Paper2022
Material reviewed: AbstractThe paper describes a security framework for multi-cloud environments aimed at diverting an attacker and gaining time to analyze and mitigate intrusions. The proposed mechanism consists of modules for managing the multi-cloud platform, an intrusion detection and prevention system, and honeypots, with detection results compared in a two-phase scenario.
CloudNetworkHoneypotDecoy
Paper2022
Material reviewed: AbstractThe paper describes setting up a honeypot on a cloud service and analyzing the activity it captures. It then applies machine learning algorithms to predict the type of threat detected in the honeypots.
CloudHoneypot
Paper2021
Material reviewed: AbstractThe authors propose a defensive deception framework for the container-based cloud, aiming to reveal stealthy attackers by presenting intentionally falsified information. The approach formalizes a System Risk Graph (SRG) as an updatable adversarial model, trains a deep reinforcement learning (DRL) model over the SRG so the agent produces decoy placement and deceptive routing strategies, and defines a coefficient of deception to evaluate the placement strategy.
CloudDecoyAdversary engagement
Paper2021
Material reviewed: AbstractThis paper presents an approach to container-based honeypots that simulate container escapes as a deception technique in the context of cloud computing virtualization. According to the authors, it investigates the possibilities of container-based honeypots to imitate legitimate network targets and raise alerts on attacker interactions, allowing study of attacker techniques.
NetworkCloudHoneypotDecoy
Paper2020
Material reviewed: AbstractThis paper proposes a framework for preventing ransomware attacks by combining blockchain, honeypot techniques, and cloud and edge computing. The authors state the framework is analyzed mainly on IoT devices, with potential generalization to other malware attacks.
IoTCloudHoneypot
Open software2020
Material reviewed: Repository metadataRepository about Docker API simulation; documentation and maintenance require further review.
CloudHoneypot
Paper2020
Material reviewed: Public pageThe article analyzes data captured by a honeypot to describe how cryptomining campaigns infect a host and seek new vulnerable targets. It includes an analysis of victim IP addresses.
CloudHoneypot
Paper2018
Material reviewed: AbstractThe authors propose a high-interaction, self-acting spontaneous honeypot (SAS HP) whose behavior can dynamically change after learning from an attacker, and present its architecture for deployment in cloud environments to analyze attack patterns and secure cloud systems. They also describe how instances of the honeypot could be made available as a service to customers and how it could be deployed within the cloud, with the stated aim of developing a working prototype.
CloudHoneypot
Paper2018
Material reviewed: AbstractThe work presents a dashboard visualization using honeypot log data from the AWN campus connected to IHP (Kemkominfo) Jakarta on a public cloud computing service network, aiming to categorize timestamps. The K-means clustering method is applied to categorize attacks into morning, noon, and night periods based on Western Indonesia Time and to identify ports 21, 80, 135, and 445 affected by DDoS attacks, with the stated expectation of supporting monitoring and anticipation of cloud network vulnerabilities.
CloudNetworkHoneypot
Paper2017
Material reviewed: AbstractThe authors describe deploying a honeynet of low-interaction and high-interaction SSH honeypots across three geographic regions of a public cloud environment in order to gather threat intelligence and obtain tailored indicators of compromise for e-learning platforms. The collected logs are analyzed through log collectors and parsers that translate the data into real-time dashboards, with the aim of understanding attackers' tactics according to time zones and geolocations and helping the education landscape prepare for emerging threats.
CloudNetworkHoneypot
Paper2017
Material reviewed: AbstractThe authors address the difficulty of distinguishing large-scale non-directional attacks from advanced persistent threats (APTs) and propose implementing honeytokens and honeypots as an intrusion detection system by deliberately placing traps within existing environments. They describe deploying a series of interconnected honeytokens, each with an exploitation difficulty level, to categorize attacks, profile the attacker and steer the execution flow into a maze-like scenario aimed at distracting, gathering forensic evidence and potentially identifying or deterring the attacker.
CloudHoneypotHoneytoken
Paper2017
Material reviewed: AbstractBased on cooperation with AWN University and the Indonesia Honeypot Project (IHP) of the Ministry of Communications and Informatics, the authors describe using a honeynet to protect and monitor public cloud computing networks, and analyzing its datalog through a k-means approach to profile DDoS attacks based on the timestamp recorded in the data.
CloudNetworkHoneypot
Paper2016
Material reviewed: Publisher metadataBibliographic record on decoy virtual machines in cloud. The abstract and findings still require review.
CloudHoneypot
Paper2014
Material reviewed: AbstractThis work addresses the challenge of detecting and collecting payloads of zero-day polymorphic worms in homogeneous and heterogeneous cloud computing platforms. The authors propose a high-interaction honeypot that inspects VM memory and disk images using open-source forensic tools. According to the authors, experiments show the proposed approach overcomes the identified challenges.
CloudHoneypot
Paper2013
Material reviewed: AbstractThe paper formulates an attack-defense scenario as a mathematical model in which the defender applies both proactive and reactive defense mechanisms against attackers with different attack strategies, assuming attackers have incomplete information and imperfect knowledge of the target network. The authors report that, based on their experiment results, a proactive defense strategy is suitable against aggressive attackers under "winner takes all" circumstances, while a reactive strategy works better against less aggressive attackers under "fight to win or die" circumstances.
NetworkCloudHoneypot
Case study—
Material reviewed: Public pageShadowPlex selection and pilot story published by Acalvio for a consumer goods company.
CloudIdentityDecoy
Open software—
Material reviewed: Repository metadataCritical readingOpen project for creating decoy tokens that alert when someone uses them.
IdentityCloudHoneytoken
Service—
Material reviewed: Public pageCritical readingACSG publishes a managed decoy and continuous-monitoring offering for IT, cloud and ICS.
NetworkCloudDecoyHoneytoken
Open software—
Material reviewed: Repository documentationDocumented project implementing a Docker-based high-interaction SSH honeypot, using patched bash and OpenSSH to log commands and credentials, integrated into a larger architecture of agents and attack-detection servers.
NetworkCloudHoneypot
Product—
Material reviewed: Public pageCritical readingCommercial decoy and breadcrumb platform for network, identity and cloud, according to Fidelis.
NetworkIdentityDecoyHoneytoken
Case study—
Material reviewed: Public pageCritical readingCounterCraft describes a bank API digital twin that attracted an attack within 30 days; outcome attributed to the vendor.
ApplicationCloudDecoy
Open software—
Material reviewed: Repository documentationDecoy software documenting bounded simulated responses for Kubernetes and Docker APIs, Ollama and other AI APIs, a misconfigured kubelet, and HTTP probes; it records TCP and UDP interactions without replying. It supports synthetic Secret honeytokens.
CloudNetworkHoneypotHoneytoken
Open software—
Material reviewed: Repository documentationProof-of-concept tool that places breadcrumbs and decoys, such as fake files and credentials, on servers and workstations to draw attackers toward traps. It is not presented as a honeypot itself.
EndpointIdentityHoneytokenDecoy
Open software—
Material reviewed: Repository documentationWeb honeypot documented to create and monitor fake HTTP endpoints whose URLs can be distributed as honeytokens; it is designed for Heroku but can also run on a self-hosted server.
ApplicationCloudHoneypotHoneytoken