Paper2025
Material reviewed: AbstractThe authors present a simulated Gym-based environment for adversarial reinforcement learning in network security, where attacker and defender agents trained with DQN compete under a zero-sum reward framework. The environment models brute-force attacks and reactive defenses, including honeypot traps and adaptive rate-limiting, and the authors report that defender observability and trap effectiveness create substantial barriers to successful attacks.
NetworkHoneypotAdversary engagement
Paper2025
Material reviewed: AbstractThe paper describes an intrusion detection system based on machine learning, enhanced by integrating the Cowrie honeypot to capture attacker behavioral data and thereby improve detection of indicators of compromise and attack patterns. The authors present an isolated multi-VM architecture, supervised and unsupervised models (Random Forest, Logistic Regression, Isolation Forest), a Flask API for real-time classification, and Kibana and Power BI dashboards, aiming to detect both known and unknown threats.
NetworkHoneypot
Paper2025
Material reviewed: AbstractThe authors propose ADLAH, a conceptual adaptive honeynet architecture using reinforcement learning to decide in real time when to escalate sessions from low-interaction sensors to dynamically provisioned high-interaction honeypots. It is described as a functional prototype of the central decision mechanism, without field-scale validation due to insufficient live data.
NetworkHoneypotAdversary engagement
Paper2025
Material reviewed: AbstractThe authors present ADIRDS, an online monitoring system that models the real system as a graph and monitors critical assets, deploying realistic honeypots with business context similar to the real system to trap attackers and collect evidence when logs are insufficient. According to the authors, they applied the system to a real case, capturing 38 unique attacker IP addresses.
NetworkHoneypotDecoy
Paper2025
Material reviewed: Public pageThe paper studies files uploaded by attackers to a cloud honeypot and uses them to compare signature-based detection by antivirus programs.
CloudHoneypot
Paper2025
Material reviewed: AbstractThe study analyzes malicious actors' patterns and tactics using a modified T-Pot Honeypot, with multiple honeypots in Docker containers emulating vulnerable services. It aims to collect and analyze exploitation, evasion and credential attempts to characterize threats and inform cyberdefense adjustments.
NetworkHoneypot
Paper2025
Material reviewed: AbstractAccording to the authors, this paper proposes a bi-level cyber warfare game framework for designing defensive deception mechanisms that exploit the cognitive vulnerabilities of Advanced Persistent Threat (APT) attackers. The approach combines strategic-level deception design with tactical and operational actions, and the authors report numerical improvements in defender rewards through strategically timed deception deployment.
NetworkAdversary engagement
Paper2025
Material reviewed: AbstractThis work presents a longitudinal analysis of attacker behavior using HoneyTrap, an adaptive honeypot framework deployed across geographically distributed nodes to emulate vulnerable services. According to the authors, more than 60.3 million events were collected over a 24-day window, with data transformed into Parquet format for scalable analytics. The authors report that HTTP/HTTPS traffic and SSH brute-force attacks were predominant, alongside activity targeting less common services like Minecraft and SMB.
NetworkIoTHoneypot
Paper2025
Material reviewed: AbstractThe work addresses classifying CVE vulnerabilities by which are most frequently exploited, using data collected from a T-pot honeypot. The authors describe a data-collection and analysis plan using Elasticsearch, Kibana and Suricata, aimed at identifying vulnerabilities attractive to malicious actors and the risk they pose to Universidad Politécnica Estatal del Carchi.
NetworkHoneypot
Paper2025
Material reviewed: AbstractThe authors present D3O-IIoT, a reinforcement learning model that dynamically coordinates deception techniques such as honeypot deployment, moving target defense, fake telemetry injection, and node isolation, driven by real-time threat monitoring. The defense problem is formulated as a Markov Decision Process, in which a Dueling Deep Q-Network agent maximizes a multi-objective reward to balance attack mitigation, deception engagement, false positive control, and resource cost.
IoTOT/ICSHoneypotMoving target defense
Paper2025
Material reviewed: AbstractAccording to the authors, this work proposes the design and implementation of an LLM-based honeypot simulating an LDAP server, a protocol critical to identity and access management in organizations. The proposed solution aims to offer a flexible and realistic tool capable of convincingly interacting with attackers, contributing to early detection and threat analysis.
IdentityNetworkHoneypot
Paper2025
Material reviewed: AbstractThis work presents a machine learning-driven methodology combining cryptic and mimetic cyber deception principles to protect integrated circuits against reverse engineering attacks, using a variational autoencoder (AIG-VAE) and new covert gate variants. The authors report that experiments show effectiveness in maintaining functionality while achieving high camouflage and similarity scores.
EndpointDecoy
Paper2025
Material reviewed: AbstractAccording to the authors, this work introduces EtherBee, a global dataset integrating Ethereum node metrics, network traffic metadata, and honeypot interaction logs collected from ten geographically diverse vantage points over three months. The stated purpose is to correlate node data with network sessions and security events to study benign and malicious activity, node stability, and network-level threats, as well as a case study on geographic concentration from client optimizations.
NetworkHoneypot
Paper2025
Material reviewed: AbstractThe study compares proposed metrics for honeyfile attributes—Common Token Count and Topic Semantic Matching for enticement, and coherence and cohesion for realism—against human users' perceptions as they judged text samples in a simulated data breach scenario on a crowd-sourcing platform. The authors report that Topic Semantic Matching aligned with perceived enticement, whereas results for Common Token Count were inconsistent and inconclusive, and coherence and cohesion did not consistently align with perceived realism.
HoneytokenDecoy
Paper2025
Material reviewed: Public pageThe study evaluates LLMs for cybersecurity tasks, including honeypot generation, combining knowledge questions with automated assessment of security artifacts.
NetworkHoneypot
Paper2025
Material reviewed: AbstractThis work uses HackIT, a cybersecurity simulation tool, and a human-subject experiment with 88 computer science students to examine how attacker behavior varies across network topologies (ring vs. star) and honeypot densities (50% vs. 75%). The reported outcomes indicate that increased honeypot density maximized decoy interaction but also led to more real-system attacks in centralized (star) networks, whereas decentralized (ring) networks were more robust with fewer honeypots.
NetworkHoneypotDecoy
Paper2025
Material reviewed: Full textBibliographic record on honeypot integration in industrial IoT. The abstract and findings still require review.
OT/ICSHoneypot
Paper2025
Material reviewed: AbstractThe authors propose HoneyFL, a run-time defense against diverse backdoor attacks in federated learning that uses honeypot clients and differential prediction to handle adaptive attacks. The work reports comparative experiments against five state-of-the-art defense baselines, with detection and false-positive rates reported by the authors and an impact on main-task aggregation described as negligible.
Honeypot
Paper2025
Material reviewed: AbstractAccording to the authors, this work proposes a defense paradigm called 'attack as defense' against model extraction attacks. They introduce HoneypotNet, which replaces the victim model's classification layer with a honeypot layer fine-tuned via bi-level optimization to poison any substitute model trained on its outputs, while preserving original performance.
ApplicationHoneypotDecoy
Paper2025
Material reviewed: AbstractThe authors present the Hybrid Cyber Deception System (HCDS), described as a Python-developed proactive tool that combines honeypots and honeytokens in a dynamically adaptive mode to simulate realistic services and redirect attackers in controlled, instrumented settings. The system integrates a deception-driven alerts correlation engine built on Python, Pandas and Scikit-learn, along with Moving Target Defense principles for continuous modulation of network parameters and decoy distribution, and was tested in a simulated environment with Windows and Ubuntu servers to profile attackers and detect complex attack vectors.
NetworkEndpointHoneypotHoneytoken
Paper2025
Material reviewed: Public pageThe authors describe a web-based classroom reservation system in which they implement a hidden honeypot field in the booking form: invisible to humans but fillable by bots, so submissions with that field completed are rejected.
ApplicationDecoy
Paper2025
Material reviewed: AbstractThis paper presents the implementation of a honeynet in which a honeypot acts as a real resource within a production network environment, aiming to divert and mislead attackers and analyze their behavior. According to the authors, the honeypot mimics both scanners and attackers within a simulated, production-level environment.
NetworkHoneypotDecoy
Paper2025
Material reviewed: Public pageProposal describing the addition of a CamouflageNet honeynet and machine learning techniques into the SCADA architecture of an ICS system, aiming to improve defense and the ability to gather information about attackers.
OT/ICSHoneypot
Paper2025
Material reviewed: AbstractThe authors present Koney, a Kubernetes operator that orchestrates cyber deception technology deployment through deception policy documents described as code. Using cloud-native technologies such as service meshes and eBPF, the system adds traps to containerized applications without source code access, facilitating setup, rotation, monitoring, and removal of traps, emphasizing maintainability, scalability, and operational simplicity.
CloudApplicationDecoyAdversary engagement