Paper2025
Material reviewed: AbstractAccording to the abstract, the authors present a descriptive model incorporating psychological and strategic factors (belief, scepticism, deception fidelity, reconnaissance, and experience) to explain an attacker's initial decision to engage or withdraw from cyber-deception techniques. The authors state they have designed experiments using Capture the Flag activities and biometric observations to evaluate the model, but explicitly clarify that these experiments have not yet been conducted and no experimental findings are presented in the paper.
NetworkDecoyAdversary engagement
Paper2025
Material reviewed: AbstractThe authors present a simulated Gym-based environment for adversarial reinforcement learning in network security, where attacker and defender agents trained with DQN compete under a zero-sum reward framework. The environment models brute-force attacks and reactive defenses, including honeypot traps and adaptive rate-limiting, and the authors report that defender observability and trap effectiveness create substantial barriers to successful attacks.
NetworkHoneypotAdversary engagement
Paper2025
Material reviewed: AbstractThe authors present ADIRDS, an online monitoring system that models the real system as a graph and monitors critical assets, deploying realistic honeypots with business context similar to the real system to trap attackers and collect evidence when logs are insufficient. According to the authors, they applied the system to a real case, capturing 38 unique attacker IP addresses.
NetworkHoneypotDecoy
Paper2025
Material reviewed: AbstractThe authors present D3O-IIoT, a reinforcement learning model that dynamically coordinates deception techniques such as honeypot deployment, moving target defense, fake telemetry injection, and node isolation, driven by real-time threat monitoring. The defense problem is formulated as a Markov Decision Process, in which a Dueling Deep Q-Network agent maximizes a multi-objective reward to balance attack mitigation, deception engagement, false positive control, and resource cost.
IoTOT/ICSHoneypotMoving target defense
Paper2025
Material reviewed: AbstractThis work presents a machine learning-driven methodology combining cryptic and mimetic cyber deception principles to protect integrated circuits against reverse engineering attacks, using a variational autoencoder (AIG-VAE) and new covert gate variants. The authors report that experiments show effectiveness in maintaining functionality while achieving high camouflage and similarity scores.
EndpointDecoy
Paper2025
Material reviewed: AbstractThe study compares proposed metrics for honeyfile attributes—Common Token Count and Topic Semantic Matching for enticement, and coherence and cohesion for realism—against human users' perceptions as they judged text samples in a simulated data breach scenario on a crowd-sourcing platform. The authors report that Topic Semantic Matching aligned with perceived enticement, whereas results for Common Token Count were inconsistent and inconclusive, and coherence and cohesion did not consistently align with perceived realism.
HoneytokenDecoy
Paper2025
Material reviewed: AbstractThis work uses HackIT, a cybersecurity simulation tool, and a human-subject experiment with 88 computer science students to examine how attacker behavior varies across network topologies (ring vs. star) and honeypot densities (50% vs. 75%). The reported outcomes indicate that increased honeypot density maximized decoy interaction but also led to more real-system attacks in centralized (star) networks, whereas decentralized (ring) networks were more robust with fewer honeypots.
NetworkHoneypotDecoy
Paper2025
Material reviewed: AbstractAccording to the authors, this work proposes a defense paradigm called 'attack as defense' against model extraction attacks. They introduce HoneypotNet, which replaces the victim model's classification layer with a honeypot layer fine-tuned via bi-level optimization to poison any substitute model trained on its outputs, while preserving original performance.
ApplicationHoneypotDecoy
Paper2025
Material reviewed: AbstractThe authors present the Hybrid Cyber Deception System (HCDS), described as a Python-developed proactive tool that combines honeypots and honeytokens in a dynamically adaptive mode to simulate realistic services and redirect attackers in controlled, instrumented settings. The system integrates a deception-driven alerts correlation engine built on Python, Pandas and Scikit-learn, along with Moving Target Defense principles for continuous modulation of network parameters and decoy distribution, and was tested in a simulated environment with Windows and Ubuntu servers to profile attackers and detect complex attack vectors.
NetworkEndpointHoneypotHoneytoken
Paper2025
Material reviewed: Public pageThe authors describe a web-based classroom reservation system in which they implement a hidden honeypot field in the booking form: invisible to humans but fillable by bots, so submissions with that field completed are rejected.
ApplicationDecoy
Paper2025
Material reviewed: AbstractThis paper presents the implementation of a honeynet in which a honeypot acts as a real resource within a production network environment, aiming to divert and mislead attackers and analyze their behavior. According to the authors, the honeypot mimics both scanners and attackers within a simulated, production-level environment.
NetworkHoneypotDecoy
Paper2025
Material reviewed: AbstractThe authors present Koney, a Kubernetes operator that orchestrates cyber deception technology deployment through deception policy documents described as code. Using cloud-native technologies such as service meshes and eBPF, the system adds traps to containerized applications without source code access, facilitating setup, rotation, monitoring, and removal of traps, emphasizing maintainability, scalability, and operational simplicity.
CloudApplicationDecoyAdversary engagement
Paper2025
Material reviewed: AbstractThe authors present LLMHoney, an SSH honeypot that uses large language models (LLMs) to generate realistic, dynamic command outputs in real time, combining a dictionary-based virtual file system with LLMs for novel inputs. According to the abstract, the system was evaluated on 138 representative Linux commands across 13 LLM variants, reporting accuracy, latency, and memory metrics, while discussing challenges such as occasional hallucinated outputs.
NetworkEndpointHoneypotDecoy
Paper2025
Material reviewed: AbstractThe authors propose a neuro-symbolic fusion approach for cognitive threat reasoning in cyber deception environments. It combines deep neural networks with symbolic reasoning, using knowledge graphs, probabilistic logic, and reinforcement learning to identify, predict, and respond to adversaries and to optimize deception strategies.
NetworkDecoyAdversary engagement
Paper2025
Material reviewed: AbstractThe study integrates a honeypot into an SD-WAN architecture to combine traffic management and threat observation. The proposal routes anomalous activity into a decoy environment that simulates vulnerable services.
NetworkHoneypotDecoy
Paper2025
Material reviewed: AbstractThe authors present ShadowKube, an active defense framework for Kubernetes that integrates behavioral monitoring with shadow honeypots to detect and neutralize anomalous behavior. The approach establishes behavioral baselines to identify deviations and converts compromised nodes into honeypots, with the stated purpose of isolating and trapping attackers in intrusions targeting container orchestration.
CloudApplicationHoneypotDecoy
Paper2025
Material reviewed: AbstractThis study proposes SPADE, a framework that uses generative AI models alongside structured prompt engineering to automate the creation of adaptive cyber deception strategies against dynamic malware. According to the authors, the framework addresses challenges of large language models such as generalized outputs, ambiguity, and scalability constraints, and was evaluated across diverse malware scenarios using metrics like Recall, Exact Match, BLEU, and expert quality assessments, identifying ChatGPT-4o as the top performer.
EndpointNetworkAdversary engagementDecoy
Paper2025
Material reviewed: AbstractAccording to the authors, this study proposes a Stackelberg game-based framework for strategically timing cyber deception, combining a tactical layer modeling attacker-defender dynamics via a one-sided information Markov game with a strategic layer optimizing deception timing and selection through a stopping-time decision process. Numerical experiments, as reported by the authors, suggest that strategically timed deception can improve the defender's expected utility compared to baseline strategies.
NetworkAdversary engagementDecoy
Paper2024
Material reviewed: AbstractThe authors address the difficulty that traditional honeypot implementations are evaded by advanced adversaries such as APT groups, and propose designing and deploying a customized honeypot network based on adaptive camouflaging techniques. The work describes orchestrating a behavioral honeypot network tailored to three APT groups, with attack paths aligned with their tactics, techniques, and procedures, and includes a camouflaged chatterbox application deployed for 100 days; according to the deposited abstract, the setup recorded 13,906,945 hits from 4,238 unique IP addresses and was used to categorize attackers.
NetworkApplicationHoneypotDecoy
Paper2024
Material reviewed: Public pageThe paper proposes a honeypot layer to support security in an optical network with cloud services. The decoys simulate vulnerable resources to attract attackers and observe their behavior.
NetworkHoneypotDecoy
Paper2024
Material reviewed: Full textBibliographic record on application-layer deception. The abstract and findings still require review.
ApplicationDecoy
Paper2024
Material reviewed: AbstractThis paper addresses automated content generation for honeyfiles, decoy documents designed to detect intruders. The authors focus on generating realistic charts within such documents, combining a multitask Transformer for captions and plot text with a specialized autoencoder for underlying tabular data. They also introduce a new dataset and a metric (Keyword Semantic Matching) to evaluate semantic consistency of generated content.
EndpointHoneypotDecoy
Paper2024
Material reviewed: AbstractAccording to the authors, this paper proposes a cyber deception mechanism that stealthily redirects TCP communications to an on-demand honeypot server cloned to resemble the victim asset. The stated goal is to make attackers focus on the decoy server, enabling threat intelligence collection while protecting the real asset.
NetworkHoneypotDecoy
Paper2024
Material reviewed: AbstractThe authors address a scenario where a defender of a networked control system has isolated an intruder and redirects them toward a honeypot emulating the real system without connection to a physical plant. They propose an adversary engagement strategy within this decoy environment to increase the attacker's information-processing costs by spoofing sensor readings based on cyber threat intelligence. They perform a numerical comparison between cases of perfect and imperfect threat intelligence.
OT/ICSNetworkHoneypotAdversary engagement