Paper2018
Material reviewed: AbstractThis paper describes the design and implementation of a malware analysis laboratory based on honeypot technology in a controlled environment, aimed at studying the techniques used by attackers and analyzing security incidents. The authors also designed an administration interface to control and analyze the gathered information, and tested the system for several weeks to collect statistics about attacks and their perpetrators.
NetworkApplicationHoneypot
Open software2018
Material reviewed: Repository metadataRepository about Python deception framework; documentation and maintenance require further review.
ApplicationHoneypot
Open software2018
Material reviewed: Repository metadataRepository about Oracle WebLogic simulation; documentation and maintenance require further review.
ApplicationHoneypot
Open software2017
Material reviewed: Repository metadataRepository about Apache Struts simulation; documentation and maintenance require further review.
ApplicationHoneypot
Open software2017
Material reviewed: Repository metadataRepository about Tomcat manager simulation; documentation and maintenance require further review.
ApplicationHoneypot
Paper2015
Material reviewed: AbstractThe study proposes a generic implementation strategy for honeytokens deployed within a database management system, leveraging the aspect-oriented paradigm to contain the insider threat. The authors test this approach by developing a proof-of-concept prototype in AspectJ and reflect on the design and implementation challenges involved in deploying honeytokens.
ApplicationHoneytoken
Open software2015
Material reviewed: Repository metadataRepository about SNARE web-event analysis; documentation and maintenance require further review.
ApplicationHoneypot
Paper2015
Material reviewed: Public pageThis paper examines ethical issues in studying malicious activity in social networks using social honeypots combined with deception. Its purpose is to clarify how this area fits within human subjects research and whether researchers should seek deception-free methods.
ApplicationHoneypot
Open software2014
Material reviewed: Repository metadataRepository about Node.js application simulation; documentation and maintenance require further review.
ApplicationHoneypot
Paper2014
Material reviewed: AbstractThe study presents a comparative measurement of Facebook page promotion methods via ads and like farm services. The authors deploy honeypot pages, promote them through both methods, and analyze the demographic, temporal, and social characteristics of garnered likes. According to the authors, findings indicate differences in behavior among like farms, with some apparently bot-operated and others mimicking real users.
ApplicationHoneypot
Paper2012
Material reviewed: AbstractAccording to the authors' abstract, this work addresses fake check-ins in location-based social networks (LBSNs). The authors propose and analyze a honeypot venue-based solution, enhanced with a challenge-response scheme, to flag users generating fake spatial information.
ApplicationHoneypot
Open software2012
Material reviewed: Repository metadataRepository about phpMyAdmin simulation; documentation and maintenance require further review.
ApplicationHoneypot
Open software2011
Material reviewed: Repository metadataRepository about decoy Django admin login; documentation and maintenance require further review.
ApplicationHoneypot
Community or education—
Material reviewed: Public pageCommunity list of honeypot projects and materials; each link requires separate verification.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationWeb honeypot that responds to HEAD and GET requests with an HTTP Basic challenge and logs received credentials; it accepts no username or password.
ApplicationIdentityHoneypot
Open software—
Material reviewed: Repository documentationA tool that parses logs from multiple honeypots (Kippo/Cowrie SSH, phpMyAdmin, Wordpot, Redispot, VncLowPot, Pghoney) to extract malicious IPs, URLs, and file hashes and publish them as pulses in AlienVault OTX.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationA high-interaction HTTP/HTTPS honeypot that presents vulnerable web applications to observe attacker access. The documentation says it sends logs to BigQuery and saves packet captures.
ApplicationHoneypot
Framework or guide—
Material reviewed: Repository documentationA Laravel 5.4/5.5 package that adds hidden honeypot fields (a decoy input and an encrypted timestamp) to forms to detect and block automated spam submissions, building on prior work by Ian Landsman and Maksim Surguy.
ApplicationHoneytoken
Framework or guide—
Material reviewed: Repository documentationA Django application that adds hidden honeypot fields to web forms via template tags, view decorators, and middleware, aiming to detect and block automated spam submissions.
ApplicationHoneypot
Open software—
Material reviewed: Repository documentationSDN honeypot with an HTTP interface that simulates a failed login without connecting to a real service; the documentation suggests checking PostgreSQL records.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationElasticPot is a honeypot that emulates an Elasticsearch service, compatible with DTAG's T-Pot environment and also available as a dockerized version.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationRuby on Rails gem plugin documenting honey traps and configurable responses to detect and respond to malicious behavior in an application.
ApplicationDecoyAdversary engagement
Open software—
Material reviewed: Repository documentationA toolset including an Ethereum RPC node scanner and stealer, along with an RPC node honeypot described as intended to collect attacker information.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository metadataCritical readingWeb honeypot using a language model to generate interactions.
ApplicationHoneypot