Dataset or lab2020
Material reviewed: Public pageA set of PANDA traces collected with PANDAcap on a VM configured to accept all passwords for root, intended as a starting point for analyzing SSH brute force attacks. The material is organized into full-system traces, disk images and network captures.
NetworkEndpointHoneypotAdversary engagement
Paper2020
Material reviewed: Public pageThe paper presents PANDAcap, a framework for automating full-system deterministic trace collection and preparing repeatable experiments. The authors describe its use in an SSH honeypot to study the actions of brute-force attacks.
NetworkHoneypot
Paper2020
Material reviewed: AbstractThe authors introduce a platform for the periodic automated processing of data collected by honeypots, generating statistics and graphs from a set of traffic capture files in PCAP format. The stated purpose is to reduce the delay in perceiving atypical occurrences and trend changes that manual processing and analysis of monitoring data introduces, with a modular design that allows the platform to be easily extended and adapted to produce different outputs.
NetworkHoneypot
Paper2020
Material reviewed: AbstractAccording to the authors, this paper introduces 'Primer', a tool for priming and evaluating dynamic honeypots against previously developed measures of effectiveness related to environment fingerprinting, capturing adversary data, deception, and self-monitoring. The authors state they provide quantitative calibration results as a step toward automated effectiveness testing.
NetworkHoneypotDecoy
Paper2020
Material reviewed: AbstractThe authors propose an integrated defense technique combining cyberdeception via decoy systems with moving target defense through network topology shuffling, applied to SDN-based IoT networks. According to the abstract, they develop and compare several strategies for deciding when and how to reshuffle network topology in the presence of decoys, analytically evaluating effectiveness through a graphical security model. The authors report that their approach prolongs system lifetime, increases attack complexity, and maintains service availability compared to a network without the technique.
IoTNetworkMoving target defenseDecoy
Paper2020
Material reviewed: AbstractThe paper addresses detection and mitigation of DDoS attacks, specifically ICMP Flood, in Software Defined Networks (SDN), where controller centralization creates a vulnerability. The authors propose integrating the Modern Honey Network (MHN) into SDN and using a reactive application outside the controller based on entropy, computed from source IP, destination IP and protocol, to identify anomalous traffic.
NetworkHoneypot
Paper2020
Material reviewed: AbstractThis paper addresses the synthesis of active deception strategies in networks using two-player games with asymmetric information and temporal logic objectives, incorporating decoy systems and high-fidelity honeypots. The authors use a level-2 hypergame framework to model the attacker's incomplete perception and assess whether the defender can guarantee security properties.
NetworkDecoyHoneypot
Paper2020
Material reviewed: AbstractThe study simulates a network defense combining IPS Snort, which examines packets and blocks access identified as attacks, with Honeypot Artillery, which detects intrusion attempts through open ports and records attacker information in a database viewable through a web interface.
NetworkHoneypot
Open software2020
Material reviewed: Repository metadataA simple low-interaction port monitoring honeypot.
NetworkHoneypot
Paper2020
Material reviewed: Publisher metadataBibliographic record on software diversity for deception. The abstract and findings still require review.
NetworkMoving target defense
Open software2020
Material reviewed: Repository metadataframework for a high interaction SSH honeypot
NetworkHoneypot
Paper2019
Material reviewed: AbstractThe article discusses how cyber deception can change an attacker's perception of the network environment and lead attackers to false beliefs about which systems contain critical information. The authors introduce game theory models and discuss techniques combining artificial intelligence algorithms with those models to estimate hidden states of the attacker using feedback through payoffs, in order to learn how best to defend the system using cyber deception.
NetworkDecoyAdversary engagement
Paper2019
Material reviewed: AbstractAccording to the authors, this work proposes a framework for modeling attacker behavior to better predict future actions using a novel semi-supervised algorithm called Fusion Hidden Markov Model (FHMM). Experiments were conducted on real attack data captured from a Cowrie honeypot system, comparing FHMM's performance against Markov Chains, traditional HMMs, and deep recurrent neural network architectures.
NetworkHoneypot
Paper2019
Material reviewed: AbstractThe authors propose an automatic identification model based on a random forest algorithm with three feature groups—application-layer, network-layer, and other system-layer features—to remotely check whether a server runs a honeypot service. The experiment datasets were collected from public known platforms, and the authors report that the model achieved an AUC value of 0.93.
NetworkApplicationHoneypot
Paper2019
Material reviewed: AbstractThe authors analyze how country attributes—such as population size, access to information and communication technologies, and ICT use—influence the number of secure shell attacks seen by their honeynet, using four statistical models built from three data sources and methods including partial least-squares path modelling and clustering of countries by similarity.
NetworkHoneypot
Paper2019
Material reviewed: AbstractAccording to the abstract, this work develops inference techniques to detect organic click fraud in advertising networks. The authors note that malware detection systems, including honeypots, fail to stop click fraud apps, and propose two defenses: a mimicry defence based on detecting click reuse patterns, and a bait-click defence that injects decoy clicks to trigger fraudulent app behavior.
NetworkApplicationHoneypotDecoy
Paper2019
Material reviewed: Publisher metadataBibliographic record on cyber deception games. The abstract and findings still require review.
NetworkAdversary engagement
Paper2019
Material reviewed: Publisher metadataBibliographic record on game theory applied to deception. The abstract and findings still require review.
NetworkAdversary engagement
Paper2019
Material reviewed: AbstractThe authors present an overview of cyber deception games across three environments, extending baseline signaling game models to include evidence via side-channel knowledge acquisition. They analyze deception in binary and continuous information spaces and explore a multi-stage incomplete-information Bayesian game model for defensive deception against advanced persistent threats, using perfect Bayesian Nash equilibrium as the solution concept.
NetworkAdversary engagementDecoy
Paper2019
Material reviewed: AbstractAndrew Bushby's article describes the use of deception technology as a mechanism for active, post-breach defence aimed at luring, detecting and defending against malware and intruders moving laterally within the network. It notes that such approaches come with misconceptions and argues that defences need to move beyond detecting bad activity within an ocean of good activity.
NetworkDecoyAdversary engagement
Paper2019
Material reviewed: Public pageThe paper describes a low-interaction Python honeypot that presents a fake SSH service to observe attacker behavior and authentication attempts while hiding the real SSH service.
NetworkHoneypot
Paper2019
Material reviewed: AbstractThe authors propose using a Cron job with a Perl script to periodically parse collected data into a database, aiming to reduce the size of logs generated by a honeypot under heavy traffic such as DDoS attacks. They report three DDoS attack cases to illustrate log growth.
NetworkHoneypot
Paper2019
Material reviewed: AbstractAccording to the authors, this paper proposes an SDN-based in-network honeypot that reroutes traffic from suspicious nodes and intelligently spoofs it with misleading information to confuse attackers in IoT environments, without requiring dedicated hardware. The authors state preliminary evaluations show little impact on network performance.
IoTNetworkHoneypotDecoy
Paper2019
Material reviewed: AbstractThe authors present experimental tests of common attacks on wired IPv6 networks and describe the design and implementation of a Honeynet with different operating systems. They use tools such as 6Guard, Snort and Wireshark to attract, detect and analyze attacker behavior.
NetworkHoneypotDecoy