Paper2022
Material reviewed: Public pageThe paper proposes an intrusion detection framework combining CAPTCHA, honeypots and supervised learning. Honeypots would be integrated into a website to lure malicious software, and the diagram sketches realistic decoy pages and decoy fields.
ApplicationNetworkHoneypotDecoy
Paper2022
Material reviewed: AbstractThis paper introduces TSM (Topic Semantic Matching), a metric based on topic modelling and semantic matching in embedding spaces to measure the enticement of honeyfiles relative to local content. According to the authors, it is the first measure using NLP techniques to quantify this enticement robustly against paraphrasing, supported by a honeyfile corpus built with various NLP methods.
EndpointHoneypotDecoy
Paper2022
Material reviewed: AbstractThis work models attacker-defender engagements as Markov Games to understand human adversarial behaviors and optimize defensive strategy. The authors validate their approach using a Capture-The-Flag (CTF) setup and user studies across varying skill levels. According to the authors, application-level deceptions are an optimal mitigation strategy against targeted attacks, outperforming classic defensive maneuvers, and they present an analysis of attacker behavior when trapped in an embedded honeypot environment.
ApplicationHoneypotAdversary engagement
Paper2021
Material reviewed: AbstractThe authors propose a multiphase dynamic deployment mechanism for virtualized honeypots (MD2VH) based on intelligent attack path prediction, modeling attack and defense characteristics with a Bayesian state attack graph and a multiphase deployment optimization model based on an extended Markov decision process, and generating deployment strategies by combining online and offline reinforcement learning. They implement a prototype system on software-defined networking and virtualization containers and report experiments on capture rate under simple and complex topologies.
NetworkHoneypotMoving target defense
Paper2021
Material reviewed: AbstractThe authors present a low-cost honeypot capable of blocking commands or replying with insults to attackers, modeling the attacker-defender interaction as a Bayesian two-player game. According to the abstract, three honeypot instances were deployed and over 200 sessions were captured for a qualitative analysis of post-exploitation behavior.
NetworkHoneypotAdversary engagement
Paper2021
Material reviewed: AbstractThis paper presents, according to its authors, a machine learning-based method for dynamic configuration, deployment and maintenance of honeypots in networks. The approach identifies and clusters machines and devices to intelligently deploy honeypots, reducing the need for manual configuration.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe authors propose a low-interaction, adaptive and dynamic web application honeypot that imitates vulnerabilities through HTTP events, using the SNARE and TANNER tools to generate the attack surface and analyze/classify incoming requests, as described in the abstract.
ApplicationHoneypot
Paper2021
Material reviewed: AbstractThe authors propose a defensive deception framework for the container-based cloud, aiming to reveal stealthy attackers by presenting intentionally falsified information. The approach formalizes a System Risk Graph (SRG) as an updatable adversarial model, trains a deep reinforcement learning (DRL) model over the SRG so the agent produces decoy placement and deceptive routing strategies, and defines a coefficient of deception to evaluate the placement strategy.
CloudDecoyAdversary engagement
Paper2021
Material reviewed: Full textTwo-factor authentication mechanism combining decoy codes with Google Authenticator.
IdentityHoneytoken
Paper2021
Material reviewed: Full textVision paper on automated generation of realistic deception artifacts with machine learning.
NetworkIdentityDecoy
Paper2021
Material reviewed: AbstractAccording to the authors, this work studies two-sided deception in cybersecurity by manipulating the observable configuration of both honeypots and real machines. Using an experiment with a 40-machine network (20 honeypots) and an experimental testbed, the authors compare three feature-concealment conditions against human attackers.
NetworkHoneypotDecoy
Paper2021
Material reviewed: Public pageThe linked preprint abstract describes DARLH, a honeypot system that uses deep reinforcement learning-based and deep recurrent neural network-based IDS agents to detect internal and external runtime DoS attacks. Its purpose is to provide dynamic intrusion detection and event validation for monitoring DoS attacks in the honeypot environment.
NetworkHoneypotDecoy
Paper2021
Material reviewed: Full textBibliographic record on design thinking for cyber deception. The abstract and findings still require review.
NetworkDecoy
Paper2021
Material reviewed: AbstractThe paper describes the use of honeypot agents that generate Route Request (RREQ) packets to attract and entrap black hole attackers in mobile ad hoc networks (MANETs), together with a deep learning technique based on Long-Short Term Memory (LSTM). The authors evaluate the proposed scheme, named HPAS-LSTM, through ns-2 simulations and compare its results with other black hole detection methods in terms of throughput, packet loss rate, packet delivery ratio and total network delay.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe work addresses the selection and classification of honeypots (virtual decoys, online traps) by their effectiveness, using characteristics such as installation and configuration, usage and support, data collection, logging level, simulation level and interaction level. The authors describe a method that forms a set of honeypots, subsets of characteristics and identifier values of linguistic estimates, base and derived frequency matrices, and fuzzy terms and reference fuzzy numbers with their visualization, in order to construct linguistic standards for multi-criteria assessment.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe authors propose OFULinMat, an episodic learning algorithm for repeated zero-sum games with unknown, time-varying payoff matrices, leveraging an ensemble of game models as prior information. The algorithm achieves a sublinear bound on saddle-point regret. As a case study, they use a dynamic honeypot allocation game to illustrate and corroborate their theoretical results.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThis paper presents an approach to container-based honeypots that simulate container escapes as a deception technique in the context of cloud computing virtualization. According to the authors, it investigates the possibilities of container-based honeypots to imitate legitimate network targets and raise alerts on attacker interactions, allowing study of attacker techniques.
NetworkCloudHoneypotDecoy
Paper2021
Material reviewed: AbstractAccording to the abstract, the authors exposed an SSH service on an internet-connected Raspberry Pi device for over six days to act as a honeypot, logging received login attempts. The study provides an analysis of request origins and intruder focus areas.
IoTNetworkHoneypot
Paper2021
Material reviewed: Publisher metadataBibliographic record on failure analysis in IoT experiments. The abstract and findings still require review.
IoTHoneypot
Paper2021
Material reviewed: AbstractAccording to the abstract, the authors propose a hypergame framework between an attacker and a defender where each can interpret the situation differently based on asymmetric beliefs, applied to advanced persistent threats (APT) across the cyber kill chain. The work evaluates through simulations how defensive deception strategies can manipulate attacker beliefs.
NetworkAdversary engagementDecoy
Paper2021
Material reviewed: Publisher metadataBibliographic record on game-theoretic deception models. The abstract and findings still require review.
NetworkAdversary engagement
Paper2021
Material reviewed: AbstractThis paper is a survey examining defensive deception approaches grounded in game theory and machine learning within cyber defense research. According to the authors, it analyzes key components, underlying principles, and tradeoffs of different approaches across various problem settings. The work compiles insights, lessons, and limitations from prior research and proposes future directions to address existing gaps.
NetworkAdversary engagementDecoy
Paper2021
Material reviewed: AbstractThis paper, according to its authors, revisits the honeypot fingerprinting field by proposing a multistage framework combining existing and novel techniques. Through large-scale IPv4 address scans, the authors report identifying thousands of honeypot instances as well as non-honeypot vulnerable systems, and discuss countermeasures against fingerprinting.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe authors present GPT-2C, a run-time system that leverages the pre-trained GPT-2 model to parse dynamic logs generated by a Cowrie SSH honeypot, addressing interoperability limitations with EDR and SIEM technologies. According to the abstract, the fine-tuned model achieves 89% inference accuracy in the new domain with acceptable execution latency.
NetworkEndpointHoneypot