Paper2026
Material reviewed: Public pagePaper describing a longitudinal dataset of high-interaction SSH honeypot logs covering connection attempts, authentication brute-forcing and post-authentication command execution. It is intended as a ground-truth source for empirical research and anomaly detection development.
NetworkHoneypot
Paper2026
Material reviewed: AbstractThis paper presents a corpus of real scam- and spam-call conversations collected via an active voice-agent honeypot. According to the authors, the system adopts a plausible target persona to sustain interactions with fraudulent callers, recording audio, transcripts, and automatic labels. The study describes the collection system, record structure, and an evaluation of corpus realism and label quality, as well as benchmarking scam detectors trained on synthetic dialogue against real traffic.
NetworkIdentityHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors propose TAB-DEN, a framework for IoT healthcare systems that combines a permissioned blockchain with Proof of Authority consensus for decentralized authentication, a hierarchical edge architecture of primary and secondary edge servers that compute trust scores in real time and redirect traffic according to trustworthiness, and deception-based edge nodes acting as honeypot-like environments to attract, isolate and profile attackers. The stated aim is to provide scalable and quantum-resistant security, recording intrusion events through a lattice-based post-quantum signature scheme so that attack records are immutable and verifiable on the distributed ledger.
IoTNetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors present a multi-attacker Bayesian Stackelberg framework for allocating honeypots in a directed network, modeling each attacker as a follower with a latent type and the defender as replanning via a DOBSS-style mixed-integer linear program under posterior beliefs. They aim to scale defense to realistic graphs using layered structures and pruning.
NetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors present AdvancedShelLM, an LLM-based SSH honeypot using a multi-agent architecture (Manager and Worker) intended to improve command understanding and deceptive capability over its predecessor shelLM. According to the abstract, the system was evaluated through unit tests, an AI attacker, human attackers, and an Internet deployment.
NetworkEndpointHoneypotDecoy
Paper2026
Material reviewed: AbstractThe work proposes AEGIS-AI, a framework combining honeypots with reinforcement learning and deep neural networks to automate deception and detection of malicious activity. The authors describe real-time adaptive deception strategies via Markov Decision Processes and federated learning, and present formulas for evaluating deception effectiveness.
NetworkHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe authors propose a dynamic honeypot framework combining a reinforcement-learning deception agent (tabular Q-learning, formalized as an MDP), threat-intelligence fusion via indicators of compromise, and automated containment actions. Its purpose is to adapt the honeypot's exposed persona and guide deception decisions, evaluated in an isolated virtualized testbed.
NetworkCloudHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThis study analyzes a corpus of 10,211 scam and spam calls collected via an AI voice-agent honeypot that answered calls and kept callers talking. The authors examine operational patterns of telephone fraud, including operating hours, script reuse, types of information solicited, and the influence of the target's simulated identity on scammer behavior. They also present an early-detection experiment based on the opening lines of calls.
NetworkHoneypot
Paper2026
Material reviewed: AbstractThe study compares, under homogeneous conditions, the technical performance, resource consumption and operational costs of traditional honeypots versus honeypots that incorporate machine learning to improve realism and hinder fingerprinting. The authors deployed six open-source honeypots simultaneously (three traditional and three ML-enhanced) for 60 days on Hetzner Cloud infrastructure, reporting differences in useful interaction, fingerprinting and return on investment.
CloudHoneypot
Paper2026
Material reviewed: Full textEditor contributionPacheco and Staino paper in the SACS 2026 proceedings describing the reproducible educational design of Cyber Deception Playground.
NetworkApplicationHoneypotDecoy
Paper2026
Material reviewed: AbstractThe article examines the application of Cyber Deception technologies to the investigation of current cyber threats and the behavior of potential attackers, arguing for the usefulness of honeypot systems in collecting information on unauthorized access attempts and cyberattack techniques. Its authors propose a laboratory architecture based on a virtual infrastructure using the Cowrie honeypot system, aimed at automated event log collection and continuous monitoring of unauthorized access attempts, authentication processes, executed commands, and subsequent analysis of attacker activity.
NetworkEndpointHoneypotDecoy
Paper2026
Material reviewed: AbstractThis paper proposes seven prompt-injection detection techniques that adapt mechanisms from disciplines outside LLM security, including forensic linguistics, materials-fatigue analysis, deception technology, bioinformatics sequence alignment, mechanism design, spectral analysis, and taint tracking. According to the authors, four of the seven techniques were implemented in the prompt-shield v0.7.3 tool, including honeypot tool definitions, and evaluated through ablations across nine benchmarks totaling approximately 10,300 samples.
ApplicationHoneypotDecoy
Paper2026
Material reviewed: AbstractAccording to the authors, Chameleon is an adaptive honeypot architecture combining a BiLSTM classifier, a locally deployed language model, and two metaheuristic engines (TC-PSO and S-RRT) to dynamically adjust connection-holding delays and deception schemas based on detected threat levels. The authors report performance comparisons against standard algorithms and note reduced operating costs compared to commercial alternatives.
NetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractPresents the design, implementation, and evaluation of a honeypot monitoring system deployed on AWS that emulates SSH, HTTP, and HTTPS services on EC2 instances within an isolated virtual private cloud. The system aims to attract, record, and analyze malicious interactions, using a Python/Flask backend and a React/D3.js dashboard for attack visualization.
CloudNetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThe paper describes the design of a honeypot framework deployed in a cloud environment to support threat detection and incident response. According to the authors, it integrates Microsoft Azure services to monitor and analyze malicious behavior, using telemetry, threat intelligence and automated workflows.
CloudHoneypot
Paper2026
Material reviewed: AbstractThe paper introduces Co-ADAM, a defense framework that formalizes cyber deception in the Industrial Internet of Things (IIoT) as a constrained Markov decision process with an embedded signaling game, aiming to jointly model the deception investment level and a co-evolutionary adversary that accumulates skepticism. The authors describe training a deep Q-network (DQN) defender against an adaptive attacker pool with budget constraints and skepticism dynamics embedded in the environment, and report evaluation on several IIoT datasets and a physical testbed.
IoTOT/ICSHoneypotDecoy
Paper2026
Material reviewed: Public pageThe chapter analyzes cyberviolence and the traits of adolescent cyberaggressors and proposes comprehensive prevention involving families, educational institutions and technological tools such as honeynets to analyze attacker behavior and mitigate the impact.
Honeypot
Paper2026
Material reviewed: Publisher metadataBibliographic record on language-model honeypot tuned on Cowrie data. The abstract and findings still require review.
NetworkHoneypot
Paper2026
Material reviewed: Public pageThe authors describe installing and configuring Cowrie on Linux as an SSH and Telnet honeypot that logs attacker login attempts, credentials, and terminal commands to log files.
NetworkHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe work proposes DecoyShield, a deception-based cybersecurity framework for proactive detection. It leverages multi-service honeypot environments that simulate network services, capture attacker behavior, and integrate behavioral analysis, threat intelligence, and dynamic risk scoring to classify severity and deploy adaptive responses.
NetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThis data article presents MURHCAD, a high-resolution honeynet dataset collected over 72 hours in June 2025 on Microsoft Azure, using three honeypots (Cowrie, Dionaea, and SentryPeer) deployed across four geographically dispersed virtual machines. According to the authors, the dataset comprises 132,425 attack events with enriched metadata (timestamps, IPs, geolocation, ports, and protocols) intended to support anomaly detection, protocol-misuse studies, and threat intelligence research.
CloudNetworkHoneypot
Paper2026
Material reviewed: AbstractThis report addresses the challenge of detecting AI-driven offensive cyber agents, proposing a strategic 'detection-in-depth' framework. According to the authors, five detection mechanisms are presented, including agent identifiers and agent honeypots, intended to support policymakers and industry against this emerging threat.
NetworkCloudHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThis paper presents DICOMHawk, a cyber-deception framework that emulates DICOM and PACS services with realistic interactions, dynamically populated medical records, and embedded honeytokens, designed to protect medical imaging infrastructure. According to the authors, in a 424-day deployment across multiple networks, DICOMHawk attracted more valid sessions than Dicompot, avoided honeypot detection, and captured 67 medical-related attacks from 15 unique IPs.
NetworkApplicationHoneypotHoneytoken
Paper2026
Material reviewed: AbstractThis paper presents a behavior-driven attacker profiling framework built from empirical data collected in SSH honeypot deployments. The methodology parses complex command chains to identify behavioral patterns, organize them into hierarchical clusters, and map them to the MITRE ATT&CK framework for structured threat interpretation.
NetworkHoneypot