Paper2019
Material reviewed: AbstractAccording to the authors, this paper proposes an SDN-based in-network honeypot that reroutes traffic from suspicious nodes and intelligently spoofs it with misleading information to confuse attackers in IoT environments, without requiring dedicated hardware. The authors state preliminary evaluations show little impact on network performance.
IoTNetworkHoneypotDecoy
Paper2018
Material reviewed: AbstractThe authors describe a measurement study of attacks against or based on IoT protocols, using data obtained from a /15 network telescope and three honeypots with 15 IPv4 addresses. The study reports that telnet-based malware is still widely used, that infected devices are employed not only for DDoS attacks but also for crypto-currency mining, and that attackers look for IoT-specific services using MQTT, CoAP, UPnP, and HNAP, and target vulnerabilities of routers and cameras with HTTP.
IoTNetworkHoneypot
Paper2018
Material reviewed: AbstractThe authors describe the use of honeypots as a decoy-based technology deployed in a network, aimed at defending IoT devices from attacks and gathering information about the attacker's device. The paper presents how honeypots, acting as cost-effective deception models, entice attackers in order to preserve information against attacks.
IoTNetworkHoneypotDecoy
Paper2018
Material reviewed: AbstractThe authors propose ThingPot, an interactive IoT honeypot that, per the abstract, targets the whole IoT platform rather than just application protocols, with a proof-of-concept implementing XMPP and a REST API to mimic a Philips Hue smart lighting system. The abstract states it was deployed for 1.5 months, capturing data that revealed five types of attacks and attack vectors against smart devices.
IoTHoneypot
Paper2017
Material reviewed: AbstractThis work proposes SIPHON, a scalable high-interaction physical honeypot architecture for IoT devices. According to the authors, the design uses geographically distributed 'wormholes' to expose a few physical devices across many Internet IP addresses. The authors describe a large-scale experiment with real devices (IP cameras, an NVR, and an IP printer) deployed across multiple cities and countries, recording traffic and login attempts over two months.
IoTNetworkHoneypot
Paper2016
Material reviewed: Full textThe authors recorded 180,581 visiting IP addresses and 481,521 download attempts, manually collected 106 binaries, and described five malware families.
IoTNetworkHoneypot
Paper2010
Material reviewed: AbstractThis paper presents Mirage, a low-cost system designed by the authors to mitigate corporate espionage in RFID-enabled retail environments. According to the authors, Mirage uses programmable RFID tags as honeytokens to inject noise into inventory data, randomizing sales and restocking trends observable by potential attackers.
IoTHoneytoken