Paper2019
Material reviewed: AbstractAccording to the authors, this chapter presents three proactive defense schemes against advanced attackers: defensive deception for detection and counter-deception, feedback-driven Moving Target Defense (MTD), and adaptive honeypot engagement. The authors propose strategic learning schemes tailored to different levels of information uncertainty for these strategies.
NetworkHoneypotMoving target defense
Paper2019
Material reviewed: AbstractAccording to the abstract, the authors conducted the first systematic study of an attack stealing cryptocurrencies via unprotected JSON-RPC endpoints in Ethereum nodes. They designed and deployed a honeypot to capture real-world attacks over six months, collecting millions of requests and analyzing attacker behavior and profits.
NetworkApplicationHoneypot
Paper2019
Material reviewed: AbstractThe work examines n-session recording attack resilient unaided authentication services (n-SRRUASs) and notes that they cope poorly with server-side issues within their authentication procedure. The authors propose generic principles for incorporating honeywords (fake passwords) into n-SRRUASs and, with the help of an existing n-SRRUAS, show the idea is implementable in practice to fill that gap.
IdentityHoneytoken
Paper2019
Material reviewed: AbstractThe authors present a data analysis of records from a geographically distributed honeypot server network deployed in Samara, Rostov-on-Don, Crimea and the USA, with methods for processing statistics discussed in detail for secure remote access SSH. Lists of attacking addresses are highlighted and their geographical affiliation determined, and request intensity to each of the 10 installed services is then calculated using rank distributions.
NetworkHoneypot
Paper2018
Material reviewed: AbstractThe authors propose a high-interaction, self-acting spontaneous honeypot (SAS HP) whose behavior can dynamically change after learning from an attacker, and present its architecture for deployment in cloud environments to analyze attack patterns and secure cloud systems. They also describe how instances of the honeypot could be made available as a service to customers and how it could be deployed within the cloud, with the stated aim of developing a working prototype.
CloudHoneypot
Paper2018
Material reviewed: Publisher metadataBibliographic record on cyber deception overview and challenges. The abstract and findings still require review.
NetworkDecoy
Paper2018
Material reviewed: AbstractThis work proposes applying a cyber deception strategy in wireless local area networks, using decoys that are honeypots, to detect and characterize malicious activity such as the evil twin access point. The authors further describe how the same approach can be used to gather attacker activity information and to detect SSL stripping and DNS spoofing attacks.
NetworkHoneypotDecoy
Paper2018
Material reviewed: AbstractThe authors use game theory, including static Bayesian games, signaling games, and multi-stage models, to model defender-attacker interactions in cybersecurity under uncertainty and asymmetric information. Per the abstract, the study examines a case involving Advanced Persistent Threats (APTs) and the Tennessee Eastman process, considering that defenders may employ deception techniques such as honey files and honeypots to create strategic uncertainty for attackers.
NetworkOT/ICSHoneypotHoneytoken
Paper2018
Material reviewed: AbstractThe authors present 'ProfileGen', a method for automatically generating realistic honeypot profiles for professional social networks, intended to attract malicious actors in online social networks. They report that an evaluation by domain experts confirmed the generated profiles were indistinguishable from real ones.
IdentityApplicationHoneypot
Paper2018
Material reviewed: AbstractThe authors propose a game-theoretic model extending signaling games to include a probabilistic deception detector, applied to the design of defensive deception mechanisms in network security. The work analyzes pooling and partially-separating equilibria depending on detector quality.
NetworkAdversary engagement
Paper2018
Material reviewed: AbstractThis paper describes the design and implementation of a malware analysis laboratory based on honeypot technology in a controlled environment, aimed at studying the techniques used by attackers and analyzing security incidents. The authors also designed an administration interface to control and analyze the gathered information, and tested the system for several weeks to collect statistics about attacks and their perpetrators.
NetworkApplicationHoneypot
Paper2018
Material reviewed: AbstractThe authors describe a measurement study of attacks against or based on IoT protocols, using data obtained from a /15 network telescope and three honeypots with 15 IPv4 addresses. The study reports that telnet-based malware is still widely used, that infected devices are employed not only for DDoS attacks but also for crypto-currency mining, and that attackers look for IoT-specific services using MQTT, CoAP, UPnP, and HNAP, and target vulnerabilities of routers and cameras with HTTP.
IoTNetworkHoneypot
Paper2018
Material reviewed: Publisher metadataBibliographic record on ransomware tracing through deception. The abstract and findings still require review.
EndpointDecoy
Paper2018
Material reviewed: AbstractThe authors describe the use of honeypots as a decoy-based technology deployed in a network, aimed at defending IoT devices from attacks and gathering information about the attacker's device. The paper presents how honeypots, acting as cost-effective deception models, entice attackers in order to preserve information against attacks.
IoTNetworkHoneypotDecoy
Paper2018
Material reviewed: AbstractThis paper addresses how intruders can exploit timing side channels to distinguish whether a system is a honeypot or a real system, potentially helping them evade defense mechanisms. The authors introduce a novel definition of timed observational equivalence using symbolic time constraints, enabling automation via SMT solvers.
NetworkHoneypot
Paper2018
Material reviewed: AbstractThe work presents a dashboard visualization using honeypot log data from the AWN campus connected to IHP (Kemkominfo) Jakarta on a public cloud computing service network, aiming to categorize timestamps. The K-means clustering method is applied to categorize attacks into morning, noon, and night periods based on Western Indonesia Time and to identify ports 21, 80, 135, and 445 affected by DDoS attacks, with the stated expectation of supporting monitoring and anticipation of cloud network vulnerabilities.
CloudNetworkHoneypot
Paper2018
Material reviewed: AbstractThe authors propose a partially observable stochastic game framework to model interactions between a fully-observing defender and a partially-observing infiltrator in cybersecurity. They formulate the deception strategy problem as a robust mixed-integer linear program and present a scalable approach using parametric Markov decision processes to compute finite-memory infiltration strategies, illustrating the approach on a network security model.
NetworkAdversary engagementMoving target defense
Paper2018
Material reviewed: AbstractThe authors propose ThingPot, an interactive IoT honeypot that, per the abstract, targets the whole IoT platform rather than just application protocols, with a proof-of-concept implementing XMPP and a REST API to mimic a Philips Hue smart lighting system. The abstract states it was deployed for 1.5 months, capturing data that revealed five types of attacks and attack vectors against smart devices.
IoTHoneypot
Paper2018
Material reviewed: Publisher metadataBibliographic record on visual modeling of deception. The abstract and findings still require review.
NetworkDecoy
Paper2017
Material reviewed: Full textCritical readingGame-theoretic taxonomy distinguishing several forms of defensive deception.
NetworkMoving target defenseHoneytoken
Paper2017
Material reviewed: Publisher metadataBibliographic record on probabilistic logic of deception. The abstract and findings still require review.
NetworkDecoy
Paper2017
Material reviewed: AbstractThe authors describe deploying a honeynet of low-interaction and high-interaction SSH honeypots across three geographic regions of a public cloud environment in order to gather threat intelligence and obtain tailored indicators of compromise for e-learning platforms. The collected logs are analyzed through log collectors and parsers that translate the data into real-time dashboards, with the aim of understanding attackers' tactics according to time zones and geolocations and helping the education landscape prepare for emerging threats.
CloudNetworkHoneypot
Paper2017
Material reviewed: AbstractThis paper examines the use of honeypot data for employee information security awareness and education training. According to the authors, two honeypots were deployed at a private university in Singapore and the resulting data were analyzed. Drawing on Routine Activity Theory, they propose a conceptual training model called EASY (Engaging Stakeholders, Acceptable Behavior, Simple Teaching method, Yardstick) for designing security awareness programs.
NetworkIdentityHoneypot
Paper2017
Material reviewed: AbstractThe authors address the difficulty of distinguishing large-scale non-directional attacks from advanced persistent threats (APTs) and propose implementing honeytokens and honeypots as an intrusion detection system by deliberately placing traps within existing environments. They describe deploying a series of interconnected honeytokens, each with an exploitation difficulty level, to categorize attacks, profile the attacker and steer the execution flow into a maze-like scenario aimed at distracting, gathering forensic evidence and potentially identifying or deterring the attacker.
CloudHoneypotHoneytoken