Paper2026
Material reviewed: AbstractThe paper presents PHANTOM, a framework that generates honeytokens by encoding organisation-specific knowledge (domain names, service naming conventions, technology-stack idioms and realistic secret-value distributions) into a multi-component pipeline. The authors formalise a four-component believability score and use it to compare PHANTOM against a template-based baseline.
HoneytokenDecoy
Paper2026
Material reviewed: AbstractThis paper presents a corpus of real scam- and spam-call conversations collected via an active voice-agent honeypot. According to the authors, the system adopts a plausible target persona to sustain interactions with fraudulent callers, recording audio, transcripts, and automatic labels. The study describes the collection system, record structure, and an evaluation of corpus realism and label quality, as well as benchmarking scam detectors trained on synthetic dialogue against real traffic.
NetworkIdentityHoneypotDecoy
Paper2026
Material reviewed: AbstractThe paper proposes a Deception Readiness Index (DRI) for ICS and OT cybersecurity programs. Using design science and qualitative analysis of public standards and guidance, it scores readiness across governance, architecture, monitoring, workforce, and operational safety domains, and applies the index to three synthetic critical-infrastructure profiles to identify gaps before deployment.
OT/ICSDecoy
Paper2026
Material reviewed: AbstractThe authors propose TAB-DEN, a framework for IoT healthcare systems that combines a permissioned blockchain with Proof of Authority consensus for decentralized authentication, a hierarchical edge architecture of primary and secondary edge servers that compute trust scores in real time and redirect traffic according to trustworthiness, and deception-based edge nodes acting as honeypot-like environments to attract, isolate and profile attackers. The stated aim is to provide scalable and quantum-resistant security, recording intrusion events through a lattice-based post-quantum signature scheme so that attack records are immutable and verifiable on the distributed ledger.
IoTNetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThe paper proposes a framework combining game theory with transformer-based components to quantify, model, and optimize cyber deception. The authors define deception attack-surface metrics and embed them in a signaling game, aiming to guide adaptive deception strategies.
NetworkDecoyMoving target defense
Paper2026
Material reviewed: AbstractThe authors present a multi-attacker Bayesian Stackelberg framework for allocating honeypots in a directed network, modeling each attacker as a follower with a latent type and the defender as replanning via a DOBSS-style mixed-integer linear program under posterior beliefs. They aim to scale defense to realistic graphs using layered structures and pruning.
NetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors present AdvancedShelLM, an LLM-based SSH honeypot using a multi-agent architecture (Manager and Worker) intended to improve command understanding and deceptive capability over its predecessor shelLM. According to the abstract, the system was evaluated through unit tests, an AI attacker, human attackers, and an Internet deployment.
NetworkEndpointHoneypotDecoy
Paper2026
Material reviewed: AbstractThis study examines how anchoring effects influence attackers' decisions in specific cyberattack scenarios through two experiments. Experiment 1 compares anchoring measurement methods in Crontab and Hostname tasks; Experiment 2 embeds bias triggers within an end-to-end cyber kill chain scenario.
NetworkEndpointDecoyAdversary engagement
Paper2026
Material reviewed: Full textEditor contributionPacheco and Staino paper in the SACS 2026 proceedings describing the reproducible educational design of Cyber Deception Playground.
NetworkApplicationHoneypotDecoy
Paper2026
Material reviewed: AbstractThe article examines the application of Cyber Deception technologies to the investigation of current cyber threats and the behavior of potential attackers, arguing for the usefulness of honeypot systems in collecting information on unauthorized access attempts and cyberattack techniques. Its authors propose a laboratory architecture based on a virtual infrastructure using the Cowrie honeypot system, aimed at automated event log collection and continuous monitoring of unauthorized access attempts, authentication processes, executed commands, and subsequent analysis of attacker activity.
NetworkEndpointHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors analyze Stackelberg Security Games (SSG) applied to cyber deception, proposing a Quantal Stackelberg Equilibrium (QSE) that models noisy attacker responses instead of a perfect best response. According to the authors, this approach serves as a form of insurance against model specification errors, and is empirically evaluated in a cybersecurity case study with real CVE/CVSS vulnerabilities, showing gains in defender utility over the classical Stackelberg approach.
NetworkDecoy
Paper2026
Material reviewed: AbstractThis paper proposes seven prompt-injection detection techniques that adapt mechanisms from disciplines outside LLM security, including forensic linguistics, materials-fatigue analysis, deception technology, bioinformatics sequence alignment, mechanism design, spectral analysis, and taint tracking. According to the authors, four of the seven techniques were implemented in the prompt-shield v0.7.3 tool, including honeypot tool definitions, and evaluated through ablations across nine benchmarks totaling approximately 10,300 samples.
ApplicationHoneypotDecoy
Paper2026
Material reviewed: AbstractThe author models honeytokens as an information design problem followed by receiver information acquisition, where an adversary can pay to fingerprint the bait. The analysis examines how installed trap prevalence, fingerprinting costs, and adjustment costs affect bait calibration and trap activation.
HoneytokenDecoy
Paper2026
Material reviewed: AbstractAccording to the authors, Chameleon is an adaptive honeypot architecture combining a BiLSTM classifier, a locally deployed language model, and two metaheuristic engines (TC-PSO and S-RRT) to dynamically adjust connection-holding delays and deception schemas based on detected threat levels. The authors report performance comparisons against standard algorithms and note reduced operating costs compared to commercial alternatives.
NetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractPresents the design, implementation, and evaluation of a honeypot monitoring system deployed on AWS that emulates SSH, HTTP, and HTTPS services on EC2 instances within an isolated virtual private cloud. The system aims to attract, record, and analyze malicious interactions, using a Python/Flask backend and a React/D3.js dashboard for attack visualization.
CloudNetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThe paper introduces Co-ADAM, a defense framework that formalizes cyber deception in the Industrial Internet of Things (IIoT) as a constrained Markov decision process with an embedded signaling game, aiming to jointly model the deception investment level and a co-evolutionary adversary that accumulates skepticism. The authors describe training a deep Q-network (DQN) defender against an adaptive attacker pool with budget constraints and skepticism dynamics embedded in the environment, and report evaluation on several IIoT datasets and a physical testbed.
IoTOT/ICSHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors propose using honey drones as a deception strategy to defend unmanned aerial vehicle (UAV) mission systems against denial-of-service attacks. They formulate an attacker-defender optimization problem based on radio signal strength and present an approach called HT-DRL, combining hypergame theory with deep reinforcement learning to identify optimal deception strategies.
IoTNetworkDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThe authors examine the assumption that decoys can be placed wherever attacker behavior occurs, applying a four-criterion rubric to all 250 MITRE ATT&CK v18.1 techniques. They find only 32% of techniques admit a plausible decoy and describe two placement patterns, Sweep and Seek, offering a simple rule for decoy deployment.
NetworkEndpointDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThe work proposes DecoyShield, a deception-based cybersecurity framework for proactive detection. It leverages multi-service honeypot environments that simulate network services, capture attacker behavior, and integrate behavioral analysis, threat intelligence, and dynamic risk scoring to classify severity and deploy adaptive responses.
NetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThis paper presents DecoyTrace, a proactive cyber deception-based defense designed for strictly serverless decentralized federated learning (DFL) environments. According to the authors, the system deploys a mobile DecoyNode that generates decoy challenges using chaotic maps, disseminates a dual model (clean vs. decoy) based on neighbor trust, and evaluates behavior using three-state semantic metrics to identify and contain malicious sources. The authors report evaluations on the NEBULA platform across multiple configurations, datasets, and topologies.
NetworkApplicationDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThis paper presents DICOMHawk, a cyber-deception framework that emulates DICOM and PACS services with realistic interactions, dynamically populated medical records, and embedded honeytokens, designed to protect medical imaging infrastructure. According to the authors, in a 424-day deployment across multiple networks, DICOMHawk attracted more valid sessions than Dicompot, avoided honeypot detection, and captured 67 medical-related attacks from 15 unique IPs.
NetworkApplicationHoneypotHoneytoken
Paper2026
Material reviewed: AbstractThe authors propose an antifragile framework that uses cyber deception with adaptive decoys and dynamic network movements to generate adversarial signals, infer threat actor profiles and support proactive decisions. A cyber threat intelligence ontology and a knowledge graph with semantic attributes represent tactical and strategic relationships between attackers and targets.
NetworkDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThe study investigates whether psychologically engineered "bias triggers" can exploit human attackers' Type I heuristic processing to degrade their performance. The authors use a high-fidelity cyber range where participants conduct network penetration with and without these triggers, analyzing operational telemetry.
NetworkDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThis paper presents LDT-FRL, a defense framework combining temporal attention encoders, lightweight digital twins, and a federated reinforcement learning (PPO) agent capable of redirecting suspicious traffic to honeypots in IoMT (Internet of Medical Things) environments. According to the authors, the system was evaluated on public network traffic benchmarks, achieving high classification metrics and explainability via techniques such as SHAP and Grad-CAM.
IoTNetworkHoneypotAdversary engagement