Paper2020
Material reviewed: AbstractThe paper reviews the use of deception technology, specifically honeypot systems, to address threats against IoT devices. The authors compare the most popular existing honeypot systems, identify their strengths and weaknesses, and attempt to adapt them to operate at the level of Internet of things devices.
IoTHoneypotDecoy
Paper2020
Material reviewed: AbstractThe paper addresses detection and mitigation of DDoS attacks, specifically ICMP Flood, in Software Defined Networks (SDN), where controller centralization creates a vulnerability. The authors propose integrating the Modern Honey Network (MHN) into SDN and using a reactive application outside the controller based on entropy, computed from source IP, destination IP and protocol, to identify anomalous traffic.
NetworkHoneypot
Paper2020
Material reviewed: AbstractThis paper addresses the synthesis of active deception strategies in networks using two-player games with asymmetric information and temporal logic objectives, incorporating decoy systems and high-fidelity honeypots. The authors use a level-2 hypergame framework to model the attacker's incomplete perception and assess whether the defender can guarantee security properties.
NetworkDecoyHoneypot
Paper2020
Material reviewed: AbstractThe study simulates a network defense combining IPS Snort, which examines packets and blocks access identified as attacks, with Honeypot Artillery, which detects intrusion attempts through open ports and records attacker information in a database viewable through a web interface.
NetworkHoneypot
Paper2020
Material reviewed: Publisher metadataBibliographic record on software diversity for deception. The abstract and findings still require review.
NetworkMoving target defense
Paper2020
Material reviewed: Publisher metadataDOI-identified publication on honeytoken fingerprinting methods; text analysis is pending.
IdentityHoneytoken
Paper2019
Material reviewed: AbstractThe authors abstract the cyber deception task using a modified version of Battleship, played either face-to-face or with a divider, in order to study deception from the human point of view of attacker and defender. According to the deposited abstract, deception was higher in the divider condition and patterns such as blatant lies, diversion, and honeypots were observed, along with behavioral cues including variations in tone of voice, less eye contact, and lower response time.
Paper2019
Material reviewed: AbstractAccording to the authors, this work proposes AnonTokens, an approach applying the honeytoken concept to the data privacy domain to trace re-identification attacks. High re-identification-risk decoy records are inserted into anonymized datasets to detect malicious users. The authors evaluate their approach using large-scale population datasets.
ApplicationHoneytokenDecoy
Paper2019
Material reviewed: AbstractThe article discusses how cyber deception can change an attacker's perception of the network environment and lead attackers to false beliefs about which systems contain critical information. The authors introduce game theory models and discuss techniques combining artificial intelligence algorithms with those models to estimate hidden states of the attacker using feedback through payoffs, in order to learn how best to defend the system using cyber deception.
NetworkDecoyAdversary engagement
Paper2019
Material reviewed: AbstractAccording to the authors, this work proposes a framework for modeling attacker behavior to better predict future actions using a novel semi-supervised algorithm called Fusion Hidden Markov Model (FHMM). Experiments were conducted on real attack data captured from a Cowrie honeypot system, comparing FHMM's performance against Markov Chains, traditional HMMs, and deep recurrent neural network architectures.
NetworkHoneypot
Paper2019
Material reviewed: AbstractThe authors propose an automatic identification model based on a random forest algorithm with three feature groups—application-layer, network-layer, and other system-layer features—to remotely check whether a server runs a honeypot service. The experiment datasets were collected from public known platforms, and the authors report that the model achieved an AUC value of 0.93.
NetworkApplicationHoneypot
Paper2019
Material reviewed: AbstractThe authors analyze how country attributes—such as population size, access to information and communication technologies, and ICT use—influence the number of secure shell attacks seen by their honeynet, using four statistical models built from three data sources and methods including partial least-squares path modelling and clustering of countries by similarity.
NetworkHoneypot
Paper2019
Material reviewed: AbstractAccording to the abstract, this work develops inference techniques to detect organic click fraud in advertising networks. The authors note that malware detection systems, including honeypots, fail to stop click fraud apps, and propose two defenses: a mimicry defence based on detecting click reuse patterns, and a bait-click defence that injects decoy clicks to trigger fraudulent app behavior.
NetworkApplicationHoneypotDecoy
Paper2019
Material reviewed: Publisher metadataBibliographic record on cyber deception games. The abstract and findings still require review.
NetworkAdversary engagement
Paper2019
Material reviewed: Publisher metadataBibliographic record on game theory applied to deception. The abstract and findings still require review.
NetworkAdversary engagement
Paper2019
Material reviewed: AbstractThe authors present an overview of cyber deception games across three environments, extending baseline signaling game models to include evidence via side-channel knowledge acquisition. They analyze deception in binary and continuous information spaces and explore a multi-stage incomplete-information Bayesian game model for defensive deception against advanced persistent threats, using perfect Bayesian Nash equilibrium as the solution concept.
NetworkAdversary engagementDecoy
Paper2019
Material reviewed: AbstractAndrew Bushby's article describes the use of deception technology as a mechanism for active, post-breach defence aimed at luring, detecting and defending against malware and intruders moving laterally within the network. It notes that such approaches come with misconceptions and argues that defences need to move beyond detecting bad activity within an ocean of good activity.
NetworkDecoyAdversary engagement
Paper2019
Material reviewed: AbstractThe authors propose ICSTrace, a model for tracing malicious IP addresses attacking industrial control systems without deploying new network services. The model extracts function codes and parameters from attack data according to the industrial control protocol format, transforms them into vectors using a short sequence probability method, and applies a clustering algorithm (Partial Seeded K-Means) to associate attacks with an organization. According to the authors, ICSTrace was evaluated using attack data captured by large-scale deployed honeypots for industrial control systems.
OT/ICSHoneypot
Paper2019
Material reviewed: Public pageThe paper describes a low-interaction Python honeypot that presents a fake SSH service to observe attacker behavior and authentication attempts while hiding the real SSH service.
NetworkHoneypot
Paper2019
Material reviewed: AbstractAccording to the authors, this paper presents a user study with 40 participants evaluating HoneyBot, a hybrid-interaction honeypot designed for networked robotic systems that simulates unsafe actions while performing safe physical ones. The authors report that participants could not distinguish simulated sensor values from real ones.
IoTOT/ICSHoneypotDecoy
Paper2019
Material reviewed: AbstractThe authors propose using a Cron job with a Perl script to periodically parse collected data into a database, aiming to reduce the size of logs generated by a honeypot under heavy traffic such as DDoS attacks. They report three DDoS attack cases to illustrate log growth.
NetworkHoneypot
Paper2019
Material reviewed: AbstractThe work addresses mapping and classifying bots that form part of IoT botnets and how they propagate across the Internet, a task the authors describe as challenging. According to the deposited abstract, Fooresec aimed to address this issue by footprinting, reporting and remotely securing IoT devices that had previously been turned into bots, relying on honeypots able to 'sense' the Internet in order to map and classify IoT bots according to their behaviours.
IoTHoneypot
Paper2019
Material reviewed: AbstractAccording to the authors, this paper proposes an SDN-based in-network honeypot that reroutes traffic from suspicious nodes and intelligently spoofs it with misleading information to confuse attackers in IoT environments, without requiring dedicated hardware. The authors state preliminary evaluations show little impact on network performance.
IoTNetworkHoneypotDecoy
Paper2019
Material reviewed: AbstractThe authors present experimental tests of common attacks on wired IPv6 networks and describe the design and implementation of a Honeynet with different operating systems. They use tools such as 6Guard, Snort and Wireshark to attract, detect and analyze attacker behavior.
NetworkHoneypotDecoy