Paper2025
Material reviewed: AbstractAccording to the authors, this work proposes a defense paradigm called 'attack as defense' against model extraction attacks. They introduce HoneypotNet, which replaces the victim model's classification layer with a honeypot layer fine-tuned via bi-level optimization to poison any substitute model trained on its outputs, while preserving original performance.
ApplicationHoneypotDecoy
Paper2025
Material reviewed: Public pageThe authors describe a web-based classroom reservation system in which they implement a hidden honeypot field in the booking form: invisible to humans but fillable by bots, so submissions with that field completed are rejected.
ApplicationDecoy
Paper2025
Material reviewed: AbstractThe authors present Koney, a Kubernetes operator that orchestrates cyber deception technology deployment through deception policy documents described as code. Using cloud-native technologies such as service meshes and eBPF, the system adds traps to containerized applications without source code access, facilitating setup, rotation, monitoring, and removal of traps, emphasizing maintainability, scalability, and operational simplicity.
CloudApplicationDecoyAdversary engagement
Paper2025
Material reviewed: AbstractThe authors present ShadowKube, an active defense framework for Kubernetes that integrates behavioral monitoring with shadow honeypots to detect and neutralize anomalous behavior. The approach establishes behavioral baselines to identify deviations and converts compromised nodes into honeypots, with the stated purpose of isolating and trapping attackers in intrusions targeting container orchestration.
CloudApplicationHoneypotDecoy
Paper2025
Material reviewed: Public pageThe authors review social engineering and describe, among other defenses, honeypots that simulate human interaction, such as email responses or chatbot interactions, to lure and log attack attempts.
NetworkApplicationHoneypot
Paper2024
Material reviewed: AbstractThe authors address the difficulty that traditional honeypot implementations are evaded by advanced adversaries such as APT groups, and propose designing and deploying a customized honeypot network based on adaptive camouflaging techniques. The work describes orchestrating a behavioral honeypot network tailored to three APT groups, with attack paths aligned with their tactics, techniques, and procedures, and includes a camouflaged chatterbox application deployed for 100 days; according to the deposited abstract, the setup recorded 13,906,945 hits from 4,238 unique IP addresses and was used to categorize attackers.
NetworkApplicationHoneypotDecoy
Paper2024
Material reviewed: Full textBibliographic record on application-layer deception. The abstract and findings still require review.
ApplicationDecoy
Paper2024
Material reviewed: AbstractAccording to the authors, this paper introduces IndisUAT, a new method for generating universal adversarial triggers (UAT) against NLP models that bypasses DARCY, a honeypot-based defense that baits multiple trapdoors to detect adversarial examples. The authors state that IndisUAT produces adversarial examples whose feature distribution is indistinguishable from benign examples, reducing DARCY's detection effectiveness and that of other defenses across several models.
ApplicationHoneypot
Paper2024
Material reviewed: AbstractPilot study exploring a deception-based honeypot using deep learning, integrated via an injection approach on web servers, aiming to minimize security breaches and detect intrusive malware activity. The authors report identification capabilities as the system learns and defends a user system against intrusive actions.
ApplicationHoneypot
Paper2024
Material reviewed: AbstractEditor contributionPacheco and Staino preprint proposing a cyclical, minimal deception process and presenting DOLOS-T as an open tool for exploring it.
NetworkApplicationDecoyAdversary engagement
Paper2023
Material reviewed: AbstractThe authors propose a framework combining moving target defense (MTD), deception, and attribute-based access control (ABAC) to make unauthorized insider access more difficult and costly. They introduce correlated attributes into ABAC and generate mutated policies from them. According to the authors, evaluation results show the framework effectively identifies correlated attributes and produces adequate mutated policies without affecting system usability.
IdentityApplicationMoving target defenseAdversary engagement
Paper2023
Material reviewed: AbstractThe paper by Adam Putra and Ade Eviyanti addresses the security of website form inputs against SQL-injection attacks, and describes the honeypot method as a system or computer deliberately used as bait to become a target for attackers. The authors present this method as a way to prevent website security attacks.
ApplicationHoneypot
Paper2023
Material reviewed: AbstractThe authors investigate using ChatGPT to automatically reply to scam emails in order to waste scammers' time and resources through pointless communications. According to the abstract, preliminary results show ChatGPT can decoy scammers.
ApplicationDecoyAdversary engagement
Paper2023
Material reviewed: AbstractThe authors propose a backdoor-resistant fine-tuning procedure for pretrained language models, integrating a 'honeypot' module designed to exclusively absorb backdoor information present in poisoned training samples. By penalizing the information captured by this module during fine-tuning, the authors report a reduction in backdoor attack success rate compared to prior methods.
ApplicationHoneypot
Paper2022
Material reviewed: Public pageThe paper describes a honeypot architecture combining social-network recruitment, decoy websites and warning messages to study prevention of online child exploitation. The authors document educational studies using legal content without hosting child exploitation material.
ApplicationHoneypot
Paper2022
Material reviewed: Full textThe prototype identified 14 of the 20 studied types in the described configuration. The authors note possible false positives and describe types the tool does not cover.
ApplicationIdentityHoneytoken
Paper2022
Material reviewed: AbstractThe paper addresses intrusion detection and cloud security and proposes using honeypots to divert malicious traffic away from systems. The authors describe implementing the honeypot concept in a file-sharing application deployed on a cloud server, aiming to detect attacks and improve security in that environment.
CloudApplicationHoneypot
Paper2022
Material reviewed: Public pageThe paper proposes an intrusion detection framework combining CAPTCHA, honeypots and supervised learning. Honeypots would be integrated into a website to lure malicious software, and the diagram sketches realistic decoy pages and decoy fields.
ApplicationNetworkHoneypotDecoy
Paper2022
Material reviewed: AbstractThis work models attacker-defender engagements as Markov Games to understand human adversarial behaviors and optimize defensive strategy. The authors validate their approach using a Capture-The-Flag (CTF) setup and user studies across varying skill levels. According to the authors, application-level deceptions are an optimal mitigation strategy against targeted attacks, outperforming classic defensive maneuvers, and they present an analysis of attacker behavior when trapped in an embedded honeypot environment.
ApplicationHoneypotAdversary engagement
Paper2021
Material reviewed: AbstractThe authors propose a low-interaction, adaptive and dynamic web application honeypot that imitates vulnerabilities through HTTP events, using the SNARE and TANNER tools to generate the attack surface and analyze/classify incoming requests, as described in the abstract.
ApplicationHoneypot
Paper2021
Material reviewed: AbstractThe authors describe installing a honeypot on a server as an attack detector, with its logs exposed through a REST API built with the Django framework and a MongoDB database, so that an Android application can show whether the server is under attack and block the attacker's IP address. The work is framed around network security and the monitoring of attacks on a resource.
NetworkApplicationHoneypot
Paper2020
Material reviewed: AbstractAccording to the authors, this paper presents an attack that partially breaks a defense that injects 'honeypots' into neural networks to detect adversarial attacks. They report reducing the detection true positive rate to 0% and detection AUC to 0.02 while maintaining original distortion bounds, and note that the original defense authors later amended it to mitigate the attack.
ApplicationHoneypotAdversary engagement
Paper2020
Material reviewed: AbstractAccording to the abstract, the authors propose DARCY, a defense framework adapting the honeypot concept from cybersecurity to detect Universal Trigger textual adversarial attacks. DARCY injects multiple trapdoors into a neural network model to bait and detect such attacks, reporting high detection rates in experiments across four public datasets.
ApplicationHoneypotDecoy
Paper2020
Material reviewed: Publisher metadataBibliographic record on an adaptive deception framework. The abstract and findings still require review.
ApplicationDecoy