Open software2026
Material reviewed: Repository metadataDatabase security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.
ApplicationHoneypot
Paper2026
Material reviewed: AbstractThe authors propose a dynamic honeypot framework combining a reinforcement-learning deception agent (tabular Q-learning, formalized as an MDP), threat-intelligence fusion via indicators of compromise, and automated containment actions. Its purpose is to adapt the honeypot's exposed persona and guide deception decisions, evaluated in an isolated virtualized testbed.
NetworkCloudHoneypotAdversary engagement
Paper2026
Material reviewed: Full textEditor contributionPacheco and Staino paper in the SACS 2026 proceedings describing the reproducible educational design of Cyber Deception Playground.
NetworkApplicationHoneypotDecoy
Paper2026
Material reviewed: AbstractThis paper proposes seven prompt-injection detection techniques that adapt mechanisms from disciplines outside LLM security, including forensic linguistics, materials-fatigue analysis, deception technology, bioinformatics sequence alignment, mechanism design, spectral analysis, and taint tracking. According to the authors, four of the seven techniques were implemented in the prompt-shield v0.7.3 tool, including honeypot tool definitions, and evaluated through ablations across nine benchmarks totaling approximately 10,300 samples.
ApplicationHoneypotDecoy
Paper2026
Material reviewed: AbstractThis work studies credential exfiltration by LLM agents via indirect prompt injection, proposing three complementary defenses according to the authors: activation probes for pre-output detection, honeytokens calibrated via split conformal prediction, and a cumulative leakage budget tracked across multi-turn conversations. The authors report preliminary results from controlled experiments on open-weight models and a small in-house multi-turn synthetic suite.
ApplicationIdentityHoneytoken
Open software2026
Material reviewed: Repository metadataEditor contributionOpen Docker Compose lab with vulnerable services, configurable deception levels, monitoring and an attacker environment for controlled training and research.
NetworkApplicationHoneypotDecoy
Paper2026
Material reviewed: AbstractThis paper presents DecoyTrace, a proactive cyber deception-based defense designed for strictly serverless decentralized federated learning (DFL) environments. According to the authors, the system deploys a mobile DecoyNode that generates decoy challenges using chaotic maps, disseminates a dual model (clean vs. decoy) based on neighbor trust, and evaluates behavior using three-state semantic metrics to identify and contain malicious sources. The authors report evaluations on the NEBULA platform across multiple configurations, datasets, and topologies.
NetworkApplicationDecoyAdversary engagement
Dataset or lab2026
Material reviewed: Public pageCritical readingZenodo record of DICOM/PACS telemetry from medical-imaging honeypot research; it documents periods of data loss.
ApplicationOT/ICSHoneypot
Paper2026
Material reviewed: AbstractThis paper presents DICOMHawk, a cyber-deception framework that emulates DICOM and PACS services with realistic interactions, dynamically populated medical records, and embedded honeytokens, designed to protect medical imaging infrastructure. According to the authors, in a 424-day deployment across multiple networks, DICOMHawk attracted more valid sessions than Dicompot, avoided honeypot detection, and captured 67 medical-related attacks from 15 unique IPs.
NetworkApplicationHoneypotHoneytoken
Open software2026
Material reviewed: Repository metadataHTTP honeypot on autopilot
ApplicationHoneypot
Paper2026
Material reviewed: AbstractThe authors present a honeypot architecture based on a fine-tuned LLM that combines command-line, API and dynamic web interaction with state management and security safeguards. The abstract describes a prototype simulating a Synology NAS on an OpenCanary baseline and an adaptation to a medical FHIR API.
ApplicationHoneypot
Paper2026
Material reviewed: AbstractThis paper proposes GroupGuard, a training-free defense framework against group collusive attacks in large language model-based multi-agent systems. The approach combines continuous graph-based monitoring, active honeypot inducement, and structural pruning to identify and isolate collusive agents. The authors report high detection accuracy across experiments with five datasets and four topologies.
ApplicationHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe abstract describes Honey Shield, a deception-driven cybersecurity paradigm for web authentication systems. It proposes a centralized security service interface offering defenses such as honeypot redirection and SQL injection protection, redirecting malicious users to a decoy system and logging incidents for later analysis.
ApplicationIdentityHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors present HoneyRoute, an inference-serving layer that detects malicious requests and routes them to a dedicated honeypot model, shielding the production model while harvesting attacker intelligence. The system combines a streaming router, a dual-implementation honeypot, and an analysis loop that feeds back into router retraining.
ApplicationCloudHoneypotDecoy
Paper2026
Material reviewed: AbstractAccording to the authors, HoneyTrap is a deceptive defense framework for large language models that employs four collaborative defender agents to counter multi-turn jailbreak attacks by directing attackers toward honeypot traps. The authors also introduce a progressive multi-turn jailbreak dataset (MTJ-Pro) and two new evaluation metrics for deceptive defense. They report reductions in attack success rates across several commercial and open-source models.
ApplicationHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThis work presents Honeyval, an evaluation framework for LLM-powered HTTP honeypots. According to the authors, the framework uses AI hacking agents as attackers and diverse backend applications to reproducibly evaluate the performance and detectability of these honeypots compared to prior limited evaluation methods.
NetworkApplicationHoneypotDecoy
Paper2026
Material reviewed: AbstractThis paper presents a noise-aware measurement study of Internet-facing DICOM services, combining IPv4-wide active scanning with passive honeypot deployments. The authors introduce a reproducible method to filter false positives caused by honeypots, network telescopes, and other measurement artifacts, reducing apparent exposure by 39%. After filtering, they identify thousands of vulnerable deployments lacking encryption and authentication, finding that existing deception systems are insufficient to capture the actual risks.
NetworkApplicationHoneypotDecoy
Paper2026
Material reviewed: AbstractAccording to the authors, this paper proposes 'Knowledge Trap', a defense against large language model extraction attacks that redirects attackers toward low-transferability knowledge using a honeypot-style knowledge graph and breadcrumb-guided exploration, rather than blocking queries or perturbing outputs. The authors report experiments in medical and financial domains showing reduced surrogate agreement without degrading legitimate-user performance.
ApplicationHoneypot
Paper2026
Material reviewed: AbstractThe paper proposes an LLM-enabled cloud-native dynamic honeypot architecture in which the model acts only as a text synthesizer behind policy gating and state verification. The authors describe a session broker that classifies attacker commands rather than executing them, alongside ethical governance controls and an evaluation protocol.
CloudNetworkHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe authors propose MemPot, a defense framework that injects optimized honeypots into the memory of large language model (LLM)-based agents to counter extraction attacks. Through a two-stage optimization process and a detection model based on Wald's Sequential Probability Ratio Test, the authors report improved detection performance over existing baselines in their experiments.
ApplicationHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors present Mirage Mesh, a lightweight cyber deception framework for Linux environments that applies deception-in-depth across four layers: an SSH decoy built on Cowrie, a system-layer decoy administrative account, a fake Flask web administration interface, and a data-layer honeytoken credential file. The work proposes a shared DecoyAlertEvent schema to normalize observations from these layers, process them through a Wazuh-based detection and active-response pipeline with Python orchestration, map them to cyber kill-chain stages and MITRE ATT&CK techniques, and evaluate them with a Deception Effectiveness Metric (DEM).
NetworkEndpointHoneypotHoneytoken
Paper2026
Material reviewed: AbstractThis paper presents a context-enriched SQL injection detection framework built via a multi-agent honeypot system that generates malicious/benign requests, mediates authentic database responses while protecting production data, and pairs requests with responses to create a labeled dataset of 140,973 pairs. The authors state that models trained on this dataset outperform payload-only counterparts.
ApplicationHoneypot
Paper2026
Material reviewed: AbstractThis paper presents Ollure, a low- and medium-interaction honeypot that emulates the Ollama API without a backend LLM, as described by the authors. Deployed across four locations over 84 days, it recorded hundreds of thousands of interactions from thousands of source IP addresses. The study documents automated discovery and fingerprinting activity, as well as concrete exploitation attempts against both the infrastructure and LLM layers.
NetworkApplicationHoneypotDecoy
Paper2026
Material reviewed: AbstractThis paper introduces PHANTOM, a framework for generating honeytokens that encode organisation-specific knowledge (domain names, naming conventions, technology idioms, and secret-value distributions) through a multi-component generation pipeline. The authors propose a four-component Believability Score and use it to compare PHANTOM against a template-based baseline across several token types and organisational contexts.
NetworkApplicationHoneytoken