Paper2023
Material reviewed: AbstractThis paper explores using ChatGPT-style conversational agents as a dynamic honeypot interface, imitating Linux, Mac, and Windows terminal commands and tools like TeamViewer, nmap, and ping. The authors present ten feasibility tasks intended for defensive teams to simulate honeypot interfaces with minimal risk, aiming to delay or understand attacker tactics, techniques, and procedures.
NetworkEndpointHoneypot
Paper2023
Material reviewed: AbstractThe authors describe symbSODA, an active cyber deception system that analyzes real-world malware using multipath execution to extract Malicious Sub-graphs composed of WinAPIs and map them to ATT&CK tactics and techniques, in order to construct and execute customized deception playbooks. Its stated purpose is to let users create conflict-free deception plans and automate deception orchestration within a deceptive environment.
EndpointDecoyAdversary engagement
Paper2022
Material reviewed: AbstractThe authors describe a TaintDroid-based honeypot monitoring system for embedded devices, in which TaintDroid marks attackers who break into the honeypot and their behavior is then monitored and recorded. The work also reports a feasibility test of the system built by the authors.
IoTEndpointHoneypot
Paper2022
Material reviewed: AbstractThis paper introduces TSM (Topic Semantic Matching), a metric based on topic modelling and semantic matching in embedding spaces to measure the enticement of honeyfiles relative to local content. According to the authors, it is the first measure using NLP techniques to quantify this enticement robustly against paraphrasing, supported by a honeyfile corpus built with various NLP methods.
EndpointHoneypotDecoy
Paper2021
Material reviewed: AbstractThe authors present GPT-2C, a run-time system that leverages the pre-trained GPT-2 model to parse dynamic logs generated by a Cowrie SSH honeypot, addressing interoperability limitations with EDR and SIEM technologies. According to the abstract, the fine-tuned model achieves 89% inference accuracy in the new domain with acceptable execution latency.
NetworkEndpointHoneypot
Paper2021
Material reviewed: AbstractThe authors extend their anti-ransomware tool R-Locker to Windows, relying on a honeyfile-based approach in which 'infinite' trap files are disseminated around the target filesystem for early detection and to block ransomware action. The Windows version addresses differences in FIFO handling and adds improved global management of honeyfiles and (semi)automated blocking of suspicious ransomware through the dynamic use of white-/black-lists.
EndpointHoneytokenDecoy
Paper2021
Material reviewed: AbstractThe authors describe monitoring honeypot sensors deployed on Raspberry Pi devices integrated with Modern Honey Network, using SNMP as a network management function. The aim is to observe system resources and analyze how the number of attacks affects sensor performance.
NetworkEndpointHoneypot
Paper2021
Material reviewed: AbstractAccording to the authors, this paper proposes an approach to generate realistic user activity on IT systems, combining deterministic and deep learning-based methods through an external agent instrumented on each machine. The aim is to improve the credibility of attacker analysis platforms, such as honeynets, and facilitate the creation of coherent scenarios.
NetworkEndpointHoneypotAdversary engagement
Paper2021
Material reviewed: AbstractThe paper proposes an intelligent defense method for mobile-terminal unknown threats based on honeypot technology, as deposited by the authors. The approach aims to induce intruders to attack the honeypot terminal in order to delay attacks on the real target and to monitor, collect and analyze attack behavior.
IoTEndpointHoneypot
Paper2021
Material reviewed: Full textHistorical review of honeypots, honeytokens and moving target defense from the late 1980s through 2021.
NetworkEndpointHoneypotHoneytoken
Paper2020
Material reviewed: AbstractThis paper, according to its authors, presents an adaptive agent that uses active deception to recognize a cyber attacker's intent, modeling the problem as a two-agent sequential decision process via factored I-POMDPs. The authors describe using honeypots and decoys across multiple attack phases to refine predictions about attacker behavior, rather than merely delaying or confusing attackers.
NetworkEndpointHoneypotDecoy
Paper2020
Material reviewed: Full textCritical readingSurvey of defensive deception models and techniques in networks, hosts and cryptographic mechanisms.
NetworkEndpointDecoy
Dataset or lab2020
Material reviewed: Public pageA set of PANDA traces collected with PANDAcap on a VM configured to accept all passwords for root, intended as a starting point for analyzing SSH brute force attacks. The material is organized into full-system traces, disk images and network captures.
NetworkEndpointHoneypotAdversary engagement
Paper2018
Material reviewed: Publisher metadataBibliographic record on ransomware tracing through deception. The abstract and findings still require review.
EndpointDecoy
Paper2015
Material reviewed: AbstractThis paper presents Apate, a Linux Kernel Module that logs, blocks, and manipulates system calls based on configurable conditions such as PID or UID. According to the authors, Apate serves as a building block to harden high-interaction honeypots and extend attacker interaction without introducing new vulnerabilities.
EndpointHoneypot
Open software2015
Material reviewed: Repository metadataRepository about capture of USB-propagated malware; documentation and maintenance require further review.
EndpointHoneypot
Paper2013
Material reviewed: AbstractThe paper surveys recent research on smartphone honeypots. The authors describe challenges in setting up a smartphone honeypot, the methods used to build it, and the results and recommendations obtained.
EndpointHoneypot
Paper2009
Material reviewed: AbstractThe authors propose a system that uses honeypots not only to detect malicious traffic but also to generate and broadcast on-the-fly anti-malware signatures for new and unknown malware in a network, mimicking the way malware itself spreads. According to the abstract, this would allow effective initial control over viruses not yet identified by established security firms.
NetworkEndpointHoneypot
Open software—
Material reviewed: Repository documentationScript for generating VirtualBox templates that make virtual machines harder to detect. It can support a less recognizable decoy VM, but the documentation does not present it as a honeypot.
Endpoint
Open software—
Material reviewed: Repository documentationArgos is an advertised honeypot using dynamic taint analysis to detect and analyze control flow attacks.
NetworkEndpointHoneypot
Open software—
Material reviewed: Repository documentationAn academic project that deploys a honeypot alongside an Elastic stack (Elasticsearch/Kibana) and ElastAlert, including a custom 'MITREAttack' alert that writes information according to the MITRE ATT&CK matrix for detecting and classifying attacks.
NetworkEndpointHoneypot
Product—
Material reviewed: Public pageCritical readingPersistent instrumented environments for malware detonation and adversary observation, according to the platform description.
NetworkEndpointDecoyAdversary engagement
Case study—
Material reviewed: Public pageCritical readingEnergy company Shadow adoption story published by Proofpoint; investigation-time reduction is a customer statement reported by the vendor.
EndpointIdentityDecoy
Open software—
Material reviewed: Repository documentationProof-of-concept tool that places breadcrumbs and decoys, such as fake files and credentials, on servers and workstations to draw attackers toward traps. It is not presented as a honeypot itself.
EndpointIdentityHoneytokenDecoy