Paper2025
Material reviewed: AbstractThe authors present ShadowKube, an active defense framework for Kubernetes that integrates behavioral monitoring with shadow honeypots to detect and neutralize anomalous behavior. The approach establishes behavioral baselines to identify deviations and converts compromised nodes into honeypots, with the stated purpose of isolating and trapping attackers in intrusions targeting container orchestration.
CloudApplicationHoneypotDecoy
Paper2025
Material reviewed: Public pageThe authors review social engineering and describe, among other defenses, honeypots that simulate human interaction, such as email responses or chatbot interactions, to lure and log attack attempts.
NetworkApplicationHoneypot
Paper2025
Material reviewed: AbstractThis study, as described by the authors, explores the use of AI agents to automate the analysis of logs generated by the Cowrie honeypot, addressing the scarcity of real-world attack data in cybersecurity research. The proposed approach uses AI agents to parse, summarize, and extract insights from unstructured data, while also considering the security implications of deploying such an autonomous system.
NetworkHoneypot
Paper2024
Material reviewed: AbstractThe authors present a generative model-based honeypot (using an LSTM network) designed to mimic industrial OPC UA communication in operational technology (OT) systems. The model learns the characteristics of a cyclic mechatronic system from recorded state space trajectories. The work proposes a proof-of-concept and publishes a dataset of a cyclic industrial process to support future research.
OT/ICSHoneypot
Paper2024
Material reviewed: AbstractThe authors address the difficulty that traditional honeypot implementations are evaded by advanced adversaries such as APT groups, and propose designing and deploying a customized honeypot network based on adaptive camouflaging techniques. The work describes orchestrating a behavioral honeypot network tailored to three APT groups, with attack paths aligned with their tactics, techniques, and procedures, and includes a camouflaged chatterbox application deployed for 100 days; according to the deposited abstract, the setup recorded 13,906,945 hits from 4,238 unique IP addresses and was used to categorize attackers.
NetworkApplicationHoneypotDecoy
Paper2024
Material reviewed: Public pageThe paper proposes a honeypot layer to support security in an optical network with cloud services. The decoys simulate vulnerable resources to attract attackers and observe their behavior.
NetworkHoneypotDecoy
Paper2024
Material reviewed: Public pageProposes using hardware honeypots as an additional defensive layer to detect and mitigate hardware Trojans in IoT devices, aiming to protect them from operational failures, denial of service, or data leakage.
IoTHoneypot
Paper2024
Material reviewed: AbstractAccording to the authors, this paper introduces IndisUAT, a new method for generating universal adversarial triggers (UAT) against NLP models that bypasses DARCY, a honeypot-based defense that baits multiple trapdoors to detect adversarial examples. The authors state that IndisUAT produces adversarial examples whose feature distribution is indistinguishable from benign examples, reducing DARCY's detection effectiveness and that of other defenses across several models.
ApplicationHoneypot
Paper2024
Material reviewed: AbstractThe authors analyze robocall data from multiple independent vantage points, including academic and industry voice honeypots, to study the effectiveness of telephone spam prevention and mitigation efforts. The work compares disparate data sources over more than 5 years, including audio and transcripts from millions of calls, to assess trends and spammer adaptation to authentication schemes like STIR/SHAKEN.
NetworkHoneypot
Paper2024
Material reviewed: AbstractThis paper addresses automated content generation for honeyfiles, decoy documents designed to detect intruders. The authors focus on generating realistic charts within such documents, combining a multitask Transformer for captions and plot text with a specialized autoencoder for underlying tabular data. They also introduce a new dataset and a metric (Keyword Semantic Matching) to evaluate semantic consistency of generated content.
EndpointHoneypotDecoy
Paper2024
Material reviewed: AbstractAccording to the authors, this paper proposes a cyber deception mechanism that stealthily redirects TCP communications to an on-demand honeypot server cloned to resemble the victim asset. The stated goal is to make attackers focus on the decoy server, enabling threat intelligence collection while protecting the real asset.
NetworkHoneypotDecoy
Paper2024
Material reviewed: Public pageThe article connects strategic principles from Chanakya's Arthashastra with digital defense and presents honeypots as a means of attracting attackers into controlled environments to observe their tactics.
Honeypot
Paper2024
Material reviewed: Public pageIt proposes simulating, transforming and integrating synthetic honeypot logs into a graph database using the STIX model, aiming to convert attack data into interconnected threat intelligence objects for visualization and exploration. The purpose is to provide security operations centers with a standardized platform that enhances situational awareness and decision-making support.
NetworkHoneypot
Paper2024
Material reviewed: AbstractThe authors address a scenario where a defender of a networked control system has isolated an intruder and redirects them toward a honeypot emulating the real system without connection to a physical plant. They propose an adversary engagement strategy within this decoy environment to increase the attacker's information-processing costs by spoofing sensor readings based on cyber threat intelligence. They perform a numerical comparison between cases of perfect and imperfect threat intelligence.
OT/ICSNetworkHoneypotAdversary engagement
Paper2024
Material reviewed: AbstractAccording to the authors, this paper reviews the use of large language models (LLMs) in malware detection, including applications to malware honeypots, text-based threat identification, code analysis, and trend detection. The authors propose a classification scheme, performance metrics, and an LLM-based risk mitigation framework, evaluating its performance against LLM-enabled malware.
EndpointHoneypot
Paper2024
Material reviewed: AbstractThis work, according to its authors, addresses security in Advanced Metering Infrastructure (AMI) for smart grids using honeypots combined with federated learning. They propose FedPot, which includes a data quality measure and a fair incentive mechanism allowing small power suppliers to share locally trained models with traditional retailers without exposing confidential data. The authors report, via simulations on realistic microgrid log datasets, improvements over state-of-the-art techniques in both the security model and reward distribution.
OT/ICSIoTHoneypot
Paper2024
Material reviewed: AbstractAccording to the authors, this paper explores the use of Generative Adversarial Networks (GANs) to generate decoy configurations for cyber defense. They note that existing approaches rely on maintained lists of configurations or pre-configured images with limited adaptability, and present what they describe as the first attempt to use GANs specifically for generating decoy configurations, aiming to provide defenders with a tool to strengthen network defenses.
NetworkHoneypotDecoy
Paper2024
Material reviewed: Full textCritical readingPresents a language-model terminal honeypot architecture and describes a field evaluation.
NetworkHoneypot
Paper2024
Material reviewed: AbstractReview of the honeypot as a decoy system simulating an isolated real system on a network to entice attackers and detect, block or foresee attempts at unauthorized access. The authors describe a monitoring arrangement linking honeypot, main network and system-admin so hostile activity is detected before the main network is affected.
NetworkHoneypot
Paper2024
Material reviewed: AbstractThe paper assesses a specific group of honeypot systems based on criteria such as detection range, emulation accuracy, data quality, dependability, scalability, and ease of setup, and draws conclusions about their relative effectiveness in different situations. It also discusses recent developments in honeypot technology, including machine learning enhancements, increased automation, integration with other security tools, cloud-based honeypots, and deception technology, using simulated attacks to demonstrate how these systems log and record attack information.
NetworkCloudHoneypotDecoy
Paper2024
Material reviewed: AbstractThe work addresses automating honeypot deployment using Ansible and a web application that also monitors the process. The authors describe their purpose of reducing the time and resources of manual deployment and report tests on sensors running on Google Cloud Platform.
CloudHoneypot
Paper2024
Material reviewed: AbstractThe authors investigate whether peer-to-peer (P2P) overlay network nodes, specifically Ethereum network nodes, attract heightened reconnaissance attacks due to their visibility and sustained uptime. They deploy a series of honeypots alongside real Ethereum nodes across globally distributed vantage points. The authors report findings on specific attack types targeting particular ports and services, extending the analysis through port scans on other reachable peers.
NetworkHoneypot
Paper2024
Material reviewed: AbstractThe study proposes a malware detection system that combines Particle Swarm Optimization (PSO) with a fuzzyKNN model, using PSO to select a feature set from a malware dataset and employing a honeypot as a controlled environment for collecting samples and training the model. The authors compare their method against standard detection techniques and report that the PSO-fuzzyKNN approach enhances malware detection accuracy.
EndpointHoneypot
Paper2024
Material reviewed: AbstractThe authors propose a network design for honeypot placement and an intrusion detection system aimed at identifying and alerting on illicit access, using traffic logs. They use datasets derived from a honeypot implementation and KDD-99, trained with generative adversarial networks, a deep learning-based generative model.
NetworkHoneypot