Paper2022
Material reviewed: AbstractThis paper reviews existing tools for monitoring P2P botnets, categorizing mechanisms as active (crawlers) and passive (sensors and honeypots). According to the authors, the purpose is to study ways to monitor a botnet and how these monitoring mechanisms work, presenting prior work on each approach.
NetworkHoneypot
Paper2022
Material reviewed: AbstractReview article that provides an overview of cyber security and discusses machine learning, cyber threats and honeypot system-based techniques for intrusion detection and the study of network attacks. The authors describe honeypots as conceptual traps intended to block unauthorised access and to give analysts insights into the origins and behaviours of such attacks.
NetworkHoneypot
Paper2022
Material reviewed: AbstractThe work proposes integrating a honeypot sensor with a software-defined network (SDN) and classifying distributed denial-of-service attacks via semi-supervised learning, combining a pseudo-labelling model based on a support vector machine with subsequent classification using Adaptive Boosting. The evaluation reported by the authors uses monitoring data from the Suricata sensor and examines accuracy, precision, recall, CPU usage, and flow-rule mitigation times.
NetworkHoneypot
Paper2022
Material reviewed: AbstractThe authors describe a Spark-based honeypot system designed, implemented, and tested on a campus network over several days, intended to draw intruders toward a resource that simulates a fully resourced computer or vault. The study presents a performance analysis of that deployment based on parameters defined by the authors.
NetworkHoneypot
Paper2022
Material reviewed: AbstractThe authors summarize and analyze the methods, tactics, and tools adversaries use to conduct reconnaissance activities throughout the attack process, discussing what types of information they seek and how and when they can obtain it. They provide a taxonomy of adversarial reconnaissance techniques categorized by source, as third-party and human- and system-based information gathering, aiming to help understand and model this aspect of cyber attacks and offer insights for improving defensive strategies such as cyber deception.
NetworkDecoy
Paper2022
Material reviewed: AbstractThis paper studies the joint deployment of moving target defense (MTD) and deception against multi-stage cyberattacks. The authors propose a two-step optimization approach to allocate intrusion detectors (observable by the attacker) and stealthy sensors (unobservable), aiming to optimize attack detection rate. They illustrate the method's effectiveness through a cyber defense example.
NetworkDecoyMoving target defense
Paper2022
Material reviewed: AbstractThe authors describe a TaintDroid-based honeypot monitoring system for embedded devices, in which TaintDroid marks attackers who break into the honeypot and their behavior is then monitored and recorded. The work also reports a feasibility test of the system built by the authors.
IoTEndpointHoneypot
Paper2022
Material reviewed: AbstractThe paper describes setting up a honeypot on a cloud service and analyzing the activity it captures. It then applies machine learning algorithms to predict the type of threat detected in the honeypots.
CloudHoneypot
Paper2022
Material reviewed: Public pageThe paper proposes an intrusion detection framework combining CAPTCHA, honeypots and supervised learning. Honeypots would be integrated into a website to lure malicious software, and the diagram sketches realistic decoy pages and decoy fields.
ApplicationNetworkHoneypotDecoy
Paper2022
Material reviewed: AbstractThis paper introduces TSM (Topic Semantic Matching), a metric based on topic modelling and semantic matching in embedding spaces to measure the enticement of honeyfiles relative to local content. According to the authors, it is the first measure using NLP techniques to quantify this enticement robustly against paraphrasing, supported by a honeyfile corpus built with various NLP methods.
EndpointHoneypotDecoy
Paper2022
Material reviewed: AbstractThis work models attacker-defender engagements as Markov Games to understand human adversarial behaviors and optimize defensive strategy. The authors validate their approach using a Capture-The-Flag (CTF) setup and user studies across varying skill levels. According to the authors, application-level deceptions are an optimal mitigation strategy against targeted attacks, outperforming classic defensive maneuvers, and they present an analysis of attacker behavior when trapped in an embedded honeypot environment.
ApplicationHoneypotAdversary engagement
Paper2021
Material reviewed: AbstractThe authors propose a multiphase dynamic deployment mechanism for virtualized honeypots (MD2VH) based on intelligent attack path prediction, modeling attack and defense characteristics with a Bayesian state attack graph and a multiphase deployment optimization model based on an extended Markov decision process, and generating deployment strategies by combining online and offline reinforcement learning. They implement a prototype system on software-defined networking and virtualization containers and report experiments on capture rate under simple and complex topologies.
NetworkHoneypotMoving target defense
Paper2021
Material reviewed: AbstractThe authors present a low-cost honeypot capable of blocking commands or replying with insults to attackers, modeling the attacker-defender interaction as a Bayesian two-player game. According to the abstract, three honeypot instances were deployed and over 200 sessions were captured for a qualitative analysis of post-exploitation behavior.
NetworkHoneypotAdversary engagement
Paper2021
Material reviewed: AbstractThis paper presents, according to its authors, a machine learning-based method for dynamic configuration, deployment and maintenance of honeypots in networks. The approach identifies and clusters machines and devices to intelligently deploy honeypots, reducing the need for manual configuration.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe authors propose a low-interaction, adaptive and dynamic web application honeypot that imitates vulnerabilities through HTTP events, using the SNARE and TANNER tools to generate the attack surface and analyze/classify incoming requests, as described in the abstract.
ApplicationHoneypot
Paper2021
Material reviewed: AbstractThe authors propose a defensive deception framework for the container-based cloud, aiming to reveal stealthy attackers by presenting intentionally falsified information. The approach formalizes a System Risk Graph (SRG) as an updatable adversarial model, trains a deep reinforcement learning (DRL) model over the SRG so the agent produces decoy placement and deceptive routing strategies, and defines a coefficient of deception to evaluate the placement strategy.
CloudDecoyAdversary engagement
Paper2021
Material reviewed: Full textTwo-factor authentication mechanism combining decoy codes with Google Authenticator.
IdentityHoneytoken
Paper2021
Material reviewed: Full textVision paper on automated generation of realistic deception artifacts with machine learning.
NetworkIdentityDecoy
Paper2021
Material reviewed: AbstractAccording to the authors, this work studies two-sided deception in cybersecurity by manipulating the observable configuration of both honeypots and real machines. Using an experiment with a 40-machine network (20 honeypots) and an experimental testbed, the authors compare three feature-concealment conditions against human attackers.
NetworkHoneypotDecoy
Paper2021
Material reviewed: Public pageThe linked preprint abstract describes DARLH, a honeypot system that uses deep reinforcement learning-based and deep recurrent neural network-based IDS agents to detect internal and external runtime DoS attacks. Its purpose is to provide dynamic intrusion detection and event validation for monitoring DoS attacks in the honeypot environment.
NetworkHoneypotDecoy
Paper2021
Material reviewed: Full textBibliographic record on design thinking for cyber deception. The abstract and findings still require review.
NetworkDecoy
Paper2021
Material reviewed: AbstractThe paper describes the use of honeypot agents that generate Route Request (RREQ) packets to attract and entrap black hole attackers in mobile ad hoc networks (MANETs), together with a deep learning technique based on Long-Short Term Memory (LSTM). The authors evaluate the proposed scheme, named HPAS-LSTM, through ns-2 simulations and compare its results with other black hole detection methods in terms of throughput, packet loss rate, packet delivery ratio and total network delay.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe work addresses the selection and classification of honeypots (virtual decoys, online traps) by their effectiveness, using characteristics such as installation and configuration, usage and support, data collection, logging level, simulation level and interaction level. The authors describe a method that forms a set of honeypots, subsets of characteristics and identifier values of linguistic estimates, base and derived frequency matrices, and fuzzy terms and reference fuzzy numbers with their visualization, in order to construct linguistic standards for multi-criteria assessment.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe authors propose OFULinMat, an episodic learning algorithm for repeated zero-sum games with unknown, time-varying payoff matrices, leveraging an ensemble of game models as prior information. The algorithm achieves a sublinear bound on saddle-point regret. As a case study, they use a dynamic honeypot allocation game to illustrate and corroborate their theoretical results.
NetworkHoneypot