Paper2021
Material reviewed: AbstractThe authors present Honeyboost, an unsupervised framework combining honeypots with network anomaly detection to identify suspicious nodes before they reach the honeypot. The approach fuses horizontal (per-node time series) and vertical (per-protocol) analysis, using extreme value theory to reduce false positives, as described in the abstract.
NetworkHoneypot
Paper2021
Material reviewed: AbstractAccording to the authors, HoneyCar is a decision support framework for configuring honeypots in the Internet of Vehicles, based on known vulnerabilities from the NVD/CVE database. The approach models adversarial interaction as a repeated imperfect-information zero-sum game, aiming to compute optimal honeypot configuration strategies for threat intelligence collection.
IoTNetworkHoneypotDecoy
Open software2021
Material reviewed: Repository metadataA multi-purpose, modular medium-interaction honeypot based on Twisted.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe authors propose HIM, a preventive forensic process model for investigating IoT network incidents that uses honeypots to record attacks over one year. The model aims to cover the entire lifecycle of IoT forensic investigation and address the needs of forensic analysts and the legal community, and the authors report it was validated using various methods.
IoTNetworkHoneypot
Paper2021
Material reviewed: AbstractThe authors review theoretical aspects of honeypot systems and present a classification of honeypots on various grounds. They also describe the architecture of a honeypot system intended to investigate an attacker's behavior after penetration into the corporate system, as a tool for an organizational secure system.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe paper proposes and investigates a botnet detection and classification model that combines honeypots with machine learning, aimed at smart factories. The study was carried out in a hardware configuration virtually mimicking a smart factory environment, as described by the authors.
IoTOT/ICSHoneypot
Open software2021
Material reviewed: Repository metadataRepository about multi-protocol sensors; documentation and maintenance require further review.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThis article aims to introduce honeypots in the context of the Internet of Things (IoT), describe how IoT devices can be exploited by attackers, and investigate honeypot ecosystems for capturing and analyzing information from attacks against these IoT devices. The authors also state that they provide insights into the attack vectors present in most IoT systems, into understanding attack patterns, and into leveraging proactive strategies for IoT security.
IoTHoneypot
Paper2021
Material reviewed: AbstractThe authors propose applying natural language processing techniques to shell commands captured via honeypots to detect and correlate botnet behaviors. The approach reduces command sequences to stochastic processes, then processed with machine learning to build classifiers and predictors that cluster botnet source IP addresses, even when attackers attempt to obfuscate intrusion attempts through rapid or random permutation techniques.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThis paper describes the incorporation of deceptive elements, including honeypots and decoys, into Microsoft's CyberBattleSim experimentation platform. According to the authors, they tested the defensive capabilities of these elements against reinforcement-learning-based attackers in a capture-the-flag environment, finding that attacker progress depended on the number and location of deceptive elements.
NetworkHoneypotDecoy
Paper2021
Material reviewed: AbstractThis paper discusses methods for improving the realism and ecological validity of AI used for autonomous cyber defense, exploring the use of Inverse Reinforcement Learning (IRL) to understand attacker actions and utilities that cyber deception could thwart. According to the authors, the Tularosa study provides experimental data on real-world attacker techniques and tools that can inform autonomous defense systems.
Adversary engagement
Paper2021
Material reviewed: AbstractThe authors extend their anti-ransomware tool R-Locker to Windows, relying on a honeyfile-based approach in which 'infinite' trap files are disseminated around the target filesystem for early detection and to block ransomware action. The Windows version addresses differences in FIFO handling and adds improved global management of honeyfiles and (semi)automated blocking of suspicious ransomware through the dynamic use of white-/black-lists.
EndpointHoneytokenDecoy
Paper2021
Material reviewed: AbstractThe work proposes integrating low interaction honeypots with the ELK Stack as a server attack detection system, aiming to divert attacker access and to help administrators analyze the generated logs through visualization. The authors carried out five testing schemes comparing the Cowrie and Dionaea honeypots, and report that Cowrie delivered real-time detection with an average delay time of 3.75 seconds, while ELK provided better monitoring results for administrators through its visualization.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe paper proposes implementing a honeypot system alongside an Intrusion Detection System, using a Venus fly-trap optimization algorithm to interact with the attacker. The authors introduce a fitness function to estimate attacker size and compare their model with prior work through remote-to-local, probing, and DoS attacks.
NetworkHoneypot
Open software2021
Material reviewed: Repository metadataRepository about observation of Log4j scans; documentation and maintenance require further review.
ApplicationHoneypot
Paper2021
Material reviewed: AbstractThe paper proposes an industrial Early Intrusion Detection System (EIDS) that combines honeypots with machine learning algorithms. The authors describe collecting data from honeypot and industrial device sensors, storing it in a database and analyzing it to alert on intrusions in industrial control networks.
OT/ICSNetworkHoneypot
Paper2021
Material reviewed: AbstractAccording to the authors, this study deploys honeypots simulating Linux shells to collect heterogeneous threat event data (network traffic, file downloads, SSH logins, and attacker commands) and models attacker behavior using a Temporal Convolutional Network (TCN), comparing it against LSTM and GRU.
NetworkIoTHoneypot
Paper2021
Material reviewed: AbstractThe authors describe monitoring honeypot sensors deployed on Raspberry Pi devices integrated with Modern Honey Network, using SNMP as a network management function. The aim is to observe system resources and analyze how the number of attacks affects sensor performance.
NetworkEndpointHoneypot
Paper2021
Material reviewed: AbstractThe authors describe installing a honeypot on a server as an attack detector, with its logs exposed through a REST API built with the Django framework and a MongoDB database, so that an Android application can show whether the server is under attack and block the attacker's IP address. The work is framed around network security and the monitoring of attacks on a resource.
NetworkApplicationHoneypot
Paper2021
Material reviewed: AbstractThe work describes the design of a honeypot-based intrusion detection system (IDS) for the computer network of Universitas Bhayangkara Jakarta Raya. According to the authors, the honeypot simulates weak points to attract malware, records attacker activity, and produces logs that can be analyzed for handling and recovery during and after an attack.
NetworkHoneypot
Paper2021
Material reviewed: AbstractThe work addresses the protection of vulnerable components in Internet-of-Things (IoT) networks through an intrusion prevention technique that combines cyberdeception (a decoy system) and moving target defense (network topology shuffling). The authors analytically evaluate effectiveness and efficiency using a graphical security model in an SDN-based IoT network, defining strategies for when and how to perform topology shuffling to pursue goals such as prolonging system lifetime, increasing attack complexity on critical nodes, or maintaining service availability.
IoTNetworkDecoyMoving target defense
Open software2021
Material reviewed: Repository metadataRemote Desktop Protocol in Twisted Python
NetworkHoneypot
Paper2021
Material reviewed: AbstractAccording to the authors, this paper proposes an approach to generate realistic user activity on IT systems, combining deterministic and deep learning-based methods through an external agent instrumented on each machine. The aim is to improve the credibility of attacker analysis platforms, such as honeynets, and facilitate the creation of coherent scenarios.
NetworkEndpointHoneypotAdversary engagement
Open software2021
Material reviewed: Repository metadataRepository about decoy Redis service; documentation and maintenance require further review.
NetworkHoneypot