Paper2021
Material reviewed: AbstractThe authors propose applying natural language processing techniques to shell commands captured via honeypots to detect and correlate botnet behaviors. The approach reduces command sequences to stochastic processes, then processed with machine learning to build classifiers and predictors that cluster botnet source IP addresses, even when attackers attempt to obfuscate intrusion attempts through rapid or random permutation techniques.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThis paper describes the incorporation of deceptive elements, including honeypots and decoys, into Microsoft's CyberBattleSim experimentation platform. According to the authors, they tested the defensive capabilities of these elements against reinforcement-learning-based attackers in a capture-the-flag environment, finding that attacker progress depended on the number and location of deceptive elements.
NetworkHoneypotDecoy
Paper2021
Material reviewed: AbstractThe work proposes integrating low interaction honeypots with the ELK Stack as a server attack detection system, aiming to divert attacker access and to help administrators analyze the generated logs through visualization. The authors carried out five testing schemes comparing the Cowrie and Dionaea honeypots, and report that Cowrie delivered real-time detection with an average delay time of 3.75 seconds, while ELK provided better monitoring results for administrators through its visualization.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe paper proposes implementing a honeypot system alongside an Intrusion Detection System, using a Venus fly-trap optimization algorithm to interact with the attacker. The authors introduce a fitness function to estimate attacker size and compare their model with prior work through remote-to-local, probing, and DoS attacks.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe paper proposes an industrial Early Intrusion Detection System (EIDS) that combines honeypots with machine learning algorithms. The authors describe collecting data from honeypot and industrial device sensors, storing it in a database and analyzing it to alert on intrusions in industrial control networks.
OT/ICSNetworkHoneypot
Paper2021
Material reviewed: AbstractAccording to the authors, this study deploys honeypots simulating Linux shells to collect heterogeneous threat event data (network traffic, file downloads, SSH logins, and attacker commands) and models attacker behavior using a Temporal Convolutional Network (TCN), comparing it against LSTM and GRU.
NetworkIoTHoneypot
Paper2021
Material reviewed: AbstractThe authors describe monitoring honeypot sensors deployed on Raspberry Pi devices integrated with Modern Honey Network, using SNMP as a network management function. The aim is to observe system resources and analyze how the number of attacks affects sensor performance.
NetworkEndpointHoneypot
Paper2021
Material reviewed: AbstractThe authors describe installing a honeypot on a server as an attack detector, with its logs exposed through a REST API built with the Django framework and a MongoDB database, so that an Android application can show whether the server is under attack and block the attacker's IP address. The work is framed around network security and the monitoring of attacks on a resource.
NetworkApplicationHoneypot
Paper2021
Material reviewed: AbstractThe work describes the design of a honeypot-based intrusion detection system (IDS) for the computer network of Universitas Bhayangkara Jakarta Raya. According to the authors, the honeypot simulates weak points to attract malware, records attacker activity, and produces logs that can be analyzed for handling and recovery during and after an attack.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe work addresses the protection of vulnerable components in Internet-of-Things (IoT) networks through an intrusion prevention technique that combines cyberdeception (a decoy system) and moving target defense (network topology shuffling). The authors analytically evaluate effectiveness and efficiency using a graphical security model in an SDN-based IoT network, defining strategies for when and how to perform topology shuffling to pursue goals such as prolonging system lifetime, increasing attack complexity on critical nodes, or maintaining service availability.
IoTNetworkDecoyMoving target defense
Paper2021
Material reviewed: AbstractAccording to the authors, this paper proposes an approach to generate realistic user activity on IT systems, combining deterministic and deep learning-based methods through an external agent instrumented on each machine. The aim is to improve the credibility of attacker analysis platforms, such as honeynets, and facilitate the creation of coherent scenarios.
NetworkEndpointHoneypotAdversary engagement
Paper2021
Material reviewed: AbstractThis work reviews the literature on using reinforcement learning (RL) as a feedback architecture for cyber-resilient mechanisms. The authors discuss resilience against posture-related, information-related, and human-related vulnerabilities, introducing three application domains: moving target defense, defensive cyber deception, and assistive human security technologies. They also examine vulnerabilities of RL itself to attacks on rewards, state observations, and action commands.
NetworkMoving target defenseAdversary engagement
Paper2021
Material reviewed: AbstractThis paper studies the DNS amplification attack ecosystem through a passive detection methodology at Internet exchange points (IXPs), combined with other measurement sources. According to the authors, IXPs and honeypots observe largely disjoint sets of attacks, and the study examines the effectiveness of observed attacks and the behavior of a dominant attacking entity.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe study, attributed to the authors, examines Cowrie Honeypot logs to inform the improvement of Snort rule signatures against brute force attacks. Snort acts as an intrusion prevention system and Cowrie as a tool to investigate anomalous behavior during such attacks; the authors report packet-matching processing times in microseconds for Hydra, Medusa and Ncrack attacks.
NetworkHoneypot
Paper2021
Material reviewed: Full textHistorical review of honeypots, honeytokens and moving target defense from the late 1980s through 2021.
NetworkEndpointHoneypotHoneytoken
Paper2021
Material reviewed: AbstractThis work examines how decoy generation can slow the decision process of automated agents in adversary emulation scenarios. The authors show, according to their study, that the degree of inhibition greatly depends on the types of decoy objects used, pointing to the need to explicitly evaluate decoy generation and placement strategies against fast-moving automated adversaries.
NetworkDecoyAdversary engagement
Paper2021
Material reviewed: Full textBibliographic record on self-adaptive deception. The abstract and findings still require review.
NetworkDecoy
Paper2021
Material reviewed: AbstractThe authors describe using honeynet data and time series to predict SSH attacks, covering overall activity and attacks from specific geographical regions. They apply ARIMA, SARIMA, GARCH and Bootstrapping with real-world data, presenting the viability, precision and usefulness of each approach across areas of IT security.
NetworkHoneypot
Paper2020
Material reviewed: AbstractThe paper describes a computational intelligence enabled honeypot intended to discover and predict attempted fingerprinting attacks while it interacts with attackers. According to the authors, the system uses principal components analysis and a fuzzy inference system, and it was tested against five fingerprinting tools: Nmap, Xprobe2, NetScanTools Pro, SinFP3 and Nessus.
NetworkHoneypot
Paper2020
Material reviewed: AbstractThe authors present a differentially private game theoretic approach to cyber deception, aiming to overcome limitations of prior approaches that assume a fixed number of systems and simplified attackers. The defender uses differential privacy mechanisms to strategically change the number of systems and obfuscate configurations, while the attacker uses Bayesian inference. According to the authors, experimental results demonstrate the effectiveness of the proposed approach.
NetworkDecoyMoving target defense
Paper2020
Material reviewed: AbstractThis paper proposes a framework for preventing ransomware attacks by combining blockchain, honeypot techniques, and cloud and edge computing. The authors state the framework is analyzed mainly on IoT devices, with potential generalization to other malware attacks.
IoTCloudHoneypot
Paper2020
Material reviewed: AbstractThe paper describes how configuration shortcomings and limited security awareness expose connected hosts, and presents an introduction to honeypot systems and machine learning. Drawing on these technologies, the authors design a smart agent aimed at cyber-attack prevention and prediction.
NetworkHoneypot
Paper2020
Material reviewed: AbstractThe authors propose a formal-methods approach to synthesize reactive defense strategies in networks equipped with decoy systems. They generalize attack graphs to incorporate defender countermeasures in an attack-defend game model, and introduce a class of hypergames to model asymmetric information created by decoys. According to the authors, this framework enables synthesis of effective defense strategies exploiting the attacker's misperception.
NetworkDecoyMoving target defense
Paper2020
Material reviewed: AbstractThis paper, according to its authors, presents an adaptive agent that uses active deception to recognize a cyber attacker's intent, modeling the problem as a two-agent sequential decision process via factored I-POMDPs. The authors describe using honeypots and decoys across multiple attack phases to refine predictions about attacker behavior, rather than merely delaying or confusing attackers.
NetworkEndpointHoneypotDecoy