Paper2026
Material reviewed: AbstractThe authors propose a proactive cyber-defense system that combines cyber deception, adversarial environment simulation and deep reinforcement learning, with GAN-generated attack vectors emulating zero-day and polymorphic threats. The aim is to train context-aware defense policies that detect malicious behavior, re-route detection vectors and trigger deceptive traps, evaluated with benign and adversarial traffic on a synthetic smart-grid network.
NetworkOT/ICSDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThe authors introduce HoneyMed, a protocol-aware honeypot framework that simulates healthcare and IoT services in order to collect malicious interactions, transform them into machine-learning tabular features, and classify attack types in real time. Its stated purpose is to provide threat visibility for IoMT security testbeds using decoys, feature extraction and lightweight classifiers, without interacting with production medical assets.
IoTNetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractAccording to the authors, this work presents SysEvolve, a system integrating three co-designed components (SysField, SysSpear, and SysArmor) to create a self-driven adversarial loop between LLM-based attack and defense agents. The authors describe the construction of realistic multi-host cyber ranges, attack scheme generation, and real-time interpretable defense. They also note that decoy endpoints deployed in the range affect LLM agent behavior.
NetworkDecoyAdversary engagement
Paper2026
Material reviewed: Publisher metadataBibliographic record on realism and efficiency of deception. The abstract and findings still require review.
NetworkDecoy
Case study2026
Material reviewed: Public pageCritical readingIBM X-Force and Deception.Pro recorded two incidents in simulated organizations, observing reconnaissance, malware deployment and fake-document exfiltration.
EndpointOT/ICSDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThe authors introduce Trident, an agentic LLM red teaming framework for evaluating the robustness of Deep Reinforcement Learning (DRL)-based cyber defenses. The work includes a dynamic benchmark, a dataset of red-blue interaction trajectories, and an agentic architecture that generates attack strategies and translates them into executable policies against DRL defenders. According to the authors, Trident substantially reduces defensive performance and uncovers emergent behaviors such as decoy avoidance.
NetworkDecoyAdversary engagement
Open software2026
Material reviewed: Repository metadataWebDecoy Bot Detection — zero-config WordPress plugin for bot protection, spam prevention, and WooCommerce carding defense
ApplicationDecoy
Paper2025
Material reviewed: AbstractAccording to the abstract, the authors present a descriptive model incorporating psychological and strategic factors (belief, scepticism, deception fidelity, reconnaissance, and experience) to explain an attacker's initial decision to engage or withdraw from cyber-deception techniques. The authors state they have designed experiments using Capture the Flag activities and biometric observations to evaluate the model, but explicitly clarify that these experiments have not yet been conducted and no experimental findings are presented in the paper.
NetworkDecoyAdversary engagement
Paper2025
Material reviewed: AbstractThe authors present a simulated Gym-based environment for adversarial reinforcement learning in network security, where attacker and defender agents trained with DQN compete under a zero-sum reward framework. The environment models brute-force attacks and reactive defenses, including honeypot traps and adaptive rate-limiting, and the authors report that defender observability and trap effectiveness create substantial barriers to successful attacks.
NetworkHoneypotAdversary engagement
Paper2025
Material reviewed: AbstractThe authors present ADIRDS, an online monitoring system that models the real system as a graph and monitors critical assets, deploying realistic honeypots with business context similar to the real system to trap attackers and collect evidence when logs are insufficient. According to the authors, they applied the system to a real case, capturing 38 unique attacker IP addresses.
NetworkHoneypotDecoy
Open software2025
Material reviewed: Repository metadataEditor contributionExperimental framework generating fictitious user profiles and activity for decoy environments; the repository documents narratives, profiles and language-model integration.
EndpointNetworkDecoyAdversary engagement
Paper2025
Material reviewed: AbstractThe authors present D3O-IIoT, a reinforcement learning model that dynamically coordinates deception techniques such as honeypot deployment, moving target defense, fake telemetry injection, and node isolation, driven by real-time threat monitoring. The defense problem is formulated as a Markov Decision Process, in which a Dueling Deep Q-Network agent maximizes a multi-objective reward to balance attack mitigation, deception engagement, false positive control, and resource cost.
IoTOT/ICSHoneypotMoving target defense
Paper2025
Material reviewed: AbstractThis work presents a machine learning-driven methodology combining cryptic and mimetic cyber deception principles to protect integrated circuits against reverse engineering attacks, using a variational autoencoder (AIG-VAE) and new covert gate variants. The authors report that experiments show effectiveness in maintaining functionality while achieving high camouflage and similarity scores.
EndpointDecoy
Paper2025
Material reviewed: AbstractThe study compares proposed metrics for honeyfile attributes—Common Token Count and Topic Semantic Matching for enticement, and coherence and cohesion for realism—against human users' perceptions as they judged text samples in a simulated data breach scenario on a crowd-sourcing platform. The authors report that Topic Semantic Matching aligned with perceived enticement, whereas results for Common Token Count were inconsistent and inconclusive, and coherence and cohesion did not consistently align with perceived realism.
HoneytokenDecoy
Paper2025
Material reviewed: AbstractThis work uses HackIT, a cybersecurity simulation tool, and a human-subject experiment with 88 computer science students to examine how attacker behavior varies across network topologies (ring vs. star) and honeypot densities (50% vs. 75%). The reported outcomes indicate that increased honeypot density maximized decoy interaction but also led to more real-system attacks in centralized (star) networks, whereas decentralized (ring) networks were more robust with fewer honeypots.
NetworkHoneypotDecoy
Paper2025
Material reviewed: AbstractAccording to the authors, this work proposes a defense paradigm called 'attack as defense' against model extraction attacks. They introduce HoneypotNet, which replaces the victim model's classification layer with a honeypot layer fine-tuned via bi-level optimization to poison any substitute model trained on its outputs, while preserving original performance.
ApplicationHoneypotDecoy
Paper2025
Material reviewed: AbstractThe authors present the Hybrid Cyber Deception System (HCDS), described as a Python-developed proactive tool that combines honeypots and honeytokens in a dynamically adaptive mode to simulate realistic services and redirect attackers in controlled, instrumented settings. The system integrates a deception-driven alerts correlation engine built on Python, Pandas and Scikit-learn, along with Moving Target Defense principles for continuous modulation of network parameters and decoy distribution, and was tested in a simulated environment with Windows and Ubuntu servers to profile attackers and detect complex attack vectors.
NetworkEndpointHoneypotHoneytoken
Paper2025
Material reviewed: Public pageThe authors describe a web-based classroom reservation system in which they implement a hidden honeypot field in the booking form: invisible to humans but fillable by bots, so submissions with that field completed are rejected.
ApplicationDecoy
Paper2025
Material reviewed: AbstractThis paper presents the implementation of a honeynet in which a honeypot acts as a real resource within a production network environment, aiming to divert and mislead attackers and analyze their behavior. According to the authors, the honeypot mimics both scanners and attackers within a simulated, production-level environment.
NetworkHoneypotDecoy
Paper2025
Material reviewed: AbstractThe authors present Koney, a Kubernetes operator that orchestrates cyber deception technology deployment through deception policy documents described as code. Using cloud-native technologies such as service meshes and eBPF, the system adds traps to containerized applications without source code access, facilitating setup, rotation, monitoring, and removal of traps, emphasizing maintainability, scalability, and operational simplicity.
CloudApplicationDecoyAdversary engagement
Open software2025
Material reviewed: Repository metadataRepository about fake applications for attacker diversion; documentation and maintenance require further review.
ApplicationDecoy
Paper2025
Material reviewed: AbstractThe authors present LLMHoney, an SSH honeypot that uses large language models (LLMs) to generate realistic, dynamic command outputs in real time, combining a dictionary-based virtual file system with LLMs for novel inputs. According to the abstract, the system was evaluated on 138 representative Linux commands across 13 LLM variants, reporting accuracy, latency, and memory metrics, while discussing challenges such as occasional hallucinated outputs.
NetworkEndpointHoneypotDecoy
Case study2025
Material reviewed: Public pageCritical readingInstitutional report on deception trials involving UK organizations and providers.
NetworkCloudHoneypotDecoy
Paper2025
Material reviewed: AbstractThe authors propose a neuro-symbolic fusion approach for cognitive threat reasoning in cyber deception environments. It combines deep neural networks with symbolic reasoning, using knowledge graphs, probabilistic logic, and reinforcement learning to identify, predict, and respond to adversaries and to optimize deception strategies.
NetworkDecoyAdversary engagement