Paper2026
Material reviewed: Public pagePaper describing a longitudinal dataset of high-interaction SSH honeypot logs covering connection attempts, authentication brute-forcing and post-authentication command execution. It is intended as a ground-truth source for empirical research and anomaly detection development.
NetworkHoneypot
Paper2026
Material reviewed: AbstractThis paper presents a corpus of real scam- and spam-call conversations collected via an active voice-agent honeypot. According to the authors, the system adopts a plausible target persona to sustain interactions with fraudulent callers, recording audio, transcripts, and automatic labels. The study describes the collection system, record structure, and an evaluation of corpus realism and label quality, as well as benchmarking scam detectors trained on synthetic dialogue against real traffic.
NetworkIdentityHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors propose TAB-DEN, a framework for IoT healthcare systems that combines a permissioned blockchain with Proof of Authority consensus for decentralized authentication, a hierarchical edge architecture of primary and secondary edge servers that compute trust scores in real time and redirect traffic according to trustworthiness, and deception-based edge nodes acting as honeypot-like environments to attract, isolate and profile attackers. The stated aim is to provide scalable and quantum-resistant security, recording intrusion events through a lattice-based post-quantum signature scheme so that attack records are immutable and verifiable on the distributed ledger.
IoTNetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThe paper proposes a framework combining game theory with transformer-based components to quantify, model, and optimize cyber deception. The authors define deception attack-surface metrics and embed them in a signaling game, aiming to guide adaptive deception strategies.
NetworkDecoyMoving target defense
Paper2026
Material reviewed: AbstractThe authors present a multi-attacker Bayesian Stackelberg framework for allocating honeypots in a directed network, modeling each attacker as a follower with a latent type and the defender as replanning via a DOBSS-style mixed-integer linear program under posterior beliefs. They aim to scale defense to realistic graphs using layered structures and pruning.
NetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors present AdvancedShelLM, an LLM-based SSH honeypot using a multi-agent architecture (Manager and Worker) intended to improve command understanding and deceptive capability over its predecessor shelLM. According to the abstract, the system was evaluated through unit tests, an AI attacker, human attackers, and an Internet deployment.
NetworkEndpointHoneypotDecoy
Paper2026
Material reviewed: AbstractThe work proposes AEGIS-AI, a framework combining honeypots with reinforcement learning and deep neural networks to automate deception and detection of malicious activity. The authors describe real-time adaptive deception strategies via Markov Decision Processes and federated learning, and present formulas for evaluating deception effectiveness.
NetworkHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe authors propose a dynamic honeypot framework combining a reinforcement-learning deception agent (tabular Q-learning, formalized as an MDP), threat-intelligence fusion via indicators of compromise, and automated containment actions. Its purpose is to adapt the honeypot's exposed persona and guide deception decisions, evaluated in an isolated virtualized testbed.
NetworkCloudHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThis study analyzes a corpus of 10,211 scam and spam calls collected via an AI voice-agent honeypot that answered calls and kept callers talking. The authors examine operational patterns of telephone fraud, including operating hours, script reuse, types of information solicited, and the influence of the target's simulated identity on scammer behavior. They also present an early-detection experiment based on the opening lines of calls.
NetworkHoneypot
Paper2026
Material reviewed: AbstractThis study examines how anchoring effects influence attackers' decisions in specific cyberattack scenarios through two experiments. Experiment 1 compares anchoring measurement methods in Crontab and Hostname tasks; Experiment 2 embeds bias triggers within an end-to-end cyber kill chain scenario.
NetworkEndpointDecoyAdversary engagement
Paper2026
Material reviewed: Full textEditor contributionPacheco and Staino paper in the SACS 2026 proceedings describing the reproducible educational design of Cyber Deception Playground.
NetworkApplicationHoneypotDecoy
Paper2026
Material reviewed: AbstractThe article examines the application of Cyber Deception technologies to the investigation of current cyber threats and the behavior of potential attackers, arguing for the usefulness of honeypot systems in collecting information on unauthorized access attempts and cyberattack techniques. Its authors propose a laboratory architecture based on a virtual infrastructure using the Cowrie honeypot system, aimed at automated event log collection and continuous monitoring of unauthorized access attempts, authentication processes, executed commands, and subsequent analysis of attacker activity.
NetworkEndpointHoneypotDecoy
Open software2026
Material reviewed: Repository metadataA secure low code deception runtime framework, leveraging AI for System Virtualization.
NetworkDecoy
Paper2026
Material reviewed: AbstractThe authors analyze Stackelberg Security Games (SSG) applied to cyber deception, proposing a Quantal Stackelberg Equilibrium (QSE) that models noisy attacker responses instead of a perfect best response. According to the authors, this approach serves as a form of insurance against model specification errors, and is empirically evaluated in a cybersecurity case study with real CVE/CVSS vulnerabilities, showing gains in defender utility over the classical Stackelberg approach.
NetworkDecoy
Case study2026
Material reviewed: Public pageCritical readingProofpoint observed post-compromise activity for over a month in a Deception.Pro decoy environment; adversary behavior research, not a commercial effectiveness trial.
EndpointNetworkDecoyAdversary engagement
Paper2026
Material reviewed: AbstractAccording to the authors, Chameleon is an adaptive honeypot architecture combining a BiLSTM classifier, a locally deployed language model, and two metaheuristic engines (TC-PSO and S-RRT) to dynamically adjust connection-holding delays and deception schemas based on detected threat levels. The authors report performance comparisons against standard algorithms and note reduced operating costs compared to commercial alternatives.
NetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractPresents the design, implementation, and evaluation of a honeypot monitoring system deployed on AWS that emulates SSH, HTTP, and HTTPS services on EC2 instances within an isolated virtual private cloud. The system aims to attract, record, and analyze malicious interactions, using a Python/Flask backend and a React/D3.js dashboard for attack visualization.
CloudNetworkHoneypotDecoy
Paper2026
Material reviewed: Publisher metadataBibliographic record on language-model honeypot tuned on Cowrie data. The abstract and findings still require review.
NetworkHoneypot
Paper2026
Material reviewed: Public pageThe authors describe installing and configuring Cowrie on Linux as an SSH and Telnet honeypot that logs attacker login attempts, credentials, and terminal commands to log files.
NetworkHoneypotAdversary engagement
Dataset or lab2026
Material reviewed: Public pageCritical readingJSONL shell-conversation datasets for training and testing language-model SSH honeypots, according to Zenodo.
NetworkHoneypot
Paper2026
Material reviewed: AbstractThe authors propose using honey drones as a deception strategy to defend unmanned aerial vehicle (UAV) mission systems against denial-of-service attacks. They formulate an attacker-defender optimization problem based on radio signal strength and present an approach called HT-DRL, combining hypergame theory with deep reinforcement learning to identify optimal deception strategies.
IoTNetworkDecoyAdversary engagement
Open software2026
Material reviewed: Repository metadataEditor contributionOpen Docker Compose lab with vulnerable services, configurable deception levels, monitoring and an attacker environment for controlled training and research.
NetworkApplicationHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors examine the assumption that decoys can be placed wherever attacker behavior occurs, applying a four-criterion rubric to all 250 MITRE ATT&CK v18.1 techniques. They find only 32% of techniques admit a plausible decoy and describe two placement patterns, Sweep and Seek, offering a simple rule for decoy deployment.
NetworkEndpointDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThe work proposes DecoyShield, a deception-based cybersecurity framework for proactive detection. It leverages multi-service honeypot environments that simulate network services, capture attacker behavior, and integrate behavioral analysis, threat intelligence, and dynamic risk scoring to classify severity and deploy adaptive responses.
NetworkHoneypotDecoy