Paper2026
Material reviewed: AbstractThe paper describes a hybrid intrusion detection system combining a supervised classifier trained on the NSL-KDD dataset with a Docker-based honeypot that deploys automatically when suspicious activity is detected. Traffic is classified into five categories, with a voting ensemble of three classifiers producing the detection.
NetworkHoneypot
Paper2026
Material reviewed: Full textEditor contributionPacheco and Staino present BUDA as an approach to simulating fictitious-user activity and strengthening decoy credibility, aligned with MITRE Engage.
EndpointNetworkDecoyAdversary engagement
Paper2026
Material reviewed: Public pageThe authors propose SecuPi, a compact Raspberry Pi-based system that combines real-time traffic monitoring, hybrid intrusion detection (signature-based and machine learning) and automated threat response. As deception and proactive defense mechanisms, they propose the use of honeypots together with automatic firewall updates and Moving Target Defense (MTD).
NetworkIoTHoneypotMoving target defense
Paper2026
Material reviewed: AbstractThe authors propose a proactive cyber-defense system that combines cyber deception, adversarial environment simulation and deep reinforcement learning, with GAN-generated attack vectors emulating zero-day and polymorphic threats. The aim is to train context-aware defense policies that detect malicious behavior, re-route detection vectors and trigger deceptive traps, evaluated with benign and adversarial traffic on a synthetic smart-grid network.
NetworkOT/ICSDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThis paper presents ShellGames, an SSH shell simulator based on large language models (LLMs) designed to sustain credible interactive deception sessions with adversaries. According to the authors, the system combines techniques such as chain-of-thought reasoning, memory management, speculative command execution, sandbox routing, and subversion detection to address common LLM limitations. The authors report improvements in accuracy, consistency, and state tracking over baselines, along with a user study indicating perceived realism comparable to a real shell.
NetworkEndpointHoneypotMoving target defense
Paper2026
Material reviewed: AbstractThe authors introduce HoneyMed, a protocol-aware honeypot framework that simulates healthcare and IoT services in order to collect malicious interactions, transform them into machine-learning tabular features, and classify attack types in real time. Its stated purpose is to provide threat visibility for IoMT security testbeds using decoys, feature extraction and lightweight classifiers, without interacting with production medical assets.
IoTNetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThis paper presents a method to estimate a lower bound on the number of networks generating spoofed traffic in DRDoS attacks, using a global deployment of anycast amplification honeypots. The authors develop two estimators based on honeypot reception patterns and TTL variations, analyzing 287 days of amplification attacks. According to the authors, at least 21.0% of attacks originate from multiple network locations.
NetworkHoneypot
Open software2026
Material reviewed: Repository metadataA low/zero interaction ssh authentication logging honeypot
NetworkHoneypot
Open software2026
Material reviewed: Repository metadataA low-interaction SSH honeypot written in C
NetworkHoneypot
Paper2026
Material reviewed: AbstractAccording to the authors, this work presents SysEvolve, a system integrating three co-designed components (SysField, SysSpear, and SysArmor) to create a self-driven adversarial loop between LLM-based attack and defense agents. The authors describe the construction of realistic multi-host cyber ranges, attack scheme generation, and real-time interpretable defense. They also note that decoy endpoints deployed in the range affect LLM agent behavior.
NetworkDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThe authors use an interactive voice honeypot with language-model personas on real U.S. numbers to measure the prevalence of automated and synthetic voices in unwanted inbound calls, combining audio fingerprinting, a commercial synthetic-speech detector, and blinded listeners to characterize call traffic.
NetworkHoneypot
Paper2026
Material reviewed: Publisher metadataBibliographic record on realism and efficiency of deception. The abstract and findings still require review.
NetworkDecoy
Paper2026
Material reviewed: AbstractThe authors introduce Trident, an agentic LLM red teaming framework for evaluating the robustness of Deep Reinforcement Learning (DRL)-based cyber defenses. The work includes a dynamic benchmark, a dataset of red-blue interaction trajectories, and an agentic architecture that generates attack strategies and translates them into executable policies against DRL defenders. According to the authors, Trident substantially reduces defensive performance and uncovers emergent behaviors such as decoy avoidance.
NetworkDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThe paper presents TrustFed-Honeypot, a hybrid federated-retraining framework for honeypot-based IDS. Clients train locally, and the server retrains a global logistic model on samples weighted by a multi-signal behavioral trust model, aiming to reshape the retraining distribution.
NetworkHoneypot
Open software2026
Material reviewed: Repository metadataSimple DNS honeypot script
NetworkHoneypot
Paper2026
Material reviewed: AbstractThe study proposes an unsupervised detection system built on autoencoder-family models that learn normal traffic behavior and flag anomalies through reconstruction error (MSE), applied to multi-source metadata (Wireshark, firewall logs, and a T-Pot honeypot) collected over fifteen days from a real enterprise VLAN. The authors incorporate external threat intelligence (AbuseIPDB, OTX) and a multi-dimensional scoring system (MDSS) to convert raw detections into prioritized risk scores, and validate anomalies through two MITRE ATT&CK pipelines.
NetworkIoTHoneypot
Paper2025
Material reviewed: AbstractAccording to the abstract, the authors present a descriptive model incorporating psychological and strategic factors (belief, scepticism, deception fidelity, reconnaissance, and experience) to explain an attacker's initial decision to engage or withdraw from cyber-deception techniques. The authors state they have designed experiments using Capture the Flag activities and biometric observations to evaluate the model, but explicitly clarify that these experiments have not yet been conducted and no experimental findings are presented in the paper.
NetworkDecoyAdversary engagement
Paper2025
Material reviewed: AbstractThe authors propose a non-zero-sum game theoretical model to represent strategic interactions between cyber attackers and defenders, incorporating payoff functions that consider exploit probabilities and costs, network node values, and honeypot deployment costs. Through simulations, they derive Nash equilibria to inform strategic defense decisions, finding that high-probability, low-cost exploits like phishing require prioritized defense mechanisms.
NetworkHoneypot
Paper2025
Material reviewed: AbstractThis paper introduces an automated cloud defense framework that leverages medium- to high-interaction honeypot telemetry to dynamically update firewall rules in real time. According to the authors, the system integrates the Cowrie honeypot, Azure-native automation tools, and MITRE ATT&CK-aligned classification within a closed-loop feedback mechanism. The authors report an average Mean Time to Block of 0.86 seconds and classification of over 12,000 SSH attempts in experimental testing.
CloudNetworkHoneypotAdversary engagement
Paper2025
Material reviewed: AbstractThe authors present a simulated Gym-based environment for adversarial reinforcement learning in network security, where attacker and defender agents trained with DQN compete under a zero-sum reward framework. The environment models brute-force attacks and reactive defenses, including honeypot traps and adaptive rate-limiting, and the authors report that defender observability and trap effectiveness create substantial barriers to successful attacks.
NetworkHoneypotAdversary engagement
Paper2025
Material reviewed: AbstractThe paper describes an intrusion detection system based on machine learning, enhanced by integrating the Cowrie honeypot to capture attacker behavioral data and thereby improve detection of indicators of compromise and attack patterns. The authors present an isolated multi-VM architecture, supervised and unsupervised models (Random Forest, Logistic Regression, Isolation Forest), a Flask API for real-time classification, and Kibana and Power BI dashboards, aiming to detect both known and unknown threats.
NetworkHoneypot
Paper2025
Material reviewed: AbstractThe authors propose ADLAH, a conceptual adaptive honeynet architecture using reinforcement learning to decide in real time when to escalate sessions from low-interaction sensors to dynamically provisioned high-interaction honeypots. It is described as a functional prototype of the central decision mechanism, without field-scale validation due to insufficient live data.
NetworkHoneypotAdversary engagement
Paper2025
Material reviewed: AbstractThe authors present ADIRDS, an online monitoring system that models the real system as a graph and monitors critical assets, deploying realistic honeypots with business context similar to the real system to trap attackers and collect evidence when logs are insufficient. According to the authors, they applied the system to a real case, capturing 38 unique attacker IP addresses.
NetworkHoneypotDecoy
Paper2025
Material reviewed: AbstractThe study analyzes malicious actors' patterns and tactics using a modified T-Pot Honeypot, with multiple honeypots in Docker containers emulating vulnerable services. It aims to collect and analyze exploitation, evasion and credential attempts to characterize threats and inform cyberdefense adjustments.
NetworkHoneypot