Paper2025
Material reviewed: AbstractThis paper presents, according to the authors, the first large-scale real-world evaluation of an LLM-based scambaiting system, designed as a conversational honeypot to engage scammers and extract actionable threat intelligence such as mule bank accounts. Over a five-month deployment, the system initiated thousands of engagements, reporting an information disclosure rate and strong alignment between LLM-generated responses and human operator preferences.
IdentityNetworkHoneypotAdversary engagement
Paper2025
Material reviewed: AbstractThe authors present ShadowKube, an active defense framework for Kubernetes that integrates behavioral monitoring with shadow honeypots to detect and neutralize anomalous behavior. The approach establishes behavioral baselines to identify deviations and converts compromised nodes into honeypots, with the stated purpose of isolating and trapping attackers in intrusions targeting container orchestration.
CloudApplicationHoneypotDecoy
Paper2025
Material reviewed: AbstractThis study proposes SPADE, a framework that uses generative AI models alongside structured prompt engineering to automate the creation of adaptive cyber deception strategies against dynamic malware. According to the authors, the framework addresses challenges of large language models such as generalized outputs, ambiguity, and scalability constraints, and was evaluated across diverse malware scenarios using metrics like Recall, Exact Match, BLEU, and expert quality assessments, identifying ChatGPT-4o as the top performer.
EndpointNetworkAdversary engagementDecoy
Paper2025
Material reviewed: AbstractAccording to the authors, this study proposes a Stackelberg game-based framework for strategically timing cyber deception, combining a tactical layer modeling attacker-defender dynamics via a one-sided information Markov game with a strategic layer optimizing deception timing and selection through a stopping-time decision process. Numerical experiments, as reported by the authors, suggest that strategically timed deception can improve the defender's expected utility compared to baseline strategies.
NetworkAdversary engagementDecoy
Paper2024
Material reviewed: AbstractThe authors address the difficulty that traditional honeypot implementations are evaded by advanced adversaries such as APT groups, and propose designing and deploying a customized honeypot network based on adaptive camouflaging techniques. The work describes orchestrating a behavioral honeypot network tailored to three APT groups, with attack paths aligned with their tactics, techniques, and procedures, and includes a camouflaged chatterbox application deployed for 100 days; according to the deposited abstract, the setup recorded 13,906,945 hits from 4,238 unique IP addresses and was used to categorize attackers.
NetworkApplicationHoneypotDecoy
Paper2024
Material reviewed: AbstractAccording to the authors, this paper proposes a cyber deception mechanism that stealthily redirects TCP communications to an on-demand honeypot server cloned to resemble the victim asset. The stated goal is to make attackers focus on the decoy server, enabling threat intelligence collection while protecting the real asset.
NetworkHoneypotDecoy
Paper2024
Material reviewed: Full textCritical readingSurvey proposing a taxonomy and comparing cyber deception research lines, including AI-based work.
NetworkCloudAdversary engagement
Open software2024
Material reviewed: Repository metadataEditor contributionOpen framework for planning deception operations and deploying decoys and services with Python and Docker, according to its repository and documentation.
NetworkApplicationDecoyHoneypot
Paper2024
Material reviewed: AbstractThe authors address a scenario where a defender of a networked control system has isolated an intruder and redirects them toward a honeypot emulating the real system without connection to a physical plant. They propose an adversary engagement strategy within this decoy environment to increase the attacker's information-processing costs by spoofing sensor readings based on cyber threat intelligence. They perform a numerical comparison between cases of perfect and imperfect threat intelligence.
OT/ICSNetworkHoneypotAdversary engagement
Paper2024
Material reviewed: AbstractThis paper proposes a reinforcement learning (RL) approach to simulate ransomware attacks within an environment mirroring real-world networks, aiming to streamline traditional red teaming exercises. According to the authors, experimental results on a 152-host example network show the RL agent's capability to discover and orchestrate attacks on high-value targets while evading honeyfiles (decoy files placed to detect unauthorized access).
NetworkEndpointDecoyAdversary engagement
Paper2024
Material reviewed: AbstractThe work presents and evaluates Mirage, an experimentation system in both emulation and simulation forms that allows for the implementation and testing of cyber deceptions designed to counter adversaries using AI search and planning capabilities. The authors frame cyber deception as a possible defensive mechanism against future AI-enabled adversaries.
NetworkDecoyAdversary engagement
Paper2024
Material reviewed: AbstractThis work aims to develop a drone-based surveillance mission system when Denial-of-Service (DoS) attacks disrupt normal operations. The authors introduce cyber deception via honey drones (HDs) that exhibit fake vulnerabilities and use stronger signal strengths to lure DoS attacks, formulate an optimization problem over HD and mission drone signal strengths, and solve it using deep reinforcement learning (DRL) with the Asynchronous Advantage Actor-Critic (A3C) algorithm, evaluated in a physical engine-based simulation testbed.
HoneypotDecoy
Paper2024
Material reviewed: AbstractEditor contributionPacheco and Staino preprint proposing a cyclical, minimal deception process and presenting DOLOS-T as an open tool for exploring it.
NetworkApplicationDecoyAdversary engagement
Paper2024
Material reviewed: AbstractAccording to the authors, this chapter examines the combined use of game-theoretic models and foundation models (FMs) to analyze, design, and implement cyber deception tactics across tactical, operational, and strategic warfare levels. It proposes MANSCOL (multi-agent neurosymbolic conjectural learning) to let defenders predict adversarial behaviors and design adaptive deceptive defenses, and discusses challenges of applying FMs in cybersecurity.
NetworkAdversary engagementDecoy
Paper2024
Material reviewed: AbstractThis paper presents a proof-of-concept (POC) cyber deception system that dynamically generates deception material based on observed attacker behaviour during a simulated real-time attack. The system analyzes attacker interaction with the deception material to predict the attacker's motive, and the authors explore expanding this POC to infer other profile features such as psychological characteristics.
NetworkDecoyAdversary engagement
Paper2023
Material reviewed: AbstractThis work examines adversarial reconnaissance mitigation techniques, including deception strategies such as honeypots, and reviews the literature on deception games from the perspective of modeling adversarial reconnaissance. The authors highlight aspects of reconnaissance they state have not been adequately captured in prior work, and present a probability-theory based model of adversaries' belief formation, illustrated with numerical examples.
NetworkHoneypotAdversary engagement
Paper2023
Material reviewed: AbstractThe authors propose a framework combining moving target defense (MTD), deception, and attribute-based access control (ABAC) to make unauthorized insider access more difficult and costly. They introduce correlated attributes into ABAC and generate mutated policies from them. According to the authors, evaluation results show the framework effectively identifies correlated attributes and produces adequate mutated policies without affecting system usability.
IdentityApplicationMoving target defenseAdversary engagement
Paper2023
Material reviewed: AbstractThis study examines how different probing costs affect adversarial decision-making in a deception game, using an IBLT model with delayed feedback to simulate human behavior. According to the authors, probing slightly decreased as its cost increased, while the proportion of attacks remained relatively stable. The authors conclude that different probing costs do not significantly affect the proportion of attacks but have a slight impact on the proportion of probing.
NetworkHoneypotAdversary engagement
Paper2023
Material reviewed: AbstractThe work describes the deployment of an ensemble of research honeypot detectors to analyze and evaluate attackers' behavior. The authors present an outline of a containerized cloud honeypot deployment that they state is portable, durable, and simple to deploy and administer, and they describe instrumented monitoring that generated data points from which inferences about malicious users' activities and purpose could be drawn.
CloudNetworkHoneypotDecoy
Paper2023
Material reviewed: Publisher metadataBibliographic record on expert experiences and opinions. The abstract and findings still require review.
NetworkAdversary engagement
Paper2023
Material reviewed: AbstractThe authors propose a signaling game framework between a defender and an insider human agent, using quantum decision theory to exploit cognitive biases and counter insider attacks. The defender deceives the attacker by luring them toward decoy sensors via generators that produce perceptions of classical signals. According to the authors, results show that strategically designed generators can worsen the attacker's ability to identify decoys compared to schemes without generators.
IdentityDecoyAdversary engagement
Paper2023
Material reviewed: AbstractThis thesis presents a honeypot solution to investigate malicious activity in the heiCLOUD environment, showing according to the author a significant increase in attacks. A new concept is proposed to detect firewall leaks in restricted network zones, along with a method for detecting honeypots at the transport level from an attacker's perspective. A customized OpenSSH server is also presented as an intermediary instance to mitigate such efforts.
CloudNetworkHoneypotAdversary engagement
Paper2023
Material reviewed: AbstractThe authors propose a planning framework to generate a defense strategy that covertly guides an attacker toward a trap state, formulating the problem as an infinite-horizon discounted MDP whose optimal policy serves as the defender's strategy. According to the abstract, this formulation is applicable to systems such as honeypots or honeynets, and the authors report empirically evaluating the merits of their approach.
NetworkHoneypotAdversary engagement
Paper2023
Material reviewed: AbstractThe authors investigate using ChatGPT to automatically reply to scam emails in order to waste scammers' time and resources through pointless communications. According to the abstract, preliminary results show ChatGPT can decoy scammers.
ApplicationDecoyAdversary engagement