Dataset or lab2020
Material reviewed: Public pageA set of PANDA traces collected with PANDAcap on a VM configured to accept all passwords for root, intended as a starting point for analyzing SSH brute force attacks. The material is organized into full-system traces, disk images and network captures.
NetworkEndpointHoneypotAdversary engagement
Paper2020
Material reviewed: Public pageThe paper presents PANDAcap, a framework for automating full-system deterministic trace collection and preparing repeatable experiments. The authors describe its use in an SSH honeypot to study the actions of brute-force attacks.
NetworkHoneypot
Paper2020
Material reviewed: AbstractThe authors introduce a platform for the periodic automated processing of data collected by honeypots, generating statistics and graphs from a set of traffic capture files in PCAP format. The stated purpose is to reduce the delay in perceiving atypical occurrences and trend changes that manual processing and analysis of monitoring data introduces, with a modular design that allows the platform to be easily extended and adapted to produce different outputs.
NetworkHoneypot
Paper2020
Material reviewed: AbstractAccording to the authors, this paper introduces 'Primer', a tool for priming and evaluating dynamic honeypots against previously developed measures of effectiveness related to environment fingerprinting, capturing adversary data, deception, and self-monitoring. The authors state they provide quantitative calibration results as a step toward automated effectiveness testing.
NetworkHoneypotDecoy
Paper2020
Material reviewed: AbstractThe paper reviews the use of deception technology, specifically honeypot systems, to address threats against IoT devices. The authors compare the most popular existing honeypot systems, identify their strengths and weaknesses, and attempt to adapt them to operate at the level of Internet of things devices.
IoTHoneypotDecoy
Paper2020
Material reviewed: AbstractThe paper addresses detection and mitigation of DDoS attacks, specifically ICMP Flood, in Software Defined Networks (SDN), where controller centralization creates a vulnerability. The authors propose integrating the Modern Honey Network (MHN) into SDN and using a reactive application outside the controller based on entropy, computed from source IP, destination IP and protocol, to identify anomalous traffic.
NetworkHoneypot
Paper2020
Material reviewed: AbstractThis paper addresses the synthesis of active deception strategies in networks using two-player games with asymmetric information and temporal logic objectives, incorporating decoy systems and high-fidelity honeypots. The authors use a level-2 hypergame framework to model the attacker's incomplete perception and assess whether the defender can guarantee security properties.
NetworkDecoyHoneypot
Paper2020
Material reviewed: AbstractThe study simulates a network defense combining IPS Snort, which examines packets and blocks access identified as attacks, with Honeypot Artillery, which detects intrusion attempts through open ports and records attacker information in a database viewable through a web interface.
NetworkHoneypot
Open software2020
Material reviewed: Repository metadataA simple low-interaction port monitoring honeypot.
NetworkHoneypot
Open software2020
Material reviewed: Repository metadataframework for a high interaction SSH honeypot
NetworkHoneypot
Paper2019
Material reviewed: AbstractAccording to the authors, this work proposes a framework for modeling attacker behavior to better predict future actions using a novel semi-supervised algorithm called Fusion Hidden Markov Model (FHMM). Experiments were conducted on real attack data captured from a Cowrie honeypot system, comparing FHMM's performance against Markov Chains, traditional HMMs, and deep recurrent neural network architectures.
NetworkHoneypot
Paper2019
Material reviewed: AbstractThe authors propose an automatic identification model based on a random forest algorithm with three feature groups—application-layer, network-layer, and other system-layer features—to remotely check whether a server runs a honeypot service. The experiment datasets were collected from public known platforms, and the authors report that the model achieved an AUC value of 0.93.
NetworkApplicationHoneypot
Paper2019
Material reviewed: AbstractThe authors analyze how country attributes—such as population size, access to information and communication technologies, and ICT use—influence the number of secure shell attacks seen by their honeynet, using four statistical models built from three data sources and methods including partial least-squares path modelling and clustering of countries by similarity.
NetworkHoneypot
Paper2019
Material reviewed: AbstractAccording to the abstract, this work develops inference techniques to detect organic click fraud in advertising networks. The authors note that malware detection systems, including honeypots, fail to stop click fraud apps, and propose two defenses: a mimicry defence based on detecting click reuse patterns, and a bait-click defence that injects decoy clicks to trigger fraudulent app behavior.
NetworkApplicationHoneypotDecoy
Open software2019
Material reviewed: Repository metadataRepository about Drupal simulation; documentation and maintenance require further review.
ApplicationHoneypot
Paper2019
Material reviewed: AbstractThe authors propose ICSTrace, a model for tracing malicious IP addresses attacking industrial control systems without deploying new network services. The model extracts function codes and parameters from attack data according to the industrial control protocol format, transforms them into vectors using a short sequence probability method, and applies a clustering algorithm (Partial Seeded K-Means) to associate attacks with an organization. According to the authors, ICSTrace was evaluated using attack data captured by large-scale deployed honeypots for industrial control systems.
OT/ICSHoneypot
Paper2019
Material reviewed: Public pageThe paper describes a low-interaction Python honeypot that presents a fake SSH service to observe attacker behavior and authentication attempts while hiding the real SSH service.
NetworkHoneypot
Paper2019
Material reviewed: AbstractAccording to the authors, this paper presents a user study with 40 participants evaluating HoneyBot, a hybrid-interaction honeypot designed for networked robotic systems that simulates unsafe actions while performing safe physical ones. The authors report that participants could not distinguish simulated sensor values from real ones.
IoTOT/ICSHoneypotDecoy
Open software2019
Material reviewed: Repository metadataRepository about Outlook Web Access simulation; documentation and maintenance require further review.
ApplicationHoneypot
Paper2019
Material reviewed: AbstractThe authors propose using a Cron job with a Perl script to periodically parse collected data into a database, aiming to reduce the size of logs generated by a honeypot under heavy traffic such as DDoS attacks. They report three DDoS attack cases to illustrate log growth.
NetworkHoneypot
Paper2019
Material reviewed: AbstractThe work addresses mapping and classifying bots that form part of IoT botnets and how they propagate across the Internet, a task the authors describe as challenging. According to the deposited abstract, Fooresec aimed to address this issue by footprinting, reporting and remotely securing IoT devices that had previously been turned into bots, relying on honeypots able to 'sense' the Internet in order to map and classify IoT bots according to their behaviours.
IoTHoneypot
Paper2019
Material reviewed: AbstractAccording to the authors, this paper proposes an SDN-based in-network honeypot that reroutes traffic from suspicious nodes and intelligently spoofs it with misleading information to confuse attackers in IoT environments, without requiring dedicated hardware. The authors state preliminary evaluations show little impact on network performance.
IoTNetworkHoneypotDecoy
Paper2019
Material reviewed: AbstractThe authors present experimental tests of common attacks on wired IPv6 networks and describe the design and implementation of a Honeynet with different operating systems. They use tools such as 6Guard, Snort and Wireshark to attract, detect and analyze attacker behavior.
NetworkHoneypotDecoy
Paper2019
Material reviewed: AbstractAccording to the authors, this chapter presents three proactive defense schemes against advanced attackers: defensive deception for detection and counter-deception, feedback-driven Moving Target Defense (MTD), and adaptive honeypot engagement. The authors propose strategic learning schemes tailored to different levels of information uncertainty for these strategies.
NetworkHoneypotMoving target defense