Paper2024
Material reviewed: AbstractThe authors analyze robocall data from multiple independent vantage points, including academic and industry voice honeypots, to study the effectiveness of telephone spam prevention and mitigation efforts. The work compares disparate data sources over more than 5 years, including audio and transcripts from millions of calls, to assess trends and spammer adaptation to authentication schemes like STIR/SHAKEN.
NetworkHoneypot
Paper2024
Material reviewed: AbstractAccording to the authors, this paper proposes a cyber deception mechanism that stealthily redirects TCP communications to an on-demand honeypot server cloned to resemble the victim asset. The stated goal is to make attackers focus on the decoy server, enabling threat intelligence collection while protecting the real asset.
NetworkHoneypotDecoy
Paper2024
Material reviewed: Full textCritical readingSurvey proposing a taxonomy and comparing cyber deception research lines, including AI-based work.
NetworkCloudAdversary engagement
Paper2024
Material reviewed: Public pageIt proposes simulating, transforming and integrating synthetic honeypot logs into a graph database using the STIX model, aiming to convert attack data into interconnected threat intelligence objects for visualization and exploration. The purpose is to provide security operations centers with a standardized platform that enhances situational awareness and decision-making support.
NetworkHoneypot
Paper2024
Material reviewed: AbstractThe authors address a scenario where a defender of a networked control system has isolated an intruder and redirects them toward a honeypot emulating the real system without connection to a physical plant. They propose an adversary engagement strategy within this decoy environment to increase the attacker's information-processing costs by spoofing sensor readings based on cyber threat intelligence. They perform a numerical comparison between cases of perfect and imperfect threat intelligence.
OT/ICSNetworkHoneypotAdversary engagement
Paper2024
Material reviewed: AbstractAccording to the authors, this paper explores the use of Generative Adversarial Networks (GANs) to generate decoy configurations for cyber defense. They note that existing approaches rely on maintained lists of configurations or pre-configured images with limited adaptability, and present what they describe as the first attempt to use GANs specifically for generating decoy configurations, aiming to provide defenders with a tool to strengthen network defenses.
NetworkHoneypotDecoy
Paper2024
Material reviewed: Full textCritical readingPresents a language-model terminal honeypot architecture and describes a field evaluation.
NetworkHoneypot
Paper2024
Material reviewed: AbstractReview of the honeypot as a decoy system simulating an isolated real system on a network to entice attackers and detect, block or foresee attempts at unauthorized access. The authors describe a monitoring arrangement linking honeypot, main network and system-admin so hostile activity is detected before the main network is affected.
NetworkHoneypot
Paper2024
Material reviewed: AbstractThe paper assesses a specific group of honeypot systems based on criteria such as detection range, emulation accuracy, data quality, dependability, scalability, and ease of setup, and draws conclusions about their relative effectiveness in different situations. It also discusses recent developments in honeypot technology, including machine learning enhancements, increased automation, integration with other security tools, cloud-based honeypots, and deception technology, using simulated attacks to demonstrate how these systems log and record attack information.
NetworkCloudHoneypotDecoy
Paper2024
Material reviewed: AbstractThe authors investigate whether peer-to-peer (P2P) overlay network nodes, specifically Ethereum network nodes, attract heightened reconnaissance attacks due to their visibility and sustained uptime. They deploy a series of honeypots alongside real Ethereum nodes across globally distributed vantage points. The authors report findings on specific attack types targeting particular ports and services, extending the analysis through port scans on other reachable peers.
NetworkHoneypot
Paper2024
Material reviewed: AbstractThe authors propose a network design for honeypot placement and an intrusion detection system aimed at identifying and alerting on illicit access, using traffic logs. They use datasets derived from a honeypot implementation and KDD-99, trained with generative adversarial networks, a deep learning-based generative model.
NetworkHoneypot
Paper2024
Material reviewed: Public pageThe review examines AI integration with SOAR, including dynamic orchestration of honeypots that present an apparent vulnerability and collect intelligence on attacker methods.
NetworkOT/ICSHoneypot
Paper2024
Material reviewed: AbstractThis paper proposes a reinforcement learning (RL) approach to simulate ransomware attacks within an environment mirroring real-world networks, aiming to streamline traditional red teaming exercises. According to the authors, experimental results on a 152-host example network show the RL agent's capability to discover and orchestrate attacks on high-value targets while evading honeyfiles (decoy files placed to detect unauthorized access).
NetworkEndpointDecoyAdversary engagement
Paper2024
Material reviewed: AbstractThe authors present LLM Honeypot, a system that augments a standard SSH honeypot with prompt injection and time-based analysis techniques to distinguish autonomous AI agents among attackers. Over a roughly three-month trial deployment in a public environment, they recorded millions of hacking attempts and identified a small number of potential AI agents. The work aims to serve as an early warning of malicious LLM agent usage in the wild.
NetworkHoneypot
Paper2024
Material reviewed: Full textCritical readingPresents an interactive honeypot using a language model fine-tuned with attacker command data.
NetworkHoneypot
Paper2024
Material reviewed: Full textOf 184 responses judged plausible by experts, participants also classified 167 as plausible (90.8%). This measures responses in this test, not deception of real attackers.
NetworkHoneypot
Paper2024
Material reviewed: AbstractThe authors propose LLMPot, an approach for designing honeypots in Industrial Control System (ICS) networks using large language models (LLMs). The goal is to automate the creation of realistic, vendor-agnostic honeypots capable of emulating industrial protocols and PLC control logic, reducing the manual effort traditionally required in this domain.
OT/ICSNetworkHoneypotDecoy
Paper2024
Material reviewed: AbstractThe work presents and evaluates Mirage, an experimentation system in both emulation and simulation forms that allows for the implementation and testing of cyber deceptions designed to counter adversaries using AI search and planning capabilities. The authors frame cyber deception as a possible defensive mechanism against future AI-enabled adversaries.
NetworkDecoyAdversary engagement
Paper2024
Material reviewed: AbstractAccording to the authors, this paper initiates a systematic study of a new honeypot deployment paradigm that blends honeypot computers into production computers. They formalize the Honeypot Deployment (HD) problem as a combinatorial optimization problem, prove its NP-hardness, propose a near-optimal algorithm (a polynomial-time approximation scheme), and conduct simulations to assess the impact of attacker capabilities.
NetworkHoneypot
Paper2024
Material reviewed: AbstractThe study describes a two-tier deception-driven security model intended to mislead potential attackers and protect network resources using decoys, honeypots, and deceptive network segments. The authors report on deploying and testing the model to assess its efficacy and feasibility in practice, and argue that integrating deception techniques into cybersecurity frameworks can provide a protective layer.
NetworkHoneypotDecoy
Paper2024
Material reviewed: AbstractEditor contributionPacheco and Staino preprint proposing a cyclical, minimal deception process and presenting DOLOS-T as an open tool for exploring it.
NetworkApplicationDecoyAdversary engagement
Paper2024
Material reviewed: AbstractThe paper examines the origin of trust in trust management systems by linking it to the network attack rate, aiming to refine trust assessments and predict new attacks. The authors describe a strategy combining machine learning and dynamic honeypots to detect prepared-for attacks and predict unprepared-for attacks in vehicular ad hoc networks (VANETs).
NetworkHoneypot
Paper2024
Material reviewed: AbstractAccording to the authors, this paper presents a self-adaptive traffic anomaly detection system for IoT smart home environments, consisting of a honeypot server and a gateway. The honeypot continuously captures traffic and adaptively generates a detection model used by the gateway to identify anomalous traffic, including unknown attacks.
IoTNetworkHoneypot
Paper2024
Material reviewed: AbstractThe authors formulate a two-player dynamic game to model honeypot allocation in tactical networks whose connectivity changes with node mobility. They propose an iterative algorithm to find Nash equilibria and assess scalability through compact states and sensitivity analysis under imperfect information.
NetworkHoneypot