Paper2016
Material reviewed: Publisher metadataBibliographic record on an adaptive deception system. The abstract and findings still require review.
NetworkDecoy
Paper2016
Material reviewed: AbstractThe authors propose an ant colony-based distributed denial of service (DDoS) detection technique that uses roaming virtual honeypots together with a multi-level secure architecture to collect information about intruders at different levels of the network and to limit the spread of the affected area. Detection relies on ant colony optimisation, using pheromone deposits in the considered area, and on a multi-level IP log table, aiming to reduce traffic overhead and wasted bandwidth.
NetworkHoneypotMoving target defense
Paper2016
Material reviewed: AbstractThis article studies how users, such as employees, interact with active honeytokens, meaning fake data objects planted among real data to detect data misuse by insiders. The authors describe an automated, generic method for generating those honeytokens and present two behavioral studies examining whether users can distinguish them from real objects and whether user behavior changes when users are informed that monitored honeytokens are present.
Honeytoken
Paper2016
Material reviewed: AbstractThe authors propose a statistical framework for rigorously analyzing honeypot-captured cyber attack data, built on the concept of a stochastic cyber attack process. According to the presented case study, low-interaction honeypot data exhibits Long-Range Dependence, which the authors state could enable prediction of attack rates with good accuracy.
NetworkHoneypot
Paper2016
Material reviewed: Publisher metadataBibliographic record on decoy virtual machines in cloud. The abstract and findings still require review.
CloudHoneypot
Paper2016
Material reviewed: Full textThe authors recorded 180,581 visiting IP addresses and 481,521 download attempts, manually collected 106 binaries, and described five malware families.
IoTNetworkHoneypot
Paper2016
Material reviewed: AbstractThe work proposes an ontological model for identifying the most common types of attacks from the use of honeynets, and outlines its implementation in working scenarios. Its purpose is to support decision-making about the placement of computer elements and components within an organization.
NetworkHoneypot
Paper2016
Material reviewed: AbstractAccording to the authors, this paper describes an automated algorithm designed to detect attacks before they occur and reduce false positive and negative rates, using malicious traffic data captured through a distributed honeypot network.
NetworkHoneypot
Paper2016
Material reviewed: AbstractThe paper presents an architecture that extends a previous system for tracking IPv6 addresses discarded by MT6D nodes, adding automation and database integration. According to the authors, the solution can deploy a honeypot on demand in an LXC container based on traffic patterns observed on a discarded address, and it lets an MT6D host query the solution database for activity on its relinquished addresses as a JSON object in order to adjust MT6D scheme parameters; the authors report a proof-of-concept and an analysis of feasibility and scalability.
NetworkHoneypotMoving target defense
Open software2016
Material reviewed: Repository metadataRepository about capture of IoT botnet binaries; documentation and maintenance require further review.
IoTHoneypot
Paper2015
Material reviewed: AbstractThis paper presents Apate, a Linux Kernel Module that logs, blocks, and manipulates system calls based on configurable conditions such as PID or UID. According to the authors, Apate serves as a building block to harden high-interaction honeypots and extend attacker interaction without introducing new vulnerabilities.
EndpointHoneypot
Paper2015
Material reviewed: AbstractThe study proposes a generic implementation strategy for honeytokens deployed within a database management system, leveraging the aspect-oriented paradigm to contain the insider threat. The authors test this approach by developing a proof-of-concept prototype in AspectJ and reflect on the design and implementation challenges involved in deploying honeytokens.
ApplicationHoneytoken
Paper2015
Material reviewed: AbstractThe authors propose a game-theoretic model for mechanism design in deception-based defense, applied specifically to honeypots in network defense. They analyze cheap-talk games and an extended version with evidence, where the receiver can detect deception with some probability. According to the authors, the model generalizes traditional signaling games and complete-information games, showing numerically that deception detection can eliminate pure-strategy equilibria.
NetworkHoneypotAdversary engagement
Open software2015
Material reviewed: Repository metadataRepository about Elasticsearch simulation; documentation and maintenance require further review.
NetworkHoneypot
Paper2015
Material reviewed: AbstractThe authors describe honeypots as a security mechanism that attracts and diverts attackers, logs network bytes, and correlates data to locate the attack source. They present honeypot types and uses and introduce Kerberos, concluding with a look at the future.
NetworkHoneypot
Open software2015
Material reviewed: Repository metadataRepository about Elasticsearch simulation; documentation and maintenance require further review.
NetworkHoneypot
Open software2015
Material reviewed: Repository metadataRepository about capture of USB-propagated malware; documentation and maintenance require further review.
EndpointHoneypot
Open software2015
Material reviewed: Repository metadataRepository about NoSQL-service simulation; documentation and maintenance require further review.
NetworkHoneypot
Open software2015
Material reviewed: Repository metadataRepository about SNARE web-event analysis; documentation and maintenance require further review.
ApplicationHoneypot
Paper2015
Material reviewed: Public pageThis paper examines ethical issues in studying malicious activity in social networks using social honeypots combined with deception. Its purpose is to clarify how this area fits within human subjects research and whether researchers should seek deception-free methods.
ApplicationHoneypot
Open software2014
Material reviewed: Repository metadataRepository about observation of Elasticsearch attacks; documentation and maintenance require further review.
NetworkHoneypot
Open software2014
Material reviewed: Repository metadataRepository about decoy NTP service; documentation and maintenance require further review.
NetworkHoneypot
Open software2014
Material reviewed: Repository metadataRepository about Node.js application simulation; documentation and maintenance require further review.
ApplicationHoneypot
Paper2014
Material reviewed: AbstractThe study presents a comparative measurement of Facebook page promotion methods via ads and like farm services. The authors deploy honeypot pages, promote them through both methods, and analyze the demographic, temporal, and social characteristics of garnered likes. According to the authors, findings indicate differences in behavior among like farms, with some apparently bot-operated and others mimicking real users.
ApplicationHoneypot