Paper2022
Material reviewed: AbstractThis survey reviews twenty-three honeyword (decoy password) based authentication techniques introduced by Juels and Rivest in 2013, which aim to detect server-side threats on password files and notify the administrator when an attacker attempts to exploit a compromised file. The authors compare existing approaches and identify remaining gaps and emergent research opportunities.
IdentityDecoyHoneytoken
Paper2022
Material reviewed: AbstractThis survey reviews and categorizes honey-X-based defense strategies, such as honeypots and honeytokens, which use deception to gather threat intelligence and protect networks. The authors also examine their combination with moving target defense, game theory and machine learning, and outline security quantification, challenges and future directions.
NetworkHoneypotHoneytoken
Paper2021
Material reviewed: Full textTwo-factor authentication mechanism combining decoy codes with Google Authenticator.
IdentityHoneytoken
Paper2021
Material reviewed: AbstractThe authors extend their anti-ransomware tool R-Locker to Windows, relying on a honeyfile-based approach in which 'infinite' trap files are disseminated around the target filesystem for early detection and to block ransomware action. The Windows version addresses differences in FIFO handling and adds improved global management of honeyfiles and (semi)automated blocking of suspicious ransomware through the dynamic use of white-/black-lists.
EndpointHoneytokenDecoy
Paper2021
Material reviewed: Full textHistorical review of honeypots, honeytokens and moving target defense from the late 1980s through 2021.
NetworkEndpointHoneypotHoneytoken
Paper2020
Material reviewed: Publisher metadataDOI-identified publication on honeytoken fingerprinting methods; text analysis is pending.
IdentityHoneytoken
Paper2019
Material reviewed: AbstractAccording to the authors, this work proposes AnonTokens, an approach applying the honeytoken concept to the data privacy domain to trace re-identification attacks. High re-identification-risk decoy records are inserted into anonymized datasets to detect malicious users. The authors evaluate their approach using large-scale population datasets.
ApplicationHoneytokenDecoy
Paper2019
Material reviewed: AbstractThe work examines n-session recording attack resilient unaided authentication services (n-SRRUASs) and notes that they cope poorly with server-side issues within their authentication procedure. The authors propose generic principles for incorporating honeywords (fake passwords) into n-SRRUASs and, with the help of an existing n-SRRUAS, show the idea is implementable in practice to fill that gap.
IdentityHoneytoken
Paper2018
Material reviewed: AbstractThe authors use game theory, including static Bayesian games, signaling games, and multi-stage models, to model defender-attacker interactions in cybersecurity under uncertainty and asymmetric information. Per the abstract, the study examines a case involving Advanced Persistent Threats (APTs) and the Tennessee Eastman process, considering that defenders may employ deception techniques such as honey files and honeypots to create strategic uncertainty for attackers.
NetworkOT/ICSHoneypotHoneytoken
Paper2017
Material reviewed: Full textCritical readingGame-theoretic taxonomy distinguishing several forms of defensive deception.
NetworkMoving target defenseHoneytoken
Paper2017
Material reviewed: AbstractThe authors address the difficulty of distinguishing large-scale non-directional attacks from advanced persistent threats (APTs) and propose implementing honeytokens and honeypots as an intrusion detection system by deliberately placing traps within existing environments. They describe deploying a series of interconnected honeytokens, each with an exploitation difficulty level, to categorize attacks, profile the attacker and steer the execution flow into a maze-like scenario aimed at distracting, gathering forensic evidence and potentially identifying or deterring the attacker.
CloudHoneypotHoneytoken
Paper2016
Material reviewed: AbstractThis article studies how users, such as employees, interact with active honeytokens, meaning fake data objects planted among real data to detect data misuse by insiders. The authors describe an automated, generic method for generating those honeytokens and present two behavioral studies examining whether users can distinguish them from real objects and whether user behavior changes when users are informed that monitored honeytokens are present.
Honeytoken
Paper2015
Material reviewed: AbstractThe study proposes a generic implementation strategy for honeytokens deployed within a database management system, leveraging the aspect-oriented paradigm to contain the insider threat. The authors test this approach by developing a proof-of-concept prototype in AspectJ and reflect on the design and implementation challenges involved in deploying honeytokens.
ApplicationHoneytoken
Paper2013
Material reviewed: Full textProposal for false passwords per account and a separate honeychecker that detects their use.
IdentityHoneytoken
Paper2010
Material reviewed: AbstractThis paper presents Mirage, a low-cost system designed by the authors to mitigate corporate espionage in RFID-enabled retail environments. According to the authors, Mirage uses programmable RFID tags as honeytokens to inject noise into inventory data, randomizing sales and restocking trends observable by potential attackers.
IoTHoneytoken
Open software—
Material reviewed: Repository documentationA honeypot project (now outdated) that deploys decoy clients and services to detect compromise via traffic discrepancies and honeytoken credential reuse.
NetworkIdentityHoneypotHoneytoken
Open software—
Material reviewed: Repository metadataCritical readingOpen project for creating decoy tokens that alert when someone uses them.
IdentityCloudHoneytoken
Service—
Material reviewed: Public pageCritical readingACSG publishes a managed decoy and continuous-monitoring offering for IT, cloud and ICS.
NetworkCloudDecoyHoneytoken
Framework or guide—
Material reviewed: Repository documentationA Laravel 5.4/5.5 package that adds hidden honeypot fields (a decoy input and an encrypted timestamp) to forms to detect and block automated spam submissions, building on prior work by Ian Landsman and Maksim Surguy.
ApplicationHoneytoken
Product—
Material reviewed: Public pageCritical readingCommercial decoy and breadcrumb platform for network, identity and cloud, according to Fidelis.
NetworkIdentityDecoyHoneytoken
Open software—
Material reviewed: Repository documentationDecoy software documenting bounded simulated responses for Kubernetes and Docker APIs, Ollama and other AI APIs, a misconfigured kubelet, and HTTP probes; it records TCP and UDP interactions without replying. It supports synthetic Secret honeytokens.
CloudNetworkHoneypotHoneytoken
Open software—
Material reviewed: Repository documentationProof-of-concept tool that places breadcrumbs and decoys, such as fake files and credentials, on servers and workstations to draw attackers toward traps. It is not presented as a honeypot itself.
EndpointIdentityHoneytokenDecoy
Open software—
Material reviewed: Repository documentationA Windows tool that creates breadcrumbs and honeytokens, such as fake credentials in Windows Credential Manager, to lead attackers toward honeypots.
EndpointIdentityHoneytokenDecoy
Open software—
Material reviewed: Repository documentationWeb honeypot documented to create and monitor fake HTTP endpoints whose URLs can be distributed as honeytokens; it is designed for Heroku but can also run on a self-hosted server.
ApplicationCloudHoneypotHoneytoken