Paper2025
Material reviewed: AbstractThe paper describes an intrusion detection system based on machine learning, enhanced by integrating the Cowrie honeypot to capture attacker behavioral data and thereby improve detection of indicators of compromise and attack patterns. The authors present an isolated multi-VM architecture, supervised and unsupervised models (Random Forest, Logistic Regression, Isolation Forest), a Flask API for real-time classification, and Kibana and Power BI dashboards, aiming to detect both known and unknown threats.
NetworkHoneypot
Paper2025
Material reviewed: AbstractThe authors propose ADLAH, a conceptual adaptive honeynet architecture using reinforcement learning to decide in real time when to escalate sessions from low-interaction sensors to dynamically provisioned high-interaction honeypots. It is described as a functional prototype of the central decision mechanism, without field-scale validation due to insufficient live data.
NetworkHoneypotAdversary engagement
Paper2025
Material reviewed: AbstractThe authors present ADIRDS, an online monitoring system that models the real system as a graph and monitors critical assets, deploying realistic honeypots with business context similar to the real system to trap attackers and collect evidence when logs are insufficient. According to the authors, they applied the system to a real case, capturing 38 unique attacker IP addresses.
NetworkHoneypotDecoy
Paper2025
Material reviewed: Public pageThe paper studies files uploaded by attackers to a cloud honeypot and uses them to compare signature-based detection by antivirus programs.
CloudHoneypot
Paper2025
Material reviewed: AbstractThe study analyzes malicious actors' patterns and tactics using a modified T-Pot Honeypot, with multiple honeypots in Docker containers emulating vulnerable services. It aims to collect and analyze exploitation, evasion and credential attempts to characterize threats and inform cyberdefense adjustments.
NetworkHoneypot
Paper2025
Material reviewed: AbstractThis work presents a longitudinal analysis of attacker behavior using HoneyTrap, an adaptive honeypot framework deployed across geographically distributed nodes to emulate vulnerable services. According to the authors, more than 60.3 million events were collected over a 24-day window, with data transformed into Parquet format for scalable analytics. The authors report that HTTP/HTTPS traffic and SSH brute-force attacks were predominant, alongside activity targeting less common services like Minecraft and SMB.
NetworkIoTHoneypot
Paper2025
Material reviewed: AbstractThe work addresses classifying CVE vulnerabilities by which are most frequently exploited, using data collected from a T-pot honeypot. The authors describe a data-collection and analysis plan using Elasticsearch, Kibana and Suricata, aimed at identifying vulnerabilities attractive to malicious actors and the risk they pose to Universidad Politécnica Estatal del Carchi.
NetworkHoneypot
Paper2025
Material reviewed: AbstractThe authors present D3O-IIoT, a reinforcement learning model that dynamically coordinates deception techniques such as honeypot deployment, moving target defense, fake telemetry injection, and node isolation, driven by real-time threat monitoring. The defense problem is formulated as a Markov Decision Process, in which a Dueling Deep Q-Network agent maximizes a multi-objective reward to balance attack mitigation, deception engagement, false positive control, and resource cost.
IoTOT/ICSHoneypotMoving target defense
Paper2025
Material reviewed: AbstractAccording to the authors, this work proposes the design and implementation of an LLM-based honeypot simulating an LDAP server, a protocol critical to identity and access management in organizations. The proposed solution aims to offer a flexible and realistic tool capable of convincingly interacting with attackers, contributing to early detection and threat analysis.
IdentityNetworkHoneypot
Paper2025
Material reviewed: AbstractAccording to the authors, this work introduces EtherBee, a global dataset integrating Ethereum node metrics, network traffic metadata, and honeypot interaction logs collected from ten geographically diverse vantage points over three months. The stated purpose is to correlate node data with network sessions and security events to study benign and malicious activity, node stability, and network-level threats, as well as a case study on geographic concentration from client optimizations.
NetworkHoneypot
Paper2025
Material reviewed: Public pageThe study evaluates LLMs for cybersecurity tasks, including honeypot generation, combining knowledge questions with automated assessment of security artifacts.
NetworkHoneypot
Paper2025
Material reviewed: AbstractThis work uses HackIT, a cybersecurity simulation tool, and a human-subject experiment with 88 computer science students to examine how attacker behavior varies across network topologies (ring vs. star) and honeypot densities (50% vs. 75%). The reported outcomes indicate that increased honeypot density maximized decoy interaction but also led to more real-system attacks in centralized (star) networks, whereas decentralized (ring) networks were more robust with fewer honeypots.
NetworkHoneypotDecoy
Paper2025
Material reviewed: Full textBibliographic record on honeypot integration in industrial IoT. The abstract and findings still require review.
OT/ICSHoneypot
Paper2025
Material reviewed: AbstractThe authors propose HoneyFL, a run-time defense against diverse backdoor attacks in federated learning that uses honeypot clients and differential prediction to handle adaptive attacks. The work reports comparative experiments against five state-of-the-art defense baselines, with detection and false-positive rates reported by the authors and an impact on main-task aggregation described as negligible.
Honeypot
Paper2025
Material reviewed: AbstractAccording to the authors, this work proposes a defense paradigm called 'attack as defense' against model extraction attacks. They introduce HoneypotNet, which replaces the victim model's classification layer with a honeypot layer fine-tuned via bi-level optimization to poison any substitute model trained on its outputs, while preserving original performance.
ApplicationHoneypotDecoy
Paper2025
Material reviewed: AbstractThe authors present the Hybrid Cyber Deception System (HCDS), described as a Python-developed proactive tool that combines honeypots and honeytokens in a dynamically adaptive mode to simulate realistic services and redirect attackers in controlled, instrumented settings. The system integrates a deception-driven alerts correlation engine built on Python, Pandas and Scikit-learn, along with Moving Target Defense principles for continuous modulation of network parameters and decoy distribution, and was tested in a simulated environment with Windows and Ubuntu servers to profile attackers and detect complex attack vectors.
NetworkEndpointHoneypotHoneytoken
Paper2025
Material reviewed: AbstractThis paper presents the implementation of a honeynet in which a honeypot acts as a real resource within a production network environment, aiming to divert and mislead attackers and analyze their behavior. According to the authors, the honeypot mimics both scanners and attackers within a simulated, production-level environment.
NetworkHoneypotDecoy
Paper2025
Material reviewed: Public pageProposal describing the addition of a CamouflageNet honeynet and machine learning techniques into the SCADA architecture of an ICS system, aiming to improve defense and the ability to gather information about attackers.
OT/ICSHoneypot
Paper2025
Material reviewed: AbstractThe authors present LLMHoney, an SSH honeypot that uses large language models (LLMs) to generate realistic, dynamic command outputs in real time, combining a dictionary-based virtual file system with LLMs for novel inputs. According to the abstract, the system was evaluated on 138 representative Linux commands across 13 LLM variants, reporting accuracy, latency, and memory metrics, while discussing challenges such as occasional hallucinated outputs.
NetworkEndpointHoneypotDecoy
Paper2025
Material reviewed: AbstractThe article explores Dirichlet distribution topic models for clustering terminal session commands collected from honeypots, aiming to find groups of attacks sharing a common intent and to identify outliers. The authors introduce primary and secondary topics, and session-level and command-level topics, and extend the methods in a Bayesian nonparametric fashion to allow unbounded vocabulary size and number of latent intents.
NetworkHoneypot
Paper2025
Material reviewed: AbstractThis paper models honeypot deployment in cyber-physical systems (CPS) as a signaling game with a fixed gamma ratio, deriving perfect Bayesian-Nash equilibria and proposing a fictitious-play algorithm to determine the optimal honeypot ratio that maximizes defense utility. The authors report numerical results that, as they state, confirm the method's effectiveness.
Honeypot
Paper2025
Material reviewed: AbstractThe authors describe designing and implementing an active defense system on a DATANET server that combines a honeypot to lure and monitor attacker activity with network obfuscation to mask the real network structure and redirect suspicious traffic. They report that the system detected and diverted attacks without disrupting the main service.
NetworkHoneypot
Paper2025
Material reviewed: AbstractThe study integrates a honeypot into an SD-WAN architecture to combine traffic management and threat observation. The proposal routes anomalous activity into a decoy environment that simulates vulnerable services.
NetworkHoneypotDecoy
Paper2025
Material reviewed: AbstractThis paper presents, according to the authors, the first large-scale real-world evaluation of an LLM-based scambaiting system, designed as a conversational honeypot to engage scammers and extract actionable threat intelligence such as mule bank accounts. Over a five-month deployment, the system initiated thousands of engagements, reporting an information disclosure rate and strong alignment between LLM-generated responses and human operator preferences.
IdentityNetworkHoneypotAdversary engagement