Paper2026
Material reviewed: AbstractThis work studies credential exfiltration by LLM agents via indirect prompt injection, proposing three complementary defenses according to the authors: activation probes for pre-output detection, honeytokens calibrated via split conformal prediction, and a cumulative leakage budget tracked across multi-turn conversations. The authors report preliminary results from controlled experiments on open-weight models and a small in-house multi-turn synthetic suite.
ApplicationIdentityHoneytoken
Paper2026
Material reviewed: AbstractThe authors present Mirage Mesh, a lightweight cyber deception framework for Linux environments that applies deception-in-depth across four layers: an SSH decoy built on Cowrie, a system-layer decoy administrative account, a fake Flask web administration interface, and a data-layer honeytoken credential file. The work proposes a shared DecoyAlertEvent schema to normalize observations from these layers, process them through a Wazuh-based detection and active-response pipeline with Python orchestration, map them to cyber kill-chain stages and MITRE ATT&CK techniques, and evaluate them with a Deception Effectiveness Metric (DEM).
NetworkEndpointHoneypotHoneytoken
Paper2026
Material reviewed: AbstractThe paper proposes a password-leak detection method based on Pythagorean triples, generating honeywords from a special graph-structure sequence built using number-theoretic properties of those triples. The authors describe a generation algorithm with a flat distribution and report a security proof and comparative experiments aimed at brute-force resistance and storage efficiency.
IdentityHoneytoken
Paper2026
Material reviewed: Full textFormal analysis of honeytoken limits when trusted agents and attackers share memory or policies.
ApplicationIdentityHoneytoken
Paper2024
Material reviewed: Publisher metadataDOI-identified publication on language-model honeytoken generation; text analysis is pending.
IdentityHoneytoken
Paper2023
Material reviewed: AbstractThis paper, according to its authors, extends a previously introduced two-factor Honeytoken authentication method by incorporating blockchain technology. The stated goal is to strengthen the method against tampering attacks. The authors report evaluation results suggesting improved performance and operational efficiency when integrating blockchain.
IdentityHoneytoken
Paper2023
Material reviewed: AbstractThe work addresses honeyword generation: fake passwords that accompany the real password (the "sugarword") in a password-cracking detection system, where a honeychecker distinguishes the real password from the fake ones. The authors describe a honeyword generation method based on a proposed discrete salp swarm algorithm (SSA), a bio-inspired metaheuristic, and present the proposed methodology alongside experimental results compared with previous strategies.
IdentityHoneytokenDecoy
Paper2022
Material reviewed: AbstractThe paper proposes a method for generating honeywords using the meerkat clan intelligence algorithm, a metaheuristic swarm intelligence algorithm, aiming to improve the generation process, honeyword properties, and address issues of prior methods. The authors present previous methods, explain the proposed method, and compare experimental results.
IdentityHoneytoken
Paper2022
Material reviewed: AbstractThe paper proposes using the harmony search algorithm (HSA), a music-inspired metaheuristic, to generate honeywords (false passwords that accompany the true password) within a password-cracking detection system. The authors review prior honeyword generation techniques, present their method, and compare experimental results with earlier approaches.
IdentityHoneytoken
Paper2022
Material reviewed: Full textBibliographic record on controllable fake documents. The abstract and findings still require review.
IdentityHoneytoken
Paper2022
Material reviewed: Full textThe prototype identified 14 of the 20 studied types in the described configuration. The authors note possible false positives and describe types the tool does not cover.
ApplicationIdentityHoneytoken
Paper2022
Material reviewed: AbstractThis survey reviews twenty-three honeyword (decoy password) based authentication techniques introduced by Juels and Rivest in 2013, which aim to detect server-side threats on password files and notify the administrator when an attacker attempts to exploit a compromised file. The authors compare existing approaches and identify remaining gaps and emergent research opportunities.
IdentityDecoyHoneytoken
Paper2021
Material reviewed: Full textTwo-factor authentication mechanism combining decoy codes with Google Authenticator.
IdentityHoneytoken
Paper2020
Material reviewed: Publisher metadataDOI-identified publication on honeytoken fingerprinting methods; text analysis is pending.
IdentityHoneytoken
Paper2019
Material reviewed: AbstractThe work examines n-session recording attack resilient unaided authentication services (n-SRRUASs) and notes that they cope poorly with server-side issues within their authentication procedure. The authors propose generic principles for incorporating honeywords (fake passwords) into n-SRRUASs and, with the help of an existing n-SRRUAS, show the idea is implementable in practice to fill that gap.
IdentityHoneytoken
Paper2013
Material reviewed: Full textProposal for false passwords per account and a separate honeychecker that detects their use.
IdentityHoneytoken
Open software—
Material reviewed: Repository documentationA honeypot project (now outdated) that deploys decoy clients and services to detect compromise via traffic discrepancies and honeytoken credential reuse.
NetworkIdentityHoneypotHoneytoken
Open software—
Material reviewed: Repository metadataCritical readingOpen project for creating decoy tokens that alert when someone uses them.
IdentityCloudHoneytoken
Product—
Material reviewed: Public pageCritical readingCommercial decoy and breadcrumb platform for network, identity and cloud, according to Fidelis.
NetworkIdentityDecoyHoneytoken
Open software—
Material reviewed: Repository documentationProof-of-concept tool that places breadcrumbs and decoys, such as fake files and credentials, on servers and workstations to draw attackers toward traps. It is not presented as a honeypot itself.
EndpointIdentityHoneytokenDecoy
Open software—
Material reviewed: Repository documentationA Windows tool that creates breadcrumbs and honeytokens, such as fake credentials in Windows Credential Manager, to lead attackers toward honeypots.
EndpointIdentityHoneytokenDecoy
Product—
Material reviewed: Public pageCritical readingInsightIDR capabilities for honeypots, honey users, files and credentials; documentation describes interaction alerts.
NetworkIdentityHoneypotHoneytoken
Product—
Material reviewed: Public pageCritical readingDocumented feature tagging honeytoken accounts and devices; sign-ins generate Defender for Identity alerts.
IdentityHoneytoken
Product—
Material reviewed: Public pageCritical readingCommercial identity protection component deploying endpoint deceptions to alert on lateral movement, according to Proofpoint.
EndpointIdentityDecoyHoneytoken