Paper2026
Material reviewed: AbstractThis paper presents a behavior-driven attacker profiling framework built from empirical data collected in SSH honeypot deployments. The methodology parses complex command chains to identify behavioral patterns, organize them into hierarchical clusters, and map them to the MITRE ATT&CK framework for structured threat interpretation.
NetworkHoneypot
Paper2026
Material reviewed: AbstractThe authors propose an antifragile framework that uses cyber deception with adaptive decoys and dynamic network movements to generate adversarial signals, infer threat actor profiles and support proactive decisions. A cyber threat intelligence ontology and a knowledge graph with semantic attributes represent tactical and strategic relationships between attackers and targets.
NetworkDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThe paper describes an intrusion detection system that monitors live packets and uses predefined rules to detect suspicious activity rather than machine learning models. It includes a honeypot module with a fake login interface and human-readable explanations for detected anomalies.
NetworkHoneypot
Paper2026
Material reviewed: AbstractThe study investigates whether psychologically engineered "bias triggers" can exploit human attackers' Type I heuristic processing to degrade their performance. The authors use a high-fidelity cyber range where participants conduct network penetration with and without these triggers, analyzing operational telemetry.
NetworkDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThis paper presents LDT-FRL, a defense framework combining temporal attention encoders, lightweight digital twins, and a federated reinforcement learning (PPO) agent capable of redirecting suspicious traffic to honeypots in IoMT (Internet of Medical Things) environments. According to the authors, the system was evaluated on public network traffic benchmarks, achieving high classification metrics and explainability via techniques such as SHAP and Grad-CAM.
IoTNetworkHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe paper proposes a proactive defense approach using a high-interaction honeypot for DDoS detection and prevention. The honeypot captures IP addresses, malware and attacker tactics, feeding firewalls and traffic filters to block similar threats across the network.
NetworkHoneypot
Paper2026
Material reviewed: AbstractThe authors study attacker behavior across eleven SSH honeypots accepting both interactive and non-interactive sessions over fifteen days. According to the abstract, they found that the vast majority of authenticated sessions were non-interactive, challenging common assumptions in cyber deception research focused on interactive shells.
NetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThis work, according to its authors, addresses DoS/DDoS mitigation by separating malicious from benign traffic using honeypots, framing the problem as a weighted MaxCut solved with variational quantum algorithms (QAOA). The authors describe a reproducible honeypot-to-QUBO pipeline, labeled temporal bipartite benchmark graphs, QAOA executions on IBM hardware, classical heuristic baselines, and a routing overhead analysis across quantum processor architectures.
NetworkHoneypot
Paper2026
Material reviewed: AbstractThe authors present HIVE-OT's design and implementation and evaluate the evidence supported by its process-coupled research core and historical exports, distinguishing the documented platform from a local implementation linking Modbus, a revised Rust water-treatment surrogate and SQLite. The study tests protocol behavior, command application and retained outcome representations, and audits two deployment exports containing 273978 and 842638 events.
OT/ICSNetworkHoneypot
Paper2026
Material reviewed: AbstractThis position paper suggests that presenting deception storyline content can influence how human attackers and Large Language Model (LLM) Agent attackers evaluate the authenticity of deception functions and effects on a network or host. The authors introduce HoneyContent, a practiced industry cyber deception model for designing and creating deception storyline content to 'wrap' or embed deception functions, integrating warranting theory and signaling theory, and visualize its use in an industry cyber deception scenario.
NetworkEndpointDecoy
Paper2026
Material reviewed: AbstractThe work presents HoneyPrompt, a multi-sensor fusion architecture for detecting and classifying autonomous AI agents that interact with industrial control systems. The authors deploy a maritime SCADA honeypot simulating a pipeline monitoring gateway across six protocols and instrument it with a graduated prompt injection acting as a sensor array.
OT/ICSNetworkHoneypotHoneytoken
Paper2026
Material reviewed: AbstractThis paper adapts the Honeyquest instrument to automatically evaluate LLM-based attacker judgment against cyber deception techniques. According to the authors, a cohort of 21 models from various providers was compared against a human baseline on reconnaissance tasks, finding that LLMs fall for traps at higher rates than humans and show a gap between recognizing deception in their reasoning and acting accordingly. The authors conclude that human-centered deception hypotheses do not reliably transfer to AI attackers.
NetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThis work presents Honeyval, an evaluation framework for LLM-powered HTTP honeypots. According to the authors, the framework uses AI hacking agents as attackers and diverse backend applications to reproducibly evaluate the performance and detectability of these honeypots compared to prior limited evaluation methods.
NetworkApplicationHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors introduce ICSLure, a modular honeynet framework intended to emulate realistic industrial control system environments. It integrates physical PLCs with live data sources over industrial protocols and virtualized network components, with monitoring to log attacker interactions.
OT/ICSNetworkHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThis paper studies how to improve shell emulation accuracy of local open-weight LLM-based SSH honeypots through prompt design and supervised fine-tuning, comparing eight models against their base versions. Using 34 automated unit tests, the authors report that prompt design has a large effect and that fine-tuning effectiveness depends on dataset coverage, with an expanded dataset built from honeypot logs producing stronger local models according to their own measurements.
NetworkEndpointHoneypot
Paper2026
Material reviewed: AbstractThis study examines international differences in hacking attempts using honeypot data, analyzing 504,877 login attempts from 314 unique IP addresses over a 3-month period. The authors test hypotheses based on socio-economic factors — unemployment, poverty, GDP and education expenditures — and attribute to higher unemployment and lower education expenditures a correlation with more breach attempts per country, and to lower education expenditures a correlation with higher success rates of breach attempts.
NetworkHoneypot
Paper2026
Material reviewed: AbstractThis paper presents a noise-aware measurement study of Internet-facing DICOM services, combining IPv4-wide active scanning with passive honeypot deployments. The authors introduce a reproducible method to filter false positives caused by honeypots, network telescopes, and other measurement artifacts, reducing apparent exposure by 39%. After filtering, they identify thousands of vulnerable deployments lacking encryption and authentication, finding that existing deception systems are insufficient to capture the actual risks.
NetworkApplicationHoneypotDecoy
Paper2026
Material reviewed: AbstractThe study implements a deception-driven security model (D-DSM) for a campus network environment, with decoy resources managed through a centralized deception mechanism. It aims to divert malicious activity away from critical assets, provide indicators of attack behavior, and complement existing defense-in-depth controls by improving visibility of advanced and lateral attacks while helping reduce false alerts.
NetworkDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThis work studies how large language model (LLM)-based penetration testing agents can allocate their execution budget when encountering honeypots. The authors formalize the attacker's problem as a budgeted decision process in which the agent must decide whether to continue exploitation or skip a target upon honeypot suspicion, proposing a detector-guided policy evaluated in a controlled mixed-host testbed.
NetworkEndpointHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe paper proposes an LLM-enabled cloud-native dynamic honeypot architecture in which the model acts only as a text synthesizer behind policy gating and state verification. The authors describe a session broker that classifies attacker commands rather than executing them, alongside ethical governance controls and an evaluation protocol.
CloudNetworkHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe authors present Mirage Mesh, a lightweight cyber deception framework for Linux environments that applies deception-in-depth across four layers: an SSH decoy built on Cowrie, a system-layer decoy administrative account, a fake Flask web administration interface, and a data-layer honeytoken credential file. The work proposes a shared DecoyAlertEvent schema to normalize observations from these layers, process them through a Wazuh-based detection and active-response pipeline with Python orchestration, map them to cyber kill-chain stages and MITRE ATT&CK techniques, and evaluate them with a Deception Effectiveness Metric (DEM).
NetworkEndpointHoneypotHoneytoken
Paper2026
Material reviewed: AbstractThis paper, according to its authors, reviews AI-based solutions for building network- and device-level cyber deception methods in contested environments. It focuses on combining large language models (LLMs) and reinforcement learning (RL) to optimize deception strategies such as honeypots and honeynets, and examines their validation against stealthy attacks on operational technology (OT) systems reported in the literature.
NetworkOT/ICSHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors present a cyber-risk management framework for networked digital systems combining strategic game behavior with contagion dynamics. The study addresses optimal cybersecurity resource allocation considering heterogeneous node valuations by attackers and defenders, proposing contagion-path-based risk measures and analyzing cyber deception effects through numerical experiments.
NetworkDecoy
Paper2026
Material reviewed: AbstractThis paper presents Ollure, a low- and medium-interaction honeypot that emulates the Ollama API without a backend LLM, as described by the authors. Deployed across four locations over 84 days, it recorded hundreds of thousands of interactions from thousands of source IP addresses. The study documents automated discovery and fingerprinting activity, as well as concrete exploitation attempts against both the infrastructure and LLM layers.
NetworkApplicationHoneypotDecoy