Paper2019
Material reviewed: AbstractThe authors propose ICSTrace, a model for tracing malicious IP addresses attacking industrial control systems without deploying new network services. The model extracts function codes and parameters from attack data according to the industrial control protocol format, transforms them into vectors using a short sequence probability method, and applies a clustering algorithm (Partial Seeded K-Means) to associate attacks with an organization. According to the authors, ICSTrace was evaluated using attack data captured by large-scale deployed honeypots for industrial control systems.
OT/ICSHoneypot
Paper2019
Material reviewed: Public pageThe paper describes a low-interaction Python honeypot that presents a fake SSH service to observe attacker behavior and authentication attempts while hiding the real SSH service.
NetworkHoneypot
Paper2019
Material reviewed: AbstractAccording to the authors, this paper presents a user study with 40 participants evaluating HoneyBot, a hybrid-interaction honeypot designed for networked robotic systems that simulates unsafe actions while performing safe physical ones. The authors report that participants could not distinguish simulated sensor values from real ones.
IoTOT/ICSHoneypotDecoy
Open software2019
Material reviewed: Repository metadataRepository about Outlook Web Access simulation; documentation and maintenance require further review.
ApplicationHoneypot
Paper2019
Material reviewed: AbstractThe authors propose using a Cron job with a Perl script to periodically parse collected data into a database, aiming to reduce the size of logs generated by a honeypot under heavy traffic such as DDoS attacks. They report three DDoS attack cases to illustrate log growth.
NetworkHoneypot
Paper2019
Material reviewed: AbstractThe work addresses mapping and classifying bots that form part of IoT botnets and how they propagate across the Internet, a task the authors describe as challenging. According to the deposited abstract, Fooresec aimed to address this issue by footprinting, reporting and remotely securing IoT devices that had previously been turned into bots, relying on honeypots able to 'sense' the Internet in order to map and classify IoT bots according to their behaviours.
IoTHoneypot
Paper2019
Material reviewed: AbstractAccording to the authors, this paper proposes an SDN-based in-network honeypot that reroutes traffic from suspicious nodes and intelligently spoofs it with misleading information to confuse attackers in IoT environments, without requiring dedicated hardware. The authors state preliminary evaluations show little impact on network performance.
IoTNetworkHoneypotDecoy
Paper2019
Material reviewed: AbstractThe authors present experimental tests of common attacks on wired IPv6 networks and describe the design and implementation of a Honeynet with different operating systems. They use tools such as 6Guard, Snort and Wireshark to attract, detect and analyze attacker behavior.
NetworkHoneypotDecoy
Paper2019
Material reviewed: AbstractAccording to the authors, this chapter presents three proactive defense schemes against advanced attackers: defensive deception for detection and counter-deception, feedback-driven Moving Target Defense (MTD), and adaptive honeypot engagement. The authors propose strategic learning schemes tailored to different levels of information uncertainty for these strategies.
NetworkHoneypotMoving target defense
Paper2019
Material reviewed: AbstractAccording to the abstract, the authors conducted the first systematic study of an attack stealing cryptocurrencies via unprotected JSON-RPC endpoints in Ethereum nodes. They designed and deployed a honeypot to capture real-world attacks over six months, collecting millions of requests and analyzing attacker behavior and profits.
NetworkApplicationHoneypot
Paper2019
Material reviewed: AbstractThe work examines n-session recording attack resilient unaided authentication services (n-SRRUASs) and notes that they cope poorly with server-side issues within their authentication procedure. The authors propose generic principles for incorporating honeywords (fake passwords) into n-SRRUASs and, with the help of an existing n-SRRUAS, show the idea is implementable in practice to fill that gap.
IdentityHoneytoken
Paper2019
Material reviewed: AbstractThe authors present a data analysis of records from a geographically distributed honeypot server network deployed in Samara, Rostov-on-Don, Crimea and the USA, with methods for processing statistics discussed in detail for secure remote access SSH. Lists of attacking addresses are highlighted and their geographical affiliation determined, and request intensity to each of the 10 installed services is then calculated using rank distributions.
NetworkHoneypot
Open software2018
Material reviewed: Repository metadataRepository about Cisco ASA simulation; documentation and maintenance require further review.
NetworkHoneypot
Paper2018
Material reviewed: AbstractThe authors propose a high-interaction, self-acting spontaneous honeypot (SAS HP) whose behavior can dynamically change after learning from an attacker, and present its architecture for deployment in cloud environments to analyze attack patterns and secure cloud systems. They also describe how instances of the honeypot could be made available as a service to customers and how it could be deployed within the cloud, with the stated aim of developing a working prototype.
CloudHoneypot
Paper2018
Material reviewed: Publisher metadataBibliographic record on cyber deception overview and challenges. The abstract and findings still require review.
NetworkDecoy
Paper2018
Material reviewed: AbstractThis work proposes applying a cyber deception strategy in wireless local area networks, using decoys that are honeypots, to detect and characterize malicious activity such as the evil twin access point. The authors further describe how the same approach can be used to gather attacker activity information and to detect SSL stripping and DNS spoofing attacks.
NetworkHoneypotDecoy
Paper2018
Material reviewed: AbstractThe authors use game theory, including static Bayesian games, signaling games, and multi-stage models, to model defender-attacker interactions in cybersecurity under uncertainty and asymmetric information. Per the abstract, the study examines a case involving Advanced Persistent Threats (APTs) and the Tennessee Eastman process, considering that defenders may employ deception techniques such as honey files and honeypots to create strategic uncertainty for attackers.
NetworkOT/ICSHoneypotHoneytoken
Paper2018
Material reviewed: AbstractThe authors present 'ProfileGen', a method for automatically generating realistic honeypot profiles for professional social networks, intended to attract malicious actors in online social networks. They report that an evaluation by domain experts confirmed the generated profiles were indistinguishable from real ones.
IdentityApplicationHoneypot
Open software2018
Material reviewed: Repository metadataRepository about OWASP honeypot material; documentation and maintenance require further review.
NetworkHoneypot
Paper2018
Material reviewed: AbstractThe authors propose a game-theoretic model extending signaling games to include a probabilistic deception detector, applied to the design of defensive deception mechanisms in network security. The work analyzes pooling and partially-separating equilibria depending on detector quality.
NetworkAdversary engagement
Paper2018
Material reviewed: AbstractThis paper describes the design and implementation of a malware analysis laboratory based on honeypot technology in a controlled environment, aimed at studying the techniques used by attackers and analyzing security incidents. The authors also designed an administration interface to control and analyze the gathered information, and tested the system for several weeks to collect statistics about attacks and their perpetrators.
NetworkApplicationHoneypot
Paper2018
Material reviewed: AbstractThe authors describe a measurement study of attacks against or based on IoT protocols, using data obtained from a /15 network telescope and three honeypots with 15 IPv4 addresses. The study reports that telnet-based malware is still widely used, that infected devices are employed not only for DDoS attacks but also for crypto-currency mining, and that attackers look for IoT-specific services using MQTT, CoAP, UPnP, and HNAP, and target vulnerabilities of routers and cameras with HTTP.
IoTNetworkHoneypot
Open software2018
Material reviewed: Repository metadataRepository about Python deception framework; documentation and maintenance require further review.
ApplicationHoneypot
Paper2018
Material reviewed: Publisher metadataBibliographic record on ransomware tracing through deception. The abstract and findings still require review.
EndpointDecoy