Paper2026
Material reviewed: AbstractThe work describes the design and implementation of a high-interaction LLM honeypot system intended to detect and analyze the behavior of LLM-based attacks. The authors propose a strategy that embeds hidden puzzles in webpage source code to consume LLM tokens, alongside multi-dimensional heuristic detection and token heatmap visualization.
ApplicationHoneypot
Paper2026
Material reviewed: Public pageThe manuscript proposes coordinating agents and threat flows through zones in a computational world, including honeypots, deception regions, and classification and quarantine routes.
ApplicationHoneypot
Open software2026
Material reviewed: Repository metadataModern honeypot supporting multiple services, realistic website cloning, and AI-powered features
ApplicationHoneypot
Open software2026
Material reviewed: Repository metadataWebDecoy Bot Detection — zero-config WordPress plugin for bot protection, spam prevention, and WooCommerce carding defense
ApplicationDecoy
Paper2026
Material reviewed: Full textFormal analysis of honeytoken limits when trusted agents and attackers share memory or policies.
ApplicationIdentityHoneytoken
Paper2025
Material reviewed: AbstractAccording to the abstract, the authors propose a honeypot-based guardrail system that fine-tunes a bait model to generate ambiguous, non-actionable responses used as lures to probe user intent during multi-turn interactions with LLMs. The work introduces metrics (HUS and DER) to evaluate bait attractiveness and the safety-usability tradeoff, with initial experiments on a multi-turn jailbreak dataset applied to GPT-4o.
ApplicationHoneypotAdversary engagement
Open software2025
Material reviewed: Repository metadataHellPot is a cross-platform portal to endless suffering meant to punish unruly HTTP bots.
ApplicationHoneypot
Paper2025
Material reviewed: AbstractAccording to the authors, this work proposes a defense paradigm called 'attack as defense' against model extraction attacks. They introduce HoneypotNet, which replaces the victim model's classification layer with a honeypot layer fine-tuned via bi-level optimization to poison any substitute model trained on its outputs, while preserving original performance.
ApplicationHoneypotDecoy
Open software2025
Material reviewed: Repository metadataAn uploader honeypot designed to look like poor website security.
ApplicationHoneypot
Paper2025
Material reviewed: Public pageThe authors describe a web-based classroom reservation system in which they implement a hidden honeypot field in the booking form: invisible to humans but fillable by bots, so submissions with that field completed are rejected.
ApplicationDecoy
Paper2025
Material reviewed: AbstractThe authors present Koney, a Kubernetes operator that orchestrates cyber deception technology deployment through deception policy documents described as code. Using cloud-native technologies such as service meshes and eBPF, the system adds traps to containerized applications without source code access, facilitating setup, rotation, monitoring, and removal of traps, emphasizing maintainability, scalability, and operational simplicity.
CloudApplicationDecoyAdversary engagement
Open software2025
Material reviewed: Repository metadataRepository about fake applications for attacker diversion; documentation and maintenance require further review.
ApplicationDecoy
Paper2025
Material reviewed: AbstractThe authors present ShadowKube, an active defense framework for Kubernetes that integrates behavioral monitoring with shadow honeypots to detect and neutralize anomalous behavior. The approach establishes behavioral baselines to identify deviations and converts compromised nodes into honeypots, with the stated purpose of isolating and trapping attackers in intrusions targeting container orchestration.
CloudApplicationHoneypotDecoy
Paper2025
Material reviewed: Public pageThe authors review social engineering and describe, among other defenses, honeypots that simulate human interaction, such as email responses or chatbot interactions, to lure and log attack attempts.
NetworkApplicationHoneypot
Paper2024
Material reviewed: AbstractThe authors address the difficulty that traditional honeypot implementations are evaded by advanced adversaries such as APT groups, and propose designing and deploying a customized honeypot network based on adaptive camouflaging techniques. The work describes orchestrating a behavioral honeypot network tailored to three APT groups, with attack paths aligned with their tactics, techniques, and procedures, and includes a camouflaged chatterbox application deployed for 100 days; according to the deposited abstract, the setup recorded 13,906,945 hits from 4,238 unique IP addresses and was used to categorize attackers.
NetworkApplicationHoneypotDecoy
Paper2024
Material reviewed: Full textBibliographic record on application-layer deception. The abstract and findings still require review.
ApplicationDecoy
Paper2024
Material reviewed: AbstractAccording to the authors, this paper introduces IndisUAT, a new method for generating universal adversarial triggers (UAT) against NLP models that bypasses DARCY, a honeypot-based defense that baits multiple trapdoors to detect adversarial examples. The authors state that IndisUAT produces adversarial examples whose feature distribution is indistinguishable from benign examples, reducing DARCY's detection effectiveness and that of other defenses across several models.
ApplicationHoneypot
Open software2024
Material reviewed: Repository metadataEditor contributionOpen framework for planning deception operations and deploying decoys and services with Python and Docker, according to its repository and documentation.
NetworkApplicationDecoyHoneypot
Open software2024
Material reviewed: Repository metadataHoneyHTTPD is a Python-based web server honeypot/service imitation builder. Great for honeypots or faking HTTP services.
ApplicationHoneypot
Open software2024
Material reviewed: Repository metadataRepository about modular web honeypot framework; documentation and maintenance require further review.
ApplicationHoneypot
Paper2024
Material reviewed: AbstractPilot study exploring a deception-based honeypot using deep learning, integrated via an injection approach on web servers, aiming to minimize security breaches and detect intrusive malware activity. The authors report identification capabilities as the system learns and defends a user system against intrusive actions.
ApplicationHoneypot
Paper2024
Material reviewed: AbstractEditor contributionPacheco and Staino preprint proposing a cyclical, minimal deception process and presenting DOLOS-T as an open tool for exploring it.
NetworkApplicationDecoyAdversary engagement
Paper2023
Material reviewed: AbstractThe authors propose a framework combining moving target defense (MTD), deception, and attribute-based access control (ABAC) to make unauthorized insider access more difficult and costly. They introduce correlated attributes into ABAC and generate mutated policies from them. According to the authors, evaluation results show the framework effectively identifies correlated attributes and produces adequate mutated policies without affecting system usability.
IdentityApplicationMoving target defenseAdversary engagement
Paper2023
Material reviewed: AbstractThe paper by Adam Putra and Ade Eviyanti addresses the security of website form inputs against SQL-injection attacks, and describes the honeypot method as a system or computer deliberately used as bait to become a target for attackers. The authors present this method as a way to prevent website security attacks.
ApplicationHoneypot