Paper2019
Material reviewed: AbstractAccording to the authors, this paper proposes an SDN-based in-network honeypot that reroutes traffic from suspicious nodes and intelligently spoofs it with misleading information to confuse attackers in IoT environments, without requiring dedicated hardware. The authors state preliminary evaluations show little impact on network performance.
IoTNetworkHoneypotDecoy
Paper2018
Material reviewed: AbstractThe authors describe a measurement study of attacks against or based on IoT protocols, using data obtained from a /15 network telescope and three honeypots with 15 IPv4 addresses. The study reports that telnet-based malware is still widely used, that infected devices are employed not only for DDoS attacks but also for crypto-currency mining, and that attackers look for IoT-specific services using MQTT, CoAP, UPnP, and HNAP, and target vulnerabilities of routers and cameras with HTTP.
IoTNetworkHoneypot
Paper2018
Material reviewed: AbstractThe authors describe the use of honeypots as a decoy-based technology deployed in a network, aimed at defending IoT devices from attacks and gathering information about the attacker's device. The paper presents how honeypots, acting as cost-effective deception models, entice attackers in order to preserve information against attacks.
IoTNetworkHoneypotDecoy
Paper2018
Material reviewed: AbstractThe authors propose ThingPot, an interactive IoT honeypot that, per the abstract, targets the whole IoT platform rather than just application protocols, with a proof-of-concept implementing XMPP and a REST API to mimic a Philips Hue smart lighting system. The abstract states it was deployed for 1.5 months, capturing data that revealed five types of attacks and attack vectors against smart devices.
IoTHoneypot
Paper2017
Material reviewed: AbstractThis work proposes SIPHON, a scalable high-interaction physical honeypot architecture for IoT devices. According to the authors, the design uses geographically distributed 'wormholes' to expose a few physical devices across many Internet IP addresses. The authors describe a large-scale experiment with real devices (IP cameras, an NVR, and an IP printer) deployed across multiple cities and countries, recording traffic and login attempts over two months.
IoTNetworkHoneypot
Paper2016
Material reviewed: Full textThe authors recorded 180,581 visiting IP addresses and 481,521 download attempts, manually collected 106 binaries, and described five malware families.
IoTNetworkHoneypot
Open software2016
Material reviewed: Repository metadataRepository about capture of IoT botnet binaries; documentation and maintenance require further review.
IoTHoneypot
Paper2010
Material reviewed: AbstractThis paper presents Mirage, a low-cost system designed by the authors to mitigate corporate espionage in RFID-enabled retail environments. According to the authors, Mirage uses programmable RFID tags as honeytokens to inject noise into inventory data, randomizing sales and restocking trends observable by potential attackers.
IoTHoneytoken
Open software—
Material reviewed: Repository metadataCritical readingLow-interaction honeypot simulating the Android Debug Bridge service.
IoTHoneypot
Open software—
Material reviewed: Repository documentationA MicroPython honeypot for the ESP8266 microcontroller that emulates a Telnet server to attract and observe attack attempts against exposed Telnet devices.
IoTNetworkHoneypot
Product—
Material reviewed: Repository documentationHFish is a free, community-oriented honeypot product developed by Beijing Microstep Online Technology Co., Ltd., aimed at enterprise scenarios such as internal lateral-movement detection, external threat perception, and intelligence generation. Its documentation states it supports over 90 honeypot service types, a B/S architecture with a server (管理端) and node/client (节点端) component, and multiple alert channels (email, syslog, webhook, WeChat Work, DingTalk, Feishu).
NetworkApplicationHoneypotDecoy
Community or education—
Material reviewed: Repository documentationA curated GitHub list aggregating open-source honeypot resources (database, web, WordPress, service, ICS/SCADA honeypots), network and data analysis tools, and deployment guides, organized by category.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationHoneyPi is a bash script to install and run various honeypot projects on a Raspberry Pi running Raspbian, serving as an installation guide.
NetworkIoTHoneypot
Open software—
Material reviewed: Repository documentationProof-of-concept observation-camera honeypot documenting a watermark, daylight intensity, and automatic refresh.
IoTHoneypot
Open software—
Material reviewed: Repository documentationHoneypot that simulates a modem or router with a RomPager web server and TR-069 support; it documents vulnerability emulation and communication logging.
IoTNetworkHoneypot
Open software—
Material reviewed: Repository documentationA Python tool that simulates an IoT device (router) to log attacker IP addresses and activity into a logfile and MySQL database, using cloned web pages as a decoy front end.
IoTNetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationA Python-based honeypot designed to emulate the Mirai malware, with separate listener and C2 components, aimed at scalable and easy setup.
IoTNetworkHoneypot
Open software—
Material reviewed: Repository documentationHoneypot software that simulates embedded-device services and vulnerabilities to record requests, origins, and, where supported, payloads; includes Telnet, HTTP, and HTTPS servers.
IoTNetworkHoneypot
Open software—
Material reviewed: Repository documentationmehrai is a Docker-based honeypot whose purpose is catching Mirai binaries, using an Alpine Linux image to mimic an IoT device and monitoring the filesystem and processes to collect samples and submit them to the Viper API.
IoTEndpointHoneypot
Open software—
Material reviewed: Repository documentationConfigurable honeypot that responds to expected scanner commands, such as Mirai's, to fingerprint their IP addresses; supports file and syslog output.
NetworkIoTHoneypot
Open software—
Material reviewed: Repository documentationA simple telnet honeypot created to show, in a security talk, how easy it is to code a telnet honeypot in order to recover IoT malware and observe active command and control.
IoTNetworkHoneypot
Open software—
Material reviewed: Repository metadataCritical readingPlatform combining multiple honeypots and analysis tools in one deployment.
NetworkIoTHoneypot
Open software—
Material reviewed: Repository documentationHoneypot that emulates a default Belkin N300 wireless router administration interface to observe traffic directed at home routers.
NetworkIoTHoneypotDecoy