Paper2021
Material reviewed: AbstractThe work describes the design of a honeypot-based intrusion detection system (IDS) for the computer network of Universitas Bhayangkara Jakarta Raya. According to the authors, the honeypot simulates weak points to attract malware, records attacker activity, and produces logs that can be analyzed for handling and recovery during and after an attack.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe work addresses the protection of vulnerable components in Internet-of-Things (IoT) networks through an intrusion prevention technique that combines cyberdeception (a decoy system) and moving target defense (network topology shuffling). The authors analytically evaluate effectiveness and efficiency using a graphical security model in an SDN-based IoT network, defining strategies for when and how to perform topology shuffling to pursue goals such as prolonging system lifetime, increasing attack complexity on critical nodes, or maintaining service availability.
IoTNetworkDecoyMoving target defense
Paper2021
Material reviewed: AbstractAccording to the authors, this paper proposes an approach to generate realistic user activity on IT systems, combining deterministic and deep learning-based methods through an external agent instrumented on each machine. The aim is to improve the credibility of attacker analysis platforms, such as honeynets, and facilitate the creation of coherent scenarios.
NetworkEndpointHoneypotAdversary engagement
Paper2021
Material reviewed: AbstractThis work reviews the literature on using reinforcement learning (RL) as a feedback architecture for cyber-resilient mechanisms. The authors discuss resilience against posture-related, information-related, and human-related vulnerabilities, introducing three application domains: moving target defense, defensive cyber deception, and assistive human security technologies. They also examine vulnerabilities of RL itself to attacks on rewards, state observations, and action commands.
NetworkMoving target defenseAdversary engagement
Paper2021
Material reviewed: AbstractThe paper proposes an intelligent defense method for mobile-terminal unknown threats based on honeypot technology, as deposited by the authors. The approach aims to induce intruders to attack the honeypot terminal in order to delay attacks on the real target and to monitor, collect and analyze attack behavior.
IoTEndpointHoneypot
Paper2021
Material reviewed: AbstractThe authors propose RRPOT, a honeypot system that combines a native honeypot with a virtual machine record and replay (RnR) framework, aiming to postpone time-consuming analysis to the replay stage and thereby enable fine-grained analysis. The system employs on-demand record and on-demand replay mechanisms to reduce performance and storage costs and to improve replay efficiency, as described in the deposited abstract.
Honeypot
Paper2021
Material reviewed: AbstractThis paper studies the DNS amplification attack ecosystem through a passive detection methodology at Internet exchange points (IXPs), combined with other measurement sources. According to the authors, IXPs and honeypots observe largely disjoint sets of attacks, and the study examines the effectiveness of observed attacks and the behavior of a dominant attacking entity.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe study, attributed to the authors, examines Cowrie Honeypot logs to inform the improvement of Snort rule signatures against brute force attacks. Snort acts as an intrusion prevention system and Cowrie as a tool to investigate anomalous behavior during such attacks; the authors report packet-matching processing times in microseconds for Hydra, Medusa and Ncrack attacks.
NetworkHoneypot
Paper2021
Material reviewed: Full textHistorical review of honeypots, honeytokens and moving target defense from the late 1980s through 2021.
NetworkEndpointHoneypotHoneytoken
Paper2021
Material reviewed: AbstractThis work is an initial step toward a cognitive theory of cyber deception, focusing on the cyber domain where physical cues are unavailable. The authors use an abstract cybersecurity game (Insider Attack Game) with behavioral experiments and an instance-based learning model within the ACT-R cognitive architecture to examine how human attackers make decisions under deceptive signaling and to compare outcomes with a perfectly rational adversary.
Paper2021
Material reviewed: AbstractThis work examines how decoy generation can slow the decision process of automated agents in adversary emulation scenarios. The authors show, according to their study, that the degree of inhibition greatly depends on the types of decoy objects used, pointing to the need to explicitly evaluate decoy generation and placement strategies against fast-moving automated adversaries.
NetworkDecoyAdversary engagement
Paper2021
Material reviewed: Full textBibliographic record on self-adaptive deception. The abstract and findings still require review.
NetworkDecoy
Paper2021
Material reviewed: AbstractThe authors describe using honeynet data and time series to predict SSH attacks, covering overall activity and attacks from specific geographical regions. They apply ARIMA, SARIMA, GARCH and Bootstrapping with real-world data, presenting the viability, precision and usefulness of each approach across areas of IT security.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe authors present a multi-phased IoT honeypot ecosystem that gradually increases interaction sophistication with adversaries, including a low-interaction camera honeypot. According to the abstract, they applied data analytics to cluster observed attack activity over three years to identify attacker goals and patterns.
IoTHoneypot
Paper2020
Material reviewed: AbstractThe paper describes a computational intelligence enabled honeypot intended to discover and predict attempted fingerprinting attacks while it interacts with attackers. According to the authors, the system uses principal components analysis and a fuzzy inference system, and it was tested against five fingerprinting tools: Nmap, Xprobe2, NetScanTools Pro, SinFP3 and Nessus.
NetworkHoneypot
Paper2020
Material reviewed: AbstractThe authors present a differentially private game theoretic approach to cyber deception, aiming to overcome limitations of prior approaches that assume a fixed number of systems and simplified attackers. The defender uses differential privacy mechanisms to strategically change the number of systems and obfuscate configurations, while the attacker uses Bayesian inference. According to the authors, experimental results demonstrate the effectiveness of the proposed approach.
NetworkDecoyMoving target defense
Paper2020
Material reviewed: AbstractThis paper describes the authors' initial efforts to build a honeypot ecosystem to gather and analyze real-world attack data against IoT devices. According to the abstract, they develop a multiphased approach that gradually increases the sophistication of low-interaction honeypots, deployed both on-premise and in the cloud, including a specific honeypot for IoT cameras called Honeycamera. The authors report observing attackers explicitly targeting IoT devices, with some activities appearing to involve direct human interaction.
IoTHoneypot
Paper2020
Material reviewed: AbstractThe authors extend the signaling game model into a two-way signaling game that represents the confrontation between defender and attacker, formally define the model, and propose an algorithm for identifying the refined Bayesian equilibrium. Based on calculated benefits, they analyze strategy choice and conduct a simulation to evaluate the model, with the aim of examining the use of deception-based defenses such as honeypots to improve IoT network security.
IoTHoneypot
Paper2020
Material reviewed: AbstractAccording to the authors, this paper presents an attack that partially breaks a defense that injects 'honeypots' into neural networks to detect adversarial attacks. They report reducing the detection true positive rate to 0% and detection AUC to 0.02 while maintaining original distortion bounds, and note that the original defense authors later amended it to mitigate the attack.
ApplicationHoneypotAdversary engagement
Paper2020
Material reviewed: AbstractThis paper proposes a framework for preventing ransomware attacks by combining blockchain, honeypot techniques, and cloud and edge computing. The authors state the framework is analyzed mainly on IoT devices, with potential generalization to other malware attacks.
IoTCloudHoneypot
Paper2020
Material reviewed: AbstractThe paper describes how configuration shortcomings and limited security awareness expose connected hosts, and presents an introduction to honeypot systems and machine learning. Drawing on these technologies, the authors design a smart agent aimed at cyber-attack prevention and prediction.
NetworkHoneypot
Paper2020
Material reviewed: AbstractAccording to the abstract, the authors propose DARCY, a defense framework adapting the honeypot concept from cybersecurity to detect Universal Trigger textual adversarial attacks. DARCY injects multiple trapdoors into a neural network model to bait and detect such attacks, reporting high detection rates in experiments across four public datasets.
ApplicationHoneypotDecoy
Paper2020
Material reviewed: AbstractThe authors propose a formal-methods approach to synthesize reactive defense strategies in networks equipped with decoy systems. They generalize attack graphs to incorporate defender countermeasures in an attack-defend game model, and introduce a class of hypergames to model asymmetric information created by decoys. According to the authors, this framework enables synthesis of effective defense strategies exploiting the attacker's misperception.
NetworkDecoyMoving target defense
Paper2020
Material reviewed: Publisher metadataBibliographic record on an adaptive deception framework. The abstract and findings still require review.
ApplicationDecoy