Paper2026
Material reviewed: Public pageThe chapter analyzes cyberviolence and the traits of adolescent cyberaggressors and proposes comprehensive prevention involving families, educational institutions and technological tools such as honeynets to analyze attacker behavior and mitigate the impact.
Honeypot
Paper2026
Material reviewed: Publisher metadataBibliographic record on language-model honeypot tuned on Cowrie data. The abstract and findings still require review.
NetworkHoneypot
Paper2026
Material reviewed: Public pageThe authors describe installing and configuring Cowrie on Linux as an SSH and Telnet honeypot that logs attacker login attempts, credentials, and terminal commands to log files.
NetworkHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe authors propose using honey drones as a deception strategy to defend unmanned aerial vehicle (UAV) mission systems against denial-of-service attacks. They formulate an attacker-defender optimization problem based on radio signal strength and present an approach called HT-DRL, combining hypergame theory with deep reinforcement learning to identify optimal deception strategies.
IoTNetworkDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThe authors examine the assumption that decoys can be placed wherever attacker behavior occurs, applying a four-criterion rubric to all 250 MITRE ATT&CK v18.1 techniques. They find only 32% of techniques admit a plausible decoy and describe two placement patterns, Sweep and Seek, offering a simple rule for decoy deployment.
NetworkEndpointDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThe work proposes DecoyShield, a deception-based cybersecurity framework for proactive detection. It leverages multi-service honeypot environments that simulate network services, capture attacker behavior, and integrate behavioral analysis, threat intelligence, and dynamic risk scoring to classify severity and deploy adaptive responses.
NetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThis paper presents DecoyTrace, a proactive cyber deception-based defense designed for strictly serverless decentralized federated learning (DFL) environments. According to the authors, the system deploys a mobile DecoyNode that generates decoy challenges using chaotic maps, disseminates a dual model (clean vs. decoy) based on neighbor trust, and evaluates behavior using three-state semantic metrics to identify and contain malicious sources. The authors report evaluations on the NEBULA platform across multiple configurations, datasets, and topologies.
NetworkApplicationDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThis data article presents MURHCAD, a high-resolution honeynet dataset collected over 72 hours in June 2025 on Microsoft Azure, using three honeypots (Cowrie, Dionaea, and SentryPeer) deployed across four geographically dispersed virtual machines. According to the authors, the dataset comprises 132,425 attack events with enriched metadata (timestamps, IPs, geolocation, ports, and protocols) intended to support anomaly detection, protocol-misuse studies, and threat intelligence research.
CloudNetworkHoneypot
Paper2026
Material reviewed: AbstractThis report addresses the challenge of detecting AI-driven offensive cyber agents, proposing a strategic 'detection-in-depth' framework. According to the authors, five detection mechanisms are presented, including agent identifiers and agent honeypots, intended to support policymakers and industry against this emerging threat.
NetworkCloudHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThis paper presents DICOMHawk, a cyber-deception framework that emulates DICOM and PACS services with realistic interactions, dynamically populated medical records, and embedded honeytokens, designed to protect medical imaging infrastructure. According to the authors, in a 424-day deployment across multiple networks, DICOMHawk attracted more valid sessions than Dicompot, avoided honeypot detection, and captured 67 medical-related attacks from 15 unique IPs.
NetworkApplicationHoneypotHoneytoken
Paper2026
Material reviewed: AbstractThis paper presents a behavior-driven attacker profiling framework built from empirical data collected in SSH honeypot deployments. The methodology parses complex command chains to identify behavioral patterns, organize them into hierarchical clusters, and map them to the MITRE ATT&CK framework for structured threat interpretation.
NetworkHoneypot
Paper2026
Material reviewed: AbstractThe authors propose an antifragile framework that uses cyber deception with adaptive decoys and dynamic network movements to generate adversarial signals, infer threat actor profiles and support proactive decisions. A cyber threat intelligence ontology and a knowledge graph with semantic attributes represent tactical and strategic relationships between attackers and targets.
NetworkDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThe paper describes an intrusion detection system that monitors live packets and uses predefined rules to detect suspicious activity rather than machine learning models. It includes a honeypot module with a fake login interface and human-readable explanations for detected anomalies.
NetworkHoneypot
Paper2026
Material reviewed: AbstractThe study investigates whether psychologically engineered "bias triggers" can exploit human attackers' Type I heuristic processing to degrade their performance. The authors use a high-fidelity cyber range where participants conduct network penetration with and without these triggers, analyzing operational telemetry.
NetworkDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThis paper presents LDT-FRL, a defense framework combining temporal attention encoders, lightweight digital twins, and a federated reinforcement learning (PPO) agent capable of redirecting suspicious traffic to honeypots in IoMT (Internet of Medical Things) environments. According to the authors, the system was evaluated on public network traffic benchmarks, achieving high classification metrics and explainability via techniques such as SHAP and Grad-CAM.
IoTNetworkHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe paper proposes a proactive defense approach using a high-interaction honeypot for DDoS detection and prevention. The honeypot captures IP addresses, malware and attacker tactics, feeding firewalls and traffic filters to block similar threats across the network.
NetworkHoneypot
Paper2026
Material reviewed: AbstractThe authors conduct a systematic literature review and introduce a taxonomy characterizing honeypot detection techniques across contextual and technical dimensions, framing detection as identifying inconsistencies between observable system properties and attacker expectations. They map existing evasion and detection methods to this taxonomy, analyze the gap between academic techniques and those used in practice, and outline mitigation strategies and design principles aimed at improving honeypot resilience.
Honeypot
Paper2026
Material reviewed: AbstractThe authors present a honeypot architecture based on a fine-tuned LLM that combines command-line, API and dynamic web interaction with state management and security safeguards. The abstract describes a prototype simulating a Synology NAS on an OpenCanary baseline and an adaptation to a medical FHIR API.
ApplicationHoneypot
Paper2026
Material reviewed: AbstractThe authors study attacker behavior across eleven SSH honeypots accepting both interactive and non-interactive sessions over fifteen days. According to the abstract, they found that the vast majority of authenticated sessions were non-interactive, challenging common assumptions in cyber deception research focused on interactive shells.
NetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThis paper proposes GroupGuard, a training-free defense framework against group collusive attacks in large language model-based multi-agent systems. The approach combines continuous graph-based monitoring, active honeypot inducement, and structural pruning to identify and isolate collusive agents. The authors report high detection accuracy across experiments with five datasets and four topologies.
ApplicationHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThis work, according to its authors, addresses DoS/DDoS mitigation by separating malicious from benign traffic using honeypots, framing the problem as a weighted MaxCut solved with variational quantum algorithms (QAOA). The authors describe a reproducible honeypot-to-QUBO pipeline, labeled temporal bipartite benchmark graphs, QAOA executions on IBM hardware, classical heuristic baselines, and a routing overhead analysis across quantum processor architectures.
NetworkHoneypot
Paper2026
Material reviewed: AbstractThe paper proposes HIVE-O, a decentralized honeypot framework for IoT ecosystems, with lightweight distributed nodes that capture, analyze and share attack intelligence without a single point of control. The authors describe emulation of IoT services and protocols and an experimental evaluation of reconnaissance, exploitation and denial-of-service attempts.
IoTHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors present HIVE-OT's design and implementation and evaluate the evidence supported by its process-coupled research core and historical exports, distinguishing the documented platform from a local implementation linking Modbus, a revised Rust water-treatment surrogate and SQLite. The study tests protocol behavior, command application and retained outcome representations, and audits two deployment exports containing 273978 and 842638 events.
OT/ICSNetworkHoneypot
Paper2026
Material reviewed: AbstractThis position paper suggests that presenting deception storyline content can influence how human attackers and Large Language Model (LLM) Agent attackers evaluate the authenticity of deception functions and effects on a network or host. The authors introduce HoneyContent, a practiced industry cyber deception model for designing and creating deception storyline content to 'wrap' or embed deception functions, integrating warranting theory and signaling theory, and visualize its use in an industry cyber deception scenario.
NetworkEndpointDecoy