Paper2021
Material reviewed: Public pageThe linked preprint abstract describes DARLH, a honeypot system that uses deep reinforcement learning-based and deep recurrent neural network-based IDS agents to detect internal and external runtime DoS attacks. Its purpose is to provide dynamic intrusion detection and event validation for monitoring DoS attacks in the honeypot environment.
NetworkHoneypotDecoy
Paper2021
Material reviewed: AbstractThe paper describes the use of honeypot agents that generate Route Request (RREQ) packets to attract and entrap black hole attackers in mobile ad hoc networks (MANETs), together with a deep learning technique based on Long-Short Term Memory (LSTM). The authors evaluate the proposed scheme, named HPAS-LSTM, through ns-2 simulations and compare its results with other black hole detection methods in terms of throughput, packet loss rate, packet delivery ratio and total network delay.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe work addresses the selection and classification of honeypots (virtual decoys, online traps) by their effectiveness, using characteristics such as installation and configuration, usage and support, data collection, logging level, simulation level and interaction level. The authors describe a method that forms a set of honeypots, subsets of characteristics and identifier values of linguistic estimates, base and derived frequency matrices, and fuzzy terms and reference fuzzy numbers with their visualization, in order to construct linguistic standards for multi-criteria assessment.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe authors propose OFULinMat, an episodic learning algorithm for repeated zero-sum games with unknown, time-varying payoff matrices, leveraging an ensemble of game models as prior information. The algorithm achieves a sublinear bound on saddle-point regret. As a case study, they use a dynamic honeypot allocation game to illustrate and corroborate their theoretical results.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThis paper presents an approach to container-based honeypots that simulate container escapes as a deception technique in the context of cloud computing virtualization. According to the authors, it investigates the possibilities of container-based honeypots to imitate legitimate network targets and raise alerts on attacker interactions, allowing study of attacker techniques.
NetworkCloudHoneypotDecoy
Paper2021
Material reviewed: AbstractAccording to the abstract, the authors exposed an SSH service on an internet-connected Raspberry Pi device for over six days to act as a honeypot, logging received login attempts. The study provides an analysis of request origins and intruder focus areas.
IoTNetworkHoneypot
Paper2021
Material reviewed: Publisher metadataBibliographic record on failure analysis in IoT experiments. The abstract and findings still require review.
IoTHoneypot
Paper2021
Material reviewed: AbstractThis paper, according to its authors, revisits the honeypot fingerprinting field by proposing a multistage framework combining existing and novel techniques. Through large-scale IPv4 address scans, the authors report identifying thousands of honeypot instances as well as non-honeypot vulnerable systems, and discuss countermeasures against fingerprinting.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe authors present GPT-2C, a run-time system that leverages the pre-trained GPT-2 model to parse dynamic logs generated by a Cowrie SSH honeypot, addressing interoperability limitations with EDR and SIEM technologies. According to the abstract, the fine-tuned model achieves 89% inference accuracy in the new domain with acceptable execution latency.
NetworkEndpointHoneypot
Paper2021
Material reviewed: AbstractThe authors present Honeyboost, an unsupervised framework combining honeypots with network anomaly detection to identify suspicious nodes before they reach the honeypot. The approach fuses horizontal (per-node time series) and vertical (per-protocol) analysis, using extreme value theory to reduce false positives, as described in the abstract.
NetworkHoneypot
Paper2021
Material reviewed: AbstractAccording to the authors, HoneyCar is a decision support framework for configuring honeypots in the Internet of Vehicles, based on known vulnerabilities from the NVD/CVE database. The approach models adversarial interaction as a repeated imperfect-information zero-sum game, aiming to compute optimal honeypot configuration strategies for threat intelligence collection.
IoTNetworkHoneypotDecoy
Paper2021
Material reviewed: AbstractThe authors propose HIM, a preventive forensic process model for investigating IoT network incidents that uses honeypots to record attacks over one year. The model aims to cover the entire lifecycle of IoT forensic investigation and address the needs of forensic analysts and the legal community, and the authors report it was validated using various methods.
IoTNetworkHoneypot
Paper2021
Material reviewed: AbstractThe authors review theoretical aspects of honeypot systems and present a classification of honeypots on various grounds. They also describe the architecture of a honeypot system intended to investigate an attacker's behavior after penetration into the corporate system, as a tool for an organizational secure system.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe paper proposes and investigates a botnet detection and classification model that combines honeypots with machine learning, aimed at smart factories. The study was carried out in a hardware configuration virtually mimicking a smart factory environment, as described by the authors.
IoTOT/ICSHoneypot
Paper2021
Material reviewed: AbstractThis article aims to introduce honeypots in the context of the Internet of Things (IoT), describe how IoT devices can be exploited by attackers, and investigate honeypot ecosystems for capturing and analyzing information from attacks against these IoT devices. The authors also state that they provide insights into the attack vectors present in most IoT systems, into understanding attack patterns, and into leveraging proactive strategies for IoT security.
IoTHoneypot
Paper2021
Material reviewed: AbstractThe authors propose applying natural language processing techniques to shell commands captured via honeypots to detect and correlate botnet behaviors. The approach reduces command sequences to stochastic processes, then processed with machine learning to build classifiers and predictors that cluster botnet source IP addresses, even when attackers attempt to obfuscate intrusion attempts through rapid or random permutation techniques.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThis paper describes the incorporation of deceptive elements, including honeypots and decoys, into Microsoft's CyberBattleSim experimentation platform. According to the authors, they tested the defensive capabilities of these elements against reinforcement-learning-based attackers in a capture-the-flag environment, finding that attacker progress depended on the number and location of deceptive elements.
NetworkHoneypotDecoy
Paper2021
Material reviewed: AbstractThe work proposes integrating low interaction honeypots with the ELK Stack as a server attack detection system, aiming to divert attacker access and to help administrators analyze the generated logs through visualization. The authors carried out five testing schemes comparing the Cowrie and Dionaea honeypots, and report that Cowrie delivered real-time detection with an average delay time of 3.75 seconds, while ELK provided better monitoring results for administrators through its visualization.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe paper proposes implementing a honeypot system alongside an Intrusion Detection System, using a Venus fly-trap optimization algorithm to interact with the attacker. The authors introduce a fitness function to estimate attacker size and compare their model with prior work through remote-to-local, probing, and DoS attacks.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe paper proposes an industrial Early Intrusion Detection System (EIDS) that combines honeypots with machine learning algorithms. The authors describe collecting data from honeypot and industrial device sensors, storing it in a database and analyzing it to alert on intrusions in industrial control networks.
OT/ICSNetworkHoneypot
Paper2021
Material reviewed: AbstractAccording to the authors, this study deploys honeypots simulating Linux shells to collect heterogeneous threat event data (network traffic, file downloads, SSH logins, and attacker commands) and models attacker behavior using a Temporal Convolutional Network (TCN), comparing it against LSTM and GRU.
NetworkIoTHoneypot
Paper2021
Material reviewed: AbstractThe authors describe monitoring honeypot sensors deployed on Raspberry Pi devices integrated with Modern Honey Network, using SNMP as a network management function. The aim is to observe system resources and analyze how the number of attacks affects sensor performance.
NetworkEndpointHoneypot
Paper2021
Material reviewed: AbstractThe authors describe installing a honeypot on a server as an attack detector, with its logs exposed through a REST API built with the Django framework and a MongoDB database, so that an Android application can show whether the server is under attack and block the attacker's IP address. The work is framed around network security and the monitoring of attacks on a resource.
NetworkApplicationHoneypot
Paper2021
Material reviewed: AbstractThe work describes the design of a honeypot-based intrusion detection system (IDS) for the computer network of Universitas Bhayangkara Jakarta Raya. According to the authors, the honeypot simulates weak points to attract malware, records attacker activity, and produces logs that can be analyzed for handling and recovery during and after an attack.
NetworkHoneypot