Paper2022
Material reviewed: AbstractThis paper introduces TSM (Topic Semantic Matching), a metric based on topic modelling and semantic matching in embedding spaces to measure the enticement of honeyfiles relative to local content. According to the authors, it is the first measure using NLP techniques to quantify this enticement robustly against paraphrasing, supported by a honeyfile corpus built with various NLP methods.
EndpointHoneypotDecoy
Paper2022
Material reviewed: AbstractThis work models attacker-defender engagements as Markov Games to understand human adversarial behaviors and optimize defensive strategy. The authors validate their approach using a Capture-The-Flag (CTF) setup and user studies across varying skill levels. According to the authors, application-level deceptions are an optimal mitigation strategy against targeted attacks, outperforming classic defensive maneuvers, and they present an analysis of attacker behavior when trapped in an embedded honeypot environment.
ApplicationHoneypotAdversary engagement
Paper2021
Material reviewed: AbstractThe authors propose a multiphase dynamic deployment mechanism for virtualized honeypots (MD2VH) based on intelligent attack path prediction, modeling attack and defense characteristics with a Bayesian state attack graph and a multiphase deployment optimization model based on an extended Markov decision process, and generating deployment strategies by combining online and offline reinforcement learning. They implement a prototype system on software-defined networking and virtualization containers and report experiments on capture rate under simple and complex topologies.
NetworkHoneypotMoving target defense
Paper2021
Material reviewed: AbstractThe authors present a low-cost honeypot capable of blocking commands or replying with insults to attackers, modeling the attacker-defender interaction as a Bayesian two-player game. According to the abstract, three honeypot instances were deployed and over 200 sessions were captured for a qualitative analysis of post-exploitation behavior.
NetworkHoneypotAdversary engagement
Paper2021
Material reviewed: AbstractThis paper presents, according to its authors, a machine learning-based method for dynamic configuration, deployment and maintenance of honeypots in networks. The approach identifies and clusters machines and devices to intelligently deploy honeypots, reducing the need for manual configuration.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe authors propose a low-interaction, adaptive and dynamic web application honeypot that imitates vulnerabilities through HTTP events, using the SNARE and TANNER tools to generate the attack surface and analyze/classify incoming requests, as described in the abstract.
ApplicationHoneypot
Paper2021
Material reviewed: AbstractAccording to the authors, this work studies two-sided deception in cybersecurity by manipulating the observable configuration of both honeypots and real machines. Using an experiment with a 40-machine network (20 honeypots) and an experimental testbed, the authors compare three feature-concealment conditions against human attackers.
NetworkHoneypotDecoy
Paper2021
Material reviewed: Public pageThe linked preprint abstract describes DARLH, a honeypot system that uses deep reinforcement learning-based and deep recurrent neural network-based IDS agents to detect internal and external runtime DoS attacks. Its purpose is to provide dynamic intrusion detection and event validation for monitoring DoS attacks in the honeypot environment.
NetworkHoneypotDecoy
Paper2021
Material reviewed: AbstractThe paper describes the use of honeypot agents that generate Route Request (RREQ) packets to attract and entrap black hole attackers in mobile ad hoc networks (MANETs), together with a deep learning technique based on Long-Short Term Memory (LSTM). The authors evaluate the proposed scheme, named HPAS-LSTM, through ns-2 simulations and compare its results with other black hole detection methods in terms of throughput, packet loss rate, packet delivery ratio and total network delay.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe work addresses the selection and classification of honeypots (virtual decoys, online traps) by their effectiveness, using characteristics such as installation and configuration, usage and support, data collection, logging level, simulation level and interaction level. The authors describe a method that forms a set of honeypots, subsets of characteristics and identifier values of linguistic estimates, base and derived frequency matrices, and fuzzy terms and reference fuzzy numbers with their visualization, in order to construct linguistic standards for multi-criteria assessment.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe authors propose OFULinMat, an episodic learning algorithm for repeated zero-sum games with unknown, time-varying payoff matrices, leveraging an ensemble of game models as prior information. The algorithm achieves a sublinear bound on saddle-point regret. As a case study, they use a dynamic honeypot allocation game to illustrate and corroborate their theoretical results.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThis paper presents an approach to container-based honeypots that simulate container escapes as a deception technique in the context of cloud computing virtualization. According to the authors, it investigates the possibilities of container-based honeypots to imitate legitimate network targets and raise alerts on attacker interactions, allowing study of attacker techniques.
NetworkCloudHoneypotDecoy
Paper2021
Material reviewed: AbstractAccording to the abstract, the authors exposed an SSH service on an internet-connected Raspberry Pi device for over six days to act as a honeypot, logging received login attempts. The study provides an analysis of request origins and intruder focus areas.
IoTNetworkHoneypot
Paper2021
Material reviewed: Publisher metadataBibliographic record on failure analysis in IoT experiments. The abstract and findings still require review.
IoTHoneypot
Paper2021
Material reviewed: AbstractThis paper, according to its authors, revisits the honeypot fingerprinting field by proposing a multistage framework combining existing and novel techniques. Through large-scale IPv4 address scans, the authors report identifying thousands of honeypot instances as well as non-honeypot vulnerable systems, and discuss countermeasures against fingerprinting.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe authors present GPT-2C, a run-time system that leverages the pre-trained GPT-2 model to parse dynamic logs generated by a Cowrie SSH honeypot, addressing interoperability limitations with EDR and SIEM technologies. According to the abstract, the fine-tuned model achieves 89% inference accuracy in the new domain with acceptable execution latency.
NetworkEndpointHoneypot
Paper2021
Material reviewed: AbstractThe authors present Honeyboost, an unsupervised framework combining honeypots with network anomaly detection to identify suspicious nodes before they reach the honeypot. The approach fuses horizontal (per-node time series) and vertical (per-protocol) analysis, using extreme value theory to reduce false positives, as described in the abstract.
NetworkHoneypot
Paper2021
Material reviewed: AbstractAccording to the authors, HoneyCar is a decision support framework for configuring honeypots in the Internet of Vehicles, based on known vulnerabilities from the NVD/CVE database. The approach models adversarial interaction as a repeated imperfect-information zero-sum game, aiming to compute optimal honeypot configuration strategies for threat intelligence collection.
IoTNetworkHoneypotDecoy
Open software2021
Material reviewed: Repository metadataA multi-purpose, modular medium-interaction honeypot based on Twisted.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe authors propose HIM, a preventive forensic process model for investigating IoT network incidents that uses honeypots to record attacks over one year. The model aims to cover the entire lifecycle of IoT forensic investigation and address the needs of forensic analysts and the legal community, and the authors report it was validated using various methods.
IoTNetworkHoneypot
Paper2021
Material reviewed: AbstractThe authors review theoretical aspects of honeypot systems and present a classification of honeypots on various grounds. They also describe the architecture of a honeypot system intended to investigate an attacker's behavior after penetration into the corporate system, as a tool for an organizational secure system.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe paper proposes and investigates a botnet detection and classification model that combines honeypots with machine learning, aimed at smart factories. The study was carried out in a hardware configuration virtually mimicking a smart factory environment, as described by the authors.
IoTOT/ICSHoneypot
Open software2021
Material reviewed: Repository metadataRepository about multi-protocol sensors; documentation and maintenance require further review.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThis article aims to introduce honeypots in the context of the Internet of Things (IoT), describe how IoT devices can be exploited by attackers, and investigate honeypot ecosystems for capturing and analyzing information from attacks against these IoT devices. The authors also state that they provide insights into the attack vectors present in most IoT systems, into understanding attack patterns, and into leveraging proactive strategies for IoT security.
IoTHoneypot