Paper2023
Material reviewed: AbstractThe paper proposes an ethics framework, termed the doctrine of cyber effect, to guide the design of defensive cyber deception. It incorporates five ethical principles (goodwill, deontology, no-harm, transparency, and fairness) and presents the game of ethical duplicity as a reasoning framework applicable to designing defensive cyber deception techniques.
NetworkAdversary engagement
Paper2023
Material reviewed: AbstractThis study, according to its authors, investigates whether honeypots and honeynets described in the literature actually incorporate autonomic computing principles, beyond the use of terms like adaptive or intelligent. The authors analyze the frequency of keywords related to self-configuration, self-healing, self-protection, and self-optimization in a literature sample, finding low presence of the first three and notable presence of the latter.
NetworkHoneypot
Paper2022
Material reviewed: AbstractThis paper describes information acquired from a Secure Shell honeypot, including plaintext login credentials and attack data. The authors present a low-interaction honeypot aimed at organizations with limited resources that records, analyzes and sends notifications about suspicious network traffic, with the stated goal of encouraging the development and adoption of practical honeypot solutions.
NetworkHoneypot
Paper2022
Material reviewed: AbstractThe authors propose a cyber deception defense method based on a signal game, aimed at dealing with network intrusions. The work describes a moving target defense (MTD) enhanced deception mechanism and a signal game model with an equilibrium solution method to guide defense strategy selection, evaluated by the authors through experimental results.
NetworkMoving target defenseDecoy
Paper2022
Material reviewed: Public pageProposes a hybrid framework with two types of honeypots to relieve the flaws of each type and offer the benefits of both, aiming to detect and mitigate DDoS attacks against a webserver.
NetworkHoneypot
Paper2022
Material reviewed: AbstractThe authors propose a game-based collaborative defense approach for UAV networks, using low/medium-interaction honeypots and contract-based incentive mechanisms combined with reinforcement learning to encourage UAVs to share captured attack data.
NetworkIoTHoneypot
Paper2022
Material reviewed: AbstractThis paper explores deploying a honeypot system as a deception mechanism to gather intelligence about attackers. According to the authors, the system can capture information such as the attacker's autonomous system, penetration techniques, attack types, executed commands, and downloaded malware. The authors demonstrate a reproducible experiment using open-source tools to implement such a system.
NetworkHoneypotAdversary engagement
Paper2022
Material reviewed: AbstractThe authors compare the low-interaction honeypot Dionaea and the medium-interaction honeypot Cowrie against port scanning, SSH brute force and DoS. The study aims to assess attack capture, interaction with the attacker, and effects on network metrics and resource usage.
NetworkHoneypot
Paper2022
Material reviewed: AbstractAccording to the authors' abstract, this paper proposes a game-theoretic and reinforcement learning approach to incentivize collaboration among UAVs in low/medium interaction honeypot defense, addressing optimal contract design under partial and complete information asymmetry. The authors state that simulations show improved cooperation and defensive effectiveness compared to conventional schemes.
NetworkIoTHoneypotAdversary engagement
Paper2022
Material reviewed: AbstractThe paper introduces honeypots, their classification by purpose and interaction, and compares open-source tools across various aspects. Its purpose is to help readers protect resources from intruders using freely available network security tools.
NetworkHoneypot
Paper2022
Material reviewed: Full textIn the simulated scenarios, more decoys reduced the attacker agent’s episode win percentage and increased the steps needed to win.
NetworkAdversary engagement
Paper2022
Material reviewed: AbstractAmid information systems' growing exposure to cyber attacks, intrusion attempts and sophisticated malware, the author frames a need for organisations to better understand the actors behind threats and the methods they employ in order to improve their threat intelligence strategy. The article presents the use of a honeypot as one solution for gathering information about the specific cyberthreats an organisation faces.
NetworkHoneypot
Paper2022
Material reviewed: AbstractThe paper describes an experiment design in which a hacker infiltrates a server and escalates privileges, and presents the Honeypsy system to correlate the hacker's recorded actions with experience, personality, and psychology. The system combines a Big-5 personality test, a cyber expertise test, and a capture-the-flag (CTF) event with a deployed honeypot to collect activity logs, with the stated aim of predicting the expertise and personality of unknown hackers and supporting the development of defense strategies.
NetworkHoneypot
Paper2022
Material reviewed: AbstractAccording to the authors' abstract, this paper uses attack-defense games to examine whether disguising normal servers as honeypots is beneficial. It compares three scenarios with varying levels of deception techniques and concludes, per the authors, that disguising real servers does not always yield better defender rewards and may increase the cost of maintaining normal nodes.
NetworkHoneypotDecoy
Paper2022
Material reviewed: AbstractThis work proposes EVHS, an elastic virtual honeypot system for SDNFV-based networks, aimed at flexibly managing and controlling honeypots. The system uses a network intrusion detection system at the network border to detect attacks, leverages SDN and NFV to generate honeypots, and employs a moving-target defense mechanism to connect attackers to these honeypots, while also reusing available honeypots after attacks are handled.
NetworkHoneypotMoving target defense
Paper2022
Material reviewed: AbstractThis survey reviews and categorizes honey-X-based defense strategies, such as honeypots and honeytokens, which use deception to gather threat intelligence and protect networks. The authors also examine their combination with moving target defense, game theory and machine learning, and outline security quantification, challenges and future directions.
NetworkHoneypotHoneytoken
Paper2022
Material reviewed: AbstractThis study examines how the proportion of honeypots deployed in a network influences an adversary's decisions, using a deception game with two consecutive stages: probe and attack. Participants were randomly assigned to conditions with small, medium, or large honeypot proportions, and the authors report that as the honeypot proportion increased, honeypot-directed and no-attack actions increased dramatically.
NetworkHoneypotAdversary engagement
Paper2022
Material reviewed: AbstractThis paper describes the deployment of medium-interaction honeypots across five different protocols on the public Internet to study the intent and sophistication of observed attacks. The authors propose a clustering approach that identifies correlations in attacker behavior to detect IP addresses likely controlled by a single operator, highlighting the usefulness of these honeypots for data collection.
NetworkHoneypot
Paper2022
Material reviewed: AbstractThe authors propose a text-based method to investigate and analyze bot loaders using high-interaction honeypots. They collect request logs, define eight loader families via agglomerative clustering, and analyze functional homology using sequence alignment techniques, revealing, according to the study, evolutionary relationships among botnet infrastructures such as Mirai.
NetworkHoneypot
Paper2022
Material reviewed: AbstractThe paper describes a security framework for multi-cloud environments aimed at diverting an attacker and gaining time to analyze and mitigate intrusions. The proposed mechanism consists of modules for managing the multi-cloud platform, an intrusion detection and prevention system, and honeypots, with detection results compared in a two-phase scenario.
CloudNetworkHoneypotDecoy
Paper2022
Material reviewed: AbstractThis paper reviews existing tools for monitoring P2P botnets, categorizing mechanisms as active (crawlers) and passive (sensors and honeypots). According to the authors, the purpose is to study ways to monitor a botnet and how these monitoring mechanisms work, presenting prior work on each approach.
NetworkHoneypot
Paper2022
Material reviewed: AbstractReview article that provides an overview of cyber security and discusses machine learning, cyber threats and honeypot system-based techniques for intrusion detection and the study of network attacks. The authors describe honeypots as conceptual traps intended to block unauthorised access and to give analysts insights into the origins and behaviours of such attacks.
NetworkHoneypot
Paper2022
Material reviewed: AbstractThe work proposes integrating a honeypot sensor with a software-defined network (SDN) and classifying distributed denial-of-service attacks via semi-supervised learning, combining a pseudo-labelling model based on a support vector machine with subsequent classification using Adaptive Boosting. The evaluation reported by the authors uses monitoring data from the Suricata sensor and examines accuracy, precision, recall, CPU usage, and flow-rule mitigation times.
NetworkHoneypot
Paper2022
Material reviewed: AbstractThe authors describe a Spark-based honeypot system designed, implemented, and tested on a campus network over several days, intended to draw intruders toward a resource that simulates a fully resourced computer or vault. The study presents a performance analysis of that deployment based on parameters defined by the authors.
NetworkHoneypot