Paper2026
Material reviewed: AbstractThe paper presents PHANTOM, a framework that generates honeytokens by encoding organisation-specific knowledge (domain names, service naming conventions, technology-stack idioms and realistic secret-value distributions) into a multi-component pipeline. The authors formalise a four-component believability score and use it to compare PHANTOM against a template-based baseline.
HoneytokenDecoy
Paper2026
Material reviewed: Public pagePaper describing a longitudinal dataset of high-interaction SSH honeypot logs covering connection attempts, authentication brute-forcing and post-authentication command execution. It is intended as a ground-truth source for empirical research and anomaly detection development.
NetworkHoneypot
Paper2026
Material reviewed: Public pageWithin a broader agent-governance proposal, the preprint describes planted canary values and precomputed transformations for detecting exfiltration of those values.
Honeytoken
Paper2026
Material reviewed: AbstractThis paper presents a corpus of real scam- and spam-call conversations collected via an active voice-agent honeypot. According to the authors, the system adopts a plausible target persona to sustain interactions with fraudulent callers, recording audio, transcripts, and automatic labels. The study describes the collection system, record structure, and an evaluation of corpus realism and label quality, as well as benchmarking scam detectors trained on synthetic dialogue against real traffic.
NetworkIdentityHoneypotDecoy
Paper2026
Material reviewed: AbstractThe paper proposes a Deception Readiness Index (DRI) for ICS and OT cybersecurity programs. Using design science and qualitative analysis of public standards and guidance, it scores readiness across governance, architecture, monitoring, workforce, and operational safety domains, and applies the index to three synthetic critical-infrastructure profiles to identify gaps before deployment.
OT/ICSDecoy
Paper2026
Material reviewed: AbstractThe authors propose TAB-DEN, a framework for IoT healthcare systems that combines a permissioned blockchain with Proof of Authority consensus for decentralized authentication, a hierarchical edge architecture of primary and secondary edge servers that compute trust scores in real time and redirect traffic according to trustworthiness, and deception-based edge nodes acting as honeypot-like environments to attract, isolate and profile attackers. The stated aim is to provide scalable and quantum-resistant security, recording intrusion events through a lattice-based post-quantum signature scheme so that attack records are immutable and verifiable on the distributed ledger.
IoTNetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThe paper proposes a framework combining game theory with transformer-based components to quantify, model, and optimize cyber deception. The authors define deception attack-surface metrics and embed them in a signaling game, aiming to guide adaptive deception strategies.
NetworkDecoyMoving target defense
Paper2026
Material reviewed: AbstractThe authors present a multi-attacker Bayesian Stackelberg framework for allocating honeypots in a directed network, modeling each attacker as a follower with a latent type and the defender as replanning via a DOBSS-style mixed-integer linear program under posterior beliefs. They aim to scale defense to realistic graphs using layered structures and pruning.
NetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors present AdvancedShelLM, an LLM-based SSH honeypot using a multi-agent architecture (Manager and Worker) intended to improve command understanding and deceptive capability over its predecessor shelLM. According to the abstract, the system was evaluated through unit tests, an AI attacker, human attackers, and an Internet deployment.
NetworkEndpointHoneypotDecoy
Paper2026
Material reviewed: AbstractThe work proposes AEGIS-AI, a framework combining honeypots with reinforcement learning and deep neural networks to automate deception and detection of malicious activity. The authors describe real-time adaptive deception strategies via Markov Decision Processes and federated learning, and present formulas for evaluating deception effectiveness.
NetworkHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe authors propose a dynamic honeypot framework combining a reinforcement-learning deception agent (tabular Q-learning, formalized as an MDP), threat-intelligence fusion via indicators of compromise, and automated containment actions. Its purpose is to adapt the honeypot's exposed persona and guide deception decisions, evaluated in an isolated virtualized testbed.
NetworkCloudHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThis study analyzes a corpus of 10,211 scam and spam calls collected via an AI voice-agent honeypot that answered calls and kept callers talking. The authors examine operational patterns of telephone fraud, including operating hours, script reuse, types of information solicited, and the influence of the target's simulated identity on scammer behavior. They also present an early-detection experiment based on the opening lines of calls.
NetworkHoneypot
Paper2026
Material reviewed: AbstractThis study examines how anchoring effects influence attackers' decisions in specific cyberattack scenarios through two experiments. Experiment 1 compares anchoring measurement methods in Crontab and Hostname tasks; Experiment 2 embeds bias triggers within an end-to-end cyber kill chain scenario.
NetworkEndpointDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThe study compares, under homogeneous conditions, the technical performance, resource consumption and operational costs of traditional honeypots versus honeypots that incorporate machine learning to improve realism and hinder fingerprinting. The authors deployed six open-source honeypots simultaneously (three traditional and three ML-enhanced) for 60 days on Hetzner Cloud infrastructure, reporting differences in useful interaction, fingerprinting and return on investment.
CloudHoneypot
Paper2026
Material reviewed: Full textEditor contributionPacheco and Staino paper in the SACS 2026 proceedings describing the reproducible educational design of Cyber Deception Playground.
NetworkApplicationHoneypotDecoy
Paper2026
Material reviewed: AbstractThe article examines the application of Cyber Deception technologies to the investigation of current cyber threats and the behavior of potential attackers, arguing for the usefulness of honeypot systems in collecting information on unauthorized access attempts and cyberattack techniques. Its authors propose a laboratory architecture based on a virtual infrastructure using the Cowrie honeypot system, aimed at automated event log collection and continuous monitoring of unauthorized access attempts, authentication processes, executed commands, and subsequent analysis of attacker activity.
NetworkEndpointHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors analyze Stackelberg Security Games (SSG) applied to cyber deception, proposing a Quantal Stackelberg Equilibrium (QSE) that models noisy attacker responses instead of a perfect best response. According to the authors, this approach serves as a form of insurance against model specification errors, and is empirically evaluated in a cybersecurity case study with real CVE/CVSS vulnerabilities, showing gains in defender utility over the classical Stackelberg approach.
NetworkDecoy
Paper2026
Material reviewed: AbstractThis paper proposes seven prompt-injection detection techniques that adapt mechanisms from disciplines outside LLM security, including forensic linguistics, materials-fatigue analysis, deception technology, bioinformatics sequence alignment, mechanism design, spectral analysis, and taint tracking. According to the authors, four of the seven techniques were implemented in the prompt-shield v0.7.3 tool, including honeypot tool definitions, and evaluated through ablations across nine benchmarks totaling approximately 10,300 samples.
ApplicationHoneypotDecoy
Paper2026
Material reviewed: AbstractThe author models honeytokens as an information design problem followed by receiver information acquisition, where an adversary can pay to fingerprint the bait. The analysis examines how installed trap prevalence, fingerprinting costs, and adjustment costs affect bait calibration and trap activation.
HoneytokenDecoy
Paper2026
Material reviewed: AbstractThis work studies credential exfiltration by LLM agents via indirect prompt injection, proposing three complementary defenses according to the authors: activation probes for pre-output detection, honeytokens calibrated via split conformal prediction, and a cumulative leakage budget tracked across multi-turn conversations. The authors report preliminary results from controlled experiments on open-weight models and a small in-house multi-turn synthetic suite.
ApplicationIdentityHoneytoken
Paper2026
Material reviewed: AbstractAccording to the authors, Chameleon is an adaptive honeypot architecture combining a BiLSTM classifier, a locally deployed language model, and two metaheuristic engines (TC-PSO and S-RRT) to dynamically adjust connection-holding delays and deception schemas based on detected threat levels. The authors report performance comparisons against standard algorithms and note reduced operating costs compared to commercial alternatives.
NetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractPresents the design, implementation, and evaluation of a honeypot monitoring system deployed on AWS that emulates SSH, HTTP, and HTTPS services on EC2 instances within an isolated virtual private cloud. The system aims to attract, record, and analyze malicious interactions, using a Python/Flask backend and a React/D3.js dashboard for attack visualization.
CloudNetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThe paper describes the design of a honeypot framework deployed in a cloud environment to support threat detection and incident response. According to the authors, it integrates Microsoft Azure services to monitor and analyze malicious behavior, using telemetry, threat intelligence and automated workflows.
CloudHoneypot
Paper2026
Material reviewed: AbstractThe paper introduces Co-ADAM, a defense framework that formalizes cyber deception in the Industrial Internet of Things (IIoT) as a constrained Markov decision process with an embedded signaling game, aiming to jointly model the deception investment level and a co-evolutionary adversary that accumulates skepticism. The authors describe training a deep Q-network (DQN) defender against an adaptive attacker pool with budget constraints and skepticism dynamics embedded in the environment, and report evaluation on several IIoT datasets and a physical testbed.
IoTOT/ICSHoneypotDecoy