Paper2025
Material reviewed: AbstractThe authors present LLMHoney, an SSH honeypot that uses large language models (LLMs) to generate realistic, dynamic command outputs in real time, combining a dictionary-based virtual file system with LLMs for novel inputs. According to the abstract, the system was evaluated on 138 representative Linux commands across 13 LLM variants, reporting accuracy, latency, and memory metrics, while discussing challenges such as occasional hallucinated outputs.
NetworkEndpointHoneypotDecoy
Paper2025
Material reviewed: AbstractThe article explores Dirichlet distribution topic models for clustering terminal session commands collected from honeypots, aiming to find groups of attacks sharing a common intent and to identify outliers. The authors introduce primary and secondary topics, and session-level and command-level topics, and extend the methods in a Bayesian nonparametric fashion to allow unbounded vocabulary size and number of latent intents.
NetworkHoneypot
Paper2025
Material reviewed: AbstractThe authors propose a neuro-symbolic fusion approach for cognitive threat reasoning in cyber deception environments. It combines deep neural networks with symbolic reasoning, using knowledge graphs, probabilistic logic, and reinforcement learning to identify, predict, and respond to adversaries and to optimize deception strategies.
NetworkDecoyAdversary engagement
Paper2025
Material reviewed: AbstractThis paper models honeypot deployment in cyber-physical systems (CPS) as a signaling game with a fixed gamma ratio, deriving perfect Bayesian-Nash equilibria and proposing a fictitious-play algorithm to determine the optimal honeypot ratio that maximizes defense utility. The authors report numerical results that, as they state, confirm the method's effectiveness.
Honeypot
Paper2025
Material reviewed: AbstractThe authors describe designing and implementing an active defense system on a DATANET server that combines a honeypot to lure and monitor attacker activity with network obfuscation to mask the real network structure and redirect suspicious traffic. They report that the system detected and diverted attacks without disrupting the main service.
NetworkHoneypot
Paper2025
Material reviewed: AbstractThe study integrates a honeypot into an SD-WAN architecture to combine traffic management and threat observation. The proposal routes anomalous activity into a decoy environment that simulates vulnerable services.
NetworkHoneypotDecoy
Paper2025
Material reviewed: AbstractThis paper presents, according to the authors, the first large-scale real-world evaluation of an LLM-based scambaiting system, designed as a conversational honeypot to engage scammers and extract actionable threat intelligence such as mule bank accounts. Over a five-month deployment, the system initiated thousands of engagements, reporting an information disclosure rate and strong alignment between LLM-generated responses and human operator preferences.
IdentityNetworkHoneypotAdversary engagement
Paper2025
Material reviewed: AbstractThe authors present ShadowKube, an active defense framework for Kubernetes that integrates behavioral monitoring with shadow honeypots to detect and neutralize anomalous behavior. The approach establishes behavioral baselines to identify deviations and converts compromised nodes into honeypots, with the stated purpose of isolating and trapping attackers in intrusions targeting container orchestration.
CloudApplicationHoneypotDecoy
Paper2025
Material reviewed: Public pageThe authors review social engineering and describe, among other defenses, honeypots that simulate human interaction, such as email responses or chatbot interactions, to lure and log attack attempts.
NetworkApplicationHoneypot
Paper2025
Material reviewed: AbstractThis study proposes SPADE, a framework that uses generative AI models alongside structured prompt engineering to automate the creation of adaptive cyber deception strategies against dynamic malware. According to the authors, the framework addresses challenges of large language models such as generalized outputs, ambiguity, and scalability constraints, and was evaluated across diverse malware scenarios using metrics like Recall, Exact Match, BLEU, and expert quality assessments, identifying ChatGPT-4o as the top performer.
EndpointNetworkAdversary engagementDecoy
Paper2025
Material reviewed: AbstractThis study, as described by the authors, explores the use of AI agents to automate the analysis of logs generated by the Cowrie honeypot, addressing the scarcity of real-world attack data in cybersecurity research. The proposed approach uses AI agents to parse, summarize, and extract insights from unstructured data, while also considering the security implications of deploying such an autonomous system.
NetworkHoneypot
Paper2025
Material reviewed: AbstractAccording to the authors, this study proposes a Stackelberg game-based framework for strategically timing cyber deception, combining a tactical layer modeling attacker-defender dynamics via a one-sided information Markov game with a strategic layer optimizing deception timing and selection through a stopping-time decision process. Numerical experiments, as reported by the authors, suggest that strategically timed deception can improve the defender's expected utility compared to baseline strategies.
NetworkAdversary engagementDecoy
Paper2024
Material reviewed: AbstractThe authors present a generative model-based honeypot (using an LSTM network) designed to mimic industrial OPC UA communication in operational technology (OT) systems. The model learns the characteristics of a cyclic mechatronic system from recorded state space trajectories. The work proposes a proof-of-concept and publishes a dataset of a cyclic industrial process to support future research.
OT/ICSHoneypot
Paper2024
Material reviewed: Publisher metadataDOI-identified publication on language-model honeytoken generation; text analysis is pending.
IdentityHoneytoken
Paper2024
Material reviewed: AbstractThe authors address the difficulty that traditional honeypot implementations are evaded by advanced adversaries such as APT groups, and propose designing and deploying a customized honeypot network based on adaptive camouflaging techniques. The work describes orchestrating a behavioral honeypot network tailored to three APT groups, with attack paths aligned with their tactics, techniques, and procedures, and includes a camouflaged chatterbox application deployed for 100 days; according to the deposited abstract, the setup recorded 13,906,945 hits from 4,238 unique IP addresses and was used to categorize attackers.
NetworkApplicationHoneypotDecoy
Paper2024
Material reviewed: Public pageThe paper proposes a honeypot layer to support security in an optical network with cloud services. The decoys simulate vulnerable resources to attract attackers and observe their behavior.
NetworkHoneypotDecoy
Paper2024
Material reviewed: Public pageProposes using hardware honeypots as an additional defensive layer to detect and mitigate hardware Trojans in IoT devices, aiming to protect them from operational failures, denial of service, or data leakage.
IoTHoneypot
Paper2024
Material reviewed: Full textBibliographic record on application-layer deception. The abstract and findings still require review.
ApplicationDecoy
Paper2024
Material reviewed: AbstractAccording to the authors, this paper introduces IndisUAT, a new method for generating universal adversarial triggers (UAT) against NLP models that bypasses DARCY, a honeypot-based defense that baits multiple trapdoors to detect adversarial examples. The authors state that IndisUAT produces adversarial examples whose feature distribution is indistinguishable from benign examples, reducing DARCY's detection effectiveness and that of other defenses across several models.
ApplicationHoneypot
Paper2024
Material reviewed: AbstractThe authors analyze robocall data from multiple independent vantage points, including academic and industry voice honeypots, to study the effectiveness of telephone spam prevention and mitigation efforts. The work compares disparate data sources over more than 5 years, including audio and transcripts from millions of calls, to assess trends and spammer adaptation to authentication schemes like STIR/SHAKEN.
NetworkHoneypot
Paper2024
Material reviewed: AbstractThis paper addresses automated content generation for honeyfiles, decoy documents designed to detect intruders. The authors focus on generating realistic charts within such documents, combining a multitask Transformer for captions and plot text with a specialized autoencoder for underlying tabular data. They also introduce a new dataset and a metric (Keyword Semantic Matching) to evaluate semantic consistency of generated content.
EndpointHoneypotDecoy
Paper2024
Material reviewed: AbstractAccording to the authors, this paper proposes a cyber deception mechanism that stealthily redirects TCP communications to an on-demand honeypot server cloned to resemble the victim asset. The stated goal is to make attackers focus on the decoy server, enabling threat intelligence collection while protecting the real asset.
NetworkHoneypotDecoy
Paper2024
Material reviewed: Full textCritical readingSurvey proposing a taxonomy and comparing cyber deception research lines, including AI-based work.
NetworkCloudAdversary engagement
Paper2024
Material reviewed: Public pageThe article connects strategic principles from Chanakya's Arthashastra with digital defense and presents honeypots as a means of attracting attackers into controlled environments to observe their tactics.
Honeypot