Paper2025
Material reviewed: AbstractThis study, as described by the authors, explores the use of AI agents to automate the analysis of logs generated by the Cowrie honeypot, addressing the scarcity of real-world attack data in cybersecurity research. The proposed approach uses AI agents to parse, summarize, and extract insights from unstructured data, while also considering the security implications of deploying such an autonomous system.
NetworkHoneypot
Paper2025
Material reviewed: AbstractAccording to the authors, this study proposes a Stackelberg game-based framework for strategically timing cyber deception, combining a tactical layer modeling attacker-defender dynamics via a one-sided information Markov game with a strategic layer optimizing deception timing and selection through a stopping-time decision process. Numerical experiments, as reported by the authors, suggest that strategically timed deception can improve the defender's expected utility compared to baseline strategies.
NetworkAdversary engagementDecoy
Paper2024
Material reviewed: AbstractThe authors address the difficulty that traditional honeypot implementations are evaded by advanced adversaries such as APT groups, and propose designing and deploying a customized honeypot network based on adaptive camouflaging techniques. The work describes orchestrating a behavioral honeypot network tailored to three APT groups, with attack paths aligned with their tactics, techniques, and procedures, and includes a camouflaged chatterbox application deployed for 100 days; according to the deposited abstract, the setup recorded 13,906,945 hits from 4,238 unique IP addresses and was used to categorize attackers.
NetworkApplicationHoneypotDecoy
Paper2024
Material reviewed: Public pageThe paper proposes a honeypot layer to support security in an optical network with cloud services. The decoys simulate vulnerable resources to attract attackers and observe their behavior.
NetworkHoneypotDecoy
Open software2024
Material reviewed: Repository metadataMulti-head SSH honeypot system.
NetworkHoneypot
Paper2024
Material reviewed: AbstractThe authors analyze robocall data from multiple independent vantage points, including academic and industry voice honeypots, to study the effectiveness of telephone spam prevention and mitigation efforts. The work compares disparate data sources over more than 5 years, including audio and transcripts from millions of calls, to assess trends and spammer adaptation to authentication schemes like STIR/SHAKEN.
NetworkHoneypot
Dataset or lab2024
Material reviewed: Public pageCritical readingZeek traffic record from geographically distributed low-interaction sensors; the page says no conventional honeypot software was used.
NetworkHoneypot
Paper2024
Material reviewed: AbstractAccording to the authors, this paper proposes a cyber deception mechanism that stealthily redirects TCP communications to an on-demand honeypot server cloned to resemble the victim asset. The stated goal is to make attackers focus on the decoy server, enabling threat intelligence collection while protecting the real asset.
NetworkHoneypotDecoy
Paper2024
Material reviewed: Full textCritical readingSurvey proposing a taxonomy and comparing cyber deception research lines, including AI-based work.
NetworkCloudAdversary engagement
Paper2024
Material reviewed: Public pageIt proposes simulating, transforming and integrating synthetic honeypot logs into a graph database using the STIX model, aiming to convert attack data into interconnected threat intelligence objects for visualization and exploration. The purpose is to provide security operations centers with a standardized platform that enhances situational awareness and decision-making support.
NetworkHoneypot
Open software2024
Material reviewed: Repository metadataEditor contributionOpen framework for planning deception operations and deploying decoys and services with Python and Docker, according to its repository and documentation.
NetworkApplicationDecoyHoneypot
Paper2024
Material reviewed: AbstractThe authors address a scenario where a defender of a networked control system has isolated an intruder and redirects them toward a honeypot emulating the real system without connection to a physical plant. They propose an adversary engagement strategy within this decoy environment to increase the attacker's information-processing costs by spoofing sensor readings based on cyber threat intelligence. They perform a numerical comparison between cases of perfect and imperfect threat intelligence.
OT/ICSNetworkHoneypotAdversary engagement
Open software2024
Material reviewed: Repository metadataCredentials catching honeypot
NetworkHoneypot
Paper2024
Material reviewed: AbstractAccording to the authors, this paper explores the use of Generative Adversarial Networks (GANs) to generate decoy configurations for cyber defense. They note that existing approaches rely on maintained lists of configurations or pre-configured images with limited adaptability, and present what they describe as the first attempt to use GANs specifically for generating decoy configurations, aiming to provide defenders with a tool to strengthen network defenses.
NetworkHoneypotDecoy
Paper2024
Material reviewed: Full textCritical readingPresents a language-model terminal honeypot architecture and describes a field evaluation.
NetworkHoneypot
Open software2024
Material reviewed: Repository metadataFTP Honeypot
NetworkHoneypot
Paper2024
Material reviewed: AbstractReview of the honeypot as a decoy system simulating an isolated real system on a network to entice attackers and detect, block or foresee attempts at unauthorized access. The authors describe a monitoring arrangement linking honeypot, main network and system-admin so hostile activity is detected before the main network is affected.
NetworkHoneypot
Open software2024
Material reviewed: Repository metadataScript for turning a Raspberry Pi into a Honey Pot Pi
NetworkHoneypot
Paper2024
Material reviewed: AbstractThe paper assesses a specific group of honeypot systems based on criteria such as detection range, emulation accuracy, data quality, dependability, scalability, and ease of setup, and draws conclusions about their relative effectiveness in different situations. It also discusses recent developments in honeypot technology, including machine learning enhancements, increased automation, integration with other security tools, cloud-based honeypots, and deception technology, using simulated attacks to demonstrate how these systems log and record attack information.
NetworkCloudHoneypotDecoy
Paper2024
Material reviewed: AbstractThe authors investigate whether peer-to-peer (P2P) overlay network nodes, specifically Ethereum network nodes, attract heightened reconnaissance attacks due to their visibility and sustained uptime. They deploy a series of honeypots alongside real Ethereum nodes across globally distributed vantage points. The authors report findings on specific attack types targeting particular ports and services, extending the analysis through port scans on other reachable peers.
NetworkHoneypot
Paper2024
Material reviewed: AbstractThe authors propose a network design for honeypot placement and an intrusion detection system aimed at identifying and alerting on illicit access, using traffic logs. They use datasets derived from a honeypot implementation and KDD-99, trained with generative adversarial networks, a deep learning-based generative model.
NetworkHoneypot
Paper2024
Material reviewed: Public pageThe review examines AI integration with SOAR, including dynamic orchestration of honeypots that present an apparent vulnerability and collect intelligence on attacker methods.
NetworkOT/ICSHoneypot
Paper2024
Material reviewed: AbstractThis paper proposes a reinforcement learning (RL) approach to simulate ransomware attacks within an environment mirroring real-world networks, aiming to streamline traditional red teaming exercises. According to the authors, experimental results on a 152-host example network show the RL agent's capability to discover and orchestrate attacks on high-value targets while evading honeyfiles (decoy files placed to detect unauthorized access).
NetworkEndpointDecoyAdversary engagement
Paper2024
Material reviewed: AbstractThe authors present LLM Honeypot, a system that augments a standard SSH honeypot with prompt injection and time-based analysis techniques to distinguish autonomous AI agents among attackers. Over a roughly three-month trial deployment in a public environment, they recorded millions of hacking attempts and identified a small number of potential AI agents. The work aims to serve as an early warning of malicious LLM agent usage in the wild.
NetworkHoneypot