Paper2026
Material reviewed: AbstractThe authors propose TAB-DEN, a framework for IoT healthcare systems that combines a permissioned blockchain with Proof of Authority consensus for decentralized authentication, a hierarchical edge architecture of primary and secondary edge servers that compute trust scores in real time and redirect traffic according to trustworthiness, and deception-based edge nodes acting as honeypot-like environments to attract, isolate and profile attackers. The stated aim is to provide scalable and quantum-resistant security, recording intrusion events through a lattice-based post-quantum signature scheme so that attack records are immutable and verifiable on the distributed ledger.
IoTNetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors propose a dynamic honeypot framework combining a reinforcement-learning deception agent (tabular Q-learning, formalized as an MDP), threat-intelligence fusion via indicators of compromise, and automated containment actions. Its purpose is to adapt the honeypot's exposed persona and guide deception decisions, evaluated in an isolated virtualized testbed.
NetworkCloudHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe paper introduces Co-ADAM, a defense framework that formalizes cyber deception in the Industrial Internet of Things (IIoT) as a constrained Markov decision process with an embedded signaling game, aiming to jointly model the deception investment level and a co-evolutionary adversary that accumulates skepticism. The authors describe training a deep Q-network (DQN) defender against an adaptive attacker pool with budget constraints and skepticism dynamics embedded in the environment, and report evaluation on several IIoT datasets and a physical testbed.
IoTOT/ICSHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors propose using honey drones as a deception strategy to defend unmanned aerial vehicle (UAV) mission systems against denial-of-service attacks. They formulate an attacker-defender optimization problem based on radio signal strength and present an approach called HT-DRL, combining hypergame theory with deep reinforcement learning to identify optimal deception strategies.
IoTNetworkDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThis paper presents LDT-FRL, a defense framework combining temporal attention encoders, lightweight digital twins, and a federated reinforcement learning (PPO) agent capable of redirecting suspicious traffic to honeypots in IoMT (Internet of Medical Things) environments. According to the authors, the system was evaluated on public network traffic benchmarks, achieving high classification metrics and explainability via techniques such as SHAP and Grad-CAM.
IoTNetworkHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe paper proposes HIVE-O, a decentralized honeypot framework for IoT ecosystems, with lightweight distributed nodes that capture, analyze and share attack intelligence without a single point of control. The authors describe emulation of IoT services and protocols and an experimental evaluation of reconnaissance, exploitation and denial-of-service attempts.
IoTHoneypotDecoy
Paper2026
Material reviewed: AbstractThis work proposes Federated TGCN-A2C, an architecture integrating temporal graph convolutional networks, LSTM-based digital twins, and a federated actor-critic agent to decide between allowing, isolating, or redirecting traffic to honeypots in IoT/IoMT devices. The authors report evaluations on public cybersecurity datasets along with explainability analysis supporting the system's decision-making.
IoTNetworkHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe study proposes QuantumGuard, a proactive cybersecurity framework that combines cognitive honeynets, post-quantum-secured intelligence channels and reinforcement-learning-driven deception adaptation across 6G-enabled cyber-physical environments. The authors aim to integrate a cognitive honeynet orchestrator, a deception policy engine operating under partial observability, a transformer-based MITRE ATT&CK attribution network and a post-quantum federated intelligence bus into a single closed-loop control architecture, and they report a preliminary evaluation on benchmark datasets and a 320-endpoint testbed.
NetworkIoTHoneypotDecoy
Paper2026
Material reviewed: AbstractThe article presents SAGE, an adaptive Internet of Things (IoT) honeypot that combines Finite-State Machine (FSM)-driven protocol emulation with GraphRAG-enhanced retrieval to model stateful IoT protocols and generate responses using a Large Language Model (LLM). The authors also describe a fact-checking engine and a feedback mechanism intended to refine responses and progressively expand state-response mappings based on observed adversarial interactions.
IoTHoneypotAdversary engagement
Paper2026
Material reviewed: Public pageThe authors propose SecuPi, a compact Raspberry Pi-based system that combines real-time traffic monitoring, hybrid intrusion detection (signature-based and machine learning) and automated threat response. As deception and proactive defense mechanisms, they propose the use of honeypots together with automatic firewall updates and Moving Target Defense (MTD).
NetworkIoTHoneypotMoving target defense
Paper2026
Material reviewed: AbstractThe authors introduce HoneyMed, a protocol-aware honeypot framework that simulates healthcare and IoT services in order to collect malicious interactions, transform them into machine-learning tabular features, and classify attack types in real time. Its stated purpose is to provide threat visibility for IoMT security testbeds using decoys, feature extraction and lightweight classifiers, without interacting with production medical assets.
IoTNetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThe study proposes an unsupervised detection system built on autoencoder-family models that learn normal traffic behavior and flag anomalies through reconstruction error (MSE), applied to multi-source metadata (Wireshark, firewall logs, and a T-Pot honeypot) collected over fifteen days from a real enterprise VLAN. The authors incorporate external threat intelligence (AbuseIPDB, OTX) and a multi-dimensional scoring system (MDSS) to convert raw detections into prioritized risk scores, and validate anomalies through two MITRE ATT&CK pipelines.
NetworkIoTHoneypot
Paper2025
Material reviewed: AbstractThis work presents a longitudinal analysis of attacker behavior using HoneyTrap, an adaptive honeypot framework deployed across geographically distributed nodes to emulate vulnerable services. According to the authors, more than 60.3 million events were collected over a 24-day window, with data transformed into Parquet format for scalable analytics. The authors report that HTTP/HTTPS traffic and SSH brute-force attacks were predominant, alongside activity targeting less common services like Minecraft and SMB.
NetworkIoTHoneypot
Paper2025
Material reviewed: AbstractThe authors present D3O-IIoT, a reinforcement learning model that dynamically coordinates deception techniques such as honeypot deployment, moving target defense, fake telemetry injection, and node isolation, driven by real-time threat monitoring. The defense problem is formulated as a Markov Decision Process, in which a Dueling Deep Q-Network agent maximizes a multi-objective reward to balance attack mitigation, deception engagement, false positive control, and resource cost.
IoTOT/ICSHoneypotMoving target defense
Paper2024
Material reviewed: Public pageProposes using hardware honeypots as an additional defensive layer to detect and mitigate hardware Trojans in IoT devices, aiming to protect them from operational failures, denial of service, or data leakage.
IoTHoneypot
Paper2024
Material reviewed: AbstractThis work, according to its authors, addresses security in Advanced Metering Infrastructure (AMI) for smart grids using honeypots combined with federated learning. They propose FedPot, which includes a data quality measure and a fair incentive mechanism allowing small power suppliers to share locally trained models with traditional retailers without exposing confidential data. The authors report, via simulations on realistic microgrid log datasets, improvements over state-of-the-art techniques in both the security model and reward distribution.
OT/ICSIoTHoneypot
Paper2024
Material reviewed: AbstractThe work addresses security in Internet of Things (IoT) ecosystems in smart cities by using honeypot data and machine learning and neural network algorithms for attack detection. The authors set out to identify datasets from IoT-targeted honeypots, evaluate threat detection algorithms, and propose security solutions, analyzing real-world cyber-attack data from diverse honeypots simulating IoT devices.
IoTHoneypot
Paper2024
Material reviewed: AbstractAccording to the authors, this paper presents a self-adaptive traffic anomaly detection system for IoT smart home environments, consisting of a honeypot server and a gateway. The honeypot continuously captures traffic and adaptively generates a detection model used by the gateway to identify anomalous traffic, including unknown attacks.
IoTNetworkHoneypot
Paper2023
Material reviewed: AbstractThe authors propose a honeypot for IoT devices that uses machine learning techniques to automatically learn and interact with attackers, aiming to overcome the limitations of manually crafting low- and high-interaction honeypots given device heterogeneity. According to the abstract, evaluation of the proposed model indicates improvements in session length with attackers and in capturing more attacks on the IoT network.
IoTHoneypot
Paper2023
Material reviewed: AbstractThe paper proposes a honeypot-based deception approach for Internet-connected video cameras. Its abstract places the proposal in the security and privacy risks of cameras and other video-capable IoT devices.
IoTHoneypot
Paper2023
Material reviewed: AbstractThe authors present HoneyEVSE, a honeypot designed to simulate Electric Vehicle Supply Equipment (EVSE) within the Vehicle-to-Grid paradigm. The system emulates the charging process and login pages with high fidelity to increase attacker engagement. They exposed the honeypot for 30 days on the Internet and report it successfully evaded the Shodan Honeyscore metric while attracting numerous interactions.
IoTOT/ICSHoneypotDecoy
Paper2023
Material reviewed: AbstractThe authors present HoneyIoT, an adaptive high-interaction honeypot for IoT devices that uses a real-device attack trace collection system and reinforcement learning to model and generate convincing responses. According to the paper, differential analysis techniques mutate response values for high fidelity, and after deployment on the public Internet, reported experiments show the system evades pre-attack checks and honeypot detection tools.
IoTHoneypot
Paper2023
Material reviewed: AbstractThe authors propose a deep learning based method to generate synthetic IoT device traffic flows mimicking real traffic, aiming to improve IoT honeypots against attacker detection. According to the abstract, the generator outperforms prior approaches in remaining indistinguishable from real traffic.
IoTNetworkHoneypotDecoy
Paper2022
Material reviewed: AbstractThe authors propose a game-based collaborative defense approach for UAV networks, using low/medium-interaction honeypots and contract-based incentive mechanisms combined with reinforcement learning to encourage UAVs to share captured attack data.
NetworkIoTHoneypot