Paper2021
Material reviewed: AbstractThe authors extend their anti-ransomware tool R-Locker to Windows, relying on a honeyfile-based approach in which 'infinite' trap files are disseminated around the target filesystem for early detection and to block ransomware action. The Windows version addresses differences in FIFO handling and adds improved global management of honeyfiles and (semi)automated blocking of suspicious ransomware through the dynamic use of white-/black-lists.
EndpointHoneytokenDecoy
Paper2021
Material reviewed: Full textHistorical review of honeypots, honeytokens and moving target defense from the late 1980s through 2021.
NetworkEndpointHoneypotHoneytoken
Paper2020
Material reviewed: Publisher metadataDOI-identified publication on honeytoken fingerprinting methods; text analysis is pending.
IdentityHoneytoken
Paper2019
Material reviewed: AbstractAccording to the authors, this work proposes AnonTokens, an approach applying the honeytoken concept to the data privacy domain to trace re-identification attacks. High re-identification-risk decoy records are inserted into anonymized datasets to detect malicious users. The authors evaluate their approach using large-scale population datasets.
ApplicationHoneytokenDecoy
Paper2019
Material reviewed: AbstractThe work examines n-session recording attack resilient unaided authentication services (n-SRRUASs) and notes that they cope poorly with server-side issues within their authentication procedure. The authors propose generic principles for incorporating honeywords (fake passwords) into n-SRRUASs and, with the help of an existing n-SRRUAS, show the idea is implementable in practice to fill that gap.
IdentityHoneytoken
Paper2018
Material reviewed: AbstractThe authors use game theory, including static Bayesian games, signaling games, and multi-stage models, to model defender-attacker interactions in cybersecurity under uncertainty and asymmetric information. Per the abstract, the study examines a case involving Advanced Persistent Threats (APTs) and the Tennessee Eastman process, considering that defenders may employ deception techniques such as honey files and honeypots to create strategic uncertainty for attackers.
NetworkOT/ICSHoneypotHoneytoken
Paper2017
Material reviewed: Full textCritical readingGame-theoretic taxonomy distinguishing several forms of defensive deception.
NetworkMoving target defenseHoneytoken
Paper2017
Material reviewed: AbstractThe authors address the difficulty of distinguishing large-scale non-directional attacks from advanced persistent threats (APTs) and propose implementing honeytokens and honeypots as an intrusion detection system by deliberately placing traps within existing environments. They describe deploying a series of interconnected honeytokens, each with an exploitation difficulty level, to categorize attacks, profile the attacker and steer the execution flow into a maze-like scenario aimed at distracting, gathering forensic evidence and potentially identifying or deterring the attacker.
CloudHoneypotHoneytoken
Paper2016
Material reviewed: AbstractThis article studies how users, such as employees, interact with active honeytokens, meaning fake data objects planted among real data to detect data misuse by insiders. The authors describe an automated, generic method for generating those honeytokens and present two behavioral studies examining whether users can distinguish them from real objects and whether user behavior changes when users are informed that monitored honeytokens are present.
Honeytoken
Paper2015
Material reviewed: AbstractThe study proposes a generic implementation strategy for honeytokens deployed within a database management system, leveraging the aspect-oriented paradigm to contain the insider threat. The authors test this approach by developing a proof-of-concept prototype in AspectJ and reflect on the design and implementation challenges involved in deploying honeytokens.
ApplicationHoneytoken
Paper2013
Material reviewed: Full textProposal for false passwords per account and a separate honeychecker that detects their use.
IdentityHoneytoken
Paper2010
Material reviewed: AbstractThis paper presents Mirage, a low-cost system designed by the authors to mitigate corporate espionage in RFID-enabled retail environments. According to the authors, Mirage uses programmable RFID tags as honeytokens to inject noise into inventory data, randomizing sales and restocking trends observable by potential attackers.
IoTHoneytoken
Paper—
Material reviewed: AbstractThe thesis proposes an authentication framework combining multi-factor authentication with honeytoken-based deception techniques. It describes three successive architectures: static honeytokens to improve detection of compromised credentials, the 2FHA mechanism combining one-time passwords (Google Authenticator) with honeytokens, and a final architecture with session-bound honeytokens, blockchain-supported auditing, and smart contracts on Ethereum.
IdentityApplicationHoneytokenDecoy