Paper2022
Material reviewed: AbstractThis paper introduces TSM (Topic Semantic Matching), a metric based on topic modelling and semantic matching in embedding spaces to measure the enticement of honeyfiles relative to local content. According to the authors, it is the first measure using NLP techniques to quantify this enticement robustly against paraphrasing, supported by a honeyfile corpus built with various NLP methods.
EndpointHoneypotDecoy
Paper2021
Material reviewed: AbstractThe authors present GPT-2C, a run-time system that leverages the pre-trained GPT-2 model to parse dynamic logs generated by a Cowrie SSH honeypot, addressing interoperability limitations with EDR and SIEM technologies. According to the abstract, the fine-tuned model achieves 89% inference accuracy in the new domain with acceptable execution latency.
NetworkEndpointHoneypot
Paper2021
Material reviewed: AbstractThe authors extend their anti-ransomware tool R-Locker to Windows, relying on a honeyfile-based approach in which 'infinite' trap files are disseminated around the target filesystem for early detection and to block ransomware action. The Windows version addresses differences in FIFO handling and adds improved global management of honeyfiles and (semi)automated blocking of suspicious ransomware through the dynamic use of white-/black-lists.
EndpointHoneytokenDecoy
Paper2021
Material reviewed: AbstractThe authors describe monitoring honeypot sensors deployed on Raspberry Pi devices integrated with Modern Honey Network, using SNMP as a network management function. The aim is to observe system resources and analyze how the number of attacks affects sensor performance.
NetworkEndpointHoneypot
Paper2021
Material reviewed: AbstractAccording to the authors, this paper proposes an approach to generate realistic user activity on IT systems, combining deterministic and deep learning-based methods through an external agent instrumented on each machine. The aim is to improve the credibility of attacker analysis platforms, such as honeynets, and facilitate the creation of coherent scenarios.
NetworkEndpointHoneypotAdversary engagement
Paper2021
Material reviewed: AbstractThe paper proposes an intelligent defense method for mobile-terminal unknown threats based on honeypot technology, as deposited by the authors. The approach aims to induce intruders to attack the honeypot terminal in order to delay attacks on the real target and to monitor, collect and analyze attack behavior.
IoTEndpointHoneypot
Paper2021
Material reviewed: Full textHistorical review of honeypots, honeytokens and moving target defense from the late 1980s through 2021.
NetworkEndpointHoneypotHoneytoken
Paper2020
Material reviewed: AbstractThis paper, according to its authors, presents an adaptive agent that uses active deception to recognize a cyber attacker's intent, modeling the problem as a two-agent sequential decision process via factored I-POMDPs. The authors describe using honeypots and decoys across multiple attack phases to refine predictions about attacker behavior, rather than merely delaying or confusing attackers.
NetworkEndpointHoneypotDecoy
Paper2020
Material reviewed: Full textCritical readingSurvey of defensive deception models and techniques in networks, hosts and cryptographic mechanisms.
NetworkEndpointDecoy
Paper2018
Material reviewed: Publisher metadataBibliographic record on ransomware tracing through deception. The abstract and findings still require review.
EndpointDecoy
Paper2015
Material reviewed: AbstractThis paper presents Apate, a Linux Kernel Module that logs, blocks, and manipulates system calls based on configurable conditions such as PID or UID. According to the authors, Apate serves as a building block to harden high-interaction honeypots and extend attacker interaction without introducing new vulnerabilities.
EndpointHoneypot
Paper2013
Material reviewed: AbstractThe paper surveys recent research on smartphone honeypots. The authors describe challenges in setting up a smartphone honeypot, the methods used to build it, and the results and recommendations obtained.
EndpointHoneypot
Paper2009
Material reviewed: AbstractThe authors propose a system that uses honeypots not only to detect malicious traffic but also to generate and broadcast on-the-fly anti-malware signatures for new and unknown malware in a network, mimicking the way malware itself spreads. According to the abstract, this would allow effective initial control over viruses not yet identified by established security firms.
NetworkEndpointHoneypot