Paper2024
Material reviewed: Public pageThe review examines AI integration with SOAR, including dynamic orchestration of honeypots that present an apparent vulnerability and collect intelligence on attacker methods.
NetworkOT/ICSHoneypot
Paper2024
Material reviewed: AbstractThe authors present LLM Honeypot, a system that augments a standard SSH honeypot with prompt injection and time-based analysis techniques to distinguish autonomous AI agents among attackers. Over a roughly three-month trial deployment in a public environment, they recorded millions of hacking attempts and identified a small number of potential AI agents. The work aims to serve as an early warning of malicious LLM agent usage in the wild.
NetworkHoneypot
Paper2024
Material reviewed: Full textCritical readingPresents an interactive honeypot using a language model fine-tuned with attacker command data.
NetworkHoneypot
Paper2024
Material reviewed: Full textOf 184 responses judged plausible by experts, participants also classified 167 as plausible (90.8%). This measures responses in this test, not deception of real attackers.
NetworkHoneypot
Paper2024
Material reviewed: AbstractThe authors propose LLMPot, an approach for designing honeypots in Industrial Control System (ICS) networks using large language models (LLMs). The goal is to automate the creation of realistic, vendor-agnostic honeypots capable of emulating industrial protocols and PLC control logic, reducing the manual effort traditionally required in this domain.
OT/ICSNetworkHoneypotDecoy
Paper2024
Material reviewed: AbstractAccording to the authors, this paper initiates a systematic study of a new honeypot deployment paradigm that blends honeypot computers into production computers. They formalize the Honeypot Deployment (HD) problem as a combinatorial optimization problem, prove its NP-hardness, propose a near-optimal algorithm (a polynomial-time approximation scheme), and conduct simulations to assess the impact of attacker capabilities.
NetworkHoneypot
Paper2024
Material reviewed: AbstractThis work aims to develop a drone-based surveillance mission system when Denial-of-Service (DoS) attacks disrupt normal operations. The authors introduce cyber deception via honey drones (HDs) that exhibit fake vulnerabilities and use stronger signal strengths to lure DoS attacks, formulate an optimization problem over HD and mission drone signal strengths, and solve it using deep reinforcement learning (DRL) with the Asynchronous Advantage Actor-Critic (A3C) algorithm, evaluated in a physical engine-based simulation testbed.
HoneypotDecoy
Paper2024
Material reviewed: AbstractPilot study exploring a deception-based honeypot using deep learning, integrated via an injection approach on web servers, aiming to minimize security breaches and detect intrusive malware activity. The authors report identification capabilities as the system learns and defends a user system against intrusive actions.
ApplicationHoneypot
Paper2024
Material reviewed: AbstractThe study describes a two-tier deception-driven security model intended to mislead potential attackers and protect network resources using decoys, honeypots, and deceptive network segments. The authors report on deploying and testing the model to assess its efficacy and feasibility in practice, and argue that integrating deception techniques into cybersecurity frameworks can provide a protective layer.
NetworkHoneypotDecoy
Paper2024
Material reviewed: AbstractAccording to the authors, this work proposes a reconfigurable and scalable honeynet for cyber-physical systems, focused on industrial control systems (ICS). The approach includes automatic generation of attacks to test and validate the honeynet, aiming to serve as a basis for producing datasets to train attack detection and classification algorithms.
OT/ICSHoneypot
Paper2024
Material reviewed: AbstractThe work addresses security in Internet of Things (IoT) ecosystems in smart cities by using honeypot data and machine learning and neural network algorithms for attack detection. The authors set out to identify datasets from IoT-targeted honeypots, evaluate threat detection algorithms, and propose security solutions, analyzing real-world cyber-attack data from diverse honeypots simulating IoT devices.
IoTHoneypot
Paper2024
Material reviewed: AbstractThe paper examines the origin of trust in trust management systems by linking it to the network attack rate, aiming to refine trust assessments and predict new attacks. The authors describe a strategy combining machine learning and dynamic honeypots to detect prepared-for attacks and predict unprepared-for attacks in vehicular ad hoc networks (VANETs).
NetworkHoneypot
Paper2024
Material reviewed: AbstractAccording to the authors, this paper presents a self-adaptive traffic anomaly detection system for IoT smart home environments, consisting of a honeypot server and a gateway. The honeypot continuously captures traffic and adaptively generates a detection model used by the gateway to identify anomalous traffic, including unknown attacks.
IoTNetworkHoneypot
Paper2024
Material reviewed: AbstractThe authors formulate a two-player dynamic game to model honeypot allocation in tactical networks whose connectivity changes with node mobility. They propose an iterative algorithm to find Nash equilibria and assess scalability through compact states and sensitivity analysis under imperfect information.
NetworkHoneypot
Paper2024
Material reviewed: AbstractThe authors present a side-channel method for covertly identifying industrial control system (ICS) honeypots using time-to-live (TTL) values in the ICMP protocol. In a study of over 8,000 devices presenting as ICS systems, they compare their approach to existing honeypot detection methods and describe what their methodology reveals about the current population of live ICS honeypots.
OT/ICSNetworkHoneypot
Paper2024
Material reviewed: AbstractThis work-in-progress paper studies the implementation of deception-in-depth strategies with three initial logical layers: network, host, and data. The authors draw on ideas from military deception, network orchestration, software deception, file deception, fake honeypots, and moving-target defenses, and are building a prototype to test in adversarial environments. According to the authors, the goal is to show that deploying a broad range of deception techniques can better protect systems than single techniques, with a focus on discouraging attacks rather than encouraging attacker engagement.
NetworkEndpointHoneypotDecoy
Paper2023
Material reviewed: AbstractThis paper proposes an adaptive experimental design (AD) method, inspired by randomized clinical trials, to study causal relationships between the design of intrusion data collection environments (such as honeypots) and the data observed. The authors state they conducted the first controlled and adaptive honeypot deployment study to measure how an SSH vulnerability affects server exploitation rates, reporting reductions in deployment time and resources needed.
NetworkHoneypot
Paper2023
Material reviewed: AbstractThis work examines adversarial reconnaissance mitigation techniques, including deception strategies such as honeypots, and reviews the literature on deception games from the perspective of modeling adversarial reconnaissance. The authors highlight aspects of reconnaissance they state have not been adequately captured in prior work, and present a probability-theory based model of adversaries' belief formation, illustrated with numerical examples.
NetworkHoneypotAdversary engagement
Paper2023
Material reviewed: AbstractThe authors propose a honeypot for IoT devices that uses machine learning techniques to automatically learn and interact with attackers, aiming to overcome the limitations of manually crafting low- and high-interaction honeypots given device heterogeneity. According to the abstract, evaluation of the proposed model indicates improvements in session length with attackers and in capturing more attacks on the IoT network.
IoTHoneypot
Paper2023
Material reviewed: AbstractThis study examines how different probing costs affect adversarial decision-making in a deception game, using an IBLT model with delayed feedback to simulate human behavior. According to the authors, probing slightly decreased as its cost increased, while the proportion of attacks remained relatively stable. The authors conclude that different probing costs do not significantly affect the proportion of attacks but have a slight impact on the proportion of probing.
NetworkHoneypotAdversary engagement
Paper2023
Material reviewed: AbstractThis paper examines attack patterns in a large public dataset of geographically distributed honeypots, addressing methodological questions and building attacker behavioural profiles. According to the authors, results show honeypot location helps identify attack patterns and profiles, concluding that not all collected intelligence is equally valuable and that an effective early warning system may be built with only two distributed honeypots and a production server.
NetworkHoneypot
Paper2023
Material reviewed: AbstractThe paper proposes a honeypot-based deception approach for Internet-connected video cameras. Its abstract places the proposal in the security and privacy risks of cameras and other video-capable IoT devices.
IoTHoneypot
Paper2023
Material reviewed: AbstractAccording to its authors, this paper studies a Stackelberg game between attacker and defender over large, dynamic Active Directory (AD) attack graphs, where the defender deploys honeypots to prevent the attacker from reaching high-value targets. The authors propose a mixed-integer programming (MIP) formulation and a clustering-based approach (dyMIP(m)) to handle large dynamic graph instances, reporting near-optimal results under realistic conditions.
IdentityNetworkHoneypot
Paper2023
Material reviewed: AbstractThis paper explores using ChatGPT-style conversational agents as a dynamic honeypot interface, imitating Linux, Mac, and Windows terminal commands and tools like TeamViewer, nmap, and ping. The authors present ten feasibility tasks intended for defensive teams to simulate honeypot interfaces with minimal risk, aiming to delay or understand attacker tactics, techniques, and procedures.
NetworkEndpointHoneypot