Paper2019
Material reviewed: AbstractThe article discusses how cyber deception can change an attacker's perception of the network environment and lead attackers to false beliefs about which systems contain critical information. The authors introduce game theory models and discuss techniques combining artificial intelligence algorithms with those models to estimate hidden states of the attacker using feedback through payoffs, in order to learn how best to defend the system using cyber deception.
NetworkDecoyAdversary engagement
Paper2019
Material reviewed: AbstractAccording to the authors, this work proposes a framework for modeling attacker behavior to better predict future actions using a novel semi-supervised algorithm called Fusion Hidden Markov Model (FHMM). Experiments were conducted on real attack data captured from a Cowrie honeypot system, comparing FHMM's performance against Markov Chains, traditional HMMs, and deep recurrent neural network architectures.
NetworkHoneypot
Paper2019
Material reviewed: AbstractThe authors propose an automatic identification model based on a random forest algorithm with three feature groups—application-layer, network-layer, and other system-layer features—to remotely check whether a server runs a honeypot service. The experiment datasets were collected from public known platforms, and the authors report that the model achieved an AUC value of 0.93.
NetworkApplicationHoneypot
Paper2019
Material reviewed: AbstractThe authors analyze how country attributes—such as population size, access to information and communication technologies, and ICT use—influence the number of secure shell attacks seen by their honeynet, using four statistical models built from three data sources and methods including partial least-squares path modelling and clustering of countries by similarity.
NetworkHoneypot
Paper2019
Material reviewed: AbstractAccording to the abstract, this work develops inference techniques to detect organic click fraud in advertising networks. The authors note that malware detection systems, including honeypots, fail to stop click fraud apps, and propose two defenses: a mimicry defence based on detecting click reuse patterns, and a bait-click defence that injects decoy clicks to trigger fraudulent app behavior.
NetworkApplicationHoneypotDecoy
Paper2019
Material reviewed: Publisher metadataBibliographic record on cyber deception games. The abstract and findings still require review.
NetworkAdversary engagement
Paper2019
Material reviewed: Publisher metadataBibliographic record on game theory applied to deception. The abstract and findings still require review.
NetworkAdversary engagement
Paper2019
Material reviewed: AbstractThe authors present an overview of cyber deception games across three environments, extending baseline signaling game models to include evidence via side-channel knowledge acquisition. They analyze deception in binary and continuous information spaces and explore a multi-stage incomplete-information Bayesian game model for defensive deception against advanced persistent threats, using perfect Bayesian Nash equilibrium as the solution concept.
NetworkAdversary engagementDecoy
Paper2019
Material reviewed: AbstractAndrew Bushby's article describes the use of deception technology as a mechanism for active, post-breach defence aimed at luring, detecting and defending against malware and intruders moving laterally within the network. It notes that such approaches come with misconceptions and argues that defences need to move beyond detecting bad activity within an ocean of good activity.
NetworkDecoyAdversary engagement
Paper2019
Material reviewed: Public pageThe paper describes a low-interaction Python honeypot that presents a fake SSH service to observe attacker behavior and authentication attempts while hiding the real SSH service.
NetworkHoneypot
Paper2019
Material reviewed: AbstractThe authors propose using a Cron job with a Perl script to periodically parse collected data into a database, aiming to reduce the size of logs generated by a honeypot under heavy traffic such as DDoS attacks. They report three DDoS attack cases to illustrate log growth.
NetworkHoneypot
Paper2019
Material reviewed: AbstractAccording to the authors, this paper proposes an SDN-based in-network honeypot that reroutes traffic from suspicious nodes and intelligently spoofs it with misleading information to confuse attackers in IoT environments, without requiring dedicated hardware. The authors state preliminary evaluations show little impact on network performance.
IoTNetworkHoneypotDecoy
Paper2019
Material reviewed: AbstractThe authors present experimental tests of common attacks on wired IPv6 networks and describe the design and implementation of a Honeynet with different operating systems. They use tools such as 6Guard, Snort and Wireshark to attract, detect and analyze attacker behavior.
NetworkHoneypotDecoy
Paper2019
Material reviewed: AbstractAccording to the authors, this chapter presents three proactive defense schemes against advanced attackers: defensive deception for detection and counter-deception, feedback-driven Moving Target Defense (MTD), and adaptive honeypot engagement. The authors propose strategic learning schemes tailored to different levels of information uncertainty for these strategies.
NetworkHoneypotMoving target defense
Paper2019
Material reviewed: AbstractAccording to the abstract, the authors conducted the first systematic study of an attack stealing cryptocurrencies via unprotected JSON-RPC endpoints in Ethereum nodes. They designed and deployed a honeypot to capture real-world attacks over six months, collecting millions of requests and analyzing attacker behavior and profits.
NetworkApplicationHoneypot
Paper2019
Material reviewed: AbstractThe authors present a data analysis of records from a geographically distributed honeypot server network deployed in Samara, Rostov-on-Don, Crimea and the USA, with methods for processing statistics discussed in detail for secure remote access SSH. Lists of attacking addresses are highlighted and their geographical affiliation determined, and request intensity to each of the 10 installed services is then calculated using rank distributions.
NetworkHoneypot
Paper2018
Material reviewed: Publisher metadataBibliographic record on cyber deception overview and challenges. The abstract and findings still require review.
NetworkDecoy
Paper2018
Material reviewed: AbstractThis work proposes applying a cyber deception strategy in wireless local area networks, using decoys that are honeypots, to detect and characterize malicious activity such as the evil twin access point. The authors further describe how the same approach can be used to gather attacker activity information and to detect SSL stripping and DNS spoofing attacks.
NetworkHoneypotDecoy
Paper2018
Material reviewed: AbstractThe authors use game theory, including static Bayesian games, signaling games, and multi-stage models, to model defender-attacker interactions in cybersecurity under uncertainty and asymmetric information. Per the abstract, the study examines a case involving Advanced Persistent Threats (APTs) and the Tennessee Eastman process, considering that defenders may employ deception techniques such as honey files and honeypots to create strategic uncertainty for attackers.
NetworkOT/ICSHoneypotHoneytoken
Paper2018
Material reviewed: AbstractThe authors propose a game-theoretic model extending signaling games to include a probabilistic deception detector, applied to the design of defensive deception mechanisms in network security. The work analyzes pooling and partially-separating equilibria depending on detector quality.
NetworkAdversary engagement
Paper2018
Material reviewed: AbstractThis paper describes the design and implementation of a malware analysis laboratory based on honeypot technology in a controlled environment, aimed at studying the techniques used by attackers and analyzing security incidents. The authors also designed an administration interface to control and analyze the gathered information, and tested the system for several weeks to collect statistics about attacks and their perpetrators.
NetworkApplicationHoneypot
Paper2018
Material reviewed: AbstractThe authors describe a measurement study of attacks against or based on IoT protocols, using data obtained from a /15 network telescope and three honeypots with 15 IPv4 addresses. The study reports that telnet-based malware is still widely used, that infected devices are employed not only for DDoS attacks but also for crypto-currency mining, and that attackers look for IoT-specific services using MQTT, CoAP, UPnP, and HNAP, and target vulnerabilities of routers and cameras with HTTP.
IoTNetworkHoneypot
Paper2018
Material reviewed: AbstractThe authors describe the use of honeypots as a decoy-based technology deployed in a network, aimed at defending IoT devices from attacks and gathering information about the attacker's device. The paper presents how honeypots, acting as cost-effective deception models, entice attackers in order to preserve information against attacks.
IoTNetworkHoneypotDecoy
Paper2018
Material reviewed: AbstractThis paper addresses how intruders can exploit timing side channels to distinguish whether a system is a honeypot or a real system, potentially helping them evade defense mechanisms. The authors introduce a novel definition of timed observational equivalence using symbolic time constraints, enabling automation via SMT solvers.
NetworkHoneypot