Paper2026
Material reviewed: AbstractThe authors present Mirage Mesh, a lightweight cyber deception framework for Linux environments that applies deception-in-depth across four layers: an SSH decoy built on Cowrie, a system-layer decoy administrative account, a fake Flask web administration interface, and a data-layer honeytoken credential file. The work proposes a shared DecoyAlertEvent schema to normalize observations from these layers, process them through a Wazuh-based detection and active-response pipeline with Python orchestration, map them to cyber kill-chain stages and MITRE ATT&CK techniques, and evaluate them with a Deception Effectiveness Metric (DEM).
NetworkEndpointHoneypotHoneytoken
Paper2026
Material reviewed: AbstractThis paper presents a context-enriched SQL injection detection framework built via a multi-agent honeypot system that generates malicious/benign requests, mediates authentic database responses while protecting production data, and pairs requests with responses to create a labeled dataset of 140,973 pairs. The authors state that models trained on this dataset outperform payload-only counterparts.
ApplicationHoneypot
Paper2026
Material reviewed: AbstractThis paper, according to its authors, reviews AI-based solutions for building network- and device-level cyber deception methods in contested environments. It focuses on combining large language models (LLMs) and reinforcement learning (RL) to optimize deception strategies such as honeypots and honeynets, and examines their validation against stealthy attacks on operational technology (OT) systems reported in the literature.
NetworkOT/ICSHoneypotDecoy
Paper2026
Material reviewed: AbstractThis paper presents Ollure, a low- and medium-interaction honeypot that emulates the Ollama API without a backend LLM, as described by the authors. Deployed across four locations over 84 days, it recorded hundreds of thousands of interactions from thousands of source IP addresses. The study documents automated discovery and fingerprinting activity, as well as concrete exploitation attempts against both the infrastructure and LLM layers.
NetworkApplicationHoneypotDecoy
Paper2026
Material reviewed: AbstractThe work describes the design of a portable wireless honeypot using a Raspberry Pi to detect and analyze SSH brute-force attacks. By simulating a vulnerable SSH service with the Cowrie honeypot, the system logs login attempts and attacker behavior in real time to study attack patterns and improve security measures.
NetworkHoneypot
Paper2026
Material reviewed: AbstractThis thesis proposes game-theoretic and optimisation-based models for hardening Active Directory attack graphs. According to the authors, it introduces a honeypot/decoy placement model that minimises shortest paths and Domain Admin-reachable nodes, along with strategies accounting for the dynamic nature of the graph and adaptive prioritisation models incorporating administrator feedback. The authors note that the underlying problems are computationally intractable.
IdentityNetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThis work proposes Federated TGCN-A2C, an architecture integrating temporal graph convolutional networks, LSTM-based digital twins, and a federated actor-critic agent to decide between allowing, isolating, or redirecting traffic to honeypots in IoT/IoMT devices. The authors report evaluations on public cybersecurity datasets along with explainability analysis supporting the system's decision-making.
IoTNetworkHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe work describes the design and implementation of a high-interaction LLM honeypot system intended to detect and analyze the behavior of LLM-based attacks. The authors propose a strategy that embeds hidden puzzles in webpage source code to consume LLM tokens, alongside multi-dimensional heuristic detection and token heatmap visualization.
ApplicationHoneypot
Paper2026
Material reviewed: AbstractThe authors discuss applying reinforcement learning to improve response generation in honeypots and propose Q-Cowrie, a customization of the medium-interaction Cowrie honeypot intended to increase deception and support adaptive decisions while interacting with attackers. They report two experimental studies, one deploying Cowrie to capture attacks and model attacker decision-making with a Markov decision process, and another using Q-Cowrie to support adaptive interaction.
NetworkHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe study proposes QuantumGuard, a proactive cybersecurity framework that combines cognitive honeynets, post-quantum-secured intelligence channels and reinforcement-learning-driven deception adaptation across 6G-enabled cyber-physical environments. The authors aim to integrate a cognitive honeynet orchestrator, a deception policy engine operating under partial observability, a transformer-based MITRE ATT&CK attribution network and a post-quantum federated intelligence bus into a single closed-loop control architecture, and they report a preliminary evaluation on benchmark datasets and a 320-endpoint testbed.
NetworkIoTHoneypotDecoy
Paper2026
Material reviewed: AbstractThe paper describes a hybrid intrusion detection system combining a supervised classifier trained on the NSL-KDD dataset with a Docker-based honeypot that deploys automatically when suspicious activity is detected. Traffic is classified into five categories, with a voting ensemble of three classifiers producing the detection.
NetworkHoneypot
Paper2026
Material reviewed: AbstractThe article presents SAGE, an adaptive Internet of Things (IoT) honeypot that combines Finite-State Machine (FSM)-driven protocol emulation with GraphRAG-enhanced retrieval to model stateful IoT protocols and generate responses using a Large Language Model (LLM). The authors also describe a fact-checking engine and a feedback mechanism intended to refine responses and progressively expand state-response mappings based on observed adversarial interactions.
IoTHoneypotAdversary engagement
Paper2026
Material reviewed: Public pageThe authors propose SecuPi, a compact Raspberry Pi-based system that combines real-time traffic monitoring, hybrid intrusion detection (signature-based and machine learning) and automated threat response. As deception and proactive defense mechanisms, they propose the use of honeypots together with automatic firewall updates and Moving Target Defense (MTD).
NetworkIoTHoneypotMoving target defense
Paper2026
Material reviewed: AbstractThis paper presents ShellGames, an SSH shell simulator based on large language models (LLMs) designed to sustain credible interactive deception sessions with adversaries. According to the authors, the system combines techniques such as chain-of-thought reasoning, memory management, speculative command execution, sandbox routing, and subversion detection to address common LLM limitations. The authors report improvements in accuracy, consistency, and state tracking over baselines, along with a user study indicating perceived realism comparable to a real shell.
NetworkEndpointHoneypotMoving target defense
Paper2026
Material reviewed: AbstractThe authors introduce HoneyMed, a protocol-aware honeypot framework that simulates healthcare and IoT services in order to collect malicious interactions, transform them into machine-learning tabular features, and classify attack types in real time. Its stated purpose is to provide threat visibility for IoMT security testbeds using decoys, feature extraction and lightweight classifiers, without interacting with production medical assets.
IoTNetworkHoneypotDecoy
Paper2026
Material reviewed: Public pageThe manuscript proposes coordinating agents and threat flows through zones in a computational world, including honeypots, deception regions, and classification and quarantine routes.
ApplicationHoneypot
Paper2026
Material reviewed: AbstractThis paper presents a method to estimate a lower bound on the number of networks generating spoofed traffic in DRDoS attacks, using a global deployment of anycast amplification honeypots. The authors develop two estimators based on honeypot reception patterns and TTL variations, analyzing 287 days of amplification attacks. According to the authors, at least 21.0% of attacks originate from multiple network locations.
NetworkHoneypot
Paper2026
Material reviewed: AbstractThe authors use an interactive voice honeypot with language-model personas on real U.S. numbers to measure the prevalence of automated and synthetic voices in unwanted inbound calls, combining audio fingerprinting, a commercial synthetic-speech detector, and blinded listeners to characterize call traffic.
NetworkHoneypot
Paper2026
Material reviewed: AbstractThe paper presents TrustFed-Honeypot, a hybrid federated-retraining framework for honeypot-based IDS. Clients train locally, and the server retrains a global logistic model on samples weighted by a multi-signal behavioral trust model, aiming to reshape the retraining distribution.
NetworkHoneypot
Paper2026
Material reviewed: AbstractThe study proposes an unsupervised detection system built on autoencoder-family models that learn normal traffic behavior and flag anomalies through reconstruction error (MSE), applied to multi-source metadata (Wireshark, firewall logs, and a T-Pot honeypot) collected over fifteen days from a real enterprise VLAN. The authors incorporate external threat intelligence (AbuseIPDB, OTX) and a multi-dimensional scoring system (MDSS) to convert raw detections into prioritized risk scores, and validate anomalies through two MITRE ATT&CK pipelines.
NetworkIoTHoneypot
Paper2025
Material reviewed: AbstractThe authors propose a non-zero-sum game theoretical model to represent strategic interactions between cyber attackers and defenders, incorporating payoff functions that consider exploit probabilities and costs, network node values, and honeypot deployment costs. Through simulations, they derive Nash equilibria to inform strategic defense decisions, finding that high-probability, low-cost exploits like phishing require prioritized defense mechanisms.
NetworkHoneypot
Paper2025
Material reviewed: AbstractThis paper introduces an automated cloud defense framework that leverages medium- to high-interaction honeypot telemetry to dynamically update firewall rules in real time. According to the authors, the system integrates the Cowrie honeypot, Azure-native automation tools, and MITRE ATT&CK-aligned classification within a closed-loop feedback mechanism. The authors report an average Mean Time to Block of 0.86 seconds and classification of over 12,000 SSH attempts in experimental testing.
CloudNetworkHoneypotAdversary engagement
Paper2025
Material reviewed: AbstractAccording to the abstract, the authors propose a honeypot-based guardrail system that fine-tunes a bait model to generate ambiguous, non-actionable responses used as lures to probe user intent during multi-turn interactions with LLMs. The work introduces metrics (HUS and DER) to evaluate bait attractiveness and the safety-usability tradeoff, with initial experiments on a multi-turn jailbreak dataset applied to GPT-4o.
ApplicationHoneypotAdversary engagement
Paper2025
Material reviewed: AbstractThe authors present a simulated Gym-based environment for adversarial reinforcement learning in network security, where attacker and defender agents trained with DQN compete under a zero-sum reward framework. The environment models brute-force attacks and reactive defenses, including honeypot traps and adaptive rate-limiting, and the authors report that defender observability and trap effectiveness create substantial barriers to successful attacks.
NetworkHoneypotAdversary engagement