Paper2020
Material reviewed: AbstractThis paper, according to its authors, presents an adaptive agent that uses active deception to recognize a cyber attacker's intent, modeling the problem as a two-agent sequential decision process via factored I-POMDPs. The authors describe using honeypots and decoys across multiple attack phases to refine predictions about attacker behavior, rather than merely delaying or confusing attackers.
NetworkEndpointHoneypotDecoy
Paper2020
Material reviewed: Full textBibliographic record on adaptive signaling for cyber defense. The abstract and findings still require review.
NetworkDecoy
Paper2020
Material reviewed: AbstractThe study presents an exploratory experiment with 30 human participants acting as attackers to test a masking strategy (compared with a random masking strategy) aimed at reducing attackers' utility during network reconnaissance. The authors observed that attackers appeared more successful in launching attacks in the optimal condition, that the attackers' total score did not differ between masking strategies, and a generalized tendency to act according to certainty bias or risk aversion.
NetworkDecoy
Paper2020
Material reviewed: AbstractThe work reports an analysis and simulation of network security for an Ubuntu server in which the authors combine port knocking with a honeypot, IPtables, and ICMP. The stated purpose is to filter and refuse packets on exposed ports, require a secret knock sequence to reach services, and divert access attempts to decoy ports in order to observe actions directed at the server.
NetworkHoneypot
Paper2020
Material reviewed: Public pageThe paper describes using K-Means to group attacks from honeypot logs collected in real time through MHN and identify attacker IP addresses. It aims to support administrators in analyzing network attacks.
NetworkHoneypot
Paper2020
Material reviewed: AbstractThe paper proposes an anti-reconnaissance model for host fingerprints based on virtual nodes. The model constructs periodically reconfigurable virtual nodes to dynamically camouflage host fingerprint information and redirects attack traffic targeting virtual nodes to honeypots; the authors also introduce probabilistic models to examine how parameters such as the number of probes or honeypot mapping rules affect attack success probability, and they describe a prototype using SDN and DPDK intended to verify the model against reconnaissance.
NetworkHoneypotDecoy
Paper2020
Material reviewed: AbstractThe article offers an approach to building a cognizant honeypot for detecting active fingerprinting attacks through the use of the established dynamic fuzzy rule interpolation (D-FRI) technique, relying on a sparse rule base while remaining capable of detecting such attacks when no matching rules are found. The system learns from current network conditions and provides a dynamic rule base intended to facilitate more accurate and efficient detection, as described by the authors.
NetworkHoneypot
Paper2020
Material reviewed: AbstractThe authors present a long-term investigation of attacks targeting MikroTik routers, using a highly interactive honeypot deployed across six countries. According to the abstract, they collected over 44 million packets over 120 days, classifying traffic by known CVEs to identify activities such as cryptocurrency mining, DNS server redirection, and eavesdropping tunnels.
NetworkIoTHoneypot
Paper2020
Material reviewed: AbstractIsrael Barak's article concerns attacks on critical infrastructure — energy, water supply, transport, election systems, government and health — and argues that operators should aim to minimise mean time to response when attacks occur and gain more visibility into their systems, particularly between the IT and OT environments. The author further argues that security needs to be an intrinsic element in all OT systems, right from the initial design.
OT/ICSNetwork
Paper2020
Material reviewed: Full textCritical readingSurvey of defensive deception models and techniques in networks, hosts and cryptographic mechanisms.
NetworkEndpointDecoy
Paper2020
Material reviewed: AbstractThe paper describes deploying a Security Information Event Management (SIEM) system and a honeypot at a government higher education agency referred to as XYZ, aiming to detect incoming threat alerts and block suspicious access, while the honeypot is intended to deceive attackers into a fake system and learn their tactics. The authors report that testing this implementation allowed real-time monitoring of information- and data-related threats, and helped deter and deflect cyber-attacks to protect information security.
NetworkHoneypot
Paper2020
Material reviewed: AbstractThe work proposes a three-stage methodology for deploying honeypots in wireless sensor networks, aimed at detecting malicious activity and isolating malicious nodes. According to the abstract, the stages are node verification, self-healing and error correction, with the system relying on a server, a real database and honeypot-based data to monitor network traffic.
NetworkHoneypot
Paper2020
Material reviewed: Public pageThe article analyzes data captured by a honeypot to describe how cryptomining campaigns infect a host and seek new vulnerable targets. It includes an analysis of victim IP addresses.
CloudHoneypot
Paper2020
Material reviewed: AbstractAccording to the authors, this study proposes a time-expanded random network to model adversarial lateral movement in enterprise networks, along with dynamic cognitive honeypots placed at idle production nodes and honey links disguised as service links. The authors describe an approach aimed at reducing long-term vulnerability through honeypot policies whose location changes randomly.
NetworkHoneypotDecoy
Paper2020
Material reviewed: Publisher metadataBibliographic record on personalized web-application deception. The abstract and findings still require review.
ApplicationDecoy
Paper2020
Material reviewed: AbstractThe authors address the limitations of network security based only on a firewall and IDS, noting that IDS produces many notifications for administrators and does not work well in encrypted or IPv6 environments, and propose complementing it with a Dionaea honeypot. The work is framed as an analysis and implementation of a Dionaea honeypot as a decoy system to trap attackers on the internet network of the UNIKS Faculty of Engineering laboratory.
NetworkHoneypot
Paper2020
Material reviewed: Public pageThe paper describes implementing multiple honeypots on Raspberry Pi and centralizing and visualizing their logs with the ELK Stack to support detection and analysis of network attacks.
NetworkHoneypot
Paper2020
Material reviewed: Public pageThe paper describes integrating Grafana with Modern Honey Network to visualize logs collected by its honeypots. The work aims to make recorded activity easier to read and analyze.
NetworkHoneypot
Paper2020
Material reviewed: AbstractThe authors propose a method that combines PKI secure authentication and honeypots with the aim of addressing several IoT security problems together, including detecting vulnerabilities and attacks and building attacker profiles. The work frames this in the context of resource-limited IoT devices and large-scale networks, where private-key management is difficult.
IoTHoneypot
Paper2020
Material reviewed: AbstractThe authors describe how they used experiments to evaluate a defense mechanism based on the low interaction honeypot HoneyPy against Slowloris attacks on an Apache web server. According to the deposited abstract, most packets are discarded and directed to the honeypot without the attacker's knowledge, reducing the Slowloris attacks that reach the web server.
NetworkApplicationHoneypot
Paper2020
Material reviewed: Public pageThe paper presents PANDAcap, a framework for automating full-system deterministic trace collection and preparing repeatable experiments. The authors describe its use in an SSH honeypot to study the actions of brute-force attacks.
NetworkHoneypot
Paper2020
Material reviewed: AbstractThe authors introduce a platform for the periodic automated processing of data collected by honeypots, generating statistics and graphs from a set of traffic capture files in PCAP format. The stated purpose is to reduce the delay in perceiving atypical occurrences and trend changes that manual processing and analysis of monitoring data introduces, with a modular design that allows the platform to be easily extended and adapted to produce different outputs.
NetworkHoneypot
Paper2020
Material reviewed: AbstractAccording to the authors, this paper introduces 'Primer', a tool for priming and evaluating dynamic honeypots against previously developed measures of effectiveness related to environment fingerprinting, capturing adversary data, deception, and self-monitoring. The authors state they provide quantitative calibration results as a step toward automated effectiveness testing.
NetworkHoneypotDecoy
Paper2020
Material reviewed: AbstractThe authors propose an integrated defense technique combining cyberdeception via decoy systems with moving target defense through network topology shuffling, applied to SDN-based IoT networks. According to the abstract, they develop and compare several strategies for deciding when and how to reshuffle network topology in the presence of decoys, analytically evaluating effectiveness through a graphical security model. The authors report that their approach prolongs system lifetime, increases attack complexity, and maintains service availability compared to a network without the technique.
IoTNetworkMoving target defenseDecoy