Paper2016
Material reviewed: Full textThe authors recorded 180,581 visiting IP addresses and 481,521 download attempts, manually collected 106 binaries, and described five malware families.
IoTNetworkHoneypot
Paper2016
Material reviewed: AbstractThe work proposes an ontological model for identifying the most common types of attacks from the use of honeynets, and outlines its implementation in working scenarios. Its purpose is to support decision-making about the placement of computer elements and components within an organization.
NetworkHoneypot
Paper2016
Material reviewed: AbstractAccording to the authors, this paper describes an automated algorithm designed to detect attacks before they occur and reduce false positive and negative rates, using malicious traffic data captured through a distributed honeypot network.
NetworkHoneypot
Paper2016
Material reviewed: AbstractThe paper presents an architecture that extends a previous system for tracking IPv6 addresses discarded by MT6D nodes, adding automation and database integration. According to the authors, the solution can deploy a honeypot on demand in an LXC container based on traffic patterns observed on a discarded address, and it lets an MT6D host query the solution database for activity on its relinquished addresses as a JSON object in order to adjust MT6D scheme parameters; the authors report a proof-of-concept and an analysis of feasibility and scalability.
NetworkHoneypotMoving target defense
Paper2015
Material reviewed: AbstractThis paper presents Apate, a Linux Kernel Module that logs, blocks, and manipulates system calls based on configurable conditions such as PID or UID. According to the authors, Apate serves as a building block to harden high-interaction honeypots and extend attacker interaction without introducing new vulnerabilities.
EndpointHoneypot
Paper2015
Material reviewed: AbstractThe authors propose a game-theoretic model for mechanism design in deception-based defense, applied specifically to honeypots in network defense. They analyze cheap-talk games and an extended version with evidence, where the receiver can detect deception with some probability. According to the authors, the model generalizes traditional signaling games and complete-information games, showing numerically that deception detection can eliminate pure-strategy equilibria.
NetworkHoneypotAdversary engagement
Paper2015
Material reviewed: AbstractThe authors describe honeypots as a security mechanism that attracts and diverts attackers, logs network bytes, and correlates data to locate the attack source. They present honeypot types and uses and introduce Kerberos, concluding with a look at the future.
NetworkHoneypot
Paper2015
Material reviewed: Public pageThis paper examines ethical issues in studying malicious activity in social networks using social honeypots combined with deception. Its purpose is to clarify how this area fits within human subjects research and whether researchers should seek deception-free methods.
ApplicationHoneypot
Paper2014
Material reviewed: AbstractThe study presents a comparative measurement of Facebook page promotion methods via ads and like farm services. The authors deploy honeypot pages, promote them through both methods, and analyze the demographic, temporal, and social characteristics of garnered likes. According to the authors, findings indicate differences in behavior among like farms, with some apparently bot-operated and others mimicking real users.
ApplicationHoneypot
Paper2014
Material reviewed: AbstractThis work addresses the challenge of detecting and collecting payloads of zero-day polymorphic worms in homogeneous and heterogeneous cloud computing platforms. The authors propose a high-interaction honeypot that inspects VM memory and disk images using open-source forensic tools. According to the authors, experiments show the proposed approach overcomes the identified challenges.
CloudHoneypot
Paper2014
Material reviewed: AbstractThe authors propose a collaboration between network intrusion detection systems (IDS) and honeypot technology, together with a mechanism to correct signatures based on honeypot analysis, aiming to reduce erroneous alerts and improve detection of zero-day attacks. Across fifteen evaluated attack scenarios, the authors report that this approach reduced false alerts and zero-day attacks by 85%.
NetworkHoneypot
Paper2013
Material reviewed: AbstractThe paper surveys recent research on smartphone honeypots. The authors describe challenges in setting up a smartphone honeypot, the methods used to build it, and the results and recommendations obtained.
EndpointHoneypot
Paper2013
Material reviewed: AbstractThe paper formulates an attack-defense scenario as a mathematical model in which the defender applies both proactive and reactive defense mechanisms against attackers with different attack strategies, assuming attackers have incomplete information and imperfect knowledge of the target network. The authors report that, based on their experiment results, a proactive defense strategy is suitable against aggressive attackers under "winner takes all" circumstances, while a reactive strategy works better against less aggressive attackers under "fight to win or die" circumstances.
NetworkCloudHoneypot
Paper2013
Material reviewed: AbstractAccording to the authors' abstract, this work shares experience in botnet detection by deploying Nepenthes honeypots in private and public networks. The authors describe an automated framework for malware collection using Nepenthes and analysis via anti-virus scanning, presenting experimental results of known bot detection in their network.
NetworkHoneypot
Paper2012
Material reviewed: AbstractThis work proposes the use of unsupervised neural models, based on neural projection methods, to generate an intuitive visualization of traffic captured from honeypot data rather than network statistics alone. The authors position the system as a complementary network security tool that supports security personnel in visually inspecting traffic events and in assessing Snort performance through the visualization of attack patterns.
NetworkHoneypot
Paper2012
Material reviewed: AbstractThe authors present a comparative study, based on a mobile honeypot that extracts first statistical results, to analyze to what extent malicious transport contacts depend on the type of network access, particularly whether an adversary specifically targets mobile or non-mobile devices. Their findings indicate that a few topological domains of the Internet have started to place particular focus on attacking mobile networks.
NetworkHoneypot
Paper2012
Material reviewed: AbstractAccording to the authors' abstract, this work addresses fake check-ins in location-based social networks (LBSNs). The authors propose and analyze a honeypot venue-based solution, enhanced with a challenge-response scheme, to flag users generating fake spatial information.
ApplicationHoneypot
Paper2012
Material reviewed: AbstractThe author introduces honeypots as a tool for security-related research, lists and characterizes several selected honeypot solutions, and presents results of practical experiments carried out at the University of Defence, including graphs and tables. The stated purpose is to acquaint the reader with the use of honeypots in security research.
NetworkHoneypot
Paper2010
Material reviewed: AbstractThis paper describes tools and techniques used in network forensics to capture, record and analyze network events for investigating security attacks. According to the authors, it surveys tools such as email trackers, packet sniffers and IP traceback techniques, and discusses the use of honeypots and honeynets to gather intelligence on intruders.
NetworkHoneypot
Paper2009
Material reviewed: AbstractThe authors propose a system that uses honeypots not only to detect malicious traffic but also to generate and broadcast on-the-fly anti-malware signatures for new and unknown malware in a network, mimicking the way malware itself spreads. According to the abstract, this would allow effective initial control over viruses not yet identified by established security firms.
NetworkEndpointHoneypot
Paper2009
Material reviewed: AbstractThe authors present an implementation of an intrusion detection system using advanced honeypots to distinguish legitimate client traffic from attacker traffic, aiming to reduce latency and improve security on public servers. According to the abstract, results of stress and scalability tests are reported, along with suggested potential uses for the system.
NetworkHoneypot
Paper2007
Material reviewed: AbstractAccording to the abstract, the authors present empirical analyses based on data collected from the Leurré.com honeypot platforms deployed on the Internet, along with preliminary modeling studies aimed at characterizing attack processes, in order to better understand attacker strategies and techniques.
NetworkHoneypot
Paper2007
Material reviewed: AbstractThis paper presents an experimental study and lessons learned by the authors from observing attackers logged onto a compromised machine. According to the abstract, results are based on a six-month controlled experiment with a high-interaction honeypot, correlated with findings from a worldwide distributed low-interaction honeypot system.
NetworkHoneypot
Paper2006
Material reviewed: AbstractThe author proposes an alternative approach to learning and teaching IT security called Honeynet Learning, which uses the honeynet as a tool and resource to augment both student and instructor learning. The approach incorporates discovery, feedback, and "real world" experience, and illustrates a methodology that can be applied in a typical IT security course.
NetworkHoneypot