Paper2012
Material reviewed: AbstractThis work proposes the use of unsupervised neural models, based on neural projection methods, to generate an intuitive visualization of traffic captured from honeypot data rather than network statistics alone. The authors position the system as a complementary network security tool that supports security personnel in visually inspecting traffic events and in assessing Snort performance through the visualization of attack patterns.
NetworkHoneypot
Paper2012
Material reviewed: AbstractThe authors present a comparative study, based on a mobile honeypot that extracts first statistical results, to analyze to what extent malicious transport contacts depend on the type of network access, particularly whether an adversary specifically targets mobile or non-mobile devices. Their findings indicate that a few topological domains of the Internet have started to place particular focus on attacking mobile networks.
NetworkHoneypot
Paper2012
Material reviewed: AbstractThe author introduces honeypots as a tool for security-related research, lists and characterizes several selected honeypot solutions, and presents results of practical experiments carried out at the University of Defence, including graphs and tables. The stated purpose is to acquaint the reader with the use of honeypots in security research.
NetworkHoneypot
Open software2012
Material reviewed: Repository metadataRepository about decoy MySQL service; documentation and maintenance require further review.
NetworkHoneypot
Paper2010
Material reviewed: AbstractThis paper describes tools and techniques used in network forensics to capture, record and analyze network events for investigating security attacks. According to the authors, it surveys tools such as email trackers, packet sniffers and IP traceback techniques, and discusses the use of honeypots and honeynets to gather intelligence on intruders.
NetworkHoneypot
Paper2009
Material reviewed: AbstractThe authors propose a system that uses honeypots not only to detect malicious traffic but also to generate and broadcast on-the-fly anti-malware signatures for new and unknown malware in a network, mimicking the way malware itself spreads. According to the abstract, this would allow effective initial control over viruses not yet identified by established security firms.
NetworkEndpointHoneypot
Paper2009
Material reviewed: AbstractThe authors present an implementation of an intrusion detection system using advanced honeypots to distinguish legitimate client traffic from attacker traffic, aiming to reduce latency and improve security on public servers. According to the abstract, results of stress and scalability tests are reported, along with suggested potential uses for the system.
NetworkHoneypot
Paper2007
Material reviewed: AbstractAccording to the abstract, the authors present empirical analyses based on data collected from the Leurré.com honeypot platforms deployed on the Internet, along with preliminary modeling studies aimed at characterizing attack processes, in order to better understand attacker strategies and techniques.
NetworkHoneypot
Paper2007
Material reviewed: AbstractThis paper presents an experimental study and lessons learned by the authors from observing attackers logged onto a compromised machine. According to the abstract, results are based on a six-month controlled experiment with a high-interaction honeypot, correlated with findings from a worldwide distributed low-interaction honeypot system.
NetworkHoneypot
Paper2006
Material reviewed: AbstractThe author proposes an alternative approach to learning and teaching IT security called Honeynet Learning, which uses the honeynet as a tool and resource to augment both student and instructor learning. The approach incorporates discovery, feedback, and "real world" experience, and illustrates a methodology that can be applied in a typical IT security course.
NetworkHoneypot
Paper2005
Material reviewed: AbstractThe paper addresses the tension between scalability and fidelity in network honeypots used to gather intelligence on malware, and proposes reducing it through a prototype honeyfarm system called Potemkin. According to the authors, Potemkin uses virtual machines, aggressive memory sharing, and late binding of resources to emulate the execution behavior of individual hosts at large scale.
NetworkHoneypot
Paper2004
Material reviewed: AbstractThis paper provides an introduction to honeypots (electronic bait), network resources designed to be attacked and compromised, indistinguishable from regular systems. According to the authors, these systems can be interconnected into honeynets equipped with special software facilitating forensic analysis of incidents. The work describes the setup and first experiences of such a network deployed at RWTH Aachen University, aiming to learn about attacker behavior in networks.
NetworkHoneypot
Paper2004
Material reviewed: AbstractThe paper describes a system for generating attack signatures for network intrusion detection systems, applying pattern-matching techniques and protocol conformance checks at multiple levels of the protocol hierarchy to network traffic captured at a honeypot system. The authors report results from running the system for 24 hours on an unprotected cable modem connection, where it created precise traffic signatures.
NetworkHoneypot
Paper2004
Material reviewed: AbstractThis paper proposes a model for estimating the costs and benefits associated with deploying honeynet technology, an area where, according to the authors, a clear framework for optimal security resource allocation was lacking. The stated goal is to foster informed reasoning about the adoption of honeynets as an IT security measure.
NetworkHoneypot
Product—
Material reviewed: Public pageCritical readingPrimarily a microsegmentation product whose documentation includes dynamic redirection into a deception environment; this related capability is recorded.
NetworkOT/ICSDecoyMoving target defense
Open software—
Material reviewed: Repository documentationDocumented honeypot for CVE-2017-5689: a web server listens on TCP port 16922 and imitates the Intel AMT management service. If exploited, it serves the attacker content obtained from an HP machine.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationAmun is a Python-based low-interaction honeypot, described as the first of its kind, following Nepenthes' concepts while extending emulation. Per its documentation, it logs exploitation attempts, malware downloads, and unknown shellcode across separate log files.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationA user-friendly, CISO-friendly configuration, management and acquisition tool for honeyd that provides a usable interface for configuring, deploying honeypots and receiving their logs from a central server.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationArgos is an advertised honeypot using dynamic taint analysis to detect and analyze control flow attacks.
NetworkEndpointHoneypot
Open software—
Material reviewed: Repository documentationTool combining a honeypot on commonly attacked ports with monitoring and alerts; according to the documentation, it blacklists IPs that connect to those ports.
NetworkHoneypot
Community or education—
Material reviewed: Public pageCommunity list of honeypot projects and materials; each link requires separate verification.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationA honeypot project (now outdated) that deploys decoy clients and services to detect compromise via traffic discrepancies and honeytoken credential reuse.
NetworkIdentityHoneypotHoneytoken
Open software—
Material reviewed: Repository documentationA tool that parses logs from multiple honeypots (Kippo/Cowrie SSH, phpMyAdmin, Wordpot, Redispot, VncLowPot, Pghoney) to extract malicious IPs, URLs, and file hashes and publish them as pulses in AlienVault OTX.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationOpen-source tool that scans systems to detect misconfigurations or fingerprints revealing honeypots, helping researchers make them harder to detect.
NetworkHoneypot