Paper2020
Material reviewed: AbstractThe authors present a differentially private game theoretic approach to cyber deception, aiming to overcome limitations of prior approaches that assume a fixed number of systems and simplified attackers. The defender uses differential privacy mechanisms to strategically change the number of systems and obfuscate configurations, while the attacker uses Bayesian inference. According to the authors, experimental results demonstrate the effectiveness of the proposed approach.
NetworkDecoyMoving target defense
Paper2020
Material reviewed: AbstractThis paper proposes a framework for preventing ransomware attacks by combining blockchain, honeypot techniques, and cloud and edge computing. The authors state the framework is analyzed mainly on IoT devices, with potential generalization to other malware attacks.
IoTCloudHoneypot
Paper2020
Material reviewed: AbstractThe paper describes how configuration shortcomings and limited security awareness expose connected hosts, and presents an introduction to honeypot systems and machine learning. Drawing on these technologies, the authors design a smart agent aimed at cyber-attack prevention and prediction.
NetworkHoneypot
Paper2020
Material reviewed: AbstractThe authors propose a formal-methods approach to synthesize reactive defense strategies in networks equipped with decoy systems. They generalize attack graphs to incorporate defender countermeasures in an attack-defend game model, and introduce a class of hypergames to model asymmetric information created by decoys. According to the authors, this framework enables synthesis of effective defense strategies exploiting the attacker's misperception.
NetworkDecoyMoving target defense
Paper2020
Material reviewed: AbstractThis paper, according to its authors, presents an adaptive agent that uses active deception to recognize a cyber attacker's intent, modeling the problem as a two-agent sequential decision process via factored I-POMDPs. The authors describe using honeypots and decoys across multiple attack phases to refine predictions about attacker behavior, rather than merely delaying or confusing attackers.
NetworkEndpointHoneypotDecoy
Paper2020
Material reviewed: Full textBibliographic record on adaptive signaling for cyber defense. The abstract and findings still require review.
NetworkDecoy
Paper2020
Material reviewed: AbstractThe study presents an exploratory experiment with 30 human participants acting as attackers to test a masking strategy (compared with a random masking strategy) aimed at reducing attackers' utility during network reconnaissance. The authors observed that attackers appeared more successful in launching attacks in the optimal condition, that the attackers' total score did not differ between masking strategies, and a generalized tendency to act according to certainty bias or risk aversion.
NetworkDecoy
Paper2020
Material reviewed: AbstractThe work reports an analysis and simulation of network security for an Ubuntu server in which the authors combine port knocking with a honeypot, IPtables, and ICMP. The stated purpose is to filter and refuse packets on exposed ports, require a secret knock sequence to reach services, and divert access attempts to decoy ports in order to observe actions directed at the server.
NetworkHoneypot
Paper2020
Material reviewed: Public pageThe paper describes using K-Means to group attacks from honeypot logs collected in real time through MHN and identify attacker IP addresses. It aims to support administrators in analyzing network attacks.
NetworkHoneypot
Paper2020
Material reviewed: AbstractThe paper proposes an anti-reconnaissance model for host fingerprints based on virtual nodes. The model constructs periodically reconfigurable virtual nodes to dynamically camouflage host fingerprint information and redirects attack traffic targeting virtual nodes to honeypots; the authors also introduce probabilistic models to examine how parameters such as the number of probes or honeypot mapping rules affect attack success probability, and they describe a prototype using SDN and DPDK intended to verify the model against reconnaissance.
NetworkHoneypotDecoy
Paper2020
Material reviewed: AbstractThe article offers an approach to building a cognizant honeypot for detecting active fingerprinting attacks through the use of the established dynamic fuzzy rule interpolation (D-FRI) technique, relying on a sparse rule base while remaining capable of detecting such attacks when no matching rules are found. The system learns from current network conditions and provides a dynamic rule base intended to facilitate more accurate and efficient detection, as described by the authors.
NetworkHoneypot
Paper2020
Material reviewed: AbstractThe authors present a long-term investigation of attacks targeting MikroTik routers, using a highly interactive honeypot deployed across six countries. According to the abstract, they collected over 44 million packets over 120 days, classifying traffic by known CVEs to identify activities such as cryptocurrency mining, DNS server redirection, and eavesdropping tunnels.
NetworkIoTHoneypot
Open software2020
Material reviewed: Repository metadataRepository about observation of Citrix exploitation; documentation and maintenance require further review.
NetworkHoneypot
Paper2020
Material reviewed: AbstractIsrael Barak's article concerns attacks on critical infrastructure — energy, water supply, transport, election systems, government and health — and argues that operators should aim to minimise mean time to response when attacks occur and gain more visibility into their systems, particularly between the IT and OT environments. The author further argues that security needs to be an intrinsic element in all OT systems, right from the initial design.
OT/ICSNetwork
Paper2020
Material reviewed: Full textCritical readingSurvey of defensive deception models and techniques in networks, hosts and cryptographic mechanisms.
NetworkEndpointDecoy
Paper2020
Material reviewed: AbstractThe paper describes deploying a Security Information Event Management (SIEM) system and a honeypot at a government higher education agency referred to as XYZ, aiming to detect incoming threat alerts and block suspicious access, while the honeypot is intended to deceive attackers into a fake system and learn their tactics. The authors report that testing this implementation allowed real-time monitoring of information- and data-related threats, and helped deter and deflect cyber-attacks to protect information security.
NetworkHoneypot
Dataset or lab2020
Material reviewed: Public pageCritical readingCowrie honeypot session data from a distributed deployment, according to Zenodo.
NetworkHoneypot
Open software2020
Material reviewed: Repository metadataRepository about observation of UDP-service abuse; documentation and maintenance require further review.
NetworkHoneypot
Paper2020
Material reviewed: AbstractThe work proposes a three-stage methodology for deploying honeypots in wireless sensor networks, aimed at detecting malicious activity and isolating malicious nodes. According to the abstract, the stages are node verification, self-healing and error correction, with the system relying on a server, a real database and honeypot-based data to monitor network traffic.
NetworkHoneypot
Paper2020
Material reviewed: AbstractAccording to the authors, this study proposes a time-expanded random network to model adversarial lateral movement in enterprise networks, along with dynamic cognitive honeypots placed at idle production nodes and honey links disguised as service links. The authors describe an approach aimed at reducing long-term vulnerability through honeypot policies whose location changes randomly.
NetworkHoneypotDecoy
Paper2020
Material reviewed: AbstractThe authors address the limitations of network security based only on a firewall and IDS, noting that IDS produces many notifications for administrators and does not work well in encrypted or IPv6 environments, and propose complementing it with a Dionaea honeypot. The work is framed as an analysis and implementation of a Dionaea honeypot as a decoy system to trap attackers on the internet network of the UNIKS Faculty of Engineering laboratory.
NetworkHoneypot
Paper2020
Material reviewed: Public pageThe paper describes implementing multiple honeypots on Raspberry Pi and centralizing and visualizing their logs with the ELK Stack to support detection and analysis of network attacks.
NetworkHoneypot
Paper2020
Material reviewed: Public pageThe paper describes integrating Grafana with Modern Honey Network to visualize logs collected by its honeypots. The work aims to make recorded activity easier to read and analyze.
NetworkHoneypot
Paper2020
Material reviewed: AbstractThe authors describe how they used experiments to evaluate a defense mechanism based on the low interaction honeypot HoneyPy against Slowloris attacks on an Apache web server. According to the deposited abstract, most packets are discarded and directed to the honeypot without the attacker's knowledge, reducing the Slowloris attacks that reach the web server.
NetworkApplicationHoneypot