Paper2026
Material reviewed: AbstractThe authors introduce ICSLure, a modular honeynet framework intended to emulate realistic industrial control system environments. It integrates physical PLCs with live data sources over industrial protocols and virtualized network components, with monitoring to log attacker interactions.
OT/ICSNetworkHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe study implements a deception-driven security model (D-DSM) for a campus network environment, with decoy resources managed through a centralized deception mechanism. It aims to divert malicious activity away from critical assets, provide indicators of attack behavior, and complement existing defense-in-depth controls by improving visibility of advanced and lateral attacks while helping reduce false alerts.
NetworkDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThis work studies how large language model (LLM)-based penetration testing agents can allocate their execution budget when encountering honeypots. The authors formalize the attacker's problem as a budgeted decision process in which the agent must decide whether to continue exploitation or skip a target upon honeypot suspicion, proposing a detector-guided policy evaluated in a controlled mixed-host testbed.
NetworkEndpointHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe paper proposes an LLM-enabled cloud-native dynamic honeypot architecture in which the model acts only as a text synthesizer behind policy gating and state verification. The authors describe a session broker that classifies attacker commands rather than executing them, alongside ethical governance controls and an evaluation protocol.
CloudNetworkHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe authors present Mirage Mesh, a lightweight cyber deception framework for Linux environments that applies deception-in-depth across four layers: an SSH decoy built on Cowrie, a system-layer decoy administrative account, a fake Flask web administration interface, and a data-layer honeytoken credential file. The work proposes a shared DecoyAlertEvent schema to normalize observations from these layers, process them through a Wazuh-based detection and active-response pipeline with Python orchestration, map them to cyber kill-chain stages and MITRE ATT&CK techniques, and evaluate them with a Deception Effectiveness Metric (DEM).
NetworkEndpointHoneypotHoneytoken
Paper2026
Material reviewed: AbstractThis work proposes Federated TGCN-A2C, an architecture integrating temporal graph convolutional networks, LSTM-based digital twins, and a federated actor-critic agent to decide between allowing, isolating, or redirecting traffic to honeypots in IoT/IoMT devices. The authors report evaluations on public cybersecurity datasets along with explainability analysis supporting the system's decision-making.
IoTNetworkHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe authors discuss applying reinforcement learning to improve response generation in honeypots and propose Q-Cowrie, a customization of the medium-interaction Cowrie honeypot intended to increase deception and support adaptive decisions while interacting with attackers. They report two experimental studies, one deploying Cowrie to capture attacks and model attacker decision-making with a Markov decision process, and another using Q-Cowrie to support adaptive interaction.
NetworkHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe study proposes QuantumGuard, a proactive cybersecurity framework that combines cognitive honeynets, post-quantum-secured intelligence channels and reinforcement-learning-driven deception adaptation across 6G-enabled cyber-physical environments. The authors aim to integrate a cognitive honeynet orchestrator, a deception policy engine operating under partial observability, a transformer-based MITRE ATT&CK attribution network and a post-quantum federated intelligence bus into a single closed-loop control architecture, and they report a preliminary evaluation on benchmark datasets and a 320-endpoint testbed.
NetworkIoTHoneypotDecoy
Paper2026
Material reviewed: Full textEditor contributionPacheco and Staino present BUDA as an approach to simulating fictitious-user activity and strengthening decoy credibility, aligned with MITRE Engage.
EndpointNetworkDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThe article presents SAGE, an adaptive Internet of Things (IoT) honeypot that combines Finite-State Machine (FSM)-driven protocol emulation with GraphRAG-enhanced retrieval to model stateful IoT protocols and generate responses using a Large Language Model (LLM). The authors also describe a fact-checking engine and a feedback mechanism intended to refine responses and progressively expand state-response mappings based on observed adversarial interactions.
IoTHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe authors propose a proactive cyber-defense system that combines cyber deception, adversarial environment simulation and deep reinforcement learning, with GAN-generated attack vectors emulating zero-day and polymorphic threats. The aim is to train context-aware defense policies that detect malicious behavior, re-route detection vectors and trigger deceptive traps, evaluated with benign and adversarial traffic on a synthetic smart-grid network.
NetworkOT/ICSDecoyAdversary engagement
Paper2026
Material reviewed: AbstractAccording to the authors, this work presents SysEvolve, a system integrating three co-designed components (SysField, SysSpear, and SysArmor) to create a self-driven adversarial loop between LLM-based attack and defense agents. The authors describe the construction of realistic multi-host cyber ranges, attack scheme generation, and real-time interpretable defense. They also note that decoy endpoints deployed in the range affect LLM agent behavior.
NetworkDecoyAdversary engagement
Case study2026
Material reviewed: Public pageCritical readingIBM X-Force and Deception.Pro recorded two incidents in simulated organizations, observing reconnaissance, malware deployment and fake-document exfiltration.
EndpointOT/ICSDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThe authors introduce Trident, an agentic LLM red teaming framework for evaluating the robustness of Deep Reinforcement Learning (DRL)-based cyber defenses. The work includes a dynamic benchmark, a dataset of red-blue interaction trajectories, and an agentic architecture that generates attack strategies and translates them into executable policies against DRL defenders. According to the authors, Trident substantially reduces defensive performance and uncovers emergent behaviors such as decoy avoidance.
NetworkDecoyAdversary engagement
Paper2025
Material reviewed: AbstractAccording to the abstract, the authors present a descriptive model incorporating psychological and strategic factors (belief, scepticism, deception fidelity, reconnaissance, and experience) to explain an attacker's initial decision to engage or withdraw from cyber-deception techniques. The authors state they have designed experiments using Capture the Flag activities and biometric observations to evaluate the model, but explicitly clarify that these experiments have not yet been conducted and no experimental findings are presented in the paper.
NetworkDecoyAdversary engagement
Paper2025
Material reviewed: AbstractThis paper introduces an automated cloud defense framework that leverages medium- to high-interaction honeypot telemetry to dynamically update firewall rules in real time. According to the authors, the system integrates the Cowrie honeypot, Azure-native automation tools, and MITRE ATT&CK-aligned classification within a closed-loop feedback mechanism. The authors report an average Mean Time to Block of 0.86 seconds and classification of over 12,000 SSH attempts in experimental testing.
CloudNetworkHoneypotAdversary engagement
Paper2025
Material reviewed: AbstractAccording to the abstract, the authors propose a honeypot-based guardrail system that fine-tunes a bait model to generate ambiguous, non-actionable responses used as lures to probe user intent during multi-turn interactions with LLMs. The work introduces metrics (HUS and DER) to evaluate bait attractiveness and the safety-usability tradeoff, with initial experiments on a multi-turn jailbreak dataset applied to GPT-4o.
ApplicationHoneypotAdversary engagement
Paper2025
Material reviewed: AbstractThe authors present a simulated Gym-based environment for adversarial reinforcement learning in network security, where attacker and defender agents trained with DQN compete under a zero-sum reward framework. The environment models brute-force attacks and reactive defenses, including honeypot traps and adaptive rate-limiting, and the authors report that defender observability and trap effectiveness create substantial barriers to successful attacks.
NetworkHoneypotAdversary engagement
Paper2025
Material reviewed: AbstractThe authors propose ADLAH, a conceptual adaptive honeynet architecture using reinforcement learning to decide in real time when to escalate sessions from low-interaction sensors to dynamically provisioned high-interaction honeypots. It is described as a functional prototype of the central decision mechanism, without field-scale validation due to insufficient live data.
NetworkHoneypotAdversary engagement
Paper2025
Material reviewed: AbstractAccording to the authors, this paper proposes a bi-level cyber warfare game framework for designing defensive deception mechanisms that exploit the cognitive vulnerabilities of Advanced Persistent Threat (APT) attackers. The approach combines strategic-level deception design with tactical and operational actions, and the authors report numerical improvements in defender rewards through strategically timed deception deployment.
NetworkAdversary engagement
Open software2025
Material reviewed: Repository metadataEditor contributionExperimental framework generating fictitious user profiles and activity for decoy environments; the repository documents narratives, profiles and language-model integration.
EndpointNetworkDecoyAdversary engagement
Paper2025
Material reviewed: AbstractThe authors present D3O-IIoT, a reinforcement learning model that dynamically coordinates deception techniques such as honeypot deployment, moving target defense, fake telemetry injection, and node isolation, driven by real-time threat monitoring. The defense problem is formulated as a Markov Decision Process, in which a Dueling Deep Q-Network agent maximizes a multi-objective reward to balance attack mitigation, deception engagement, false positive control, and resource cost.
IoTOT/ICSHoneypotMoving target defense
Paper2025
Material reviewed: AbstractThe authors present Koney, a Kubernetes operator that orchestrates cyber deception technology deployment through deception policy documents described as code. Using cloud-native technologies such as service meshes and eBPF, the system adds traps to containerized applications without source code access, facilitating setup, rotation, monitoring, and removal of traps, emphasizing maintainability, scalability, and operational simplicity.
CloudApplicationDecoyAdversary engagement
Paper2025
Material reviewed: AbstractThe authors propose a neuro-symbolic fusion approach for cognitive threat reasoning in cyber deception environments. It combines deep neural networks with symbolic reasoning, using knowledge graphs, probabilistic logic, and reinforcement learning to identify, predict, and respond to adversaries and to optimize deception strategies.
NetworkDecoyAdversary engagement