Paper2026
Material reviewed: AbstractThe authors propose TAB-DEN, a framework for IoT healthcare systems that combines a permissioned blockchain with Proof of Authority consensus for decentralized authentication, a hierarchical edge architecture of primary and secondary edge servers that compute trust scores in real time and redirect traffic according to trustworthiness, and deception-based edge nodes acting as honeypot-like environments to attract, isolate and profile attackers. The stated aim is to provide scalable and quantum-resistant security, recording intrusion events through a lattice-based post-quantum signature scheme so that attack records are immutable and verifiable on the distributed ledger.
IoTNetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors present a multi-attacker Bayesian Stackelberg framework for allocating honeypots in a directed network, modeling each attacker as a follower with a latent type and the defender as replanning via a DOBSS-style mixed-integer linear program under posterior beliefs. They aim to scale defense to realistic graphs using layered structures and pruning.
NetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors present AdvancedShelLM, an LLM-based SSH honeypot using a multi-agent architecture (Manager and Worker) intended to improve command understanding and deceptive capability over its predecessor shelLM. According to the abstract, the system was evaluated through unit tests, an AI attacker, human attackers, and an Internet deployment.
NetworkEndpointHoneypotDecoy
Paper2026
Material reviewed: AbstractThe work proposes AEGIS-AI, a framework combining honeypots with reinforcement learning and deep neural networks to automate deception and detection of malicious activity. The authors describe real-time adaptive deception strategies via Markov Decision Processes and federated learning, and present formulas for evaluating deception effectiveness.
NetworkHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe authors propose a dynamic honeypot framework combining a reinforcement-learning deception agent (tabular Q-learning, formalized as an MDP), threat-intelligence fusion via indicators of compromise, and automated containment actions. Its purpose is to adapt the honeypot's exposed persona and guide deception decisions, evaluated in an isolated virtualized testbed.
NetworkCloudHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThis study examines how anchoring effects influence attackers' decisions in specific cyberattack scenarios through two experiments. Experiment 1 compares anchoring measurement methods in Crontab and Hostname tasks; Experiment 2 embeds bias triggers within an end-to-end cyber kill chain scenario.
NetworkEndpointDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThe article examines the application of Cyber Deception technologies to the investigation of current cyber threats and the behavior of potential attackers, arguing for the usefulness of honeypot systems in collecting information on unauthorized access attempts and cyberattack techniques. Its authors propose a laboratory architecture based on a virtual infrastructure using the Cowrie honeypot system, aimed at automated event log collection and continuous monitoring of unauthorized access attempts, authentication processes, executed commands, and subsequent analysis of attacker activity.
NetworkEndpointHoneypotDecoy
Paper2026
Material reviewed: AbstractThe paper introduces Co-ADAM, a defense framework that formalizes cyber deception in the Industrial Internet of Things (IIoT) as a constrained Markov decision process with an embedded signaling game, aiming to jointly model the deception investment level and a co-evolutionary adversary that accumulates skepticism. The authors describe training a deep Q-network (DQN) defender against an adaptive attacker pool with budget constraints and skepticism dynamics embedded in the environment, and report evaluation on several IIoT datasets and a physical testbed.
IoTOT/ICSHoneypotDecoy
Paper2026
Material reviewed: Public pageThe authors describe installing and configuring Cowrie on Linux as an SSH and Telnet honeypot that logs attacker login attempts, credentials, and terminal commands to log files.
NetworkHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe authors propose using honey drones as a deception strategy to defend unmanned aerial vehicle (UAV) mission systems against denial-of-service attacks. They formulate an attacker-defender optimization problem based on radio signal strength and present an approach called HT-DRL, combining hypergame theory with deep reinforcement learning to identify optimal deception strategies.
IoTNetworkDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThe authors examine the assumption that decoys can be placed wherever attacker behavior occurs, applying a four-criterion rubric to all 250 MITRE ATT&CK v18.1 techniques. They find only 32% of techniques admit a plausible decoy and describe two placement patterns, Sweep and Seek, offering a simple rule for decoy deployment.
NetworkEndpointDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThe work proposes DecoyShield, a deception-based cybersecurity framework for proactive detection. It leverages multi-service honeypot environments that simulate network services, capture attacker behavior, and integrate behavioral analysis, threat intelligence, and dynamic risk scoring to classify severity and deploy adaptive responses.
NetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThis paper presents DecoyTrace, a proactive cyber deception-based defense designed for strictly serverless decentralized federated learning (DFL) environments. According to the authors, the system deploys a mobile DecoyNode that generates decoy challenges using chaotic maps, disseminates a dual model (clean vs. decoy) based on neighbor trust, and evaluates behavior using three-state semantic metrics to identify and contain malicious sources. The authors report evaluations on the NEBULA platform across multiple configurations, datasets, and topologies.
NetworkApplicationDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThis report addresses the challenge of detecting AI-driven offensive cyber agents, proposing a strategic 'detection-in-depth' framework. According to the authors, five detection mechanisms are presented, including agent identifiers and agent honeypots, intended to support policymakers and industry against this emerging threat.
NetworkCloudHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe authors propose an antifragile framework that uses cyber deception with adaptive decoys and dynamic network movements to generate adversarial signals, infer threat actor profiles and support proactive decisions. A cyber threat intelligence ontology and a knowledge graph with semantic attributes represent tactical and strategic relationships between attackers and targets.
NetworkDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThe study investigates whether psychologically engineered "bias triggers" can exploit human attackers' Type I heuristic processing to degrade their performance. The authors use a high-fidelity cyber range where participants conduct network penetration with and without these triggers, analyzing operational telemetry.
NetworkDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThis paper presents LDT-FRL, a defense framework combining temporal attention encoders, lightweight digital twins, and a federated reinforcement learning (PPO) agent capable of redirecting suspicious traffic to honeypots in IoMT (Internet of Medical Things) environments. According to the authors, the system was evaluated on public network traffic benchmarks, achieving high classification metrics and explainability via techniques such as SHAP and Grad-CAM.
IoTNetworkHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThis paper proposes GroupGuard, a training-free defense framework against group collusive attacks in large language model-based multi-agent systems. The approach combines continuous graph-based monitoring, active honeypot inducement, and structural pruning to identify and isolate collusive agents. The authors report high detection accuracy across experiments with five datasets and four topologies.
ApplicationHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe abstract describes Honey Shield, a deception-driven cybersecurity paradigm for web authentication systems. It proposes a centralized security service interface offering defenses such as honeypot redirection and SQL injection protection, redirecting malicious users to a decoy system and logging incidents for later analysis.
ApplicationIdentityHoneypotDecoy
Paper2026
Material reviewed: AbstractThe work presents HoneyPrompt, a multi-sensor fusion architecture for detecting and classifying autonomous AI agents that interact with industrial control systems. The authors deploy a maritime SCADA honeypot simulating a pipeline monitoring gateway across six protocols and instrument it with a graduated prompt injection acting as a sensor array.
OT/ICSNetworkHoneypotHoneytoken
Paper2026
Material reviewed: AbstractThis paper adapts the Honeyquest instrument to automatically evaluate LLM-based attacker judgment against cyber deception techniques. According to the authors, a cohort of 21 models from various providers was compared against a human baseline on reconnaissance tasks, finding that LLMs fall for traps at higher rates than humans and show a gap between recognizing deception in their reasoning and acting accordingly. The authors conclude that human-centered deception hypotheses do not reliably transfer to AI attackers.
NetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractAccording to the authors, HoneyTrap is a deceptive defense framework for large language models that employs four collaborative defender agents to counter multi-turn jailbreak attacks by directing attackers toward honeypot traps. The authors also introduce a progressive multi-turn jailbreak dataset (MTJ-Pro) and two new evaluation metrics for deceptive defense. They report reductions in attack success rates across several commercial and open-source models.
ApplicationHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThis work presents Honeyval, an evaluation framework for LLM-powered HTTP honeypots. According to the authors, the framework uses AI hacking agents as attackers and diverse backend applications to reproducibly evaluate the performance and detectability of these honeypots compared to prior limited evaluation methods.
NetworkApplicationHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors introduce ICSLure, a modular honeynet framework intended to emulate realistic industrial control system environments. It integrates physical PLCs with live data sources over industrial protocols and virtualized network components, with monitoring to log attacker interactions.
OT/ICSNetworkHoneypotAdversary engagement