Paper2026
Material reviewed: AbstractThe paper presents PHANTOM, a framework that generates honeytokens by encoding organisation-specific knowledge (domain names, service naming conventions, technology-stack idioms and realistic secret-value distributions) into a multi-component pipeline. The authors formalise a four-component believability score and use it to compare PHANTOM against a template-based baseline.
HoneytokenDecoy
Paper2026
Material reviewed: Public pageWithin a broader agent-governance proposal, the preprint describes planted canary values and precomputed transformations for detecting exfiltration of those values.
Honeytoken
Paper2026
Material reviewed: Full textEditor contributionPacheco and Staino paper in the SACS 2026 proceedings describing the reproducible educational design of Cyber Deception Playground.
NetworkApplicationHoneypotDecoy
Paper2026
Material reviewed: AbstractThe author models honeytokens as an information design problem followed by receiver information acquisition, where an adversary can pay to fingerprint the bait. The analysis examines how installed trap prevalence, fingerprinting costs, and adjustment costs affect bait calibration and trap activation.
HoneytokenDecoy
Paper2026
Material reviewed: AbstractThis work studies credential exfiltration by LLM agents via indirect prompt injection, proposing three complementary defenses according to the authors: activation probes for pre-output detection, honeytokens calibrated via split conformal prediction, and a cumulative leakage budget tracked across multi-turn conversations. The authors report preliminary results from controlled experiments on open-weight models and a small in-house multi-turn synthetic suite.
ApplicationIdentityHoneytoken
Paper2026
Material reviewed: AbstractThis paper presents DICOMHawk, a cyber-deception framework that emulates DICOM and PACS services with realistic interactions, dynamically populated medical records, and embedded honeytokens, designed to protect medical imaging infrastructure. According to the authors, in a 424-day deployment across multiple networks, DICOMHawk attracted more valid sessions than Dicompot, avoided honeypot detection, and captured 67 medical-related attacks from 15 unique IPs.
NetworkApplicationHoneypotHoneytoken
Paper2026
Material reviewed: AbstractThe work presents HoneyPrompt, a multi-sensor fusion architecture for detecting and classifying autonomous AI agents that interact with industrial control systems. The authors deploy a maritime SCADA honeypot simulating a pipeline monitoring gateway across six protocols and instrument it with a graduated prompt injection acting as a sensor array.
OT/ICSNetworkHoneypotHoneytoken
Paper2026
Material reviewed: AbstractThe authors present Mirage Mesh, a lightweight cyber deception framework for Linux environments that applies deception-in-depth across four layers: an SSH decoy built on Cowrie, a system-layer decoy administrative account, a fake Flask web administration interface, and a data-layer honeytoken credential file. The work proposes a shared DecoyAlertEvent schema to normalize observations from these layers, process them through a Wazuh-based detection and active-response pipeline with Python orchestration, map them to cyber kill-chain stages and MITRE ATT&CK techniques, and evaluate them with a Deception Effectiveness Metric (DEM).
NetworkEndpointHoneypotHoneytoken
Paper2026
Material reviewed: AbstractThe paper proposes a password-leak detection method based on Pythagorean triples, generating honeywords from a special graph-structure sequence built using number-theoretic properties of those triples. The authors describe a generation algorithm with a flat distribution and report a security proof and comparative experiments aimed at brute-force resistance and storage efficiency.
IdentityHoneytoken
Paper2026
Material reviewed: AbstractThis paper introduces PHANTOM, a framework for generating honeytokens that encode organisation-specific knowledge (domain names, naming conventions, technology idioms, and secret-value distributions) through a multi-component generation pipeline. The authors propose a four-component Believability Score and use it to compare PHANTOM against a template-based baseline across several token types and organisational contexts.
NetworkApplicationHoneytoken
Paper2026
Material reviewed: Full textFormal analysis of honeytoken limits when trusted agents and attackers share memory or policies.
ApplicationIdentityHoneytoken
Paper2025
Material reviewed: AbstractThe study compares proposed metrics for honeyfile attributes—Common Token Count and Topic Semantic Matching for enticement, and coherence and cohesion for realism—against human users' perceptions as they judged text samples in a simulated data breach scenario on a crowd-sourcing platform. The authors report that Topic Semantic Matching aligned with perceived enticement, whereas results for Common Token Count were inconsistent and inconclusive, and coherence and cohesion did not consistently align with perceived realism.
HoneytokenDecoy
Paper2025
Material reviewed: AbstractThe authors present the Hybrid Cyber Deception System (HCDS), described as a Python-developed proactive tool that combines honeypots and honeytokens in a dynamically adaptive mode to simulate realistic services and redirect attackers in controlled, instrumented settings. The system integrates a deception-driven alerts correlation engine built on Python, Pandas and Scikit-learn, along with Moving Target Defense principles for continuous modulation of network parameters and decoy distribution, and was tested in a simulated environment with Windows and Ubuntu servers to profile attackers and detect complex attack vectors.
NetworkEndpointHoneypotHoneytoken
Paper2024
Material reviewed: Publisher metadataDOI-identified publication on language-model honeytoken generation; text analysis is pending.
IdentityHoneytoken
Paper2023
Material reviewed: AbstractThis paper, according to its authors, extends a previously introduced two-factor Honeytoken authentication method by incorporating blockchain technology. The stated goal is to strengthen the method against tampering attacks. The authors report evaluation results suggesting improved performance and operational efficiency when integrating blockchain.
IdentityHoneytoken
Paper2023
Material reviewed: Publisher metadataDOI-identified publication on injecting honeytokens using Netfilter; text analysis is pending.
NetworkHoneytoken
Paper2023
Material reviewed: AbstractThe work addresses honeyword generation: fake passwords that accompany the real password (the "sugarword") in a password-cracking detection system, where a honeychecker distinguishes the real password from the fake ones. The authors describe a honeyword generation method based on a proposed discrete salp swarm algorithm (SSA), a bio-inspired metaheuristic, and present the proposed methodology alongside experimental results compared with previous strategies.
IdentityHoneytokenDecoy
Paper2022
Material reviewed: AbstractThe paper proposes a method for generating honeywords using the meerkat clan intelligence algorithm, a metaheuristic swarm intelligence algorithm, aiming to improve the generation process, honeyword properties, and address issues of prior methods. The authors present previous methods, explain the proposed method, and compare experimental results.
IdentityHoneytoken
Paper2022
Material reviewed: AbstractThe paper proposes using the harmony search algorithm (HSA), a music-inspired metaheuristic, to generate honeywords (false passwords that accompany the true password) within a password-cracking detection system. The authors review prior honeyword generation techniques, present their method, and compare experimental results with earlier approaches.
IdentityHoneytoken
Paper2022
Material reviewed: Full textBibliographic record on controllable fake documents. The abstract and findings still require review.
IdentityHoneytoken
Paper2022
Material reviewed: Full textThe prototype identified 14 of the 20 studied types in the described configuration. The authors note possible false positives and describe types the tool does not cover.
ApplicationIdentityHoneytoken
Paper2022
Material reviewed: AbstractThis survey reviews twenty-three honeyword (decoy password) based authentication techniques introduced by Juels and Rivest in 2013, which aim to detect server-side threats on password files and notify the administrator when an attacker attempts to exploit a compromised file. The authors compare existing approaches and identify remaining gaps and emergent research opportunities.
IdentityDecoyHoneytoken
Paper2022
Material reviewed: AbstractThis survey reviews and categorizes honey-X-based defense strategies, such as honeypots and honeytokens, which use deception to gather threat intelligence and protect networks. The authors also examine their combination with moving target defense, game theory and machine learning, and outline security quantification, challenges and future directions.
NetworkHoneypotHoneytoken
Paper2021
Material reviewed: Full textTwo-factor authentication mechanism combining decoy codes with Google Authenticator.
IdentityHoneytoken