Paper2021
Material reviewed: AbstractThe authors propose applying natural language processing techniques to shell commands captured via honeypots to detect and correlate botnet behaviors. The approach reduces command sequences to stochastic processes, then processed with machine learning to build classifiers and predictors that cluster botnet source IP addresses, even when attackers attempt to obfuscate intrusion attempts through rapid or random permutation techniques.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThis paper describes the incorporation of deceptive elements, including honeypots and decoys, into Microsoft's CyberBattleSim experimentation platform. According to the authors, they tested the defensive capabilities of these elements against reinforcement-learning-based attackers in a capture-the-flag environment, finding that attacker progress depended on the number and location of deceptive elements.
NetworkHoneypotDecoy
Paper2021
Material reviewed: AbstractThe work proposes integrating low interaction honeypots with the ELK Stack as a server attack detection system, aiming to divert attacker access and to help administrators analyze the generated logs through visualization. The authors carried out five testing schemes comparing the Cowrie and Dionaea honeypots, and report that Cowrie delivered real-time detection with an average delay time of 3.75 seconds, while ELK provided better monitoring results for administrators through its visualization.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe paper proposes implementing a honeypot system alongside an Intrusion Detection System, using a Venus fly-trap optimization algorithm to interact with the attacker. The authors introduce a fitness function to estimate attacker size and compare their model with prior work through remote-to-local, probing, and DoS attacks.
NetworkHoneypot
Open software2021
Material reviewed: Repository metadataRepository about observation of Log4j scans; documentation and maintenance require further review.
ApplicationHoneypot
Paper2021
Material reviewed: AbstractThe paper proposes an industrial Early Intrusion Detection System (EIDS) that combines honeypots with machine learning algorithms. The authors describe collecting data from honeypot and industrial device sensors, storing it in a database and analyzing it to alert on intrusions in industrial control networks.
OT/ICSNetworkHoneypot
Paper2021
Material reviewed: AbstractAccording to the authors, this study deploys honeypots simulating Linux shells to collect heterogeneous threat event data (network traffic, file downloads, SSH logins, and attacker commands) and models attacker behavior using a Temporal Convolutional Network (TCN), comparing it against LSTM and GRU.
NetworkIoTHoneypot
Paper2021
Material reviewed: AbstractThe authors describe monitoring honeypot sensors deployed on Raspberry Pi devices integrated with Modern Honey Network, using SNMP as a network management function. The aim is to observe system resources and analyze how the number of attacks affects sensor performance.
NetworkEndpointHoneypot
Paper2021
Material reviewed: AbstractThe authors describe installing a honeypot on a server as an attack detector, with its logs exposed through a REST API built with the Django framework and a MongoDB database, so that an Android application can show whether the server is under attack and block the attacker's IP address. The work is framed around network security and the monitoring of attacks on a resource.
NetworkApplicationHoneypot
Paper2021
Material reviewed: AbstractThe work describes the design of a honeypot-based intrusion detection system (IDS) for the computer network of Universitas Bhayangkara Jakarta Raya. According to the authors, the honeypot simulates weak points to attract malware, records attacker activity, and produces logs that can be analyzed for handling and recovery during and after an attack.
NetworkHoneypot
Open software2021
Material reviewed: Repository metadataRemote Desktop Protocol in Twisted Python
NetworkHoneypot
Paper2021
Material reviewed: AbstractAccording to the authors, this paper proposes an approach to generate realistic user activity on IT systems, combining deterministic and deep learning-based methods through an external agent instrumented on each machine. The aim is to improve the credibility of attacker analysis platforms, such as honeynets, and facilitate the creation of coherent scenarios.
NetworkEndpointHoneypotAdversary engagement
Open software2021
Material reviewed: Repository metadataRepository about decoy Redis service; documentation and maintenance require further review.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe paper proposes an intelligent defense method for mobile-terminal unknown threats based on honeypot technology, as deposited by the authors. The approach aims to induce intruders to attack the honeypot terminal in order to delay attacks on the real target and to monitor, collect and analyze attack behavior.
IoTEndpointHoneypot
Paper2021
Material reviewed: AbstractThe authors propose RRPOT, a honeypot system that combines a native honeypot with a virtual machine record and replay (RnR) framework, aiming to postpone time-consuming analysis to the replay stage and thereby enable fine-grained analysis. The system employs on-demand record and on-demand replay mechanisms to reduce performance and storage costs and to improve replay efficiency, as described in the deposited abstract.
Honeypot
Open software2021
Material reviewed: Repository metadataSimple High Interaction Honeypot Solution for SMB protocol
NetworkHoneypot
Paper2021
Material reviewed: AbstractThis paper studies the DNS amplification attack ecosystem through a passive detection methodology at Internet exchange points (IXPs), combined with other measurement sources. According to the authors, IXPs and honeypots observe largely disjoint sets of attacks, and the study examines the effectiveness of observed attacks and the behavior of a dominant attacking entity.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe study, attributed to the authors, examines Cowrie Honeypot logs to inform the improvement of Snort rule signatures against brute force attacks. Snort acts as an intrusion prevention system and Cowrie as a tool to investigate anomalous behavior during such attacks; the authors report packet-matching processing times in microseconds for Hydra, Medusa and Ncrack attacks.
NetworkHoneypot
Paper2021
Material reviewed: Full textHistorical review of honeypots, honeytokens and moving target defense from the late 1980s through 2021.
NetworkEndpointHoneypotHoneytoken
Paper2021
Material reviewed: AbstractThe authors describe using honeynet data and time series to predict SSH attacks, covering overall activity and attacks from specific geographical regions. They apply ARIMA, SARIMA, GARCH and Bootstrapping with real-world data, presenting the viability, precision and usefulness of each approach across areas of IT security.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe authors present a multi-phased IoT honeypot ecosystem that gradually increases interaction sophistication with adversaries, including a low-interaction camera honeypot. According to the abstract, they applied data analytics to cluster observed attack activity over three years to identify attacker goals and patterns.
IoTHoneypot
Paper2020
Material reviewed: AbstractThe paper describes a computational intelligence enabled honeypot intended to discover and predict attempted fingerprinting attacks while it interacts with attackers. According to the authors, the system uses principal components analysis and a fuzzy inference system, and it was tested against five fingerprinting tools: Nmap, Xprobe2, NetScanTools Pro, SinFP3 and Nessus.
NetworkHoneypot
Paper2020
Material reviewed: AbstractThis paper describes the authors' initial efforts to build a honeypot ecosystem to gather and analyze real-world attack data against IoT devices. According to the abstract, they develop a multiphased approach that gradually increases the sophistication of low-interaction honeypots, deployed both on-premise and in the cloud, including a specific honeypot for IoT cameras called Honeycamera. The authors report observing attackers explicitly targeting IoT devices, with some activities appearing to involve direct human interaction.
IoTHoneypot
Paper2020
Material reviewed: AbstractThe authors extend the signaling game model into a two-way signaling game that represents the confrontation between defender and attacker, formally define the model, and propose an algorithm for identifying the refined Bayesian equilibrium. Based on calculated benefits, they analyze strategy choice and conduct a simulation to evaluate the model, with the aim of examining the use of deception-based defenses such as honeypots to improve IoT network security.
IoTHoneypot