Paper2018
Material reviewed: AbstractThe authors describe the use of honeypots as a decoy-based technology deployed in a network, aimed at defending IoT devices from attacks and gathering information about the attacker's device. The paper presents how honeypots, acting as cost-effective deception models, entice attackers in order to preserve information against attacks.
IoTNetworkHoneypotDecoy
Paper2018
Material reviewed: AbstractThis paper addresses how intruders can exploit timing side channels to distinguish whether a system is a honeypot or a real system, potentially helping them evade defense mechanisms. The authors introduce a novel definition of timed observational equivalence using symbolic time constraints, enabling automation via SMT solvers.
NetworkHoneypot
Paper2018
Material reviewed: AbstractThe work presents a dashboard visualization using honeypot log data from the AWN campus connected to IHP (Kemkominfo) Jakarta on a public cloud computing service network, aiming to categorize timestamps. The K-means clustering method is applied to categorize attacks into morning, noon, and night periods based on Western Indonesia Time and to identify ports 21, 80, 135, and 445 affected by DDoS attacks, with the stated expectation of supporting monitoring and anticipation of cloud network vulnerabilities.
CloudNetworkHoneypot
Paper2018
Material reviewed: AbstractThe authors propose a partially observable stochastic game framework to model interactions between a fully-observing defender and a partially-observing infiltrator in cybersecurity. They formulate the deception strategy problem as a robust mixed-integer linear program and present a scalable approach using parametric Markov decision processes to compute finite-memory infiltration strategies, illustrating the approach on a network security model.
NetworkAdversary engagementMoving target defense
Paper2018
Material reviewed: AbstractThe authors propose ThingPot, an interactive IoT honeypot that, per the abstract, targets the whole IoT platform rather than just application protocols, with a proof-of-concept implementing XMPP and a REST API to mimic a Philips Hue smart lighting system. The abstract states it was deployed for 1.5 months, capturing data that revealed five types of attacks and attack vectors against smart devices.
IoTHoneypot
Paper2018
Material reviewed: Publisher metadataBibliographic record on visual modeling of deception. The abstract and findings still require review.
NetworkDecoy
Open software2018
Material reviewed: Repository metadataRepository about Oracle WebLogic simulation; documentation and maintenance require further review.
ApplicationHoneypot
Paper2017
Material reviewed: Full textCritical readingGame-theoretic taxonomy distinguishing several forms of defensive deception.
NetworkMoving target defenseHoneytoken
Paper2017
Material reviewed: Publisher metadataBibliographic record on probabilistic logic of deception. The abstract and findings still require review.
NetworkDecoy
Paper2017
Material reviewed: AbstractThe authors describe deploying a honeynet of low-interaction and high-interaction SSH honeypots across three geographic regions of a public cloud environment in order to gather threat intelligence and obtain tailored indicators of compromise for e-learning platforms. The collected logs are analyzed through log collectors and parsers that translate the data into real-time dashboards, with the aim of understanding attackers' tactics according to time zones and geolocations and helping the education landscape prepare for emerging threats.
CloudNetworkHoneypot
Paper2017
Material reviewed: AbstractThis paper examines the use of honeypot data for employee information security awareness and education training. According to the authors, two honeypots were deployed at a private university in Singapore and the resulting data were analyzed. Drawing on Routine Activity Theory, they propose a conceptual training model called EASY (Engaging Stakeholders, Acceptable Behavior, Simple Teaching method, Yardstick) for designing security awareness programs.
NetworkIdentityHoneypot
Paper2017
Material reviewed: AbstractThe authors address the difficulty of distinguishing large-scale non-directional attacks from advanced persistent threats (APTs) and propose implementing honeytokens and honeypots as an intrusion detection system by deliberately placing traps within existing environments. They describe deploying a series of interconnected honeytokens, each with an exploitation difficulty level, to categorize attacks, profile the attacker and steer the execution flow into a maze-like scenario aimed at distracting, gathering forensic evidence and potentially identifying or deterring the attacker.
CloudHoneypotHoneytoken
Open software2017
Material reviewed: Repository metadataRepository about MongoDB decoy proxy; documentation and maintenance require further review.
NetworkHoneypot
Open software2017
Material reviewed: Repository metadataRepository about MySQL simulation; documentation and maintenance require further review.
NetworkHoneypot
Paper2017
Material reviewed: AbstractThis paper studies a scenario where a defender uses honeynets for active defense to observe an attacker who has penetrated the network. The authors propose an infinite-horizon Markov decision process over a continuous state space to model when to eject the attacker after gathering information, and analyze the robustness of this policy via a Stackelberg game, with simulations on a conceptual network.
NetworkHoneypotAdversary engagement
Open software2017
Material reviewed: Repository metadataRepository about PostgreSQL simulation; documentation and maintenance require further review.
NetworkHoneypot
Paper2017
Material reviewed: AbstractThis work proposes SIPHON, a scalable high-interaction physical honeypot architecture for IoT devices. According to the authors, the design uses geographically distributed 'wormholes' to expose a few physical devices across many Internet IP addresses. The authors describe a large-scale experiment with real devices (IP cameras, an NVR, and an IP printer) deployed across multiple cities and countries, recording traffic and login attempts over two months.
IoTNetworkHoneypot
Open software2017
Material reviewed: Repository metadataRepository about interactive PostgreSQL simulation; documentation and maintenance require further review.
NetworkHoneypot
Open software2017
Material reviewed: Repository metadataRepository about Apache Struts simulation; documentation and maintenance require further review.
ApplicationHoneypot
Paper2017
Material reviewed: Publisher metadataBibliographic record on technologies enabling deception. The abstract and findings still require review.
NetworkDecoy
Paper2017
Material reviewed: AbstractBased on cooperation with AWN University and the Indonesia Honeypot Project (IHP) of the Ministry of Communications and Informatics, the authors describe using a honeynet to protect and monitor public cloud computing networks, and analyzing its datalog through a k-means approach to profile DDoS attacks based on the timestamp recorded in the data.
CloudNetworkHoneypot
Open software2017
Material reviewed: Repository metadataRepository about Tomcat manager simulation; documentation and maintenance require further review.
ApplicationHoneypot
Paper2017
Material reviewed: AbstractThe authors propose a versatile virtual honeynet management tool for deploying heterogeneous types of honeypots through a dynamic configuration approach that adapts to mutable network environments. The stated purpose is to support investigation of malicious behavior where general platforms for versatile honeynet deployment are lacking.
NetworkHoneypot
Paper2016
Material reviewed: AbstractAccording to the authors, this work provides an extensive overview of honeypots, covering both available software and the methodologies used to analyze data collected by these systems.
NetworkHoneypot