Paper2018
Material reviewed: AbstractThe authors present 'ProfileGen', a method for automatically generating realistic honeypot profiles for professional social networks, intended to attract malicious actors in online social networks. They report that an evaluation by domain experts confirmed the generated profiles were indistinguishable from real ones.
IdentityApplicationHoneypot
Paper2017
Material reviewed: AbstractThis paper examines the use of honeypot data for employee information security awareness and education training. According to the authors, two honeypots were deployed at a private university in Singapore and the resulting data were analyzed. Drawing on Routine Activity Theory, they propose a conceptual training model called EASY (Engaging Stakeholders, Acceptable Behavior, Simple Teaching method, Yardstick) for designing security awareness programs.
NetworkIdentityHoneypot
Paper2013
Material reviewed: Full textProposal for false passwords per account and a separate honeychecker that detects their use.
IdentityHoneytoken
Case study—
Material reviewed: Public pageShadowPlex selection and pilot story published by Acalvio for a consumer goods company.
CloudIdentityDecoy
Open software—
Material reviewed: Repository documentationWeb honeypot that responds to HEAD and GET requests with an HTTP Basic challenge and logs received credentials; it accepts no username or password.
ApplicationIdentityHoneypot
Open software—
Material reviewed: Repository documentationA honeypot project (now outdated) that deploys decoy clients and services to detect compromise via traffic discrepancies and honeytoken credential reuse.
NetworkIdentityHoneypotHoneytoken
Open software—
Material reviewed: Repository metadataCritical readingOpen project for creating decoy tokens that alert when someone uses them.
IdentityCloudHoneytoken
Case study—
Material reviewed: Public pageCritical readingVendor-published story of Fidelis Deception use at a North American children’s hospital.
NetworkIdentityDecoy
Service—
Material reviewed: Public pageCritical readingECCA offering in Egypt and GCC listing integration, independent services, training and managed deception.
NetworkIdentityDecoy
Case study—
Material reviewed: Public pageCritical readingEnergy company Shadow adoption story published by Proofpoint; investigation-time reduction is a customer statement reported by the vendor.
EndpointIdentityDecoy
Product—
Material reviewed: Public pageCritical readingCommercial decoy and breadcrumb platform for network, identity and cloud, according to Fidelis.
NetworkIdentityDecoyHoneytoken
Community or education—
Material reviewed: Repository documentationA curated GitHub list aggregating open-source honeypot resources (database, web, WordPress, service, ICS/SCADA honeypots), network and data analysis tools, and deployment guides, organized by category.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationProof-of-concept tool that places breadcrumbs and decoys, such as fake files and credentials, on servers and workstations to draw attackers toward traps. It is not presented as a honeypot itself.
EndpointIdentityHoneytokenDecoy
Open software—
Material reviewed: Repository documentationA Windows tool that creates breadcrumbs and honeytokens, such as fake credentials in Windows Credential Manager, to lead attackers toward honeypots.
EndpointIdentityHoneytokenDecoy
Open software—
Material reviewed: Repository documentationA Ubuntu-based Docker image that sets up an SSH honeypot, logging usernames and passwords used by attackers during login attempts, based on code and instructions from an external tutorial.
NetworkIdentityHoneypot
Product—
Material reviewed: Public pageCritical readingInsightIDR capabilities for honeypots, honey users, files and credentials; documentation describes interaction alerts.
NetworkIdentityHoneypotHoneytoken
Service—
Material reviewed: Public pageManaged deception offering that Wipro describes in partnership with Acalvio.
NetworkIdentityDecoy
Product—
Material reviewed: Public pageCritical readingDocumented feature tagging honeytoken accounts and devices; sign-ins generate Defender for Identity alerts.
IdentityHoneytoken
Product—
Material reviewed: Public pageCritical readingCommercial identity protection component deploying endpoint deceptions to alert on lateral movement, according to Proofpoint.
EndpointIdentityDecoyHoneytoken
Product—
Material reviewed: Public pageCritical readingCommercial deception portfolio for identity, cloud and networks, according to Acalvio documentation.
IdentityCloudDecoyHoneytoken
Product—
Material reviewed: Public pageCritical readingCommercial decoy product for detecting interactions with systems that appear legitimate.
NetworkIdentityHoneypotHoneytoken
Paper—
Material reviewed: AbstractThe thesis proposes an authentication framework combining multi-factor authentication with honeytoken-based deception techniques. It describes three successive architectures: static honeytokens to improve detection of compromised credentials, the 2FHA mechanism combining one-time passwords (Google Authenticator) with honeytokens, and a final architecture with session-bound honeytokens, blockchain-supported auditing, and smart contracts on Ethereum.
IdentityApplicationHoneytokenDecoy
Product—
Material reviewed: Public pageCritical readingZscaler product distributing decoys and interaction alerts, according to its product page.
NetworkIdentityDecoyHoneytoken