Paper2024
Material reviewed: Full textCritical readingPresents an interactive honeypot using a language model fine-tuned with attacker command data.
NetworkHoneypot
Paper2024
Material reviewed: Full textOf 184 responses judged plausible by experts, participants also classified 167 as plausible (90.8%). This measures responses in this test, not deception of real attackers.
NetworkHoneypot
Paper2024
Material reviewed: AbstractThe authors propose LLMPot, an approach for designing honeypots in Industrial Control System (ICS) networks using large language models (LLMs). The goal is to automate the creation of realistic, vendor-agnostic honeypots capable of emulating industrial protocols and PLC control logic, reducing the manual effort traditionally required in this domain.
OT/ICSNetworkHoneypotDecoy
Open software2024
Material reviewed: Repository metadataA honeypot for the Log4Shell vulnerability (CVE-2021-44228).
NetworkHoneypot
Open software2024
Material reviewed: Repository metadataSimple TCP/UDP honeypot implemented in Perl
NetworkHoneypot
Open software2024
Material reviewed: Repository metadataHL7 / FHIR honeypot
NetworkHoneypot
Paper2024
Material reviewed: AbstractThe work presents and evaluates Mirage, an experimentation system in both emulation and simulation forms that allows for the implementation and testing of cyber deceptions designed to counter adversaries using AI search and planning capabilities. The authors frame cyber deception as a possible defensive mechanism against future AI-enabled adversaries.
NetworkDecoyAdversary engagement
Paper2024
Material reviewed: AbstractAccording to the authors, this paper initiates a systematic study of a new honeypot deployment paradigm that blends honeypot computers into production computers. They formalize the Honeypot Deployment (HD) problem as a combinatorial optimization problem, prove its NP-hardness, propose a near-optimal algorithm (a polynomial-time approximation scheme), and conduct simulations to assess the impact of attacker capabilities.
NetworkHoneypot
Paper2024
Material reviewed: AbstractThe study describes a two-tier deception-driven security model intended to mislead potential attackers and protect network resources using decoys, honeypots, and deceptive network segments. The authors report on deploying and testing the model to assess its efficacy and feasibility in practice, and argue that integrating deception techniques into cybersecurity frameworks can provide a protective layer.
NetworkHoneypotDecoy
Paper2024
Material reviewed: AbstractEditor contributionPacheco and Staino preprint proposing a cyclical, minimal deception process and presenting DOLOS-T as an open tool for exploring it.
NetworkApplicationDecoyAdversary engagement
Paper2024
Material reviewed: AbstractThe paper examines the origin of trust in trust management systems by linking it to the network attack rate, aiming to refine trust assessments and predict new attacks. The authors describe a strategy combining machine learning and dynamic honeypots to detect prepared-for attacks and predict unprepared-for attacks in vehicular ad hoc networks (VANETs).
NetworkHoneypot
Paper2024
Material reviewed: AbstractAccording to the authors, this paper presents a self-adaptive traffic anomaly detection system for IoT smart home environments, consisting of a honeypot server and a gateway. The honeypot continuously captures traffic and adaptively generates a detection model used by the gateway to identify anomalous traffic, including unknown attacks.
IoTNetworkHoneypot
Open software2024
Material reviewed: Repository metadataAn easy to set up and use SSH honeypot, a fake SSH server that lets anyone in and logs their activity
NetworkHoneypot
Paper2024
Material reviewed: AbstractThe authors formulate a two-player dynamic game to model honeypot allocation in tactical networks whose connectivity changes with node mobility. They propose an iterative algorithm to find Nash equilibria and assess scalability through compact states and sensitivity analysis under imperfect information.
NetworkHoneypot
Paper2024
Material reviewed: AbstractAccording to the authors, this chapter examines the combined use of game-theoretic models and foundation models (FMs) to analyze, design, and implement cyber deception tactics across tactical, operational, and strategic warfare levels. It proposes MANSCOL (multi-agent neurosymbolic conjectural learning) to let defenders predict adversarial behaviors and design adaptive deceptive defenses, and discusses challenges of applying FMs in cybersecurity.
NetworkAdversary engagementDecoy
Paper2024
Material reviewed: AbstractThe authors present a side-channel method for covertly identifying industrial control system (ICS) honeypots using time-to-live (TTL) values in the ICMP protocol. In a study of over 8,000 devices presenting as ICS systems, they compare their approach to existing honeypot detection methods and describe what their methodology reveals about the current population of live ICS honeypots.
OT/ICSNetworkHoneypot
Paper2024
Material reviewed: AbstractThis paper presents a proof-of-concept (POC) cyber deception system that dynamically generates deception material based on observed attacker behaviour during a simulated real-time attack. The system analyzes attacker interaction with the deception material to predict the attacker's motive, and the authors explore expanding this POC to infer other profile features such as psychological characteristics.
NetworkDecoyAdversary engagement
Paper2024
Material reviewed: AbstractThis work-in-progress paper studies the implementation of deception-in-depth strategies with three initial logical layers: network, host, and data. The authors draw on ideas from military deception, network orchestration, software deception, file deception, fake honeypots, and moving-target defenses, and are building a prototype to test in adversarial environments. According to the authors, the goal is to show that deploying a broad range of deception techniques can better protect systems than single techniques, with a focus on discouraging attacks rather than encouraging attacker engagement.
NetworkEndpointHoneypotDecoy
Paper2023
Material reviewed: Full textCritical readingSurvey of network requirements for implementing cyber deception techniques.
NetworkDecoy
Paper2023
Material reviewed: AbstractThis paper proposes an adaptive experimental design (AD) method, inspired by randomized clinical trials, to study causal relationships between the design of intrusion data collection environments (such as honeypots) and the data observed. The authors state they conducted the first controlled and adaptive honeypot deployment study to measure how an SSH vulnerability affects server exploitation rates, reporting reductions in deployment time and resources needed.
NetworkHoneypot
Paper2023
Material reviewed: AbstractThis work examines adversarial reconnaissance mitigation techniques, including deception strategies such as honeypots, and reviews the literature on deception games from the perspective of modeling adversarial reconnaissance. The authors highlight aspects of reconnaissance they state have not been adequately captured in prior work, and present a probability-theory based model of adversaries' belief formation, illustrated with numerical examples.
NetworkHoneypotAdversary engagement
Paper2023
Material reviewed: AbstractThis study examines how different probing costs affect adversarial decision-making in a deception game, using an IBLT model with delayed feedback to simulate human behavior. According to the authors, probing slightly decreased as its cost increased, while the proportion of attacks remained relatively stable. The authors conclude that different probing costs do not significantly affect the proportion of attacks but have a slight impact on the proportion of probing.
NetworkHoneypotAdversary engagement
Paper2023
Material reviewed: AbstractThis paper examines attack patterns in a large public dataset of geographically distributed honeypots, addressing methodological questions and building attacker behavioural profiles. According to the authors, results show honeypot location helps identify attack patterns and profiles, concluding that not all collected intelligence is equally valuable and that an effective early warning system may be built with only two distributed honeypots and a production server.
NetworkHoneypot
Paper2023
Material reviewed: AbstractThe work proposes a decision support system based on a Bayesian belief network to guide cyber deception strategies from a detailed model of attacker beliefs, illustrated with a case study using passively observed operating system fingerprinting data. The authors compare the model's prediction accuracy with a sequential artificial neural network and introduce a deception algorithm to select a minimal set of features whose modification would make a system appear as a different operating system.
EndpointNetworkDecoy