Paper2026
Material reviewed: AbstractThe authors propose TAB-DEN, a framework for IoT healthcare systems that combines a permissioned blockchain with Proof of Authority consensus for decentralized authentication, a hierarchical edge architecture of primary and secondary edge servers that compute trust scores in real time and redirect traffic according to trustworthiness, and deception-based edge nodes acting as honeypot-like environments to attract, isolate and profile attackers. The stated aim is to provide scalable and quantum-resistant security, recording intrusion events through a lattice-based post-quantum signature scheme so that attack records are immutable and verifiable on the distributed ledger.
IoTNetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors present AdvancedShelLM, an LLM-based SSH honeypot using a multi-agent architecture (Manager and Worker) intended to improve command understanding and deceptive capability over its predecessor shelLM. According to the abstract, the system was evaluated through unit tests, an AI attacker, human attackers, and an Internet deployment.
NetworkEndpointHoneypotDecoy
Paper2026
Material reviewed: AbstractThis study examines how anchoring effects influence attackers' decisions in specific cyberattack scenarios through two experiments. Experiment 1 compares anchoring measurement methods in Crontab and Hostname tasks; Experiment 2 embeds bias triggers within an end-to-end cyber kill chain scenario.
NetworkEndpointDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThe article examines the application of Cyber Deception technologies to the investigation of current cyber threats and the behavior of potential attackers, arguing for the usefulness of honeypot systems in collecting information on unauthorized access attempts and cyberattack techniques. Its authors propose a laboratory architecture based on a virtual infrastructure using the Cowrie honeypot system, aimed at automated event log collection and continuous monitoring of unauthorized access attempts, authentication processes, executed commands, and subsequent analysis of attacker activity.
NetworkEndpointHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors examine the assumption that decoys can be placed wherever attacker behavior occurs, applying a four-criterion rubric to all 250 MITRE ATT&CK v18.1 techniques. They find only 32% of techniques admit a plausible decoy and describe two placement patterns, Sweep and Seek, offering a simple rule for decoy deployment.
NetworkEndpointDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThis position paper suggests that presenting deception storyline content can influence how human attackers and Large Language Model (LLM) Agent attackers evaluate the authenticity of deception functions and effects on a network or host. The authors introduce HoneyContent, a practiced industry cyber deception model for designing and creating deception storyline content to 'wrap' or embed deception functions, integrating warranting theory and signaling theory, and visualize its use in an industry cyber deception scenario.
NetworkEndpointDecoy
Paper2026
Material reviewed: AbstractThis paper studies how to improve shell emulation accuracy of local open-weight LLM-based SSH honeypots through prompt design and supervised fine-tuning, comparing eight models against their base versions. Using 34 automated unit tests, the authors report that prompt design has a large effect and that fine-tuning effectiveness depends on dataset coverage, with an expanded dataset built from honeypot logs producing stronger local models according to their own measurements.
NetworkEndpointHoneypot
Paper2026
Material reviewed: AbstractThis work studies how large language model (LLM)-based penetration testing agents can allocate their execution budget when encountering honeypots. The authors formalize the attacker's problem as a budgeted decision process in which the agent must decide whether to continue exploitation or skip a target upon honeypot suspicion, proposing a detector-guided policy evaluated in a controlled mixed-host testbed.
NetworkEndpointHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe authors present Mirage Mesh, a lightweight cyber deception framework for Linux environments that applies deception-in-depth across four layers: an SSH decoy built on Cowrie, a system-layer decoy administrative account, a fake Flask web administration interface, and a data-layer honeytoken credential file. The work proposes a shared DecoyAlertEvent schema to normalize observations from these layers, process them through a Wazuh-based detection and active-response pipeline with Python orchestration, map them to cyber kill-chain stages and MITRE ATT&CK techniques, and evaluate them with a Deception Effectiveness Metric (DEM).
NetworkEndpointHoneypotHoneytoken
Paper2026
Material reviewed: Full textEditor contributionPacheco and Staino present BUDA as an approach to simulating fictitious-user activity and strengthening decoy credibility, aligned with MITRE Engage.
EndpointNetworkDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThis paper presents ShellGames, an SSH shell simulator based on large language models (LLMs) designed to sustain credible interactive deception sessions with adversaries. According to the authors, the system combines techniques such as chain-of-thought reasoning, memory management, speculative command execution, sandbox routing, and subversion detection to address common LLM limitations. The authors report improvements in accuracy, consistency, and state tracking over baselines, along with a user study indicating perceived realism comparable to a real shell.
NetworkEndpointHoneypotMoving target defense
Paper2025
Material reviewed: AbstractThis work presents a machine learning-driven methodology combining cryptic and mimetic cyber deception principles to protect integrated circuits against reverse engineering attacks, using a variational autoencoder (AIG-VAE) and new covert gate variants. The authors report that experiments show effectiveness in maintaining functionality while achieving high camouflage and similarity scores.
EndpointDecoy
Paper2025
Material reviewed: AbstractThe authors present the Hybrid Cyber Deception System (HCDS), described as a Python-developed proactive tool that combines honeypots and honeytokens in a dynamically adaptive mode to simulate realistic services and redirect attackers in controlled, instrumented settings. The system integrates a deception-driven alerts correlation engine built on Python, Pandas and Scikit-learn, along with Moving Target Defense principles for continuous modulation of network parameters and decoy distribution, and was tested in a simulated environment with Windows and Ubuntu servers to profile attackers and detect complex attack vectors.
NetworkEndpointHoneypotHoneytoken
Paper2025
Material reviewed: AbstractThe authors present LLMHoney, an SSH honeypot that uses large language models (LLMs) to generate realistic, dynamic command outputs in real time, combining a dictionary-based virtual file system with LLMs for novel inputs. According to the abstract, the system was evaluated on 138 representative Linux commands across 13 LLM variants, reporting accuracy, latency, and memory metrics, while discussing challenges such as occasional hallucinated outputs.
NetworkEndpointHoneypotDecoy
Paper2025
Material reviewed: AbstractThis study proposes SPADE, a framework that uses generative AI models alongside structured prompt engineering to automate the creation of adaptive cyber deception strategies against dynamic malware. According to the authors, the framework addresses challenges of large language models such as generalized outputs, ambiguity, and scalability constraints, and was evaluated across diverse malware scenarios using metrics like Recall, Exact Match, BLEU, and expert quality assessments, identifying ChatGPT-4o as the top performer.
EndpointNetworkAdversary engagementDecoy
Paper2024
Material reviewed: AbstractThis paper addresses automated content generation for honeyfiles, decoy documents designed to detect intruders. The authors focus on generating realistic charts within such documents, combining a multitask Transformer for captions and plot text with a specialized autoencoder for underlying tabular data. They also introduce a new dataset and a metric (Keyword Semantic Matching) to evaluate semantic consistency of generated content.
EndpointHoneypotDecoy
Paper2024
Material reviewed: AbstractAccording to the authors, this paper reviews the use of large language models (LLMs) in malware detection, including applications to malware honeypots, text-based threat identification, code analysis, and trend detection. The authors propose a classification scheme, performance metrics, and an LLM-based risk mitigation framework, evaluating its performance against LLM-enabled malware.
EndpointHoneypot
Paper2024
Material reviewed: AbstractThe study proposes a malware detection system that combines Particle Swarm Optimization (PSO) with a fuzzyKNN model, using PSO to select a feature set from a malware dataset and employing a honeypot as a controlled environment for collecting samples and training the model. The authors compare their method against standard detection techniques and report that the PSO-fuzzyKNN approach enhances malware detection accuracy.
EndpointHoneypot
Paper2024
Material reviewed: AbstractThis paper proposes a reinforcement learning (RL) approach to simulate ransomware attacks within an environment mirroring real-world networks, aiming to streamline traditional red teaming exercises. According to the authors, experimental results on a 152-host example network show the RL agent's capability to discover and orchestrate attacks on high-value targets while evading honeyfiles (decoy files placed to detect unauthorized access).
NetworkEndpointDecoyAdversary engagement
Paper2024
Material reviewed: AbstractThis work-in-progress paper studies the implementation of deception-in-depth strategies with three initial logical layers: network, host, and data. The authors draw on ideas from military deception, network orchestration, software deception, file deception, fake honeypots, and moving-target defenses, and are building a prototype to test in adversarial environments. According to the authors, the goal is to show that deploying a broad range of deception techniques can better protect systems than single techniques, with a focus on discouraging attacks rather than encouraging attacker engagement.
NetworkEndpointHoneypotDecoy
Paper2023
Material reviewed: AbstractThe work proposes a decision support system based on a Bayesian belief network to guide cyber deception strategies from a detailed model of attacker beliefs, illustrated with a case study using passively observed operating system fingerprinting data. The authors compare the model's prediction accuracy with a sequential artificial neural network and introduce a deception algorithm to select a minimal set of features whose modification would make a system appear as a different operating system.
EndpointNetworkDecoy
Paper2023
Material reviewed: AbstractThis paper explores using ChatGPT-style conversational agents as a dynamic honeypot interface, imitating Linux, Mac, and Windows terminal commands and tools like TeamViewer, nmap, and ping. The authors present ten feasibility tasks intended for defensive teams to simulate honeypot interfaces with minimal risk, aiming to delay or understand attacker tactics, techniques, and procedures.
NetworkEndpointHoneypot
Paper2023
Material reviewed: AbstractThe authors describe symbSODA, an active cyber deception system that analyzes real-world malware using multipath execution to extract Malicious Sub-graphs composed of WinAPIs and map them to ATT&CK tactics and techniques, in order to construct and execute customized deception playbooks. Its stated purpose is to let users create conflict-free deception plans and automate deception orchestration within a deceptive environment.
EndpointDecoyAdversary engagement
Paper2022
Material reviewed: AbstractThe authors describe a TaintDroid-based honeypot monitoring system for embedded devices, in which TaintDroid marks attackers who break into the honeypot and their behavior is then monitored and recorded. The work also reports a feasibility test of the system built by the authors.
IoTEndpointHoneypot