Paper2023
Material reviewed: AbstractAccording to its authors, this paper studies a Stackelberg game between attacker and defender over large, dynamic Active Directory (AD) attack graphs, where the defender deploys honeypots to prevent the attacker from reaching high-value targets. The authors propose a mixed-integer programming (MIP) formulation and a clustering-based approach (dyMIP(m)) to handle large dynamic graph instances, reporting near-optimal results under realistic conditions.
IdentityNetworkHoneypot
Paper2023
Material reviewed: AbstractThis paper explores using ChatGPT-style conversational agents as a dynamic honeypot interface, imitating Linux, Mac, and Windows terminal commands and tools like TeamViewer, nmap, and ping. The authors present ten feasibility tasks intended for defensive teams to simulate honeypot interfaces with minimal risk, aiming to delay or understand attacker tactics, techniques, and procedures.
NetworkEndpointHoneypot
Paper2023
Material reviewed: AbstractThe work describes the deployment of an ensemble of research honeypot detectors to analyze and evaluate attackers' behavior. The authors present an outline of a containerized cloud honeypot deployment that they state is portable, durable, and simple to deploy and administer, and they describe instrumented monitoring that generated data points from which inferences about malicious users' activities and purpose could be drawn.
CloudNetworkHoneypotDecoy
Paper2023
Material reviewed: Publisher metadataBibliographic record on expert experiences and opinions. The abstract and findings still require review.
NetworkAdversary engagement
Paper2023
Material reviewed: AbstractThe study addresses social engineering attacks, which the authors say exploit human psychology and user awareness, and proposes an automated prevention mechanism that combines honeypots with artificial intelligence and an intrusion prevention system. The stated aim is to detect such attacks, threaten the attacker and restrict his session to keep users away from these manipulation tactics.
NetworkHoneypot
Open software2023
Material reviewed: Repository metadataEthereum honey pot
NetworkHoneypot
Paper2023
Material reviewed: Full textCritical readingProposes a simulation method for evaluating honeypots and moving target defense in networks.
NetworkHoneypotMoving target defense
Paper2023
Material reviewed: AbstractThe authors present a method for selecting cyber deception strategies using a multi-stage Flipit game, aiming to account for defense timing alongside spatial strategy selection. The approach constructs a spatiotemporal decision-making model, introduces a discount factor and transition probabilities, and applies a Proximal Policy Optimization algorithm to compute defender strategies.
NetworkDecoyMoving target defense
Paper2023
Material reviewed: Publisher metadataDOI-identified publication on injecting honeytokens using Netfilter; text analysis is pending.
NetworkHoneytoken
Open software2023
Material reviewed: Repository metadataThe plugin repository for Honeycomb, the honeypot framework by Cymmetria
NetworkHoneypot
Open software2023
Material reviewed: Repository metadataLLM Based Honeypot File System Creator
NetworkHoneypot
Paper2023
Material reviewed: AbstractThe authors propose a game-theoretic approach for optimal honeypot allocation in tactical networks with dynamic connectivity. They model a two-player dynamic game accounting for future network state evolution, aiming to maximize the attacker's likelihood of hitting a honeypot while minimizing reconfiguration costs. They present an iterative algorithm to find Nash equilibrium strategies and evaluate its scalability through simulations.
NetworkHoneypotDecoy
Paper2023
Material reviewed: AbstractThis thesis presents a honeypot solution to investigate malicious activity in the heiCLOUD environment, showing according to the author a significant increase in attacks. A new concept is proposed to detect firewall leaks in restricted network zones, along with a method for detecting honeypots at the transport level from an attacker's perspective. A customized OpenSSH server is also presented as an intermediary instance to mitigate such efforts.
CloudNetworkHoneypotAdversary engagement
Paper2023
Material reviewed: AbstractThis report reviews the concepts and types of honeypots, which organizations use as decoy networks to lure attackers, and discusses challenges of deploying them along with advantages and disadvantages.
NetworkHoneypotDecoy
Paper2023
Material reviewed: AbstractThe authors propose a deep learning based method to generate synthetic IoT device traffic flows mimicking real traffic, aiming to improve IoT honeypots against attacker detection. According to the abstract, the generator outperforms prior approaches in remaining indistinguishable from real traffic.
IoTNetworkHoneypotDecoy
Open software2023
Material reviewed: Repository metadataKippo - SSH Honeypot
NetworkHoneypot
Open software2023
Material reviewed: Repository metadataA medium interaction printer honeypot 🍯
NetworkHoneypot
Paper2023
Material reviewed: Publisher metadataBibliographic record on deception against autonomous attacks. The abstract and findings still require review.
NetworkDecoy
Open software2023
Material reviewed: Repository metadataRepo for the Open Source version of NOVA
NetworkHoneypot
Paper2023
Material reviewed: AbstractThe authors propose a planning framework to generate a defense strategy that covertly guides an attacker toward a trap state, formulating the problem as an infinite-horizon discounted MDP whose optimal policy serves as the defender's strategy. According to the abstract, this formulation is applicable to systems such as honeypots or honeynets, and the authors report empirically evaluating the merits of their approach.
NetworkHoneypotAdversary engagement
Open software2023
Material reviewed: Repository metadataA simple PoC for the use of GPT3.5 in creating an SMTP honeypot
NetworkHoneypot
Paper2023
Material reviewed: AbstractThe paper proposes an ethics framework, termed the doctrine of cyber effect, to guide the design of defensive cyber deception. It incorporates five ethical principles (goodwill, deontology, no-harm, transparency, and fairness) and presents the game of ethical duplicity as a reasoning framework applicable to designing defensive cyber deception techniques.
NetworkAdversary engagement
Paper2023
Material reviewed: AbstractThis study, according to its authors, investigates whether honeypots and honeynets described in the literature actually incorporate autonomic computing principles, beyond the use of terms like adaptive or intelligent. The authors analyze the frequency of keywords related to self-configuration, self-healing, self-protection, and self-optimization in a literature sample, finding low presence of the first three and notable presence of the latter.
NetworkHoneypot
Paper2022
Material reviewed: AbstractThis paper describes information acquired from a Secure Shell honeypot, including plaintext login credentials and attack data. The authors present a low-interaction honeypot aimed at organizations with limited resources that records, analyzes and sends notifications about suspicious network traffic, with the stated goal of encouraging the development and adoption of practical honeypot solutions.
NetworkHoneypot