Paper2020
Material reviewed: AbstractAccording to the authors, this study proposes a time-expanded random network to model adversarial lateral movement in enterprise networks, along with dynamic cognitive honeypots placed at idle production nodes and honey links disguised as service links. The authors describe an approach aimed at reducing long-term vulnerability through honeypot policies whose location changes randomly.
NetworkHoneypotDecoy
Paper2020
Material reviewed: AbstractThe authors address the limitations of network security based only on a firewall and IDS, noting that IDS produces many notifications for administrators and does not work well in encrypted or IPv6 environments, and propose complementing it with a Dionaea honeypot. The work is framed as an analysis and implementation of a Dionaea honeypot as a decoy system to trap attackers on the internet network of the UNIKS Faculty of Engineering laboratory.
NetworkHoneypot
Paper2020
Material reviewed: Public pageThe paper describes implementing multiple honeypots on Raspberry Pi and centralizing and visualizing their logs with the ELK Stack to support detection and analysis of network attacks.
NetworkHoneypot
Paper2020
Material reviewed: Public pageThe paper describes integrating Grafana with Modern Honey Network to visualize logs collected by its honeypots. The work aims to make recorded activity easier to read and analyze.
NetworkHoneypot
Paper2020
Material reviewed: AbstractThe authors propose a method that combines PKI secure authentication and honeypots with the aim of addressing several IoT security problems together, including detecting vulnerabilities and attacks and building attacker profiles. The work frames this in the context of resource-limited IoT devices and large-scale networks, where private-key management is difficult.
IoTHoneypot
Paper2020
Material reviewed: AbstractThe authors describe how they used experiments to evaluate a defense mechanism based on the low interaction honeypot HoneyPy against Slowloris attacks on an Apache web server. According to the deposited abstract, most packets are discarded and directed to the honeypot without the attacker's knowledge, reducing the Slowloris attacks that reach the web server.
NetworkApplicationHoneypot
Paper2020
Material reviewed: Public pageThe paper presents PANDAcap, a framework for automating full-system deterministic trace collection and preparing repeatable experiments. The authors describe its use in an SSH honeypot to study the actions of brute-force attacks.
NetworkHoneypot
Paper2020
Material reviewed: AbstractThe authors introduce a platform for the periodic automated processing of data collected by honeypots, generating statistics and graphs from a set of traffic capture files in PCAP format. The stated purpose is to reduce the delay in perceiving atypical occurrences and trend changes that manual processing and analysis of monitoring data introduces, with a modular design that allows the platform to be easily extended and adapted to produce different outputs.
NetworkHoneypot
Paper2020
Material reviewed: AbstractAccording to the authors, this paper introduces 'Primer', a tool for priming and evaluating dynamic honeypots against previously developed measures of effectiveness related to environment fingerprinting, capturing adversary data, deception, and self-monitoring. The authors state they provide quantitative calibration results as a step toward automated effectiveness testing.
NetworkHoneypotDecoy
Paper2020
Material reviewed: AbstractThe paper reviews the use of deception technology, specifically honeypot systems, to address threats against IoT devices. The authors compare the most popular existing honeypot systems, identify their strengths and weaknesses, and attempt to adapt them to operate at the level of Internet of things devices.
IoTHoneypotDecoy
Paper2020
Material reviewed: AbstractThe paper addresses detection and mitigation of DDoS attacks, specifically ICMP Flood, in Software Defined Networks (SDN), where controller centralization creates a vulnerability. The authors propose integrating the Modern Honey Network (MHN) into SDN and using a reactive application outside the controller based on entropy, computed from source IP, destination IP and protocol, to identify anomalous traffic.
NetworkHoneypot
Paper2020
Material reviewed: AbstractThis paper addresses the synthesis of active deception strategies in networks using two-player games with asymmetric information and temporal logic objectives, incorporating decoy systems and high-fidelity honeypots. The authors use a level-2 hypergame framework to model the attacker's incomplete perception and assess whether the defender can guarantee security properties.
NetworkDecoyHoneypot
Paper2020
Material reviewed: AbstractThe study simulates a network defense combining IPS Snort, which examines packets and blocks access identified as attacks, with Honeypot Artillery, which detects intrusion attempts through open ports and records attacker information in a database viewable through a web interface.
NetworkHoneypot
Paper2019
Material reviewed: AbstractAccording to the authors, this work proposes a framework for modeling attacker behavior to better predict future actions using a novel semi-supervised algorithm called Fusion Hidden Markov Model (FHMM). Experiments were conducted on real attack data captured from a Cowrie honeypot system, comparing FHMM's performance against Markov Chains, traditional HMMs, and deep recurrent neural network architectures.
NetworkHoneypot
Paper2019
Material reviewed: AbstractThe authors propose an automatic identification model based on a random forest algorithm with three feature groups—application-layer, network-layer, and other system-layer features—to remotely check whether a server runs a honeypot service. The experiment datasets were collected from public known platforms, and the authors report that the model achieved an AUC value of 0.93.
NetworkApplicationHoneypot
Paper2019
Material reviewed: AbstractThe authors analyze how country attributes—such as population size, access to information and communication technologies, and ICT use—influence the number of secure shell attacks seen by their honeynet, using four statistical models built from three data sources and methods including partial least-squares path modelling and clustering of countries by similarity.
NetworkHoneypot
Paper2019
Material reviewed: AbstractAccording to the abstract, this work develops inference techniques to detect organic click fraud in advertising networks. The authors note that malware detection systems, including honeypots, fail to stop click fraud apps, and propose two defenses: a mimicry defence based on detecting click reuse patterns, and a bait-click defence that injects decoy clicks to trigger fraudulent app behavior.
NetworkApplicationHoneypotDecoy
Paper2019
Material reviewed: AbstractThe authors propose ICSTrace, a model for tracing malicious IP addresses attacking industrial control systems without deploying new network services. The model extracts function codes and parameters from attack data according to the industrial control protocol format, transforms them into vectors using a short sequence probability method, and applies a clustering algorithm (Partial Seeded K-Means) to associate attacks with an organization. According to the authors, ICSTrace was evaluated using attack data captured by large-scale deployed honeypots for industrial control systems.
OT/ICSHoneypot
Paper2019
Material reviewed: Public pageThe paper describes a low-interaction Python honeypot that presents a fake SSH service to observe attacker behavior and authentication attempts while hiding the real SSH service.
NetworkHoneypot
Paper2019
Material reviewed: AbstractAccording to the authors, this paper presents a user study with 40 participants evaluating HoneyBot, a hybrid-interaction honeypot designed for networked robotic systems that simulates unsafe actions while performing safe physical ones. The authors report that participants could not distinguish simulated sensor values from real ones.
IoTOT/ICSHoneypotDecoy
Paper2019
Material reviewed: AbstractThe authors propose using a Cron job with a Perl script to periodically parse collected data into a database, aiming to reduce the size of logs generated by a honeypot under heavy traffic such as DDoS attacks. They report three DDoS attack cases to illustrate log growth.
NetworkHoneypot
Paper2019
Material reviewed: AbstractThe work addresses mapping and classifying bots that form part of IoT botnets and how they propagate across the Internet, a task the authors describe as challenging. According to the deposited abstract, Fooresec aimed to address this issue by footprinting, reporting and remotely securing IoT devices that had previously been turned into bots, relying on honeypots able to 'sense' the Internet in order to map and classify IoT bots according to their behaviours.
IoTHoneypot
Paper2019
Material reviewed: AbstractAccording to the authors, this paper proposes an SDN-based in-network honeypot that reroutes traffic from suspicious nodes and intelligently spoofs it with misleading information to confuse attackers in IoT environments, without requiring dedicated hardware. The authors state preliminary evaluations show little impact on network performance.
IoTNetworkHoneypotDecoy
Paper2019
Material reviewed: AbstractThe authors present experimental tests of common attacks on wired IPv6 networks and describe the design and implementation of a Honeynet with different operating systems. They use tools such as 6Guard, Snort and Wireshark to attract, detect and analyze attacker behavior.
NetworkHoneypotDecoy