Paper2024
Material reviewed: AbstractAccording to the authors, this chapter examines the combined use of game-theoretic models and foundation models (FMs) to analyze, design, and implement cyber deception tactics across tactical, operational, and strategic warfare levels. It proposes MANSCOL (multi-agent neurosymbolic conjectural learning) to let defenders predict adversarial behaviors and design adaptive deceptive defenses, and discusses challenges of applying FMs in cybersecurity.
NetworkAdversary engagementDecoy
Paper2024
Material reviewed: AbstractThe authors present a side-channel method for covertly identifying industrial control system (ICS) honeypots using time-to-live (TTL) values in the ICMP protocol. In a study of over 8,000 devices presenting as ICS systems, they compare their approach to existing honeypot detection methods and describe what their methodology reveals about the current population of live ICS honeypots.
OT/ICSNetworkHoneypot
Paper2024
Material reviewed: AbstractThis paper presents a proof-of-concept (POC) cyber deception system that dynamically generates deception material based on observed attacker behaviour during a simulated real-time attack. The system analyzes attacker interaction with the deception material to predict the attacker's motive, and the authors explore expanding this POC to infer other profile features such as psychological characteristics.
NetworkDecoyAdversary engagement
Paper2024
Material reviewed: AbstractThis work-in-progress paper studies the implementation of deception-in-depth strategies with three initial logical layers: network, host, and data. The authors draw on ideas from military deception, network orchestration, software deception, file deception, fake honeypots, and moving-target defenses, and are building a prototype to test in adversarial environments. According to the authors, the goal is to show that deploying a broad range of deception techniques can better protect systems than single techniques, with a focus on discouraging attacks rather than encouraging attacker engagement.
NetworkEndpointHoneypotDecoy
Paper2023
Material reviewed: Full textCritical readingSurvey of network requirements for implementing cyber deception techniques.
NetworkDecoy
Paper2023
Material reviewed: AbstractThis paper proposes an adaptive experimental design (AD) method, inspired by randomized clinical trials, to study causal relationships between the design of intrusion data collection environments (such as honeypots) and the data observed. The authors state they conducted the first controlled and adaptive honeypot deployment study to measure how an SSH vulnerability affects server exploitation rates, reporting reductions in deployment time and resources needed.
NetworkHoneypot
Paper2023
Material reviewed: AbstractThis work examines adversarial reconnaissance mitigation techniques, including deception strategies such as honeypots, and reviews the literature on deception games from the perspective of modeling adversarial reconnaissance. The authors highlight aspects of reconnaissance they state have not been adequately captured in prior work, and present a probability-theory based model of adversaries' belief formation, illustrated with numerical examples.
NetworkHoneypotAdversary engagement
Paper2023
Material reviewed: AbstractThis study examines how different probing costs affect adversarial decision-making in a deception game, using an IBLT model with delayed feedback to simulate human behavior. According to the authors, probing slightly decreased as its cost increased, while the proportion of attacks remained relatively stable. The authors conclude that different probing costs do not significantly affect the proportion of attacks but have a slight impact on the proportion of probing.
NetworkHoneypotAdversary engagement
Paper2023
Material reviewed: AbstractThis paper examines attack patterns in a large public dataset of geographically distributed honeypots, addressing methodological questions and building attacker behavioural profiles. According to the authors, results show honeypot location helps identify attack patterns and profiles, concluding that not all collected intelligence is equally valuable and that an effective early warning system may be built with only two distributed honeypots and a production server.
NetworkHoneypot
Paper2023
Material reviewed: AbstractThe work proposes a decision support system based on a Bayesian belief network to guide cyber deception strategies from a detailed model of attacker beliefs, illustrated with a case study using passively observed operating system fingerprinting data. The authors compare the model's prediction accuracy with a sequential artificial neural network and introduce a deception algorithm to select a minimal set of features whose modification would make a system appear as a different operating system.
EndpointNetworkDecoy
Paper2023
Material reviewed: AbstractAccording to its authors, this paper studies a Stackelberg game between attacker and defender over large, dynamic Active Directory (AD) attack graphs, where the defender deploys honeypots to prevent the attacker from reaching high-value targets. The authors propose a mixed-integer programming (MIP) formulation and a clustering-based approach (dyMIP(m)) to handle large dynamic graph instances, reporting near-optimal results under realistic conditions.
IdentityNetworkHoneypot
Paper2023
Material reviewed: AbstractThis paper explores using ChatGPT-style conversational agents as a dynamic honeypot interface, imitating Linux, Mac, and Windows terminal commands and tools like TeamViewer, nmap, and ping. The authors present ten feasibility tasks intended for defensive teams to simulate honeypot interfaces with minimal risk, aiming to delay or understand attacker tactics, techniques, and procedures.
NetworkEndpointHoneypot
Paper2023
Material reviewed: AbstractThe work describes the deployment of an ensemble of research honeypot detectors to analyze and evaluate attackers' behavior. The authors present an outline of a containerized cloud honeypot deployment that they state is portable, durable, and simple to deploy and administer, and they describe instrumented monitoring that generated data points from which inferences about malicious users' activities and purpose could be drawn.
CloudNetworkHoneypotDecoy
Paper2023
Material reviewed: Publisher metadataBibliographic record on expert experiences and opinions. The abstract and findings still require review.
NetworkAdversary engagement
Paper2023
Material reviewed: AbstractThe study addresses social engineering attacks, which the authors say exploit human psychology and user awareness, and proposes an automated prevention mechanism that combines honeypots with artificial intelligence and an intrusion prevention system. The stated aim is to detect such attacks, threaten the attacker and restrict his session to keep users away from these manipulation tactics.
NetworkHoneypot
Paper2023
Material reviewed: Full textCritical readingProposes a simulation method for evaluating honeypots and moving target defense in networks.
NetworkHoneypotMoving target defense
Paper2023
Material reviewed: AbstractThe authors present a method for selecting cyber deception strategies using a multi-stage Flipit game, aiming to account for defense timing alongside spatial strategy selection. The approach constructs a spatiotemporal decision-making model, introduces a discount factor and transition probabilities, and applies a Proximal Policy Optimization algorithm to compute defender strategies.
NetworkDecoyMoving target defense
Paper2023
Material reviewed: Publisher metadataDOI-identified publication on injecting honeytokens using Netfilter; text analysis is pending.
NetworkHoneytoken
Paper2023
Material reviewed: AbstractThe authors propose a game-theoretic approach for optimal honeypot allocation in tactical networks with dynamic connectivity. They model a two-player dynamic game accounting for future network state evolution, aiming to maximize the attacker's likelihood of hitting a honeypot while minimizing reconfiguration costs. They present an iterative algorithm to find Nash equilibrium strategies and evaluate its scalability through simulations.
NetworkHoneypotDecoy
Paper2023
Material reviewed: AbstractThis thesis presents a honeypot solution to investigate malicious activity in the heiCLOUD environment, showing according to the author a significant increase in attacks. A new concept is proposed to detect firewall leaks in restricted network zones, along with a method for detecting honeypots at the transport level from an attacker's perspective. A customized OpenSSH server is also presented as an intermediary instance to mitigate such efforts.
CloudNetworkHoneypotAdversary engagement
Paper2023
Material reviewed: AbstractThis report reviews the concepts and types of honeypots, which organizations use as decoy networks to lure attackers, and discusses challenges of deploying them along with advantages and disadvantages.
NetworkHoneypotDecoy
Paper2023
Material reviewed: AbstractThe authors propose a deep learning based method to generate synthetic IoT device traffic flows mimicking real traffic, aiming to improve IoT honeypots against attacker detection. According to the abstract, the generator outperforms prior approaches in remaining indistinguishable from real traffic.
IoTNetworkHoneypotDecoy
Paper2023
Material reviewed: Publisher metadataBibliographic record on deception against autonomous attacks. The abstract and findings still require review.
NetworkDecoy
Paper2023
Material reviewed: AbstractThe authors propose a planning framework to generate a defense strategy that covertly guides an attacker toward a trap state, formulating the problem as an infinite-horizon discounted MDP whose optimal policy serves as the defender's strategy. According to the abstract, this formulation is applicable to systems such as honeypots or honeynets, and the authors report empirically evaluating the merits of their approach.
NetworkHoneypotAdversary engagement