Paper2021
Material reviewed: AbstractThis paper presents an approach to container-based honeypots that simulate container escapes as a deception technique in the context of cloud computing virtualization. According to the authors, it investigates the possibilities of container-based honeypots to imitate legitimate network targets and raise alerts on attacker interactions, allowing study of attacker techniques.
NetworkCloudHoneypotDecoy
Paper2020
Material reviewed: AbstractThis paper proposes a framework for preventing ransomware attacks by combining blockchain, honeypot techniques, and cloud and edge computing. The authors state the framework is analyzed mainly on IoT devices, with potential generalization to other malware attacks.
IoTCloudHoneypot
Paper2020
Material reviewed: Public pageThe article analyzes data captured by a honeypot to describe how cryptomining campaigns infect a host and seek new vulnerable targets. It includes an analysis of victim IP addresses.
CloudHoneypot
Paper2018
Material reviewed: AbstractThe authors propose a high-interaction, self-acting spontaneous honeypot (SAS HP) whose behavior can dynamically change after learning from an attacker, and present its architecture for deployment in cloud environments to analyze attack patterns and secure cloud systems. They also describe how instances of the honeypot could be made available as a service to customers and how it could be deployed within the cloud, with the stated aim of developing a working prototype.
CloudHoneypot
Paper2018
Material reviewed: AbstractThe work presents a dashboard visualization using honeypot log data from the AWN campus connected to IHP (Kemkominfo) Jakarta on a public cloud computing service network, aiming to categorize timestamps. The K-means clustering method is applied to categorize attacks into morning, noon, and night periods based on Western Indonesia Time and to identify ports 21, 80, 135, and 445 affected by DDoS attacks, with the stated expectation of supporting monitoring and anticipation of cloud network vulnerabilities.
CloudNetworkHoneypot
Paper2017
Material reviewed: AbstractThe authors describe deploying a honeynet of low-interaction and high-interaction SSH honeypots across three geographic regions of a public cloud environment in order to gather threat intelligence and obtain tailored indicators of compromise for e-learning platforms. The collected logs are analyzed through log collectors and parsers that translate the data into real-time dashboards, with the aim of understanding attackers' tactics according to time zones and geolocations and helping the education landscape prepare for emerging threats.
CloudNetworkHoneypot
Paper2017
Material reviewed: AbstractThe authors address the difficulty of distinguishing large-scale non-directional attacks from advanced persistent threats (APTs) and propose implementing honeytokens and honeypots as an intrusion detection system by deliberately placing traps within existing environments. They describe deploying a series of interconnected honeytokens, each with an exploitation difficulty level, to categorize attacks, profile the attacker and steer the execution flow into a maze-like scenario aimed at distracting, gathering forensic evidence and potentially identifying or deterring the attacker.
CloudHoneypotHoneytoken
Paper2017
Material reviewed: AbstractBased on cooperation with AWN University and the Indonesia Honeypot Project (IHP) of the Ministry of Communications and Informatics, the authors describe using a honeynet to protect and monitor public cloud computing networks, and analyzing its datalog through a k-means approach to profile DDoS attacks based on the timestamp recorded in the data.
CloudNetworkHoneypot
Paper2016
Material reviewed: Publisher metadataBibliographic record on decoy virtual machines in cloud. The abstract and findings still require review.
CloudHoneypot
Paper2014
Material reviewed: AbstractThis work addresses the challenge of detecting and collecting payloads of zero-day polymorphic worms in homogeneous and heterogeneous cloud computing platforms. The authors propose a high-interaction honeypot that inspects VM memory and disk images using open-source forensic tools. According to the authors, experiments show the proposed approach overcomes the identified challenges.
CloudHoneypot
Paper2013
Material reviewed: AbstractThe paper formulates an attack-defense scenario as a mathematical model in which the defender applies both proactive and reactive defense mechanisms against attackers with different attack strategies, assuming attackers have incomplete information and imperfect knowledge of the target network. The authors report that, based on their experiment results, a proactive defense strategy is suitable against aggressive attackers under "winner takes all" circumstances, while a reactive strategy works better against less aggressive attackers under "fight to win or die" circumstances.
NetworkCloudHoneypot