Paper2026
Material reviewed: AbstractThe paper describes an intrusion detection system that monitors live packets and uses predefined rules to detect suspicious activity rather than machine learning models. It includes a honeypot module with a fake login interface and human-readable explanations for detected anomalies.
NetworkHoneypot
Paper2026
Material reviewed: AbstractThis paper presents LDT-FRL, a defense framework combining temporal attention encoders, lightweight digital twins, and a federated reinforcement learning (PPO) agent capable of redirecting suspicious traffic to honeypots in IoMT (Internet of Medical Things) environments. According to the authors, the system was evaluated on public network traffic benchmarks, achieving high classification metrics and explainability via techniques such as SHAP and Grad-CAM.
IoTNetworkHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe paper proposes a proactive defense approach using a high-interaction honeypot for DDoS detection and prevention. The honeypot captures IP addresses, malware and attacker tactics, feeding firewalls and traffic filters to block similar threats across the network.
NetworkHoneypot
Paper2026
Material reviewed: AbstractThe authors conduct a systematic literature review and introduce a taxonomy characterizing honeypot detection techniques across contextual and technical dimensions, framing detection as identifying inconsistencies between observable system properties and attacker expectations. They map existing evasion and detection methods to this taxonomy, analyze the gap between academic techniques and those used in practice, and outline mitigation strategies and design principles aimed at improving honeypot resilience.
Honeypot
Paper2026
Material reviewed: AbstractThe authors present a honeypot architecture based on a fine-tuned LLM that combines command-line, API and dynamic web interaction with state management and security safeguards. The abstract describes a prototype simulating a Synology NAS on an OpenCanary baseline and an adaptation to a medical FHIR API.
ApplicationHoneypot
Paper2026
Material reviewed: AbstractThe authors study attacker behavior across eleven SSH honeypots accepting both interactive and non-interactive sessions over fifteen days. According to the abstract, they found that the vast majority of authenticated sessions were non-interactive, challenging common assumptions in cyber deception research focused on interactive shells.
NetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThis paper proposes GroupGuard, a training-free defense framework against group collusive attacks in large language model-based multi-agent systems. The approach combines continuous graph-based monitoring, active honeypot inducement, and structural pruning to identify and isolate collusive agents. The authors report high detection accuracy across experiments with five datasets and four topologies.
ApplicationHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThis work, according to its authors, addresses DoS/DDoS mitigation by separating malicious from benign traffic using honeypots, framing the problem as a weighted MaxCut solved with variational quantum algorithms (QAOA). The authors describe a reproducible honeypot-to-QUBO pipeline, labeled temporal bipartite benchmark graphs, QAOA executions on IBM hardware, classical heuristic baselines, and a routing overhead analysis across quantum processor architectures.
NetworkHoneypot
Paper2026
Material reviewed: AbstractThe paper proposes HIVE-O, a decentralized honeypot framework for IoT ecosystems, with lightweight distributed nodes that capture, analyze and share attack intelligence without a single point of control. The authors describe emulation of IoT services and protocols and an experimental evaluation of reconnaissance, exploitation and denial-of-service attempts.
IoTHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors present HIVE-OT's design and implementation and evaluate the evidence supported by its process-coupled research core and historical exports, distinguishing the documented platform from a local implementation linking Modbus, a revised Rust water-treatment surrogate and SQLite. The study tests protocol behavior, command application and retained outcome representations, and audits two deployment exports containing 273978 and 842638 events.
OT/ICSNetworkHoneypot
Paper2026
Material reviewed: AbstractThe abstract describes Honey Shield, a deception-driven cybersecurity paradigm for web authentication systems. It proposes a centralized security service interface offering defenses such as honeypot redirection and SQL injection protection, redirecting malicious users to a decoy system and logging incidents for later analysis.
ApplicationIdentityHoneypotDecoy
Paper2026
Material reviewed: AbstractThe work presents HoneyPrompt, a multi-sensor fusion architecture for detecting and classifying autonomous AI agents that interact with industrial control systems. The authors deploy a maritime SCADA honeypot simulating a pipeline monitoring gateway across six protocols and instrument it with a graduated prompt injection acting as a sensor array.
OT/ICSNetworkHoneypotHoneytoken
Paper2026
Material reviewed: AbstractThis paper adapts the Honeyquest instrument to automatically evaluate LLM-based attacker judgment against cyber deception techniques. According to the authors, a cohort of 21 models from various providers was compared against a human baseline on reconnaissance tasks, finding that LLMs fall for traps at higher rates than humans and show a gap between recognizing deception in their reasoning and acting accordingly. The authors conclude that human-centered deception hypotheses do not reliably transfer to AI attackers.
NetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors present HoneyRoute, an inference-serving layer that detects malicious requests and routes them to a dedicated honeypot model, shielding the production model while harvesting attacker intelligence. The system combines a streaming router, a dual-implementation honeypot, and an analysis loop that feeds back into router retraining.
ApplicationCloudHoneypotDecoy
Paper2026
Material reviewed: AbstractAccording to the authors, HoneyTrap is a deceptive defense framework for large language models that employs four collaborative defender agents to counter multi-turn jailbreak attacks by directing attackers toward honeypot traps. The authors also introduce a progressive multi-turn jailbreak dataset (MTJ-Pro) and two new evaluation metrics for deceptive defense. They report reductions in attack success rates across several commercial and open-source models.
ApplicationHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThis work presents Honeyval, an evaluation framework for LLM-powered HTTP honeypots. According to the authors, the framework uses AI hacking agents as attackers and diverse backend applications to reproducibly evaluate the performance and detectability of these honeypots compared to prior limited evaluation methods.
NetworkApplicationHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors introduce ICSLure, a modular honeynet framework intended to emulate realistic industrial control system environments. It integrates physical PLCs with live data sources over industrial protocols and virtualized network components, with monitoring to log attacker interactions.
OT/ICSNetworkHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThis paper studies how to improve shell emulation accuracy of local open-weight LLM-based SSH honeypots through prompt design and supervised fine-tuning, comparing eight models against their base versions. Using 34 automated unit tests, the authors report that prompt design has a large effect and that fine-tuning effectiveness depends on dataset coverage, with an expanded dataset built from honeypot logs producing stronger local models according to their own measurements.
NetworkEndpointHoneypot
Paper2026
Material reviewed: AbstractThis study examines international differences in hacking attempts using honeypot data, analyzing 504,877 login attempts from 314 unique IP addresses over a 3-month period. The authors test hypotheses based on socio-economic factors — unemployment, poverty, GDP and education expenditures — and attribute to higher unemployment and lower education expenditures a correlation with more breach attempts per country, and to lower education expenditures a correlation with higher success rates of breach attempts.
NetworkHoneypot
Paper2026
Material reviewed: AbstractThis paper presents a noise-aware measurement study of Internet-facing DICOM services, combining IPv4-wide active scanning with passive honeypot deployments. The authors introduce a reproducible method to filter false positives caused by honeypots, network telescopes, and other measurement artifacts, reducing apparent exposure by 39%. After filtering, they identify thousands of vulnerable deployments lacking encryption and authentication, finding that existing deception systems are insufficient to capture the actual risks.
NetworkApplicationHoneypotDecoy
Paper2026
Material reviewed: AbstractAccording to the authors, this paper proposes 'Knowledge Trap', a defense against large language model extraction attacks that redirects attackers toward low-transferability knowledge using a honeypot-style knowledge graph and breadcrumb-guided exploration, rather than blocking queries or perturbing outputs. The authors report experiments in medical and financial domains showing reduced surrogate agreement without degrading legitimate-user performance.
ApplicationHoneypot
Paper2026
Material reviewed: AbstractThis work studies how large language model (LLM)-based penetration testing agents can allocate their execution budget when encountering honeypots. The authors formalize the attacker's problem as a budgeted decision process in which the agent must decide whether to continue exploitation or skip a target upon honeypot suspicion, proposing a detector-guided policy evaluated in a controlled mixed-host testbed.
NetworkEndpointHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe paper proposes an LLM-enabled cloud-native dynamic honeypot architecture in which the model acts only as a text synthesizer behind policy gating and state verification. The authors describe a session broker that classifies attacker commands rather than executing them, alongside ethical governance controls and an evaluation protocol.
CloudNetworkHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe authors propose MemPot, a defense framework that injects optimized honeypots into the memory of large language model (LLM)-based agents to counter extraction attacks. Through a two-stage optimization process and a detection model based on Wald's Sequential Probability Ratio Test, the authors report improved detection performance over existing baselines in their experiments.
ApplicationHoneypotDecoy