Paper2013
Material reviewed: AbstractThe paper formulates an attack-defense scenario as a mathematical model in which the defender applies both proactive and reactive defense mechanisms against attackers with different attack strategies, assuming attackers have incomplete information and imperfect knowledge of the target network. The authors report that, based on their experiment results, a proactive defense strategy is suitable against aggressive attackers under "winner takes all" circumstances, while a reactive strategy works better against less aggressive attackers under "fight to win or die" circumstances.
NetworkCloudHoneypot
Paper2013
Material reviewed: Full textProposal for false passwords per account and a separate honeychecker that detects their use.
IdentityHoneytoken
Paper2013
Material reviewed: AbstractAccording to the authors' abstract, this work shares experience in botnet detection by deploying Nepenthes honeypots in private and public networks. The authors describe an automated framework for malware collection using Nepenthes and analysis via anti-virus scanning, presenting experimental results of known bot detection in their network.
NetworkHoneypot
Paper2012
Material reviewed: AbstractThis work proposes the use of unsupervised neural models, based on neural projection methods, to generate an intuitive visualization of traffic captured from honeypot data rather than network statistics alone. The authors position the system as a complementary network security tool that supports security personnel in visually inspecting traffic events and in assessing Snort performance through the visualization of attack patterns.
NetworkHoneypot
Paper2012
Material reviewed: AbstractThe authors present a comparative study, based on a mobile honeypot that extracts first statistical results, to analyze to what extent malicious transport contacts depend on the type of network access, particularly whether an adversary specifically targets mobile or non-mobile devices. Their findings indicate that a few topological domains of the Internet have started to place particular focus on attacking mobile networks.
NetworkHoneypot
Paper2012
Material reviewed: AbstractAccording to the authors' abstract, this work addresses fake check-ins in location-based social networks (LBSNs). The authors propose and analyze a honeypot venue-based solution, enhanced with a challenge-response scheme, to flag users generating fake spatial information.
ApplicationHoneypot
Paper2012
Material reviewed: AbstractThe author introduces honeypots as a tool for security-related research, lists and characterizes several selected honeypot solutions, and presents results of practical experiments carried out at the University of Defence, including graphs and tables. The stated purpose is to acquaint the reader with the use of honeypots in security research.
NetworkHoneypot
Paper2010
Material reviewed: AbstractThis paper presents Mirage, a low-cost system designed by the authors to mitigate corporate espionage in RFID-enabled retail environments. According to the authors, Mirage uses programmable RFID tags as honeytokens to inject noise into inventory data, randomizing sales and restocking trends observable by potential attackers.
IoTHoneytoken
Paper2010
Material reviewed: AbstractThis paper describes tools and techniques used in network forensics to capture, record and analyze network events for investigating security attacks. According to the authors, it surveys tools such as email trackers, packet sniffers and IP traceback techniques, and discusses the use of honeypots and honeynets to gather intelligence on intruders.
NetworkHoneypot
Paper2009
Material reviewed: AbstractThe authors propose a system that uses honeypots not only to detect malicious traffic but also to generate and broadcast on-the-fly anti-malware signatures for new and unknown malware in a network, mimicking the way malware itself spreads. According to the abstract, this would allow effective initial control over viruses not yet identified by established security firms.
NetworkEndpointHoneypot
Paper2009
Material reviewed: AbstractThe authors present an implementation of an intrusion detection system using advanced honeypots to distinguish legitimate client traffic from attacker traffic, aiming to reduce latency and improve security on public servers. According to the abstract, results of stress and scalability tests are reported, along with suggested potential uses for the system.
NetworkHoneypot
Paper2007
Material reviewed: AbstractAccording to the abstract, the authors present empirical analyses based on data collected from the Leurré.com honeypot platforms deployed on the Internet, along with preliminary modeling studies aimed at characterizing attack processes, in order to better understand attacker strategies and techniques.
NetworkHoneypot
Paper2007
Material reviewed: AbstractThis paper presents an experimental study and lessons learned by the authors from observing attackers logged onto a compromised machine. According to the abstract, results are based on a six-month controlled experiment with a high-interaction honeypot, correlated with findings from a worldwide distributed low-interaction honeypot system.
NetworkHoneypot
Paper2006
Material reviewed: AbstractThe author proposes an alternative approach to learning and teaching IT security called Honeynet Learning, which uses the honeynet as a tool and resource to augment both student and instructor learning. The approach incorporates discovery, feedback, and "real world" experience, and illustrates a methodology that can be applied in a typical IT security course.
NetworkHoneypot
Paper2005
Material reviewed: AbstractThe paper addresses the tension between scalability and fidelity in network honeypots used to gather intelligence on malware, and proposes reducing it through a prototype honeyfarm system called Potemkin. According to the authors, Potemkin uses virtual machines, aggressive memory sharing, and late binding of resources to emulate the execution behavior of individual hosts at large scale.
NetworkHoneypot
Paper2004
Material reviewed: AbstractThis paper provides an introduction to honeypots (electronic bait), network resources designed to be attacked and compromised, indistinguishable from regular systems. According to the authors, these systems can be interconnected into honeynets equipped with special software facilitating forensic analysis of incidents. The work describes the setup and first experiences of such a network deployed at RWTH Aachen University, aiming to learn about attacker behavior in networks.
NetworkHoneypot
Paper2004
Material reviewed: AbstractThe paper describes a system for generating attack signatures for network intrusion detection systems, applying pattern-matching techniques and protocol conformance checks at multiple levels of the protocol hierarchy to network traffic captured at a honeypot system. The authors report results from running the system for 24 hours on an unprotected cable modem connection, where it created precise traffic signatures.
NetworkHoneypot
Paper2004
Material reviewed: AbstractThis paper proposes a model for estimating the costs and benefits associated with deploying honeynet technology, an area where, according to the authors, a clear framework for optimal security resource allocation was lacking. The stated goal is to foster informed reasoning about the adoption of honeynets as an IT security measure.
NetworkHoneypot
Paper—
Material reviewed: AbstractThe thesis proposes an authentication framework combining multi-factor authentication with honeytoken-based deception techniques. It describes three successive architectures: static honeytokens to improve detection of compromised credentials, the 2FHA mechanism combining one-time passwords (Google Authenticator) with honeytokens, and a final architecture with session-bound honeytokens, blockchain-supported auditing, and smart contracts on Ethereum.
IdentityApplicationHoneytokenDecoy