprint]"}], "volume": null}]}, "evidence": "primary-source-passages", "id": "doi-10-5281-zenodo-20052407", "kind": "paper", "name": "A 4-Month Dataset of Interactive SSH Honeypot Logs and Command Payloads [Preprint]", "organization": null, "reviewed_at": "2026-10-17", "slug": "doi-10-5281-zenodo-20052407", "source_url": "https://doi.org/10.5281/zenodo.20052407", "status": "published", "summary_en": "Paper describing a longitudinal dataset of high-interaction SSH honeypot logs covering connection attempts, authentication brute-forcing and post-authentication command execution. It is intended as a ground-truth source for empirical research and anomaly detection development.", "summary_es": "Artículo que describe un conjunto de datos longitudinal de registros de un honeypot SSH de alta interacción, con intentos de conexión, fuerza bruta de autenticación y ejecución de comandos posteriores al acceso. Su propósito es servir como fuente de referencia para investigación empírica y desarrollo de detección de anomalías.", "updated_at": "2026-10-17", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-13", "authors": ["Pacha, James"], "doi": "10.5281/zenodo.20172622", "doi_aliases": ["10.5281/zenodo.19797148"], "draft_review_basis": "deepseek-original-draft; codex-source-correction-and-claude-review", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "Static review of selected code sections from the deposited ZIP; the program was not executed and results and runtime behavior were not independently validated.", "limitations_es": "Revisión estática de secciones seleccionadas del código depositado; el programa no se ejecutó y no se validaron de forma independiente los resultados ni el comportamiento en tiempo de ejecución.", "metadata_sha256": "d9a19d3caefdfa946f937963e75888bc6de198509f180406851534bf56329b5a", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "source-page", "review_depth": "selected source-code sections read statically", "reviewed_archive_entry": "HYM3-UI/AI/HYM3-UI/security/HYM3_Designs_Version_1_Security_Monitor.py", "reviewed_metadata_url": "https://zenodo.org/api/records/20172622", "selection_report_sha256": "8c94e41ae3ef31103ef600a77351f1f63b7db35c1f540eb9848e267d4c71297b", "software_executed": false, "source_document_url": "https://zenodo.org/api/records/20172622/files/HYM3-UI.zip/content", "source_packet_sha256": "3b3c0d03cf3c7d8edf2e5bf5d970a816a6c8fc52519f0897b1c3618155d1e9d6", "source_quote": "    def _on_honeypot_hit(self, ip: str, port: int):\n        if self.allow.contains(ip):", "source_quote_locator": {"archive_entry": "HYM3-UI/AI/HYM3-UI/security/HYM3_Designs_Version_1_Security_Monitor.py", "line": 638}, "source_sha256": "6dfd76ce7186b758a2c27b03ccd6a04abd8e4c5b2ee1bce3aad11dd3d77de93b", "source_title": "HYM3 Designs AGI and Offline Ai Interface for Advanced Scientific Research, Graphic Design, and Computer Programming", "summary_correction_input_sha256": "3eb4f01f8d80ffb0d85bf92f889a4981ab86be2d2f28a77792d13a12292c4b95", "tags": [], "techniques": ["Honeypot", "Decoy"], "whole_archive_checksum_verified": false}, "evidence": "static-source-code", "id": "doi-10-5281-zenodo-20172622", "kind": "software", "name": "HYM3 Designs AGI and Offline Ai Interface for Advanced Scientific Research, Graphic Design, and Computer Programming", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-5281-zenodo-20172622", "source_url": "https://doi.org/10.5281/zenodo.20172622", "status": "published", "summary_en": "The statically read code defines configurable TCP bait ports that accept and close connections; it logs interactions and requests a firewall block for source IPs outside the allowlist.", "summary_es": "El código leído define puertos señuelo TCP configurables que aceptan y cierran conexiones; registra las interacciones y solicita un bloqueo de cortafuegos para las IPs fuera de la lista de permitidas.", "updated_at": "2026-10-13", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-15", "author_name_aliases_inferred": false, "authors": ["Freddy Medina"], "byline_source": "selected PDF page 1", "deposited_creators": [{"affiliation": null, "name": "Medina Hernandez, Alfredo"}, {"affiliation": null, "name": "MedinaTech"}], "deposited_resource_type": {"subtype": "softwaredocumentation", "title": "Software documentation", "type": "publication"}, "deposited_title": "SpatiumComputationisv4: Physics-Bounded Multi-Agent Worlds as a Research Substrate for Autonomous Intelligence", "doi": "10.5281/zenodo.20711464", "doi_aliases": ["10.5281/zenodo.20602943", "10.5281/zenodo.20602944"], "draft_review_basis": "deepseek-original-draft; codex-source-correction-and-independent-claude-review", "environments": ["Application"], "family_resource_count": 1, "full_text_reviewed": false, "identity_report_sha256": "15223296f8c61e92891f45219636dcc5a9184c5f3a55a077016345b2ea915d28", "journal": null, "limitations_en": "Review of manuscript and corroborating code passages relevant to registry scope. The system was not executed and results were not validated.", "limitations_es": "Lectura de pasajes del manuscrito y del código relacionados con el alcance del registro. No se ejecutó el sistema ni se validaron sus resultados.", "metadata_sha256": "285b116c4938eb68b588964eb06f8b5c3e1e2e49a7ad7a20127b3954aa4ce993", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "source-page", "review_depth": "deposited resource metadata, selected PDF and statically read repository code", "reviewed_metadata_url": "https://zenodo.org/api/records/20711464", "selection_report": "data/coverage/spatium-source-family-review-2026-10-15.json", "selection_report_sha256": "a8ef4ed60ab9a32cb83ce106e436101a991cc05b5a10362ac08f5bdc18c2f5d4", "software_executed": false, "source_correction_input_sha256": "7e7c8e96761d0ff863932c1ef81507ee152013cc634c2fa3e27b4835d099374a", "source_document_url": "https://zenodo.org/api/records/20711464", "source_packet_sha256": "836e644acb5649e4b916746f53ca9da09e6f8cc635c00837d4c31a262593edba", "source_quote": "Zones act as operational boundaries. A zone may represent research, defense, quarantine, decep- tion, gateway handling, or core coordination.", "source_quote_locator": {"pdf_page": 4, "pdf_sha256": "3703d673e9a52e0bf559fa8f98c836968d63b1978d3b0c5a37c0dd130e0755bb"}, "source_sha256": "285b116c4938eb68b588964eb06f8b5c3e1e2e49a7ad7a20127b3954aa4ce993", "source_title": "Spatium Computationis v4: Physics-Bounded Multi-Agent Worlds as a Research Substrate for Autonomous Intelligence", "source_type": "deposited resource metadata, selected PDF and statically read repository code", "tags": [], "techniques": ["Honeypot"], "version_history": [{"conceptdoi": "10.5281/zenodo.20602943", "creators": [{"affiliation": null, "name": "Medina Hernandez, Alfredo"}], "declared_resource_type": {"subtype": "softwaredocumentation", "title": "Software documentation", "type": "publication"}, "doi": "10.5281/zenodo.20602944", "extracted_pages_sha256": "9e2109a4aae7a5c81b3a0be04d1d2d3ba24d7d232b852a9a44534d526846549b", "files": ["paper_04_agent_spacetime_architecture.pdf", "claims_evidence_matrix.pdf", "README.pdf", "repo_evidence_map.pdf", "paper_01_physics_engine.pdf", "paper_02_geometry_engine.pdf", "paper_03_miniverse_cosmology.pdf", "overlap_minimization_map.pdf", "Zip File made by THESIS ALPHA RESEACH ORO.mp4", "spatium_computationis_v3_preprint_series (4).zip", "spatium_computationis_v3_full_preprint_packet.pdf"], "metadata_sha256": "16c8d44432f98cb1ad4cdddf5d455edd7825122a91df984aa580ac601c54b43a", "pdf_sha256": "aa6afffb0777f60868da7c6fc8e24a8378072cc8a3e94a625c5506f56fd36beb", "pdf_url": "https://zenodo.org/api/records/20602944/files/paper_04_agent_spacetime_architecture.pdf/content", "registered_version_relations": {"version": [{"index": 0, "is_last": false, "parent": {"pid_type": "recid", "pid_value": "20602943"}}]}, "reviewed_genre": "documentation", "reviewed_genre_report_sha256": "a8ef4ed60ab9a32cb83ce106e436101a991cc05b5a10362ac08f5bdc18c2f5d4", "source_url": "https://zenodo.org/api/records/20602944", "title": "Embedding Autonomous Agents in Simulated Spacetime"}, {"conceptdoi": "10.5281/zenodo.20602943", "creators": [{"affiliation": null, "name": "Medina Hernandez, Alfredo"}, {"affiliation": null, "name": "MedinaTech"}], "declared_resource_type": {"subtype": "softwaredocumentation", "title": "Software documentation", "type": "publication"}, "doi": "10.5281/zenodo.20711464", "extracted_pages_sha256": "075d9483ed82aba4088907be088868b31c9971e37b9ec8d84c4b112c69381615", "files": ["Spatium Computalis.pdf", "intra_turn_deliberation_metrics.md", "spatium_computationis_v4_journal_paper.zip"], "metadata_sha256": "285b116c4938eb68b588964eb06f8b5c3e1e2e49a7ad7a20127b3954aa4ce993", "pdf_sha256": "3703d673e9a52e0bf559fa8f98c836968d63b1978d3b0c5a37c0dd130e0755bb", "pdf_url": "https://zenodo.org/api/records/20711464/files/Spatium%20Computalis.pdf/content", "registered_version_relations": {"version": [{"index": 1, "is_last": true, "parent": {"pid_type": "recid", "pid_value": "20602943"}}]}, "reviewed_genre": "paper", "reviewed_genre_report_sha256": "a8ef4ed60ab9a32cb83ce106e436101a991cc05b5a10362ac08f5bdc18c2f5d4", "source_url": "https://zenodo.org/api/records/20711464", "title": "SpatiumComputationisv4: Physics-Bounded Multi-Agent Worlds as a Research Substrate for Autonomous Intelligence"}]}, "evidence": "primary-source-passages", "id": "doi-10-5281-zenodo-20711464", "kind": "paper", "name": "Spatium Computationis v4: Physics-Bounded Multi-Agent Worlds as a Research Substrate for Autonomous Intelligence", "organization": null, "reviewed_at": "2026-10-15", "slug": "doi-10-5281-zenodo-20711464", "source_url": "https://doi.org/10.5281/zenodo.20711464", "status": "published", "summary_en": "The manuscript proposes coordinating agents and threat flows through zones in a computational world, including honeypots, deception regions, and classification and quarantine routes.", "summary_es": "El manuscrito propone coordinar agentes y flujos de amenazas mediante zonas en un mundo computacional, incluyendo honeypots, regiones de engaño y rutas de clasificación y cuarentena.", "updated_at": "2026-10-15", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-15", "authors": ["Anonymous"], "doi": "10.5281/zenodo.21756582", "doi_aliases": ["10.5281/zenodo.21756581"], "draft_review_basis": "deepseek-original-draft; codex-source-correction-and-independent-claude-review", "environments": [], "full_text_reviewed": false, "journal": null, "limitations_en": "Based on the complete official deposited description. The standalone manuscript was not recovered and its results were not validated.", "limitations_es": "Lectura de la descripción oficial completa. No se recuperó el manuscrito independiente ni se validaron sus resultados.", "metadata_sha256": "4d51364ecde2be35e5d595a258a3032c0e452eb984e88302f1304ae9fc0d35d0", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "source-page", "review_depth": "complete official deposited description and selected file where identified", "reviewed_metadata_url": "https://zenodo.org/api/records/21756582", "selection_report": "data/coverage/runtime-deception-source-clarification-2026-10-15.json", "selection_report_sha256": "2f2d8a36dcd6e0217ebad8d2feb90fa54f10d41ccc76bf44437df547c9154c74", "source_correction_input_sha256": "900064e042ff0afc9381636882c20d3b2d749aec9f48ecf93702d48c8e1bf2c0", "source_document_url": "https://zenodo.org/api/records/21756582", "source_packet_sha256": "ad86ca467e69ac5b91b21db0f9abac999717125502b4f5fba1822e2c75185efc", "source_quote": "a canary layer that closes the crypto floor for planted values by precomputing the bait's transforms.", "source_quote_locator": {"field": "official deposited description", "standalone_manuscript_read": false}, "source_sha256": "4d51364ecde2be35e5d595a258a3032c0e452eb984e88302f1304ae9fc0d35d0", "source_title": "A closed-loop consequence-governance runtime for AI agents: structural gating, counterfactual recovery, and adaptive hardening", "source_type": "complete official deposited description and selected file where identified", "tags": [], "techniques": ["Honeytoken"]}, "evidence": "primary-source-passages", "id": "doi-10-5281-zenodo-21756582", "kind": "paper", "name": "A closed-loop consequence-governance runtime for AI agents: structural gating, counterfactual recovery, and adaptive hardening", "organization": null, "reviewed_at": "2026-10-15", "slug": "doi-10-5281-zenodo-21756582", "source_url": "https://doi.org/10.5281/zenodo.21756582", "status": "published", "summary_en": "Within a broader agent-governance proposal, the preprint describes planted canary values and precomputed transformations for detecting exfiltration of those values.", "summary_es": "Dentro de una propuesta de gobernanza para agentes de IA, el preprint describe valores canario plantados y transformaciones precalculadas para detectar su exfiltración.", "updated_at": "2026-10-15", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-13", "authors": ["Khorozov Khumoyun Inomjon oglu, Mamatkarimov Asadbek Anvarjonovich, Qaxramonov Sardor, Sotvoldiyev Asadbek", "Worldly Knowledge Publishing Centre"], "doi": "10.5281/zenodo.21757903", "doi_aliases": ["10.5281/zenodo.21757902"], "draft_review_basis": "deepseek-draft-and-independent-claude-review", "environments": ["Network"], "full_text_reviewed": false, "limitations_en": "Review limited to selected PDF identity/scope passages; no independent validation of results or effectiveness was performed.", "limitations_es": "Revisión limitada a las páginas seleccionadas del PDF de identidad y alcance; no se validaron de forma independiente los resultados ni la eficacia.", "metadata_sha256": "5001f70fad3850ae5dd2a7085c38ab686a6d1dbb88fe444c0424d8a278608dd7", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "source-page", "review_depth": "selected primary PDF pages", "reviewed_metadata_url": "https://zenodo.org/api/records/21757903", "selection_report_sha256": "8c94e41ae3ef31103ef600a77351f1f63b7db35c1f540eb9848e267d4c71297b", "software_executed": false, "source_document_url": "https://zenodo.org/api/records/21757903/files/3-11.pdf/content", "source_packet_sha256": "46eac4c70bd70c3d03886b6fd4961c6954404c2bab7ce0fbd6fe7f44184fbe37", "source_quote": "Cowrie honeypot SSH va Telnet xizmatlariga qaratilgan hujumlarni kuzatish, qayd etish va tahlil qilish uchun mo‘ljallangan maxsus dasturiy vosita hisoblanadi.", "source_quote_locator": {"pdf_page": 1}, "source_sha256": "061f5bd8433a7f1e37c2dff5171b9cac6291c24c33d58c038822bdc735801de2", "source_title": "COWRIE HONEYPOT INSTALLATION, CONFIGURATION AND SSH ATTACK LOGGING PROCESS", "tags": [], "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "primary-document-passages", "id": "doi-10-5281-zenodo-21757903", "kind": "paper", "name": "COWRIE HONEYPOT INSTALLATION, CONFIGURATION AND SSH ATTACK LOGGING PROCESS", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-5281-zenodo-21757903", "source_url": "https://doi.org/10.5281/zenodo.21757903", "status": "published", "summary_en": "The authors describe installing and configuring Cowrie on Linux as an SSH and Telnet honeypot that logs attacker login attempts, credentials, and terminal commands to log files.", "summary_es": "Los autores describen la instalación y configuración de Cowrie en Linux como un honeypot de SSH y Telnet que registra intentos de inicio de sesión, credenciales y comandos de atacantes en archivos de log.", "updated_at": "2026-10-13", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-15", "authors": ["Stamatogiannakis, Manolis", "Bos, Herbert", "Groth, Paul"], "dataset_files_analyzed": false, "deposited_version": "1.0", "doi": "10.5281/zenodo.3759652", "doi_aliases": ["10.5281/zenodo.3759651"], "draft_review_basis": "deepseek-draft-and-independent-claude-review", "environments": ["Network", "Endpoint"], "full_text_reviewed": false, "identity_report_reference_refreshed": true, "identity_report_sha256": "b3f8aed210739c468aae86c80aa29cb7bf5d1a6e46e4db65711aacd7722c24d6", "identity_report_sha256_in_frozen_ai_input": "baa0aff2dea7f02eb0fbab32ef363b43954a2cc8505ac2a42cb2bbd972b20bb7", "journal": null, "limitations_en": "Assessment based only on deposited metadata and abstract; no code was executed and no dataset files were analyzed.", "limitations_es": "Evaluación basada únicamente en metadatos y resumen depositado; no se ejecutó código ni se analizaron los archivos del conjunto de datos.", "metadata_sha256": "f8b79bc3579b5548b46781f5be03d0e5933782a6d5935d699cab9e91437800b8", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "related_paper_catalog_id": null, "related_paper_doi": "10.1145/3380786.3391396", "review_basis": "source-page", "review_depth": "DataCite repository-deposited DOI metadata with abstract", "reviewed_metadata_url": "https://api.datacite.org/dois/10.5281/zenodo.3759652", "selection_report": "data/coverage/educational-scope-third-review-2026-10-13.json", "selection_report_sha256": "51793eb87f113136572518fc4b6516e2c019f3714ebc6d160a68220f1c6706e3", "software_executed": false, "source_document_url": "https://api.datacite.org/dois/10.5281/zenodo.3759652", "source_packet_sha256": "fc09b32480f6aa17df812982143d691ab93047162c0e4f663947e99dedafd849", "source_quote": "The dataset aims to offer a starting point for the analysis of ssh brute force attacks", "source_quote_locator": {"field": "DataCite.attributes.descriptions (HTML normalized)"}, "source_sha256": "f8b79bc3579b5548b46781f5be03d0e5933782a6d5935d699cab9e91437800b8", "source_title": "PANDAcap SSH Honeypot Dataset", "source_type": "DataCite repository-deposited DOI metadata with abstract", "tags": [], "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "deposited-resource-description", "id": "doi-10-5281-zenodo-3759652", "kind": "dataset", "name": "PANDAcap SSH Honeypot Dataset", "organization": null, "reviewed_at": "2026-10-15", "slug": "doi-10-5281-zenodo-3759652", "source_url": "https://doi.org/10.5281/zenodo.3759652", "status": "published", "summary_en": "A set of PANDA traces collected with PANDAcap on a VM configured to accept all passwords for root, intended as a starting point for analyzing SSH brute force attacks. The material is organized into full-system traces, disk images and network captures.", "summary_es": "Conjunto de trazas PANDA recogidas con PANDAcap en una VM que acepta cualquier contraseña para root, pensado como punto de partida para analizar ataques de fuerza bruta SSH. El material se organiza en trazas de sistema completo, imágenes de disco y capturas de red.", "updated_at": "2026-10-15", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-10-13", "authors": ["Asere Gbenga Femi", "Innocent L. Mangbon", "Jumbo Daniel"], "doi": "10.54473/ijtret.2025.9305", "doi_aliases": [], "draft_review_basis": "deepseek-draft-and-independent-claude-review", "environments": ["Network", "Application"], "full_text_reviewed": false, "journal": "International Journal of Trendy Research in Engineering and Technology", "limitations_en": "Review of selected PDF pages (1 and 3), with no independent result validation.", "limitations_es": "Revisión de páginas PDF seleccionadas (1 y 3), sin validación independiente de resultados.", "metadata_sha256": "9e4c1d2732f3a9f2b548b34cfe9e3f3d6392ccf09daa66b49ffc1a6dd8507728", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "source-page", "review_depth": "selected primary PDF pages", "reviewed_metadata_url": "https://api.crossref.org/works/10.54473/ijtret.2025.9305", "selection_report_sha256": "8c94e41ae3ef31103ef600a77351f1f63b7db35c1f540eb9848e267d4c71297b", "software_executed": false, "source_document_url": "https://www.trendytechjournals.com/ijtret/volume9/issue3-5.pdf", "source_packet_sha256": "8e0a2e80266214e31980d88b138df456cc0839a4b942a978beddb449b41ba252", "source_quote": "Social engineering- specific honeypots simulate human interaction, such as email responses or chatbot interactions, to detect and log attempts.", "source_quote_locator": {"pdf_page": 3}, "source_sha256": "4d6d2de0a1e22aa01953a13a5272c65094b73574acb829589fca4db3989a4d44", "source_title": "SOCIAL ENGINEERING ATTACKS: TRENDS, DETECTION, AND PREVENTION", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-document-passages", "id": "doi-10-54473-ijtret-2025-9305", "kind": "paper", "name": "SOCIAL ENGINEERING ATTACKS: TRENDS, DETECTION, AND PREVENTION", "organization": null, "reviewed_at": "2026-10-13", "slug": "doi-10-54473-ijtret-2025-9305", "source_url": "https://doi.org/10.54473/ijtret.2025.9305", "status": "published", "summary_en": "The authors review social engineering and describe, among other defenses, honeypots that simulate human interaction, such as email responses or chatbot interactions, to lure and log attack attempts.", "summary_es": "Los autores revisan la ingeniería social y describen, entre otras defensas, honeypots que simulan interacción humana, como respuestas de correo o interacciones de chatbot, para atraer y registrar intentos de ataque.", "updated_at": "2026-10-13", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-10-15", "authors": ["Alejandra Alemán Delgado", "Roberto Castañeda González", "Luz Adriana Orozco Ramírez"], "doi": "10.69821/plagcis.44.c76", "doi_aliases": [], "draft_review_basis": "deepseek-original-draft; codex-source-correction-and-independent-claude-review", "environments": [], "full_text_reviewed": false, "journal": "Ciberviolencia y riesgos digitales: avances, desafíos y perspectivas en investigación", "limitations_en": "Review based solely on the Crossref-deposited abstract; the full text was not accessed and no results, experiments or implementations were validated.", "limitations_es": "Revisión basada únicamente en el resumen depositado en Crossref; no se accedió al texto completo ni se validaron resultados, experimentos o implementaciones.", "metadata_sha256": "b42eec36dfda7eb7ef626b7911a709f1caa5bacd61117769c5a46622a0a8c6e7", "publication_basis": "source-reviewed-followup-batch-2026-10-17", "review_basis": "source-page", "review_depth": "Crossref member-deposited bibliographic metadata with abstract", "reviewed_metadata_url": "https://api.crossref.org/works/10.69821/plagcis.44.c76", "selection_report": "data/coverage/educational-scope-third-review-2026-10-13.json", "selection_report_sha256": "51793eb87f113136572518fc4b6516e2c019f3714ebc6d160a68220f1c6706e3", "source_correction_input_sha256": "b0917c58b5d8f7bafac94a890b747835206318b7f6f08611e0bff408b75034ed", "source_document_url": "https://api.crossref.org/works/10.69821/plagcis.44.c76", "source_packet_sha256": "66384bf6b1a0b298e884dc71fd950ad1b8cc833ba8afd9b0f5eccf2ffa6c2f2d", "source_quote": "Se proponen estrategias basadas en la educación emocional de las víctimas, la divulgación de información preventiva y el uso de herramientas tecnológicas como las honeynets para analizar el comportamiento de los atacantes y mitigar el impacto de este fenómeno global.", "source_quote_locator": {"field": "Crossref.message.abstract (HTML normalized)"}, "source_sha256": "b42eec36dfda7eb7ef626b7911a709f1caa5bacd61117769c5a46622a0a8c6e7", "source_title": "Conductas violentas en el panorama digital. ciberagresores", "source_type": "Crossref member-deposited bibliographic metadata with abstract", "tags": [], "techniques": ["Honeypot"]}, "evidence": "primary-source-passages", "id": "doi-10-69821-plagcis-44-c76", "kind": "paper", "name": "Conductas violentas en el panorama digital. ciberagresores", "organization": null, "reviewed_at": "2026-10-15", "slug": "doi-10-69821-plagcis-44-c76", "source_url": "https://doi.org/10.69821/plagcis.44.c76", "status": "published", "summary_en": "The chapter analyzes cyberviolence and the traits of adolescent cyberaggressors and proposes comprehensive prevention involving families, educational institutions and technological tools such as honeynets to analyze attacker behavior and mitigate the impact.", "summary_es": "El capítulo analiza la ciberviolencia y los rasgos de los ciberagresores adolescentes y propone prevención integral que incluye familias, instituciones educativas y herramientas tecnológicas como las honeynets para analizar el comportamiento de los atacantes y mitigar el impacto.", "updated_at": "2026-10-15", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "authors": ["Federico Pacheco", "Diego Staino"], "disclosure_en": "Federico Pacheco, the Atlas owner, contributed to this project or its associated publication. This record follows the same source and limitation criteria as the rest of the catalog; it is not an independent evaluation.", "disclosure_es": "Federico Pacheco, responsable de este Atlas, participa en este proyecto o su publicación asociada. La ficha aplica los mismos criterios de fuentes y límites que el resto del catálogo; no constituye una evaluación independiente.", "doi": "10.13140/RG.2.2.34289.29289", "environments": ["Network", "Application"], "limitations_en": "This is a proposal and architecture preprint. Expected effectiveness and low operational impact are not independent evaluations.", "limitations_es": "Se trata de un preprint de propuesta y arquitectura. Las expectativas de eficacia y bajo impacto operativo no equivalen a una evaluación independiente.", "review_basis": "abstract", "source_language": "es", "source_title": "Preprint de los autores — ResearchGate", "tags": ["BASE4 Security", "Federico Pacheco", "Diego Staino"], "techniques": ["Decoy", "Adversary engagement"]}, "evidence": "paper-abstract", "id": "dolos-t-minimal-deception-2024", "kind": "paper", "name": "Propuesta para implementación de estrategias minimalistas de ciber engaño", "organization": "Federico Pacheco y Diego Staino", "reviewed_at": "2026-09-15", "slug": "dolos-t-minimal-deception-2024", "source_url": "https://www.researchgate.net/publication/379404267_Proposal_for_the_implementation_of_minimalistic_cyber_deception_strategies", "status": "published", "summary_en": "Pacheco and Staino preprint proposing a cyclical, minimal deception process and presenting DOLOS-T as an open tool for exploring it.", "summary_es": "Preprint de Pacheco y Staino que propone un proceso cíclico y minimalista de deception y presenta DOLOS-T como herramienta abierta para experimentarlo.", "updated_at": "2026-09-15", "year": 2024}
{"critical_reading": {"limitations_en": "The offering page does not publish outcome metrics or full operating agreements.", "limitations_es": "La página de oferta no publica métricas de resultados ni acuerdos operativos completos.", "observation_en": "ECCA lists integration, training and managed operation for customers in Egypt and GCC.", "observation_es": "ECCA enumera integración, formación y operación gestionada para clientes en Egipto y GCC.", "question_en": "Who maintains decoys and responds to alerts in each delivery mode?", "question_es": "¿Quién mantiene los señuelos y responde a las alertas en cada modalidad?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "deployment_regions": ["Egypt", "Africa", "GCC"], "environments": ["Network", "Identity"], "organization_country": "Egypt", "review_basis": "source-page", "source_language": "en", "source_title": "Deception as a Service", "tags": [], "techniques": ["Decoy"]}, "evidence": "provider-offering", "id": "ecca-deception-as-a-service", "kind": "service", "name": "Deception as a Service", "organization": "ECCA Group", "reviewed_at": "2026-09-15", "slug": "ecca-deception-as-a-service", "source_url": "https://ecca-group.com/deception-as-a-service/", "status": "published", "summary_en": "ECCA offering in Egypt and GCC listing integration, independent services, training and managed deception.", "summary_es": "Oferta de ECCA en Egipto y GCC que enumera integración, servicios independientes, formación y gestión de deception.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": {"limitations_en": "Independent outcomes and clinical deployment constraints were not verified here.", "limitations_es": "No se verificaron aquí resultados independientes ni restricciones clínicas del despliegue.", "observation_en": "Fidelis publishes a deployment story at a children’s hospital.", "observation_es": "Fidelis publica una experiencia de despliegue en un hospital infantil.", "question_en": "Which controls ensure a decoy does not affect clinical systems?", "question_es": "¿Qué controles aseguran que un señuelo no afecta sistemas asistenciales?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Network", "Identity"], "review_basis": "source-page", "source_title": "Children’s Hospital / Fidelis Deception", "tags": [], "techniques": ["Decoy"]}, "evidence": "vendor-published-case", "id": "fidelis-childrens-hospital", "kind": "case-study", "name": "Children’s Hospital / Fidelis Deception", "organization": "Fidelis Security", "reviewed_at": "2026-09-15", "slug": "fidelis-childrens-hospital", "source_url": "https://fidelissecurity.com/resource/case-study/childrens-hospital/", "status": "published", "summary_en": "Vendor-published story of Fidelis Deception use at a North American children’s hospital.", "summary_es": "Relato de uso de Fidelis Deception en un hospital infantil norteamericano publicado por el proveedor.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": {"limitations_en": "This record does not verify integrations, permissions or detection outcomes.", "limitations_es": "Esta ficha no comprueba integraciones, permisos ni resultados de detección.", "observation_en": "Fidelis publishes a decoy and breadcrumb offering across environments.", "observation_es": "Fidelis publica una oferta de señuelos y breadcrumbs en varios entornos.", "question_en": "Which integration carries decoy interactions into the SOC workflow?", "question_es": "¿Qué integración lleva la interacción con el señuelo al flujo del SOC?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Network", "Identity", "Cloud"], "review_basis": "source-page", "source_title": "Fidelis Deception", "tags": [], "techniques": ["Decoy", "Honeytoken"]}, "evidence": "vendor-claim", "id": "fidelis-deception", "kind": "product", "name": "Fidelis Deception", "organization": "Fidelis Security", "reviewed_at": "2026-09-15", "slug": "fidelis-deception", "source_url": "https://fidelissecurity.com/solutions/deception/", "status": "published", "summary_en": "Commercial decoy and breadcrumb platform for network, identity and cloud, according to Fidelis.", "summary_es": "Plataforma comercial de señuelos y breadcrumbs para redes, identidad y cloud, según la oferta de Fidelis.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": {"limitations_en": "An OT/ICS category does not prove safe isolation in a specific plant.", "limitations_es": "La presencia de una categoría OT/ICS no demuestra aislamiento seguro en una planta concreta.", "observation_en": "The commercial page claims decoys for network and industrial environments.", "observation_es": "La página comercial declara señuelos para red y entornos industriales.", "question_en": "How is process safety validated before placing industrial decoys?", "question_es": "¿Cómo se valida seguridad de proceso antes de colocar señuelos industriales?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Network", "OT/ICS"], "review_basis": "source-page", "source_title": "FortiDeceptor", "tags": [], "techniques": ["Decoy", "Honeypot"]}, "evidence": "vendor-claim", "id": "fortideceptor", "kind": "product", "name": "FortiDeceptor", "organization": "Fortinet", "reviewed_at": "2026-09-15", "slug": "fortideceptor", "source_url": "https://www.fortinet.com/products/fortideceptor", "status": "published", "summary_en": "Fortinet platform for deploying decoy assets and alerting on their use.", "summary_es": "Plataforma de Fortinet para desplegar activos señuelo y alertar sobre su uso.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": {"limitations_en": "Response plausibility and inference cost were not independently evaluated in this record.", "limitations_es": "La plausibilidad y el costo de inferencia no se evaluaron de forma independiente en esta ficha.", "observation_en": "Documentation presents a web honeypot with language-model-generated responses.", "observation_es": "La documentación presenta un honeypot web con respuestas generadas mediante un modelo de lenguaje.", "question_en": "When does an adversary detect inconsistent or out-of-context responses?", "question_es": "¿Cuándo detecta el adversario respuestas inconsistentes o fuera de contexto?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Application"], "review_basis": "repository-metadata", "source_title": "Galah", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "galah", "kind": "software", "name": "Galah", "organization": "0x4D31", "reviewed_at": "2026-09-15", "slug": "galah", "source_url": "https://github.com/0x4D31/galah", "status": "published", "summary_en": "Web honeypot using a language model to generate interactions.", "summary_es": "Honeypot web que utiliza un modelo de lenguaje para generar interacciones.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": {"limitations_en": "Formal assumptions may not reflect a real attacker’s knowledge, resources or decisions.", "limitations_es": "Los supuestos formales pueden no reflejar conocimiento, recursos o decisiones de un atacante real.", "observation_en": "The abstract proposes a game-theoretic taxonomy of defensive deception.", "observation_es": "El abstract propone una taxonomía de engaño defensivo basada en teoría de juegos.", "question_en": "Which model assumptions change decoy selection?", "question_es": "¿Qué supuestos del modelo cambian la elección del señuelo?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "authors": ["Jeffrey Pawlick", "Edward Colbert", "Quanyan Zhu"], "design_en": "Survey and taxonomy organizing work through games among defender, attacker and users.", "design_es": "Revisión y taxonomía que organiza trabajos mediante juegos entre defensor, atacante y usuarios.", "doi_aliases": ["10.1145/3337772", "10.48550/arxiv.1712.05441"], "environments": ["Network"], "finding_en": "Relates six deception classes to private information, signals, actions and utilities.", "finding_es": "Relaciona seis clases de engaño con información privada, señales, acciones y utilidades.", "full_text_reviewed_at": "2026-09-16", "limits_en": "Models abstract behavior, information and rationality; operational fit requires scenario validation.", "limits_es": "Los modelos abstraen conducta, información y racionalidad; su ajuste operativo debe validarse por escenario.", "review_basis": "full-text", "source_title": "A Game-Theoretic Taxonomy and Survey of Defensive Deception for Cybersecurity and Privacy", "tags": [], "techniques": ["Moving target defense", "Honeytoken"]}, "evidence": "full-text-review", "id": "game-taxonomy-2017", "kind": "paper", "name": "A Game-Theoretic Taxonomy and Survey of Defensive Deception for Cybersecurity and Privacy", "organization": "Pawlick et al.", "reviewed_at": "2026-09-16", "slug": "game-taxonomy-2017", "source_url": "https://arxiv.org/abs/1712.05441", "status": "published", "summary_en": "Game-theoretic taxonomy distinguishing several forms of defensive deception.", "summary_es": "Taxonomía basada en teoría de juegos que distingue varios tipos de engaño defensivo.", "updated_at": "2026-09-18", "year": 2017}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Network"], "last_push": "2020-12-27T09:28:27Z", "license": "MIT", "review_basis": "repository-metadata", "source_title": "aelth/ddospot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-aelth-ddospot", "kind": "software", "name": "ddospot", "organization": "aelth", "reviewed_at": "2026-09-15", "slug": "gh-aelth-ddospot", "source_url": "https://github.com/aelth/ddospot", "status": "published", "summary_en": "Repository about observation of UDP-service abuse; documentation and maintenance require further review.", "summary_es": "Repositorio sobre observación de abusos de servicios UDP; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Network"], "last_push": "2024-05-20T19:13:04Z", "review_basis": "repository-metadata", "source_title": "betheroot/pghoney", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-betheroot-pghoney", "kind": "software", "name": "pghoney", "organization": "betheroot", "reviewed_at": "2026-09-15", "slug": "gh-betheroot-pghoney", "source_url": "https://github.com/betheroot/pghoney", "status": "published", "summary_en": "Repository about PostgreSQL simulation; documentation and maintenance require further review.", "summary_es": "Repositorio sobre simulación de PostgreSQL; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2017}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Network"], "last_push": "2024-08-06T17:17:05Z", "license": "MIT", "review_basis": "repository-metadata", "source_title": "betheroot/sticky_elephant", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-betheroot-sticky-elephant", "kind": "software", "name": "sticky_elephant", "organization": "betheroot", "reviewed_at": "2026-09-15", "slug": "gh-betheroot-sticky-elephant", "source_url": "https://github.com/betheroot/sticky_elephant", "status": "published", "summary_en": "Repository about interactive PostgreSQL simulation; documentation and maintenance require further review.", "summary_es": "Repositorio sobre simulación interactiva de PostgreSQL; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2017}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Application"], "last_push": "2021-12-20T14:44:27Z", "review_basis": "repository-metadata", "source_title": "BinaryDefense/log4j-honeypot-flask", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-binarydefense-log4j-honeypot-flask", "kind": "software", "name": "log4j-honeypot-flask", "organization": "BinaryDefense", "reviewed_at": "2026-09-15", "slug": "gh-binarydefense-log4j-honeypot-flask", "source_url": "https://github.com/BinaryDefense/log4j-honeypot-flask", "status": "published", "summary_en": "Repository about observation of Log4j scans; documentation and maintenance require further review.", "summary_es": "Repositorio sobre observación de escaneos Log4j; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Application"], "last_push": "2026-09-11T14:27:51Z", "license": "MIT", "review_basis": "repository-metadata", "source_title": "BlessedRebuS/Krawl", "tags": [], "techniques": ["Decoy"]}, "evidence": "repository-metadata", "id": "gh-blessedrebus-krawl", "kind": "software", "name": "Krawl", "organization": "BlessedRebuS", "reviewed_at": "2026-09-15", "slug": "gh-blessedrebus-krawl", "source_url": "https://github.com/BlessedRebuS/Krawl", "status": "published", "summary_en": "Repository about fake applications for attacker diversion; documentation and maintenance require further review.", "summary_es": "Repositorio sobre aplicaciones falsas para desviar atacantes; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Cloud"], "last_push": "2020-10-06T14:41:21Z", "license": "Apache-2.0", "review_basis": "repository-metadata", "source_title": "ciscocsirt/dhp", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-ciscocsirt-dhp", "kind": "software", "name": "dhp", "organization": "ciscocsirt", "reviewed_at": "2026-09-15", "slug": "gh-ciscocsirt-dhp", "source_url": "https://github.com/ciscocsirt/dhp", "status": "published", "summary_en": "Repository about Docker API simulation; documentation and maintenance require further review.", "summary_es": "Repositorio sobre simulación de la API de Docker; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Network"], "last_push": "2018-11-23T11:47:10Z", "license": "MIT", "review_basis": "repository-metadata", "source_title": "Cymmetria/ciscoasa_honeypot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-cymmetria-ciscoasa-honeypot", "kind": "software", "name": "ciscoasa_honeypot", "organization": "Cymmetria", "reviewed_at": "2026-09-15", "slug": "gh-cymmetria-ciscoasa-honeypot", "source_url": "https://github.com/Cymmetria/ciscoasa_honeypot", "status": "published", "summary_en": "Repository about Cisco ASA simulation; documentation and maintenance require further review.", "summary_es": "Repositorio sobre simulación de Cisco ASA; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2018}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Application"], "last_push": "2017-03-24T10:32:17Z", "license": "MIT", "review_basis": "repository-metadata", "source_title": "Cymmetria/StrutsHoneypot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-cymmetria-strutshoneypot", "kind": "software", "name": "StrutsHoneypot", "organization": "Cymmetria", "reviewed_at": "2026-09-15", "slug": "gh-cymmetria-strutshoneypot", "source_url": "https://github.com/Cymmetria/StrutsHoneypot", "status": "published", "summary_en": "Repository about Apache Struts simulation; documentation and maintenance require further review.", "summary_es": "Repositorio sobre simulación de Apache Struts; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2017}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Application"], "last_push": "2020-04-25T20:55:29Z", "license": "MIT", "review_basis": "repository-metadata", "source_title": "Cymmetria/weblogic_honeypot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-cymmetria-weblogic-honeypot", "kind": "software", "name": "weblogic_honeypot", "organization": "Cymmetria", "reviewed_at": "2026-09-15", "slug": "gh-cymmetria-weblogic-honeypot", "source_url": "https://github.com/Cymmetria/weblogic_honeypot", "status": "published", "summary_en": "Repository about Oracle WebLogic simulation; documentation and maintenance require further review.", "summary_es": "Repositorio sobre simulación de Oracle WebLogic; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2018}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Network"], "last_push": "2021-04-23T05:57:05Z", "license": "GPL-3.0", "review_basis": "repository-metadata", "source_title": "cypwnpwnsocute/RedisHoneyPot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-cypwnpwnsocute-redishoneypot", "kind": "software", "name": "RedisHoneyPot", "organization": "cypwnpwnsocute", "reviewed_at": "2026-09-15", "slug": "gh-cypwnpwnsocute-redishoneypot", "source_url": "https://github.com/cypwnpwnsocute/RedisHoneyPot", "status": "published", "summary_en": "Repository about decoy Redis service; documentation and maintenance require further review.", "summary_es": "Repositorio sobre servicio señuelo Redis; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Application"], "last_push": "2019-07-14T03:50:37Z", "license": "MIT", "review_basis": "repository-metadata", "source_title": "d1str0/drupot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-d1str0-drupot", "kind": "software", "name": "drupot", "organization": "d1str0", "reviewed_at": "2026-09-15", "slug": "gh-d1str0-drupot", "source_url": "https://github.com/d1str0/drupot", "status": "published", "summary_en": "Repository about Drupal simulation; documentation and maintenance require further review.", "summary_es": "Repositorio sobre simulación de Drupal; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2019}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Application"], "last_push": "2024-04-10T14:22:38Z", "license": "MIT", "review_basis": "repository-metadata", "source_title": "dmpayton/django-admin-honeypot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-dmpayton-django-admin-honeypot", "kind": "software", "name": "django-admin-honeypot", "organization": "dmpayton", "reviewed_at": "2026-09-15", "slug": "gh-dmpayton-django-admin-honeypot", "source_url": "https://github.com/dmpayton/django-admin-honeypot", "status": "published", "summary_en": "Repository about decoy Django admin login; documentation and maintenance require further review.", "summary_es": "Repositorio sobre login señuelo de administración Django; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2011}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Network"], "last_push": "2014-03-27T07:20:52Z", "review_basis": "repository-metadata", "source_title": "fygrave/honeyntp", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-fygrave-honeyntp", "kind": "software", "name": "honeyntp", "organization": "fygrave", "reviewed_at": "2026-09-15", "slug": "gh-fygrave-honeyntp", "source_url": "https://github.com/fygrave/honeyntp", "status": "published", "summary_en": "Repository about decoy NTP service; documentation and maintenance require further review.", "summary_es": "Repositorio sobre servicio señuelo NTP; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2014}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Application"], "last_push": "2018-02-11T16:45:53Z", "license": "GPL-3.0", "review_basis": "repository-metadata", "source_title": "gfoss/phpmyadmin_honeypot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-gfoss-phpmyadmin-honeypot", "kind": "software", "name": "phpmyadmin_honeypot", "organization": "gfoss", "reviewed_at": "2026-09-15", "slug": "gh-gfoss-phpmyadmin-honeypot", "source_url": "https://github.com/gfoss/phpmyadmin_honeypot", "status": "published", "summary_en": "Repository about phpMyAdmin simulation; documentation and maintenance require further review.", "summary_es": "Repositorio sobre simulación de phpMyAdmin; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2012}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Application"], "last_push": "2017-08-27T09:48:01Z", "license": "MIT", "review_basis": "repository-metadata", "source_title": "helospark/tomcat-manager-honeypot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-helospark-tomcat-manager-honeypot", "kind": "software", "name": "tomcat-manager-honeypot", "organization": "helospark", "reviewed_at": "2026-09-15", "slug": "gh-helospark-tomcat-manager-honeypot", "source_url": "https://github.com/helospark/tomcat-manager-honeypot", "status": "published", "summary_en": "Repository about Tomcat manager simulation; documentation and maintenance require further review.", "summary_es": "Repositorio sobre simulación del administrador Tomcat; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2017}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Endpoint"], "last_push": "2015-03-24T14:35:53Z", "license": "GPL-3.0", "review_basis": "repository-metadata", "source_title": "honeynet/ghost-usb-honeypot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-honeynet-ghost-usb-honeypot", "kind": "software", "name": "ghost-usb-honeypot", "organization": "honeynet", "reviewed_at": "2026-09-15", "slug": "gh-honeynet-ghost-usb-honeypot", "source_url": "https://github.com/honeynet/ghost-usb-honeypot", "status": "published", "summary_en": "Repository about capture of USB-propagated malware; documentation and maintenance require further review.", "summary_es": "Repositorio sobre captura de malware propagado por USB; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2015}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Application"], "last_push": "2023-05-02T16:39:01Z", "license": "Apache-2.0", "review_basis": "repository-metadata", "source_title": "joda32/owa-honeypot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-joda32-owa-honeypot", "kind": "software", "name": "owa-honeypot", "organization": "joda32", "reviewed_at": "2026-09-15", "slug": "gh-joda32-owa-honeypot", "source_url": "https://github.com/joda32/owa-honeypot", "status": "published", "summary_en": "Repository about Outlook Web Access simulation; documentation and maintenance require further review.", "summary_es": "Repositorio sobre simulación de Outlook Web Access; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2019}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Network"], "last_push": "2015-07-14T19:27:37Z", "license": "MIT", "review_basis": "repository-metadata", "source_title": "jordan-wright/elastichoney", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-jordan-wright-elastichoney", "kind": "software", "name": "elastichoney", "organization": "jordan-wright", "reviewed_at": "2026-09-15", "slug": "gh-jordan-wright-elastichoney", "source_url": "https://github.com/jordan-wright/elastichoney", "status": "published", "summary_en": "Repository about Elasticsearch simulation; documentation and maintenance require further review.", "summary_es": "Repositorio sobre simulación de Elasticsearch; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2015}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Network"], "last_push": "2020-01-15T13:58:22Z", "review_basis": "repository-metadata", "source_title": "MalwareTech/CitrixHoneypot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-malwaretech-citrixhoneypot", "kind": "software", "name": "CitrixHoneypot", "organization": "MalwareTech", "reviewed_at": "2026-09-15", "slug": "gh-malwaretech-citrixhoneypot", "source_url": "https://github.com/MalwareTech/CitrixHoneypot", "status": "published", "summary_en": "Repository about observation of Citrix exploitation; documentation and maintenance require further review.", "summary_es": "Repositorio sobre observación de explotación Citrix; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Network"], "last_push": "2013-12-20T18:45:20Z", "review_basis": "repository-metadata", "source_title": "mdp/honeypot.go", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-mdp-honeypot-go", "kind": "software", "name": "honeypot.go", "organization": "mdp", "reviewed_at": "2026-09-15", "slug": "gh-mdp-honeypot-go", "source_url": "https://github.com/mdp/honeypot.go", "status": "published", "summary_en": "Repository about SSH simulation in Go; documentation and maintenance require further review.", "summary_es": "Repositorio sobre simulación de SSH en Go; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2013}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["OT/ICS"], "last_push": "2026-09-14T22:24:15Z", "license": "GPL-2.0", "review_basis": "repository-metadata", "source_title": "mushorg/conpot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-mushorg-conpot", "kind": "software", "name": "conpot", "organization": "mushorg", "reviewed_at": "2026-09-15", "slug": "gh-mushorg-conpot", "source_url": "https://github.com/mushorg/conpot", "status": "published", "summary_en": "Repository about industrial-system simulation; documentation and maintenance require further review.", "summary_es": "Repositorio sobre simulación de sistemas industriales; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2013}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Application"], "last_push": "2024-08-19T22:54:36Z", "license": "GPL-3.0", "review_basis": "repository-metadata", "source_title": "mushorg/tanner", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-mushorg-tanner", "kind": "software", "name": "tanner", "organization": "mushorg", "reviewed_at": "2026-09-15", "slug": "gh-mushorg-tanner", "source_url": "https://github.com/mushorg/tanner", "status": "published", "summary_en": "Repository about SNARE web-event analysis; documentation and maintenance require further review.", "summary_es": "Repositorio sobre análisis de eventos web de SNARE; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2015}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Network"], "last_push": "2014-08-25T07:10:30Z", "review_basis": "repository-metadata", "source_title": "mycert/ESPot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-mycert-espot", "kind": "software", "name": "ESPot", "organization": "mycert", "reviewed_at": "2026-09-15", "slug": "gh-mycert-espot", "source_url": "https://github.com/mycert/ESPot", "status": "published", "summary_en": "Repository about observation of Elasticsearch attacks; documentation and maintenance require further review.", "summary_es": "Repositorio sobre observación de ataques a Elasticsearch; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2014}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Network"], "last_push": "2026-08-30T11:34:41Z", "review_basis": "repository-metadata", "source_title": "OWASP/Honeypot-Project", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-owasp-honeypot-project", "kind": "software", "name": "Honeypot-Project", "organization": "OWASP", "reviewed_at": "2026-09-15", "slug": "gh-owasp-honeypot-project", "source_url": "https://github.com/OWASP/Honeypot-Project", "status": "published", "summary_en": "Repository about OWASP honeypot material; documentation and maintenance require further review.", "summary_es": "Repositorio sobre material de honeypots de OWASP; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2018}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Application"], "last_push": "2024-09-15T09:17:13Z", "license": "Apache-2.0", "review_basis": "repository-metadata", "source_title": "OWASP/Python-Honeypot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-owasp-python-honeypot", "kind": "software", "name": "Python-Honeypot", "organization": "OWASP", "reviewed_at": "2026-09-15", "slug": "gh-owasp-python-honeypot", "source_url": "https://github.com/OWASP/Python-Honeypot", "status": "published", "summary_en": "Repository about Python deception framework; documentation and maintenance require further review.", "summary_es": "Repositorio sobre framework de deception en Python; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2018}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["IoT"], "last_push": "2024-02-02T22:07:12Z", "review_basis": "repository-metadata", "source_title": "Phype/telnet-iot-honeypot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-phype-telnet-iot-honeypot", "kind": "software", "name": "telnet-iot-honeypot", "organization": "Phype", "reviewed_at": "2026-09-15", "slug": "gh-phype-telnet-iot-honeypot", "source_url": "https://github.com/Phype/telnet-iot-honeypot", "status": "published", "summary_en": "Repository about capture of IoT botnet binaries; documentation and maintenance require further review.", "summary_es": "Repositorio sobre captura de binarios de botnets IoT; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2016}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Network"], "last_push": "2023-02-20T01:16:32Z", "license": "GPL-3.0", "review_basis": "repository-metadata", "source_title": "Plazmaz/MongoDB-HoneyProxy", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-plazmaz-mongodb-honeyproxy", "kind": "software", "name": "MongoDB-HoneyProxy", "organization": "Plazmaz", "reviewed_at": "2026-09-15", "slug": "gh-plazmaz-mongodb-honeyproxy", "source_url": "https://github.com/Plazmaz/MongoDB-HoneyProxy", "status": "published", "summary_en": "Repository about MongoDB decoy proxy; documentation and maintenance require further review.", "summary_es": "Repositorio sobre proxy señuelo de MongoDB; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2017}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Network"], "last_push": "2025-12-03T18:22:22Z", "license": "AGPL-3.0", "review_basis": "repository-metadata", "source_title": "qeeqbox/honeypots", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-qeeqbox-honeypots", "kind": "software", "name": "honeypots", "organization": "qeeqbox", "reviewed_at": "2026-09-15", "slug": "gh-qeeqbox-honeypots", "source_url": "https://github.com/qeeqbox/honeypots", "status": "published", "summary_en": "Repository about multi-protocol sensors; documentation and maintenance require further review.", "summary_es": "Repositorio sobre sensores de múltiples protocolos; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Application"], "last_push": "2024-05-08T03:19:45Z", "license": "Apache-2.0", "review_basis": "repository-metadata", "source_title": "referefref/modpot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-referefref-modpot", "kind": "software", "name": "modpot", "organization": "referefref", "reviewed_at": "2026-09-15", "slug": "gh-referefref-modpot", "source_url": "https://github.com/referefref/modpot", "status": "published", "summary_en": "Repository about modular web honeypot framework; documentation and maintenance require further review.", "summary_es": "Repositorio sobre framework modular de honeypots web; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Cloud"], "last_push": "2026-09-11T13:26:11Z", "license": "Apache-2.0", "review_basis": "repository-metadata", "source_title": "SAP/cloud-active-defense", "tags": [], "techniques": ["Decoy"]}, "evidence": "repository-metadata", "id": "gh-sap-cloud-active-defense", "kind": "software", "name": "cloud-active-defense", "organization": "SAP", "reviewed_at": "2026-09-15", "slug": "gh-sap-cloud-active-defense", "source_url": "https://github.com/SAP/cloud-active-defense", "status": "published", "summary_en": "Repository about cloud-application decoys; documentation and maintenance require further review.", "summary_es": "Repositorio sobre señuelos en aplicaciones cloud; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Network"], "last_push": "2012-10-14T19:17:10Z", "review_basis": "repository-metadata", "source_title": "schmalle/MysqlPot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-schmalle-mysqlpot", "kind": "software", "name": "MysqlPot", "organization": "schmalle", "reviewed_at": "2026-09-15", "slug": "gh-schmalle-mysqlpot", "source_url": "https://github.com/schmalle/MysqlPot", "status": "published", "summary_en": "Repository about decoy MySQL service; documentation and maintenance require further review.", "summary_es": "Repositorio sobre servicio señuelo MySQL; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2012}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Application"], "last_push": "2015-08-23T16:29:31Z", "review_basis": "repository-metadata", "source_title": "schmalle/Nodepot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-schmalle-nodepot", "kind": "software", "name": "Nodepot", "organization": "schmalle", "reviewed_at": "2026-09-15", "slug": "gh-schmalle-nodepot", "source_url": "https://github.com/schmalle/Nodepot", "status": "published", "summary_en": "Repository about Node.js application simulation; documentation and maintenance require further review.", "summary_es": "Repositorio sobre simulación de aplicaciones Node.js; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2014}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Network"], "last_push": "2015-06-11T12:30:14Z", "review_basis": "repository-metadata", "source_title": "SecurityTW/delilah", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-securitytw-delilah", "kind": "software", "name": "delilah", "organization": "SecurityTW", "reviewed_at": "2026-09-15", "slug": "gh-securitytw-delilah", "source_url": "https://github.com/SecurityTW/delilah", "status": "published", "summary_en": "Repository about Elasticsearch simulation; documentation and maintenance require further review.", "summary_es": "Repositorio sobre simulación de Elasticsearch; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2015}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Network"], "last_push": "2026-09-15T11:46:01Z", "license": "MIT", "review_basis": "repository-metadata", "source_title": "sjinks/mysql-honeypotd", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-sjinks-mysql-honeypotd", "kind": "software", "name": "mysql-honeypotd", "organization": "sjinks", "reviewed_at": "2026-09-15", "slug": "gh-sjinks-mysql-honeypotd", "source_url": "https://github.com/sjinks/mysql-honeypotd", "status": "published", "summary_en": "Repository about MySQL simulation; documentation and maintenance require further review.", "summary_es": "Repositorio sobre simulación de MySQL; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2017}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": true, "environments": ["Network"], "last_push": "2026-05-16T15:39:03Z", "review_basis": "repository-metadata", "source_title": "tg12/dns-honeypot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-tg12-dns-honeypot", "kind": "software", "name": "dns-honeypot", "organization": "tg12", "reviewed_at": "2026-09-15", "slug": "gh-tg12-dns-honeypot", "source_url": "https://github.com/tg12/dns-honeypot", "status": "published", "summary_en": "Repository about DNS simulation; documentation and maintenance require further review.", "summary_es": "Repositorio sobre simulación de DNS; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "archived": false, "environments": ["Network"], "last_push": "2023-10-17T07:27:57Z", "license": "GPL-2.0", "review_basis": "repository-metadata", "source_title": "torque59/nosqlpot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-metadata", "id": "gh-torque59-nosqlpot", "kind": "software", "name": "nosqlpot", "organization": "torque59", "reviewed_at": "2026-09-15", "slug": "gh-torque59-nosqlpot", "source_url": "https://github.com/torque59/nosqlpot", "status": "published", "summary_en": "Repository about NoSQL-service simulation; documentation and maintenance require further review.", "summary_es": "Repositorio sobre simulación de servicios NoSQL; documentación y mantenimiento requieren revisión adicional.", "updated_at": "2026-09-15", "year": 2015}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Application"], "license": "AGPL-3.0", "repository_last_push": "2026-08-13", "review_basis": "repository-metadata", "source_language": "en", "source_title": "0xBallpoint/trapster-community repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-0xballpoint-trapster-community", "kind": "software", "name": "Trapster Commmunity", "organization": "0xBallpoint", "reviewed_at": "2026-09-16", "slug": "gh2-0xballpoint-trapster-community", "source_url": "https://github.com/0xBallpoint/trapster-community", "status": "published", "summary_en": "Modern honeypot supporting multiple services, realistic website cloning, and AI-powered features", "summary_es": "Repositorio que documenta modern honeypot supporting multiple services, realistic website cloning, and AI-powered features", "updated_at": "2026-09-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "license": "BSD-2-Clause", "repository_last_push": "2024-01-22", "review_basis": "repository-metadata", "source_language": "en", "source_title": "alexbredo/honeypot-ftp repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-alexbredo-honeypot-ftp", "kind": "software", "name": "honeypot-ftp", "organization": "alexbredo", "reviewed_at": "2026-09-16", "slug": "gh2-alexbredo-honeypot-ftp", "source_url": "https://github.com/alexbredo/honeypot-ftp", "status": "published", "summary_en": "FTP Honeypot", "summary_es": "Repositorio que documenta fTP Honeypot", "updated_at": "2026-09-16", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Application"], "license": "MIT", "repository_last_push": "2026-09-15", "review_basis": "repository-metadata", "source_language": "en", "source_title": "andrewmichaelsmith/flux repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-andrewmichaelsmith-flux", "kind": "software", "name": "flux", "organization": "andrewmichaelsmith", "reviewed_at": "2026-09-16", "slug": "gh2-andrewmichaelsmith-flux", "source_url": "https://github.com/andrewmichaelsmith/flux", "status": "published", "summary_en": "HTTP honeypot on autopilot", "summary_es": "Repositorio que documenta hTTP honeypot on autopilot", "updated_at": "2026-09-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "license": "MIT", "repository_last_push": "2026-04-24", "review_basis": "repository-metadata", "source_language": "en", "source_title": "bartnv/portlurker repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-bartnv-portlurker", "kind": "software", "name": "portlurker", "organization": "bartnv", "reviewed_at": "2026-09-16", "slug": "gh2-bartnv-portlurker", "source_url": "https://github.com/bartnv/portlurker", "status": "published", "summary_en": "Port listener / honeypot in Rust with protocol guessing and safe string display", "summary_es": "Repositorio que documenta port listener / honeypot in Rust with protocol guessing and safe string display", "updated_at": "2026-09-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "repository_last_push": "2024-04-27", "review_basis": "repository-metadata", "source_language": "en", "source_title": "batchmcnulty/Malbait repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-batchmcnulty-malbait", "kind": "software", "name": "Malbait", "organization": "batchmcnulty", "reviewed_at": "2026-09-16", "slug": "gh2-batchmcnulty-malbait", "source_url": "https://github.com/batchmcnulty/Malbait", "status": "published", "summary_en": "Simple TCP/UDP honeypot implemented in Perl", "summary_es": "Repositorio que documenta simple TCP/UDP honeypot implemented in Perl", "updated_at": "2026-09-16", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Application"], "license": "MPL-2.0", "repository_last_push": "2024-06-29", "review_basis": "repository-metadata", "source_language": "en", "source_title": "bocajspear1/honeyhttpd repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-bocajspear1-honeyhttpd", "kind": "software", "name": "honeyhttpd", "organization": "bocajspear1", "reviewed_at": "2026-09-16", "slug": "gh2-bocajspear1-honeyhttpd", "source_url": "https://github.com/bocajspear1/honeyhttpd", "status": "published", "summary_en": "HoneyHTTPD is a Python-based web server honeypot/service imitation builder. Great for honeypots or faking HTTP services.", "summary_es": "Repositorio que documenta honeyHTTPD is a Python-based web server honeypot/service imitation builder. Great for honeypots or faking HTTP services.", "updated_at": "2026-09-16", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "repository_last_push": "2026-03-20", "review_basis": "repository-metadata", "source_language": "en", "source_title": "chaitin/mimicry repository", "tags": ["community-discovery"], "techniques": ["Decoy"]}, "evidence": "repository-documentation", "id": "gh2-chaitin-mimicry", "kind": "software", "name": "Mimicry", "organization": "chaitin", "reviewed_at": "2026-09-16", "slug": "gh2-chaitin-mimicry", "source_url": "https://github.com/chaitin/mimicry", "status": "published", "summary_en": "Mimicry is a dynamic deception tool that actively deceives an attacker during exploitation and post-exploitation.", "summary_es": "Repositorio que documenta mimicry is a dynamic deception tool that actively deceives an attacker during exploitation and post-exploitation.", "updated_at": "2026-09-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "license": "MIT", "repository_last_push": "2026-06-22", "review_basis": "repository-metadata", "source_language": "en", "source_title": "christophe77/express-honeypot repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-christophe77-express-honeypot", "kind": "software", "name": "Express honeypot", "organization": "christophe77", "reviewed_at": "2026-09-16", "slug": "gh2-christophe77-express-honeypot", "source_url": "https://github.com/christophe77/express-honeypot", "status": "published", "summary_en": "Express honeypot for remote file inclusion (RFI) and local file inclusion (LFI).", "summary_es": "Repositorio que documenta express honeypot for remote file inclusion (RFI) and local file inclusion (LFI).", "updated_at": "2026-09-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "license": "MIT", "repository_last_push": "2026-06-22", "review_basis": "repository-metadata", "source_language": "en", "source_title": "christophe77/node-ftp-honeypot repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-christophe77-node-ftp-honeypot", "kind": "software", "name": "node-ftp-honeypot", "organization": "christophe77", "reviewed_at": "2026-09-16", "slug": "gh2-christophe77-node-ftp-honeypot", "source_url": "https://github.com/christophe77/node-ftp-honeypot", "status": "published", "summary_en": "nodejs ftp honeypot", "summary_es": "Repositorio que documenta nodejs ftp honeypot", "updated_at": "2026-09-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "license": "GPL-3.0", "repository_last_push": "2021-06-28", "review_basis": "repository-metadata", "source_language": "en", "source_title": "citronneur/rdpy repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-citronneur-rdpy", "kind": "software", "name": "RDPy", "organization": "citronneur", "reviewed_at": "2026-09-16", "slug": "gh2-citronneur-rdpy", "source_url": "https://github.com/citronneur/rdpy", "status": "published", "summary_en": "Remote Desktop Protocol in Twisted Python", "summary_es": "Repositorio que documenta remote Desktop Protocol in Twisted Python", "updated_at": "2026-09-16", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Application"], "license": "Apache-2.0", "repository_last_push": "2026-04-23", "review_basis": "repository-metadata", "source_language": "en", "source_title": "cossacklabs/acra repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-cossacklabs-acra", "kind": "software", "name": "Acra", "organization": "cossacklabs", "reviewed_at": "2026-09-16", "slug": "gh2-cossacklabs-acra", "source_url": "https://github.com/cossacklabs/acra", "status": "published", "summary_en": "Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side (\"transparent\") encryption. SQL, NoSQL.", "summary_es": "Repositorio que documenta database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side (\"transparent\") encryption. SQL, NoSQL.", "updated_at": "2026-09-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "license": "MIT", "repository_last_push": "2023-10-19", "review_basis": "repository-metadata", "source_language": "en", "source_title": "Cymmetria/honeycomb_plugins repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-cymmetria-honeycomb-plugins", "kind": "software", "name": "honeycomb_plugins", "organization": "Cymmetria", "reviewed_at": "2026-09-16", "slug": "gh2-cymmetria-honeycomb-plugins", "source_url": "https://github.com/Cymmetria/honeycomb_plugins", "status": "published", "summary_en": "The plugin repository for Honeycomb, the honeypot framework by Cymmetria", "summary_es": "Repositorio que documenta the plugin repository for Honeycomb, the honeypot framework by Cymmetria", "updated_at": "2026-09-16", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "license": "GPL-3.0", "repository_last_push": "2023-06-08", "review_basis": "repository-metadata", "source_language": "en", "source_title": "DataSoft/Nova repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-datasoft-nova", "kind": "software", "name": "NOVA", "organization": "DataSoft", "reviewed_at": "2026-09-16", "slug": "gh2-datasoft-nova", "source_url": "https://github.com/DataSoft/Nova", "status": "published", "summary_en": "Repo for the Open Source version of NOVA", "summary_es": "Repositorio que documenta repo for the Open Source version of NOVA", "updated_at": "2026-09-16", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "license": "MIT", "repository_last_push": "2022-11-14", "review_basis": "repository-metadata", "source_language": "en", "source_title": "deroux/longitudinal-analysis-cowrie repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-deroux-longitudinal-analysis-cowrie", "kind": "software", "name": "Longitudinal Analysis of SSH Cowrie Honeypot Logs", "organization": "deroux", "reviewed_at": "2026-09-16", "slug": "gh2-deroux-longitudinal-analysis-cowrie", "source_url": "https://github.com/deroux/longitudinal-analysis-cowrie", "status": "published", "summary_en": "Longitudinal Analysis of SSH Cowrie Honeypot Logs", "summary_es": "Repositorio que documenta longitudinal Analysis of SSH Cowrie Honeypot Logs", "updated_at": "2026-09-16", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "repository_last_push": "2023-11-19", "review_basis": "repository-metadata", "source_language": "en", "source_title": "desaster/kippo repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-desaster-kippo", "kind": "software", "name": "Kippo", "organization": "desaster", "reviewed_at": "2026-09-16", "slug": "gh2-desaster-kippo", "source_url": "https://github.com/desaster/kippo", "status": "published", "summary_en": "Kippo - SSH Honeypot", "summary_es": "Repositorio que documenta kippo - SSH Honeypot", "updated_at": "2026-09-16", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "repository_last_push": "2026-02-19", "review_basis": "repository-metadata", "source_language": "en", "source_title": "eymengunay/EoHoneypotBundle repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-eymengunay-eohoneypotbundle", "kind": "software", "name": "EoHoneypotBundle", "organization": "eymengunay", "reviewed_at": "2026-09-16", "slug": "gh2-eymengunay-eohoneypotbundle", "source_url": "https://github.com/eymengunay/EoHoneypotBundle", "status": "published", "summary_en": "Honeypot type for Symfony forms", "summary_es": "Repositorio que documenta honeypot type for Symfony forms", "updated_at": "2026-09-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "license": "MIT", "repository_last_push": "2026-06-14", "review_basis": "repository-metadata", "source_language": "en", "source_title": "f0rw4rd/potsnitch repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-f0rw4rd-potsnitch", "kind": "software", "name": "potsnitch", "organization": "f0rw4rd", "reviewed_at": "2026-09-16", "slug": "gh2-f0rw4rd-potsnitch", "source_url": "https://github.com/f0rw4rd/potsnitch", "status": "published", "summary_en": "Honeypot detection toolkit", "summary_es": "Repositorio que documenta honeypot detection toolkit", "updated_at": "2026-09-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "repository_last_push": "2024-09-25", "review_basis": "repository-metadata", "source_language": "en", "source_title": "free5ty1e/honeypotpi repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-free5ty1e-honeypotpi", "kind": "software", "name": "honeypotpi", "organization": "free5ty1e", "reviewed_at": "2026-09-16", "slug": "gh2-free5ty1e-honeypotpi", "source_url": "https://github.com/free5ty1e/honeypotpi", "status": "published", "summary_en": "Script for turning a Raspberry Pi into a Honey Pot Pi", "summary_es": "Repositorio que documenta script for turning a Raspberry Pi into a Honey Pot Pi", "updated_at": "2026-09-16", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Application"], "repository_last_push": "2023-02-07", "review_basis": "repository-metadata", "source_language": "en", "source_title": "gbrindisi/wordpot repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-gbrindisi-wordpot", "kind": "software", "name": "wordpot", "organization": "gbrindisi", "reviewed_at": "2026-09-16", "slug": "gh2-gbrindisi-wordpot", "source_url": "https://github.com/gbrindisi/wordpot", "status": "published", "summary_en": "A Wordpress Honeypot", "summary_es": "Repositorio que documenta a Wordpress Honeypot", "updated_at": "2026-09-16", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "license": "GPL-3.0", "repository_last_push": "2026-06-17", "review_basis": "repository-metadata", "source_language": "en", "source_title": "ivre/masscanned repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-ivre-masscanned", "kind": "software", "name": "Masscanned", "organization": "ivre", "reviewed_at": "2026-09-16", "slug": "gh2-ivre-masscanned", "source_url": "https://github.com/ivre/masscanned", "status": "published", "summary_en": "Let's be scanned. A low-interaction honeypot focused on network scanners and bots. It integrates very well with IVRE to build a self-hosted alternative to GreyNoise.", "summary_es": "Repositorio que documenta let's be scanned. A low-interaction honeypot focused on network scanners and bots. It integrates very well with IVRE to build a self-hosted alternative to GreyNoise.", "updated_at": "2026-09-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "license": "Apache-2.0", "repository_last_push": "2024-10-21", "review_basis": "repository-metadata", "source_language": "en", "source_title": "jaksi/sshesame repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-jaksi-sshesame", "kind": "software", "name": "sshesame", "organization": "jaksi", "reviewed_at": "2026-09-16", "slug": "gh2-jaksi-sshesame", "source_url": "https://github.com/jaksi/sshesame", "status": "published", "summary_en": "An easy to set up and use SSH honeypot, a fake SSH server that lets anyone in and logs their activity", "summary_es": "Repositorio que documenta an easy to set up and use SSH honeypot, a fake SSH server that lets anyone in and logs their activity", "updated_at": "2026-09-16", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "repository_last_push": "2026-01-23", "review_basis": "repository-metadata", "source_language": "en", "source_title": "jekil/UDPot repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-jekil-udpot", "kind": "software", "name": "UDPot Honeypot", "organization": "jekil", "reviewed_at": "2026-09-16", "slug": "gh2-jekil-udpot", "source_url": "https://github.com/jekil/UDPot", "status": "published", "summary_en": "Simple DNS honeypot script", "summary_es": "Repositorio que documenta simple DNS honeypot script", "updated_at": "2026-09-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "repository_last_push": "2023-11-17", "review_basis": "repository-metadata", "source_language": "en", "source_title": "jeremyfritzen/Ethereum-honey-pot repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-jeremyfritzen-ethereum-honey-pot", "kind": "software", "name": "Ethereum-honey-pot", "organization": "jeremyfritzen", "reviewed_at": "2026-09-16", "slug": "gh2-jeremyfritzen-ethereum-honey-pot", "source_url": "https://github.com/jeremyfritzen/Ethereum-honey-pot", "status": "published", "summary_en": "Ethereum honey pot", "summary_es": "Repositorio que documenta ethereum honey pot", "updated_at": "2026-09-16", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "license": "GPL-3.0", "repository_last_push": "2024-05-21", "review_basis": "repository-metadata", "source_language": "en", "source_title": "johnnykv/heralding repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-johnnykv-heralding", "kind": "software", "name": "Heralding", "organization": "johnnykv", "reviewed_at": "2026-09-16", "slug": "gh2-johnnykv-heralding", "source_url": "https://github.com/johnnykv/heralding", "status": "published", "summary_en": "Credentials catching honeypot", "summary_es": "Repositorio que documenta credentials catching honeypot", "updated_at": "2026-09-16", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "license": "MIT", "repository_last_push": "2026-05-29", "review_basis": "repository-metadata", "source_language": "en", "source_title": "JustinAzoff/ssh-auth-logger repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-justinazoff-ssh-auth-logger", "kind": "software", "name": "ssh-auth-logger", "organization": "JustinAzoff", "reviewed_at": "2026-09-16", "slug": "gh2-justinazoff-ssh-auth-logger", "source_url": "https://github.com/JustinAzoff/ssh-auth-logger", "status": "published", "summary_en": "A low/zero interaction ssh authentication logging honeypot", "summary_es": "Repositorio que documenta a low/zero interaction ssh authentication logging honeypot", "updated_at": "2026-09-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Application"], "repository_last_push": "2020-11-19", "review_basis": "repository-metadata", "source_language": "en", "source_title": "kungfuguapo/HoneyPress repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-kungfuguapo-honeypress", "kind": "software", "name": "HoneyPress", "organization": "kungfuguapo", "reviewed_at": "2026-09-16", "slug": "gh2-kungfuguapo-honeypress", "source_url": "https://github.com/kungfuguapo/HoneyPress", "status": "published", "summary_en": "python based WordPress honeypot in a docker container", "summary_es": "Repositorio que documenta python based WordPress honeypot in a docker container", "updated_at": "2026-09-16", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Application"], "license": "GPL-3.0", "repository_last_push": "2025-04-19", "review_basis": "repository-metadata", "source_language": "en", "source_title": "LogoiLab/honeyup repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-logoilab-honeyup", "kind": "software", "name": "honeyup", "organization": "LogoiLab", "reviewed_at": "2026-09-16", "slug": "gh2-logoilab-honeyup", "source_url": "https://github.com/mrcbax/honeyup", "status": "published", "summary_en": "An uploader honeypot designed to look like poor website security.", "summary_es": "Repositorio que documenta an uploader honeypot designed to look like poor website security.", "updated_at": "2026-09-16", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "license": "GPL-3.0", "repository_last_push": "2026-09-14", "review_basis": "repository-metadata", "source_language": "en", "source_title": "mariocandela/beelzebub repository", "tags": ["community-discovery"], "techniques": ["Decoy"]}, "evidence": "repository-documentation", "id": "gh2-mariocandela-beelzebub", "kind": "software", "name": "beelzebub", "organization": "mariocandela", "reviewed_at": "2026-09-16", "slug": "gh2-mariocandela-beelzebub", "source_url": "https://github.com/beelzebub-labs/beelzebub", "status": "published", "summary_en": "A secure low code deception runtime framework, leveraging AI for System Virtualization.", "summary_es": "Repositorio que documenta a secure low code deception runtime framework, leveraging AI for System Virtualization.", "updated_at": "2026-09-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "license": "MIT", "repository_last_push": "2024-03-21", "review_basis": "repository-metadata", "source_language": "en", "source_title": "morian/blacknet repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-morian-blacknet", "kind": "software", "name": "Blacknet", "organization": "morian", "reviewed_at": "2026-09-16", "slug": "gh2-morian-blacknet", "source_url": "https://github.com/morian/blacknet", "status": "published", "summary_en": "Multi-head SSH honeypot system.", "summary_es": "Repositorio que documenta multi-head SSH honeypot system.", "updated_at": "2026-09-16", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "license": "MIT", "repository_last_push": "2026-08-30", "review_basis": "repository-metadata", "source_language": "en", "source_title": "mushorg/glutton repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-mushorg-glutton", "kind": "software", "name": "glutton", "organization": "mushorg", "reviewed_at": "2026-09-16", "slug": "gh2-mushorg-glutton", "source_url": "https://github.com/mushorg/glutton", "status": "published", "summary_en": "Generic Low Interaction Honeypot", "summary_es": "Repositorio que documenta generic Low Interaction Honeypot", "updated_at": "2026-09-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "license": "Apache-2.0", "repository_last_push": "2026-05-11", "review_basis": "repository-metadata", "source_language": "en", "source_title": "nsmfoo/dicompot repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-nsmfoo-dicompot", "kind": "software", "name": "dicompot", "organization": "nsmfoo", "reviewed_at": "2026-09-16", "slug": "gh2-nsmfoo-dicompot", "source_url": "https://github.com/nsmfoo/dicompot", "status": "published", "summary_en": "DICOM Honeypot", "summary_es": "Repositorio que documenta dICOM Honeypot", "updated_at": "2026-09-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "license": "MIT", "repository_last_push": "2026-06-28", "review_basis": "repository-metadata", "source_language": "en", "source_title": "PeterGabaldon/Fortigate.VPN-SSL.Honeypot repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-petergabaldon-fortigate-vpn-ssl-honeypot", "kind": "software", "name": "FortiGate SSL-VPN Honeypot", "organization": "PeterGabaldon", "reviewed_at": "2026-09-16", "slug": "gh2-petergabaldon-fortigate-vpn-ssl-honeypot", "source_url": "https://github.com/PeterGabaldon/Fortigate.VPN-SSL.Honeypot", "status": "published", "summary_en": "Fortigate VPN-SSL Honeypot", "summary_es": "Repositorio que documenta fortigate VPN-SSL Honeypot", "updated_at": "2026-09-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "license": "MIT", "repository_last_push": "2026-09-07", "review_basis": "repository-metadata", "source_language": "en", "source_title": "phin3has/mailoney repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-phin3has-mailoney", "kind": "software", "name": "Mailoney", "organization": "phin3has", "reviewed_at": "2026-09-16", "slug": "gh2-phin3has-mailoney", "source_url": "https://github.com/phin3has/mailoney", "status": "published", "summary_en": "An SMTP Honeypot", "summary_es": "Repositorio que documenta an SMTP Honeypot", "updated_at": "2026-09-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "repository_last_push": "2021-03-28", "review_basis": "repository-metadata", "source_language": "en", "source_title": "r0hi7/HoneySMB repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-r0hi7-honeysmb", "kind": "software", "name": "SMB Honeypot", "organization": "r0hi7", "reviewed_at": "2026-09-16", "slug": "gh2-r0hi7-honeysmb", "source_url": "https://github.com/rosehgal/HoneySMB", "status": "published", "summary_en": "Simple High Interaction Honeypot Solution for SMB protocol", "summary_es": "Repositorio que documenta simple High Interaction Honeypot Solution for SMB protocol", "updated_at": "2026-09-16", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "repository_last_push": "2025-03-22", "review_basis": "repository-metadata", "source_language": "en", "source_title": "referefref/honeydet repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-referefref-honeydet", "kind": "software", "name": "honeydet", "organization": "referefref", "reviewed_at": "2026-09-16", "slug": "gh2-referefref-honeydet", "source_url": "https://github.com/referefref/honeydet", "status": "published", "summary_en": "Signature based honeypot detector tool written in Golang", "summary_es": "Repositorio que documenta signature based honeypot detector tool written in Golang", "updated_at": "2026-09-16", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "license": "GPL-3.0", "repository_last_push": "2023-12-05", "review_basis": "repository-metadata", "source_language": "en", "source_title": "referefref/honeyfs repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-referefref-honeyfs", "kind": "software", "name": "honeyfs", "organization": "referefref", "reviewed_at": "2026-09-16", "slug": "gh2-referefref-honeyfs", "source_url": "https://github.com/referefref/honeyfs", "status": "published", "summary_en": "LLM Based Honeypot File System Creator", "summary_es": "Repositorio que documenta lLM Based Honeypot File System Creator", "updated_at": "2026-09-16", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "license": "GPL-3.0", "repository_last_push": "2023-12-01", "review_basis": "repository-metadata", "source_language": "en", "source_title": "referefref/SMTPLLMPot repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-referefref-smtpllmpot", "kind": "software", "name": "SMTPLLMPot", "organization": "referefref", "reviewed_at": "2026-09-16", "slug": "gh2-referefref-smtpllmpot", "source_url": "https://github.com/referefref/SMTPLLMPot", "status": "published", "summary_en": "A simple PoC for the use of GPT3.5 in creating an SMTP honeypot", "summary_es": "Repositorio que documenta a simple PoC for the use of GPT3.5 in creating an SMTP honeypot", "updated_at": "2026-09-16", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "repository_last_push": "2020-06-14", "review_basis": "repository-metadata", "source_language": "en", "source_title": "rshipp/slipm-honeypot repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-rshipp-slipm-honeypot", "kind": "software", "name": "slipm-honeypot", "organization": "rshipp", "reviewed_at": "2026-09-16", "slug": "gh2-rshipp-slipm-honeypot", "source_url": "https://github.com/rshipp/slipm-honeypot", "status": "published", "summary_en": "A simple low-interaction port monitoring honeypot.", "summary_es": "Repositorio que documenta a simple low-interaction port monitoring honeypot.", "updated_at": "2026-09-16", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "license": "GPL-3.0", "repository_last_push": "2023-07-09", "review_basis": "repository-metadata", "source_language": "en", "source_title": "sa7mon/miniprint repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-sa7mon-miniprint", "kind": "software", "name": "miniprint", "organization": "sa7mon", "reviewed_at": "2026-09-16", "slug": "gh2-sa7mon-miniprint", "source_url": "https://github.com/sa7mon/miniprint", "status": "published", "summary_en": "A medium interaction printer honeypot 🍯", "summary_es": "Repositorio que documenta a medium interaction printer honeypot 🍯", "updated_at": "2026-09-16", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "repository_last_push": "2024-05-20", "review_basis": "repository-metadata", "source_language": "en", "source_title": "schmalle/medpot repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-schmalle-medpot", "kind": "software", "name": "medpot", "organization": "schmalle", "reviewed_at": "2026-09-16", "slug": "gh2-schmalle-medpot", "source_url": "https://github.com/schmalle/medpot", "status": "published", "summary_en": "HL7 / FHIR honeypot", "summary_es": "Repositorio que documenta hL7 / FHIR honeypot", "updated_at": "2026-09-16", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "license": "GPL-3.0", "repository_last_push": "2022-07-13", "review_basis": "repository-metadata", "source_language": "en", "source_title": "secureworks/dcept repository", "tags": ["community-discovery"], "techniques": ["Honeytoken"]}, "evidence": "repository-documentation", "id": "gh2-secureworks-dcept", "kind": "software", "name": "dcept", "organization": "secureworks", "reviewed_at": "2026-09-16", "slug": "gh2-secureworks-dcept", "source_url": "https://github.com/secureworks/dcept", "status": "published", "summary_en": "A tool for deploying and detecting use of Active Directory honeytokens", "summary_es": "Repositorio que documenta a tool for deploying and detecting use of Active Directory honeytokens", "updated_at": "2026-09-16", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["OT/ICS"], "license": "GPL-3.0", "repository_last_push": "2023-05-16", "review_basis": "repository-metadata", "source_language": "en", "source_title": "sefcom/honeyplc repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-sefcom-honeyplc", "kind": "software", "name": "HoneyPLC", "organization": "sefcom", "reviewed_at": "2026-09-16", "slug": "gh2-sefcom-honeyplc", "source_url": "https://github.com/sefcom/honeyplc", "status": "published", "summary_en": "High-interaction Honeypot for PLCs and Industrial Control Systems", "summary_es": "Repositorio que documenta high-interaction Honeypot for PLCs and Industrial Control Systems", "updated_at": "2026-09-16", "year": 2023}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "license": "MIT", "repository_last_push": "2025-03-31", "review_basis": "repository-metadata", "source_language": "en", "source_title": "shiva-spampot/shiva repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-shiva-spampot-shiva", "kind": "software", "name": "Shiva", "organization": "shiva-spampot", "reviewed_at": "2026-09-16", "slug": "gh2-shiva-spampot-shiva", "source_url": "https://github.com/shiva-spampot/shiva", "status": "published", "summary_en": "Spam Honeypot with Intelligent Virtual Analyzer", "summary_es": "Repositorio que documenta spam Honeypot with Intelligent Virtual Analyzer", "updated_at": "2026-09-16", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "license": "MIT", "repository_last_push": "2026-09-16", "review_basis": "repository-metadata", "source_language": "en", "source_title": "sjinks/ssh-honeypotd repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-sjinks-ssh-honeypotd", "kind": "software", "name": "ssh-honeypotd", "organization": "sjinks", "reviewed_at": "2026-09-16", "slug": "gh2-sjinks-ssh-honeypotd", "source_url": "https://github.com/sjinks/ssh-honeypotd", "status": "published", "summary_en": "A low-interaction SSH honeypot written in C", "summary_es": "Repositorio que documenta a low-interaction SSH honeypot written in C", "updated_at": "2026-09-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "license": "GPL-3.0", "repository_last_push": "2024-11-29", "review_basis": "repository-metadata", "source_language": "en", "source_title": "thomaspatzke/Log4Pot repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-thomaspatzke-log4pot", "kind": "software", "name": "Log4Pot", "organization": "thomaspatzke", "reviewed_at": "2026-09-16", "slug": "gh2-thomaspatzke-log4pot", "source_url": "https://github.com/thomaspatzke/Log4Pot", "status": "published", "summary_en": "A honeypot for the Log4Shell vulnerability (CVE-2021-44228).", "summary_es": "Repositorio que documenta a honeypot for the Log4Shell vulnerability (CVE-2021-44228).", "updated_at": "2026-09-16", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "license": "MIT", "repository_last_push": "2020-04-08", "review_basis": "repository-metadata", "source_language": "en", "source_title": "traetox/sshForShits repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-traetox-sshforshits", "kind": "software", "name": "sshForShits", "organization": "traetox", "reviewed_at": "2026-09-16", "slug": "gh2-traetox-sshforshits", "source_url": "https://github.com/traetox/sshForShits", "status": "published", "summary_en": "framework for a high interaction SSH honeypot", "summary_es": "Repositorio que documenta framework for a high interaction SSH honeypot", "updated_at": "2026-09-16", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "license": "MIT", "repository_last_push": "2021-06-07", "review_basis": "repository-metadata", "source_language": "en", "source_title": "UHH-ISS/honeygrove repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-uhh-iss-honeygrove", "kind": "software", "name": "Honeygrove", "organization": "UHH-ISS", "reviewed_at": "2026-09-16", "slug": "gh2-uhh-iss-honeygrove", "source_url": "https://github.com/UHH-ISS/honeygrove", "status": "published", "summary_en": "A multi-purpose, modular medium-interaction honeypot based on Twisted.", "summary_es": "Repositorio que documenta a multi-purpose, modular medium-interaction honeypot based on Twisted.", "updated_at": "2026-09-16", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Application"], "license": "GPL-2.0", "repository_last_push": "2026-09-14", "review_basis": "repository-metadata", "source_language": "en", "source_title": "WebDecoy/wordpress-plugin repository", "tags": ["community-discovery"], "techniques": ["Decoy"]}, "evidence": "repository-documentation", "id": "gh2-webdecoy-wordpress-plugin", "kind": "software", "name": "WebDecoy", "organization": "WebDecoy", "reviewed_at": "2026-09-16", "slug": "gh2-webdecoy-wordpress-plugin", "source_url": "https://github.com/WebDecoy/wordpress-plugin", "status": "published", "summary_en": "WebDecoy Bot Detection — zero-config WordPress plugin for bot protection, spam prevention, and WooCommerce carding defense", "summary_es": "Repositorio que documenta webDecoy Bot Detection — zero-config WordPress plugin for bot protection, spam prevention, and WooCommerce carding defense", "updated_at": "2026-09-16", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Application"], "license": "MIT", "repository_last_push": "2025-12-19", "review_basis": "repository-metadata", "source_language": "en", "source_title": "yunginnanet/HellPot repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-yunginnanet-hellpot", "kind": "software", "name": "HellPot", "organization": "yunginnanet", "reviewed_at": "2026-09-16", "slug": "gh2-yunginnanet-hellpot", "source_url": "https://github.com/yunginnanet/HellPot", "status": "published", "summary_en": "HellPot is a cross-platform portal to endless suffering meant to punish unruly HTTP bots.", "summary_es": "Repositorio que documenta hellPot is a cross-platform portal to endless suffering meant to punish unruly HTTP bots.", "updated_at": "2026-09-16", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "environments": ["Network"], "license": "MIT", "repository_last_push": "2022-04-22", "review_basis": "repository-metadata", "source_language": "en", "source_title": "yvesago/imap-honey repository", "tags": ["community-discovery"], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh2-yvesago-imap-honey", "kind": "software", "name": "imap-honey", "organization": "yvesago", "reviewed_at": "2026-09-16", "slug": "gh2-yvesago-imap-honey", "source_url": "https://github.com/yvesago/imap-honey", "status": "published", "summary_en": "IMAP or SMTP honeypot written in Golang", "summary_es": "Repositorio que documenta iMAP or SMTP honeypot written in Golang", "updated_at": "2026-09-16", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The capabilities described come solely from the repository's documentation and have not been independently verified.", "limitations_es": "Las capacidades descritas provienen únicamente de la documentación del repositorio y no han sido verificadas de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/0x4445565a/portanoia/blob/c76399132c00bc4838351c433010b5b0ca8c349a/README.md", "source_packet_sha256": "a4e5c43b3c8dfc870448b90ee797b51632e5f7bb14f2c4404397d498c0926c33", "source_sha": "b89b1973f4f3148b2239545449041842b72dffab", "source_title": "0x4445565a/portanoia repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-0x4445565a-portanoia", "kind": "software", "name": "Portanoia", "organization": "0x4445565a", "reviewed_at": "2026-10-04", "slug": "gh3-0x4445565a-portanoia", "source_url": "https://github.com/0x4445565a/portanoia", "status": "published", "summary_en": "A Go tool that sets up a decoy (honeypot) port and executes a configurable command against every IP that connects to it, described by the author as suited for informal settings like conferences.", "summary_es": "Herramienta en Go que define un puerto señuelo (honeypot) y ejecuta un comando configurable contra cada IP que se conecte a él, pensada por el autor para entornos informales como conferencias.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": "support-only-not-honeypot", "draft_review_basis": "independent-second-provider-review", "environments": ["Endpoint", "Identity", "Cloud"], "limitations_en": "The described behavior comes from documentation and has not been independently verified.", "limitations_es": "El comportamiento descrito procede de la documentación y no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": ["Honeypot"], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_document_url": "https://github.com/0x4D31/honeybits/blob/master/README.md", "source_packet_sha256": "69768cc823b609259c96fe1cb2e9bc9ae76625303f8a27da60a38f2e60364f52", "source_sha": "dc22a8b29ed49f9eb0a840bbe1e57d5a251999f9", "source_title": "0x4D31/honeybits repository", "tags": [], "techniques": ["Honeytoken", "Decoy"]}, "evidence": "repository-documentation", "id": "gh3-0x4d31-honeybits", "kind": "software", "name": "honeybits", "organization": "0x4D31", "reviewed_at": "2026-10-04", "slug": "gh3-0x4d31-honeybits", "source_url": "https://github.com/0x4D31/honeybits", "status": "published", "summary_en": "Proof-of-concept tool that places breadcrumbs and decoys, such as fake files and credentials, on servers and workstations to draw attackers toward traps. It is not presented as a honeypot itself.", "summary_es": "Herramienta de prueba de concepto que coloca pistas y señuelos, como archivos y credenciales falsos, en servidores y estaciones de trabajo para dirigir atacantes hacia trampas. No se presenta como un honeypot en sí.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Endpoint", "Identity"], "limitations_en": "The features and planned traps are as described in the project's documentation and have not been independently verified; several items are listed as pending (TODO).", "limitations_es": "Las funcionalidades y la lista de trampas planificadas provienen de la documentación del proyecto y no han sido verificadas de forma independiente; varias funciones figuran como pendientes (TODO).", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/0x4d31/honeybits-win/blob/efafdc6d85b6c73991f26e445be4fc60fd24f332/README.md", "source_packet_sha256": "ca6920309f0c2e41025cef597af81d102e4672e777b5f9ae0a064a9b9c038de4", "source_sha": "683fbff3f2c1ee605b9d902b104aa8bc0cda5c54", "source_title": "0x4d31/honeybits-win repository", "tags": [], "techniques": ["Honeytoken", "Decoy"]}, "evidence": "repository-documentation", "id": "gh3-0x4d31-honeybits-win", "kind": "software", "name": "Honeybits-win", "organization": "0x4d31", "reviewed_at": "2026-10-04", "slug": "gh3-0x4d31-honeybits-win", "source_url": "https://github.com/0x4d31/honeybits-win", "status": "published", "summary_en": "A Windows tool that creates breadcrumbs and honeytokens, such as fake credentials in Windows Credential Manager, to lead attackers toward honeypots.", "summary_es": "Herramienta para Windows que crea migas de pan (breadcrumbs) y honeytokens, como credenciales falsas en el Administrador de Credenciales de Windows, para dirigir a los atacantes hacia honeypots.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Application", "Cloud"], "limitations_en": "The described behavior comes from documentation and has not been independently verified.", "limitations_es": "El comportamiento descrito procede de la documentación y no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_document_url": "https://github.com/0x4D31/honeyku/blob/master/README.md", "source_packet_sha256": "53a3818705fbb6090c5ca22867164733afc914314c99a27ef1ce4b970550c0ed", "source_sha": "d8f3a3da690e2f4a6b1ff6273b68d9c535ed5715", "source_title": "0x4D31/honeyku repository", "tags": [], "techniques": ["Honeypot", "Honeytoken"]}, "evidence": "repository-documentation", "id": "gh3-0x4d31-honeyku", "kind": "software", "name": "honeyku", "organization": "0x4D31", "reviewed_at": "2026-10-04", "slug": "gh3-0x4d31-honeyku", "source_url": "https://github.com/0x4D31/honeyku", "status": "published", "summary_en": "Web honeypot documented to create and monitor fake HTTP endpoints whose URLs can be distributed as honeytokens; it is designed for Heroku but can also run on a self-hosted server.", "summary_es": "Honeypot web que, según su documentación, crea y supervisa endpoints HTTP falsos cuyos URL pueden distribuirse como honeytokens; está diseñado para Heroku y también puede alojarse en un servidor propio.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Application", "Cloud"], "limitations_en": "The described behavior comes from documentation and has not been independently verified; the documentation reports testing only on AWS.", "limitations_es": "El comportamiento descrito procede de la documentación y no se ha verificado de forma independiente; la documentación solo indica pruebas en AWS.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_document_url": "https://github.com/0x4D31/honeyLambda/blob/master/README.md", "source_packet_sha256": "93822790a0eed7c75e82fb8284caa6ebb565b31c0d72fcbcbf3b55b58e095d54", "source_sha": "da2a9e8e2a26ab8869a3c628e8524ef915581906", "source_title": "0x4D31/honeyLambda repository", "tags": [], "techniques": ["Honeytoken", "Decoy"]}, "evidence": "repository-documentation", "id": "gh3-0x4d31-honeylambda", "kind": "software", "name": "honeyLambda", "organization": "0x4D31", "reviewed_at": "2026-10-04", "slug": "gh3-0x4d31-honeylambda", "source_url": "https://github.com/0x4D31/honeyLambda", "status": "published", "summary_en": "Serverless application that creates and monitors fake HTTP endpoints for use as URL honeytokens; its documentation describes deployment with AWS Lambda and API Gateway.", "summary_es": "Aplicación sin servidor que crea y supervisa endpoints HTTP falsos para usarlos como honeytokens URL; la documentación describe su implementación con AWS Lambda y API Gateway.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": "89bd2128be345b7b26ee96b75cac02d185d10febb6157439e868fc254a0ee5e9", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "This description reflects only what is documented on the archived repository page; current behavior, maintenance, or availability have not been independently verified.", "limitations_es": "Esta descripción refleja únicamente lo documentado en la página archivada del repositorio; el comportamiento, mantenimiento o disponibilidad actuales no han sido verificados de forma independiente.", "original_url": "https://github.com/0x4d31/honeytls", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "three-ai-source-page-agreement", "source_commit": null, "source_document_url": "https://web.archive.org/web/20180617165518id_/https://github.com/0x4D31/honeyTLS", "source_packet_sha256": "caa95ec41c1962f93e018f0166a3e44d6764589737923cccea6a36bcfc8a7703", "source_sha": null, "source_title": "honeytls", "tags": [], "techniques": ["Honeypot"]}, "evidence": "archived-repository-documentation", "id": "gh3-0x4d31-honeytls", "kind": "software", "name": "honeyTLS", "organization": "0x4d31", "reviewed_at": "2026-10-04", "slug": "gh3-0x4d31-honeytls", "source_url": "https://web.archive.org/web/20180617165518id_/https://github.com/0x4D31/honeyTLS", "status": "published", "summary_en": "honeyTLS is a bash script that sets up Bro (Zeek) together with a JA3 script for Bro and Nginx, used as a simple honeypot to capture JA3 hashes (SSL/TLS client fingerprints). It also documents an alternative one-liner for skimming JA3 fingerprints directly off the wire.", "summary_es": "honeyTLS es un script bash que configura Bro (Zeek) junto con un script JA3 para Bro y Nginx, utilizado como honeypot simple para capturar hashes JA3 (huellas de clientes SSL/TLS). También documenta un comando alternativo de una línea para extraer huellas JA3 directamente del tráfico de red.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Application"], "limitations_en": "Behavior is documented, not independently verified.", "limitations_es": "El comportamiento se describe en la documentación; no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_document_url": "https://github.com/ahoernecke/ensnare/blob/master/README.md", "source_packet_sha256": "24a7f5e5eac7b40f5187160ecf0311f86f3d46bc61f0b432d8b912c70ce590c4", "source_sha": "2c244a160600eda8ffb01172eca346f6b1085ccc", "source_title": "ahoernecke/ensnare repository", "tags": [], "techniques": ["Decoy", "Adversary engagement"]}, "evidence": "repository-documentation", "id": "gh3-ahoernecke-ensnare", "kind": "software", "name": "Ensnare", "organization": "ahoernecke", "reviewed_at": "2026-10-04", "slug": "gh3-ahoernecke-ensnare", "source_url": "https://github.com/ahoernecke/ensnare", "status": "published", "summary_en": "Ruby on Rails gem plugin documenting honey traps and configurable responses to detect and respond to malicious behavior in an application.", "summary_es": "Complemento para Ruby on Rails que documenta trampas señuelo y respuestas configurables para detectar y responder a comportamientos maliciosos en una aplicación.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": [], "limitations_en": "The description is documented, not independently verified.", "limitations_es": "La descripción procede de la documentación y no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/ajackal/arctic-swallow/blob/master/README.md", "source_packet_sha256": "41a1df460fe227b08c0c70b579bcb20e966fdc7ecfd6eb569669afafacd97727", "source_sha": "bd949b80719a65786dc104f89b4674dd0bc90f26", "source_title": "ajackal/arctic-swallow repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-ajackal-arctic-swallow", "kind": "software", "name": "arctic-swallow", "organization": "ajackal", "reviewed_at": "2026-10-04", "slug": "gh3-ajackal-arctic-swallow", "source_url": "https://github.com/ajackal/arctic-swallow", "status": "published", "summary_en": "Described as a low-interaction honeypot; the source does not specify its environment or features.", "summary_es": "Descrito como un honeypot de baja interacción; la fuente no especifica su entorno ni sus funciones.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network", "Application"], "limitations_en": "The description is based solely on the repository's README; the functioning of the playbooks and integrated honeypots has not been independently verified.", "limitations_es": "La descripción se basa únicamente en el README del repositorio; no se ha verificado de forma independiente el funcionamiento de los playbooks ni de los honeypots integrados.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/akagisho/multi-honeypot-ansible/blob/8e60acd6b39c86e6f47778cc8dce93e7441f314f/README.md", "source_packet_sha256": "bbf5f8cc312d46516bccbc6fe374fc930bb5a45cb19f7a7f32367df1914d879d", "source_sha": "0cb681cd6ee87ed0c9385d4bf5fe08863dd871fd", "source_title": "akagisho/multi-honeypot-ansible repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-akagisho-multi-honeypot-ansible", "kind": "framework", "name": "multi-honeypot-ansible", "organization": "akagisho", "reviewed_at": "2026-10-04", "slug": "gh3-akagisho-multi-honeypot-ansible", "source_url": "https://github.com/akagisho/multi-honeypot-ansible", "status": "published", "summary_en": "A set of Ansible playbooks to deploy and configure several existing honeypot servers (Cowrie, Mailoney, Wordpot, UDPot, iplog) alongside an open-relay Postfix mail server.", "summary_es": "Conjunto de playbooks de Ansible para desplegar y configurar varios servidores honeypot existentes (Cowrie, Mailoney, Wordpot, UDPot, iplog) junto con un servidor Postfix de relay abierto.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["IoT"], "limitations_en": "Features are documented, not independently verified.", "limitations_es": "Las funciones se describen en la documentación; no se han verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/alexbredo/honeypot-camera/blob/master/README.md", "source_packet_sha256": "76507ab1384e7ba6657392837a123a5f5c1a6b9ca2cc2b7cf81414efd889d2f9", "source_sha": "67135f47eda85661c061c33350be1fb33162a4c7", "source_title": "alexbredo/honeypot-camera repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-alexbredo-honeypot-camera", "kind": "software", "name": "honeypot-camera", "organization": "alexbredo", "reviewed_at": "2026-10-04", "slug": "gh3-alexbredo-honeypot-camera", "source_url": "https://github.com/alexbredo/honeypot-camera", "status": "published", "summary_en": "Proof-of-concept observation-camera honeypot documenting a watermark, daylight intensity, and automatic refresh.", "summary_es": "Prueba de concepto de honeypot que simula una cámara de observación; documenta marca de agua, intensidad de luz diurna y actualización automática.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Behavior is documented, not independently verified.", "limitations_es": "El comportamiento se describe en la documentación; no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/amv42/sshd-honeypot/blob/master/README.md", "source_packet_sha256": "df40af9dc62eb264889d9801ce0cdbb685ec71d9dd5638644e23f710bdcdfd4e", "source_sha": "038190cb5daa030d11c9dca7b74f99f4d7379679", "source_title": "amv42/sshd-honeypot repository", "tags": [], "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "repository-documentation", "id": "gh3-amv42-sshd-honeypot", "kind": "software", "name": "sshd-honeypot", "organization": "amv42", "reviewed_at": "2026-10-04", "slug": "gh3-amv42-sshd-honeypot", "source_url": "https://github.com/amv42/sshd-honeypot", "status": "published", "summary_en": "Modified OpenSSH daemon that forwards commands to Cowrie to interpret interactions and log brute-force attacks and SSH sessions.", "summary_es": "Versión modificada de OpenSSH que remite comandos a Cowrie para interpretar la interacción y registrar ataques de fuerza bruta y sesiones SSH.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The described behavior comes solely from the project's documentation and has not been independently verified; the README itself warns it can damage existing installations.", "limitations_es": "El comportamiento descrito proviene únicamente de la documentación del proyecto y no ha sido verificado de forma independiente; el propio README advierte que puede dañar instalaciones existentes.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/andrewmichaelsmith/honeypot-setup-script/blob/668116f40b54a6cc8cb8438e96cd81f1e774d387/README.md", "source_packet_sha256": "2c1ff5fc65116ae10f96b04b6485e7f946ee1f286f49e636abe0139c47978cd2", "source_sha": "27599a031c571acd69eb7e6fd2ee51fc9d2e7df9", "source_title": "andrewmichaelsmith/honeypot-setup-script repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-andrewmichaelsmith-honeypot-setup-script", "kind": "software", "name": "honeypot-setup-script", "organization": "andrewmichaelsmith", "reviewed_at": "2026-10-04", "slug": "gh3-andrewmichaelsmith-honeypot-setup-script", "source_url": "https://github.com/andrewmichaelsmith/honeypot-setup-script", "status": "published", "summary_en": "A script for Ubuntu 12.04 that automatically installs and configures Kippo, Dionaea, and p0f as system services, changing the SSH port and turning the host into a honeypot.", "summary_es": "Script para Ubuntu 12.04 que instala y configura automáticamente Kippo, Dionaea y p0f como servicios del sistema, cambiando el puerto SSH y dejando el host preparado como honeypot.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": "support-only-not-honeypot", "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Behavior is documented, not independently verified.", "limitations_es": "El comportamiento se describe en la documentación; no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": ["Honeypot"], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_document_url": "https://github.com/andrewmichaelsmith/manuka/blob/master/README.md", "source_packet_sha256": "78284006c57166b5c0244f941c640c49974dc1144efc6be5988cc3bb24250f0a", "source_sha": "67f5f64d4ede05dae4109a96f850c071066ab3e7", "source_title": "andrewmichaelsmith/manuka repository", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-andrewmichaelsmith-manuka", "kind": "software", "name": "manuka", "organization": "andrewmichaelsmith", "reviewed_at": "2026-10-04", "slug": "gh3-andrewmichaelsmith-manuka", "source_url": "https://github.com/andrewmichaelsmith/manuka", "status": "published", "summary_en": "Deployment script that runs Docker images of the Dionaea and Kippo honeypots; the script facilitates their setup but is not itself a honeypot.", "summary_es": "Script de despliegue que ejecuta imágenes Docker de los honeypots Dionaea y Kippo; el script facilita su instalación, pero no es en sí un honeypot.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["IoT", "Network"], "limitations_en": "This description is based solely on the project's README and has not been independently verified; its effectiveness in real-world environments is not confirmed.”", "limitations_es": "La descripción se basa únicamente en el README del proyecto y no ha sido verificada de forma independiente; no se confirma su eficacia en entornos reales.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/anouarbensaad/honeypot-iot/blob/dd40ce688d4a83c7ea5fb833372512d1fc2186e8/README.md", "source_packet_sha256": "b609f8fd3616e2838adf21f9fee353dcc66e5c0a3ccd5502ac81cba21cd94569", "source_sha": "bf9ad2383af970ce3139fcaa6a728473c448e363", "source_title": "anouarbensaad/honeypot-iot repository", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "repository-documentation", "id": "gh3-anouarbensaad-honeypot-iot", "kind": "software", "name": "IoT-Honeypot", "organization": "anouarbensaad", "reviewed_at": "2026-10-04", "slug": "gh3-anouarbensaad-honeypot-iot", "source_url": "https://github.com/anouarbensaad/honeypot-iot", "status": "published", "summary_en": "A Python tool that simulates an IoT device (router) to log attacker IP addresses and activity into a logfile and MySQL database, using cloned web pages as a decoy front end.", "summary_es": "Herramienta en Python que simula un dispositivo IoT (router) para registrar direcciones IP de atacantes y su actividad en un archivo de registro y una base de datos MySQL, usando páginas web clonadas como señuelo.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": "64173b5e9af38d77dcd4d76034e9b5868403a2f58d66fe64ee629226f4b7f7cb", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The description is based solely on the minimal text documented on the archived repository page; its current behavior or maintenance has not been independently verified.", "limitations_es": "La descripción se basa únicamente en el texto mínimo documentado en la página archivada del repositorio; no se ha verificado de forma independiente su comportamiento ni mantenimiento actual.", "original_url": "https://github.com/anvol/micro-honeypot", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "three-ai-source-page-agreement", "source_commit": null, "source_document_url": "https://web.archive.org/web/20180617144813id_/https://github.com/anvol/micro-honeypot", "source_packet_sha256": "4e09f34f06d618579d9276ce6ee1ac1a4ac9ba8e3b5343a1743b4ddd6cf7abdb", "source_sha": null, "source_title": "micro-honeypot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "archived-repository-documentation", "id": "gh3-anvol-micro-honeypot", "kind": "software", "name": "micro-honeypot", "organization": "anvol", "reviewed_at": "2026-10-04", "slug": "gh3-anvol-micro-honeypot", "source_url": "https://web.archive.org/web/20180617144813id_/https://github.com/anvol/micro-honeypot", "status": "published", "summary_en": "micro-honeypot is described on its repository page as a simple honeypot designed to block port scanning.", "summary_es": "micro-honeypot es descrito en su página de repositorio como un honeypot simple diseñado para bloquear el escaneo de puertos.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Behavior is documented, not independently verified.", "limitations_es": "El comportamiento se describe en la documentación; no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/aplura/Tango/blob/master/README.md", "source_packet_sha256": "9caadccbd1515bebe6e8c2d29f01b898e275bbeb553830525f1181b0628710fd", "source_sha": "f2860b1e4f6e2285e51282dedf17c641dee24f81", "source_title": "aplura/Tango repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-aplura-tango", "kind": "software", "name": "Tango", "organization": "aplura", "reviewed_at": "2026-10-04", "slug": "gh3-aplura-tango", "source_url": "https://github.com/aplura/Tango", "status": "published", "summary_en": "Scripts and Splunk apps for deploying Cowrie and analyzing attacker-session logs; it provides honeypot infrastructure rather than being a honeypot itself.", "summary_es": "Conjunto de scripts y aplicaciones de Splunk para desplegar Cowrie y analizar registros de sesiones de atacantes; proporciona infraestructura para honeypots, no un honeypot propio.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Behavior is documented, not independently verified.", "limitations_es": "Comportamiento descrito en la documentación; no verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/ashmckenzie/go-sshoney/blob/master/README.md", "source_packet_sha256": "612b536b6289ebb2ac6162661e5bfdfa31905023c25abf18c08c2459ccacc7f0", "source_sha": "707c25fb4784af84ca1c9e2d6e21159db9931c3e", "source_title": "ashmckenzie/go-sshoney repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-ashmckenzie-go-sshoney", "kind": "software", "name": "SSHoney", "organization": "ashmckenzie", "reviewed_at": "2026-10-04", "slug": "gh3-ashmckenzie-go-sshoney", "source_url": "https://github.com/ashmckenzie/go-sshoney", "status": "published", "summary_en": "SSH honeypot that poses as a server and logs connection attempts, including IP, username, password, and client version. The documentation says it goes no further than logging.", "summary_es": "Honeypot SSH que simula un servidor y registra intentos de conexión, incluidos IP, usuario, contraseña y versión del cliente. La documentación indica que no continúa más allá del registro.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Application"], "limitations_en": "This information comes solely from the repository's documentation and has not been independently verified; it is not the original Dionaea project despite the similar name.", "limitations_es": "La información proviene exclusivamente de la documentación del repositorio y no ha sido verificada de forma independiente; no se trata del proyecto Dionaea original.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/atiger77/dionaea/blob/f6f929ae2402ddbc4bdde114a26fb82c6b9c67f2/README.md", "source_packet_sha256": "2f8193c675139e7a37ae10b19916801052ad208e99f39300dc406233682f1782", "source_sha": "aa256f6ef3a39e0f5d530bb49ee4b4b1234dfa05", "source_title": "atiger77/dionaea repository", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "repository-documentation", "id": "gh3-atiger77-dionaea", "kind": "software", "name": "web_dionaea", "organization": "atiger77", "reviewed_at": "2026-10-04", "slug": "gh3-atiger77-dionaea", "source_url": "https://github.com/atiger77/dionaea", "status": "published", "summary_en": "An internal web honeypot built with Django and Docker, designed to capture APT activity and insider intrusions using a decoy login interface.", "summary_es": "Honeypot web interno basado en Django y Docker, diseñado para detectar amenazas persistentes avanzadas (APT) e intrusiones de usuarios internos mediante una página de inicio de sesión señuelo.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The described behavior comes from the project's documentation and has not been independently verified.", "limitations_es": "El comportamiento descrito proviene de la documentación del proyecto y no ha sido verificado de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/awhitehatter/mailoney/blob/b8310a7019dd0ba00c666e5185bee3c1dd851e19/README.md", "source_packet_sha256": "4771ae3e367871d708c39b434391cbd64e9640e271ec757f009bc331017bec4c", "source_sha": "3c5b019e708be342e097f5e01a2f603d01a10ac1", "source_title": "awhitehatter/mailoney repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-awhitehatter-mailoney", "kind": "software", "name": "Mailoney", "organization": "awhitehatter", "reviewed_at": "2026-10-04", "slug": "gh3-awhitehatter-mailoney", "source_url": "https://github.com/awhitehatter/mailoney", "status": "published", "summary_en": "Mailoney is a low-interaction SMTP honeypot that simulates a vulnerable mail server, capturing authentication attempts and logging sessions to an optional database.", "summary_es": "Mailoney es un honeypot SMTP de baja interacción que simula un servidor de correo vulnerable, capturando intentos de autenticación y registrando sesiones en una base de datos opcional.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The description and behavior shown in the code are not independently verified; this source does not document how it interacts with clients.", "limitations_es": "La descripción y el comportamiento mostrado en el código no se han verificado de forma independiente; la fuente no documenta aquí cómo interactúa con los clientes.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/balte/TelnetHoney/blob/master/TeletHoney/src/Server.cs", "source_packet_sha256": "bbd8fbc95d3e5286e670e93e8d9fe6a22a1e0f72c24a27bd604b5716ca41592b", "source_sha": null, "source_title": "balte/TelnetHoney repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-balte-telnethoney", "kind": "software", "name": "TelnetHoney", "organization": "balte", "reviewed_at": "2026-10-04", "slug": "gh3-balte-telnethoney", "source_url": "https://github.com/balte/TelnetHoney", "status": "published", "summary_en": "The repository describes a simple Telnet honeypot; the supplied code shows a TCP server listening on port 23 and accepting connections.", "summary_es": "El repositorio lo describe como un honeypot Telnet sencillo; el código proporcionado muestra un servidor TCP que escucha en el puerto 23 y acepta conexiones.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network", "Endpoint"], "limitations_en": "The described behavior comes from the project's documentation and has not been independently verified.", "limitations_es": "El comportamiento descrito proviene de la documentación del proyecto y no ha sido verificado de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/basilfx/kippo-extra/blob/a03f8b94877efcb7fbf458226b73ed06ce732b4a/README.md", "source_packet_sha256": "049a41aad7f740a75a1a29016607d241fc9ff55f9bcab47f2eeaf3ff31bfca02", "source_sha": "1ec958e41855e6f4207dde9f77db2c7d39fc9e25", "source_title": "basilfx/kippo-extra repository", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "repository-documentation", "id": "gh3-basilfx-kippo-extra", "kind": "software", "name": "kippo-extra", "organization": "basilfx", "reviewed_at": "2026-10-04", "slug": "gh3-basilfx-kippo-extra", "source_url": "https://github.com/basilfx/kippo-extra", "status": "published", "summary_en": "kippo-extra is a set of additional fake commands (gcc, iptables, netstat, etc.) for the Kippo SSH honeypot, intended to make attacker sessions more realistic.", "summary_es": "kippo-extra es un conjunto de comandos adicionales (gcc, iptables, netstat, etc.) para el honeypot SSH Kippo, pensado para hacer más realistas las sesiones de los atacantes.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Behavior is documented, not independently verified.", "limitations_es": "Comportamiento descrito en la documentación; no verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/BinaryDefense/artillery/blob/master/README.md", "source_packet_sha256": "e002fbb4496af1d8115703524614039c7dbab4c5de9019a1836a13a127dd2963", "source_sha": "cb12c568e50ee5500676da773aa8acc896d0ee51", "source_title": "BinaryDefense/artillery repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-binarydefense-artillery", "kind": "software", "name": "Artillery", "organization": "BinaryDefense", "reviewed_at": "2026-10-04", "slug": "gh3-binarydefense-artillery", "source_url": "https://github.com/BinaryDefense/artillery", "status": "published", "summary_en": "Tool combining a honeypot on commonly attacked ports with monitoring and alerts; according to the documentation, it blacklists IPs that connect to those ports.", "summary_es": "Herramienta que combina un honeypot en puertos habituales con supervisión y alertas; según la documentación, bloquea las IP que se conectan a esos puertos.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network", "IoT"], "limitations_en": "The described behavior comes from the project's documentation, which states it has only been slightly tested, and has not been independently verified.", "limitations_es": "El comportamiento descrito proviene de la documentación del proyecto, que indica haber sido probado solo ligeramente, y no ha sido verificado de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/binkybear/honeypi/blob/abcc768e83ed8672e7d8b63f83ecd7c80269ce82/README.md", "source_packet_sha256": "036ec03063a7011dc42ce0e06048a0172ba5dce0dc2f9653fb8757bec7a208eb", "source_sha": "dd1894ccbc5e4ed983389b8890f1bfe2d541bd3c", "source_title": "binkybear/honeypi repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-binkybear-honeypi", "kind": "software", "name": "HoneyPi", "organization": "binkybear", "reviewed_at": "2026-10-04", "slug": "gh3-binkybear-honeypi", "source_url": "https://github.com/binkybear/honeypi", "status": "published", "summary_en": "HoneyPi is a bash script to install and run various honeypot projects on a Raspberry Pi running Raspbian, serving as an installation guide.", "summary_es": "HoneyPi es un script bash para instalar y ejecutar varios proyectos de honeypot en una Raspberry Pi con Raspbian, sirviendo como guía de despliegue.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Application", "Identity"], "limitations_en": "This behavior is documented, not independently verified.", "limitations_es": "Este comportamiento está documentado, pero no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/bjeborn/basic-auth-pot/blob/master/README.md", "source_packet_sha256": "eaed4c7680de4250831311946afa1aa3e79bd39736de9856058d07ca7cbaa1dc", "source_sha": "17986a48970ab29c05fb7ffad2f7e00b313cc467", "source_title": "bjeborn/basic-auth-pot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-bjeborn-basic-auth-pot", "kind": "software", "name": "bap", "organization": "bjeborn", "reviewed_at": "2026-10-04", "slug": "gh3-bjeborn-basic-auth-pot", "source_url": "https://github.com/bjeborn/basic-auth-pot", "status": "published", "summary_en": "Web honeypot that responds to HEAD and GET requests with an HTTP Basic challenge and logs received credentials; it accepts no username or password.", "summary_es": "Honeypot web que responde a solicitudes HEAD y GET con un desafío HTTP Basic y registra las credenciales recibidas; no acepta ningún usuario ni contraseña.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The description and instructions are documented, but behavior has not been independently verified.", "limitations_es": "La descripción y las instrucciones están documentadas, pero el comportamiento no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/blaverick62/SIREN/blob/master/docs/README.md", "source_packet_sha256": "c63609022ade768758f421ec168b1d0e791202dd149e3d7924d70467da0f58ff", "source_sha": "c265b28aee9b5eedb091b353daf2a41e489fc8fe", "source_title": "blaverick62/SIREN repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-blaverick62-siren", "kind": "software", "name": "SIREN", "organization": "blaverick62", "reviewed_at": "2026-10-04", "slug": "gh3-blaverick62-siren", "source_url": "https://github.com/blaverick62/SIREN", "status": "published", "summary_en": "Project described as a honeypot network. The supplied instructions cover startup and configuration of Snort, an alert rule, and MySQL, but do not explain how the honeypots operate.", "summary_es": "Proyecto descrito como una red de honeypots. Las instrucciones proporcionadas cubren su arranque y la configuración de Snort, una regla de alerta y MySQL, pero no explican cómo operan los honeypots.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": [], "limitations_en": "Emulation is documented, not independently verified; the deception link is a possibility, not a documented integration.", "limitations_es": "La emulación está documentada, no verificada de forma independiente; el vínculo con el engaño es una posibilidad, no una integración documentada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-agreement-on-augmented-primary-source", "source_document_url": "https://github.com/buffer/libemu/blob/master/README", "source_packet_sha256": "b048da55346b1f71aadb11d630edd726b35a17e1ebd72f58b2b053167a337455", "source_sha": "175b5569cf9b2c96d25fa5c02d5e146f543516fe", "source_title": "buffer/libemu repository", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-buffer-libemu", "kind": "software", "name": "libemu", "organization": "buffer", "reviewed_at": "2026-10-04", "slug": "gh3-buffer-libemu", "source_url": "https://github.com/buffer/libemu", "status": "published", "summary_en": "Software described as x86 emulation. That capability could be used to analyze code captured by a deception system, but the README documents neither that use nor libemu as a honeypot.", "summary_es": "Software descrito como emulación x86. Esa capacidad podría servir para analizar código capturado por un sistema de engaño, pero el README no documenta ese uso ni presenta libemu como honeypot.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Endpoint", "Network"], "limitations_en": "This summary describes behavior as documented by the project; it is not an independent verification of its detection or emulation capabilities.", "limitations_es": "Este resumen describe el comportamiento documentado por el proyecto; no constituye una verificación independiente de sus capacidades de detección o emulación.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_commit": null, "source_document_url": "https://github.com/buffer/thug/blob/9970d2563a941de2c9e5f4aeb6101787d2e1f3c9/README.rst", "source_packet_sha256": "ba28dc340e7e1812acbc52404c1587bd884d9b42a562976ae22c6a975c9047d0", "source_sha": "5b884eb18641d4ba66819e960188864d184ade0e", "source_title": "buffer/thug repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-buffer-thug", "kind": "software", "name": "Thug", "organization": "buffer", "reviewed_at": "2026-10-04", "slug": "gh3-buffer-thug", "source_url": "https://github.com/buffer/thug", "status": "published", "summary_en": "Thug is a Python low-interaction honeyclient that mimics the behavior of a web browser to detect and emulate malicious content.", "summary_es": "Thug es un honeyclient de baja interacción escrito en Python que imita el comportamiento de un navegador web para detectar y emular contenido malicioso.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Behavior is documented but has not been independently verified.", "limitations_es": "El comportamiento está documentado, pero no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_document_url": "https://github.com/CanadianJeff/honeywrt/blob/master/README.md", "source_packet_sha256": "3ea4ac69fea7c904ad3a85013bdd5ad4048a3af95e24b77302994ec00b344339", "source_sha": "5472013ddbf07d12f17c6a26b87961b05b59377f", "source_title": "CanadianJeff/honeywrt repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-canadianjeff-honeywrt", "kind": "software", "name": "HoneyWRT", "organization": "CanadianJeff", "reviewed_at": "2026-10-04", "slug": "gh3-canadianjeff-honeywrt", "source_url": "https://github.com/CanadianJeff/honeywrt", "status": "published", "summary_en": "Low-interaction Python honeypot that mimics network services and ports and logs access attempts.", "summary_es": "Honeypot de baja interacción en Python que simula servicios y puertos de red y registra los intentos de acceso.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Application"], "limitations_en": "The guarantees and limitations of each mechanism are as documented by the project itself; their effectiveness against real bots has not been independently verified.", "limitations_es": "Las garantías y limitaciones de cada mecanismo están documentadas por el propio proyecto; no se ha verificado de forma independiente su eficacia frente a bots reales.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "one-source-clarification-after-three-ai-screening", "source_commit": null, "source_document_url": "https://github.com/cedric/spamtrap/blob/a2b24d0fb1248636371bad505713024ea1c481cb/README.md", "source_packet_sha256": "02622cab2e2f34cb84c393602ed9474bcd95ae65cc6e045a002775d5241acedf", "source_sha": "d8d33a5894654ea7915ddb364e2d2d4d2c2b181a", "source_title": "cedric/spamtrap repository", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "repository-documentation", "id": "gh3-cedric-spamtrap", "kind": "framework", "name": "Spamtrap", "organization": "cedric", "reviewed_at": "2026-10-04", "slug": "gh3-cedric-spamtrap", "source_url": "https://github.com/cedric/spamtrap", "status": "published", "summary_en": "Spamtrap is a Rails gem that protects forms from spambots through opt-in, combinable mechanisms including hidden honeypot fields, nonces, field name mutation, and a minimum fill-time check.", "summary_es": "Spamtrap es una gema de Rails que protege formularios contra spambots mediante mecanismos opcionales combinables, incluyendo campos honeypot ocultos, nonces, mutación de nombres de campos y una comprobación de tiempo mínimo de llenado.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Application"], "limitations_en": "The described integration and detection are documented but have not been independently verified.", "limitations_es": "La integración y detección descritas están documentadas, pero no se han verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/CERT-Polska/hsn2-bundle/blob/master/README", "source_packet_sha256": "ea12e7d48f47343562805571ff0c6eb069255aec2f6f4609dd8610be41f08476", "source_sha": "f47831d62e19833de41efc35a2baeee598857dca", "source_title": "CERT-Polska/hsn2-bundle repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-cert-polska-hsn2-bundle", "kind": "software", "name": "Honeyspider Network 2.1", "organization": "CERT-Polska", "reviewed_at": "2026-10-04", "slug": "gh3-cert-polska-hsn2-bundle", "source_url": "https://github.com/CERT-Polska/hsn2-bundle", "status": "published", "summary_en": "System integrating multiple client honeypots and a crawler to process URLs and detect malicious websites.", "summary_es": "Sistema que integra varios honeypots cliente y un rastreador para procesar URL y detectar sitios web maliciosos.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Application"], "limitations_en": "The middleware behavior is documented but has not been independently verified.", "limitations_es": "El comportamiento del middleware está documentado, pero no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_document_url": "https://github.com/CHH/stack-honeypot/blob/master/README.md", "source_packet_sha256": "19010439806b18bc1f2300ebd1013558aa4dbb5e51599b5377ebda73c21d005b", "source_sha": "4f3ccd5f7fea1b2e5c2a8687cbcab711595a9da8", "source_title": "CHH/stack-honeypot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-chh-stack-honeypot", "kind": "software", "name": "Stack\\Honeypot", "organization": "CHH", "reviewed_at": "2026-10-04", "slug": "gh3-chh-stack-honeypot", "source_url": "https://github.com/CHH/stack-honeypot", "status": "published", "summary_en": "Middleware for PHP applications that adds a hidden form field as a spambot trap and checks whether it was changed.", "summary_es": "Middleware para aplicaciones PHP que añade a los formularios un campo oculto como trampa para spambots y comprueba si fue modificado.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["IoT", "Endpoint"], "limitations_en": "The description reflects behavior as documented by the project author, including noted instability and required manual interaction; it has not been independently verified.", "limitations_es": "La descripción refleja el comportamiento documentado por el autor del proyecto, incluyendo advertencias de inestabilidad e interacción manual requerida; no ha sido verificado de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/compoterhacker/mehrai/blob/4ab3362731969f5bb845a84deaed795ae0b76ea0/README.md", "source_packet_sha256": "5553b4c9dc2b55223ba99ad607237085b2442c80dda8c8fb9b415dc7381d31b0", "source_sha": "b92c109cdd95952dd2dae7a89e2a4a56a20d7be4", "source_title": "compoterhacker/mehrai repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-compoterhacker-mehrai", "kind": "software", "name": "mehrai", "organization": "compoterhacker", "reviewed_at": "2026-10-04", "slug": "gh3-compoterhacker-mehrai", "source_url": "https://github.com/compoterhacker/mehrai", "status": "published", "summary_en": "mehrai is a Docker-based honeypot whose purpose is catching Mirai binaries, using an Alpine Linux image to mimic an IoT device and monitoring the filesystem and processes to collect samples and submit them to the Viper API.", "summary_es": "mehrai es un honeypot basado en Docker cuyo propósito es capturar binarios de Mirai, usando una imagen de Alpine Linux para imitar un dispositivo IoT y monitoreando el sistema de archivos y procesos para recolectar muestras y enviarlas a la API de Viper.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The described behavior comes from documentation and has not been independently verified.", "limitations_es": "El comportamiento descrito procede de la documentación y no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/Cryptix720/HUDINX/blob/master/README.md", "source_packet_sha256": "c04ffac06c1864728985d2f5e3a324782693b52684247f310fd221bc2ed53595", "source_sha": "54490af2bc1e3f52ff9b70b8c1616a0f1a58558e", "source_title": "Cryptix720/HUDINX repository", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "repository-documentation", "id": "gh3-cryptix720-hudinx", "kind": "software", "name": "HUDINX", "organization": "Cryptix720", "reviewed_at": "2026-10-04", "slug": "gh3-cryptix720-hudinx", "source_url": "https://github.com/Cryptix720/HUDINX", "status": "published", "summary_en": "Medium-interaction SSH honeypot documented to log brute-force attacks and shell sessions, with a fake filesystem.", "summary_es": "Honeypot SSH de interacción media que documenta el registro de ataques de fuerza bruta y sesiones de shell, con un sistema de archivos simulado.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The documentation does not detail the honeypot’s behavior; it has not been independently verified.", "limitations_es": "La documentación no detalla el comportamiento del honeypot; este no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/csirtgadgets/csirtg-honeypot/blob/master/README.md", "source_packet_sha256": "61e5d4c469d2da79bac9ec023ec48164f4773fe14eba95bfd20c7e2ac2a6806a", "source_sha": "06f77ed021660538213a998e9cd63e0f733f42fd", "source_title": "csirtgadgets/csirtg-honeypot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-csirtgadgets-csirtg-honeypot", "kind": "software", "name": "WhiteFace HoneyPot", "organization": "csirtgadgets", "reviewed_at": "2026-10-04", "slug": "gh3-csirtgadgets-csirtg-honeypot", "source_url": "https://github.com/csirtgadgets/csirtg-honeypot", "status": "published", "summary_en": "Repository documenting how to start and stop WhiteFace HoneyPot and showing rdp.yml and vnc.yml configuration files; it does not explain which services it simulates.", "summary_es": "Repositorio que documenta instrucciones para iniciar y detener WhiteFace HoneyPot y muestra archivos de configuración rdp.yml y vnc.yml; no explica qué servicios simula.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "third-provider-adjudication", "environments": ["Network"], "limitations_en": "The information describes configuration steps documented by the repository; its functioning has not been independently verified.", "limitations_es": "La información describe pasos de configuración documentados por el repositorio; no se ha verificado de forma independiente su funcionamiento.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_commit": null, "source_document_url": "https://github.com/cudeso/cudeso-honeypot/blob/c2c9630756ff003e3ee22153c30428f60551a134/README.md", "source_packet_sha256": "fc3537596670334bf46a113b4692cd55a4cf90d9586fb6e307a00c348a2f219e", "source_sha": "9746370753a94daa0fd74c972881dadb7e5fb91d", "source_title": "cudeso/cudeso-honeypot repository", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-cudeso-cudeso-honeypot", "kind": "documentation", "name": "cudeso-honeypot", "organization": "cudeso", "reviewed_at": "2026-10-04", "slug": "gh3-cudeso-cudeso-honeypot", "source_url": "https://github.com/cudeso/cudeso-honeypot", "status": "published", "summary_en": "Setup documentation for several low-interaction honeypots (dionaea, kippo, glastopf, conpot), including network configuration steps such as reconfiguring the system SSH port for kippo.", "summary_es": "Documentación de configuración para varios honeypots de baja interacción (dionaea, kippo, glastopf, conpot), incluyendo pasos de red como reconfigurar el puerto SSH del sistema para kippo.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network", "Application"], "limitations_en": "The description reflects what is documented in the repository and its associated documentation; its behavior has not been independently verified.", "limitations_es": "La descripción refleja lo documentado en el repositorio y su documentación asociada; no se ha verificado de forma independiente su comportamiento.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/cymmetria/honeycomb/blob/33ea91b5cf675000e4e85dd02efe580ea6e95c86/README.rst", "source_packet_sha256": "92f60b0592fe9703a5e88b1217abe098df359b2d4496b74f630d89ba54450efe", "source_sha": "495083c32dc76951ce52ecc6517fd61c4d636de6", "source_title": "cymmetria/honeycomb repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-cymmetria-honeycomb", "kind": "framework", "name": "Honeycomb", "organization": "cymmetria", "reviewed_at": "2026-10-04", "slug": "gh3-cymmetria-honeycomb", "source_url": "https://github.com/cymmetria/honeycomb", "status": "published", "summary_en": "Honeycomb is an open-source honeypot framework created by Cymmetria that allows running honeypots with various integrations via a public plugin library, and makes it easy to write new honeypot services.", "summary_es": "Honeycomb es un framework de honeypots de código abierto creado por Cymmetria que permite ejecutar honeypots con diversas integraciones a través de una biblioteca pública de plugins, y facilita la creación de nuevos servicios de honeypot.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Application"], "limitations_en": "The simulation and detection are documented but have not been independently verified.", "limitations_es": "La simulación y la detección están descritas en la documentación, pero no se han verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/Cymmetria/micros_honeypot/blob/master/README.md", "source_packet_sha256": "386299879a5366404cb2a5fee183e3ac9fe752377a5559a15bad5299fd341c09", "source_sha": "f3a2e65f1b3ecdb8b15e7b79c90f16a6db0a6d04", "source_title": "Cymmetria/micros_honeypot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-cymmetria-micros-honeypot", "kind": "software", "name": "MICROS Honeypot", "organization": "Cymmetria", "reviewed_at": "2026-10-04", "slug": "gh3-cymmetria-micros-honeypot", "source_url": "https://github.com/Cymmetria/micros_honeypot", "status": "published", "summary_en": "Low-interaction honeypot documented to simulate a MICROS server, detect attempts to exploit CVE-2018-2636, and report them.", "summary_es": "Honeypot de baja interacción que, según la documentación, simula un servidor MICROS para detectar intentos de explotar CVE-2018-2636 y notificarlos.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network", "IoT"], "limitations_en": "Behavior is documented, not independently verified; the README notes an unresolved sample-downloading issue.", "limitations_es": "El comportamiento está documentado, no verificado de forma independiente; el README señala un fallo pendiente en la descarga de muestras.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/Cymmetria/MTPot/blob/master/README.md", "source_packet_sha256": "dd8723632a351998e4645abf7f2a895b688bdba0e2f131f376e9c457d6723513", "source_sha": "78108c54362fcf98d7e18ee8f31609aef771a30b", "source_title": "Cymmetria/MTPot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-cymmetria-mtpot", "kind": "software", "name": "MTPot", "organization": "Cymmetria", "reviewed_at": "2026-10-04", "slug": "gh3-cymmetria-mtpot", "source_url": "https://github.com/Cymmetria/MTPot", "status": "published", "summary_en": "Configurable honeypot that responds to expected scanner commands, such as Mirai's, to fingerprint their IP addresses; supports file and syslog output.", "summary_es": "Honeypot configurable que responde a comandos esperados de escáneres como Mirai para identificar sus direcciones IP; admite salida a archivo y syslog.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Behavior is documented, not independently verified; the README warns it is under development and should not be used in production.", "limitations_es": "El comportamiento está documentado, no verificado de forma independiente; el README advierte que está en desarrollo y no debe usarse en producción.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_document_url": "https://github.com/czardoz/hornet/blob/develop/README.rst", "source_packet_sha256": "b8708765bbe377c5f41862dbc5d2496c9de2e9f04d4300957a9083a7cc7de7d5", "source_sha": "4c8830e76293b3917930141b27dbe92400fff747", "source_title": "czardoz/hornet repository", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "repository-documentation", "id": "gh3-czardoz-hornet", "kind": "software", "name": "Hornet", "organization": "czardoz", "reviewed_at": "2026-10-04", "slug": "gh3-czardoz-hornet", "source_url": "https://github.com/czardoz/hornet", "status": "published", "summary_en": "Medium-interaction SSH honeypot with multiple virtual hosts, sandboxed filesystems, and commands that simulate interactions between hosts.", "summary_es": "Honeypot SSH de interacción media con varios hosts virtuales, sistemas de archivos aislados y comandos que permiten simular interacciones entre hosts.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["IoT", "Network"], "limitations_en": "Behavior is documented, not independently verified; payload collection depends on simulation support.", "limitations_es": "El comportamiento está documentado, no verificado de forma independiente; la recopilación de cargas útiles depende de que la simulación la admita.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/darkarnium/kako/blob/master/README.md", "source_packet_sha256": "8e57f37ef017cf27e5439b6aad17189241ad0dd9fc355e8f623124938178798b", "source_sha": "63afa1bf6a374699cea9447353caa5ccde2665c1", "source_title": "darkarnium/kako repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-darkarnium-kako", "kind": "software", "name": "Kako", "organization": "darkarnium", "reviewed_at": "2026-10-04", "slug": "gh3-darkarnium-kako", "source_url": "https://github.com/darkarnium/kako", "status": "published", "summary_en": "Honeypot software that simulates embedded-device services and vulnerabilities to record requests, origins, and, where supported, payloads; includes Telnet, HTTP, and HTTPS servers.", "summary_es": "Software de honeypots que simula servicios y vulnerabilidades de dispositivos embebidos para registrar solicitudes, orígenes y, cuando es posible, cargas útiles; ofrece servidores Telnet, HTTP y HTTPS.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The described behavior is drawn from the project's documentation; it has not been independently verified.", "limitations_es": "El comportamiento descrito proviene de la documentación del proyecto; no ha sido verificado de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_commit": null, "source_document_url": "https://github.com/datasoft/honeyd/blob/a0f3d64834781cf2c02f6d7302638f54c68dfdb0/README", "source_packet_sha256": "5e196b4ecb32c1b86a6aa10e9e282cd21a2827df73089fde7c68fce75eaebdf5", "source_sha": "d8e112d6aac7e5e8f87555e1f1b738e9ee2759f3", "source_title": "datasoft/honeyd repository", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "repository-documentation", "id": "gh3-datasoft-honeyd", "kind": "software", "name": "Honeyd", "organization": "datasoft", "reviewed_at": "2026-10-04", "slug": "gh3-datasoft-honeyd", "source_url": "https://github.com/datasoft/honeyd", "status": "published", "summary_en": "Honeyd is a small daemon that creates virtual hosts on a network, capable of running arbitrary services and adapting their TCP personality to simulate operating systems, enabling a single host to claim multiple addresses for network simulation.", "summary_es": "Honeyd es un pequeño daemon que crea hosts virtuales en una red, capaces de ejecutar servicios arbitrarios y adaptar su personalidad TCP para simular sistemas operativos, permitiendo que un solo host reclame múltiples direcciones para simulación de red.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Application"], "limitations_en": "The documentation describes the package's stated behavior (hidden fields and timing validation), but its effectiveness or security in production has not been independently verified.", "limitations_es": "La documentación describe el funcionamiento declarado del paquete (campos ocultos y validación por tiempo), pero no se ha verificado de forma independiente su eficacia o seguridad en producción.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_commit": null, "source_document_url": "https://github.com/devarjhay/honeypot/blob/2f1055971223e8e368af213a1b3ec6fede74c42a/README.md", "source_packet_sha256": "5b3baa64a12cdc4b9ae1c35427d37dc054386c5c4fac9c0be9fcf16a71d3ab2b", "source_sha": "415cd94551e998faf12b12b5c432445471f9d5f8", "source_title": "devarjhay/honeypot repository", "tags": [], "techniques": ["Honeytoken"]}, "evidence": "repository-documentation", "id": "gh3-devarjhay-honeypot", "kind": "framework", "name": "devarjhay/honeypot (Laravel Honeypot Spam Prevention)", "organization": "devarjhay", "reviewed_at": "2026-10-04", "slug": "gh3-devarjhay-honeypot", "source_url": "https://github.com/devarjhay/honeypot", "status": "published", "summary_en": "A Laravel 5.4/5.5 package that adds hidden honeypot fields (a decoy input and an encrypted timestamp) to forms to detect and block automated spam submissions, building on prior work by Ian Landsman and Maksim Surguy.", "summary_es": "Paquete para Laravel 5.4/5.5 que añade campos ocultos tipo honeypot (nombre y marca de tiempo cifrada) a los formularios para detectar y bloquear envíos automatizados de spam, basado en trabajos previos de Ian Landsman y Maksim Surguy.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Behavior is documented, not independently verified; the author says it is not intended for production use.", "limitations_es": "Comportamiento documentado, no verificado independientemente; el autor indica que no está destinado a producción.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "one-source-clarification-after-three-ai-screening", "source_document_url": "https://github.com/droberson/ssh-honeypot/blob/master/README.md", "source_packet_sha256": "6d3606e964d54fc883300265292cc3c861e72fca4234e6589f4678aeb420c6b8", "source_sha": "3586af216e3b4fc9d2a245e7d147f6232b5483b1", "source_title": "droberson/ssh-honeypot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-droberson-ssh-honeypot", "kind": "software", "name": "SSH Honeypot", "organization": "droberson", "reviewed_at": "2026-10-04", "slug": "gh3-droberson-ssh-honeypot", "source_url": "https://github.com/droberson/ssh-honeypot", "status": "published", "summary_en": "Low-interaction SSH honeypot that logs incoming IP addresses, usernames, and passwords without allowing logins.", "summary_es": "Honeypot SSH de baja interacción que registra IP, usuario y contraseña de conexiones entrantes sin permitir el inicio de sesión.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": "860445c9e740bc3f1b88f73eb114f8ebc578b7a0f69a5791721fd907e59a50b6", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Application"], "limitations_en": "This description reflects only what is documented on the archived repository page; the actual operation of the container and data capture has not been independently verified.", "limitations_es": "Esta descripción refleja solo lo documentado en la página archivada del repositorio; no se ha verificado de forma independiente el funcionamiento real del contenedor ni de la captura de datos.", "original_url": "https://github.com/dustyfresh/honeypress", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "three-ai-source-page-agreement", "source_commit": null, "source_document_url": "https://web.archive.org/web/20180611155858id_/https://github.com/dustyfresh/HoneyPress", "source_packet_sha256": "f1db0d4dbcc43c3fb686a034424d12b1550dca4eeb6ec28206c051954f2dcc1c", "source_sha": null, "source_title": "honeypress", "tags": [], "techniques": ["Honeypot"]}, "evidence": "archived-repository-documentation", "id": "gh3-dustyfresh-honeypress", "kind": "software", "name": "HoneyPress", "organization": "dustyfresh", "reviewed_at": "2026-10-04", "slug": "gh3-dustyfresh-honeypress", "source_url": "https://web.archive.org/web/20180611155858id_/https://github.com/dustyfresh/HoneyPress", "status": "published", "summary_en": "HoneyPress is a WordPress honeypot shipped in a Docker container, documented with a Flask/Python reimplementation simulating a WordPress install, logging access via Nginx, and storing captured payloads (including IP, user-agent, and commands) in a MongoDB database.", "summary_es": "HoneyPress es un honeypot de WordPress distribuido en un contenedor Docker, documentado con una reimplementación en Flask/Python que simula una instalación de WordPress, registra accesos vía Nginx y almacena payloads capturados (incluyendo IP, user-agent y comandos) en una base de datos MongoDB.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Behavior is documented, not independently verified; the project describes itself as a proof of concept that has not been adequately tested.", "limitations_es": "Comportamiento documentado, no verificado independientemente; el proyecto se presenta como prueba de concepto no probada adecuadamente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/dutchcoders/troje/blob/master/readme.md", "source_packet_sha256": "18c887ddbd4e505148a0826fbe622670cfa2f653f2fea6619e225435abf289fd", "source_sha": "94e20412ea69a1cabc1374dcbf16887ea4f84d76", "source_title": "dutchcoders/troje repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-dutchcoders-troje", "kind": "software", "name": "Troje", "organization": "dutchcoders", "reviewed_at": "2026-10-04", "slug": "gh3-dutchcoders-troje", "source_url": "https://github.com/dutchcoders/troje", "status": "published", "summary_en": "Honeypot documented as cloning an LXC container for a remote address and forwarding its connections there; it describes monitoring traffic and disk changes.", "summary_es": "Honeypot que, según su documentación, clona un contenedor LXC para una dirección remota y le redirige las conexiones; describe la supervisión del tráfico y los cambios en disco.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Application"], "limitations_en": "Behavior is documented, not independently verified; continuity with the historical link is unconfirmed.", "limitations_es": "Comportamiento documentado, no verificado independientemente; la continuidad con el enlace histórico no está confirmada.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/dvershinin/nginx-honeypot/blob/HEAD/README.md", "source_packet_sha256": "170a91dde0adfe9315395832b48689c4a182310a343fd8d934a187f80ed3a172", "source_sha": "dfad57487cd537c9c800fd1780ff7b5813979b4b", "source_title": "dvershinin/nginx-honeypot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-dvershinin-nginx-honeypot", "kind": "software", "name": "nginx-honeypot", "organization": "dvershinin", "reviewed_at": "2026-10-04", "slug": "gh3-dvershinin-nginx-honeypot", "source_url": "https://github.com/dvershinin/nginx-honeypot", "status": "published", "summary_en": "NGINX configuration that detects requests to bait paths and exploit probes and returns 410; optional IP blocking is documented.", "summary_es": "Configuración de NGINX que detecta solicitudes a rutas señuelo y sondeos de explotación, y responde 410; ofrece opciones de bloqueo de IP.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The repository itself is not a honeypot but supporting visualization tooling; its behavior is as documented and has not been independently verified.", "limitations_es": "El repositorio en sí no es un honeypot sino herramientas auxiliares de visualización; su comportamiento se basa en lo documentado y no ha sido verificado independientemente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/executemalware/honeypot-visualizations/blob/b9930e204c9cd049d2ea59f3b405c46aa93325ee/README.md", "source_packet_sha256": "72f09588be8b961b2a731085cd5c84124d51485fde49fd800e0c851351fd66b4", "source_sha": "d4f6b376a8ab9a25bce115722160c848d6e30bfc", "source_title": "executemalware/honeypot-visualizations repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-executemalware-honeypot-visualizations", "kind": "software", "name": "executemalware/honeypot-visualizations", "organization": "executemalware", "reviewed_at": "2026-10-04", "slug": "gh3-executemalware-honeypot-visualizations", "source_url": "https://github.com/executemalware/honeypot-visualizations", "status": "published", "summary_en": "A collection of scripts to install and run DionaeaFR and to index Cowrie honeypot data into Elasticsearch, aiding visualization of data collected from Dionaea and Cowrie honeypots.", "summary_es": "Colección de scripts para instalar y ejecutar DionaeaFR y para indexar datos de honeypots Cowrie en Elasticsearch, facilitando la visualización de los datos recolectados por los honeypots Dionaea y Cowrie.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The described behavior (service emulation and scan detection) is as documented by the author and has not been independently verified.", "limitations_es": "El comportamiento descrito (emulación de servicios y detección de escaneos) está documentado por el autor pero no ha sido verificado de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_commit": null, "source_document_url": "https://github.com/fabio-d/honeypot/blob/f87c4d85a69b807681f30b84d058419757f7545b/README.md", "source_packet_sha256": "16bcea07f1d2d1addb29d3b4fdf74b3a486eb91a443a0fc7e54c534a38799c3f", "source_sha": "36077f0d04e9fa20087490fe62418eb195212ae1", "source_title": "fabio-d/honeypot repository", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "repository-documentation", "id": "gh3-fabio-d-honeypot", "kind": "software", "name": "fabio-d/honeypot", "organization": "fabio-d", "reviewed_at": "2026-10-04", "slug": "gh3-fabio-d-honeypot", "source_url": "https://github.com/fabio-d/honeypot", "status": "published", "summary_en": "A Python honeypot that listens on all TCP and UDP ports, emulating services such as SSH, telnet, SMTP, HTTP/HTTPS, SIP (with sipvicious scan detection), and a Netis router factory backdoor, logging unrecognized traffic in hexdump-like form.", "summary_es": "Honeypot en Python que escucha en todos los puertos TCP y UDP, emulando servicios como SSH, telnet, SMTP, HTTP/HTTPS, SIP (con detección de escaneos sipvicious) y una puerta trasera de fábrica de routers Netis, registrando el tráfico no reconocido en formato hexdump.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "This description reflects the project's documentation and has not been independently verified.", "limitations_es": "Esta descripción refleja lo documentado por el proyecto y no ha sido verificada de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/fffaraz/fakessh/blob/148bec3aecbd39e1d7f182eb4e06f04c2cc5c829/README.md", "source_packet_sha256": "13ea0ca075d9c8295be7413d7c89f7b360270fd650dd541990b7fa464e57ffa0", "source_sha": "61b9e58b1e96c993fb769a5d5d30cbc278f74738", "source_title": "fffaraz/fakessh repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-fffaraz-fakessh", "kind": "software", "name": "FakeSSH", "organization": "fffaraz", "reviewed_at": "2026-10-04", "slug": "gh3-fffaraz-fakessh", "source_url": "https://github.com/fffaraz/fakessh", "status": "published", "summary_en": "FakeSSH is a dockerized SSH honeypot server written in Go that logs login attempts. Per its documentation, password authentication always fails, so no terminal access is granted to the attacker.", "summary_es": "FakeSSH es un honeypot SSH dockerizado escrito en Go que registra los intentos de inicio de sesión. Según la documentación, la autenticación por contraseña siempre falla, por lo que no se concede acceso a terminal al atacante.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Behavior is documented, not independently verified.", "limitations_es": "Comportamiento documentado, no verificado independientemente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_document_url": "https://github.com/fnzv/YAFH/blob/master/README.md", "source_packet_sha256": "e597dfa4fc5c85e2325b94baca3a44e437d6549b8c10050ca4d2564590585c7e", "source_sha": "8824f03de8e31c0f92f2dae6f1563efb15ee459f", "source_title": "fnzv/YAFH repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-fnzv-yafh", "kind": "software", "name": "YAFH", "organization": "fnzv", "reviewed_at": "2026-10-04", "slug": "gh3-fnzv-yafh", "source_url": "https://github.com/fnzv/YAFH", "status": "published", "summary_en": "SSH and Telnet honeypots that present a fake shell and fake Cisco router login, respectively, and save actions to log files.", "summary_es": "Honeypots SSH y Telnet que presentan una shell falsa y un acceso falso a un router Cisco, respectivamente, y guardan las acciones en archivos de registro.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network", "OT/ICS"], "limitations_en": "The described behavior comes from documentation and has not been independently verified.", "limitations_es": "El comportamiento descrito procede de la documentación y no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/fofapro/fapro/blob/master/README.md", "source_packet_sha256": "79aeeba6ff08cf554c20922827b7dff71ba964d38fdc849bdb1191439f3742df", "source_sha": "451f200f376790bdaefba7c3b6baaf33c68ee33d", "source_title": "fofapro/fapro repository", "tags": [], "techniques": ["Decoy"]}, "evidence": "repository-documentation", "id": "gh3-fofapro-fapro", "kind": "software", "name": "FaPro", "organization": "fofapro", "reviewed_at": "2026-10-04", "slug": "gh3-fofapro-fapro", "source_url": "https://github.com/fofapro/fapro", "status": "published", "summary_en": "Protocol server simulator documenting fake network services, interactions, and traffic logging, including industrial protocols.", "summary_es": "Simulador de servidores de protocolos que documenta servicios de red falsos, interacciones y registro de tráfico; incluye protocolos industriales.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network", "Cloud"], "limitations_en": "This description reflects the project's documentation and has not been independently verified; the honeypot functionality depends on the external honeydb-agent component.", "limitations_es": "Esta descripción refleja lo documentado por el proyecto y no ha sido verificada de forma independiente; la funcionalidad de honeypot depende del componente externo honeydb-agent.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/foospidy/honeyminer/blob/01a0de6d4fb79c54b26d4338eda2a50bd28b8015/README.md", "source_packet_sha256": "56f2dd495be85762fed4a196f7f3cdbdc1972d38078a3da46a1c678dd8dd5558", "source_sha": "9b38c3367f6794eea9d0d6323220031d0919e1cb", "source_title": "foospidy/honeyminer repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-foospidy-honeyminer", "kind": "software", "name": "HoneyMiner", "organization": "foospidy", "reviewed_at": "2026-10-04", "slug": "gh3-foospidy-honeyminer", "source_url": "https://github.com/foospidy/honeyminer", "status": "published", "summary_en": "HoneyMiner is a bash script that automates the installation of a crypto currency mining tool (minergate-cli) and a honeypot agent (honeydb-agent) on remote servers, per its documentation.", "summary_es": "HoneyMiner es un script bash que automatiza la instalación conjunta de una herramienta de minería de criptomonedas (minergate-cli) y un agente honeypot (honeydb-agent) en servidores remotos, según su documentación.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The described behavior comes from documentation and has not been independently verified.", "limitations_es": "El comportamiento descrito procede de la documentación y no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/foospidy/HoneyPy/blob/master/README.md", "source_packet_sha256": "45c4997e50af81a171c1c2e17f1375208c3187504b16c454cb82f785fc1ff72c", "source_sha": "8c40b30485bab875c45653a57e9827945b31628b", "source_title": "foospidy/HoneyPy repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-foospidy-honeypy", "kind": "software", "name": "HoneyPy", "organization": "foospidy", "reviewed_at": "2026-10-04", "slug": "gh3-foospidy-honeypy", "source_url": "https://github.com/foospidy/HoneyPy", "status": "published", "summary_en": "Low-interaction honeypot with plugins that can emulate TCP or UDP services and log activity. The project states it is no longer actively developed.", "summary_es": "Honeypot de baja interacción con plugins que pueden emular servicios TCP o UDP y registrar la actividad. El proyecto indica que ya no está en desarrollo activo.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Application"], "limitations_en": "The described behavior comes from documentation and has not been independently verified.", "limitations_es": "El comportamiento descrito procede de la documentación y no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/freak3dot/wp-smart-honeypot/blob/master/README.md", "source_packet_sha256": "e4826a998f079b8bf80b324fb2c878735e5a0f61fbfd30387883193068a74a90", "source_sha": "551e6854d8da6d3045b7fa5dde01d324a3f5cd12", "source_title": "freak3dot/wp-smart-honeypot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-freak3dot-wp-smart-honeypot", "kind": "software", "name": "wp-smart-honeypot", "organization": "freak3dot", "reviewed_at": "2026-10-04", "slug": "gh3-freak3dot-wp-smart-honeypot", "source_url": "https://github.com/freak3dot/wp-smart-honeypot", "status": "published", "summary_en": "WordPress plugin documenting a decoy field in comment forms to reduce spam; it is not intended to stop trackback spam.", "summary_es": "Plugin de WordPress que documenta un campo señuelo en formularios de comentarios para reducir el spam; no está destinado a detener el spam de trackbacks.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": "support-only-not-honeypot", "draft_review_basis": "independent-second-provider-review", "environments": ["Network", "Endpoint"], "limitations_en": "This description reflects the project's documentation and has not been independently verified; Sysdig and Falco are auxiliary monitoring tools, not honeypots themselves.", "limitations_es": "Esta descripción refleja lo documentado por el proyecto y no ha sido verificada de forma independiente; Sysdig y Falco son herramientas de monitorización auxiliares, no honeypots en sí mismas.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": ["Honeypot"], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/FSecureLABS/honeypot_recipes/blob/4de72d6f61ac024eecaef67d1928b6a43d153cbc/README.md", "source_packet_sha256": "1d8610b1f3ea5c3bb9bde1183bfdfb9725a2b62a28f844f4e7fd89adea99535a", "source_sha": "01d15304c5cb8b88d594d69082622ced84758702", "source_title": "FSecureLABS/honeypot_recipes repository", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-fsecurelabs-honeypot-recipes", "kind": "framework", "name": "honeypot_recipes (Sysdig and Falco cookbook)", "organization": "FSecureLABS", "reviewed_at": "2026-10-04", "slug": "gh3-fsecurelabs-honeypot-recipes", "source_url": "https://github.com/FSecureLABS/honeypot_recipes", "status": "published", "summary_en": "honeypot_recipes is a Chef cookbook that automates deployment of activity-monitoring tools (Sysdig and Falco) on Linux systems to support high-interaction honeypots, capturing and logging system calls. The tools themselves are monitoring infrastructure, not a honeypot: they provide logging and detection support used alongside a high-interaction honeypot.", "summary_es": "honeypot_recipes es un cookbook de Chef que automatiza el despliegue de herramientas de monitorización de actividad (Sysdig y Falco) en sistemas Linux para apoyar honeypots de alta interacción, capturando y registrando llamadas al sistema. Las herramientas en sí son de monitorización, no un honeypot: proporcionan la infraestructura de registro y detección usada junto con un honeypot de alta interacción.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": "support-only-not-honeypot", "draft_review_basis": "third-provider-adjudication", "environments": [], "limitations_en": "Its behavior is documented in the README, not independently verified; the README does not say HoneyMap deploys honeypots.", "limitations_es": "Su comportamiento está documentado en el README, no verificado de forma independiente; el README no indica que HoneyMap despliegue honeypots.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": ["Honeypot"], "review_basis": "repository-documentation", "screening_basis": "one-source-clarification-after-three-ai-screening", "source_document_url": "https://github.com/fw42/honeymap/blob/master/README.md", "source_packet_sha256": "d134c5cb1e6cc089208389901cbfabb1b3f15c3d35cb45b135faa48a50742d15", "source_sha": "a7c25e25d11d44e6b1f51f92863145fa5b05b4a4", "source_title": "fw42/honeymap repository", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-fw42-honeymap", "kind": "software", "name": "HoneyMap", "organization": "fw42", "reviewed_at": "2026-10-04", "slug": "gh3-fw42-honeymap", "source_url": "https://github.com/fw42/honeymap", "status": "published", "summary_en": "Web application that visualizes a live stream of GPS locations on an SVG world map; in its described instance it consumes honeypot captures provided through hpfeeds. It displays deception data but is not described as a honeypot.", "summary_es": "Aplicación web que visualiza un flujo en vivo de ubicaciones GPS sobre un mapa SVG; en su instancia descrita consume capturas de honeypots proporcionadas por hpfeeds. Visualiza datos de engaño, pero no se describe como honeypot.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Its behavior is documented, not independently verified; the README warns that running it as root is dangerous.", "limitations_es": "Su comportamiento está documentado, no verificado de forma independiente; el README advierte que ejecutarlo como root es peligroso.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/fzerorubigd/go0r/blob/master/README.md", "source_packet_sha256": "b44da2538e9aa4f9e6aaaf734a6255b11cea9c295b5234e9a90e8dd649236fb2", "source_sha": "b0d941f897829f8bd2aee80f6820a3612042ad01", "source_title": "fzerorubigd/go0r repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-fzerorubigd-go0r", "kind": "software", "name": "go0r", "organization": "fzerorubigd", "reviewed_at": "2026-10-04", "slug": "gh3-fzerorubigd-go0r", "source_url": "https://github.com/fzerorubigd/go0r", "status": "published", "summary_en": "SSH honeypot written in Go; the documentation describes configuring its port and host key and observing login attempts.", "summary_es": "Honeypot SSH escrito en Go; la documentación indica cómo configurar su puerto y clave de host y observar intentos de inicio de sesión.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["IoT", "Network"], "limitations_en": "The described behavior comes solely from the project's documentation and has not been independently verified.", "limitations_es": "El comportamiento descrito proviene únicamente de la documentación del proyecto y no ha sido verificado de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/gbafana25/esp8266_honeypot/blob/6896971846e29e942cf0a64c6bf4438276831b1f/README.md", "source_packet_sha256": "45e0f0ccda8512b62c5688006986d4008cf212e0dd1d4698b21e2a7f9a27d09d", "source_sha": "a2f5a645417835e8fa7d0a2373718e9dd7750348", "source_title": "gbafana25/esp8266_honeypot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-gbafana25-esp8266-honeypot", "kind": "software", "name": "ESP8266 Honeypot", "organization": "gbafana25", "reviewed_at": "2026-10-04", "slug": "gh3-gbafana25-esp8266-honeypot", "source_url": "https://github.com/gbafana25/esp8266_honeypot", "status": "published", "summary_en": "A MicroPython honeypot for the ESP8266 microcontroller that emulates a Telnet server to attract and observe attack attempts against exposed Telnet devices.", "summary_es": "Honeypot escrito en MicroPython para el microcontrolador ESP8266 que emula un servidor Telnet para atraer y observar intentos de ataque contra dispositivos Telnet expuestos.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Application"], "limitations_en": "The described behavior comes solely from the module's documentation and has not been independently verified.", "limitations_es": "El comportamiento descrito proviene únicamente de la documentación del módulo y no ha sido verificado de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_commit": null, "source_document_url": "https://github.com/geerlingguy/drupal-honeypot/blob/43dcba515d98523fcb0e03b65e077e274ab6e3b1/README.md", "source_packet_sha256": "d95fb1383ed3f2b00f1c7a25e937bd9b6d61642efa050b4deaf46e33426894bf", "source_sha": "c096502ad351f2e5e2a758c8cf07942c50710fe6", "source_title": "geerlingguy/drupal-honeypot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-geerlingguy-drupal-honeypot", "kind": "software", "name": "Honeypot module for Drupal", "organization": "geerlingguy", "reviewed_at": "2026-10-04", "slug": "gh3-geerlingguy-drupal-honeypot", "source_url": "https://github.com/geerlingguy/drupal-honeypot", "status": "published", "summary_en": "A Drupal module that adds a hidden honeypot field and a time-based restriction to forms in order to detect and block automated spam submissions.", "summary_es": "Módulo de Drupal que añade un campo honeypot oculto y una restricción de tiempo a los formularios para detectar y bloquear envíos automatizados de spam.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The described behavior comes solely from the project's documentation and has not been independently verified.", "limitations_es": "El comportamiento descrito proviene únicamente de la documentación del proyecto y no ha sido verificado de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/gento/dionaea/blob/bb40f46c5547c6d4d918eb5ee05573de8f7f07df/README", "source_packet_sha256": "82d3b7a330ff10b3896d3d089a18500ce0ef0b60b8bfabcf306e7b8c69227fda", "source_sha": "7da64d95a2926339052eb67363da7536f302e84a", "source_title": "gento/dionaea repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-gento-dionaea", "kind": "software", "name": "Dionaea", "organization": "gento", "reviewed_at": "2026-10-04", "slug": "gh3-gento-dionaea", "source_url": "https://github.com/gento/dionaea", "status": "published", "summary_en": "A low-interaction honeypot, successor to nepenthes, offering emulated network services such as SMB, HTTP, FTP, TFTP, and MSSQL via embedded Python and libemu, aiming to capture copies of malware.", "summary_es": "Honeypot de baja interacción, sucesor de nepenthes, que ofrece servicios de red emulados como SMB, HTTP, FTP, TFTP y MSSQL mediante Python embebido y libemu, con el objetivo de capturar copias de malware.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The use of the DIONAEA honeypot to capture the samples is as documented in the repository, but has not been independently verified.", "limitations_es": "El uso del honeypot DIONAEA para capturar las muestras está documentado en el repositorio, pero no se ha verificado de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_commit": null, "source_document_url": "https://github.com/gexos/malrepo/blob/00732b1aa3127b0c9cff9c7d29c57359d27a82eb/README.md", "source_packet_sha256": "2f60bd17259ccda50f8d65ef9761b3b9c09e4332eb72e7799e3992a4c14007cb", "source_sha": "7666f83e129fce1178558921b964753b81f1b439", "source_title": "gexos/malrepo repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-gexos-malrepo", "kind": "dataset", "name": "MalRepo", "organization": "gexos", "reviewed_at": "2026-10-04", "slug": "gh3-gexos-malrepo", "source_url": "https://github.com/gexos/malrepo", "status": "published", "summary_en": "MalRepo is a repository of malware samples captured via the DIONAEA honeypot, intended for security researchers to analyze and reverse engineer.", "summary_es": "MalRepo es un repositorio de muestras de malware capturadas mediante el honeypot DIONAEA, destinado a investigadores de seguridad para análisis e ingeniería inversa.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": [], "limitations_en": "Its behavior is documented, not independently verified; the description provides no operational details.", "limitations_es": "Su comportamiento está documentado, no verificado de forma independiente; la descripción no aporta detalles de funcionamiento.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/glaslos/honeyprint/blob/master/README.md", "source_packet_sha256": "ad854a4f8af479ccb06c0c6e06d8e09680919ffae4ceb7b28137042675815ae0", "source_sha": "e6573c86577b3a15d702cf2b45670c8fe55cfb70", "source_title": "glaslos/honeyprint repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-glaslos-honeyprint", "kind": "software", "name": "Honeyprint", "organization": "glaslos", "reviewed_at": "2026-10-04", "slug": "gh3-glaslos-honeyprint", "source_url": "https://github.com/glaslos/honeyprint", "status": "published", "summary_en": "Printer honeypot proof of concept.", "summary_es": "Prueba de concepto de un honeypot de impresora.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network", "Application"], "limitations_en": "This tool is a query client to the Project Honeypot service and does not itself implement a honeypot; its behavior is as documented, without independent verification.", "limitations_es": "Esta herramienta es un cliente de consulta hacia el servicio Project Honeypot y no implementa por sí misma un honeypot; su funcionamiento es tal como se documenta, sin verificación independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_commit": null, "source_document_url": "https://github.com/gmr/httpbl/blob/90a6d6d67026aab286b19df4ad01395853ddc55e/README.rst", "source_packet_sha256": "c9f8b5644f27ab342993ff672cd1fc89b506c2f622b11f7b9b7c09ed3c94a412", "source_sha": "421fd159a9aec542e2eb0875eaf6dacb247b9f0a", "source_title": "gmr/httpbl repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-gmr-httpbl", "kind": "software", "name": "httpbl", "organization": "gmr", "reviewed_at": "2026-10-04", "slug": "gh3-gmr-httpbl", "source_url": "https://github.com/gmr/httpbl", "status": "published", "summary_en": "httpbl is a Python client package for the Project Honeypot Http:BL API, allowing queries of threat scores and visitor types for IP addresses.", "summary_es": "httpbl es un paquete cliente de Python para la API Http:BL de Project Honeypot, que permite consultar puntuaciones de amenaza y tipos de visitantes a partir de direcciones IP.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": "support-only-not-honeypot", "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "These capabilities are documented, not independently verified.", "limitations_es": "Estas funciones están documentadas, pero no se han verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": ["Honeypot"], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/GoSecure/pyrdp/blob/main/README.md", "source_packet_sha256": "9e9ae10f122dd24c2a65091980bfbdedb5921458d664354ea1bf2806d1059749", "source_sha": "00c5c871925c2348341fd35b31c99324fb6d1d24", "source_title": "GoSecure/pyrdp repository", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-gosecure-pyrdp", "kind": "software", "name": "PyRDP", "organization": "GoSecure", "reviewed_at": "2026-10-04", "slug": "gh3-gosecure-pyrdp", "source_url": "https://github.com/GoSecure/pyrdp", "status": "published", "summary_en": "A tool and library for intercepting RDP connections; the documentation describes credential logging and session replay. It can support observation of actors but is not presented as a honeypot.", "summary_es": "Herramienta y biblioteca para interponerse en conexiones RDP; la documentación describe el registro de credenciales y la reproducción de sesiones. Puede apoyar la observación de actores, pero no se presenta como honeypot.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": "support-only-not-honeypot", "draft_review_basis": "independent-second-provider-review", "environments": [], "limitations_en": "Its function is documented, not independently verified.", "limitations_es": "Su función está documentada, pero no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": ["Honeypot"], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/GovCERT-CZ/Shockpot-Frontend/blob/master/README.md", "source_packet_sha256": "1ac5f8d6d0a524ee47fa91795e84955a2f635f4e9560a4b3d755149742885252", "source_sha": "937f435b1a0e6f35b9162758a8d038a26117d846", "source_title": "GovCERT-CZ/Shockpot-Frontend repository", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-govcert-cz-shockpot-frontend", "kind": "software", "name": "Shockpot-Frontend", "organization": "GovCERT-CZ", "reviewed_at": "2026-10-04", "slug": "gh3-govcert-cz-shockpot-frontend", "source_url": "https://github.com/GovCERT-CZ/Shockpot-Frontend", "status": "published", "summary_en": "A script for visualizing statistics from a Shockpot honeypot that logs to PostgreSQL. It is a frontend for honeypot data, not itself a honeypot.", "summary_es": "Script para visualizar estadísticas de un honeypot Shockpot que registra datos en PostgreSQL. Es una interfaz para datos del honeypot, no un honeypot en sí.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": "support-only-not-honeypot", "draft_review_basis": "independent-second-provider-review", "environments": [], "limitations_en": "Its function is documented, not independently verified.", "limitations_es": "Su función está documentada, pero no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": ["Honeypot"], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/GovCERT-CZ/Wordpot-Frontend/blob/master/README.md", "source_packet_sha256": "25e13d7ae989c2648e0de756601a0463ed7dd75f181ddad23ed7d6c51804b3b0", "source_sha": "c6825806f77c2bf945b10ffcaf2a13a1ec4857db", "source_title": "GovCERT-CZ/Wordpot-Frontend repository", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-govcert-cz-wordpot-frontend", "kind": "software", "name": "Wordpot-Frontend", "organization": "GovCERT-CZ", "reviewed_at": "2026-10-04", "slug": "gh3-govcert-cz-wordpot-frontend", "source_url": "https://github.com/GovCERT-CZ/Wordpot-Frontend", "status": "published", "summary_en": "A script for visualizing statistics from a Wordpot honeypot that logs to PostgreSQL. It is a frontend for honeypot data, not itself a honeypot.", "summary_es": "Script para visualizar estadísticas de un honeypot Wordpot que registra datos en PostgreSQL. Es una interfaz para datos del honeypot, no un honeypot en sí.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "third-provider-adjudication", "environments": ["Network"], "limitations_en": "Only a scant README is available; the credential collection method is not detailed, nor is any honeypot implementation or deployment. The honeypot relation is suggested solely by the repository name and has not been independently verified. No techniques are included because the source text does not describe any.", "limitations_es": "Solo se dispone de un README escueto; no se detalla el método de recolección de las credenciales ni ninguna implementación o despliegue de honeypot. La relación con honeypots se sugiere únicamente por el nombre del repositorio y no se ha verificado de forma independiente. No se ha incluido ninguna técnica porque el texto fuente no describe ninguna.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_commit": null, "source_document_url": "https://github.com/govolution/honeypotwordlist/blob/bd161bc53c62f8fddcbb4fa87a5747d031cfc716/README.md", "source_packet_sha256": "cdb94836f17725e41abdeaf381ba1da6b4add195cbab3ce912f4cf1a566bef08", "source_sha": "4c6e52302c3c2de5e457922fb573cc49828ea1ea", "source_title": "govolution/honeypotwordlist repository", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-govolution-honeypotwordlist", "kind": "dataset", "name": "honeypotwordlist", "organization": "govolution", "reviewed_at": "2026-10-04", "slug": "gh3-govolution-honeypotwordlist", "source_url": "https://github.com/govolution/honeypotwordlist", "status": "published", "summary_en": "honeypotwordlist is a collection of two wordlists of credentials: one containing all passwords sorted and unique, and another containing credentials in username:password format, sorted and unique.", "summary_es": "honeypotwordlist es una colección de dos listas de palabras con credenciales: una con todas las contraseñas ordenadas y únicas, y otra con credenciales en formato usuario:contraseña, ordenadas y únicas.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Application"], "limitations_en": "The described behavior comes from documentation and has not been independently verified.", "limitations_es": "El comportamiento descrito procede de la documentación y no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_document_url": "https://github.com/graneed/bwpot/blob/master/README.md", "source_packet_sha256": "33425bf651f3daf2c6a58040f307c7f7c2e89368a2d8759dddaf0505b17a7773", "source_sha": "992a4dfb514a89ba0c59fa1ebaad0d01fb459192", "source_title": "graneed/bwpot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-graneed-bwpot", "kind": "software", "name": "BW-Pot", "organization": "graneed", "reviewed_at": "2026-10-04", "slug": "gh3-graneed-bwpot", "source_url": "https://github.com/graneed/bwpot", "status": "published", "summary_en": "A high-interaction HTTP/HTTPS honeypot that presents vulnerable web applications to observe attacker access. The documentation says it sends logs to BigQuery and saves packet captures.", "summary_es": "Honeypot de alta interacción para HTTP/HTTPS que presenta aplicaciones web vulnerables para observar accesos de atacantes. La documentación indica que envía registros a BigQuery y guarda capturas de paquetes.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The described behavior comes from documentation and has not been independently verified.", "limitations_es": "El comportamiento descrito procede de la documentación y no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/gregcmartin/Kippo_JunOS/blob/master/README.md", "source_packet_sha256": "df2d9ec8c8463132a759b52fce14ae6c6ba5b1301e75594850a05cce25333376", "source_sha": "5450024c86ba787fb7d0d29f9cef1f9c39502420", "source_title": "gregcmartin/Kippo_JunOS repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-gregcmartin-kippo-junos", "kind": "software", "name": "Kippo_JunOS", "organization": "gregcmartin", "reviewed_at": "2026-10-04", "slug": "gh3-gregcmartin-kippo-junos", "source_url": "https://github.com/gregcmartin/Kippo_JunOS", "status": "published", "summary_en": "A medium-interaction SSH honeypot documented to log brute-force attacks and shell interactions; it includes a fake filesystem and replayable session logs.", "summary_es": "Honeypot SSH de interacción media que documenta ataques de fuerza bruta e interacciones de shell; incluye un sistema de archivos simulado y registros de sesión reproducibles.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": "c00adc99a3d72ed6767a3a062eb65067184fccc6a5ecf39d280ee4bf64762631", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network", "Application", "Identity", "IoT", "OT/ICS"], "limitations_en": "The content describes a link list as documented in an archived copy; the current availability, maintenance, or behavior of the linked projects has not been independently verified.", "limitations_es": "El contenido describe un listado de enlaces documentado en una copia archivada; no se ha verificado de forma independiente la disponibilidad, mantenimiento o comportamiento actual de los proyectos enlazados.", "original_url": "https://github.com/hackinfinity/honey-pots-", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "three-ai-source-page-agreement", "source_commit": null, "source_document_url": "https://web.archive.org/web/20200806031543id_/https://github.com/Hackinfinity/Honey-Pots-", "source_packet_sha256": "cddfc3694517c87c4a2ccb3d6871577d0cc07204b3d3bc1515edf9289055ee03", "source_sha": null, "source_title": "honey-pots-", "tags": [], "techniques": ["Honeypot"]}, "evidence": "archived-repository-documentation", "id": "gh3-hackinfinity-honey-pots", "kind": "community", "name": "Honey-Pots- (Hackinfinity curated list)", "organization": "hackinfinity", "reviewed_at": "2026-10-04", "slug": "gh3-hackinfinity-honey-pots", "source_url": "https://web.archive.org/web/20200806031543id_/https://github.com/Hackinfinity/Honey-Pots-", "status": "published", "summary_en": "A curated GitHub list aggregating open-source honeypot resources (database, web, WordPress, service, ICS/SCADA honeypots), network and data analysis tools, and deployment guides, organized by category.", "summary_es": "Lista curada en GitHub que recopila recursos de honeypots de código abierto (bases de datos, web, WordPress, servicios, ICS/SCADA), herramientas de análisis de red y datos, y guías de despliegue, organizados por categorías.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "third-provider-adjudication", "environments": ["Network", "Application", "IoT"], "limitations_en": "The described capabilities and architecture come from the project's own documentation; no code was executed and the claims were not independently verified. Classification as a honeypot rests solely on the project's explicit documentation claims.", "limitations_es": "Las capacidades y la arquitectura descritas provienen de la documentación oficial del proyecto; no se ha ejecutado código ni verificado las afirmaciones de forma independiente. La clasificación como honeypot se basa únicamente en las afirmaciones explícitas de la documentación del proyecto.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "three-ai-source-page-agreement", "source_commit": "7fd6ebfec693d7056fa1806de20415e9a109b2f7", "source_document_url": "https://github.com/hacklcx/hfish/blob/7fd6ebfec693d7056fa1806de20415e9a109b2f7/docs/README.md", "source_packet_sha256": "eb3dce60e9a0a9d61eaa4cef02e1dd4d24e2862b6a7f022f3b108d2ba30286ce", "source_sha": null, "source_title": "hfish", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "vendor-documentation", "id": "gh3-hacklcx-hfish", "kind": "product", "name": "HFish", "organization": "北京微步在线科技有限公司", "reviewed_at": "2026-10-04", "slug": "gh3-hacklcx-hfish", "source_url": "https://github.com/hacklcx/hfish", "status": "published", "summary_en": "HFish is a free, community-oriented honeypot product developed by Beijing Microstep Online Technology Co., Ltd., aimed at enterprise scenarios such as internal lateral-movement detection, external threat perception, and intelligence generation. Its documentation states it supports over 90 honeypot service types, a B/S architecture with a server (管理端) and node/client (节点端) component, and multiple alert channels (email, syslog, webhook, WeChat Work, DingTalk, Feishu).", "summary_es": "HFish es un producto de honeypot comunitario y gratuito desarrollado por Beijing Microstep Online Technology Co., Ltd., orientado a escenarios empresariales como detección de movimiento lateral interno, percepción de amenazas externas y generación de inteligencia. La documentación indica que admite más de 90 tipos de servicios honeypot, arquitectura B/S con un componente de servidor (管理端) y otro de cliente/nodo (节点端), y múltiples canales de alerta (correo, syslog, webhook, WeChat Work, DingTalk, Feishu).", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Endpoint"], "limitations_en": "The described behavior comes from documentation and has not been independently verified.", "limitations_es": "El comportamiento descrito procede de la documentación y no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_document_url": "https://github.com/hatching/vmcloak/blob/main/README.md", "source_packet_sha256": "49ba16e6f04880c35bb4a229adb4d2b981ab92a913bad9441138291348e33b07", "source_sha": "7903f79e29fc8f9737bc914f93765dc02235300f", "source_title": "hatching/vmcloak repository", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-hatching-vmcloak", "kind": "software", "name": "VMCloak", "organization": "hatching", "reviewed_at": "2026-10-04", "slug": "gh3-hatching-vmcloak", "source_url": "https://github.com/hatching/vmcloak", "status": "published", "summary_en": "A tool for creating and preparing virtual machines for Cuckoo Sandbox. Its link to deception is preparing and cloaking those analysis environments; the documentation does not present it as a honeypot.", "summary_es": "Herramienta para crear y preparar máquinas virtuales destinadas a Cuckoo Sandbox. Su vínculo con la decepción es la preparación y ocultación de esos entornos de análisis; la documentación no la presenta como honeypot.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Application"], "limitations_en": "The described behavior (lack of spam in production) comes from the author's documentation and has not been independently verified.", "limitations_es": "El comportamiento descrito (ausencia de spam en producción) proviene de la documentación del autor y no ha sido verificado de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "one-source-clarification-after-three-ai-screening", "source_commit": null, "source_document_url": "https://github.com/heiglandreas/orgheiglcontact/blob/cabf861ea37637b1dc349b4df813ac63cfe00076/README.md", "source_packet_sha256": "71133c2df3ab230262ae8247b90c87c92e503559de8f6c6bd2a349d9e23f631d", "source_sha": "fbeb7a50ba8ae59cf8a56f6217f0c01d3a3ef8c8", "source_title": "heiglandreas/orgheiglcontact repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-heiglandreas-orgheiglcontact", "kind": "software", "name": "Org_Heigl\\Contact", "organization": "heiglandreas", "reviewed_at": "2026-10-04", "slug": "gh3-heiglandreas-orgheiglcontact", "source_url": "https://github.com/heiglandreas/orgheiglcontact", "status": "published", "summary_en": "PHP (Zend/Laminas) module providing a contact form with anti-spam protection using a hidden honeypot field.", "summary_es": "Módulo PHP (Zend/Laminas) que provee un formulario de contacto con protección anti-spam mediante un campo honeypot oculto.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": "support-only-not-honeypot", "draft_review_basis": "independent-second-provider-review", "environments": [], "limitations_en": "The behavior is documented, not independently verified.", "limitations_es": "El comportamiento está documentado, no verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": ["Honeypot"], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/hgascon/acapulco/blob/master/README.md", "source_packet_sha256": "625ce88fef35d8477714db5dd1a9cb90ad1d6ff077dd42c7378f7631530585bb", "source_sha": "ac6e1a577fc9f8eac1febe9051db91e62118afe5", "source_title": "hgascon/acapulco repository", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-hgascon-acapulco", "kind": "software", "name": "Acapulco", "organization": "hgascon", "reviewed_at": "2026-10-04", "slug": "gh3-hgascon-acapulco", "source_url": "https://github.com/hgascon/acapulco", "status": "published", "summary_en": "Splunk application and client that generate, cluster, and visualize meta-events from hpfeeds channels. It supports analysis in the Honeynet ecosystem; it is not described as a honeypot.", "summary_es": "Aplicación de Splunk y cliente que generan, agrupan y visualizan metaeventos de canales hpfeeds. Se vincula al análisis de datos del ecosistema Honeynet; no se describe como un honeypot.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network", "Identity"], "limitations_en": "The project is documented as outdated and in a proof-of-concept state; its capabilities have not been independently verified.", "limitations_es": "El proyecto está documentado como desactualizado y en estado de prueba de concepto; sus capacidades no han sido verificadas de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/honeynet/beeswarm/blob/db51ea0bc29f631c3e3b5312b479ac9d5e31079a/README.rst", "source_packet_sha256": "047d42d0d435f6195c9fe4a63167d0d72ec90fdf2e189d7cb663ce70256f23a7", "source_sha": "b9226931da74170f7c72e265303d984500590bc2", "source_title": "honeynet/beeswarm repository", "tags": [], "techniques": ["Honeypot", "Honeytoken", "Decoy"]}, "evidence": "repository-documentation", "id": "gh3-honeynet-beeswarm", "kind": "software", "name": "Beeswarm", "organization": "honeynet", "reviewed_at": "2026-10-04", "slug": "gh3-honeynet-beeswarm", "source_url": "https://github.com/honeynet/beeswarm", "status": "published", "summary_en": "A honeypot project (now outdated) that deploys decoy clients and services to detect compromise via traffic discrepancies and honeytoken credential reuse.", "summary_es": "Proyecto honeypot (ahora desactualizado) que despliega clientes y servicios señuelo para detectar compromisos mediante discrepancias en tráfico y reutilización de credenciales honeytoken.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The tool's behavior and effectiveness are based on project documentation, which states it is in very early development stages, and have not been independently verified.", "limitations_es": "El comportamiento y la eficacia de la herramienta se basan en la documentación del proyecto, que indica que se encuentra en etapas muy tempranas de desarrollo, y no han sido verificados de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/honeynet/checkpot/blob/17f6cf37b72fe91bf97c67242f21360df9968e72/README.md", "source_packet_sha256": "1eab9695315f53a7a88118c608eeee3e462f81e643d5e6464c3178bd3bc7fe6f", "source_sha": "226d04fbcbd2c26be34422768510e229d88c2e6a", "source_title": "honeynet/checkpot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-honeynet-checkpot", "kind": "software", "name": "Checkpot", "organization": "honeynet", "reviewed_at": "2026-10-04", "slug": "gh3-honeynet-checkpot", "source_url": "https://github.com/honeynet/checkpot", "status": "published", "summary_en": "Open-source tool that scans systems to detect misconfigurations or fingerprints revealing honeypots, helping researchers make them harder to detect.", "summary_es": "Herramienta de código abierto que escanea sistemas para detectar configuraciones incorrectas o huellas que delatan la presencia de honeypots, ayudando a los investigadores a hacerlos menos detectables.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Application"], "limitations_en": "The behavior is documented, not independently verified.", "limitations_es": "El comportamiento está documentado, no verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_document_url": "https://github.com/honeynet/phoneyc/blob/master/README.md", "source_packet_sha256": "4f64921a0b35fad0f12644cdc1628960545434d55eb784d59d07976d67e6d095", "source_sha": "4eb19763011e7317a807a06704f26011bbcbba02", "source_title": "honeynet/phoneyc repository", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-honeynet-phoneyc", "kind": "software", "name": "PhoneyC", "organization": "honeynet", "reviewed_at": "2026-10-04", "slug": "gh3-honeynet-phoneyc", "source_url": "https://github.com/honeynet/phoneyc", "status": "published", "summary_en": "Tool shown running against a sample malicious page or URL, with shellcode and heap-spray alerts in the example output. The README does not identify it as a honeypot.", "summary_es": "Herramienta que el README muestra ejecutándose sobre una página maliciosa de ejemplo o una URL, con alertas de shellcode y heap spray en la salida de ejemplo. No la identifica como honeypot.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": [], "limitations_en": "The deployment role and its link to the honeypot system are documented, not independently verified.", "limitations_es": "La función de despliegue y su vínculo con el sistema honeypot están documentados, no verificados de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/HoneySat/honeysat-deploy/blob/main/README.md", "source_packet_sha256": "3f120bcc189709a8a246f96cf9d658310f712279dfd6314171184becdaf812ac", "source_sha": "a97246a4d262a9d8447d80abe252fe8a024af3ba", "source_title": "HoneySat/honeysat-deploy repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-honeysat-honeysat-deploy", "kind": "software", "name": "honeysat-deploy", "organization": "HoneySat", "reviewed_at": "2026-10-04", "slug": "gh3-honeysat-honeysat-deploy", "source_url": "https://github.com/HoneySat/honeysat-deploy", "status": "published", "summary_en": "Docker Compose configurations and scripts for deploying Honeysat components. The README links its submodules to a honeypot system but does not present the deployment repository itself as a honeypot.", "summary_es": "Configuraciones y scripts de Docker Compose para desplegar componentes de Honeysat. El README vincula sus submódulos con un sistema honeypot, pero no presenta el repositorio de despliegue como un honeypot.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "third-provider-adjudication", "environments": [], "limitations_en": "Functionality is documented, not independently verified; this source does not establish a specific honeypot use.", "limitations_es": "La funcionalidad está documentada, no verificada de forma independiente; esta fuente no establece un uso específico con honeypots.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-agreement-on-augmented-primary-source", "source_document_url": "https://github.com/hpfeeds/hpfeeds/blob/master/README.md", "source_packet_sha256": "a1d409a74181b3c3c7ce4808541965bccc824de6a973962ebe8879350534f7ca", "source_sha": "62452df37fc1dfbd7a69cc8889e4ee624e54252a", "source_title": "hpfeeds/hpfeeds repository", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-hpfeeds-hpfeeds", "kind": "software", "name": "hpfeeds", "organization": "hpfeeds", "reviewed_at": "2026-10-04", "slug": "gh3-hpfeeds-hpfeeds", "source_url": "https://github.com/hpfeeds/hpfeeds", "status": "published", "summary_en": "Authenticated publish-subscribe protocol with an asyncio-based broker and Python 3 client; it can carry deception-system events but is not documented as a honeypot.", "summary_es": "Protocolo de publicación y suscripción autenticado, con broker escrito sobre asyncio y cliente Python 3; puede transportar eventos de sistemas de engaño, pero no se documenta como honeypot.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The described behavior comes from the repository's documentation and has not been independently verified.", "limitations_es": "El comportamiento descrito proviene de la documentación del repositorio y no ha sido verificado de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/ikoniaris/dionaea-vagrant/blob/212f2ae147b51befb3863325494d65ec285d2411/README.md", "source_packet_sha256": "b6f0fb9edc9c2bec5e475796d3613289b09002e92cd34edb81b8c7e44e2e91fd", "source_sha": "55b1d0fbe581d1366366cb95ce2680e32f317868", "source_title": "ikoniaris/dionaea-vagrant repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-ikoniaris-dionaea-vagrant", "kind": "software", "name": "Dionaea-Vagrant", "organization": "ikoniaris", "reviewed_at": "2026-10-04", "slug": "gh3-ikoniaris-dionaea-vagrant", "source_url": "https://github.com/ikoniaris/dionaea-vagrant", "status": "published", "summary_en": "Dionaea-Vagrant is a set of scripts and a Vagrantfile that automate deployment of a virtual machine running the Dionaea malware honeypot on Ubuntu 12.04, installing dependencies and running it as a daemon alongside p0f.", "summary_es": "Dionaea-Vagrant es un conjunto de scripts y un Vagrantfile que automatizan el despliegue de una máquina virtual con el honeypot de malware Dionaea sobre Ubuntu 12.04, instalando sus dependencias y ejecutándolo como demonio junto con p0f.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": "support-only-not-honeypot", "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The described behavior comes from the repository's documentation and has not been independently verified.", "limitations_es": "El comportamiento descrito proviene de la documentación del repositorio y no ha sido verificado de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": ["Honeypot"], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/ikoniaris/kippo-graph/blob/da45bddc93f2d7e8e31dde6248035816804f4ff6/README.md", "source_packet_sha256": "58ae26a5c5fc5a3409ffb0a5276c0df0da4208e64f5dc3da8feaf5bec037eae7", "source_sha": "8a87c413ef8061cb9076db23a4520ae5554350d3", "source_title": "ikoniaris/kippo-graph repository", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-ikoniaris-kippo-graph", "kind": "software", "name": "Kippo-Graph", "organization": "ikoniaris", "reviewed_at": "2026-10-04", "slug": "gh3-ikoniaris-kippo-graph", "source_url": "https://github.com/ikoniaris/kippo-graph", "status": "published", "summary_en": "Kippo-Graph is a PHP tool that visualizes statistics and charts from data collected by the Kippo SSH honeypot, including attack geolocation, but is not itself a honeypot.", "summary_es": "Kippo-Graph es una herramienta en PHP que visualiza estadísticas y gráficos a partir de los datos recopilados por el honeypot SSH Kippo, incluyendo geolocalización de ataques, pero no es en sí mismo un honeypot.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": "support-only-not-honeypot", "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The described behavior comes from the repository's documentation and has not been independently verified.", "limitations_es": "El comportamiento descrito proviene de la documentación del repositorio y no ha sido verificado de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": ["Honeypot"], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/ikoniaris/kippo-malware/blob/4621e223ab5222e4fb46f31c997f8226d071edb7/README.md", "source_packet_sha256": "4a0b4a76337e4c58b11b4ab34abf735c39fbe906f08cb5f0c671d9b21460af14", "source_sha": "2cd30bb8d8f194972bf30c876cc4acc055caed18", "source_title": "ikoniaris/kippo-malware repository", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-ikoniaris-kippo-malware", "kind": "software", "name": "Kippo-Malware", "organization": "ikoniaris", "reviewed_at": "2026-10-04", "slug": "gh3-ikoniaris-kippo-malware", "source_url": "https://github.com/ikoniaris/kippo-malware", "status": "published", "summary_en": "Kippo-Malware is a Python script that downloads malicious files stored as URLs in the Kippo SSH honeypot's database, with support for HTTP proxies and custom User-Agent values; it is not itself a honeypot.", "summary_es": "Kippo-Malware es un script en Python que descarga los archivos maliciosos almacenados como URLs en la base de datos del honeypot SSH Kippo, con soporte para proxies HTTP y User-Agent personalizado; no es en sí mismo un honeypot.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Application"], "limitations_en": "This behavior is documented but has not been independently verified.", "limitations_es": "Este comportamiento está documentado, pero no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/IllusiveNetworks-Labs/WebTrap/blob/master/Readme.md", "source_packet_sha256": "8d359f863e928c15be7bbce5fcaedcffc09621cc1e1299ef25082d9a628aae54", "source_sha": "a86decbe4846c795e8e09407ea469c71a84de925", "source_title": "IllusiveNetworks-Labs/WebTrap repository", "tags": [], "techniques": ["Decoy"]}, "evidence": "repository-documentation", "id": "gh3-illusivenetworks-labs-webtrap", "kind": "software", "name": "WebTrap", "organization": "IllusiveNetworks-Labs", "reviewed_at": "2026-10-04", "slug": "gh3-illusivenetworks-labs-webtrap", "source_url": "https://github.com/IllusiveNetworks-Labs/WebTrap", "status": "published", "summary_en": "Tools for cloning webpages, particularly login pages, and serving them as decoys. The documentation says the server reports requests to a syslog server.", "summary_es": "Herramientas para clonar páginas web, especialmente páginas de inicio de sesión, y servirlas como señuelos. Según la documentación, el servidor informa de las solicitudes a un servidor syslog.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "third-provider-adjudication", "environments": ["Network"], "limitations_en": "Classification is based solely on a brief source code excerpt without further documentation; its full behavior has not been executed or independently verified.", "limitations_es": "La clasificación se basa únicamente en un breve extracto de código fuente sin documentación adicional; no se ha ejecutado ni verificado de forma independiente su comportamiento completo.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/inguardians/toms_honeypot/blob/master/toms_honeypot.py", "source_packet_sha256": "a04d78543d7d63dbf83572c968ca86aa6c604575d39c221c7d9984ede0c514c9", "source_sha": "403681413f2801afb0d542376c3ff5046204d526", "source_title": "inguardians/toms_honeypot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-inguardians-toms-honeypot", "kind": "software", "name": "toms_honeypot", "organization": "inguardians", "reviewed_at": "2026-10-04", "slug": "gh3-inguardians-toms-honeypot", "source_url": "https://github.com/inguardians/toms_honeypot", "status": "published", "summary_en": "The repository is named “Tom's Honey Pot,” and the source code excerpt shows Protocol/DatagramProtocol classes that emulate network services (MSSQL, Terminal Services, RAdmind, VNC, SIP) listening on known TCP/UDP ports, posting Twitter alerts when connections or login attempts occur.", "summary_es": "El nombre del repositorio se presenta como «Tom's Honey Pot», y el código fuente muestra clases Protocol/DatagramProtocol que simulan servicios de red (MSSQL, Terminal Services, RAdmind, VNC, SIP) escuchando en puertos TCP/UDP conocidos, y que publican alertas en Twitter cuando reciben conexiones o intentos de inicio de sesión.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "This description is based solely on the repository's documentation and has not been independently verified.", "limitations_es": "Esta descripción se basa únicamente en la documentación del repositorio y no ha sido verificada de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/internetwache/ssh-honeypot/blob/3ee08157fcb7c32efa6ccbdb972fee035a294a7d/README.md", "source_packet_sha256": "b61f8c7c1efe9205b7758172350f6c811fc91d887b6a7bf5e920a11adfc86d3c", "source_sha": "a754d1beee06ef7e1f4369abb02658b0ba4c833f", "source_title": "internetwache/ssh-honeypot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-internetwache-ssh-honeypot", "kind": "software", "name": "SSH-Honeypot (internetwache)", "organization": "internetwache", "reviewed_at": "2026-10-04", "slug": "gh3-internetwache-ssh-honeypot", "source_url": "https://github.com/internetwache/ssh-honeypot", "status": "published", "summary_en": "A simple Python SSH server that logs all username/password combinations attempted against it to a logfile, intended to be deployed on a redirected port via iptables.", "summary_es": "Servidor SSH simple en Python que registra todas las combinaciones de usuario/contraseña intentadas por los atacantes en un archivo de log, pensado para desplegarse en un puerto redirigido mediante iptables.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "third-provider-adjudication", "environments": ["Application"], "limitations_en": "The README describes client classes (HttpBL, Quicklink, Address) for querying an external service and generating links; the code has not been executed or independently verified, and it does not implement any honeypot technique itself.", "limitations_es": "El README describe clases cliente (HttpBL, Quicklink, Address) para consultar un servicio externo y generar enlaces; no se ha ejecutado ni verificado el código, y no implementa ninguna técnica de honeypot propia.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_document_url": "https://github.com/jadb/honeypot/blob/master/README.md", "source_packet_sha256": "dfd609a0c6a0bba8cf1685f09081f78862dbcf8798c9d9aecfe876e59a035ab2", "source_sha": "7297b0241394e61367a44f819649bb6d87505957", "source_title": "jadb/honeypot repository", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-jadb-honeypot", "kind": "software", "name": "jadb/honeypot", "organization": "jadb", "reviewed_at": "2026-10-04", "slug": "gh3-jadb-honeypot", "source_url": "https://github.com/jadb/honeypot", "status": "published", "summary_en": "Unofficial PHP SDK for Project Honey Pot that queries the HttpBL API to detect bad visitors and generates Quicklinks pointing to an external honeypot. It is a client/integration SDK and does not itself implement a honeypot.", "summary_es": "SDK PHP no oficial de Project Honey Pot que permite consultar la API HttpBL para detectar visitantes maliciosos y generar enlaces Quicklink hacia un honeypot externo. Es un cliente/SDK de integración, no implementa un honeypot por sí mismo.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "This description reflects what the project author documented and has not been independently verified; the tool depends on an already-running Cowrie honeypot.", "limitations_es": "Esta descripción refleja lo documentado por el autor del proyecto y no ha sido verificada de forma independiente; la herramienta depende de un honeypot Cowrie ya en funcionamiento.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/jamesbower/engagedthreat/blob/7e0edae3037c7d351cc5a4fcc2948d18a93c971e/README.md", "source_packet_sha256": "bf34ab293c7a5ef1e26b59b1a440a71154897484cd1a4a53bc28e8b19e1d33e7", "source_sha": "c0b9e6719b0d897039e81bbab8949beaac543c3f", "source_title": "jamesbower/engagedthreat repository", "tags": [], "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "repository-documentation", "id": "gh3-jamesbower-engagedthreat", "kind": "software", "name": "Engaged Threat (Splunk app for Cowrie)", "organization": "jamesbower", "reviewed_at": "2026-10-04", "slug": "gh3-jamesbower-engagedthreat", "source_url": "https://github.com/jamesbower/engagedthreat", "status": "published", "summary_en": "A Splunk app that analyzes JSON logs from the Cowrie SSH honeypot to provide dashboards and metrics on attacker engagement, aiming to observe behavioral changes when honeypot configuration settings are adjusted.", "summary_es": "Aplicación de Splunk que analiza los logs JSON del honeypot SSH Cowrie para generar dashboards y métricas de interacción de atacantes, con el fin de observar cambios de comportamiento ante modificaciones en la configuración del honeypot.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Application"], "limitations_en": "This description is based on the project's README documentation and has not been independently verified; its effectiveness depends on the configuration chosen by each developer.", "limitations_es": "Esta descripción se basa en la documentación del README del proyecto y no ha sido verificada de forma independiente; su eficacia depende de la configuración elegida por cada desarrollador.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_commit": null, "source_document_url": "https://github.com/jamesturk/django-honeypot/blob/8edb4a0694ed6eb695a017a87731fc0638ad8b22/README.rst", "source_packet_sha256": "8a9bf57eb456ca0fb49f1acb9633dd23f43577795b71d03e78c68548d4f2c06e", "source_sha": "304561b6c2c74a5e31a8fb3df2d8ce3db212162c", "source_title": "jamesturk/django-honeypot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-jamesturk-django-honeypot", "kind": "framework", "name": "django-honeypot", "organization": "jamesturk", "reviewed_at": "2026-10-04", "slug": "gh3-jamesturk-django-honeypot", "source_url": "https://github.com/jamesturk/django-honeypot", "status": "published", "summary_en": "A Django application that adds hidden honeypot fields to web forms via template tags, view decorators, and middleware, aiming to detect and block automated spam submissions.", "summary_es": "Aplicación para Django que añade campos honeypot ocultos a formularios web mediante etiquetas de plantilla, decoradores de vista y middleware, con el objetivo de detectar y bloquear envíos automatizados de spam.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Endpoint"], "limitations_en": "The described behavior is based solely on the project's documentation and has not been independently verified; the author itself warns there is no guarantee of full accuracy.", "limitations_es": "El comportamiento descrito proviene únicamente de la documentación del proyecto y no ha sido verificado de forma independiente; el propio autor advierte que no hay garantía de exactitud total.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/jlchntoz/ransomhoneypot/blob/9ae51f62272dbf00b9a9e1b40d9211e768afbc7a/README.md", "source_packet_sha256": "6d2d1dcfdd19a1604483e90d972359b8a0c923f69f4e3d56c2f3917a758bca80", "source_sha": "f066a749301287c7f3f7ff192acdcb7518ffe6f3", "source_title": "jlchntoz/ransomhoneypot repository", "tags": [], "techniques": ["Decoy"]}, "evidence": "repository-documentation", "id": "gh3-jlchntoz-ransomhoneypot", "kind": "software", "name": "RansomHoneyPot", "organization": "jlchntoz", "reviewed_at": "2026-10-04", "slug": "gh3-jlchntoz-ransomhoneypot", "source_url": "https://github.com/jlchntoz/ransomhoneypot", "status": "published", "summary_en": "An experimental and incomplete alpha-stage program that tracks decoy ('honey pot') files with names, extensions, and paths likely to be encrypted by ransomware, killing processes that lock them when opened.", "summary_es": "Programa experimental e incompleto en etapa alfa que rastrea archivos señuelo ('honey pot') con nombres, extensiones y rutas susceptibles de ser cifrados por ransomware, y termina los procesos que los bloquean al abrirlos.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Behavior is documented in the README, not independently verified.", "limitations_es": "Comportamiento descrito en el README; no verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/johestephan/VerySimpleHoneypot/blob/master/README.md", "source_packet_sha256": "a6697f9318b6f9b48c687598f149f4889dfd2d032f75f0e4c09bdd915e34c195", "source_sha": "b567902ae8bb40ec68e378ff35eb486dd52b24c6", "source_title": "johestephan/VerySimpleHoneypot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-johestephan-verysimplehoneypot", "kind": "software", "name": "VerySimpleHoneypot", "organization": "johestephan", "reviewed_at": "2026-10-04", "slug": "gh3-johestephan-verysimplehoneypot", "source_url": "https://github.com/johestephan/VerySimpleHoneypot", "status": "published", "summary_en": "Honeypot configurable by service, port, and response; the documentation says it logs events to syslog.", "summary_es": "Honeypot configurable por servicio, puerto y respuesta; la documentación indica que registra los eventos en syslog.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Mnemosyne is data-collection and correlation infrastructure for honeypot-sourced data, not itself a honeypot; the description reflects only the published documentation and not independent verification.", "limitations_es": "Mnemosyne es infraestructura de recolección y correlación de datos provenientes de honeypots, no un honeypot en sí mismo; la descripción refleja únicamente la documentación publicada y no una verificación independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_commit": null, "source_document_url": "https://github.com/johnnykv/mnemosyne/blob/54d635ec363868f15c8872cfefa7f4546f04e52e/README.md", "source_packet_sha256": "f015c82748457806fce72afdb8a6bddc4ccc02592dffeaaa34c82a94d9e0476f", "source_sha": "99a1e1205e9cbb6c9c775ed209c1edfe2c7e383e", "source_title": "johnnykv/mnemosyne repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-johnnykv-mnemosyne", "kind": "software", "name": "Mnemosyne", "organization": "johnnykv", "reviewed_at": "2026-10-04", "slug": "gh3-johnnykv-mnemosyne", "source_url": "https://github.com/johnnykv/mnemosyne", "status": "published", "summary_en": "A service that provides immutable persistence for hpfeeds, normalizes data from multiple honeypot sensors (dionaea, kippo, glastopf, thug, beeswarm), and exposes the normalized data through a RESTful API.", "summary_es": "Servicio que provee persistencia inmutable para hpfeeds, normaliza datos de múltiples sensores honeypot (dionaea, kippo, glastopf, thug, beeswarm) y expone los datos normalizados mediante una API RESTful.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network", "Cloud"], "limitations_en": "The README's descriptions of functionality have not been independently verified.", "limitations_es": "Las funciones descritas en el README no se han verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_document_url": "https://github.com/joshrendek/threat.gg-agent/blob/master/README.md", "source_packet_sha256": "06d752138991241b59b2c0f900c563aa4e36674e5ed5380cf80e81042013b545", "source_sha": "3b03f0188391d0a46c1c6184c72d5f57cf444f63", "source_title": "joshrendek/threat.gg-agent repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-joshrendek-threat-gg-agent", "kind": "software", "name": "threat.gg Agent", "organization": "joshrendek", "reviewed_at": "2026-10-04", "slug": "gh3-joshrendek-threat-gg-agent", "source_url": "https://github.com/joshrendek/threat.gg-agent", "status": "published", "summary_en": "Agent that, according to the README, emulates multiple network services, captures interactions, and sends data to threat.gg via gRPC.", "summary_es": "Agente que, según el README, emula varios servicios de red, captura interacciones y envía los datos a threat.gg mediante gRPC.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Its behavior is described by the repository description and selected code, not independently verified.", "limitations_es": "Su comportamiento se describe en la descripción del repositorio y el código seleccionado; no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/Joss-Steward/honeypotDisplay/blob/master/HoneypotDataDisplay/HoneypotDataDisplay/views.py", "source_packet_sha256": "17cf4c2ed66d8d6271fff75513b03b4f49c5a1aee8dc32f8794c7e10c86867ac", "source_sha": null, "source_title": "Joss-Steward/honeypotDisplay repository", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-joss-steward-honeypotdisplay", "kind": "software", "name": "honeypotDisplay", "organization": "Joss-Steward", "reviewed_at": "2026-10-04", "slug": "gh3-joss-steward-honeypotdisplay", "source_url": "https://github.com/Joss-Steward/honeypotDisplay", "status": "published", "summary_en": "Flask site for displaying data collected by an SSH honeypot, including attempts and statistics. It is deception-adjacent visualization software, not itself described as a honeypot.", "summary_es": "Sitio Flask para mostrar datos recopilados por un honeypot SSH, incluidos intentos y estadísticas. Es una herramienta de visualización vinculada al engaño, no un honeypot descrito como tal.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network", "Application", "OT/ICS"], "limitations_en": "Behavior is documented, not independently verified; the README also notes outstanding logging and configuration issues.", "limitations_es": "El comportamiento está documentado, no verificado de forma independiente; el README también señala problemas pendientes con registros y configuración.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/jpyorre/IntelligentHoneyNet/blob/master/README.md", "source_packet_sha256": "242d4023aeabc51cdaeeae7a4d1b6ccb0743539b8231ef283603cae911ebdc07", "source_sha": "9527079809f9f52865b0aa6e19525f82cc5f79be", "source_title": "jpyorre/IntelligentHoneyNet repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-jpyorre-intelligenthoneynet", "kind": "software", "name": "IntelligentHoneyNet", "organization": "jpyorre", "reviewed_at": "2026-10-04", "slug": "gh3-jpyorre-intelligenthoneynet", "source_url": "https://github.com/jpyorre/IntelligentHoneyNet", "status": "published", "summary_en": "Scripts to install a server and multiple honeypots, process their logs, and display information about attack attempts. The documentation lists SSH, web, and industrial-system honeypots.", "summary_es": "Scripts para instalar un servidor y varios honeypots, procesar sus registros y presentar información sobre intentos de ataque. La documentación enumera señuelos SSH, web y de sistemas industriales.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": "support-only-not-honeypot", "draft_review_basis": "independent-second-provider-review", "environments": ["Application"], "limitations_en": "The function is documented, not independently verified.", "limitations_es": "La función está documentada, no verificada de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": ["Honeypot"], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/katkad/Glastopf-Analytics/blob/master/README.md", "source_packet_sha256": "0c63ad9ce2e4b558361b7c7cabde8c9a326a0798d4587667e20cd36169cf0c72", "source_sha": "cdfe442e3dbcc52c8f5b413445e6a3fa24127cd5", "source_title": "katkad/Glastopf-Analytics repository", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-katkad-glastopf-analytics", "kind": "software", "name": "Glastopf Analytics", "organization": "katkad", "reviewed_at": "2026-10-04", "slug": "gh3-katkad-glastopf-analytics", "source_url": "https://github.com/katkad/Glastopf-Analytics", "status": "published", "summary_en": "Perl script that queries Glastopf's SQLite database for statistics. It supports analysis of a web-application honeypot but is not described as a honeypot itself.", "summary_es": "Script Perl que consulta la base SQLite de Glastopf para mostrar estadísticas. Apoya el análisis de un honeypot de aplicaciones web; no se describe como un honeypot.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": [], "limitations_en": "Behavior and the performance improvement are documented claims, not independently verified.", "limitations_es": "El comportamiento y la mejora de rendimiento se describen en la documentación, pero no se han verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/kingtuna/go-emulators/blob/master/README.md", "source_packet_sha256": "76b5324899aaa79e6a49cb8afc20bbef13b938ff3641a680fb8f5b1d49734831", "source_sha": "d96d03c94c72cfe53c9ae526987ab9e696c1a769", "source_title": "kingtuna/go-emulators repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-kingtuna-go-emulators", "kind": "software", "name": "go-emulators", "organization": "kingtuna", "reviewed_at": "2026-10-04", "slug": "gh3-kingtuna-go-emulators", "source_url": "https://github.com/kingtuna/go-emulators", "status": "published", "summary_en": "Service emulators for honeypots rewritten in Go; the README does not specify which services they emulate.", "summary_es": "Emuladores de servicios para honeypots reescritos en Go; el README no especifica qué servicios emulan.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Behavior is documented, not independently verified; the documentation warns that the emulation is not fully compatible.", "limitations_es": "El comportamiento solo está documentado, no verificado de forma independiente; la documentación advierte que la simulación no es totalmente compatible.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/knalli/honeypot-for-tcp-32764/blob/master/README.md", "source_packet_sha256": "9ffdd916a7f0f3e63dcd769f3290c89fed46fe70410e65b3390d89ce823bd759", "source_sha": "8d54b049576ef96a1aed7a7964dedb33ddcc0eed", "source_title": "knalli/honeypot-for-tcp-32764 repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-knalli-honeypot-for-tcp-32764", "kind": "software", "name": "honeypot-for-tcp-32764", "organization": "knalli", "reviewed_at": "2026-10-04", "slug": "gh3-knalli-honeypot-for-tcp-32764", "source_url": "https://github.com/knalli/honeypot-for-tcp-32764", "status": "published", "summary_en": "Node.js honeypot that emulates the TCP-32764 router backdoor and provides logs for monitoring.", "summary_es": "Honeypot en Node.js que simula la puerta trasera TCP-32764 de routers y ofrece registros para supervisión.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Behavior is documented, not independently verified; the README advises against production use.", "limitations_es": "El comportamiento solo está documentado, no verificado de forma independiente; el README desaconseja su uso en producción.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/kryptoslogic/rdppot/blob/master/README.md", "source_packet_sha256": "3ae50e202872affe5ca75a384a399340ca5fa3c6543acb54a0fd188607f42a0a", "source_sha": "0ffdaacc2931b409fca0beebbec5f9adaa506fbc", "source_title": "kryptoslogic/rdppot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-kryptoslogic-rdppot", "kind": "software", "name": "rdppot", "organization": "kryptoslogic", "reviewed_at": "2026-10-04", "slug": "gh3-kryptoslogic-rdppot", "source_url": "https://github.com/kryptoslogic/rdppot", "status": "published", "summary_en": "RDP honeypot that assigns a virtual machine to each session and documents disk and traffic capture for BlueKeep telemetry.", "summary_es": "Honeypot RDP que asigna una máquina virtual a cada sesión y documenta la captura del disco y del tráfico para obtener telemetría de BlueKeep.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network", "Endpoint"], "limitations_en": "The description is based solely on the academic project's README and does not constitute independent verification of the system's functioning.", "limitations_es": "La descripción se basa únicamente en el README del proyecto académico y no constituye una verificación independiente del funcionamiento del sistema.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/kulinacs/cowrie-attack/blob/dace013a2fa3f3bfb85df59796a4e8a49e975660/README.md", "source_packet_sha256": "411b3924720018065dbcaa18ce6fe35c12c423e1d9a4de5b6ac0aa1e564abbe0", "source_sha": "726c993869e402e91852e99e9957544d73508419", "source_title": "kulinacs/cowrie-attack repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-kulinacs-cowrie-attack", "kind": "software", "name": "cowrie-attack (CS6324 Project)", "organization": "kulinacs", "reviewed_at": "2026-10-04", "slug": "gh3-kulinacs-cowrie-attack", "source_url": "https://github.com/kulinacs/cowrie-attack", "status": "published", "summary_en": "An academic project that deploys a honeypot alongside an Elastic stack (Elasticsearch/Kibana) and ElastAlert, including a custom 'MITREAttack' alert that writes information according to the MITRE ATT&CK matrix for detecting and classifying attacks.", "summary_es": "Proyecto académico que despliega un honeypot junto con una pila Elastic (Elasticsearch/Kibana) y ElastAlert, incluyendo una alerta personalizada 'MITREAttack' que escribe información según la matriz MITRE ATT&CK para la detección y clasificación de ataques.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Behavior is documented, not independently verified.", "limitations_es": "El comportamiento solo está documentado, no verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_document_url": "https://github.com/lanjelot/twisted-honeypots/blob/master/README.md", "source_packet_sha256": "d7f8b1c7d8c65a5e25b324f16fd95666c038f7b4f10c6c5c5ec865093ae1f580", "source_sha": "d9389bb882d6fb359abe16641bfdb066729b33f5", "source_title": "lanjelot/twisted-honeypots repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-lanjelot-twisted-honeypots", "kind": "software", "name": "twisted-honeypots", "organization": "lanjelot", "reviewed_at": "2026-10-04", "slug": "gh3-lanjelot-twisted-honeypots", "source_url": "https://github.com/lanjelot/twisted-honeypots", "status": "published", "summary_en": "Twisted-based SSH, FTP and Telnet honeypot services that store credentials in a local MySQL database.", "summary_es": "Servicios honeypot SSH, FTP y Telnet basados en Twisted que almacenan credenciales en una base de datos MySQL local.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network", "IoT"], "limitations_en": "The described behavior is documented, not independently verified.", "limitations_es": "El comportamiento descrito procede de la documentación y no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/lcashdol/WAPot/blob/master/README.md", "source_packet_sha256": "9e21a315a71f6dbd4c8c829bfd64f12c8a07d816db10d493f42ec8aca334bc21", "source_sha": "f82f262e23547a86d721f87913e1c48d3c1ccf8c", "source_title": "lcashdol/WAPot repository", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "repository-documentation", "id": "gh3-lcashdol-wapot", "kind": "software", "name": "WAPot", "organization": "lcashdol", "reviewed_at": "2026-10-04", "slug": "gh3-lcashdol-wapot", "source_url": "https://github.com/lcashdol/WAPot", "status": "published", "summary_en": "Honeypot that emulates a default Belkin N300 wireless router administration interface to observe traffic directed at home routers.", "summary_es": "Honeypot que emula la interfaz administrativa predeterminada de un router inalámbrico Belkin N300 para observar el tráfico dirigido a routers domésticos.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network", "Application"], "limitations_en": "The described behavior comes solely from the repository documentation and has not been independently verified.", "limitations_es": "El comportamiento descrito proviene únicamente de la documentación del repositorio y no ha sido verificado de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/lcatro/etherum_rpc_steal/blob/a29868f0f1544c67d70cd3dcdc39485cb544cde5/readme.md", "source_packet_sha256": "57693d255cc6422d8d7fa6e2187d327571cfb1d25d60f1e6f84f1ecb302bc258", "source_sha": "fc9e6616ea40b18cadaedc5f619357ebe3b31e28", "source_title": "lcatro/etherum_rpc_steal repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-lcatro-etherum-rpc-steal", "kind": "software", "name": "Ethereum RPC Steal Toolset", "organization": "lcatro", "reviewed_at": "2026-10-04", "slug": "gh3-lcatro-etherum-rpc-steal", "source_url": "https://github.com/lcatro/etherum_rpc_steal", "status": "published", "summary_en": "A toolset including an Ethereum RPC node scanner and stealer, along with an RPC node honeypot described as intended to collect attacker information.", "summary_es": "Conjunto de herramientas que incluye un escáner y un recolector de nodos RPC de Ethereum, junto con un honeypot de nodo RPC descrito como destinado a recopilar información sobre atacantes.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": [], "limitations_en": "Publisher-documented behavior, not independently verified; the emulated services are unspecified.", "limitations_es": "Comportamiento documentado por el editor, no verificado independientemente; no se especifican los servicios emulados.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://sourceforge.net/projects/genaipot/", "source_packet_sha256": "632f8b4688fa3c43747e279121e71c3635ec86e68ad69efe55be532af775f44e", "source_sha": null, "source_title": "ls1911/GenAIPot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-ls1911-genaipot", "kind": "software", "name": "GenAIPot", "organization": "ls1911", "reviewed_at": "2026-10-04", "slug": "gh3-ls1911-genaipot", "source_url": "https://sourceforge.net/projects/genaipot/", "status": "published", "summary_en": "Honeypot described by its publisher as using generative AI to emulate services.", "summary_es": "Honeypot que, según la página del editor, emula servicios mediante IA generativa.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The described behavior is documented, not independently verified.", "limitations_es": "El comportamiento descrito procede de la documentación y no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_document_url": "https://github.com/madirish/kojoney2/blob/master/README", "source_packet_sha256": "121aecd2167581bb978624fff441909b38a2e74474d1a7c945bac6b2f2884f29", "source_sha": "baa8475a82387e16d5783fd99eb64d84466fe5af", "source_title": "madirish/kojoney2 repository", "tags": [], "techniques": ["Honeypot", "Decoy", "Adversary engagement"]}, "evidence": "repository-documentation", "id": "gh3-madirish-kojoney2", "kind": "software", "name": "Kojoney2", "organization": "madirish", "reviewed_at": "2026-10-04", "slug": "gh3-madirish-kojoney2", "source_url": "https://github.com/madirish/kojoney2", "status": "published", "summary_en": "Medium-interaction SSH honeypot that simulates users and a shell to observe attacker commands; it documents downloading requested files to a separate directory for analysis.", "summary_es": "Honeypot SSH de interacción media que simula usuarios y una shell para observar comandos de atacantes; documenta la descarga de archivos solicitados a un directorio separado para su análisis.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Behavior is documented, not independently verified; the README calls it a work in progress and says logging is rough.", "limitations_es": "El comportamiento solo está documentado, no verificado de forma independiente; el README lo considera en desarrollo y señala que el registro aún es rudimentario.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/magisterquis/sshhipot/blob/master/README.md", "source_packet_sha256": "2e69f93ce56c98a3e127ef496e673726196daa7a8d07931793fa72a70ef22d43", "source_sha": "54fc173aa1f71a4973aac3f89dd587dcab79b8e3", "source_title": "magisterquis/sshhipot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-magisterquis-sshhipot", "kind": "software", "name": "SSHHiPot", "organization": "magisterquis", "reviewed_at": "2026-10-04", "slug": "gh3-magisterquis-sshhipot", "source_url": "https://github.com/magisterquis/sshhipot", "status": "published", "summary_en": "High-interaction SSH proxy described as a honeypot: it sits between a connecting party and a real SSH server and logs connections.", "summary_es": "Proxy SSH de alta interacción descrito como honeypot: se sitúa entre quien se conecta y un servidor SSH real, y registra las conexiones.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Behavior is documented, not independently verified; the README warns that it is not yet production code.", "limitations_es": "El comportamiento solo está documentado, no verificado de forma independiente; el README advierte que aún no es código de producción.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/magisterquis/sshlowpot/blob/master/README.md", "source_packet_sha256": "38314abfe1ffe81aae0d93fcdc21f4b49f2d3b6fcb90b2666ceade59099ec88f", "source_sha": "8caf23ca7e4c4a40e2918fff6c90c5956da97e85", "source_title": "magisterquis/sshlowpot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-magisterquis-sshlowpot", "kind": "software", "name": "sshlowpot", "organization": "magisterquis", "reviewed_at": "2026-10-04", "slug": "gh3-magisterquis-sshlowpot", "source_url": "https://github.com/magisterquis/sshlowpot", "status": "published", "summary_en": "Low-interaction SSH honeypot that accepts connections, records authentication attempts, and reports authentication failure.", "summary_es": "Honeypot SSH de baja interacción que acepta conexiones, registra intentos de autenticación y responde que la autenticación falló.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Behavior is documented, not independently verified; the described authentication challenge is static.", "limitations_es": "El comportamiento solo está documentado, no verificado de forma independiente; el desafío de autenticación descrito es estático.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/magisterquis/vnclowpot/blob/master/README.md", "source_packet_sha256": "1aa3f96ecf74cb7b9d7e74a9e70ba376c6a6e8d9b15797fab5d9373e290cbcb9", "source_sha": "1b6b5edcd1600b80d135babb9e6fcd916df60414", "source_title": "magisterquis/vnclowpot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-magisterquis-vnclowpot", "kind": "software", "name": "vnclowpot", "organization": "magisterquis", "reviewed_at": "2026-10-04", "slug": "gh3-magisterquis-vnclowpot", "source_url": "https://github.com/magisterquis/vnclowpot", "status": "published", "summary_en": "Low-interaction VNC honeypot that listens on a port and logs responses to a static VNC authentication challenge.", "summary_es": "Honeypot VNC de baja interacción que escucha en un puerto y registra respuestas a un desafío de autenticación VNC estático.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network", "Application"], "limitations_en": "Behavior is documented, not independently verified.", "limitations_es": "Comportamiento descrito en la documentación; no verificado independientemente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/Marist-Innovation-Lab/DolosHoneypot/blob/master/README.md", "source_packet_sha256": "14439c9cc7133022413f4cc5ae289495b4848ccea289b84acc5519172d793d14", "source_sha": "f2863ef490c266ef8680920765d3d6006c0fbadb", "source_title": "Marist-Innovation-Lab/DolosHoneypot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-marist-innovation-lab-doloshoneypot", "kind": "software", "name": "DolosHoneypot", "organization": "Marist-Innovation-Lab", "reviewed_at": "2026-10-04", "slug": "gh3-marist-innovation-lab-doloshoneypot", "source_url": "https://github.com/Marist-Innovation-Lab/DolosHoneypot", "status": "published", "summary_en": "SDN honeypot with an HTTP interface that simulates a failed login without connecting to a real service; the documentation suggests checking PostgreSQL records.", "summary_es": "Honeypot SDN con interfaz HTTP que simula un inicio de sesión fallido sin conectarse a un servicio real; la documentación propone comprobar los registros en PostgreSQL.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Application"], "limitations_en": "Behavior is documented, not independently verified.", "limitations_es": "Comportamiento descrito en la documentación; no verificado independientemente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/Marist-Innovation-Lab/PasitheaHoneypot/blob/master/README.md", "source_packet_sha256": "03877036cca3c3951295c68723eb8f5fce484ad6ef7bcef1d1abaa9e887ef289", "source_sha": "22d09f3cdac18b4faa2dd6ddd25f1ed0571a68ca", "source_title": "Marist-Innovation-Lab/PasitheaHoneypot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-marist-innovation-lab-pasitheahoneypot", "kind": "software", "name": "PasitheaHoneypot", "organization": "Marist-Innovation-Lab", "reviewed_at": "2026-10-04", "slug": "gh3-marist-innovation-lab-pasitheahoneypot", "source_url": "https://github.com/Marist-Innovation-Lab/PasitheaHoneypot", "status": "published", "summary_en": "API honeypot whose server, according to the documentation, logs attempts to the API.log file.", "summary_es": "Honeypot de API cuyo servidor, según la documentación, registra los intentos en el archivo API.log.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Application"], "limitations_en": "Capabilities are documented, not independently verified.", "limitations_es": "Capacidades descritas en la documentación; no verificadas independientemente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/Masood-M/yalih/blob/master/README.md", "source_packet_sha256": "e0eca5511793f555b659c5ed10cef0709b4e5aeb5c904e60b9a3162c43aa829f", "source_sha": "69ad7cb9b2c9d4d6b5799948dc67e9c2cbf1affb", "source_title": "Masood-M/yalih repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-masood-m-yalih", "kind": "software", "name": "YALIH", "organization": "Masood-M", "reviewed_at": "2026-10-04", "slug": "gh3-masood-m-yalih", "source_url": "https://github.com/Masood-M/yalih", "status": "published", "summary_en": "Low-interaction honeyclient for detecting malicious websites through signatures, anomalies, and pattern matching; it documents browser emulation and script analysis.", "summary_es": "Honeyclient de baja interacción para detectar sitios web maliciosos mediante firmas, anomalías y patrones; documenta emulación de navegador y análisis de scripts.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Behavior is documented but has not been independently verified.", "limitations_es": "El comportamiento está documentado, pero no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_document_url": "https://github.com/MattCarothers/mhn-core-docker/blob/master/README.md", "source_packet_sha256": "7e95f53d25589e789d4d29f0261220f34ca1dfc7459849bb464efaa4165fd863", "source_sha": "ea3c3b9cfcb962e00e5b65b4da9027bcf67c4702", "source_title": "MattCarothers/mhn-core-docker repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-mattcarothers-mhn-core-docker", "kind": "software", "name": "mhn-core-docker", "organization": "MattCarothers", "reviewed_at": "2026-10-04", "slug": "gh3-mattcarothers-mhn-core-docker", "source_url": "https://github.com/MattCarothers/mhn-core-docker", "status": "published", "summary_en": "Docker-based MHN subset that includes Cowrie and Dionaea honeypots connected to an hpfeeds broker to publish events.", "summary_es": "Subconjunto de MHN para Docker que incluye los honeypots Cowrie y Dionaea, conectados a un broker hpfeeds para publicar eventos.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": "support-only-not-honeypot", "draft_review_basis": "third-provider-adjudication", "environments": ["Network"], "limitations_en": "Behavior is documented in the README but has not been independently verified; no software was executed.", "limitations_es": "El comportamiento está documentado en el README, pero no se ha verificado de forma independiente; no se ejecutó ningún software.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": ["Honeypot"], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/mfontani/kippo-stats/blob/master/README.mkd", "source_packet_sha256": "a59b360eaa81959f319dd944475c6bc57d08acfbe8d5889c06b975e8ddaba622", "source_sha": "a9cd2ee97ecd3a8d6f5bed0f1d4725e29942eeb9", "source_title": "mfontani/kippo-stats repository", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-mfontani-kippo-stats", "kind": "software", "name": "kippo-stats", "organization": "mfontani", "reviewed_at": "2026-10-04", "slug": "gh3-mfontani-kippo-stats", "source_url": "https://github.com/mfontani/kippo-stats", "status": "published", "summary_en": "A Mojolicious and DBIx::Class web application that displays statistics about the Kippo (kippo) SSH honeypot. It is not itself a honeypot.", "summary_es": "Aplicación web Mojolicious y DBIx::Class que muestra estadísticas sobre el honeypot SSH Kippo (kippo). No es en sí misma un honeypot.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Behavior is documented but has not been independently verified.", "limitations_es": "El comportamiento está documentado, pero no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/miguelraulb/spamhat/blob/master/README.md", "source_packet_sha256": "304743841489595dcac918eb490798b610fb63be64c3930e74c718bcab342407", "source_sha": "7a8b21c235d60c95edafa6e0df08abfff5012e03", "source_title": "miguelraulb/spamhat repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-miguelraulb-spamhat", "kind": "software", "name": "spamhat", "organization": "miguelraulb", "reviewed_at": "2026-10-04", "slug": "gh3-miguelraulb-spamhat", "source_url": "https://github.com/miguelraulb/spamhat", "status": "published", "summary_en": "Tool described as an open-relay simulator for spam capture and analysis.", "summary_es": "Herramienta descrita como un simulador de relay abierto para capturar y analizar spam.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Listening and logging are described in the documentation; their behavior has not been independently verified.", "limitations_es": "El registro y la escucha se describen en la documentación; su comportamiento no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/Mojachieee/go-HoneyPot/blob/master/README.md", "source_packet_sha256": "c1acaac7e8add60befa3815467a68fc84bcae8984c006dd31c225efde2f56aa9", "source_sha": "d5e55c0008716640ee60c59bbefacb772cc39e9e", "source_title": "Mojachieee/go-HoneyPot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-mojachieee-go-honeypot", "kind": "software", "name": "go-HoneyPot", "organization": "Mojachieee", "reviewed_at": "2026-10-04", "slug": "gh3-mojachieee-go-honeypot", "source_url": "https://github.com/Mojachieee/go-HoneyPot", "status": "published", "summary_en": "Go honeypot server documented to listen on configured ports and log details of received data to a database.", "summary_es": "Servidor honeypot en Go que, según su documentación, escucha en puertos configurados y registra en una base de datos los detalles de los datos recibidos.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Application"], "limitations_en": "The capabilities are described in the documentation, but their behavior has not been independently verified.", "limitations_es": "Las capacidades se describen en la documentación, pero su comportamiento no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/mrheinen/lophiid/blob/main/README.md", "source_packet_sha256": "2330ac3e1ddbc012ed1972d39f13a943f0b5e2e25cf7538ae899256db64136f5", "source_sha": "09695636f83890eef4f34aa4f986aeea20291459", "source_title": "mrheinen/lophiid repository", "tags": [], "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "repository-documentation", "id": "gh3-mrheinen-lophiid", "kind": "software", "name": "lophiid", "organization": "mrheinen", "reviewed_at": "2026-10-04", "slug": "gh3-mrheinen-lophiid", "source_url": "https://github.com/mrheinen/lophiid", "status": "published", "summary_en": "Honeypot for detecting and interacting with web application exploitation attempts. Its documentation describes backend-managed sensors and static, scripted, or AI-assisted responses.", "summary_es": "Honeypot para detectar e interactuar con intentos de explotación de aplicaciones web. Documenta sensores gestionados por un backend y respuestas estáticas, programadas o asistidas por IA.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Behavior is documented, not independently verified.", "limitations_es": "El comportamiento se describe en la documentación; no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/mrschyte/dockerpot/blob/master/README.md", "source_packet_sha256": "84a684c3bb372c346395e94c132123d3c712cb97356a0742ffa22a06f9a82386", "source_sha": "f91709d1489c56ab0d1d2af606a7c4258da038bb", "source_title": "mrschyte/dockerpot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-mrschyte-dockerpot", "kind": "software", "name": "Dockerpot", "organization": "mrschyte", "reviewed_at": "2026-10-04", "slug": "gh3-mrschyte-dockerpot", "source_url": "https://github.com/mrschyte/dockerpot", "status": "published", "summary_en": "Docker-based honeypot documented as an SSH decoy on port 22, using containers and auditd logging.", "summary_es": "Honeypot basado en Docker; la documentación describe su configuración como señuelo SSH en el puerto 22, con contenedores y registro mediante auditd.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The description is based solely on the provided documentation and has not been independently verified.'", "limitations_es": "La descripción se basa únicamente en la documentación proporcionada y no ha sido verificada de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/mrtc0/honeylog2016/blob/58554d2008cc1cc2b9a4e417e5c66a0256882708/README.md", "source_packet_sha256": "9594e6d1521ce5adb73720e4fec58db359994c0af85340efb434ce05c29a9250", "source_sha": "3be1009dc8ef7f5b5dae34da99c8c73b2313f4e1", "source_title": "mrtc0/honeylog2016 repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-mrtc0-honeylog2016", "kind": "dataset", "name": "honeylog2016", "organization": "mrtc0", "reviewed_at": "2026-10-04", "slug": "gh3-mrtc0-honeylog2016", "source_url": "https://github.com/mrtc0/honeylog2016", "status": "published", "summary_en": "A dataset and analysis of 2016 logs generated by the Cowrie, Dionaea, and Glastopf honeypots, with statistics on captured passwords and access attempts.", "summary_es": "Conjunto de datos y análisis de registros de 2016 generados por los honeypots Cowrie, Dionaea y Glastopf, con estadísticas sobre contraseñas e intentos de acceso capturados.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Application"], "limitations_en": "Behavior is documented, not independently verified.", "limitations_es": "El comportamiento se describe en la documentación; no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/msurguy/Honeypot/blob/master/README.md", "source_packet_sha256": "ff70c06919e620417385c3ce483d06f9581c8128d85c3c0c240bcfbe4c2d27f5", "source_sha": "040e2a31224acb94343a6cb7b5d01b8157173504", "source_title": "msurguy/Honeypot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-msurguy-honeypot", "kind": "software", "name": "Honeypot", "organization": "msurguy", "reviewed_at": "2026-10-04", "slug": "gh3-msurguy-honeypot", "source_url": "https://github.com/msurguy/Honeypot", "status": "published", "summary_en": "Laravel package that adds a hidden field and encrypted timestamp to forms to identify likely bot submissions.", "summary_es": "Paquete para Laravel que añade a los formularios un campo oculto y una marca de tiempo cifrada para detectar posibles envíos de bots.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "third-provider-adjudication", "environments": ["Application", "Network"], "limitations_en": "The documentation is minimal; the described behavior and supported protocols have not been executed or independently verified.", "limitations_es": "La documentación es mínima; no se han ejecutado ni verificado de forma independiente el comportamiento ni los protocolos soportados.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/mushorg/imhoneypot/blob/8450287184af3a62690cb2a54b24315ca2ce870e/README.md", "source_packet_sha256": "65b156f7d1be739c7f13df99358a733805106b1c94f8c22b1826ebc2c0db908b", "source_sha": "4e610f5344408bf83f1b361712f26c5c2b6be517", "source_title": "mushorg/imhoneypot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-mushorg-imhoneypot", "kind": "software", "name": "imhoneypot", "organization": "mushorg", "reviewed_at": "2026-10-04", "slug": "gh3-mushorg-imhoneypot", "source_url": "https://github.com/mushorg/imhoneypot", "status": "published", "summary_en": "An instant messenger honeypot; the documentation only describes it as 'Instant messenger honeypot', without detailing protocols or detection mechanisms.", "summary_es": "Honeypot de mensajería instantánea; la documentación solo lo describe como 'Instant messenger honeypot', sin detallar protocolos ni mecanismos de detección.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Endpoint", "Network"], "limitations_en": "This description is based solely on repository documentation; its behavior and effectiveness in real deployments have not been independently verified.", "limitations_es": "La descripción proviene únicamente de la documentación del repositorio; no se ha verificado de forma independiente su comportamiento ni su eficacia en despliegues reales.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/nao-sec/starc/blob/c5a7bd0bf8986302733b63a6e9bb971995923a82/README.md", "source_packet_sha256": "e8c825d224896404d0287a921ae21bd42e2cae868d88650c422f65ce55ec2bc0", "source_sha": "ad915542a41f935a19e6f6a479f6b4efc7acfe32", "source_title": "nao-sec/starc repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-nao-sec-starc", "kind": "software", "name": "StarC", "organization": "nao-sec", "reviewed_at": "2026-10-04", "slug": "gh3-nao-sec-starc", "source_url": "https://github.com/nao-sec/starc", "status": "published", "summary_en": "StarC is a documented high-interaction client honeypot for traffic analysis of Drive-by Download attacks, orchestrating a vulnerable Windows VM alongside traffic capture tools such as Wireshark and Fiddler.", "summary_es": "StarC es un honeypot cliente de alta interacción documentado para el análisis de tráfico en ataques de Drive-by Download, orquestando una VM vulnerable con Windows junto a herramientas de captura de tráfico como Wireshark y Fiddler.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Behavior is documented, not independently verified.", "limitations_es": "El comportamiento se describe en la documentación; no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/naorlivne/dshp/blob/master/README.md", "source_packet_sha256": "e820ddab9876984ed9d24aeb519e6edede91b7b41c5b52b15718a7138a388f88", "source_sha": "f8e82b9f6c484f3d0b47adf71c95f3f74409f36b", "source_title": "naorlivne/dshp repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-naorlivne-dshp", "kind": "software", "name": "DSHP", "organization": "naorlivne", "reviewed_at": "2026-10-04", "slug": "gh3-naorlivne-dshp", "source_url": "https://github.com/naorlivne/dshp", "status": "published", "summary_en": "Low-interaction honeypot that listens for connections on a configurable port, can send a reply, and triggers event handlers, including an email handler.", "summary_es": "Honeypot de baja interacción que escucha conexiones en un puerto configurable, puede responder y activa manejadores de eventos, incluido uno de correo.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Application"], "limitations_en": "The information comes solely from the project's README; its effectiveness against spam and integration with the mentioned add-ons have not been independently verified.", "limitations_es": "La información proviene exclusivamente del README del proyecto; su eficacia contra spam y su integración con los complementos mencionados no han sido verificadas de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_commit": null, "source_document_url": "https://github.com/nathanpitman/honeypot.ext.ee_addon/blob/12baac827c5e4193974c3b5d52eb455f7f97374f/README.md", "source_packet_sha256": "dececa264bb5aa89a9c4c5a75296d12691ac3834fbb2fbf9bf050b08b7c66588", "source_sha": "e6c682837e337b2f91d9f4f7288eb870549e4555", "source_title": "nathanpitman/honeypot.ext.ee_addon repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-nathanpitman-honeypot-ext-ee-addon", "kind": "software", "name": "Honeypot for ExpressionEngine", "organization": "nathanpitman", "reviewed_at": "2026-10-04", "slug": "gh3-nathanpitman-honeypot-ext-ee-addon", "source_url": "https://github.com/nathanpitman/honeypot.ext.ee_addon", "status": "published", "summary_en": "Documented ExpressionEngine extension that adds a hidden honeypot field to comment and user forms to block automated spam submissions without using a CAPTCHA.", "summary_es": "Extensión para ExpressionEngine documentada que añade un campo honeypot oculto a formularios de comentarios y usuarios con el fin de bloquear envíos automatizados de spam sin usar CAPTCHA.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network", "Cloud"], "limitations_en": "This description relies solely on the repository's documentation and screenshots; its operation and resilience against real attackers have not been independently verified.", "limitations_es": "La descripción se basa únicamente en la documentación y capturas de pantalla del repositorio; no se ha verificado de forma independiente su funcionamiento ni su resistencia frente a atacantes reales.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/netxfly/docker_ssh_honeypot/blob/c784e1453ebb5faeb4a682a76d8db9ec0f0c6d80/README.md", "source_packet_sha256": "ab2ff123688d7a10bf2eec3c57384bdde9ccd5622c7fcea728f322b795efa9bd", "source_sha": "7bc496a0ea0c60c0d4f680be68527e566b561637", "source_title": "netxfly/docker_ssh_honeypot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-netxfly-docker-ssh-honeypot", "kind": "software", "name": "docker_ssh_honeypot", "organization": "netxfly", "reviewed_at": "2026-10-04", "slug": "gh3-netxfly-docker-ssh-honeypot", "source_url": "https://github.com/netxfly/docker_ssh_honeypot", "status": "published", "summary_en": "Documented project implementing a Docker-based high-interaction SSH honeypot, using patched bash and OpenSSH to log commands and credentials, integrated into a larger architecture of agents and attack-detection servers.", "summary_es": "Proyecto documentado que implementa un honeypot SSH de alta interacción basado en Docker, con bash y OpenSSH modificados para registrar comandos y credenciales, integrado en una arquitectura mayor de agentes y servidores de detección de ataques.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The description reflects what is documented in the project's README; the software's behavior has not been independently verified.", "limitations_es": "La descripción corresponde a lo documentado en el README del proyecto; no se ha verificado de forma independiente el comportamiento del software.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/netxfly/x-proxy/blob/e3c58c6938cb9b9b97b882827ed015b81d9dc26e/README.md", "source_packet_sha256": "e4a1a595529902cb11b333c031d750eb425c32bb24212a046c48d409e82f0640", "source_sha": "834a40dfdd83e7219c44798b1aa7579b49bec357", "source_title": "netxfly/x-proxy repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-netxfly-x-proxy", "kind": "software", "name": "x-proxy", "organization": "netxfly", "reviewed_at": "2026-10-04", "slug": "gh3-netxfly-x-proxy", "source_url": "https://github.com/netxfly/x-proxy", "status": "published", "summary_en": "x-proxy is sample code accompanying an article on developing a proxy honeypot, consisting of an agent that serves as a proxy, a server that receives and stores collected data in MongoDB, and a management console to view the gathered data.", "summary_es": "x-proxy es el código de ejemplo para un artículo sobre el desarrollo de un honeypot de proxy, compuesto por un agente que actúa como servidor proxy, un servidor que recibe los datos recopilados y los almacena en MongoDB, y un panel de administración para visualizar la información recolectada.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "third-provider-adjudication", "environments": ["Application"], "limitations_en": "The description is based solely on what is stated in the repository's README and has not been independently verified.", "limitations_es": "La descripción se basa únicamente en lo indicado en el README del repositorio y no ha sido verificada de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/no3x/wp-login-honeypot/blob/0fdf7c7c33d27894ee1820adbabbaf689e74c339/README.md", "source_packet_sha256": "44a79ca1b8f729cf8f8a2ab19de554dec7363d452e117234f72dfbe28e3f4166", "source_sha": "ce9cc5e6d5d8be94fe9352bc88b43dcbcaaaaccf", "source_title": "no3x/wp-login-honeypot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-no3x-wp-login-honeypot", "kind": "software", "name": "wp-login-honeypot", "organization": "no3x", "reviewed_at": "2026-10-04", "slug": "gh3-no3x-wp-login-honeypot", "source_url": "https://github.com/no3x/wp-login-honeypot", "status": "published", "summary_en": "wp-login-honeypot is a honeypot for wordpress login.php that blacklists all clients accessing it.", "summary_es": "wp-login-honeypot es un honeypot para login.php de WordPress que pone en lista negra a todos los clientes que acceden a él.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Endpoint"], "limitations_en": "Behavior is documented, not independently verified; no honeypot function is documented.", "limitations_es": "El comportamiento está documentado, no verificado de forma independiente; no se documenta una función de honeypot.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/nsmfoo/antivmdetection/blob/master/README.md", "source_packet_sha256": "45eeebf4c06d011a6d73becec1ebeeb7c2bb5c7a2f6da70f2e8803b53a4d68c8", "source_sha": "feceebbe75c3ee2c934cb4f39dbabe5f20749d1f", "source_title": "nsmfoo/antivmdetection repository", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-nsmfoo-antivmdetection", "kind": "software", "name": "Antivmdetection", "organization": "nsmfoo", "reviewed_at": "2026-10-04", "slug": "gh3-nsmfoo-antivmdetection", "source_url": "https://github.com/nsmfoo/antivmdetection", "status": "published", "summary_en": "Script for generating VirtualBox templates that make virtual machines harder to detect. It can support a less recognizable decoy VM, but the documentation does not present it as a honeypot.", "summary_es": "Script para generar plantillas de VirtualBox que dificultan la detección de máquinas virtuales. Puede ayudar a que una VM usada como señuelo resulte menos reconocible, pero la documentación no lo presenta como honeypot.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network", "Endpoint"], "limitations_en": "The described capabilities come from the project's README and have not been confirmed through independent testing.", "limitations_es": "Las capacidades descritas provienen del README del proyecto y no han sido confirmadas mediante pruebas independientes.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/ohmyadd/wetland/blob/0e7b1d109eb8bfe6da8753dcfcb3c4e1f5e125a9/README.md", "source_packet_sha256": "db33c8757e6b6d1343b1b47f2770cb5a01a817a16d49725f47ce8bec13a34501", "source_sha": "fd4046d2a088119fce59176ccc450bb9c709b77a", "source_title": "ohmyadd/wetland repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-ohmyadd-wetland", "kind": "software", "name": "Wetland", "organization": "ohmyadd", "reviewed_at": "2026-10-04", "slug": "gh3-ohmyadd-wetland", "source_url": "https://github.com/ohmyadd/wetland", "status": "published", "summary_en": "Wetland is a high-interaction SSH honeypot written in Python that uses Docker containers to provide a real Linux environment, logging brute force attempts as well as attacker shell, SCP, SFTP, exec-command, and port-forwarding sessions.", "summary_es": "Wetland es un honeypot SSH de alta interacción escrito en Python que utiliza contenedores Docker para proporcionar un entorno Linux real, registrando intentos de fuerza bruta y las sesiones de shell, SCP, SFTP, ejecución de comandos y reenvío de puertos realizadas por el atacante.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["IoT", "Network"], "limitations_en": "The described features are documented, not independently verified.", "limitations_es": "Las funciones descritas están documentadas, no verificadas de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/omererdem/honeything/blob/master/README.md", "source_packet_sha256": "f891c7b6c7886b139e9eaad99cfe27bf83831f86a261060d8173e9b7e0dee3c3", "source_sha": "5b508fef739b62c20a90efd350f396c50d5e66ca", "source_title": "omererdem/honeything repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-omererdem-honeything", "kind": "software", "name": "HoneyThing", "organization": "omererdem", "reviewed_at": "2026-10-04", "slug": "gh3-omererdem-honeything", "source_url": "https://github.com/omererdem/honeything", "status": "published", "summary_en": "Honeypot that simulates a modem or router with a RomPager web server and TR-069 support; it documents vulnerability emulation and communication logging.", "summary_es": "Honeypot que simula un módem o router con servidor web RomPager y soporte TR-069; documenta emulación de vulnerabilidades y registro de comunicaciones.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "This description reflects only what is documented in the project's README; actual behavior has not been independently verified.", "limitations_es": "Esta descripción refleja únicamente lo documentado en el README del proyecto; no se ha verificado de forma independiente su funcionamiento real.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/oniondecoy/installer/blob/b4f566c19d1613b1a32128eeb41777ae56753360/README.md", "source_packet_sha256": "27e9f81b8389ce42908ed44cf525b51a11a36f505fc25d5a3c6155a76f472f6f", "source_sha": "519d7b1ed4e7aa06aeb13eaee16eac38a1b48be0", "source_title": "oniondecoy/installer repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-oniondecoy-installer", "kind": "software", "name": "Onion Decoy Server", "organization": "oniondecoy", "reviewed_at": "2026-10-04", "slug": "gh3-oniondecoy-installer", "source_url": "https://github.com/oniondecoy/installer", "status": "published", "summary_en": "A platform to run private unannounced honeypots as Tor hidden services (Onion Decoys), using Docker containers combining Glastopf (HTTP) and Cowrie (SSH and Telnet), with randomly generated, unpublished onion addresses.", "summary_es": "Plataforma que ejecuta honeypots privados no anunciados como servicios ocultos de Tor (Onion Decoys), usando contenedores Docker que combinan Glastopf (HTTP) y Cowrie (SSH y Telnet), con direcciones onion generadas aleatoriamente y no publicadas.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network", "Application"], "limitations_en": "This description reflects only what is documented in the project's README; this tool is management/visualization infrastructure for the OpenCanary honeypot rather than a honeypot itself, and has not been independently verified.", "limitations_es": "Esta descripción refleja únicamente lo documentado en el README del proyecto; esta herramienta es infraestructura de gestión y visualización asociada al honeypot OpenCanary, no un honeypot en sí misma, y no ha sido verificada de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/p1r06u3/opencanary_web/blob/71156ef8d7f86e2bb380a69f584de9603bfba93a/README.md", "source_packet_sha256": "96df675bd05d897a7fdc304781a1a6e0c81091d7bc55959cf9fb9526d8b0fae7", "source_sha": "e95e793feb977a6cf869097f535a07ea3e9e4030", "source_title": "p1r06u3/opencanary_web repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-p1r06u3-opencanary-web", "kind": "software", "name": "opencanary_web", "organization": "p1r06u3", "reviewed_at": "2026-10-04", "slug": "gh3-p1r06u3-opencanary-web", "source_url": "https://github.com/p1r06u3/opencanary_web", "status": "published", "summary_en": "A web backend (Tornado+Vue+Mysql+APScheduler+Nginx+Supervisor) providing a dashboard, host status, attack list, filter lists, and mail configuration to visualize and manage events detected by the OpenCanary honeypot.", "summary_es": "Panel web (Tornado+Vue+Mysql+APScheduler+Nginx+Supervisor) que ofrece dashboard, estado de hosts, lista de ataques, listas de filtro y configuración de correo para visualizar y gestionar los eventos detectados por el honeypot OpenCanary.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": "033ae3488faf462f6430bcb290543838ead556bb83cdf5b4574fb3d6a6c05811", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Behavior is based on an archived README and has not been independently verified; current repository availability is unknown.", "limitations_es": "El comportamiento se basa en un README archivado y no se ha verificado de forma independiente; la disponibilidad actual del repositorio es desconocida.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "three-ai-source-page-agreement", "source_document_url": "https://web.archive.org/web/20180627093751id_/https://github.com/packetflare/amthoneypot", "source_packet_sha256": "01ed40b931c8edc810bb1c735688dbe38f4382427db2799c6b5ba0258c3e4aaa", "source_sha": null, "source_title": "AMTHoneypot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "archived-repository-documentation", "id": "gh3-packetflare-amthoneypot", "kind": "software", "name": "AMTHoneypot", "organization": "packetflare", "reviewed_at": "2026-10-04", "slug": "gh3-packetflare-amthoneypot", "source_url": "https://web.archive.org/web/20180627093751id_/https://github.com/packetflare/amthoneypot", "status": "published", "summary_en": "Documented honeypot for CVE-2017-5689: a web server listens on TCP port 16922 and imitates the Intel AMT management service. If exploited, it serves the attacker content obtained from an HP machine.", "summary_es": "Honeypot documentado para CVE-2017-5689: un servidor web escucha en el puerto TCP 16922 e imita el servicio de gestión Intel AMT. Si se explota, sirve al atacante contenido obtenido de una máquina HP.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["IoT", "Network"], "limitations_en": "The author explicitly warns the code is 'dirty' and unmaintained; this description is based solely on the README and has not been independently verified.", "limitations_es": "El propio autor advierte que el código es 'dirty' y que no planea mantenerlo; esta descripción se basa solo en el README y no ha sido verificada de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_commit": null, "source_document_url": "https://github.com/pandipanda69/my-little-honeypot/blob/5fe3ec2f6bb0d3e6775a1854f77dbd5618ee0726/README.md", "source_packet_sha256": "7d26b37477751f6c7b6b0277ad1b404bc198917f77978f228111731fa01dc95e", "source_sha": "9c493aec2f7ff53ee6991a0eebd23250c204866b", "source_title": "pandipanda69/my-little-honeypot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-pandipanda69-my-little-honeypot", "kind": "software", "name": "my-little-honeypot", "organization": "pandipanda69", "reviewed_at": "2026-10-04", "slug": "gh3-pandipanda69-my-little-honeypot", "source_url": "https://github.com/pandipanda69/my-little-honeypot", "status": "published", "summary_en": "A simple telnet honeypot created to show, in a security talk, how easy it is to code a telnet honeypot in order to recover IoT malware and observe active command and control.", "summary_es": "Honeypot telnet simple creado para mostrar, en una charla de seguridad, lo fácil que es programar un honeypot telnet con el fin de recuperar malware de IoT y observar su comando y control activo.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network", "Application"], "limitations_en": "The described functionality is based solely on the repository's documentation and has not been independently verified.", "limitations_es": "La funcionalidad descrita se basa únicamente en la documentación del repositorio y no ha sido verificada de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/paralax/burningdogs/blob/9b65d320df8069e11fdc36b3cbc5e42128838bb8/README.md", "source_packet_sha256": "3707237fb3896a66bfd225ab7bd64471d38a3586afd6a6acbb6c7eaed4667f87", "source_sha": "0411cc8af075d4fe065cf6b49eefc3b3d64d5127", "source_title": "paralax/burningdogs repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-paralax-burningdogs", "kind": "software", "name": "BurningDogs", "organization": "paralax", "reviewed_at": "2026-10-04", "slug": "gh3-paralax-burningdogs", "source_url": "https://github.com/paralax/burningdogs", "status": "published", "summary_en": "A tool that parses logs from multiple honeypots (Kippo/Cowrie SSH, phpMyAdmin, Wordpot, Redispot, VncLowPot, Pghoney) to extract malicious IPs, URLs, and file hashes and publish them as pulses in AlienVault OTX.", "summary_es": "Herramienta que analiza registros de múltiples honeypots (Kippo/Cowrie SSH, phpMyAdmin, Wordpot, Redispot, VncLowPot, Pghoney) para extraer IPs, URLs y hashes maliciosos y publicarlos como pulsos en AlienVault OTX.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Behavior is documented, not independently verified.", "limitations_es": "El comportamiento está documentado, no verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_document_url": "https://github.com/PaulMaddox/gohoney/blob/master/README.md", "source_packet_sha256": "4a07b86aab30e86753ce21a8a00d3c548a45a3149cdd24223271b2154bea10dc", "source_sha": "20a2eb3ad1d0f583b501a6661a488ca69a22c911", "source_title": "PaulMaddox/gohoney repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-paulmaddox-gohoney", "kind": "software", "name": "gohoney", "organization": "PaulMaddox", "reviewed_at": "2026-10-04", "slug": "gh3-paulmaddox-gohoney", "source_url": "https://github.com/PaulMaddox/gohoney", "status": "published", "summary_en": "Go-based SSH honeypot that, according to its documentation, accepts credentials, presents a fake shell, and records attempted commands.", "summary_es": "Honeypot SSH en Go que, según la documentación, acepta credenciales, presenta una consola falsa y registra los comandos intentados.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The documentation is extremely brief and does not detail specific behavior, nor has it been independently verified.", "limitations_es": "La documentación es extremadamente breve y no detalla el comportamiento específico ni ha sido verificada de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/pentestpartners/honeypot-scripts/blob/6bcd063a225c306fb94c572f21bfec9c02311372/README.md", "source_packet_sha256": "38c83134d9327f2c3df12f3c375a6b5cd5d42d0254afcb0cd35297bc79a82495", "source_sha": "a3d5e1923b08391585125f371d540c64577721b3", "source_title": "pentestpartners/honeypot-scripts repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-pentestpartners-honeypot-scripts", "kind": "software", "name": "honeypot-scripts", "organization": "pentestpartners", "reviewed_at": "2026-10-04", "slug": "gh3-pentestpartners-honeypot-scripts", "source_url": "https://github.com/pentestpartners/honeypot-scripts", "status": "published", "summary_en": "A collection of support scripts for honeypots, minimally described in its documentation.", "summary_es": "Conjunto de scripts de soporte para honeypots, descrito de forma mínima en su documentación.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Application"], "limitations_en": "The description comes solely from the project's documentation and has not been independently verified.", "limitations_es": "La descripción proviene únicamente de la documentación del proyecto y no ha sido verificada de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/ph-7/fake-admin-honeypot-v1.1/blob/e5ea0c2f86b93db618472ee3fa929b220a380da0/README.md", "source_packet_sha256": "bfb8e4c2a16b0ab776a7ff8a9397e8dad5fa2ad5eb90a31c798b191e68e79a43", "source_sha": "f7834613822d41188ce89c00651d2473de760708", "source_title": "ph-7/fake-admin-honeypot-v1.1 repository", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "repository-documentation", "id": "gh3-ph-7-fake-admin-honeypot-v1-1", "kind": "software", "name": "Honeypot Fake Admin Panel (pH7CMS module)", "organization": "ph-7", "reviewed_at": "2026-10-04", "slug": "gh3-ph-7-fake-admin-honeypot-v1-1", "source_url": "https://github.com/ph-7/fake-admin-honeypot-v1.1", "status": "published", "summary_en": "A module for pH7CMS that presents a fake admin panel to lure and log attackers, leveraging the CMS's built-in analytics tracking.", "summary_es": "Módulo para pH7CMS que presenta un panel de administración falso para atraer y registrar a atacantes, aprovechando el seguimiento analítico ya incluido en el CMS.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "third-provider-adjudication", "environments": ["Application"], "limitations_en": "The described behavior comes solely from the repository's documentation and has not been independently verified.", "limitations_es": "El comportamiento descrito proviene únicamente de la documentación del repositorio y no ha sido verificado de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/ph-7/honeypots/blob/847127ba2dcdbb4800b3eee132d589f0180e87b3/README.md", "source_packet_sha256": "a9a604ed2636436f94bc7eb0595bf302fe59aafd951dc91729ecb33b5c1a3a7c", "source_sha": "140a580b25ab7565b7c761323ad5f3e8b3c35cb5", "source_title": "ph-7/honeypots repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-ph-7-honeypots", "kind": "software", "name": "honeypots (pH-7)", "organization": "ph-7", "reviewed_at": "2026-10-04", "slug": "gh3-ph-7-honeypots", "source_url": "https://github.com/ph-7/honeypots", "status": "published", "summary_en": "Example of using honeypots with a Standalone model and a model with the Joomla CMS for PHP applications.", "summary_es": "Ejemplo de uso de honeypots con un modelo independiente y un modelo con el CMS Joomla para aplicaciones PHP.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network", "OT/ICS"], "limitations_en": "The described behavior comes solely from the project's documentation and has not been independently verified; the README itself warns against production use without a complete security audit.", "limitations_es": "El comportamiento descrito proviene únicamente de la documentación del proyecto y no ha sido verificado de forma independiente; el propio README advierte contra su uso en producción sin una auditoría de seguridad completa.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_commit": null, "source_document_url": "https://github.com/philcryer/prickly-pete/blob/99b65cf2fb6994f43ffa19e12a739c98a33e2a92/README.md", "source_packet_sha256": "2364bd25f85df3ad4d35dea71ce8e6b244e3dd2a72346578492032efee10c862", "source_sha": "0149fcfee8c1fe685bd626236c89d59713879d19", "source_title": "philcryer/prickly-pete repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-philcryer-prickly-pete", "kind": "software", "name": "prickly-pete", "organization": "philcryer", "reviewed_at": "2026-10-04", "slug": "gh3-philcryer-prickly-pete", "source_url": "https://github.com/philcryer/prickly-pete", "status": "published", "summary_en": "A script that uses Docker to quickly deploy several honeypots (Conpot, Cowrie, Heralding, Honeyaml, among others) exposing multiple services for research and reconnaissance.", "summary_es": "Script que usa Docker para desplegar rápidamente varios honeypots (Conpot, Cowrie, Heralding, Honeyaml, entre otros) que exponen múltiples servicios para investigación y reconocimiento.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The described behavior comes solely from the repository's documentation and has not been independently verified.", "limitations_es": "El comportamiento descrito proviene únicamente de la documentación del repositorio y no ha sido verificado de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/plazmaz/liquidhoney/blob/eb983a3223b01e19a360132f9661d4c68cd3ae8c/README.md", "source_packet_sha256": "b4a2802384804ae1d8aa0ce0f4176e36459aa0d0f5d0276bd1ddd1f4b895a24d", "source_sha": "082aff8212e2600c95b34dc7120d043c29b05473", "source_title": "plazmaz/liquidhoney repository", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "repository-documentation", "id": "gh3-plazmaz-liquidhoney", "kind": "software", "name": "LiquidHoney", "organization": "plazmaz", "reviewed_at": "2026-10-04", "slug": "gh3-plazmaz-liquidhoney", "source_url": "https://github.com/plazmaz/liquidhoney", "status": "published", "summary_en": "A low-interaction honeypot that spoofs service banners across thousands of ports using the nmap-service-probes file format, with support for TCP and UDP protocols, including SSL-wrapped ones.", "summary_es": "Honeypot de baja interacción que falsifica banners de servicio en miles de puertos usando el formato de archivo nmap-service-probes, con soporte para protocolos TCP y UDP, incluidos los envueltos en SSL.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "third-provider-adjudication", "environments": ["Network"], "limitations_en": "Behavior is documented in the README, not independently verified by running the software.", "limitations_es": "El comportamiento está documentado en el README, no verificado de forma independiente mediante ejecución del software.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/ppacher/honeyssh/blob/master/README.md", "source_packet_sha256": "693695e7b420f37353b041ad3543f19722dec4da3890cc8947e0acf9e56fc86e", "source_sha": "dc2527ba57afaac311ac39232adabe3833737f40", "source_title": "ppacher/honeyssh repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-ppacher-honeyssh", "kind": "software", "name": "honeyssh", "organization": "ppacher", "reviewed_at": "2026-10-04", "slug": "gh3-ppacher-honeyssh", "source_url": "https://github.com/ppacher/honeyssh", "status": "published", "summary_en": "SSH honeypot that logs username and password attempts during brute-force attacks, rejecting them with a wrong-password message. Includes statsd, a simple HTTP API for querying login attempts.", "summary_es": "Honeypot SSH que registra intentos de usuario y contraseña durante ataques de fuerza bruta, rechazándolos con un mensaje de contraseña incorrecta. Incluye statsd, una API HTTP simple para consultar los intentos de acceso.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The described behavior (traffic redirection to the honeypot via OpenFlow rules) is documented by the author in the README but has not been independently verified.", "limitations_es": "El comportamiento descrito (redirección de tráfico al honeypot mediante reglas OpenFlow) está documentado por el autor en el README, pero no ha sido verificado de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/pratiklotia/sdn-intrusion-prevention-system-honeypot/blob/9d1ca0f3aaa9c039ca8d7c228c214b87f3427b25/README.md", "source_packet_sha256": "6d9f1c6f25333de9d7787a65a314d39b9494902cc46ece8f084f34cf4cca1ddf", "source_sha": "381c8985d7723904d26ccd91cd473cddd6c4e67b", "source_title": "pratiklotia/sdn-intrusion-prevention-system-honeypot repository", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "repository-documentation", "id": "gh3-pratiklotia-sdn-intrusion-prevention-system-honeypot", "kind": "framework", "name": "SDN-Intrusion-Prevention-System-Honeypot", "organization": "pratiklotia", "reviewed_at": "2026-10-04", "slug": "gh3-pratiklotia-sdn-intrusion-prevention-system-honeypot", "source_url": "https://github.com/pratiklotia/sdn-intrusion-prevention-system-honeypot", "status": "published", "summary_en": "Educational project combining a Snort-based IPS on a software-defined network (SDN) with OpenFlow, capable of dynamically redirecting suspicious traffic to a honeypot server for analysis instead of outright blocking it.", "summary_es": "Proyecto educativo que combina un IPS basado en Snort sobre una red definida por software (SDN) con OpenFlow, capaz de redirigir dinámicamente el tráfico sospechoso hacia un servidor honeypot para su análisis en lugar de bloquearlo directamente.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "third-provider-adjudication", "environments": ["Network"], "limitations_en": "Described behavior is based solely on the project's README; it has not been executed or independently verified.", "limitations_es": "El comportamiento descrito proviene únicamente del README del proyecto; no se ha ejecutado ni verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/provos/honeyd/blob/master/honeyd/README", "source_packet_sha256": "76a4a708ad1467a576277adc5e6cbb5930ea7d09d2e643a87f8b0203a2fce94c", "source_sha": "441c3dea9d324eadbcc9bcb0b8869abed964f8e0", "source_title": "provos/honeyd repository", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "repository-documentation", "id": "gh3-provos-honeyd", "kind": "software", "name": "Honeyd", "organization": "provos", "reviewed_at": "2026-10-04", "slug": "gh3-provos-honeyd", "source_url": "https://github.com/provos/honeyd", "status": "published", "summary_en": "Daemon that creates virtual network hosts and can simulate services and TCP personalities to appear as different operating systems, per the project's documentation.", "summary_es": "Demonio que crea hosts virtuales en una red y permite simular servicios y personalidades TCP para aparentar distintos sistemas operativos, según la documentación del proyecto.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Endpoint", "Network"], "limitations_en": "The listening, logging, and blocking behavior is documented in the script header but has not been independently verified.", "limitations_es": "El comportamiento de escucha, registro y bloqueo está documentado en el encabezado del script, pero no ha sido verificado de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/pwdrkeg/honeyport/blob/d10c136e7bd6f5510d0adc398f020cdaaa276ba4/README.md", "source_packet_sha256": "2c55bcd362a7d62ba6c0fbdb5c10ee768705cd54f7adb201d82880729043b462", "source_sha": "2f8f341de2bd9a90cd3c501c9834b4af478cbd00", "source_title": "pwdrkeg/honeyport repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-pwdrkeg-honeyport", "kind": "software", "name": "HoneyPort", "organization": "pwdrkeg", "reviewed_at": "2026-10-04", "slug": "gh3-pwdrkeg-honeyport", "source_url": "https://github.com/pwdrkeg/honeyport", "status": "published", "summary_en": "PowerShell script that listens on specified TCP ports, logs incoming connections, and optionally blocks suspicious IP addresses via Windows Firewall, with whitelist support and detailed logging.", "summary_es": "Script de PowerShell que escucha en puertos TCP especificados, registra las conexiones entrantes y, opcionalmente, bloquea las direcciones IP sospechosas mediante el Firewall de Windows, con soporte para listas blancas y registro detallado.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": "support-only-not-honeypot", "draft_review_basis": "third-provider-adjudication", "environments": ["Network"], "limitations_en": "Capabilities described come solely from the README documentation and were not independently verified or executed; continuity of identity with the historical repository mentioned in the source note was not confirmed.", "limitations_es": "Las capacidades descritas provienen únicamente de la documentación del README y no fueron verificadas de forma independiente ni ejecutadas; no se confirmó la continuidad de identidad con el repositorio histórico mencionado en la nota de la fuente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": ["Honeypot"], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/pwnlandia/mhn/blob/HEAD/README.md", "source_packet_sha256": "7de8610444e384363ec21226722eee872ec9981bc1e1d34cb5b23bd98558b1cb", "source_sha": "830ab5be7419f29eed375bb8d0e6f638d820dd7c", "source_title": "pwnlandia/mhn repository", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-pwnlandia-mhn", "kind": "software", "name": "Modern Honey Network (MHN)", "organization": "pwnlandia", "reviewed_at": "2026-10-04", "slug": "gh3-pwnlandia-mhn", "source_url": "https://github.com/pwnlandia/mhn", "status": "published", "summary_en": "Centralized server that manages deployment of honeypot sensors (Snort, Cowrie, Dionaea, glastopf, among others) and collects their data through a web interface; MHN itself is orchestration and collection infrastructure, not a honeypot, though it supports honeypot techniques via the sensors it deploys.", "summary_es": "Servidor centralizado que gestiona el despliegue de sensores honeypot (Snort, Cowrie, Dionaea, glastopf, entre otros) y recopila sus datos mediante una interfaz web; MHN mismo es infraestructura de orquestación y recolección, no un honeypot en sí, aunque admite técnicas de honeypot a través de los sensores que despliega.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Application"], "limitations_en": "Behavior is documented, not independently verified; continuity with the historical repository was not checked.", "limitations_es": "Comportamiento descrito en la documentación, no verificado independientemente; no se comprobó la continuidad con el repositorio histórico.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_document_url": "https://github.com/pwnlandia/shockpot/blob/HEAD/README.md", "source_packet_sha256": "7a5b221238fd2392baa7e36fd1f1403d0f9de08e34f339f3f50ecd003802345c", "source_sha": "84f222421f6f0c6ab7b1aba35b1abf60013effb7", "source_title": "pwnlandia/shockpot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-pwnlandia-shockpot", "kind": "software", "name": "Shockpot", "organization": "pwnlandia", "reviewed_at": "2026-10-04", "slug": "gh3-pwnlandia-shockpot", "source_url": "https://github.com/pwnlandia/shockpot", "status": "published", "summary_en": "Web-application honeypot designed to detect attempts to exploit the Bash remote-code vulnerability CVE-2014-6271.", "summary_es": "Honeypot de aplicación web diseñado para detectar intentos de explotación de la vulnerabilidad de ejecución remota de Bash CVE-2014-6271.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The behavior described in the README (credential capture and logging) is documented by the author but has not been independently verified; it is noted as being for research and educational purposes only.", "limitations_es": "El funcionamiento descrito en el README (captura y registro de credenciales) está documentado por el autor, pero no ha sido verificado de forma independiente; se advierte que es solo para fines educativos y de investigación.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/random-robbie/docker-ssh-honey/blob/1ad9a1e8867e7b8f302a6ea18515be57bbe8e765/README.md", "source_packet_sha256": "d72417ba1162fc44aa1ff7a620972dd2b11e5709face65560ff41a591dbdd66e", "source_sha": "172fec342641df153b6ae954094a99c3f6275069", "source_title": "random-robbie/docker-ssh-honey repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-random-robbie-docker-ssh-honey", "kind": "software", "name": "Docker SSH Honey", "organization": "random-robbie", "reviewed_at": "2026-10-04", "slug": "gh3-random-robbie-docker-ssh-honey", "source_url": "https://github.com/random-robbie/docker-ssh-honey", "status": "published", "summary_en": "Low-interaction SSH honeypot packaged in a Docker container that listens on port 2222, logs IP addresses, usernames, and passwords from login attempts, and then disconnects the client.", "summary_es": "Honeypot SSH de baja interacción empaquetado en un contenedor Docker, que escucha en el puerto 2222, registra direcciones IP, nombres de usuario y contraseñas de los intentos de inicio de sesión, y luego desconecta al cliente.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The described behavior is as documented by the project and has not been independently verified.", "limitations_es": "El comportamiento descrito proviene de la documentación del proyecto y no ha sido verificado de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "one-source-clarification-after-three-ai-screening", "source_commit": null, "source_document_url": "https://github.com/rep/dionaea/blob/6756787f94c4f1ac53d1e5545d052774a0446c04/README", "source_packet_sha256": "82d3b7a330ff10b3896d3d089a18500ce0ef0b60b8bfabcf306e7b8c69227fda", "source_sha": "7da64d95a2926339052eb67363da7536f302e84a", "source_title": "rep/dionaea repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-rep-dionaea", "kind": "software", "name": "Dionaea", "organization": "rep", "reviewed_at": "2026-10-04", "slug": "gh3-rep-dionaea", "source_url": "https://github.com/rep/dionaea", "status": "published", "summary_en": "Dionaea is a low-interaction honeypot, successor to nepenthes, designed to trap malware exploiting vulnerabilities in network services offered to a network, with the goal of obtaining a copy of the malware.", "summary_es": "Dionaea es un honeypot de baja interacción, sucesor de nepenthes, diseñado para atrapar malware que explota vulnerabilidades en servicios de red ofrecidos a una red, con el objetivo de obtener una copia del malware.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The described behavior is documented, not independently verified.", "limitations_es": "El comportamiento descrito procede de la documentación y no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/RevengeComing/DemonHunter/blob/master/README.md", "source_packet_sha256": "36211500dd0204fa210c456fbf69098848a70bf629f6a5226f77d5ab2beb9e6e", "source_sha": "ca15c88a4ebb33b20933d5ad37a3f8497ae422bd", "source_title": "RevengeComing/DemonHunter repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-revengecoming-demonhunter", "kind": "software", "name": "DemonHunter", "organization": "RevengeComing", "reviewed_at": "2026-10-04", "slug": "gh3-revengecoming-demonhunter", "source_url": "https://github.com/RevengeComing/DemonHunter", "status": "published", "summary_en": "Distributed low-interaction honeypot whose agents simulate services with protocol handlers and whose master receives attack information.", "summary_es": "Honeypot distribuido de baja interacción: los agentes simulan servicios mediante manejadores de protocolos y un servidor central recibe la información de los ataques.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": "192c538977a0c0b718a7e7fdd63ab731fd5ed32bc19419472c16a85ef80c8ea1", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["IoT", "Network"], "limitations_en": "Described behavior comes from the archived repository documentation; it has not been independently verified, and the author notes pending features and an unresolved known issue.", "limitations_es": "El comportamiento descrito proviene de la documentación archivada del repositorio; no ha sido verificado de forma independiente, y el propio autor señala funciones pendientes y un problema conocido sin resolver.", "original_url": "https://github.com/richpayne/jenny", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "three-ai-source-page-agreement", "source_commit": null, "source_document_url": "https://web.archive.org/web/20200804105028id_/https://github.com/RichPayne/Jenny", "source_packet_sha256": "a1ec37fd9f05cd3aa9bdc001940ecd98333a1f300d4f852673f5003d02afb4b1", "source_sha": null, "source_title": "jenny", "tags": [], "techniques": ["Honeypot"]}, "evidence": "archived-repository-documentation", "id": "gh3-richpayne-jenny", "kind": "software", "name": "Jenny", "organization": "richpayne", "reviewed_at": "2026-10-04", "slug": "gh3-richpayne-jenny", "source_url": "https://web.archive.org/web/20200804105028id_/https://github.com/RichPayne/Jenny", "status": "published", "summary_en": "A Python-based honeypot designed to emulate the Mirai malware, with separate listener and C2 components, aimed at scalable and easy setup.", "summary_es": "Honeypot en Python diseñado para emular el malware Mirai, con un componente de escucha y un componente de C2 separados, orientado a ser escalable y fácil de configurar.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The described behavior is documented, not independently verified.", "limitations_es": "El comportamiento descrito procede de la documentación y no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_document_url": "https://github.com/robertdavidgraham/telnetlogger/blob/master/README.md", "source_packet_sha256": "0df3324633bebb31cbb74ae7a4d64582029abcf5d6cad1924cc3bbf935121e0c", "source_sha": "5378f5465bb30a201b606ecb54eb1be92e3ee14a", "source_title": "robertdavidgraham/telnetlogger repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-robertdavidgraham-telnetlogger", "kind": "software", "name": "telnetlogger", "organization": "robertdavidgraham", "reviewed_at": "2026-10-04", "slug": "gh3-robertdavidgraham-telnetlogger", "source_url": "https://github.com/robertdavidgraham/telnetlogger", "status": "published", "summary_en": "Program that presents a Telnet response intended to elicit login attempts and logs the IP addresses and credentials used; its documentation frames this as tracking Mirai.", "summary_es": "Programa que presenta una respuesta Telnet destinada a provocar intentos de inicio de sesión y registra las direcciones IP y credenciales empleadas; la documentación lo orienta al seguimiento de Mirai.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": "support-only-not-honeypot", "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The described functions are documented, not independently verified.", "limitations_es": "Las funciones descritas proceden de la documentación y no se han verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": ["Honeypot"], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/rubenespadas/DionaeaFR/blob/master/README.md", "source_packet_sha256": "ebbdc85c07456e0461da2fb618d951b33281ccd95da57b09d33a82c285581637", "source_sha": "4ce446095df03dfffd7c5a87041bd0b4a779a4de", "source_title": "rubenespadas/DionaeaFR repository", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-rubenespadas-dionaeafr", "kind": "software", "name": "DionaeaFR", "organization": "rubenespadas", "reviewed_at": "2026-10-04", "slug": "gh3-rubenespadas-dionaeafr", "source_url": "https://github.com/rubenespadas/DionaeaFR", "status": "published", "summary_en": "Web front end for the Dionaea low-interaction honeypot, with connection filters and attack graphs. It is honeypot-adjacent visualization infrastructure, not itself a honeypot.", "summary_es": "Interfaz web para el honeypot de baja interacción Dionaea, con filtros de conexiones y gráficos de ataques. Es infraestructura de visualización vinculada al honeypot, no un honeypot por sí misma.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Behavior is documented, not independently verified.", "limitations_es": "El comportamiento se describe en la documentación; no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/run41/honey_ports/blob/master/README.md", "source_packet_sha256": "de99d94d6a32127e9d3251e7bab7402328a8fa64a1414b72df558f65ac8df487", "source_sha": "9156726568ea758c23b514ccda9292f2c6f57fdc", "source_title": "run41/honey_ports repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-run41-honey-ports", "kind": "software", "name": "honey_ports", "organization": "run41", "reviewed_at": "2026-10-04", "slug": "gh3-run41-honey-ports", "source_url": "https://github.com/run41/honey_ports", "status": "published", "summary_en": "Docker-deployed honeypot for detecting port scans; documents port configuration and logging of connection attempts.", "summary_es": "Honeypot desplegado con Docker para detectar escaneos de puertos; documenta la configuración de puertos y el registro de intentos de conexión.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network", "Endpoint"], "limitations_en": "The described functionality corresponds to the project's documentation and thesis, and has not been independently verified.", "limitations_es": "La funcionalidad descrita corresponde a la documentación y tesis del proyecto, y no ha sido verificada de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "one-source-clarification-after-three-ai-screening", "source_commit": null, "source_document_url": "https://github.com/rvermeulen/argos/blob/2e2bd212c189410130618874c190ee3f3fb3e4c1/README", "source_packet_sha256": "a2c1a9e80dd7ff1810ed47ca26d37ce1f011bda03e745ed4570b2d874d31f7c2", "source_sha": "3f6badde4aed694b29e04973803ce315168dae11", "source_title": "rvermeulen/argos repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-rvermeulen-argos", "kind": "software", "name": "Argos", "organization": "rvermeulen", "reviewed_at": "2026-10-04", "slug": "gh3-rvermeulen-argos", "source_url": "https://github.com/rvermeulen/argos", "status": "published", "summary_en": "Argos is an advertised honeypot using dynamic taint analysis to detect and analyze control flow attacks.", "summary_es": "Argos es un honeypot anunciado que utiliza análisis dinámico de contaminación (taint analysis) para detectar y analizar ataques de control de flujo.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": [], "limitations_en": "Its identification as a honeypot is documented; behavior is not independently verified.", "limitations_es": "La condición de honeypot consta en la documentación; su comportamiento no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/sahilm/hived/blob/master/README.md", "source_packet_sha256": "a438182040edfe003e4b9d8abf72b3ab5fa6518a48e966ba10eb92f4ba74e473", "source_sha": "57ae82cf0404d798e0d512521d2a444b505419a9", "source_title": "sahilm/hived repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-sahilm-hived", "kind": "software", "name": "hived", "organization": "sahilm", "reviewed_at": "2026-10-04", "slug": "gh3-sahilm-hived", "source_url": "https://github.com/sahilm/hived", "status": "published", "summary_en": "Repository whose documentation identifies hived as a honeypot without describing its operation or environment.", "summary_es": "Repositorio cuya documentación identifica hived como un honeypot, sin describir su funcionamiento ni entorno.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network", "Application"], "limitations_en": "The description is based on the repository's documentation and has not been independently verified.", "limitations_es": "La descripción se basa en la documentación del repositorio y no ha sido verificada de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/schmalle/elasticpotpy/blob/73fff6798ab81b868f6b1ee2f0c8853aa49fa2de/README.md", "source_packet_sha256": "ac864f3e50fba863777f50abec840a59cbbb59f80a85b310f8051a2702ddf9b4", "source_sha": "fa8b427427d07b4de468dd7f7da8a9c79e26f50d", "source_title": "schmalle/elasticpotpy repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-schmalle-elasticpotpy", "kind": "software", "name": "ElasticPot", "organization": "schmalle", "reviewed_at": "2026-10-04", "slug": "gh3-schmalle-elasticpotpy", "source_url": "https://github.com/schmalle/elasticpotpy", "status": "published", "summary_en": "ElasticPot is a honeypot that emulates an Elasticsearch service, compatible with DTAG's T-Pot environment and also available as a dockerized version.", "summary_es": "ElasticPot es un honeypot que emula un servicio Elasticsearch, compatible con el entorno T-Pot de DTAG y disponible también como versión dockerizada.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": "333d8417ad5cfd406e594c3800010e6a4d5fef3636c54e4c833c34b2338318ca", "classification_rule": "support-only-not-honeypot", "draft_review_basis": "independent-second-provider-review", "environments": [], "limitations_en": "These functions are documented in an archived README; their behavior has not been independently verified, and current availability is unknown.", "limitations_es": "Estas funciones constan en un README archivado; su comportamiento no se ha verificado de forma independiente ni se conoce su disponibilidad actual.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": ["Honeypot"], "review_basis": "repository-documentation", "screening_basis": "three-ai-source-page-agreement", "source_document_url": "https://web.archive.org/web/20180611112651id_/https://github.com/schmalle/honeyalarmg2", "source_packet_sha256": "25da5e663932d2d935520a0b6cfb9280df5c10511af4dafe5c3204ab0539e9cc", "source_sha": null, "source_title": "HoneyAlarmG2", "tags": [], "techniques": []}, "evidence": "archived-repository-documentation", "id": "gh3-schmalle-honeyalarmg2", "kind": "software", "name": "HoneyAlarmG2", "organization": "schmalle", "reviewed_at": "2026-10-04", "slug": "gh3-schmalle-honeyalarmg2", "source_url": "https://web.archive.org/web/20180611112651id_/https://github.com/schmalle/honeyalarmg2", "status": "published", "summary_en": "In-development interface for collecting and reviewing alarms from local honeypot installations and forwarding them to the DTAG early warning system. It manages alarms; it is not itself a honeypot.", "summary_es": "Interfaz en desarrollo para recopilar y revisar alarmas de instalaciones locales de honeypots y reenviarlas al sistema de alerta temprana de DTAG. Es una herramienta para gestionar alarmas, no un honeypot.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Application"], "limitations_en": "Features are documented; behavior is not independently verified.", "limitations_es": "Las funciones se describen en la documentación; su comportamiento no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/schmalle/Servletpot/blob/master/README.txt", "source_packet_sha256": "2f57da9e8d8ae82979c1dde651bb2f645b8684dbaa1f30714c732b65fe798127", "source_sha": "d9a25d6841ee018df91dd9b5b2c73b0037de1649", "source_title": "schmalle/Servletpot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-schmalle-servletpot", "kind": "software", "name": "Servletpot", "organization": "schmalle", "reviewed_at": "2026-10-04", "slug": "gh3-schmalle-servletpot", "source_url": "https://github.com/schmalle/Servletpot", "status": "published", "summary_en": "Web application honeypot implemented as a Java servlet; documentation mentions GET/POST handling and a self-learning approach.", "summary_es": "Honeypot de aplicación web implementado como servlet Java; la documentación menciona manejo de GET/POST y aprendizaje automático.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "These features are documented, not independently verified; the README warns of possible severe bugs.", "limitations_es": "Estas funciones están documentadas, no verificadas de forma independiente; el README advierte de posibles fallos graves.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/sec51/honeymail/blob/master/README.md", "source_packet_sha256": "fa35dbf2b6e0be777574644ad68c22aebfae036fc8b6bae2b21723e93a202854", "source_sha": "1b345a6ebaf914757739e04fcd67bb15d6d78b4c", "source_title": "sec51/honeymail repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-sec51-honeymail", "kind": "software", "name": "honeymail", "organization": "sec51", "reviewed_at": "2026-10-04", "slug": "gh3-sec51-honeymail", "source_url": "https://github.com/sec51/honeymail", "status": "published", "summary_en": "SMTP honeypot with configurable responses, TLS and STARTTLS support, BoltDB email storage, and an API for retrieving messages.", "summary_es": "Honeypot SMTP con respuestas configurables, compatibilidad con TLS y STARTTLS, almacenamiento de correos en BoltDB y una API para consultarlos.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The behavior is documented, not independently verified; a connection to the port alone does not establish a targeted attack.", "limitations_es": "El comportamiento está documentado, no verificado de forma independiente; una conexión al puerto no demuestra por sí sola un ataque dirigido.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/securitygeneration/Honeyport/blob/master/README.md", "source_packet_sha256": "25007eb494148fab981d3fdc4306d67ff2e927a88c2e1fedd6af0bd1b4b1fc78", "source_sha": "7f7129bbaff68696f2eb967000f0a4ebf4d48136", "source_title": "securitygeneration/Honeyport repository", "tags": [], "techniques": ["Decoy"]}, "evidence": "repository-documentation", "id": "gh3-securitygeneration-honeyport", "kind": "software", "name": "Honeyport", "organization": "securitygeneration", "reviewed_at": "2026-10-04", "slug": "gh3-securitygeneration-honeyport", "source_url": "https://github.com/securitygeneration/Honeyport", "status": "published", "summary_en": "Bash and Python scripts that listen on a decoy port and can block a connecting source IP. They do not simulate a full application or protocol.", "summary_es": "Scripts Bash y Python que escuchan en un puerto señuelo y, al recibir una conexión, pueden bloquear la IP de origen. No simulan una aplicación o protocolo completo.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": "support-only-not-honeypot", "draft_review_basis": "third-provider-adjudication", "environments": ["Network"], "limitations_en": "The content describes a research-sharing platform per its own page, not an independently verified deception product.", "limitations_es": "El contenido describe una plataforma de intercambio de investigación según su propia página, no un producto de engaño verificado de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": ["Honeypot"], "review_basis": "repository-documentation", "screening_basis": "three-ai-source-page-agreement", "source_commit": "598dd58e0f103b18a6c92113179bb7a4bc7fff59", "source_document_url": "https://github.com/secwiki/ipot/blob/598dd58e0f103b18a6c92113179bb7a4bc7fff59/README.html", "source_packet_sha256": "610d2a895f9a871421330bbb34abfa2de502ce8c77612a2537879f883c7f38e9", "source_sha": null, "source_title": "ipot", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-secwiki-ipot", "kind": "community", "name": "iPot", "organization": "secwiki", "reviewed_at": "2026-10-04", "slug": "gh3-secwiki-ipot", "source_url": "https://github.com/secwiki/ipot", "status": "published", "summary_en": "iPot is a Chinese-language blog and community dedicated to honeypot research, aggregating open-source projects, academic papers, datasets, and research sharing on honeypot technologies; it is not itself deception software.", "summary_es": "iPot es un blog y comunidad en chino dedicado a la investigación de honeypots, que reúne proyectos de código abierto, artículos académicos, conjuntos de datos e intercambio de resultados sobre tecnologías de honeypot; no es en sí mismo software de engaño.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "That behavior is documented, not independently verified; the description does not establish that it is a full honeypot.", "limitations_es": "Ese comportamiento está documentado, no verificado de forma independiente; la descripción no establece que sea un honeypot completo.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/SentryPeer/SentryPeer/blob/main/README.md", "source_packet_sha256": "9f70fa4082971933b145e5fb7ffa373d7a9b68c76c7f0f1f3d90c9ad76bca239", "source_sha": "2fb1343ab5649d4087d0b8eea246bd62b0e5b7de", "source_title": "SentryPeer/SentryPeer repository", "tags": [], "techniques": ["Adversary engagement"]}, "evidence": "repository-documentation", "id": "gh3-sentrypeer-sentrypeer", "kind": "software", "name": "SentryPeer", "organization": "SentryPeer", "reviewed_at": "2026-10-04", "slug": "gh3-sentrypeer-sentrypeer", "source_url": "https://github.com/SentryPeer/SentryPeer", "status": "published", "summary_en": "Fraud-detection tool that receives attempted calls and SIP probes, recording source IPs and dialed numbers for alerts and lookup. Its deception link is allowing and observing those attempts.", "summary_es": "Herramienta de detección de fraude que recibe intentos de llamadas y sondeos SIP, y registra las IP y los números marcados para alertas y consultas. Su vínculo con el engaño es permitir esos intentos y observarlos.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Application"], "limitations_en": "The described functionality is based solely on project documentation and has not been independently verified.", "limitations_es": "La funcionalidad descrita se basa únicamente en la documentación del proyecto y no ha sido verificada de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/shipcod3/honeypy/blob/9b4a1fb9316626dc2f586b8bdf3dc9f022970e6e/README.md", "source_packet_sha256": "8fc843ff9c20c33004da3f1c0f3083a47debb4172e48d8e1809016210e15fda0", "source_sha": "e3cae6efafd28ec0b25326cbda513ea50fbcbb0b", "source_title": "shipcod3/honeypy repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-shipcod3-honeypy", "kind": "software", "name": "HoneyPy", "organization": "shipcod3", "reviewed_at": "2026-10-04", "slug": "gh3-shipcod3-honeypy", "source_url": "https://github.com/shipcod3/honeypy", "status": "published", "summary_en": "A simple web application honeypot that uses SimpleHTTPServer to serve a retro-styled HTML page, intended to attract and log basic web interactions.", "summary_es": "Honeypot web simple que usa SimpleHTTPServer para servir una página HTML con apariencia retro, creado para atraer y registrar interacciones web básicas.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": "12b07a6aacfb843f0404fcc6643cdf8b886f8c9facdcb3b0fcb426ed87e10480", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Endpoint"], "limitations_en": "The described capabilities (ROP detection, malware dumping, bypass protection) are documented by the author in an early beta release and have not been independently verified; the author acknowledges known weaknesses, including possible bypass methods and lack of detection for logical Java exploits.", "limitations_es": "Las capacidades descritas (detección de ROP, dumping de malware, protección contra elusión) están documentadas por el autor en una versión beta temprana y no han sido verificadas de forma independiente; el propio autor reconoce debilidades conocidas, incluyendo posibles métodos de evasión y falta de detección de exploits lógicos en Java.", "original_url": "https://github.com/shjalayeri/mcedp", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "three-ai-source-page-agreement", "source_commit": null, "source_document_url": "https://web.archive.org/web/20180611022743id_/https://github.com/shjalayeri/MCEDP", "source_packet_sha256": "cb6483d9b3baecb06633fecb158ecbd96ed4e7628d46017a58c39ec1fb5ec7d4", "source_sha": null, "source_title": "mcedp", "tags": [], "techniques": ["Honeypot"]}, "evidence": "archived-repository-documentation", "id": "gh3-shjalayeri-mcedp", "kind": "software", "name": "MCEDP HoneyClient", "organization": "shjalayeri", "reviewed_at": "2026-10-04", "slug": "gh3-shjalayeri-mcedp", "source_url": "https://web.archive.org/web/20180611022743id_/https://github.com/shjalayeri/MCEDP", "status": "published", "summary_en": "A high-interaction client honeypot for Windows that, per its documentation, detects zero-day exploits and shellcodes in browsers and office applications using exploitation-stage detection methods rather than signatures, without infecting the system.", "summary_es": "Honeypot cliente de alta interacción para Windows que, según su documentación, detecta exploits de día cero y shellcodes en navegadores y aplicaciones ofimáticas mediante métodos de detección en tiempo de explotación en lugar de firmas, sin infectar el sistema.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": [], "limitations_en": "Historical documented description, not independently verified; the code repository is unavailable.", "limitations_es": "Descripción histórica documentada, no verificada independientemente; el repositorio de código no está disponible.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://www.honeynet.org/2013/05/31/gsoc-2013-student-selection-officially-announced/", "source_packet_sha256": "6df7aa0cbb0c990985c914945de80e7431420863e35fc0a7a8c147d66de90120", "source_sha": null, "source_title": "shjalayeri/pwnypot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-shjalayeri-pwnypot", "kind": "software", "name": "pwnypot", "organization": "shjalayeri", "reviewed_at": "2026-10-04", "slug": "gh3-shjalayeri-pwnypot", "source_url": "https://www.honeynet.org/2013/05/31/gsoc-2013-student-selection-officially-announced/", "status": "published", "summary_en": "Historical project described by Honeynet as a high-interaction client honeypot for malicious-code execution detection and prevention.", "summary_es": "Proyecto histórico descrito por Honeynet como un honeypot cliente de alta interacción para detectar y prevenir la ejecución de código malicioso.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The described capabilities come from the repository documentation and have not been independently verified.", "limitations_es": "Las capacidades descritas provienen de la documentación del repositorio y no han sido verificadas de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/shmakov/honeypot/blob/1c3d5f3ba1da5f507f5abd278b9a5c7265e7ef61/README.md", "source_packet_sha256": "ef7ffd61e8ad5fca6500a28b8508c2d6cacf6c3214f74c99ea0a0e3d32f3d528", "source_sha": "b3a8a2d96dc957560b1723911e829440d6500eb0", "source_title": "shmakov/honeypot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-shmakov-honeypot", "kind": "software", "name": "Honeypot (shmakov)", "organization": "shmakov", "reviewed_at": "2026-10-04", "slug": "gh3-shmakov-honeypot", "source_url": "https://github.com/shmakov/honeypot", "status": "published", "summary_en": "A low-interaction network honeypot written in Rust that emulates SSH, FTP, and Telnet protocols, captures credentials, and provides a real-time dashboard with attack visualization and geolocation.", "summary_es": "Honeypot de red de baja interacción escrito en Rust que emula protocolos SSH, FTP y Telnet, captura credenciales y ofrece un panel en tiempo real con visualización de ataques y geolocalización.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["OT/ICS"], "limitations_en": "The described behavior is documented, not independently verified.", "limitations_es": "El comportamiento descrito procede de la documentación y no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/sjhilt/GasPot/blob/master/README.md", "source_packet_sha256": "0eaa6449e4dd3331004e48f07c8007e701f8d91448ee27b94631ea7f20630203", "source_sha": "a279e6cd8cdd9e5354183223d9e8d1e53e1bd34f", "source_title": "sjhilt/GasPot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-sjhilt-gaspot", "kind": "software", "name": "GasPot", "organization": "sjhilt", "reviewed_at": "2026-10-04", "slug": "gh3-sjhilt-gaspot", "source_url": "https://github.com/sjhilt/GasPot", "status": "published", "summary_en": "Honeypot that emulates a Veeder-Root TLS-350/TLS-450 automatic tank gauge controller and logs connections and commands.", "summary_es": "Honeypot que emula un controlador de medición automática de tanques Veeder-Root TLS-350/TLS-450 y registra conexiones y comandos.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": "support-only-not-honeypot", "draft_review_basis": "independent-second-provider-review", "environments": ["OT/ICS"], "limitations_en": "The integration and its behavior are documented only, not independently verified.", "limitations_es": "La integración y su comportamiento solo están documentados; no se han verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": ["Honeypot"], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/sk4ld/gridpot/blob/master/README.md", "source_packet_sha256": "bb4c658a478a594d5aeffc2deff62378c6debf2a828fb384c8401ec43cff24d7", "source_sha": "821c4c7f713f2402129af82be94cfa7b6fff80b3", "source_title": "sk4ld/gridpot repository", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-sk4ld-gridpot", "kind": "software", "name": "GridPot", "organization": "sk4ld", "reviewed_at": "2026-10-04", "slug": "gh3-sk4ld-gridpot", "source_url": "https://github.com/sk4ld/gridpot", "status": "published", "summary_en": "Documented integration of Conpot with GridLAB-D for a demonstration using a power-grid model and the “gridpot” template. GridLAB-D supplies the simulation; it is not presented as a honeypot itself.", "summary_es": "Integración documentada de Conpot con GridLAB-D para una demostración con un modelo de red eléctrica y una plantilla «gridpot». GridLAB-D aporta la simulación; no se presenta como un honeypot por sí mismo.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The described behavior is documented, not independently verified.", "limitations_es": "El comportamiento descrito procede de la documentación y no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/skeeto/endlessh/blob/master/README.md", "source_packet_sha256": "9450d498f34bc579e9dc10ce897f7706910ff140717508159751c2cebd324f99", "source_sha": "16debcdc0878c832eddb191885085e0909248ccb", "source_title": "skeeto/endlessh repository", "tags": [], "techniques": ["Adversary engagement", "Decoy"]}, "evidence": "repository-documentation", "id": "gh3-skeeto-endlessh", "kind": "software", "name": "Endlessh", "organization": "skeeto", "reviewed_at": "2026-10-04", "slug": "gh3-skeeto-endlessh", "source_url": "https://github.com/skeeto/endlessh", "status": "published", "summary_en": "SSH tarpit that slowly sends an endless banner to tie up connecting SSH clients while the real SSH server uses another port.", "summary_es": "Tarpit SSH que envía lentamente un banner interminable para mantener ocupados a clientes SSH que se conecten a él, mientras el servidor SSH real usa otro puerto.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network", "Application"], "limitations_en": "The project describes itself as a pre-release in early alpha stage; its functionality is documented but not independently verified.", "limitations_es": "El proyecto se describe a sí mismo como una prerelease en fase alfa temprana; su funcionalidad está documentada pero no verificada de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_commit": null, "source_document_url": "https://github.com/slober3/pothead/blob/0779ad3d71fcc570b13dc09ce6363c11e6533480/README.md", "source_packet_sha256": "f28bbd4efee1272e5ad3b8a3b00ddf06c992ef0d70d0ea2477722fa889161f25", "source_sha": "5fc43538a3d93ec0225db53e16b5d1844a77fb6c", "source_title": "slober3/pothead repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-slober3-pothead", "kind": "software", "name": "PotHead", "organization": "slober3", "reviewed_at": "2026-10-04", "slug": "gh3-slober3-pothead", "source_url": "https://github.com/slober3/pothead", "status": "published", "summary_en": "A lightweight package described as a minimal-interaction honeypot, combining a Python port-listening script with a PHP web backend to log incoming connections.", "summary_es": "Paquete ligero descrito como honeypot de interacción mínima que combina un script Python de escucha de puertos con un backend web en PHP para registrar conexiones entrantes.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": "support-only-not-honeypot", "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Behavior is documented, not independently verified.", "limitations_es": "El comportamiento se describe en la documentación, pero no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": ["Honeypot"], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/SneakersInc/HoneyMalt/blob/master/README.md", "source_packet_sha256": "329fcb20bfe4c18687ba50414f4bae83e7f6564bb29c77c78d40268131416737", "source_sha": "f6b02e076c5589593710dee7589ec1fa159dcc99", "source_title": "SneakersInc/HoneyMalt repository", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-sneakersinc-honeymalt", "kind": "software", "name": "HoneyMalt", "organization": "SneakersInc", "reviewed_at": "2026-10-04", "slug": "gh3-sneakersinc-honeymalt", "source_url": "https://github.com/SneakersInc/HoneyMalt", "status": "published", "summary_en": "Maltego transform pack for graphing Kippo honeypot data stored in MySQL. Its deception link is analysis of that data; it is not described as a honeypot.", "summary_es": "Paquete de transformaciones de Maltego para analizar gráficamente datos del honeypot Kippo almacenados en MySQL. Se vincula al engaño mediante el análisis de esos datos; no se describe como un honeypot.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": "44042092bd3d6b6a54e6fc70905d7119d149276bca53ca1c228bcd34f2c05d40", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Application"], "limitations_en": "The described behavior comes solely from archived repository metadata and has not been independently verified; no project-specific documentation exists beyond the title and description.", "limitations_es": "El comportamiento descrito proviene únicamente de los metadatos archivados del repositorio y no ha sido verificado de forma independiente; no existe documentación específica del proyecto más allá del título y la descripción.", "original_url": "https://github.com/SoftwareAgenten/WordPress-Login-Honeypot", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-metadata", "screening_basis": "three-ai-source-page-agreement", "source_commit": null, "source_document_url": "https://web.archive.org/web/20180612221201id_/https://github.com/SoftwareAgenten/WordPress-Login-Honeypot", "source_packet_sha256": "181719c739eec95fe6c0b613ebe9405afde21157c6c6897e0888aa821b92bfc7", "source_sha": null, "source_title": "WordPress-Login-Honeypot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "archived-repository-metadata", "id": "gh3-softwareagenten-wordpress-login-honeypot", "kind": "software", "name": "WordPress-Login-Honeypot", "organization": "softwareagenten", "reviewed_at": "2026-10-04", "slug": "gh3-softwareagenten-wordpress-login-honeypot", "source_url": "https://web.archive.org/web/20180612221201id_/https://github.com/SoftwareAgenten/WordPress-Login-Honeypot", "status": "published", "summary_en": "Archived GitHub repository describing a fake WordPress login and registration page intended to track bot behavior. Only repository metadata is available; the bundled readme.html is the generic WordPress file and provides no project-specific documentation.", "summary_es": "Repositorio archivado en GitHub que describe una página falsa de inicio de sesión y registro de WordPress, destinada a rastrear el comportamiento de bots. Solo se dispone de metadatos del repositorio; el readme.html incluido es el genérico de WordPress y no aporta documentación específica del proyecto.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": [], "limitations_en": "The stated use is documented, not independently verified; the text documents no deception function.", "limitations_es": "El uso indicado está documentado, no verificado de forma independiente; el texto no documenta una función de engaño.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-agreement-on-augmented-primary-source", "source_document_url": "https://github.com/sreinhardt/Docker-Honeynet/blob/master/README.rdoc", "source_packet_sha256": "c337f86da6eee988c33082c29058eb48c25c211fad697531e53df509cd960843", "source_sha": "b64ca9db69cd3b5c47abfdcdef36d4617bc651ba", "source_title": "sreinhardt/Docker-Honeynet repository", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-sreinhardt-docker-honeynet", "kind": "software", "name": "Docker-Honeynet", "organization": "sreinhardt", "reviewed_at": "2026-10-04", "slug": "gh3-sreinhardt-docker-honeynet", "source_url": "https://github.com/sreinhardt/Docker-Honeynet", "status": "published", "summary_en": "Docker files for testing software and long-term containers. Although the repository name refers to a honeynet, the text does not explain a functional deception link or describe the files as a honeypot.", "summary_es": "Archivos Docker para probar software y contenedores de larga duración. Aunque el nombre del repositorio alude a una honeynet, el texto no explica un vínculo funcional con el engaño ni los describe como un honeypot.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Behavior is documented, not independently verified.", "limitations_es": "El comportamiento se describe en la documentación, pero no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "one-source-clarification-after-three-ai-screening", "source_document_url": "https://github.com/stamparm/hontel/blob/master/README.md", "source_packet_sha256": "2223ff8f9d07c7ac8fbb2a96c338643fcd8aaab344c37038dce2cc1a8e826f60", "source_sha": "8af40b0ca47f84f3087554f6c22ef2a07a273df2", "source_title": "stamparm/hontel repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-stamparm-hontel", "kind": "software", "name": "HonTel", "organization": "stamparm", "reviewed_at": "2026-10-04", "slug": "gh3-stamparm-hontel", "source_url": "https://github.com/stamparm/hontel", "status": "published", "summary_en": "Python 2.x Telnet honeypot that emulates the service in a chroot environment. The documentation describes options for credentials, a fake hostname, and command logging.", "summary_es": "Honeypot de Telnet en Python 2.x que emula el servicio en un entorno chroot. La documentación describe opciones para credenciales, nombre de host simulado y registro de comandos.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Application", "Network"], "limitations_en": "The described behavior comes solely from the project's documentation and has not been independently verified.", "limitations_es": "El comportamiento descrito proviene únicamente de la documentación del proyecto y no ha sido verificado de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/teakolik/honeytea/blob/5adc7b9703e04dbaa6e29edcb568bd112dcd09c1/README.md", "source_packet_sha256": "f2abec11dd67a49ecdd32616bac076f4abb688bddcca2aac3a6c4f55c43f3bfd", "source_sha": "23f1867c03c3e39e2c67ccd3546d4777dbc6de51", "source_title": "teakolik/honeytea repository", "tags": [], "techniques": ["Decoy"]}, "evidence": "repository-documentation", "id": "gh3-teakolik-honeytea", "kind": "software", "name": "honeyTEA", "organization": "teakolik", "reviewed_at": "2026-10-04", "slug": "gh3-teakolik-honeytea", "source_url": "https://github.com/teakolik/honeytea", "status": "published", "summary_en": "A bash script for CentOS that combines Apache, Cloudflare, and a CMS (mainly WordPress) to detect malicious requests in server logs and temporarily block the attacker's real IP via the Cloudflare API.", "summary_es": "Script en bash para CentOS que combina Apache, Cloudflare y un CMS (principalmente WordPress) para detectar solicitudes maliciosas en los logs del servidor y bloquear temporalmente la IP real del atacante mediante la API de Cloudflare.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The described behavior comes from documentation and has not been independently verified.", "limitations_es": "El comportamiento descrito procede de la documentación y no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/tillmannw/honeytrap/blob/master/README.md", "source_packet_sha256": "e35f4dd8963e85a7f6386d3d6278ba54941d373cd1d134e321c3ff5880728012", "source_sha": "09b24df3c0cc5ee409952420d4e649cf9491f639", "source_title": "tillmannw/honeytrap repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-tillmannw-honeytrap", "kind": "software", "name": "honeytrap", "organization": "tillmannw", "reviewed_at": "2026-10-04", "slug": "gh3-tillmannw-honeytrap", "source_url": "https://github.com/tillmannw/honeytrap", "status": "published", "summary_en": "Low-interaction honeypot for attacks against TCP and UDP services; documents template-based emulation, mirror mode, and proxy mode.", "summary_es": "Honeypot de baja interacción para ataques contra servicios TCP y UDP; documenta emulación mediante plantillas y modos de espejo y proxy.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The description comes from an archived page and project documentation; its current functioning has not been independently verified.", "limitations_es": "La descripción procede de una página archivada y de la documentación del proyecto; no se ha verificado de forma independiente su funcionamiento actual.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/tiny-honeypot/thp/blob/155ad3d16b1d61a15e32aace1d7283118ac23725/README.md", "source_packet_sha256": "17b5cb7ac789c8b521c14642da14dcbb2678a0304f7545324d4de71a7d9a4cbc", "source_sha": "5b378faee71acacee4d54d1dee9f603ae2d5201f", "source_title": "tiny-honeypot/thp repository", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "repository-documentation", "id": "gh3-tiny-honeypot-thp", "kind": "software", "name": "Tiny Honeypot (thp)", "organization": "tiny-honeypot", "reviewed_at": "2026-10-04", "slug": "gh3-tiny-honeypot-thp", "source_url": "https://github.com/tiny-honeypot/thp", "status": "published", "summary_en": "A historical Linux honeypot that listens on unused ports via xinetd and netfilter/REDIRECT, providing phony responses to attacker commands to consume their resources and complement IDS systems like Snort.", "summary_es": "Honeypot histórico para Linux que escucha en puertos no utilizados mediante xinetd y netfilter/REDIRECT, ofreciendo respuestas falsas a comandos de atacantes para consumir sus recursos y complementar sistemas IDS como Snort.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The documentation says the project is no longer maintained; its documented behavior has not been independently verified.", "limitations_es": "La documentación indica que el proyecto ya no se mantiene; su comportamiento documentado no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/tnich/honssh/blob/master/README", "source_packet_sha256": "be80b6d5004066ef6af0bada30d73b765b5c3c940840b0421bad8cb40ed6be0e", "source_sha": "5fca8e6f8d7142c6a48e44da515ccdda385814ad", "source_title": "tnich/honssh repository", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-tnich-honssh", "kind": "software", "name": "HonSSH", "organization": "tnich", "reviewed_at": "2026-10-04", "slug": "gh3-tnich-honssh", "source_url": "https://github.com/tnich/honssh", "status": "published", "summary_en": "SSH intermediary designed for use with a high-interaction honeypot: it sits between the attacker and the honeypot and creates two SSH connections. It is not described as a standalone honeypot.", "summary_es": "Intermediario SSH diseñado para usarse con un honeypot de alta interacción: se sitúa entre el atacante y el honeypot y crea dos conexiones SSH. No se describe como un honeypot independiente.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network", "Identity"], "limitations_en": "The described behavior is based on the repository's documentation and sample output, without independent verification of the code.", "limitations_es": "El comportamiento descrito se basa en la documentación y ejemplos de salida del repositorio, sin verificación independiente del código.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/tomwillfixit/honeypot/blob/fd7dbb8acce863f32af91fa6c8648c46cdbaa4a1/README.md", "source_packet_sha256": "d0d278a7cbf2b460c39ebe5998387ca3fb1acf1e5dd3f50189c2452b9b8859ca", "source_sha": "165cbe3469b0c44c9f2f9b02902024552193cc02", "source_title": "tomwillfixit/honeypot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-tomwillfixit-honeypot", "kind": "software", "name": "honeypot (tomwillfixit)", "organization": "tomwillfixit", "reviewed_at": "2026-10-04", "slug": "gh3-tomwillfixit-honeypot", "source_url": "https://github.com/tomwillfixit/honeypot", "status": "published", "summary_en": "A Ubuntu-based Docker image that sets up an SSH honeypot, logging usernames and passwords used by attackers during login attempts, based on code and instructions from an external tutorial.", "summary_es": "Imagen Docker basada en Ubuntu que configura un honeypot SSH, registrando nombres de usuario y contraseñas usados por atacantes en intentos de inicio de sesión, basada en código e instrucciones de un tutorial externo.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The description of functionality comes solely from the repository's documentation and has not been independently verified.'", "limitations_es": "La descripción del funcionamiento proviene únicamente de la documentación del repositorio y no ha sido verificada de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/travisbgreen/intel_amt_honeypot/blob/a46b43cb453990e11a55f7619b174d071d271ad5/README.md", "source_packet_sha256": "7a5d8bf35539d13333eb1128d92a90f4bb2a2d6f9508ac1f59881357c0bcb109", "source_sha": "9a9429afd88e9dcef35bc3386f8e94ae91df579c", "source_title": "travisbgreen/intel_amt_honeypot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-travisbgreen-intel-amt-honeypot", "kind": "software", "name": "Intel AMT Honeypot", "organization": "travisbgreen", "reviewed_at": "2026-10-04", "slug": "gh3-travisbgreen-intel-amt-honeypot", "source_url": "https://github.com/travisbgreen/intel_amt_honeypot", "status": "published", "summary_en": "Simple honeypot for the Intel AMT port, inspired by a SANS ISC advisory about the risk of exposed AMT. It is intended to run alongside packet capture to log activity on the relevant ports.", "summary_es": "Honeypot simple para el puerto de Intel AMT, inspirado en un aviso de SANS ISC sobre el riesgo de dejar AMT expuesto. Está pensado para ejecutarse junto a una captura de paquetes para registrar la actividad en los puertos relevantes.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The described redirection comes from documentation and has not been independently verified.", "limitations_es": "La redirección descrita procede de la documentación y no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/upa/ofpot/blob/master/README.md", "source_packet_sha256": "1b3ecbe36abf217361698ded4a16cfe0fc9bf0d27eb42ea123eb19d1830365db", "source_sha": "0ddb79359659083c4c355abf656eeb62f97d563e", "source_title": "upa/ofpot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-upa-ofpot", "kind": "software", "name": "OFPOT", "organization": "upa", "reviewed_at": "2026-10-04", "slug": "gh3-upa-ofpot", "source_url": "https://github.com/upa/ofpot", "status": "published", "summary_en": "OpenFlow application for POX that detects unused IP addresses through ARP snooping and redirects traffic destined for them to a specified honeypot. It is deception-routing infrastructure, not the destination honeypot.", "summary_es": "Aplicación OpenFlow para POX que detecta direcciones IP sin usar mediante observación de ARP y redirige hacia un honeypot especificado el tráfico destinado a ellas. Es infraestructura de redirección para el engaño, no el honeypot de destino.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The described features are documented, not independently verified; HTTP and SCADA are listed as future protocols.", "limitations_es": "Las funciones descritas proceden de la documentación y no se han verificado de forma independiente; HTTP y SCADA figuran como protocolos futuros.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/utoni/potd/blob/master/README.md", "source_packet_sha256": "fe53c4e4c231d8a549f489b77df96794be6c80561d23a6471ec059ecf80fc064", "source_sha": "cd42252f6fa43538b34a738d09e609a6c6128105", "source_title": "utoni/potd repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-utoni-potd", "kind": "software", "name": "potd", "organization": "utoni", "reviewed_at": "2026-10-04", "slug": "gh3-utoni-potd", "source_url": "https://github.com/utoni/potd", "status": "published", "summary_en": "Pre-alpha honeypot daemon documented to filter and redirect SSH traffic to a protocol handler and then to a sandbox if the connection is accepted.", "summary_es": "Daemon de honeypot en estado prealfa que, según la documentación, filtra y redirige tráfico SSH a un manejador de protocolo y después a un entorno aislado si se acepta la conexión.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "These features are documented, but their behavior has not been independently verified.", "limitations_es": "Estas funciones están documentadas, pero su comportamiento no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/victpork/sshsyrup/blob/master/README.md", "source_packet_sha256": "5bc2576533d0323261aa845cd5ca3679cdaf7fffc6777d174449551d82c7e9b7", "source_sha": "94e137b58532ca3f167229f223d791ac3476febf", "source_title": "victpork/sshsyrup repository", "tags": [], "techniques": ["Honeypot", "Adversary engagement"]}, "evidence": "repository-documentation", "id": "gh3-victpork-sshsyrup", "kind": "software", "name": "Syrup (sshsyrup)", "organization": "victpork", "reviewed_at": "2026-10-04", "slug": "gh3-victpork-sshsyrup", "source_url": "https://github.com/victpork/sshsyrup", "status": "published", "summary_en": "Go-based SSH honeypot with a fake shell and virtual filesystem; its documentation describes session recording, SFTP/SCP transfers, and JSON activity logs.", "summary_es": "Honeypot SSH en Go con shell y sistema de archivos simulados; documenta el registro de sesiones, transferencias SFTP/SCP y actividad en JSON.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "third-provider-adjudication", "environments": [], "limitations_en": "Available documentation is limited to the repository title; no functional capabilities or environments are described, so techniques cannot be inferred and the project cannot be classified as a honeypot.", "limitations_es": "La documentación disponible se limita al título del repositorio; no se describen capacidades funcionales ni entornos, por lo que no pueden inferirse técnicas ni clasificarse el proyecto como honeypot.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/weboide/esp8266-wifi-honeypot/blob/d1e4e115f7ded777e23276afcd9cb1fe67de95f1/README.md", "source_packet_sha256": "62297fa7f6daaeec5930aa84fa7bd3c168992ead60b461bd54b3a64d4413416b", "source_sha": "7e31b8413c4540af1c5f312303001042cb022fd3", "source_title": "weboide/esp8266-wifi-honeypot repository", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-weboide-esp8266-wifi-honeypot", "kind": "software", "name": "ESP8266-wifi-honeypot", "organization": "weboide", "reviewed_at": "2026-10-04", "slug": "gh3-weboide-esp8266-wifi-honeypot", "source_url": "https://github.com/weboide/esp8266-wifi-honeypot", "status": "published", "summary_en": "Repository whose README contains only the heading '# ESP8266-wifi-honeypot', with no descriptive text. No functional capabilities are documented beyond the project name.", "summary_es": "Repositorio cuyo README únicamente contiene el título '# ESP8266-wifi-honeypot', sin texto descriptivo. No se documentan capacidades funcionales más allá del nombre del proyecto.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network", "Endpoint"], "limitations_en": "The documentation notes that a legacy libssh-based branch is not fully tested and is buggy; the described behavior has not been independently verified.", "limitations_es": "La documentación indica que una rama legacy basada en libssh no está completamente probada y contiene errores; el comportamiento descrito no ha sido verificado de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/wisepythagoras/honeyshell/blob/9931003058380549c7fe55845055bac96fe81042/README.md", "source_packet_sha256": "82e063c817cc73e3c3ecd7a8957bb2bba1b76e5e51a396ad9b43b950566dfb8f", "source_sha": "ea2d45334efa603a64055068b682cfdded8c0b2c", "source_title": "wisepythagoras/honeyshell repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-wisepythagoras-honeyshell", "kind": "software", "name": "Honeyshell", "organization": "wisepythagoras", "reviewed_at": "2026-10-04", "slug": "gh3-wisepythagoras-honeyshell", "source_url": "https://github.com/wisepythagoras/honeyshell", "status": "published", "summary_en": "Extensible SSH honeypot written in Go using crypto/ssh to accept connections and log failed login attempts, including usernames and passwords. It supports dropping process privileges and includes a Lua-based plugin engine to process captured information, plus a virtual filesystem to more convincingly emulate a system.", "summary_es": "Honeypot SSH extensible escrito en Go que utiliza crypto/ssh para aceptar conexiones y registrar los intentos de inicio de sesión fallidos, incluyendo usuarios y contraseñas. Admite reducir privilegios del proceso y cuenta con un motor de plugins en Lua para procesar la información capturada, además de un sistema de archivos virtual para emular un sistema de forma más convincente.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "This description reflects only what the project's README documents; its runtime behavior has not been independently verified.", "limitations_es": "Esta descripción refleja únicamente lo que documenta el README del proyecto; no se ha verificado de forma independiente su comportamiento en ejecución.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/x0rz/ssh-honeypot/blob/a5e89ea38f4021ab83964eff56661ff84c32da47/README.md", "source_packet_sha256": "0b68da8ad0469009beb2517bf36abcb764379968ffbfae09e7510f793c773626", "source_sha": "293a2a7b67ce84a629c94c0d9aee4cf4bfb04a15", "source_title": "x0rz/ssh-honeypot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-x0rz-ssh-honeypot", "kind": "software", "name": "SSH Honeypot (x0rz)", "organization": "x0rz", "reviewed_at": "2026-10-04", "slug": "gh3-x0rz-ssh-honeypot", "source_url": "https://github.com/x0rz/ssh-honeypot", "status": "published", "summary_en": "A C program that listens for incoming SSH connections and logs the IP address, username, and password used, written to gather rudimentary intelligence on brute force attacks.", "summary_es": "Programa en C que escucha conexiones SSH entrantes y registra la dirección IP, el nombre de usuario y la contraseña utilizados, escrito para recopilar inteligencia básica sobre ataques de fuerza bruta.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "Behavior is documented, not independently verified; the mirror does not establish active maintenance or code identity.", "limitations_es": "El comportamiento solo está documentado, no verificado de forma independiente; el espejo no demuestra mantenimiento activo ni identidad del código.", "original_url": "https://github.com/xiaoxiaoleo/HoneyMysql", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "three-ai-source-page-agreement", "source_document_url": "https://github.com/supriyo-biswas/HoneyMysql/blob/46b555cf972927b74caaeb164171f6a90a576c70/README.md", "source_packet_sha256": "12133a92482348134f9aae2377fb011e66f922cb6c6b9f2b998bf2e241a121e8", "source_sha": "c911af2fd44e17a0edadf09936088d1ca99ff46a", "source_title": "HoneyMysql", "tags": [], "techniques": ["Honeypot"]}, "evidence": "mirrored-author-documentation", "id": "gh3-xiaoxiaoleo-honeymysql", "kind": "software", "name": "HoneyMysql", "organization": "xiaoxiaoleo", "reviewed_at": "2026-10-04", "slug": "gh3-xiaoxiaoleo-honeymysql", "source_url": "https://github.com/supriyo-biswas/HoneyMysql", "status": "published", "summary_en": "MySQL honeypot project described in a README preserved in a mirror repository.", "summary_es": "Proyecto de honeypot de MySQL descrito en un README conservado en un repositorio espejo.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": [], "limitations_en": "The function is documented but has not been independently verified.", "limitations_es": "La función está documentada, pero no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/xlfe/cowrie2neo/blob/master/README.md", "source_packet_sha256": "4ebeafdb2a392932edfa757b15420f641d4c064f4139549e475a0d83e35766f1", "source_sha": "1dd944e5fd340bb7adbd1e9587bd5850344c178b", "source_title": "xlfe/cowrie2neo repository", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-xlfe-cowrie2neo", "kind": "software", "name": "cowrie2neo", "organization": "xlfe", "reviewed_at": "2026-10-04", "slug": "gh3-xlfe-cowrie2neo", "source_url": "https://github.com/xlfe/cowrie2neo", "status": "published", "summary_en": "Tool that parses Cowrie honeypot logs into a Neo4j database; it supports analysis infrastructure rather than being presented as a honeypot.", "summary_es": "Herramienta que analiza registros del honeypot Cowrie y los incorpora a una base de datos Neo4j; sirve a la infraestructura de análisis, no se presenta como honeypot.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The behavior is documented but has not been independently verified.", "limitations_es": "El comportamiento está documentado, pero no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/xme/dshield-docker/blob/master/README.md", "source_packet_sha256": "e512e09ef28650f7d7a5c54b86469d81ce769d2f05009aced51a82b3faee4ca6", "source_sha": "b78ce925d35d534f3fe42736b45e99bed93ce77c", "source_title": "xme/dshield-docker repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-xme-dshield-docker", "kind": "software", "name": "DShield Docker", "organization": "xme", "reviewed_at": "2026-10-04", "slug": "gh3-xme-dshield-docker", "source_url": "https://github.com/xme/dshield-docker", "status": "published", "summary_en": "Docker container that starts a Cowrie-based SSH honeypot and enables statistics reporting to DShield.", "summary_es": "Contenedor Docker que inicia un honeypot SSH basado en Cowrie y habilita el envío de estadísticas a DShield.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "This description reflects only what the project's README documents, including outstanding tasks noted by the author; its functioning has not been independently verified.", "limitations_es": "Esta descripción refleja únicamente lo documentado en el README del proyecto, incluyendo tareas pendientes señaladas por el autor; no se ha verificado de forma independiente su funcionamiento.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_commit": null, "source_document_url": "https://github.com/ytisf/apate/blob/ace57f346f5db275083579aa79046323a8e5094e/README.md", "source_packet_sha256": "f518599cfc73ea0eccb218a07d3edd98054e476550f1b4274d475709ed13bfcb", "source_sha": "74a7718de887af46b7c80ff6706b2c50cb7f6d61", "source_title": "ytisf/apate repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-ytisf-apate", "kind": "software", "name": "Apate", "organization": "ytisf", "reviewed_at": "2026-10-04", "slug": "gh3-ytisf-apate", "source_url": "https://github.com/ytisf/apate", "status": "published", "summary_en": "A user-friendly, CISO-friendly configuration, management and acquisition tool for honeyd that provides a usable interface for configuring, deploying honeypots and receiving their logs from a central server.", "summary_es": "Herramienta de configuración, gestión y adquisición orientada a usuarios y CISOs para honeyd, que proporciona una interfaz usable para configurar, desplegar honeypots virtuales y recibir sus registros desde un servidor central.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": "support-only-not-honeypot", "draft_review_basis": "independent-second-provider-review", "environments": [], "limitations_en": "The function is documented but has not been independently verified.", "limitations_es": "La función está documentada, pero no se ha verificado de forma independiente.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": ["Honeypot"], "review_basis": "repository-documentation", "screening_basis": "two-ai-source-quoted-agreement", "source_document_url": "https://github.com/yuchincheng/HpfeedsHoneyGraph/blob/master/README.md", "source_packet_sha256": "7c6a424b8429a9537df1d55878a4a34c90b52a50e09cd7aa8d53991ebbbcb5cd", "source_sha": "c886c6ec9556c700ce9806f783f735319ae29808", "source_title": "yuchincheng/HpfeedsHoneyGraph repository", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-yuchincheng-hpfeedshoneygraph", "kind": "software", "name": "HpfeedsHoneyGraph", "organization": "yuchincheng", "reviewed_at": "2026-10-04", "slug": "gh3-yuchincheng-hpfeedshoneygraph", "source_url": "https://github.com/yuchincheng/HpfeedsHoneyGraph", "status": "published", "summary_en": "Application for visualizing hpfeeds logs; it is adjacent infrastructure for analyzing deception-related data, not presented as a honeypot.", "summary_es": "Aplicación para visualizar registros de hpfeeds; es infraestructura adyacente para analizar datos vinculados al engaño, no se presenta como honeypot.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network", "Application"], "limitations_en": "The project itself warns that it is in a research and development phase and errors should be expected; this description is based solely on documentation and has not been independently verified.", "limitations_es": "El propio proyecto advierte que está en fase de investigación y desarrollo y que deben esperarse errores; esta descripción se basa solo en lo documentado y no ha sido verificada de forma independiente.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_commit": null, "source_document_url": "https://github.com/zdresearch/owasp-honeypot/blob/5482fdcc0b828a5d3acf354910843b907e92032a/readme.md", "source_packet_sha256": "a2bc1d95f1c5d8db7c3873dc0efcf39e46d1e68bf919afe72fb67a543e74314a", "source_sha": "83881d1335819589b6f92ea8ccc9905e1718c667", "source_title": "zdresearch/owasp-honeypot repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-zdresearch-owasp-honeypot", "kind": "software", "name": "OWASP Honeypot", "organization": "zdresearch", "reviewed_at": "2026-10-04", "slug": "gh3-zdresearch-owasp-honeypot", "source_url": "https://github.com/zdresearch/owasp-honeypot", "status": "published", "summary_en": "Open-source Python software designed for creating honeypot and honeynet setups in an easy and secure way, compatible with Python 3.x and tested on Mac OS X and Linux, with example modules for FTP, HTTP, and SSH deployed via containers.", "summary_es": "Software de código abierto en Python diseñado para crear honeypots y honeynets de forma sencilla y segura, compatible con Python 3.x y probado en macOS y Linux, con módulos de ejemplo para FTP, HTTP y SSH desplegados mediante contenedores.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Cloud", "Network", "Application"], "limitations_en": "Behavior is documented, not independently verified; the façade is not a real Kubernetes control plane.", "limitations_es": "El comportamiento se describe en la documentación, pero no se ha verificado de forma independiente; la fachada no es un plano de control Kubernetes real.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/Zeerg/helix-honeypot/blob/develop/readme.md", "source_packet_sha256": "9cc7d1f5c9bedd04f3ed9b3c8159a0c5ce9c83ce4fbc312ba317c5c037c4edec", "source_sha": "52c187cc672b5e1982abe40dab19e472f6a2f8a5", "source_title": "Zeerg/helix-honeypot repository", "tags": [], "techniques": ["Honeypot", "Honeytoken", "Decoy"]}, "evidence": "repository-documentation", "id": "gh3-zeerg-helix-honeypot", "kind": "software", "name": "Helix Honeypot", "organization": "Zeerg", "reviewed_at": "2026-10-04", "slug": "gh3-zeerg-helix-honeypot", "source_url": "https://github.com/Zeerg/helix-honeypot", "status": "published", "summary_en": "Decoy software documenting bounded simulated responses for Kubernetes and Docker APIs, Ollama and other AI APIs, a misconfigured kubelet, and HTTP probes; it records TCP and UDP interactions without replying. It supports synthetic Secret honeytokens.", "summary_es": "Software señuelo que simula respuestas acotadas de las API de Kubernetes y Docker, Ollama y otras API de IA, un kubelet mal configurado y sondas HTTP; registra interacciones TCP y UDP sin responder. Admite Secrets sintéticos como honeytokens.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "archive_html_sha256": null, "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "This description reflects only what is documented in the project's README; its behavior and effectiveness against real threats have not been independently verified.", "limitations_es": "Esta descripción refleja únicamente lo documentado en el README del proyecto; no se ha verificado de forma independiente su comportamiento ni su efectividad frente a amenazas reales.", "original_url": null, "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "third-ai-source-quoted-adjudication", "source_commit": null, "source_document_url": "https://github.com/zeroq/amun/blob/55714deb61b24a92e3ad700fce6e04f8194d3c33/README.md", "source_packet_sha256": "51e59b2ee0747f7367be9d4fe938a832844f1ff8cc70c2778be613bc76f0b8cb", "source_sha": "4b3b54cfb3fc048ff2701653839d9415851c52d9", "source_title": "zeroq/amun repository", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "gh3-zeroq-amun", "kind": "software", "name": "Amun", "organization": "zeroq", "reviewed_at": "2026-10-04", "slug": "gh3-zeroq-amun", "source_url": "https://github.com/zeroq/amun", "status": "published", "summary_en": "Amun is a Python-based low-interaction honeypot, described as the first of its kind, following Nepenthes' concepts while extending emulation. Per its documentation, it logs exploitation attempts, malware downloads, and unknown shellcode across separate log files.", "summary_es": "Amun es un honeypot de baja interacción basado en Python, descrito como el primero de su tipo, que sigue los conceptos de Nepenthes pero extiende la emulación. Según la documentación, registra intentos de explotación, descargas de malware y shellcodes desconocidos en distintos archivos de log.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": [], "limitations_en": "The documentation is incomplete; behavior and deployment are documented, not independently verified.", "limitations_es": "La información procede de documentación incompleta y no se ha verificado de forma independiente el comportamiento ni el despliegue.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "repository-documentation", "screening_basis": "audited-three-ai-source-quoted-agreement", "source_document_url": "https://github.com/Ziemeck/bifrozt-ansible/blob/master/README.md", "source_packet_sha256": "3697247ffb9f6a2d6b1f97016848b4dbf559c84b8be103761c808afdf6709085", "source_sha": "85fe21bc7f4c487d4c136295b7939b30193ad422", "source_title": "Ziemeck/bifrozt-ansible repository", "tags": [], "techniques": []}, "evidence": "repository-documentation", "id": "gh3-ziemeck-bifrozt-ansible", "kind": "software", "name": "bifrozt-ansible", "organization": "Ziemeck", "reviewed_at": "2026-10-04", "slug": "gh3-ziemeck-bifrozt-ansible", "source_url": "https://github.com/Ziemeck/bifrozt-ansible", "status": "published", "summary_en": "Ansible deployment repository for Bifrozt. Its deception link is its reference to installation documentation and honeypot risks; the README does not say this repository is itself a honeypot.", "summary_es": "Repositorio de despliegue de Bifrozt mediante Ansible. Su vínculo con el engaño es la referencia a documentación de instalación y riesgos de honeypots; el README no afirma que este repositorio sea un honeypot.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": {"limitations_en": "A web honeypot may need adaptation to resemble modern applications; that fit was not tested here.", "limitations_es": "Un proyecto de honeypot web puede necesitar adaptación para parecerse a aplicaciones modernas; aquí no se verificó ese ajuste.", "observation_en": "Documentation places the project in web-application deception.", "observation_es": "La documentación ubica el proyecto en el engaño de aplicaciones web.", "question_en": "What signals distinguish bulk automated traffic from investigable interaction?", "question_es": "¿Qué señales distinguen tráfico automatizado masivo de interacción investigable?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Application"], "review_basis": "repository-metadata", "source_title": "Glastopf", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "glastopf", "kind": "software", "name": "Glastopf", "organization": "mushorg", "reviewed_at": "2026-09-15", "slug": "glastopf", "source_url": "https://github.com/mushorg/glastopf", "status": "published", "summary_en": "Web application honeypot recording interactions with simulated attack surfaces.", "summary_es": "Honeypot para aplicaciones web que registra interacciones con superficies simuladas.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "doi": "10.1109/eurospw59978.2023.00057", "environments": ["Network"], "review_basis": "publisher-metadata", "source_title": "Honey Infiltrator: Injecting Honeytoken Using Netfilter", "tags": [], "techniques": ["Honeytoken"]}, "evidence": "publisher-metadata", "id": "honey-infiltrator-2023", "kind": "paper", "name": "Honey Infiltrator: Injecting Honeytoken Using Netfilter", "organization": "Publication authors", "reviewed_at": "2026-09-15", "slug": "honey-infiltrator-2023", "source_url": "https://doi.org/10.1109/eurospw59978.2023.00057", "status": "published", "summary_en": "DOI-identified publication on injecting honeytokens using Netfilter; text analysis is pending.", "summary_es": "Publicación identificada por DOI sobre inserción de honeytokens con Netfilter; análisis pendiente del texto.", "updated_at": "2026-09-15", "year": 2023}
{"critical_reading": {"limitations_en": "Metrics, field conditions and negative outcomes were not extracted from the full text.", "limitations_es": "No se extrajeron del texto completo métricas, condiciones de campo ni resultados negativos.", "observation_en": "The abstract describes an architecture and evaluation of a language-model terminal honeypot.", "observation_es": "El abstract describe arquitectura y evaluación de un honeypot de terminal con modelo de lenguaje.", "question_en": "What was the baseline, and how was decoy realism measured?", "question_es": "¿Cuál fue el baseline y cómo se midió que el señuelo parecía auténtico?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "design_en": "LLM terminal architecture evaluated with response, session-length and interaction metrics.", "design_es": "Arquitectura de terminal con LLM evaluada con métricas de respuesta, longitud e interacción.", "environments": ["Network"], "finding_en": "In the reported tests, GPT variants respond to more commands and sessions than Cowrie.", "finding_es": "En las pruebas informadas, las variantes GPT responden a más comandos y sesiones que Cowrie.", "full_text_reviewed_at": "2026-09-16", "limits_en": "Metrics favor response coverage; they do not prove credibility against human adversaries or sustained cost.", "limits_es": "Las métricas favorecen cobertura de respuesta; no prueban credibilidad ante adversarios humanos ni costo sostenido.", "review_basis": "full-text", "source_title": "HoneyGPT: Breaking the Trilemma in Terminal Honeypots with Large Language Model", "tags": [], "techniques": ["Honeypot"]}, "evidence": "full-text-review", "id": "honeygpt-2024", "kind": "paper", "name": "HoneyGPT: Breaking the Trilemma in Terminal Honeypots with Large Language Model", "organization": "Wang et al.", "reviewed_at": "2026-09-16", "slug": "honeygpt-2024", "source_url": "https://arxiv.org/abs/2406.01882", "status": "published", "summary_en": "Presents a language-model terminal honeypot architecture and describes a field evaluation.", "summary_es": "Presenta una arquitectura de honeypot de terminal con modelo de lenguaje y describe su evaluación en campo.", "updated_at": "2026-09-18", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-10-02", "adjudication_status": "not performed", "design_en": "White-box and black-box analysis of 20 Canarytokens honeytoken types, followed by an artifact-based fingerprinting proof of concept. The evaluation is limited to that implementation and version.", "design_es": "Análisis de caja blanca y negra de 20 tipos de honeytoken de Canarytokens, seguido de una prueba de concepto de identificación basada en artefactos del token. La evaluación se limita a esa implementación y versión.", "doi": "10.1007/978-3-031-22295-5_6", "environments": ["Application", "Identity"], "extraction_status": "single-reviewer source-bounded full-text synthesis", "finding_en": "The prototype identified 14 of the 20 studied types in the described configuration. The authors note possible false positives and describe types the tool does not cover.", "finding_es": "El prototipo identificó 14 de los 20 tipos estudiados en la configuración descrita. Los autores señalan posibles falsos positivos y describen tipos que la herramienta no cubre.", "full_text_reviewed_at": "2026-10-02", "full_text_source_url": "https://vbn.aau.dk/ws/portalfiles/portal/513321187/978_3_031_22295_5_6.pdf", "limitations_en": "14/20 is coverage of one provider’s token types, not success against diverse deployments or a measure of real attacker evasion. Code and templates may have changed since 2022.", "limitations_es": "14/20 es cobertura de tipos de un proveedor, no una tasa de éxito frente a despliegues diversos ni una medida de evasión de atacantes reales. El código y las plantillas pueden haber cambiado desde 2022.", "limits_en": "14/20 is coverage of one provider’s token types, not success against diverse deployments or a measure of real attacker evasion. Code and templates may have changed since 2022.", "limits_es": "14/20 es cobertura de tipos de un proveedor, no una tasa de éxito frente a despliegues diversos ni una medida de evasión de atacantes reales. El código y las plantillas pueden haber cambiado desde 2022.", "page_anchors": ["PDF pp. 7–13, Sections 4–6, Table 1, Figure 3"], "prior_summary_en": "Study of artifacts that allow recognition of Canarytokens honeytokens without triggering some alerts.", "prior_summary_es": "Estudio de artefactos que permiten reconocer honeytokens de Canarytokens sin activar ciertas alertas.", "provenance_note_en": "The full text was examined and locators were retained. Single-reviewer synthesis without independent extraction or formal quality appraisal.", "provenance_note_es": "Se examinó el texto completo y se conservaron localizadores. Síntesis de un revisor, sin extracción independiente ni evaluación formal de calidad.", "review_basis": "full-text", "source_language": "en", "source_title": "Honeysweeper: Towards Stealthy Honeytoken Fingerprinting Techniques", "tags": ["open-access"], "techniques": ["Honeytoken"]}, "evidence": "full-text-review", "id": "honeysweeper-2022", "kind": "paper", "name": "Honeysweeper: Towards Stealthy Honeytoken Fingerprinting Techniques", "organization": "Msaad et al.", "reviewed_at": "2026-10-02", "slug": "honeysweeper-2022", "source_url": "https://vbn.aau.dk/ws/portalfiles/portal/513321187/978_3_031_22295_5_6.pdf", "status": "published", "summary_en": "The prototype identified 14 of the 20 studied types in the described configuration. The authors note possible false positives and describe types the tool does not cover.", "summary_es": "El prototipo identificó 14 de los 20 tipos estudiados en la configuración descrita. Los autores señalan posibles falsos positivos y describen tipos que la herramienta no cubre.", "updated_at": "2026-10-02", "year": 2022}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "design_en": "Authentication prototype combining real and decoy codes with a TOTP-based second factor.", "design_es": "Prototipo de autenticación que combina códigos reales y señuelo con un segundo factor basado en TOTP.", "environments": ["Identity"], "finding_en": "Aims to detect use of stolen secrets while retaining compatibility with common authenticators.", "finding_es": "Busca detectar uso de secretos robados y conservar compatibilidad con autenticadores habituales.", "full_text_reviewed_at": "2026-09-16", "limits_en": "Evaluation is a prototype and attack analysis; user study and deployment at scale are missing.", "limits_es": "La evaluación es de prototipo y análisis de ataques; faltan estudio de usuarios y despliegue a escala.", "review_basis": "full-text", "source_language": "en", "source_title": "Cybersecurity Revisited: Honeytokens Meet Google Authenticator", "tags": ["open-access"], "techniques": ["Honeytoken"]}, "evidence": "full-text-review", "id": "honeytoken-auth-2021", "kind": "paper", "name": "Cybersecurity Revisited: Honeytokens Meet Google Authenticator", "organization": "Papaspirou et al.", "reviewed_at": "2026-09-16", "slug": "honeytoken-auth-2021", "source_url": "https://arxiv.org/abs/2112.08431", "status": "published", "summary_en": "Two-factor authentication mechanism combining decoy codes with Google Authenticator.", "summary_es": "Mecanismo de autenticación de dos factores que combina códigos señuelo y Google Authenticator.", "updated_at": "2026-09-18", "year": 2021}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "doi": "10.1145/3433174.3433599", "environments": ["Identity"], "review_basis": "publisher-metadata", "source_title": "Towards Systematic Honeytoken Fingerprinting", "tags": [], "techniques": ["Honeytoken"]}, "evidence": "publisher-metadata", "id": "honeytoken-fingerprinting-2020", "kind": "paper", "name": "Towards Systematic Honeytoken Fingerprinting", "organization": "Publication authors", "reviewed_at": "2026-09-15", "slug": "honeytoken-fingerprinting-2020", "source_url": "https://doi.org/10.1145/3433174.3433599", "status": "published", "summary_en": "DOI-identified publication on honeytoken fingerprinting methods; text analysis is pending.", "summary_es": "Publicación identificada por DOI sobre métodos de identificación de honeytokens; análisis pendiente del texto.", "updated_at": "2026-09-15", "year": 2020}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "doi": "10.1145/3689935.3690394", "environments": ["Identity"], "review_basis": "publisher-metadata", "source_title": "Act as a Honeytoken Generator! An Investigation into Honeytoken Generation with Large Language Models", "tags": [], "techniques": ["Honeytoken"]}, "evidence": "publisher-metadata", "id": "honeytoken-generator-2024", "kind": "paper", "name": "Act as a Honeytoken Generator! An Investigation into Honeytoken Generation with Large Language Models", "organization": "Publication authors", "reviewed_at": "2026-09-15", "slug": "honeytoken-generator-2024", "source_url": "https://doi.org/10.1145/3689935.3690394", "status": "published", "summary_en": "DOI-identified publication on language-model honeytoken generation; text analysis is pending.", "summary_es": "Publicación identificada por DOI sobre generación de honeytokens mediante modelos de lenguaje; análisis pendiente del texto.", "updated_at": "2026-09-15", "year": 2024}
{"critical_reading": {"limitations_en": "A framework requires design, operation and further testing; it does not itself provide measured detection.", "limitations_es": "Un framework exige diseño, operación y pruebas adicionales; no aporta por sí mismo una detección medida.", "observation_en": "The repository describes a framework for building honeypot sensors.", "observation_es": "El repositorio describe un framework para construir sensores honeypot.", "question_en": "Which modules and protocols are maintained, and which require custom work?", "question_es": "¿Qué módulos y protocolos están mantenidos y cuáles requieren desarrollo propio?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Network"], "review_basis": "repository-metadata", "source_title": "Honeytrap", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "honeytrap", "kind": "software", "name": "Honeytrap", "organization": "Honeytrap contributors", "reviewed_at": "2026-09-15", "slug": "honeytrap", "source_url": "https://github.com/honeytrap/honeytrap", "status": "published", "summary_en": "Open framework for building and operating honeypot sensors.", "summary_es": "Framework abierto para crear y operar sensores honeypot.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "design_en": "Design of per-account honeywords and a separate honeychecker; analyzes generation, attacks and operation.", "design_es": "Diseño de honeywords por cuenta y un honeychecker separado; analiza generación, ataques y operación.", "doi": "10.1145/2508859.2516671", "environments": ["Identity"], "finding_en": "Turns use of a false credential into a signal that the password file was compromised.", "finding_es": "Convierte el uso de una credencial falsa en una señal de compromiso del archivo de hashes.", "full_text_reviewed_at": "2026-09-16", "limits_en": "Effectiveness depends on indistinguishable honeywords, honeychecker protection and safe false-alarm handling.", "limits_es": "La eficacia depende de honeywords indistinguibles, protección del honeychecker y gestión segura de falsas alarmas.", "review_basis": "full-text", "source_language": "en", "source_title": "Honeywords: Making Password-Cracking Detectable", "tags": ["open-access"], "techniques": ["Honeytoken"]}, "evidence": "full-text-review", "id": "honeywords-2013", "kind": "paper", "name": "Honeywords: Making Password-Cracking Detectable", "organization": "Juels & Rivest", "reviewed_at": "2026-09-16", "slug": "honeywords-2013", "source_url": "https://people.csail.mit.edu/rivest/pubs/JR13.pdf", "status": "published", "summary_en": "Proposal for false passwords per account and a separate honeychecker that detects their use.", "summary_es": "Propuesta de contraseñas falsas asociadas a cada cuenta y un honeychecker separado para detectar su uso.", "updated_at": "2026-09-18", "year": 2013}
{"critical_reading": {"limitations_en": "Two incidents illustrate behavior; they do not establish a general success rate.", "limitations_es": "Dos incidentes ilustran conducta; no establecen una tasa de éxito general.", "observation_en": "IBM X-Force describes two incidents in simulated organizations with fake documents.", "observation_es": "IBM X-Force describe dos incidentes en organizaciones simuladas con documentos falsos.", "question_en": "Which parts of the simulation shaped the observed behavior?", "question_es": "¿Qué partes de la simulación condicionaron la conducta observada?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Endpoint", "OT/ICS"], "review_basis": "source-page", "source_title": "Trapping a Mustang Panda", "tags": [], "techniques": ["Decoy", "Adversary engagement"]}, "evidence": "threat-research-observation", "id": "ibm-itg27-deception-2026", "kind": "case-study", "name": "Trapping a Mustang Panda", "organization": "IBM X-Force", "reviewed_at": "2026-09-15", "slug": "ibm-itg27-deception-2026", "source_url": "https://www.ibm.com/think/x-force/trapping-a-mustang-panda", "status": "published", "summary_en": "IBM X-Force and Deception.Pro recorded two incidents in simulated organizations, observing reconnaissance, malware deployment and fake-document exfiltration.", "summary_es": "IBM X-Force y Deception.Pro registraron dos incidentes en organizaciones simuladas y observaron reconocimiento, despliegue de malware y exfiltración de documentos falsos.", "updated_at": "2026-09-15", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-02", "adjudication_status": "not performed", "design_en": "An 81-day observation in 2015 with IoTPOT on 87 IP addresses and 29 Telnet profiles; combines low-interaction responses with IoTBOX environments spanning eight architectures.", "design_es": "Observación de 81 días en 2015 con IoTPOT en 87 direcciones IP y 29 perfiles Telnet; combina respuestas de baja interacción con entornos IoTBOX de ocho arquitecturas.", "doi": "10.2197/ipsjjip.24.522", "environments": ["IoT", "Network"], "extraction_status": "single-reviewer source-bounded full-text synthesis", "finding_en": "The authors recorded 180,581 visiting IP addresses and 481,521 download attempts, manually collected 106 binaries, and described five malware families.", "finding_es": "Los autores registraron 180.581 IP visitantes y 481.521 intentos de descarga, reunieron manualmente 106 binarios y describieron cinco familias de malware.", "full_text_reviewed_at": "2026-10-02", "full_text_source_url": "https://www.jstage.jst.go.jp/article/ipsjjip/24/3/24_522/_pdf/-char/en", "limitations_en": "The counts concern exposed Telnet sensors in 2015, not a controlled effectiveness comparison or current threats. Binary collection and analysis were selective.", "limitations_es": "Los conteos corresponden a sensores Telnet expuestos en 2015, no a una comparación controlada de eficacia ni a amenazas actuales. La recolección y el análisis de binarios fueron selectivos.", "limits_en": "The counts concern exposed Telnet sensors in 2015, not a controlled effectiveness comparison or current threats. Binary collection and analysis were selective.", "limits_es": "Los conteos corresponden a sensores Telnet expuestos en 2015, no a una comparación controlada de eficacia ni a amenazas actuales. La recolección y el análisis de binarios fueron selectivos.", "page_anchors": ["PDF pp. 524–528, Sections 3.2–5.1", "PDF pp. 529–531, Sections 6–7"], "prior_summary_en": "Observational study of IoT Telnet honeypots with 81 days of telemetry and malware analysis.", "prior_summary_es": "Estudio observacional de honeypots Telnet para IoT, con telemetría de 81 días y análisis de malware.", "provenance_note_en": "The full text was examined and locators were retained. Single-reviewer synthesis without independent extraction or formal quality appraisal.", "provenance_note_es": "Se examinó el texto completo y se conservaron localizadores. Síntesis de un revisor, sin extracción independiente ni evaluación formal de calidad.", "review_basis": "full-text", "source_language": "en", "source_title": "IoTPOT: A Novel Honeypot for Revealing Current IoT Threats", "tags": ["open-access"], "techniques": ["Honeypot"]}, "evidence": "full-text-review", "id": "iotpot-2016", "kind": "paper", "name": "IoTPOT: A Novel Honeypot for Revealing Current IoT Threats", "organization": "Pa Pa et al.", "reviewed_at": "2026-10-02", "slug": "iotpot-2016", "source_url": "https://www.jstage.jst.go.jp/article/ipsjjip/24/3/24_522/_pdf/-char/en", "status": "published", "summary_en": "The authors recorded 180,581 visiting IP addresses and 481,521 download attempts, manually collected 106 binaries, and described five malware families.", "summary_es": "Los autores registraron 180.581 IP visitantes y 481.521 intentos de descarga, reunieron manualmente 106 binarios y describieron cinco familias de malware.", "updated_at": "2026-10-02", "year": 2016}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "environments": ["Network"], "review_basis": "source-page", "source_title": "Managed Deception Service", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "provider-offering", "id": "lastnode-managed-deception", "kind": "service", "name": "Managed Deception Service", "organization": "LastNode", "reviewed_at": "2026-09-15", "slug": "lastnode-managed-deception", "source_url": "https://lastnode.com/deception", "status": "published", "summary_en": "Deception operated by LastNode, according to its service page.", "summary_es": "Servicio de deception operado por LastNode, según su página de oferta.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": {"limitations_en": "This record did not review the full text, evaluation or model maintenance costs.", "limitations_es": "La ficha no revisó el texto completo, la evaluación ni los costos de mantener el modelo.", "observation_en": "The abstract describes an interactive honeypot using a model fine-tuned with commands.", "observation_es": "El abstract describe un honeypot interactivo apoyado en un modelo ajustado con comandos.", "question_en": "How is response coherence measured against an attacker probing inconsistencies?", "question_es": "¿Cómo se mide coherencia de respuestas frente a un atacante que prueba inconsistencias?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "authors": ["Hakan T. Otal", "M. Abdullah Canbaz"], "design_en": "SSH honeypot prototype using an open model fine-tuned on malicious commands.", "design_es": "Prototipo de honeypot SSH con un modelo abierto ajustado sobre comandos maliciosos.", "environments": ["Network"], "finding_en": "Shows a route to interactive responses and richer session recording.", "finding_es": "Muestra una ruta para producir respuestas interactivas y registrar sesiones con mayor contexto.", "full_text_reviewed_at": "2026-09-16", "limits_en": "The evaluation is limited and does not establish long-term fingerprint resistance or production cost.", "limits_es": "La evaluación es acotada y no establece resistencia prolongada a fingerprinting ni costos de producción.", "review_basis": "full-text", "source_title": "LLM Honeypot: Leveraging Large Language Models as Advanced Interactive Honeypot Systems", "tags": [], "techniques": ["Honeypot"]}, "evidence": "full-text-review", "id": "llm-honeypot-2024", "kind": "paper", "name": "LLM Honeypot: Leveraging Large Language Models as Advanced Interactive Honeypot Systems", "organization": "Otal & Canbaz", "reviewed_at": "2026-09-16", "slug": "llm-honeypot-2024", "source_url": "https://arxiv.org/abs/2409.08234", "status": "published", "summary_en": "Presents an interactive honeypot using a language model fine-tuned with attacker command data.", "summary_es": "Presenta un honeypot interactivo basado en un modelo de lenguaje ajustado con datos de comandos de atacantes.", "updated_at": "2026-09-18", "year": 2024}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "environments": ["OT/ICS", "Network"], "review_basis": "source-page", "source_title": "DeepSea Managed OT Deception", "tags": [], "techniques": ["Decoy"]}, "evidence": "provider-offering", "id": "maindefense-deepsea", "kind": "service", "name": "DeepSea Managed OT Deception", "organization": "MainDefense", "reviewed_at": "2026-09-15", "slug": "maindefense-deepsea", "source_url": "https://maindefense.de/", "status": "published", "summary_en": "Managed IT and OT deception service published by MainDefense.", "summary_es": "Servicio gestionado de deception para IT y OT publicado por MainDefense.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "environments": ["Network"], "review_basis": "source-page", "source_title": "Deception as a Service", "tags": [], "techniques": ["Honeypot"]}, "evidence": "provider-offering", "id": "maple-deception-service", "kind": "service", "name": "Deception as a Service", "organization": "Maple Networks", "reviewed_at": "2026-09-15", "slug": "maple-deception-service", "source_url": "https://www.maple-networks.com/security/honeypots/", "status": "published", "summary_en": "Honeypot service offering published by Maple Networks.", "summary_es": "Oferta de honeypots operados como servicio publicada por Maple Networks.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": {"limitations_en": "A tag requires account governance; this site does not measure effectiveness.", "limitations_es": "Una etiqueta exige gobernanza de cuentas; la documentación no mide eficacia en este sitio.", "observation_en": "Microsoft documents honeytoken tags for accounts and devices.", "observation_es": "Microsoft documenta etiquetas honeytoken para cuentas y dispositivos.", "question_en": "Which legitimate activity can touch the account and create noise?", "question_es": "¿Qué actividad legítima puede tocar la cuenta y generar ruido?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Identity"], "review_basis": "source-page", "source_title": "Microsoft Defender for Identity Honeytoken Tags", "tags": [], "techniques": ["Honeytoken"]}, "evidence": "product-documentation", "id": "microsoft-defender-identity-honeytoken", "kind": "product", "name": "Microsoft Defender for Identity Honeytoken Tags", "organization": "Microsoft", "reviewed_at": "2026-09-15", "slug": "microsoft-defender-identity-honeytoken", "source_url": "https://learn.microsoft.com/en-us/defender-for-identity/entity-tags", "status": "published", "summary_en": "Documented feature tagging honeytoken accounts and devices; sign-ins generate Defender for Identity alerts.", "summary_es": "Función documentada para etiquetar cuentas y dispositivos honeytoken; la actividad de acceso genera alertas en Defender for Identity.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": {"limitations_en": "A taxonomy mapping does not imply a specific implementation works.", "limitations_es": "La correspondencia taxonómica no implica que una implementación concreta funcione.", "observation_en": "The MITRE knowledge base offers vocabulary for defensive techniques and decoys.", "observation_es": "La base de conocimiento MITRE ofrece vocabulario para técnicas defensivas y señuelos.", "question_en": "Which D3FEND technique best describes the behavior, beyond the commercial name?", "question_es": "¿Qué técnica D3FEND describe mejor el comportamiento, no solo el nombre comercial?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Network"], "review_basis": "source-page", "source_title": "MITRE D3FEND", "tags": [], "techniques": ["Decoy"]}, "evidence": "framework-documentation", "id": "mitre-d3fend", "kind": "framework", "name": "MITRE D3FEND", "organization": "MITRE", "reviewed_at": "2026-09-15", "slug": "mitre-d3fend", "source_url": "https://d3fend.mitre.org/", "status": "published", "summary_en": "Knowledge base of defensive techniques with terminology related to decoys.", "summary_es": "Base de conocimiento de técnicas defensivas que ofrece vocabulario relacionado con señuelos.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": {"limitations_en": "It is a planning framework, not a certification of product or campaign effectiveness.", "limitations_es": "Es un marco de planificación, no una certificación de eficacia de productos o campañas.", "observation_en": "MITRE documentation proposes a process to prepare, operate and understand engagement.", "observation_es": "La documentación de MITRE propone un proceso para planificar, operar y entender engagement.", "question_en": "Which hypotheses and operating limits are documented before deployment?", "question_es": "¿Qué hipótesis y límites de operación se documentan antes del despliegue?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Network", "Cloud"], "review_basis": "source-page", "source_title": "MITRE Engage", "tags": [], "techniques": ["Adversary engagement"]}, "evidence": "framework-documentation", "id": "mitre-engage", "kind": "framework", "name": "MITRE Engage", "organization": "MITRE", "reviewed_at": "2026-09-15", "slug": "mitre-engage", "source_url": "https://github.com/mitre/engage", "status": "published", "summary_en": "Framework for planning and communicating denial, deception and adversary engagement.", "summary_es": "Framework para planificar y comunicar actividades de denial, deception y adversary engagement.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": {"limitations_en": "The public report does not allow extrapolation of one trial’s outcomes to all organizations.", "limitations_es": "El informe público no permite extrapolar resultados de una prueba a todas las organizaciones.", "observation_en": "NCSC describes institutional trials and measurement gaps in the field.", "observation_es": "NCSC describe ensayos institucionales y vacíos de medición del campo.", "question_en": "Which outcome metrics should future trials require?", "question_es": "¿Qué métricas de resultados deberían exigirse en futuras pruebas?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Network", "Cloud", "OT/ICS"], "review_basis": "source-page", "source_title": "NCSC Cyber Deception Trials", "tags": [], "techniques": ["Honeypot", "Decoy"]}, "evidence": "institutional-evaluation", "id": "ncsc-deception-trials", "kind": "case-study", "name": "NCSC Cyber Deception Trials", "organization": "UK National Cyber Security Centre", "reviewed_at": "2026-09-15", "slug": "ncsc-deception-trials", "source_url": "https://www.ncsc.gov.uk/blog-post/cyber-deception-trials-what-weve-learned-so-far", "status": "published", "summary_en": "Institutional report on deception trials involving UK organizations and providers.", "summary_es": "Informe institucional de pruebas de cyberdeception con organizaciones y proveedores del Reino Unido.", "updated_at": "2026-09-15", "year": 2025}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "environments": ["Network"], "review_basis": "source-page", "source_title": "NeroSwarm Research Access Program", "tags": [], "techniques": ["Honeypot", "Honeytoken"]}, "evidence": "research-access-program", "id": "neroswarm-research-access", "kind": "community", "name": "NeroSwarm Research Access Program", "organization": "NeroSwarm", "reviewed_at": "2026-09-15", "slug": "neroswarm-research-access", "source_url": "https://neroswarm.com/research-access", "status": "published", "summary_en": "September 2026 program offering time-limited deception-platform access for non-commercial research; eligibility is listed at the source.", "summary_es": "Programa publicado en septiembre de 2026 que ofrece acceso temporal a una plataforma de deception para investigación no comercial; los requisitos se consultan en la fuente.", "updated_at": "2026-09-15", "year": 2026}
{"critical_reading": {"limitations_en": "This record does not verify which requirements were validated in production networks.", "limitations_es": "La ficha no verifica cuáles requisitos fueron validados en redes de producción.", "observation_en": "The abstract addresses network requirements for effective deception deployment.", "observation_es": "El abstract trata requisitos de red para desplegar deception eficazmente.", "question_en": "Which segmentation and telemetry constraints limit deployment?", "question_es": "¿Qué restricciones de segmentación y telemetría limitan el despliegue?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "design_en": "Narrative review of virtualization, SDN, honeynets, MTD and network-evaluation requirements.", "design_es": "Revisión narrativa de requisitos de virtualización, SDN, honeynets, MTD y evaluación de red.", "environments": ["Network"], "finding_en": "Organizes network dependencies that shape deployment and measurement of deception mechanisms.", "finding_es": "Organiza dependencias de red que condicionan despliegue y medición de mecanismos de deception.", "full_text_reviewed_at": "2026-09-16", "limits_en": "It does not document a systematic search protocol or validate a complete architecture.", "limits_es": "No documenta protocolo sistemático de búsqueda ni valida una arquitectura completa.", "review_basis": "full-text", "source_title": "A Survey of Network Requirements for Enabling Effective Cyber Deception", "tags": [], "techniques": ["Decoy"]}, "evidence": "full-text-review", "id": "network-requirements-2023", "kind": "paper", "name": "A Survey of Network Requirements for Enabling Effective Cyber Deception", "organization": "Sayed et al.", "reviewed_at": "2026-09-16", "slug": "network-requirements-2023", "source_url": "https://arxiv.org/abs/2309.00184", "status": "published", "summary_en": "Survey of network requirements for implementing cyber deception techniques.", "summary_es": "Revisión de requisitos de red necesarios para implementar técnicas de cyberdeception.", "updated_at": "2026-09-18", "year": 2023}
{"critical_reading": {"limitations_en": "This record does not measure alert rates, false positives or maintenance in a real network.", "limitations_es": "La ficha no mide tasas de alerta, falsos positivos ni esfuerzo de mantenimiento en una red real.", "observation_en": "Repository documentation describes a multiprotocol sensor for internal networks.", "observation_es": "La documentación del repositorio describe un sensor multiprotocolo para redes internas.", "question_en": "Which simulated services remain credible in the target environment?", "question_es": "¿Qué servicios simulados siguen siendo creíbles en el entorno que se quiere proteger?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Network"], "review_basis": "repository-metadata", "source_title": "OpenCanary", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "opencanary", "kind": "software", "name": "OpenCanary", "organization": "Thinkst", "reviewed_at": "2026-09-15", "slug": "opencanary", "source_url": "https://github.com/thinkst/opencanary", "status": "published", "summary_en": "Multi-protocol network honeypot for detecting suspicious interactions inside networks.", "summary_es": "Honeypot de red multiprotocolo para detectar interacciones sospechosas en redes internas.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "authors": ["Federico Pacheco", "Diego Staino"], "design_en": "Reproducible educational environment with controlled exercises and a practical learning sequence.", "design_es": "Entorno educativo reproducible con ejercicios controlados y una secuencia de aprendizaje práctico.", "disclosure_en": "Federico Pacheco, the Atlas owner, contributed to this project or its associated publication. This record follows the same source and limitation criteria as the rest of the catalog; it is not an independent evaluation.", "disclosure_es": "Federico Pacheco, responsable de este Atlas, participa en este proyecto o su publicación asociada. La ficha aplica los mismos criterios de fuentes y límites que el resto del catálogo; no constituye una evaluación independiente.", "environments": ["Network", "Application"], "finding_en": "Connects concepts, deployment, observation and analysis in a laboratory experience.", "finding_es": "Conecta conceptos, despliegue, observación y análisis en una experiencia de laboratorio.", "full_text_reviewed_at": "2026-09-16", "limitations_en": "The paper is a design contribution. Its authors state that it provides neither empirical learning evaluation nor comparative effectiveness results.", "limitations_es": "El artículo presenta una contribución de diseño. Sus autores indican que no ofrece evaluación empírica de aprendizaje ni una comparación de eficacia.", "limits_en": "The paper presents design and educational use; comparable cohorts and longitudinal learning measurement are missing.", "limits_es": "La publicación presenta diseño y uso educativo; faltan cohortes comparables y medición longitudinal de aprendizaje.", "review_basis": "full-text", "source_language": "es, en", "source_title": "55JAIIO / SACS 2026 — artículo completo", "tags": ["BASE4 Security", "Federico Pacheco", "Diego Staino"], "techniques": ["Honeypot", "Decoy", "Honeytoken"]}, "evidence": "full-text-review", "id": "playground-experiential-learning-2026", "kind": "paper", "name": "Aprendizaje experimental de ciberengaño mediante un entorno educativo reproducible", "organization": "Federico Pacheco y Diego Staino", "reviewed_at": "2026-09-16", "slug": "playground-experiential-learning-2026", "source_url": "https://55jaiio.sadio.org.ar/wp-content/uploads/2026/07/21.pdf", "status": "published", "summary_en": "Pacheco and Staino paper in the SACS 2026 proceedings describing the reproducible educational design of Cyber Deception Playground.", "summary_es": "Artículo de Pacheco y Staino publicado en las memorias SACS 2026 que describe el diseño educativo reproducible de Cyber Deception Playground.", "updated_at": "2026-09-18", "year": 2026}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": null, "draft_review_basis": "independent-second-provider-review", "environments": ["Endpoint"], "limitations_en": "Behavior is documented by the vendor, not independently verified; the page does not attribute it to the open-source guardrail.", "limitations_es": "El comportamiento está documentado por el proveedor, no verificado de forma independiente; la página no lo atribuye al guardarraíl de código abierto.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": [], "review_basis": "source-page", "screening_basis": "three-ai-source-page-agreement", "source_document_url": "https://www.innerwarden.com/blog/honeypot-attackers-cant-detect", "source_packet_sha256": "405d1e0c6cd64ab49b578a96f55cb68a14cf04cb8b218091507a8496586e6c32", "source_sha": null, "source_title": "InnerWarden enterprise honeypot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "vendor-documentation", "id": "prod-innerwarden-enterprise-honeypot", "kind": "product", "name": "InnerWarden Enterprise honeypot", "organization": "InnerWarden", "reviewed_at": "2026-10-04", "slug": "prod-innerwarden-enterprise-honeypot", "source_url": "https://www.innerwarden.com/blog/honeypot-attackers-cant-detect", "status": "published", "summary_en": "An InnerWarden enterprise offering that, according to the vendor page, simulates a filesystem and Linux commands to interact with attackers. It is separate from the open-source innerwarden guardrail.", "summary_es": "Oferta empresarial de InnerWarden que, según la página del proveedor, simula un sistema de archivos y comandos Linux para interactuar con atacantes. Es distinta del guardarraíl de código abierto innerwarden.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": {"limitations_en": "A selected case does not measure detection of missed attacks or generalizability.", "limitations_es": "Un caso seleccionado no mide tasa de detección de ataques ausentes ni generalización.", "observation_en": "Proofpoint reports over a month of post-compromise observations in a decoy.", "observation_es": "Proofpoint narra observaciones posteriores a la intrusión durante más de un mes en un señuelo.", "question_en": "Which adversary-behavior hypothesis changed from that observation?", "question_es": "¿Qué hipótesis de comportamiento adversario cambió con esa observación?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Endpoint", "Network"], "review_basis": "source-page", "source_title": "Cargo Theft Actor in a Persistent Decoy", "tags": [], "techniques": ["Decoy", "Adversary engagement"]}, "evidence": "threat-research-observation", "id": "proofpoint-cargo-decoy-2026", "kind": "case-study", "name": "Cargo Theft Actor in a Persistent Decoy", "organization": "Proofpoint Threat Research", "reviewed_at": "2026-09-15", "slug": "proofpoint-cargo-decoy-2026", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/beyond-breach-inside-cargo-theft-actors-post-compromise-playbook", "status": "published", "summary_en": "Proofpoint observed post-compromise activity for over a month in a Deception.Pro decoy environment; adversary behavior research, not a commercial effectiveness trial.", "summary_es": "Proofpoint observó durante más de un mes acciones posteriores a la intrusión en un entorno señuelo operado con Deception.Pro; estudio de conducta adversaria, no prueba de eficacia comercial.", "updated_at": "2026-09-15", "year": 2026}
{"critical_reading": {"limitations_en": "The cited investigation reduction is a testimonial published by the vendor.", "limitations_es": "La reducción de investigación citada es un testimonio publicado por el proveedor.", "observation_en": "Proofpoint publishes an energy-company adoption story.", "observation_es": "Proofpoint publica un relato de adopción en una empresa de energía.", "question_en": "What before-and-after measurement supports the reported reduction?", "question_es": "¿Qué medición previa y posterior sustenta la reducción declarada?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Endpoint", "Identity"], "limitations_en": "No independent outcome evaluation was reviewed.", "limitations_es": "No se verificó una evaluación independiente de resultados.", "review_basis": "source-page", "source_title": "Energy Company / Proofpoint Shadow", "tags": [], "techniques": ["Decoy"]}, "evidence": "vendor-published-case", "id": "proofpoint-energy-shadow", "kind": "case-study", "name": "Energy Company / Proofpoint Shadow", "organization": "Proofpoint", "reviewed_at": "2026-09-15", "slug": "proofpoint-energy-shadow", "source_url": "https://www.proofpoint.com/us/customer-stories/energy-company-powers-defenses-proofpoint", "status": "published", "summary_en": "Energy company Shadow adoption story published by Proofpoint; investigation-time reduction is a customer statement reported by the vendor.", "summary_es": "Relato de adopción de Shadow en una empresa energética publicado por Proofpoint; la reducción de tiempo de investigación es una afirmación del cliente recogida por el proveedor.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": {"limitations_en": "The commercial source does not quantify coverage or false alerts in a comparable organization.", "limitations_es": "La fuente comercial no cuantifica cobertura ni falsas alertas en una organización comparable.", "observation_en": "Proofpoint describes endpoint decoys for lateral-movement detection.", "observation_es": "Proofpoint describe señuelos en endpoints para detectar movimiento lateral.", "question_en": "How is each alert linked to a real identity and endpoint?", "question_es": "¿Cómo se relaciona cada alerta con una identidad y un endpoint reales?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Endpoint", "Identity"], "review_basis": "source-page", "source_title": "Proofpoint Shadow", "tags": [], "techniques": ["Decoy", "Honeytoken"]}, "evidence": "vendor-claim", "id": "proofpoint-shadow", "kind": "product", "name": "Proofpoint Shadow", "organization": "Proofpoint", "reviewed_at": "2026-09-15", "slug": "proofpoint-shadow", "source_url": "https://www.proofpoint.com/us/products/identity-threat-detection-response/shadow", "status": "published", "summary_en": "Commercial identity protection component deploying endpoint deceptions to alert on lateral movement, according to Proofpoint.", "summary_es": "Componente comercial de protección de identidad que distribuye señuelos en endpoints para alertar sobre movimiento lateral, según Proofpoint.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-04", "classification_rule": "support-only-not-honeypot", "draft_review_basis": "independent-second-provider-review", "environments": ["Network"], "limitations_en": "The Kippo integration is documented on the historical package page, not independently verified. The Honeypot label denotes its connection to Kippo, not a decoy capability of its own.", "limitations_es": "La integración con Kippo está documentada en la página histórica del paquete, no verificada de forma independiente. La etiqueta Honeypot indica su relación con Kippo, no una capacidad propia de señuelo.", "publication_basis": "source-reviewed-curated-batch-2026-10-11", "related_techniques": ["Honeypot"], "review_basis": "source-page", "screening_basis": "three-ai-source-page-agreement", "source_document_url": "https://pypi.org/project/django-kippo/", "source_packet_sha256": "f70465d37ac25116ca32d603007ce36952e8753cafe81f39e25c290bdde965a9", "source_sha": null, "source_title": "django-kippo", "tags": [], "techniques": []}, "evidence": "package-registry-documentation", "id": "pypi-django-kippo", "kind": "software", "name": "django-kippo", "organization": "jedie", "reviewed_at": "2026-10-04", "slug": "pypi-django-kippo", "source_url": "https://pypi.org/project/django-kippo/", "status": "published", "summary_en": "A Django application for browsing the Kippo SSH honeypot’s MySQL data in the admin panel; it is not described as a honeypot itself.", "summary_es": "Aplicación Django para consultar en el panel de administración los datos MySQL del honeypot SSH Kippo; no se describe como un honeypot por sí misma.", "updated_at": "2026-10-04", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "environments": ["Network"], "review_basis": "source-page", "source_title": "Managed Deception and Response", "tags": [], "techniques": ["Decoy"]}, "evidence": "provider-offering", "id": "quirso-managed-response", "kind": "service", "name": "Managed Deception and Response", "organization": "QUIRSO", "reviewed_at": "2026-09-15", "slug": "quirso-managed-response", "source_url": "https://www.quirso.de/index-en.html", "status": "published", "summary_en": "Decoy and response service published by QUIRSO for organizations in Germany.", "summary_es": "Servicio de señuelos y respuesta publicado por QUIRSO para organizaciones en Alemania.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": {"limitations_en": "The documented variety does not establish that every decoy is useful in every deployment.", "limitations_es": "La variedad de señuelos documentada no demuestra que todos sean útiles en cada instalación.", "observation_en": "Documentation lists honeypots, honey users, files and credentials.", "observation_es": "La documentación enumera honeypots, usuarios, archivos y credenciales señuelo.", "question_en": "Which decoy yields the most actionable signal in the local network?", "question_es": "¿Qué señuelo genera la señal más investigable en la red propia?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Network", "Identity"], "review_basis": "source-page", "source_title": "InsightIDR Deception Technology", "tags": [], "techniques": ["Honeypot", "Honeytoken"]}, "evidence": "product-documentation", "id": "rapid7-insightidr-deception", "kind": "product", "name": "InsightIDR Deception Technology", "organization": "Rapid7", "reviewed_at": "2026-09-15", "slug": "rapid7-insightidr-deception", "source_url": "https://docs.rapid7.com/insightidr/deception-technology/", "status": "published", "summary_en": "InsightIDR capabilities for honeypots, honey users, files and credentials; documentation describes interaction alerts.", "summary_es": "Capacidades de InsightIDR para crear honeypots, usuarios, archivos y credenciales señuelo; la documentación describe alertas ante interacción.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": {"limitations_en": "The source is commercial; this record has no independent data or missed-incident data.", "limitations_es": "La fuente es comercial; no se dispone aquí de datos independientes ni de incidentes no detectados.", "observation_en": "The vendor publishes a cloud adoption story attributed to Riot Games.", "observation_es": "El proveedor publica una experiencia de adopción cloud atribuida a Riot Games.", "question_en": "Which measurable results and operating costs can be verified beyond the story?", "question_es": "¿Qué resultados medibles y costos de operación se pueden verificar fuera del relato?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Cloud"], "limitations_en": "The story is published by the vendor. Its claims should be read in that context.", "limitations_es": "El relato está publicado por el proveedor. Sus afirmaciones deben leerse en ese contexto.", "review_basis": "source-page", "source_title": "Riot Games | Tracebit Customer Stories", "tags": [], "techniques": ["Honeytoken"]}, "evidence": "published-case", "id": "riot-games-tracebit", "kind": "case-study", "name": "Riot Games / Tracebit", "organization": "Tracebit", "reviewed_at": "2026-09-15", "slug": "riot-games-tracebit", "source_url": "https://tracebit.com/customer/riot-games", "status": "published", "summary_en": "Cloud deception adoption story published by the vendor Tracebit.", "summary_es": "Experiencia de adopción de deception en cloud publicada por el proveedor Tracebit.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": {"limitations_en": "The portfolio page provides neither an independent test nor requirements for each module.", "limitations_es": "La página de portafolio no ofrece una prueba independiente ni requisitos de cada módulo.", "observation_en": "The commercial portfolio attributes identity, cloud and network coverage to ShadowPlex.", "observation_es": "El portafolio comercial atribuye cobertura de identidad, cloud y redes a ShadowPlex.", "question_en": "Which integrations and constraints apply to the specific offering being purchased?", "question_es": "¿Qué integraciones y límites corresponden a la modalidad concreta que se compra?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Identity", "Cloud", "Network"], "review_basis": "source-page", "source_title": "ShadowPlex", "tags": [], "techniques": ["Decoy", "Honeytoken"]}, "evidence": "vendor-claim", "id": "shadowplex", "kind": "product", "name": "ShadowPlex", "organization": "Acalvio", "reviewed_at": "2026-09-15", "slug": "shadowplex", "source_url": "https://www.acalvio.com/products/", "status": "published", "summary_en": "Commercial deception portfolio for identity, cloud and networks, according to Acalvio documentation.", "summary_es": "Familia comercial de deception para identidad, cloud y redes, según la documentación de Acalvio.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-10-02", "adjudication_status": "not performed", "design_en": "Twelve security participants, told they were using a honeypot, assessed 226 shelLM command responses; three experts judged whether those responses were consistent with a Linux shell.", "design_es": "Doce participantes de seguridad, informados de que usaban un honeypot, evaluaron 226 respuestas a comandos de shelLM; tres expertos juzgaron la consistencia de esas respuestas con una shell Linux.", "doi": "10.1109/eurospw61312.2024.00054", "environments": ["Network"], "extraction_status": "single-reviewer source-bounded full-text synthesis", "finding_en": "Of 184 responses judged plausible by experts, participants also classified 167 as plausible (90.8%). This measures responses in this test, not deception of real attackers.", "finding_es": "De 184 respuestas consideradas plausibles por los expertos, los participantes también clasificaron 167 como plausibles (90,8 %). Esa medida describe respuestas en esta prueba, no engaño de atacantes reales.", "full_text_reviewed_at": "2026-10-02", "full_text_source_url": "https://arxiv.org/pdf/2309.00155", "limitations_en": "Participants knew the system’s nature; there was no controlled comparison with another honeypot or real-adversary test. The 226 responses are clustered within 12 people and are not independent observations.", "limitations_es": "Los participantes conocían la naturaleza del sistema; no hubo comparación controlada con otro honeypot ni prueba con adversarios reales. Las 226 respuestas están agrupadas en 12 personas y no son observaciones independientes.", "limits_en": "Participants knew the system’s nature; there was no controlled comparison with another honeypot or real-adversary test. The 226 responses are clustered within 12 people and are not independent observations.", "limits_es": "Los participantes conocían la naturaleza del sistema; no hubo comparación controlada con otro honeypot ni prueba con adversarios reales. Las 226 respuestas están agrupadas en 12 personas y no son observaciones independientes.", "page_anchors": ["PDF pp. 3–5, Sections 4–7, Figure 6, Tables 1–2"], "prior_summary_en": "Evaluation of LLM shell-honeypot responses by informed participants and Linux experts.", "prior_summary_es": "Evaluación de respuestas de un honeypot de shell con LLM por participantes informados y expertos en Linux.", "provenance_note_en": "The full text was examined and locators were retained. Single-reviewer synthesis without independent extraction or formal quality appraisal.", "provenance_note_es": "Se examinó el texto completo y se conservaron localizadores. Síntesis de un revisor, sin extracción independiente ni evaluación formal de calidad.", "review_basis": "full-text", "source_language": "en", "source_title": "LLM in the Shell: Generative Honeypots", "tags": ["open-access"], "techniques": ["Honeypot"]}, "evidence": "full-text-review", "id": "shellm-generative-honeypots-2024", "kind": "paper", "name": "LLM in the Shell: Generative Honeypots", "organization": "Sladić et al.", "reviewed_at": "2026-10-02", "slug": "shellm-generative-honeypots-2024", "source_url": "https://arxiv.org/pdf/2309.00155", "status": "published", "summary_en": "Of 184 responses judged plausible by experts, participants also classified 167 as plausible (90.8%). This measures responses in this test, not deception of real attackers.", "summary_es": "De 184 respuestas consideradas plausibles por los expertos, los participantes también clasificaron 167 como plausibles (90,8 %). Esa medida describe respuestas en esta prueba, no engaño de atacantes reales.", "updated_at": "2026-10-02", "year": 2024}
{"critical_reading": {"limitations_en": "This record does not verify current compatibility, deployment safety or production results.", "limitations_es": "La ficha no verifica compatibilidad actual, seguridad de despliegue ni resultados en producción.", "observation_en": "The repository documents a reactive web component from the mushorg ecosystem.", "observation_es": "El repositorio documenta un componente web reactivo del ecosistema mushorg.", "question_en": "Which analysis component does it integrate with, and what data is retained?", "question_es": "¿Con qué componente de análisis se integra y qué datos conserva?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Application"], "review_basis": "repository-metadata", "source_title": "SNARE", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "snare", "kind": "software", "name": "SNARE", "organization": "mushorg", "reviewed_at": "2026-09-15", "slug": "snare", "source_url": "https://github.com/mushorg/snare", "status": "published", "summary_en": "Reactive web honeypot component developed by the mushorg team.", "summary_es": "Componente de honeypot web reactivo desarrollado por el equipo de mushorg.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": {"limitations_en": "Access, retention and integration terms remain unverified here.", "limitations_es": "Los términos de acceso, retención e integración siguen sin verificarse aquí.", "observation_en": "Sprint IT Solutions advertises honeypots as a service.", "observation_es": "Sprint IT Solutions anuncia honeypots ofrecidos como servicio.", "question_en": "Where does observed data reside and who can access it?", "question_es": "¿Dónde residen los datos observados y quién puede consultarlos?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Network"], "review_basis": "source-page", "source_title": "Honeypot as a Service", "tags": [], "techniques": ["Honeypot"]}, "evidence": "provider-offering", "id": "sprintit-honeypot-service", "kind": "service", "name": "Honeypot as a Service", "organization": "Sprint IT Solutions", "reviewed_at": "2026-09-15", "slug": "sprintit-honeypot-service", "source_url": "https://www.sitwll.com/honeypot", "status": "published", "summary_en": "SaaS honeypot and deception-signal offering published by Sprint IT Solutions; operational terms await assessment.", "summary_es": "Oferta SaaS de honeypots y señales de engaño publicada por Sprint IT Solutions; condiciones operativas pendientes de evaluación.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "doi": "10.5281/zenodo.20435481", "environments": ["Network"], "review_basis": "source-page", "source_title": "Four-Month SSH Botnet Interaction Dataset", "tags": [], "techniques": ["Honeypot"]}, "evidence": "dataset-record", "id": "ssh-botnet-2025-odessa", "kind": "dataset", "name": "Four-Month SSH Botnet Interaction Dataset", "organization": "Odesa Law Academy researchers", "reviewed_at": "2026-09-15", "slug": "ssh-botnet-2025-odessa", "source_url": "https://zenodo.org/records/20435481", "status": "published", "summary_en": "SSH interaction data collected by a honeypot between July and November 2025; event count comes from the authors.", "summary_es": "Datos de interacciones SSH recopilados por un honeypot entre julio y noviembre de 2025; la cifra de eventos procede de los autores.", "updated_at": "2026-09-15", "year": 2026}
{"critical_reading": {"limitations_en": "Combining sensors does not guarantee sound placement, isolation or maintenance.", "limitations_es": "Integrar sensores no garantiza que todos estén bien ubicados, aislados o mantenidos.", "observation_en": "Documentation presents a deployment combining several sensors and analysis tools.", "observation_es": "La documentación presenta una instalación que reúne varios sensores y herramientas de análisis.", "question_en": "Which sensors add unique signals compared with a smaller deployment?", "question_es": "¿Qué sensores aportan señales únicas frente a una instalación más pequeña?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Network", "IoT"], "review_basis": "repository-metadata", "source_title": "T-Pot", "tags": [], "techniques": ["Honeypot"]}, "evidence": "repository-documentation", "id": "t-pot", "kind": "software", "name": "T-Pot", "organization": "Telekom Security", "reviewed_at": "2026-09-15", "slug": "t-pot", "source_url": "https://github.com/telekom-security/tpotce", "status": "published", "summary_en": "Platform combining multiple honeypots and analysis tools in one deployment.", "summary_es": "Plataforma que reúne varios honeypots y herramientas de análisis en una instalación.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": {"limitations_en": "This record captures declared capabilities; it does not test effectiveness, noise rate or total cost.", "limitations_es": "La ficha registra capacidades declaradas; no prueba eficacia, tasa de ruido ni costo total.", "observation_en": "The vendor page presents decoys and tokens that generate interaction alerts.", "observation_es": "La página del proveedor presenta señuelos y tokens para generar alertas de interacción.", "question_en": "Which alerts does it add beyond existing detection controls?", "question_es": "¿Qué alertas aporta frente a controles de detección ya existentes?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Network", "Identity"], "review_basis": "source-page", "source_title": "Thinkst Canary", "tags": [], "techniques": ["Honeypot", "Honeytoken"]}, "evidence": "vendor-claim", "id": "thinkst-canary", "kind": "product", "name": "Thinkst Canary", "organization": "Thinkst", "reviewed_at": "2026-09-15", "slug": "thinkst-canary", "source_url": "https://canary.tools/", "status": "published", "summary_en": "Commercial decoy product for detecting interactions with systems that appear legitimate.", "summary_es": "Producto comercial de señuelos para detectar interacciones con sistemas que aparentan ser legítimos.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-09-16", "design_en": "Historical review of representative work on honeypots, honeytokens and MTD through 2021.", "design_es": "Revisión histórica de trabajos representativos sobre honeypots, honeytokens y MTD hasta 2021.", "doi": "10.1016/j.cose.2021.102288", "environments": ["Network", "Endpoint"], "finding_en": "Shows complementarity among the three families and calls for evaluation on realistic platforms.", "finding_es": "Muestra complementariedad entre las tres familias y reclama evaluación en plataformas realistas.", "full_text_reviewed_at": "2026-09-16", "limits_en": "Representative selection is not an exhaustive inventory and the cutoff excludes later advances.", "limits_es": "La selección representativa no equivale a un inventario exhaustivo y el corte excluye avances posteriores.", "review_basis": "full-text", "source_language": "en", "source_title": "Three Decades of Deception Techniques in Active Cyber Defense—Retrospect and Outlook", "tags": ["open-access"], "techniques": ["Honeypot", "Honeytoken", "Moving target defense"]}, "evidence": "full-text-review", "id": "three-decades-2021", "kind": "paper", "name": "Three Decades of Deception Techniques in Active Cyber Defense—Retrospect and Outlook", "organization": "Zhang & Thing", "reviewed_at": "2026-09-16", "slug": "three-decades-2021", "source_url": "https://arxiv.org/abs/2104.03594", "status": "published", "summary_en": "Historical review of honeypots, honeytokens and moving target defense from the late 1980s through 2021.", "summary_es": "Revisión histórica de honeypots, honeytokens y moving target defense entre fines de los años 1980 y 2021.", "updated_at": "2026-09-18", "year": 2021}
{"critical_reading": {"limitations_en": "A one-week window may miss seasonality and does not itself reveal label quality.", "limitations_es": "Una ventana semanal puede omitir estacionalidad y no revela por sí sola calidad de etiquetas.", "observation_en": "Zenodo offers seven days of Suricata events from T-Pot.", "observation_es": "Zenodo ofrece siete días de eventos Suricata procedentes de T-Pot.", "question_en": "Which events are confirmed attacks and which are sensor alerts?", "question_es": "¿Qué eventos son ataques confirmados y cuáles alertas del sensor?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "doi": "10.5281/zenodo.15830438", "environments": ["Network"], "review_basis": "source-page", "source_title": "Honeypot-Anomaly-Self Attack", "tags": [], "techniques": ["Honeypot"]}, "evidence": "dataset-record", "id": "tpot-anomaly-7-days", "kind": "dataset", "name": "Honeypot-Anomaly-Self Attack", "organization": "University of Baghdad", "reviewed_at": "2026-09-15", "slug": "tpot-anomaly-7-days", "source_url": "https://zenodo.org/records/15830438", "status": "published", "summary_en": "CSV of seven days of Suricata events from T-Pot, according to the Zenodo record.", "summary_es": "Archivo CSV de siete días de eventos Suricata procedentes de T-Pot, según el registro Zenodo.", "updated_at": "2026-09-15", "year": 2025}
{"critical_reading": {"limitations_en": "Vendor-published customer stories need attribution and are not independent benchmarks.", "limitations_es": "Los relatos de clientes publicados por el proveedor requieren atribución y no son benchmarks independientes.", "observation_en": "Commercial documentation presents a cloud deception platform.", "observation_es": "La documentación comercial presenta una plataforma de deception para cloud.", "question_en": "What permissions does each decoy need, and how is its exposure limited?", "question_es": "¿Qué permisos requiere cada señuelo y cómo se limita su exposición?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Cloud"], "review_basis": "source-page", "source_title": "Tracebit", "tags": [], "techniques": ["Honeytoken", "Decoy"]}, "evidence": "vendor-claim", "id": "tracebit-platform", "kind": "product", "name": "Tracebit", "organization": "Tracebit", "reviewed_at": "2026-09-15", "slug": "tracebit-platform", "source_url": "https://tracebit.com/", "status": "published", "summary_en": "Commercial deception platform with published cloud case studies.", "summary_es": "Plataforma comercial de deception con casos publicados para entornos cloud.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": null, "data": {"access_date": "2026-09-15", "environments": ["Network", "Identity"], "review_basis": "source-page", "source_title": "Managed Deception Services", "tags": [], "techniques": ["Decoy"]}, "evidence": "provider-offering", "id": "wipro-managed-deception", "kind": "service", "name": "Managed Deception Services", "organization": "Wipro", "reviewed_at": "2026-09-15", "slug": "wipro-managed-deception", "source_url": "https://www.wipro.com/cybersecurity/managed-deception-services/", "status": "published", "summary_en": "Managed deception offering that Wipro describes in partnership with Acalvio.", "summary_es": "Servicio gestionado de deception que Wipro describe en colaboración con Acalvio.", "updated_at": "2026-09-15", "year": null}
{"critical_reading": {"limitations_en": "A data deposit does not establish representativeness or label quality for all scenarios.", "limitations_es": "El depósito de datos no confirma representatividad ni calidad de etiquetas para todos los escenarios.", "observation_en": "The Zenodo record identifies a multiregional cloud honeynet dataset.", "observation_es": "La ficha Zenodo identifica un dataset de honeynet cloud multirregional.", "question_en": "Which regions, periods, sensors and anonymization criteria does the dataset document?", "question_es": "¿Qué regiones, períodos, sensores y criterios de anonimización documenta el dataset?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "doi": "10.5281/zenodo.15716735", "environments": ["Cloud"], "review_basis": "source-page", "source_title": "Multi-Regional Cloud Honeynet Dataset", "tags": [], "techniques": ["Honeypot"]}, "evidence": "dataset-record", "id": "zenodo-cloud-honeynet", "kind": "dataset", "name": "Multi-Regional Cloud Honeynet Dataset", "organization": "Feito-Casares et al.", "reviewed_at": "2026-09-15", "slug": "zenodo-cloud-honeynet", "source_url": "https://zenodo.org/records/15716735", "status": "published", "summary_en": "Data from a T-Pot honeynet spread across Azure regions, according to its Zenodo record.", "summary_es": "Datos de una honeynet con T-Pot distribuida en varias regiones Azure, según el registro de Zenodo.", "updated_at": "2026-09-15", "year": 2025}
{"critical_reading": {"limitations_en": "Without reviewing schema, collection and license, comparability with other datasets should not be assumed.", "limitations_es": "Sin revisar esquema, recolección y licencia no se debe asumir comparabilidad con otros datasets.", "observation_en": "Zenodo hosts a published dataset for honeynet analysis.", "observation_es": "Zenodo conserva un conjunto de datos publicado para análisis de honeynet.", "question_en": "Which fields allow reconstruction of a session, and which were omitted?", "question_es": "¿Qué campos permiten reconstruir una sesión y cuáles se omitieron?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "doi": "10.5281/zenodo.3687527", "environments": ["Network"], "review_basis": "source-page", "source_title": "CyberLab Honeynet Dataset", "tags": [], "techniques": ["Honeypot"]}, "evidence": "dataset-record", "id": "zenodo-cyberlab-honeynet", "kind": "dataset", "name": "CyberLab Honeynet Dataset", "organization": "CyberLab / University of Ljubljana", "reviewed_at": "2026-09-15", "slug": "zenodo-cyberlab-honeynet", "source_url": "https://zenodo.org/records/3687527", "status": "published", "summary_en": "Cowrie honeypot session data from a distributed deployment, according to Zenodo.", "summary_es": "Datos de sesiones de honeypots Cowrie obtenidos en un despliegue distribuido, según Zenodo.", "updated_at": "2026-09-15", "year": 2020}
{"critical_reading": {"limitations_en": "The deposit record does not replace an audit of labels, biases and capture conditions.", "limitations_es": "La ficha de depósito no sustituye una auditoría de etiquetas, sesgos y condiciones de captura.", "observation_en": "The Zenodo record presents a deception-related telemetry dataset.", "observation_es": "La ficha Zenodo presenta un dataset relacionado con deception y telemetría.", "question_en": "What baseline and research tasks does it support reproducing?", "question_es": "¿Qué baseline y tareas de investigación permite reproducir?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "doi": "10.5281/zenodo.18088113", "environments": ["OT/ICS"], "review_basis": "source-page", "source_title": "Salty Seagull Dataset", "tags": [], "techniques": ["Honeypot"]}, "evidence": "dataset-record", "id": "zenodo-salty-seagull", "kind": "dataset", "name": "Salty Seagull Dataset", "organization": "Dataset authors", "reviewed_at": "2026-09-15", "slug": "zenodo-salty-seagull", "source_url": "https://zenodo.org/records/18088113", "status": "published", "summary_en": "Record of access and attack data against a VSAT honeynet.", "summary_es": "Registro de datos de acceso y ataques a una honeynet VSAT.", "updated_at": "2026-09-15", "year": 2025}
{"critical_reading": {"limitations_en": "Effective coverage, integration and false positives were not verified in a real deployment here.", "limitations_es": "No se verificaron aquí cobertura efectiva, integración ni falsos positivos en una implantación real.", "observation_en": "The vendor page describes decoy distribution and interaction alerts.", "observation_es": "La página del proveedor describe distribución de señuelos y alertas por interacción.", "question_en": "What event triggers an alert, and what context reaches the analyst?", "question_es": "¿Qué evento desencadena una alerta y con qué contexto llega al analista?", "reviewed_at": "2026-09-15"}, "data": {"access_date": "2026-09-15", "environments": ["Network", "Identity"], "review_basis": "source-page", "source_title": "Zscaler Deception", "tags": [], "techniques": ["Decoy", "Honeytoken"]}, "evidence": "vendor-claim", "id": "zscaler-deception", "kind": "product", "name": "Zscaler Deception", "organization": "Zscaler", "reviewed_at": "2026-09-15", "slug": "zscaler-deception", "source_url": "https://www.zscaler.com/products-and-solutions/deception-technology", "status": "published", "summary_en": "Zscaler product distributing decoys and interaction alerts, according to its product page.", "summary_es": "Producto de Zscaler que distribuye señuelos y alertas por interacción, según su página comercial.", "updated_at": "2026-09-15", "year": null}