Paper2021
Material reviewed: AbstractAccording to the authors, this paper proposes an approach to generate realistic user activity on IT systems, combining deterministic and deep learning-based methods through an external agent instrumented on each machine. The aim is to improve the credibility of attacker analysis platforms, such as honeynets, and facilitate the creation of coherent scenarios.
NetworkEndpointHoneypotAdversary engagement
Paper2021
Material reviewed: AbstractThe paper proposes an intelligent defense method for mobile-terminal unknown threats based on honeypot technology, as deposited by the authors. The approach aims to induce intruders to attack the honeypot terminal in order to delay attacks on the real target and to monitor, collect and analyze attack behavior.
IoTEndpointHoneypot
Paper2021
Material reviewed: AbstractThe authors propose RRPOT, a honeypot system that combines a native honeypot with a virtual machine record and replay (RnR) framework, aiming to postpone time-consuming analysis to the replay stage and thereby enable fine-grained analysis. The system employs on-demand record and on-demand replay mechanisms to reduce performance and storage costs and to improve replay efficiency, as described in the deposited abstract.
Honeypot
Paper2021
Material reviewed: AbstractThis paper studies the DNS amplification attack ecosystem through a passive detection methodology at Internet exchange points (IXPs), combined with other measurement sources. According to the authors, IXPs and honeypots observe largely disjoint sets of attacks, and the study examines the effectiveness of observed attacks and the behavior of a dominant attacking entity.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe study, attributed to the authors, examines Cowrie Honeypot logs to inform the improvement of Snort rule signatures against brute force attacks. Snort acts as an intrusion prevention system and Cowrie as a tool to investigate anomalous behavior during such attacks; the authors report packet-matching processing times in microseconds for Hydra, Medusa and Ncrack attacks.
NetworkHoneypot
Paper2021
Material reviewed: Full textHistorical review of honeypots, honeytokens and moving target defense from the late 1980s through 2021.
NetworkEndpointHoneypotHoneytoken
Paper2021
Material reviewed: AbstractThe authors describe using honeynet data and time series to predict SSH attacks, covering overall activity and attacks from specific geographical regions. They apply ARIMA, SARIMA, GARCH and Bootstrapping with real-world data, presenting the viability, precision and usefulness of each approach across areas of IT security.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe authors present a multi-phased IoT honeypot ecosystem that gradually increases interaction sophistication with adversaries, including a low-interaction camera honeypot. According to the abstract, they applied data analytics to cluster observed attack activity over three years to identify attacker goals and patterns.
IoTHoneypot
Paper2020
Material reviewed: AbstractThe paper describes a computational intelligence enabled honeypot intended to discover and predict attempted fingerprinting attacks while it interacts with attackers. According to the authors, the system uses principal components analysis and a fuzzy inference system, and it was tested against five fingerprinting tools: Nmap, Xprobe2, NetScanTools Pro, SinFP3 and Nessus.
NetworkHoneypot
Paper2020
Material reviewed: AbstractThis paper describes the authors' initial efforts to build a honeypot ecosystem to gather and analyze real-world attack data against IoT devices. According to the abstract, they develop a multiphased approach that gradually increases the sophistication of low-interaction honeypots, deployed both on-premise and in the cloud, including a specific honeypot for IoT cameras called Honeycamera. The authors report observing attackers explicitly targeting IoT devices, with some activities appearing to involve direct human interaction.
IoTHoneypot
Paper2020
Material reviewed: AbstractThe authors extend the signaling game model into a two-way signaling game that represents the confrontation between defender and attacker, formally define the model, and propose an algorithm for identifying the refined Bayesian equilibrium. Based on calculated benefits, they analyze strategy choice and conduct a simulation to evaluate the model, with the aim of examining the use of deception-based defenses such as honeypots to improve IoT network security.
IoTHoneypot
Paper2020
Material reviewed: AbstractAccording to the authors, this paper presents an attack that partially breaks a defense that injects 'honeypots' into neural networks to detect adversarial attacks. They report reducing the detection true positive rate to 0% and detection AUC to 0.02 while maintaining original distortion bounds, and note that the original defense authors later amended it to mitigate the attack.
ApplicationHoneypotAdversary engagement
Paper2020
Material reviewed: AbstractThis paper proposes a framework for preventing ransomware attacks by combining blockchain, honeypot techniques, and cloud and edge computing. The authors state the framework is analyzed mainly on IoT devices, with potential generalization to other malware attacks.
IoTCloudHoneypot
Paper2020
Material reviewed: AbstractThe paper describes how configuration shortcomings and limited security awareness expose connected hosts, and presents an introduction to honeypot systems and machine learning. Drawing on these technologies, the authors design a smart agent aimed at cyber-attack prevention and prediction.
NetworkHoneypot
Paper2020
Material reviewed: AbstractAccording to the abstract, the authors propose DARCY, a defense framework adapting the honeypot concept from cybersecurity to detect Universal Trigger textual adversarial attacks. DARCY injects multiple trapdoors into a neural network model to bait and detect such attacks, reporting high detection rates in experiments across four public datasets.
ApplicationHoneypotDecoy
Paper2020
Material reviewed: AbstractThis paper, according to its authors, presents an adaptive agent that uses active deception to recognize a cyber attacker's intent, modeling the problem as a two-agent sequential decision process via factored I-POMDPs. The authors describe using honeypots and decoys across multiple attack phases to refine predictions about attacker behavior, rather than merely delaying or confusing attackers.
NetworkEndpointHoneypotDecoy
Paper2020
Material reviewed: AbstractThe work reports an analysis and simulation of network security for an Ubuntu server in which the authors combine port knocking with a honeypot, IPtables, and ICMP. The stated purpose is to filter and refuse packets on exposed ports, require a secret knock sequence to reach services, and divert access attempts to decoy ports in order to observe actions directed at the server.
NetworkHoneypot
Paper2020
Material reviewed: Public pageThe paper describes using K-Means to group attacks from honeypot logs collected in real time through MHN and identify attacker IP addresses. It aims to support administrators in analyzing network attacks.
NetworkHoneypot
Paper2020
Material reviewed: AbstractThe paper proposes an anti-reconnaissance model for host fingerprints based on virtual nodes. The model constructs periodically reconfigurable virtual nodes to dynamically camouflage host fingerprint information and redirects attack traffic targeting virtual nodes to honeypots; the authors also introduce probabilistic models to examine how parameters such as the number of probes or honeypot mapping rules affect attack success probability, and they describe a prototype using SDN and DPDK intended to verify the model against reconnaissance.
NetworkHoneypotDecoy
Paper2020
Material reviewed: AbstractThe article offers an approach to building a cognizant honeypot for detecting active fingerprinting attacks through the use of the established dynamic fuzzy rule interpolation (D-FRI) technique, relying on a sparse rule base while remaining capable of detecting such attacks when no matching rules are found. The system learns from current network conditions and provides a dynamic rule base intended to facilitate more accurate and efficient detection, as described by the authors.
NetworkHoneypot
Paper2020
Material reviewed: AbstractThe authors present a long-term investigation of attacks targeting MikroTik routers, using a highly interactive honeypot deployed across six countries. According to the abstract, they collected over 44 million packets over 120 days, classifying traffic by known CVEs to identify activities such as cryptocurrency mining, DNS server redirection, and eavesdropping tunnels.
NetworkIoTHoneypot
Paper2020
Material reviewed: AbstractThe paper describes deploying a Security Information Event Management (SIEM) system and a honeypot at a government higher education agency referred to as XYZ, aiming to detect incoming threat alerts and block suspicious access, while the honeypot is intended to deceive attackers into a fake system and learn their tactics. The authors report that testing this implementation allowed real-time monitoring of information- and data-related threats, and helped deter and deflect cyber-attacks to protect information security.
NetworkHoneypot
Paper2020
Material reviewed: AbstractThe work proposes a three-stage methodology for deploying honeypots in wireless sensor networks, aimed at detecting malicious activity and isolating malicious nodes. According to the abstract, the stages are node verification, self-healing and error correction, with the system relying on a server, a real database and honeypot-based data to monitor network traffic.
NetworkHoneypot
Paper2020
Material reviewed: Public pageThe article analyzes data captured by a honeypot to describe how cryptomining campaigns infect a host and seek new vulnerable targets. It includes an analysis of victim IP addresses.
CloudHoneypot