Paper2020
Material reviewed: Publisher metadataBibliographic record on personalized web-application deception. The abstract and findings still require review.
ApplicationDecoy
Paper2020
Material reviewed: AbstractThe authors describe how they used experiments to evaluate a defense mechanism based on the low interaction honeypot HoneyPy against Slowloris attacks on an Apache web server. According to the deposited abstract, most packets are discarded and directed to the honeypot without the attacker's knowledge, reducing the Slowloris attacks that reach the web server.
NetworkApplicationHoneypot
Paper2019
Material reviewed: AbstractAccording to the authors, this work proposes AnonTokens, an approach applying the honeytoken concept to the data privacy domain to trace re-identification attacks. High re-identification-risk decoy records are inserted into anonymized datasets to detect malicious users. The authors evaluate their approach using large-scale population datasets.
ApplicationHoneytokenDecoy
Paper2019
Material reviewed: AbstractThe authors propose an automatic identification model based on a random forest algorithm with three feature groups—application-layer, network-layer, and other system-layer features—to remotely check whether a server runs a honeypot service. The experiment datasets were collected from public known platforms, and the authors report that the model achieved an AUC value of 0.93.
NetworkApplicationHoneypot
Paper2019
Material reviewed: AbstractAccording to the abstract, this work develops inference techniques to detect organic click fraud in advertising networks. The authors note that malware detection systems, including honeypots, fail to stop click fraud apps, and propose two defenses: a mimicry defence based on detecting click reuse patterns, and a bait-click defence that injects decoy clicks to trigger fraudulent app behavior.
NetworkApplicationHoneypotDecoy
Paper2019
Material reviewed: AbstractAccording to the abstract, the authors conducted the first systematic study of an attack stealing cryptocurrencies via unprotected JSON-RPC endpoints in Ethereum nodes. They designed and deployed a honeypot to capture real-world attacks over six months, collecting millions of requests and analyzing attacker behavior and profits.
NetworkApplicationHoneypot
Paper2018
Material reviewed: AbstractThe authors present 'ProfileGen', a method for automatically generating realistic honeypot profiles for professional social networks, intended to attract malicious actors in online social networks. They report that an evaluation by domain experts confirmed the generated profiles were indistinguishable from real ones.
IdentityApplicationHoneypot
Paper2018
Material reviewed: AbstractThis paper describes the design and implementation of a malware analysis laboratory based on honeypot technology in a controlled environment, aimed at studying the techniques used by attackers and analyzing security incidents. The authors also designed an administration interface to control and analyze the gathered information, and tested the system for several weeks to collect statistics about attacks and their perpetrators.
NetworkApplicationHoneypot
Paper2015
Material reviewed: AbstractThe study proposes a generic implementation strategy for honeytokens deployed within a database management system, leveraging the aspect-oriented paradigm to contain the insider threat. The authors test this approach by developing a proof-of-concept prototype in AspectJ and reflect on the design and implementation challenges involved in deploying honeytokens.
ApplicationHoneytoken
Paper2015
Material reviewed: Public pageThis paper examines ethical issues in studying malicious activity in social networks using social honeypots combined with deception. Its purpose is to clarify how this area fits within human subjects research and whether researchers should seek deception-free methods.
ApplicationHoneypot
Paper2014
Material reviewed: AbstractThe study presents a comparative measurement of Facebook page promotion methods via ads and like farm services. The authors deploy honeypot pages, promote them through both methods, and analyze the demographic, temporal, and social characteristics of garnered likes. According to the authors, findings indicate differences in behavior among like farms, with some apparently bot-operated and others mimicking real users.
ApplicationHoneypot
Paper2012
Material reviewed: AbstractAccording to the authors' abstract, this work addresses fake check-ins in location-based social networks (LBSNs). The authors propose and analyze a honeypot venue-based solution, enhanced with a challenge-response scheme, to flag users generating fake spatial information.
ApplicationHoneypot
Paper—
Material reviewed: AbstractThe thesis proposes an authentication framework combining multi-factor authentication with honeytoken-based deception techniques. It describes three successive architectures: static honeytokens to improve detection of compromised credentials, the 2FHA mechanism combining one-time passwords (Google Authenticator) with honeytokens, and a final architecture with session-bound honeytokens, blockchain-supported auditing, and smart contracts on Ethereum.
IdentityApplicationHoneytokenDecoy