Paper2026
Material reviewed: AbstractPresents the design, implementation, and evaluation of a honeypot monitoring system deployed on AWS that emulates SSH, HTTP, and HTTPS services on EC2 instances within an isolated virtual private cloud. The system aims to attract, record, and analyze malicious interactions, using a Python/Flask backend and a React/D3.js dashboard for attack visualization.
CloudNetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThe paper describes the design of a honeypot framework deployed in a cloud environment to support threat detection and incident response. According to the authors, it integrates Microsoft Azure services to monitor and analyze malicious behavior, using telemetry, threat intelligence and automated workflows.
CloudHoneypot
Paper2026
Material reviewed: AbstractThe paper introduces Co-ADAM, a defense framework that formalizes cyber deception in the Industrial Internet of Things (IIoT) as a constrained Markov decision process with an embedded signaling game, aiming to jointly model the deception investment level and a co-evolutionary adversary that accumulates skepticism. The authors describe training a deep Q-network (DQN) defender against an adaptive attacker pool with budget constraints and skepticism dynamics embedded in the environment, and report evaluation on several IIoT datasets and a physical testbed.
IoTOT/ICSHoneypotDecoy
Paper2026
Material reviewed: Public pageThe chapter analyzes cyberviolence and the traits of adolescent cyberaggressors and proposes comprehensive prevention involving families, educational institutions and technological tools such as honeynets to analyze attacker behavior and mitigate the impact.
Honeypot
Paper2026
Material reviewed: Publisher metadataBibliographic record on language-model honeypot tuned on Cowrie data. The abstract and findings still require review.
NetworkHoneypot
Paper2026
Material reviewed: Public pageThe authors describe installing and configuring Cowrie on Linux as an SSH and Telnet honeypot that logs attacker login attempts, credentials, and terminal commands to log files.
NetworkHoneypotAdversary engagement
Dataset or lab2026
Material reviewed: Public pageCritical readingJSONL shell-conversation datasets for training and testing language-model SSH honeypots, according to Zenodo.
NetworkHoneypot
Paper2026
Material reviewed: AbstractThe authors propose using honey drones as a deception strategy to defend unmanned aerial vehicle (UAV) mission systems against denial-of-service attacks. They formulate an attacker-defender optimization problem based on radio signal strength and present an approach called HT-DRL, combining hypergame theory with deep reinforcement learning to identify optimal deception strategies.
IoTNetworkDecoyAdversary engagement
Open software2026
Material reviewed: Repository metadataEditor contributionOpen Docker Compose lab with vulnerable services, configurable deception levels, monitoring and an attacker environment for controlled training and research.
NetworkApplicationHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors examine the assumption that decoys can be placed wherever attacker behavior occurs, applying a four-criterion rubric to all 250 MITRE ATT&CK v18.1 techniques. They find only 32% of techniques admit a plausible decoy and describe two placement patterns, Sweep and Seek, offering a simple rule for decoy deployment.
NetworkEndpointDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThe work proposes DecoyShield, a deception-based cybersecurity framework for proactive detection. It leverages multi-service honeypot environments that simulate network services, capture attacker behavior, and integrate behavioral analysis, threat intelligence, and dynamic risk scoring to classify severity and deploy adaptive responses.
NetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThis paper presents DecoyTrace, a proactive cyber deception-based defense designed for strictly serverless decentralized federated learning (DFL) environments. According to the authors, the system deploys a mobile DecoyNode that generates decoy challenges using chaotic maps, disseminates a dual model (clean vs. decoy) based on neighbor trust, and evaluates behavior using three-state semantic metrics to identify and contain malicious sources. The authors report evaluations on the NEBULA platform across multiple configurations, datasets, and topologies.
NetworkApplicationDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThis data article presents MURHCAD, a high-resolution honeynet dataset collected over 72 hours in June 2025 on Microsoft Azure, using three honeypots (Cowrie, Dionaea, and SentryPeer) deployed across four geographically dispersed virtual machines. According to the authors, the dataset comprises 132,425 attack events with enriched metadata (timestamps, IPs, geolocation, ports, and protocols) intended to support anomaly detection, protocol-misuse studies, and threat intelligence research.
CloudNetworkHoneypot
Paper2026
Material reviewed: AbstractThis report addresses the challenge of detecting AI-driven offensive cyber agents, proposing a strategic 'detection-in-depth' framework. According to the authors, five detection mechanisms are presented, including agent identifiers and agent honeypots, intended to support policymakers and industry against this emerging threat.
NetworkCloudHoneypotAdversary engagement
Dataset or lab2026
Material reviewed: Public pageCritical readingZenodo record of DICOM/PACS telemetry from medical-imaging honeypot research; it documents periods of data loss.
ApplicationOT/ICSHoneypot
Paper2026
Material reviewed: AbstractThis paper presents DICOMHawk, a cyber-deception framework that emulates DICOM and PACS services with realistic interactions, dynamically populated medical records, and embedded honeytokens, designed to protect medical imaging infrastructure. According to the authors, in a 424-day deployment across multiple networks, DICOMHawk attracted more valid sessions than Dicompot, avoided honeypot detection, and captured 67 medical-related attacks from 15 unique IPs.
NetworkApplicationHoneypotHoneytoken
Open software2026
Material reviewed: Repository metadataDICOM Honeypot
NetworkHoneypot
Paper2026
Material reviewed: AbstractThis paper presents a behavior-driven attacker profiling framework built from empirical data collected in SSH honeypot deployments. The methodology parses complex command chains to identify behavioral patterns, organize them into hierarchical clusters, and map them to the MITRE ATT&CK framework for structured threat interpretation.
NetworkHoneypot
Paper2026
Material reviewed: AbstractThe authors propose an antifragile framework that uses cyber deception with adaptive decoys and dynamic network movements to generate adversarial signals, infer threat actor profiles and support proactive decisions. A cyber threat intelligence ontology and a knowledge graph with semantic attributes represent tactical and strategic relationships between attackers and targets.
NetworkDecoyAdversary engagement
Open software2026
Material reviewed: Repository metadataHoneypot type for Symfony forms
NetworkHoneypot
Paper2026
Material reviewed: AbstractThe paper describes an intrusion detection system that monitors live packets and uses predefined rules to detect suspicious activity rather than machine learning models. It includes a honeypot module with a fake login interface and human-readable explanations for detected anomalies.
NetworkHoneypot
Paper2026
Material reviewed: AbstractThe study investigates whether psychologically engineered "bias triggers" can exploit human attackers' Type I heuristic processing to degrade their performance. The authors use a high-fidelity cyber range where participants conduct network penetration with and without these triggers, analyzing operational telemetry.
NetworkDecoyAdversary engagement
Open software2026
Material reviewed: Repository metadataExpress honeypot for remote file inclusion (RFI) and local file inclusion (LFI).
NetworkHoneypot
Paper2026
Material reviewed: AbstractThis paper presents LDT-FRL, a defense framework combining temporal attention encoders, lightweight digital twins, and a federated reinforcement learning (PPO) agent capable of redirecting suspicious traffic to honeypots in IoMT (Internet of Medical Things) environments. According to the authors, the system was evaluated on public network traffic benchmarks, achieving high classification metrics and explainability via techniques such as SHAP and Grad-CAM.
IoTNetworkHoneypotAdversary engagement