Paper2004
Material reviewed: AbstractThe paper describes a system for generating attack signatures for network intrusion detection systems, applying pattern-matching techniques and protocol conformance checks at multiple levels of the protocol hierarchy to network traffic captured at a honeypot system. The authors report results from running the system for 24 hours on an unprotected cable modem connection, where it created precise traffic signatures.
NetworkHoneypot
Paper2004
Material reviewed: AbstractThis paper proposes a model for estimating the costs and benefits associated with deploying honeynet technology, an area where, according to the authors, a clear framework for optimal security resource allocation was lacking. The stated goal is to foster informed reasoning about the adoption of honeynets as an IT security measure.
NetworkHoneypot
Case study—
Material reviewed: Public pageShadowPlex selection and pilot story published by Acalvio for a consumer goods company.
CloudIdentityDecoy
Case study—
Material reviewed: Public pageIndustrial manufacturer story published by Acalvio; recorded as a vendor case.
OT/ICSDecoy
Open software—
Material reviewed: Repository documentationSplunk application and client that generate, cluster, and visualize meta-events from hpfeeds channels. It supports analysis in the Honeynet ecosystem; it is not described as a honeypot.
Open software—
Material reviewed: Repository metadataCritical readingLow-interaction honeypot simulating the Android Debug Bridge service.
IoTHoneypot
Product—
Material reviewed: Public pageCritical readingPrimarily a microsegmentation product whose documentation includes dynamic redirection into a deception environment; this related capability is recorded.
NetworkOT/ICSDecoyMoving target defense
Open software—
Material reviewed: Repository documentationDocumented honeypot for CVE-2017-5689: a web server listens on TCP port 16922 and imitates the Intel AMT management service. If exploited, it serves the attacker content obtained from an HP machine.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationAmun is a Python-based low-interaction honeypot, described as the first of its kind, following Nepenthes' concepts while extending emulation. Per its documentation, it logs exploitation attempts, malware downloads, and unknown shellcode across separate log files.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationScript for generating VirtualBox templates that make virtual machines harder to detect. It can support a less recognizable decoy VM, but the documentation does not present it as a honeypot.
Endpoint
Open software—
Material reviewed: Repository documentationA user-friendly, CISO-friendly configuration, management and acquisition tool for honeyd that provides a usable interface for configuring, deploying honeypots and receiving their logs from a central server.
NetworkHoneypot
Open software—
Material reviewed: Repository documentationDescribed as a low-interaction honeypot; the source does not specify its environment or features.
Honeypot
Open software—
Material reviewed: Repository documentationArgos is an advertised honeypot using dynamic taint analysis to detect and analyze control flow attacks.
NetworkEndpointHoneypot
Open software—
Material reviewed: Repository documentationTool combining a honeypot on commonly attacked ports with monitoring and alerts; according to the documentation, it blacklists IPs that connect to those ports.
NetworkHoneypot
Community or education—
Material reviewed: Public pageCommunity list of honeypot projects and materials; each link requires separate verification.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationWeb honeypot that responds to HEAD and GET requests with an HTTP Basic challenge and logs received credentials; it accepts no username or password.
ApplicationIdentityHoneypot
Open software—
Material reviewed: Repository documentationA honeypot project (now outdated) that deploys decoy clients and services to detect compromise via traffic discrepancies and honeytoken credential reuse.
NetworkIdentityHoneypotHoneytoken
Open software—
Material reviewed: Repository documentationAnsible deployment repository for Bifrozt. Its deception link is its reference to installation documentation and honeypot risks; the README does not say this repository is itself a honeypot.
Open software—
Material reviewed: Repository documentationA tool that parses logs from multiple honeypots (Kippo/Cowrie SSH, phpMyAdmin, Wordpot, Redispot, VncLowPot, Pghoney) to extract malicious IPs, URLs, and file hashes and publish them as pulses in AlienVault OTX.
NetworkApplicationHoneypot
Open software—
Material reviewed: Repository documentationA high-interaction HTTP/HTTPS honeypot that presents vulnerable web applications to observe attacker access. The documentation says it sends logs to BigQuery and saves packet captures.
ApplicationHoneypot
Open software—
Material reviewed: Repository metadataCritical readingOpen project for creating decoy tokens that alert when someone uses them.
IdentityCloudHoneytoken
Open software—
Material reviewed: Repository documentationOpen-source tool that scans systems to detect misconfigurations or fingerprints revealing honeypots, helping researchers make them harder to detect.
NetworkHoneypot
Case study—
Material reviewed: Public pageCritical readingVendor-published story of Fidelis Deception use at a North American children’s hospital.
NetworkIdentityDecoy
Open software—
Material reviewed: Repository metadataCritical readingSSH and Telnet honeypot that records login attempts and attacker sessions.
NetworkHoneypot