Paper2018
Material reviewed: AbstractThe work presents a dashboard visualization using honeypot log data from the AWN campus connected to IHP (Kemkominfo) Jakarta on a public cloud computing service network, aiming to categorize timestamps. The K-means clustering method is applied to categorize attacks into morning, noon, and night periods based on Western Indonesia Time and to identify ports 21, 80, 135, and 445 affected by DDoS attacks, with the stated expectation of supporting monitoring and anticipation of cloud network vulnerabilities.
CloudNetworkHoneypot
Paper2018
Material reviewed: AbstractThe authors propose a partially observable stochastic game framework to model interactions between a fully-observing defender and a partially-observing infiltrator in cybersecurity. They formulate the deception strategy problem as a robust mixed-integer linear program and present a scalable approach using parametric Markov decision processes to compute finite-memory infiltration strategies, illustrating the approach on a network security model.
NetworkAdversary engagementMoving target defense
Paper2018
Material reviewed: Publisher metadataBibliographic record on visual modeling of deception. The abstract and findings still require review.
NetworkDecoy
Paper2017
Material reviewed: Full textCritical readingGame-theoretic taxonomy distinguishing several forms of defensive deception.
NetworkMoving target defenseHoneytoken
Paper2017
Material reviewed: Publisher metadataBibliographic record on probabilistic logic of deception. The abstract and findings still require review.
NetworkDecoy
Paper2017
Material reviewed: AbstractThe authors describe deploying a honeynet of low-interaction and high-interaction SSH honeypots across three geographic regions of a public cloud environment in order to gather threat intelligence and obtain tailored indicators of compromise for e-learning platforms. The collected logs are analyzed through log collectors and parsers that translate the data into real-time dashboards, with the aim of understanding attackers' tactics according to time zones and geolocations and helping the education landscape prepare for emerging threats.
CloudNetworkHoneypot
Paper2017
Material reviewed: AbstractThis paper examines the use of honeypot data for employee information security awareness and education training. According to the authors, two honeypots were deployed at a private university in Singapore and the resulting data were analyzed. Drawing on Routine Activity Theory, they propose a conceptual training model called EASY (Engaging Stakeholders, Acceptable Behavior, Simple Teaching method, Yardstick) for designing security awareness programs.
NetworkIdentityHoneypot
Paper2017
Material reviewed: AbstractThis paper studies a scenario where a defender uses honeynets for active defense to observe an attacker who has penetrated the network. The authors propose an infinite-horizon Markov decision process over a continuous state space to model when to eject the attacker after gathering information, and analyze the robustness of this policy via a Stackelberg game, with simulations on a conceptual network.
NetworkHoneypotAdversary engagement
Paper2017
Material reviewed: AbstractThis work proposes SIPHON, a scalable high-interaction physical honeypot architecture for IoT devices. According to the authors, the design uses geographically distributed 'wormholes' to expose a few physical devices across many Internet IP addresses. The authors describe a large-scale experiment with real devices (IP cameras, an NVR, and an IP printer) deployed across multiple cities and countries, recording traffic and login attempts over two months.
IoTNetworkHoneypot
Paper2017
Material reviewed: Publisher metadataBibliographic record on technologies enabling deception. The abstract and findings still require review.
NetworkDecoy
Paper2017
Material reviewed: AbstractBased on cooperation with AWN University and the Indonesia Honeypot Project (IHP) of the Ministry of Communications and Informatics, the authors describe using a honeynet to protect and monitor public cloud computing networks, and analyzing its datalog through a k-means approach to profile DDoS attacks based on the timestamp recorded in the data.
CloudNetworkHoneypot
Paper2017
Material reviewed: AbstractThe authors propose a versatile virtual honeynet management tool for deploying heterogeneous types of honeypots through a dynamic configuration approach that adapts to mutable network environments. The stated purpose is to support investigation of malicious behavior where general platforms for versatile honeynet deployment are lacking.
NetworkHoneypot
Paper2016
Material reviewed: AbstractAccording to the authors, this work provides an extensive overview of honeypots, covering both available software and the methodologies used to analyze data collected by these systems.
NetworkHoneypot
Paper2016
Material reviewed: Publisher metadataBibliographic record on an adaptive deception system. The abstract and findings still require review.
NetworkDecoy
Paper2016
Material reviewed: AbstractThe authors propose an ant colony-based distributed denial of service (DDoS) detection technique that uses roaming virtual honeypots together with a multi-level secure architecture to collect information about intruders at different levels of the network and to limit the spread of the affected area. Detection relies on ant colony optimisation, using pheromone deposits in the considered area, and on a multi-level IP log table, aiming to reduce traffic overhead and wasted bandwidth.
NetworkHoneypotMoving target defense
Paper2016
Material reviewed: AbstractThe authors propose a statistical framework for rigorously analyzing honeypot-captured cyber attack data, built on the concept of a stochastic cyber attack process. According to the presented case study, low-interaction honeypot data exhibits Long-Range Dependence, which the authors state could enable prediction of attack rates with good accuracy.
NetworkHoneypot
Paper2016
Material reviewed: Full textThe authors recorded 180,581 visiting IP addresses and 481,521 download attempts, manually collected 106 binaries, and described five malware families.
IoTNetworkHoneypot
Paper2016
Material reviewed: AbstractThe work proposes an ontological model for identifying the most common types of attacks from the use of honeynets, and outlines its implementation in working scenarios. Its purpose is to support decision-making about the placement of computer elements and components within an organization.
NetworkHoneypot
Paper2016
Material reviewed: AbstractAccording to the authors, this paper describes an automated algorithm designed to detect attacks before they occur and reduce false positive and negative rates, using malicious traffic data captured through a distributed honeypot network.
NetworkHoneypot
Paper2016
Material reviewed: AbstractThe paper presents an architecture that extends a previous system for tracking IPv6 addresses discarded by MT6D nodes, adding automation and database integration. According to the authors, the solution can deploy a honeypot on demand in an LXC container based on traffic patterns observed on a discarded address, and it lets an MT6D host query the solution database for activity on its relinquished addresses as a JSON object in order to adjust MT6D scheme parameters; the authors report a proof-of-concept and an analysis of feasibility and scalability.
NetworkHoneypotMoving target defense
Paper2015
Material reviewed: AbstractThe authors propose a game-theoretic model for mechanism design in deception-based defense, applied specifically to honeypots in network defense. They analyze cheap-talk games and an extended version with evidence, where the receiver can detect deception with some probability. According to the authors, the model generalizes traditional signaling games and complete-information games, showing numerically that deception detection can eliminate pure-strategy equilibria.
NetworkHoneypotAdversary engagement
Paper2015
Material reviewed: AbstractThe authors describe honeypots as a security mechanism that attracts and diverts attackers, logs network bytes, and correlates data to locate the attack source. They present honeypot types and uses and introduce Kerberos, concluding with a look at the future.
NetworkHoneypot
Paper2014
Material reviewed: AbstractThe authors propose a collaboration between network intrusion detection systems (IDS) and honeypot technology, together with a mechanism to correct signatures based on honeypot analysis, aiming to reduce erroneous alerts and improve detection of zero-day attacks. Across fifteen evaluated attack scenarios, the authors report that this approach reduced false alerts and zero-day attacks by 85%.
NetworkHoneypot
Paper2013
Material reviewed: AbstractThe paper formulates an attack-defense scenario as a mathematical model in which the defender applies both proactive and reactive defense mechanisms against attackers with different attack strategies, assuming attackers have incomplete information and imperfect knowledge of the target network. The authors report that, based on their experiment results, a proactive defense strategy is suitable against aggressive attackers under "winner takes all" circumstances, while a reactive strategy works better against less aggressive attackers under "fight to win or die" circumstances.
NetworkCloudHoneypot