Paper2026
Material reviewed: AbstractThis paper presents a corpus of real scam- and spam-call conversations collected via an active voice-agent honeypot. According to the authors, the system adopts a plausible target persona to sustain interactions with fraudulent callers, recording audio, transcripts, and automatic labels. The study describes the collection system, record structure, and an evaluation of corpus realism and label quality, as well as benchmarking scam detectors trained on synthetic dialogue against real traffic.
NetworkIdentityHoneypotDecoy
Paper2026
Material reviewed: AbstractThis work studies credential exfiltration by LLM agents via indirect prompt injection, proposing three complementary defenses according to the authors: activation probes for pre-output detection, honeytokens calibrated via split conformal prediction, and a cumulative leakage budget tracked across multi-turn conversations. The authors report preliminary results from controlled experiments on open-weight models and a small in-house multi-turn synthetic suite.
ApplicationIdentityHoneytoken
Paper2026
Material reviewed: AbstractThe abstract describes Honey Shield, a deception-driven cybersecurity paradigm for web authentication systems. It proposes a centralized security service interface offering defenses such as honeypot redirection and SQL injection protection, redirecting malicious users to a decoy system and logging incidents for later analysis.
ApplicationIdentityHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors present Mirage Mesh, a lightweight cyber deception framework for Linux environments that applies deception-in-depth across four layers: an SSH decoy built on Cowrie, a system-layer decoy administrative account, a fake Flask web administration interface, and a data-layer honeytoken credential file. The work proposes a shared DecoyAlertEvent schema to normalize observations from these layers, process them through a Wazuh-based detection and active-response pipeline with Python orchestration, map them to cyber kill-chain stages and MITRE ATT&CK techniques, and evaluate them with a Deception Effectiveness Metric (DEM).
NetworkEndpointHoneypotHoneytoken
Paper2026
Material reviewed: AbstractThe paper proposes a password-leak detection method based on Pythagorean triples, generating honeywords from a special graph-structure sequence built using number-theoretic properties of those triples. The authors describe a generation algorithm with a flat distribution and report a security proof and comparative experiments aimed at brute-force resistance and storage efficiency.
IdentityHoneytoken
Paper2026
Material reviewed: AbstractThis thesis proposes game-theoretic and optimisation-based models for hardening Active Directory attack graphs. According to the authors, it introduces a honeypot/decoy placement model that minimises shortest paths and Domain Admin-reachable nodes, along with strategies accounting for the dynamic nature of the graph and adaptive prioritisation models incorporating administrator feedback. The authors note that the underlying problems are computationally intractable.
IdentityNetworkHoneypotDecoy
Paper2026
Material reviewed: Full textFormal analysis of honeytoken limits when trusted agents and attackers share memory or policies.
ApplicationIdentityHoneytoken
Paper2025
Material reviewed: AbstractAccording to the authors, this work proposes the design and implementation of an LLM-based honeypot simulating an LDAP server, a protocol critical to identity and access management in organizations. The proposed solution aims to offer a flexible and realistic tool capable of convincingly interacting with attackers, contributing to early detection and threat analysis.
IdentityNetworkHoneypot
Paper2025
Material reviewed: AbstractThis paper presents, according to the authors, the first large-scale real-world evaluation of an LLM-based scambaiting system, designed as a conversational honeypot to engage scammers and extract actionable threat intelligence such as mule bank accounts. Over a five-month deployment, the system initiated thousands of engagements, reporting an information disclosure rate and strong alignment between LLM-generated responses and human operator preferences.
IdentityNetworkHoneypotAdversary engagement
Paper2024
Material reviewed: Publisher metadataDOI-identified publication on language-model honeytoken generation; text analysis is pending.
IdentityHoneytoken
Paper2023
Material reviewed: AbstractThis paper, according to its authors, extends a previously introduced two-factor Honeytoken authentication method by incorporating blockchain technology. The stated goal is to strengthen the method against tampering attacks. The authors report evaluation results suggesting improved performance and operational efficiency when integrating blockchain.
IdentityHoneytoken
Paper2023
Material reviewed: AbstractThe authors propose a framework combining moving target defense (MTD), deception, and attribute-based access control (ABAC) to make unauthorized insider access more difficult and costly. They introduce correlated attributes into ABAC and generate mutated policies from them. According to the authors, evaluation results show the framework effectively identifies correlated attributes and produces adequate mutated policies without affecting system usability.
IdentityApplicationMoving target defenseAdversary engagement
Paper2023
Material reviewed: AbstractAccording to its authors, this paper studies a Stackelberg game between attacker and defender over large, dynamic Active Directory (AD) attack graphs, where the defender deploys honeypots to prevent the attacker from reaching high-value targets. The authors propose a mixed-integer programming (MIP) formulation and a clustering-based approach (dyMIP(m)) to handle large dynamic graph instances, reporting near-optimal results under realistic conditions.
IdentityNetworkHoneypot
Paper2023
Material reviewed: AbstractThe authors propose a signaling game framework between a defender and an insider human agent, using quantum decision theory to exploit cognitive biases and counter insider attacks. The defender deceives the attacker by luring them toward decoy sensors via generators that produce perceptions of classical signals. According to the authors, results show that strategically designed generators can worsen the attacker's ability to identify decoys compared to schemes without generators.
IdentityDecoyAdversary engagement
Paper2023
Material reviewed: AbstractThe work addresses honeyword generation: fake passwords that accompany the real password (the "sugarword") in a password-cracking detection system, where a honeychecker distinguishes the real password from the fake ones. The authors describe a honeyword generation method based on a proposed discrete salp swarm algorithm (SSA), a bio-inspired metaheuristic, and present the proposed methodology alongside experimental results compared with previous strategies.
IdentityHoneytokenDecoy
Paper2022
Material reviewed: AbstractThe paper proposes a method for generating honeywords using the meerkat clan intelligence algorithm, a metaheuristic swarm intelligence algorithm, aiming to improve the generation process, honeyword properties, and address issues of prior methods. The authors present previous methods, explain the proposed method, and compare experimental results.
IdentityHoneytoken
Paper2022
Material reviewed: AbstractThe paper proposes using the harmony search algorithm (HSA), a music-inspired metaheuristic, to generate honeywords (false passwords that accompany the true password) within a password-cracking detection system. The authors review prior honeyword generation techniques, present their method, and compare experimental results with earlier approaches.
IdentityHoneytoken
Paper2022
Material reviewed: Full textBibliographic record on controllable fake documents. The abstract and findings still require review.
IdentityHoneytoken
Paper2022
Material reviewed: Full textThe prototype identified 14 of the 20 studied types in the described configuration. The authors note possible false positives and describe types the tool does not cover.
ApplicationIdentityHoneytoken
Paper2022
Material reviewed: AbstractThis survey reviews twenty-three honeyword (decoy password) based authentication techniques introduced by Juels and Rivest in 2013, which aim to detect server-side threats on password files and notify the administrator when an attacker attempts to exploit a compromised file. The authors compare existing approaches and identify remaining gaps and emergent research opportunities.
IdentityDecoyHoneytoken
Paper2021
Material reviewed: Full textTwo-factor authentication mechanism combining decoy codes with Google Authenticator.
IdentityHoneytoken
Paper2021
Material reviewed: Full textVision paper on automated generation of realistic deception artifacts with machine learning.
NetworkIdentityDecoy
Paper2020
Material reviewed: Publisher metadataDOI-identified publication on honeytoken fingerprinting methods; text analysis is pending.
IdentityHoneytoken
Paper2019
Material reviewed: AbstractThe work examines n-session recording attack resilient unaided authentication services (n-SRRUASs) and notes that they cope poorly with server-side issues within their authentication procedure. The authors propose generic principles for incorporating honeywords (fake passwords) into n-SRRUASs and, with the help of an existing n-SRRUAS, show the idea is implementable in practice to fill that gap.
IdentityHoneytoken