Paper2026
Material reviewed: AbstractThe authors propose an antifragile framework that uses cyber deception with adaptive decoys and dynamic network movements to generate adversarial signals, infer threat actor profiles and support proactive decisions. A cyber threat intelligence ontology and a knowledge graph with semantic attributes represent tactical and strategic relationships between attackers and targets.
NetworkDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThe study investigates whether psychologically engineered "bias triggers" can exploit human attackers' Type I heuristic processing to degrade their performance. The authors use a high-fidelity cyber range where participants conduct network penetration with and without these triggers, analyzing operational telemetry.
NetworkDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThis paper presents LDT-FRL, a defense framework combining temporal attention encoders, lightweight digital twins, and a federated reinforcement learning (PPO) agent capable of redirecting suspicious traffic to honeypots in IoMT (Internet of Medical Things) environments. According to the authors, the system was evaluated on public network traffic benchmarks, achieving high classification metrics and explainability via techniques such as SHAP and Grad-CAM.
IoTNetworkHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe authors study attacker behavior across eleven SSH honeypots accepting both interactive and non-interactive sessions over fifteen days. According to the abstract, they found that the vast majority of authenticated sessions were non-interactive, challenging common assumptions in cyber deception research focused on interactive shells.
NetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThe paper proposes HIVE-O, a decentralized honeypot framework for IoT ecosystems, with lightweight distributed nodes that capture, analyze and share attack intelligence without a single point of control. The authors describe emulation of IoT services and protocols and an experimental evaluation of reconnaissance, exploitation and denial-of-service attempts.
IoTHoneypotDecoy
Paper2026
Material reviewed: AbstractThis position paper suggests that presenting deception storyline content can influence how human attackers and Large Language Model (LLM) Agent attackers evaluate the authenticity of deception functions and effects on a network or host. The authors introduce HoneyContent, a practiced industry cyber deception model for designing and creating deception storyline content to 'wrap' or embed deception functions, integrating warranting theory and signaling theory, and visualize its use in an industry cyber deception scenario.
NetworkEndpointDecoy
Paper2026
Material reviewed: AbstractThe abstract describes Honey Shield, a deception-driven cybersecurity paradigm for web authentication systems. It proposes a centralized security service interface offering defenses such as honeypot redirection and SQL injection protection, redirecting malicious users to a decoy system and logging incidents for later analysis.
ApplicationIdentityHoneypotDecoy
Paper2026
Material reviewed: AbstractThis paper adapts the Honeyquest instrument to automatically evaluate LLM-based attacker judgment against cyber deception techniques. According to the authors, a cohort of 21 models from various providers was compared against a human baseline on reconnaissance tasks, finding that LLMs fall for traps at higher rates than humans and show a gap between recognizing deception in their reasoning and acting accordingly. The authors conclude that human-centered deception hypotheses do not reliably transfer to AI attackers.
NetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors present HoneyRoute, an inference-serving layer that detects malicious requests and routes them to a dedicated honeypot model, shielding the production model while harvesting attacker intelligence. The system combines a streaming router, a dual-implementation honeypot, and an analysis loop that feeds back into router retraining.
ApplicationCloudHoneypotDecoy
Paper2026
Material reviewed: AbstractAccording to the authors, HoneyTrap is a deceptive defense framework for large language models that employs four collaborative defender agents to counter multi-turn jailbreak attacks by directing attackers toward honeypot traps. The authors also introduce a progressive multi-turn jailbreak dataset (MTJ-Pro) and two new evaluation metrics for deceptive defense. They report reductions in attack success rates across several commercial and open-source models.
ApplicationHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThis work presents Honeyval, an evaluation framework for LLM-powered HTTP honeypots. According to the authors, the framework uses AI hacking agents as attackers and diverse backend applications to reproducibly evaluate the performance and detectability of these honeypots compared to prior limited evaluation methods.
NetworkApplicationHoneypotDecoy
Open software2026
Material reviewed: Public pageThe statically read code defines configurable TCP bait ports that accept and close connections; it logs interactions and requests a firewall block for source IPs outside the allowlist.
NetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThis paper presents a noise-aware measurement study of Internet-facing DICOM services, combining IPv4-wide active scanning with passive honeypot deployments. The authors introduce a reproducible method to filter false positives caused by honeypots, network telescopes, and other measurement artifacts, reducing apparent exposure by 39%. After filtering, they identify thousands of vulnerable deployments lacking encryption and authentication, finding that existing deception systems are insufficient to capture the actual risks.
NetworkApplicationHoneypotDecoy
Paper2026
Material reviewed: AbstractThe study implements a deception-driven security model (D-DSM) for a campus network environment, with decoy resources managed through a centralized deception mechanism. It aims to divert malicious activity away from critical assets, provide indicators of attack behavior, and complement existing defense-in-depth controls by improving visibility of advanced and lateral attacks while helping reduce false alerts.
NetworkDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThe authors propose MemPot, a defense framework that injects optimized honeypots into the memory of large language model (LLM)-based agents to counter extraction attacks. Through a two-stage optimization process and a detection model based on Wald's Sequential Probability Ratio Test, the authors report improved detection performance over existing baselines in their experiments.
ApplicationHoneypotDecoy
Open software2026
Material reviewed: Repository metadataMimicry is a dynamic deception tool that actively deceives an attacker during exploitation and post-exploitation.
NetworkDecoy
Paper2026
Material reviewed: AbstractThe authors present Mirage Mesh, a lightweight cyber deception framework for Linux environments that applies deception-in-depth across four layers: an SSH decoy built on Cowrie, a system-layer decoy administrative account, a fake Flask web administration interface, and a data-layer honeytoken credential file. The work proposes a shared DecoyAlertEvent schema to normalize observations from these layers, process them through a Wazuh-based detection and active-response pipeline with Python orchestration, map them to cyber kill-chain stages and MITRE ATT&CK techniques, and evaluate them with a Deception Effectiveness Metric (DEM).
NetworkEndpointHoneypotHoneytoken
Paper2026
Material reviewed: AbstractThis paper, according to its authors, reviews AI-based solutions for building network- and device-level cyber deception methods in contested environments. It focuses on combining large language models (LLMs) and reinforcement learning (RL) to optimize deception strategies such as honeypots and honeynets, and examines their validation against stealthy attacks on operational technology (OT) systems reported in the literature.
NetworkOT/ICSHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors present a cyber-risk management framework for networked digital systems combining strategic game behavior with contagion dynamics. The study addresses optimal cybersecurity resource allocation considering heterogeneous node valuations by attackers and defenders, proposing contagion-path-based risk measures and analyzing cyber deception effects through numerical experiments.
NetworkDecoy
Paper2026
Material reviewed: AbstractThis paper presents Ollure, a low- and medium-interaction honeypot that emulates the Ollama API without a backend LLM, as described by the authors. Deployed across four locations over 84 days, it recorded hundreds of thousands of interactions from thousands of source IP addresses. The study documents automated discovery and fingerprinting activity, as well as concrete exploitation attempts against both the infrastructure and LLM layers.
NetworkApplicationHoneypotDecoy
Paper2026
Material reviewed: AbstractThis thesis proposes game-theoretic and optimisation-based models for hardening Active Directory attack graphs. According to the authors, it introduces a honeypot/decoy placement model that minimises shortest paths and Domain Admin-reachable nodes, along with strategies accounting for the dynamic nature of the graph and adaptive prioritisation models incorporating administrator feedback. The authors note that the underlying problems are computationally intractable.
IdentityNetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThis work proposes Federated TGCN-A2C, an architecture integrating temporal graph convolutional networks, LSTM-based digital twins, and a federated actor-critic agent to decide between allowing, isolating, or redirecting traffic to honeypots in IoT/IoMT devices. The authors report evaluations on public cybersecurity datasets along with explainability analysis supporting the system's decision-making.
IoTNetworkHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe study proposes QuantumGuard, a proactive cybersecurity framework that combines cognitive honeynets, post-quantum-secured intelligence channels and reinforcement-learning-driven deception adaptation across 6G-enabled cyber-physical environments. The authors aim to integrate a cognitive honeynet orchestrator, a deception policy engine operating under partial observability, a transformer-based MITRE ATT&CK attribution network and a post-quantum federated intelligence bus into a single closed-loop control architecture, and they report a preliminary evaluation on benchmark datasets and a 320-endpoint testbed.
NetworkIoTHoneypotDecoy
Paper2026
Material reviewed: Full textEditor contributionPacheco and Staino present BUDA as an approach to simulating fictitious-user activity and strengthening decoy credibility, aligned with MITRE Engage.
EndpointNetworkDecoyAdversary engagement