Paper2023
Material reviewed: AbstractThe work describes the deployment of an ensemble of research honeypot detectors to analyze and evaluate attackers' behavior. The authors present an outline of a containerized cloud honeypot deployment that they state is portable, durable, and simple to deploy and administer, and they describe instrumented monitoring that generated data points from which inferences about malicious users' activities and purpose could be drawn.
CloudNetworkHoneypotDecoy
Paper2023
Material reviewed: AbstractThe study addresses social engineering attacks, which the authors say exploit human psychology and user awareness, and proposes an automated prevention mechanism that combines honeypots with artificial intelligence and an intrusion prevention system. The stated aim is to detect such attacks, threaten the attacker and restrict his session to keep users away from these manipulation tactics.
NetworkHoneypot
Paper2023
Material reviewed: AbstractThe paper describes implementing a honeypot on Azure Services as a supplement to customary cloud security measures, listing advantages such as prompt attack detection, recognition of attack methods, and safeguarding critical data. The authors outline steps including selecting a virtual machine, installing and configuring honeypot software, deploying monitoring and logging, establishing security groups, running a penetration test, and consistently monitoring the honeypot.
CloudHoneypot
Paper2023
Material reviewed: Full textCritical readingProposes a simulation method for evaluating honeypots and moving target defense in networks.
NetworkHoneypotMoving target defense
Paper2023
Material reviewed: AbstractThe authors present HoneyEVSE, a honeypot designed to simulate Electric Vehicle Supply Equipment (EVSE) within the Vehicle-to-Grid paradigm. The system emulates the charging process and login pages with high fidelity to increase attacker engagement. They exposed the honeypot for 30 days on the Internet and report it successfully evaded the Shodan Honeyscore metric while attracting numerous interactions.
IoTOT/ICSHoneypotDecoy
Paper2023
Material reviewed: AbstractThe authors present HoneyIoT, an adaptive high-interaction honeypot for IoT devices that uses a real-device attack trace collection system and reinforcement learning to model and generate convincing responses. According to the paper, differential analysis techniques mutate response values for high fidelity, and after deployment on the public Internet, reported experiments show the system evades pre-attack checks and honeypot detection tools.
IoTHoneypot
Paper2023
Material reviewed: AbstractThe authors propose a game-theoretic approach for optimal honeypot allocation in tactical networks with dynamic connectivity. They model a two-player dynamic game accounting for future network state evolution, aiming to maximize the attacker's likelihood of hitting a honeypot while minimizing reconfiguration costs. They present an iterative algorithm to find Nash equilibrium strategies and evaluate its scalability through simulations.
NetworkHoneypotDecoy
Paper2023
Material reviewed: AbstractThis thesis presents a honeypot solution to investigate malicious activity in the heiCLOUD environment, showing according to the author a significant increase in attacks. A new concept is proposed to detect firewall leaks in restricted network zones, along with a method for detecting honeypots at the transport level from an attacker's perspective. A customized OpenSSH server is also presented as an intermediary instance to mitigate such efforts.
CloudNetworkHoneypotAdversary engagement
Paper2023
Material reviewed: AbstractThis report reviews the concepts and types of honeypots, which organizations use as decoy networks to lure attackers, and discusses challenges of deploying them along with advantages and disadvantages.
NetworkHoneypotDecoy
Paper2023
Material reviewed: AbstractThe paper by Adam Putra and Ade Eviyanti addresses the security of website form inputs against SQL-injection attacks, and describes the honeypot method as a system or computer deliberately used as bait to become a target for attackers. The authors present this method as a way to prevent website security attacks.
ApplicationHoneypot
Paper2023
Material reviewed: AbstractThe authors propose a deep learning based method to generate synthetic IoT device traffic flows mimicking real traffic, aiming to improve IoT honeypots against attacker detection. According to the abstract, the generator outperforms prior approaches in remaining indistinguishable from real traffic.
IoTNetworkHoneypotDecoy
Paper2023
Material reviewed: AbstractThe authors propose a planning framework to generate a defense strategy that covertly guides an attacker toward a trap state, formulating the problem as an infinite-horizon discounted MDP whose optimal policy serves as the defender's strategy. According to the abstract, this formulation is applicable to systems such as honeypots or honeynets, and the authors report empirically evaluating the merits of their approach.
NetworkHoneypotAdversary engagement
Paper2023
Material reviewed: AbstractThe authors propose a backdoor-resistant fine-tuning procedure for pretrained language models, integrating a 'honeypot' module designed to exclusively absorb backdoor information present in poisoned training samples. By penalizing the information captured by this module during fine-tuning, the authors report a reduction in backdoor attack success rate compared to prior methods.
ApplicationHoneypot
Paper2023
Material reviewed: AbstractThis study, according to its authors, investigates whether honeypots and honeynets described in the literature actually incorporate autonomic computing principles, beyond the use of terms like adaptive or intelligent. The authors analyze the frequency of keywords related to self-configuration, self-healing, self-protection, and self-optimization in a literature sample, finding low presence of the first three and notable presence of the latter.
NetworkHoneypot
Paper2022
Material reviewed: AbstractThis paper describes information acquired from a Secure Shell honeypot, including plaintext login credentials and attack data. The authors present a low-interaction honeypot aimed at organizations with limited resources that records, analyzes and sends notifications about suspicious network traffic, with the stated goal of encouraging the development and adoption of practical honeypot solutions.
NetworkHoneypot
Paper2022
Material reviewed: Public pageProposes a hybrid framework with two types of honeypots to relieve the flaws of each type and offer the benefits of both, aiming to detect and mitigate DDoS attacks against a webserver.
NetworkHoneypot
Paper2022
Material reviewed: AbstractThe authors propose a game-based collaborative defense approach for UAV networks, using low/medium-interaction honeypots and contract-based incentive mechanisms combined with reinforcement learning to encourage UAVs to share captured attack data.
NetworkIoTHoneypot
Paper2022
Material reviewed: AbstractThis paper explores deploying a honeypot system as a deception mechanism to gather intelligence about attackers. According to the authors, the system can capture information such as the attacker's autonomous system, penetration techniques, attack types, executed commands, and downloaded malware. The authors demonstrate a reproducible experiment using open-source tools to implement such a system.
NetworkHoneypotAdversary engagement
Paper2022
Material reviewed: AbstractThe authors compare the low-interaction honeypot Dionaea and the medium-interaction honeypot Cowrie against port scanning, SSH brute force and DoS. The study aims to assess attack capture, interaction with the attacker, and effects on network metrics and resource usage.
NetworkHoneypot
Paper2022
Material reviewed: AbstractAccording to the authors' abstract, this paper proposes a game-theoretic and reinforcement learning approach to incentivize collaboration among UAVs in low/medium interaction honeypot defense, addressing optimal contract design under partial and complete information asymmetry. The authors state that simulations show improved cooperation and defensive effectiveness compared to conventional schemes.
NetworkIoTHoneypotAdversary engagement
Paper2022
Material reviewed: AbstractThe paper introduces honeypots, their classification by purpose and interaction, and compares open-source tools across various aspects. Its purpose is to help readers protect resources from intruders using freely available network security tools.
NetworkHoneypot
Paper2022
Material reviewed: Public pageThe paper describes a honeypot architecture combining social-network recruitment, decoy websites and warning messages to study prevention of online child exploitation. The authors document educational studies using legal content without hosting child exploitation material.
ApplicationHoneypot
Paper2022
Material reviewed: AbstractAmid information systems' growing exposure to cyber attacks, intrusion attempts and sophisticated malware, the author frames a need for organisations to better understand the actors behind threats and the methods they employ in order to improve their threat intelligence strategy. The article presents the use of a honeypot as one solution for gathering information about the specific cyberthreats an organisation faces.
NetworkHoneypot
Paper2022
Material reviewed: AbstractThe paper describes an experiment design in which a hacker infiltrates a server and escalates privileges, and presents the Honeypsy system to correlate the hacker's recorded actions with experience, personality, and psychology. The system combines a Big-5 personality test, a cyber expertise test, and a capture-the-flag (CTF) event with a deployed honeypot to collect activity logs, with the stated aim of predicting the expertise and personality of unknown hackers and supporting the development of defense strategies.
NetworkHoneypot