Paper2026
Material reviewed: AbstractAccording to the authors, this paper proposes 'Knowledge Trap', a defense against large language model extraction attacks that redirects attackers toward low-transferability knowledge using a honeypot-style knowledge graph and breadcrumb-guided exploration, rather than blocking queries or perturbing outputs. The authors report experiments in medical and financial domains showing reduced surrogate agreement without degrading legitimate-user performance.
ApplicationHoneypot
Paper2026
Material reviewed: AbstractThe study implements a deception-driven security model (D-DSM) for a campus network environment, with decoy resources managed through a centralized deception mechanism. It aims to divert malicious activity away from critical assets, provide indicators of attack behavior, and complement existing defense-in-depth controls by improving visibility of advanced and lateral attacks while helping reduce false alerts.
NetworkDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThis work studies how large language model (LLM)-based penetration testing agents can allocate their execution budget when encountering honeypots. The authors formalize the attacker's problem as a budgeted decision process in which the agent must decide whether to continue exploitation or skip a target upon honeypot suspicion, proposing a detector-guided policy evaluated in a controlled mixed-host testbed.
NetworkEndpointHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe paper proposes an LLM-enabled cloud-native dynamic honeypot architecture in which the model acts only as a text synthesizer behind policy gating and state verification. The authors describe a session broker that classifies attacker commands rather than executing them, alongside ethical governance controls and an evaluation protocol.
CloudNetworkHoneypotAdversary engagement
Open software2026
Material reviewed: Repository metadataAn SMTP Honeypot
NetworkHoneypot
Open software2026
Material reviewed: Repository metadataLet's be scanned. A low-interaction honeypot focused on network scanners and bots. It integrates very well with IVRE to build a self-hosted alternative to GreyNoise.
NetworkHoneypot
Paper2026
Material reviewed: AbstractThe authors propose MemPot, a defense framework that injects optimized honeypots into the memory of large language model (LLM)-based agents to counter extraction attacks. Through a two-stage optimization process and a detection model based on Wald's Sequential Probability Ratio Test, the authors report improved detection performance over existing baselines in their experiments.
ApplicationHoneypotDecoy
Open software2026
Material reviewed: Repository metadataMimicry is a dynamic deception tool that actively deceives an attacker during exploitation and post-exploitation.
NetworkDecoy
Paper2026
Material reviewed: AbstractThe authors present Mirage Mesh, a lightweight cyber deception framework for Linux environments that applies deception-in-depth across four layers: an SSH decoy built on Cowrie, a system-layer decoy administrative account, a fake Flask web administration interface, and a data-layer honeytoken credential file. The work proposes a shared DecoyAlertEvent schema to normalize observations from these layers, process them through a Wazuh-based detection and active-response pipeline with Python orchestration, map them to cyber kill-chain stages and MITRE ATT&CK techniques, and evaluate them with a Deception Effectiveness Metric (DEM).
NetworkEndpointHoneypotHoneytoken
Paper2026
Material reviewed: AbstractThis paper presents a context-enriched SQL injection detection framework built via a multi-agent honeypot system that generates malicious/benign requests, mediates authentic database responses while protecting production data, and pairs requests with responses to create a labeled dataset of 140,973 pairs. The authors state that models trained on this dataset outperform payload-only counterparts.
ApplicationHoneypot
Community or education2026
Material reviewed: Public pageSeptember 2026 program offering time-limited deception-platform access for non-commercial research; eligibility is listed at the source.
NetworkHoneypotHoneytoken
Paper2026
Material reviewed: AbstractThis paper, according to its authors, reviews AI-based solutions for building network- and device-level cyber deception methods in contested environments. It focuses on combining large language models (LLMs) and reinforcement learning (RL) to optimize deception strategies such as honeypots and honeynets, and examines their validation against stealthy attacks on operational technology (OT) systems reported in the literature.
NetworkOT/ICSHoneypotDecoy
Paper2026
Material reviewed: AbstractThe authors present a cyber-risk management framework for networked digital systems combining strategic game behavior with contagion dynamics. The study addresses optimal cybersecurity resource allocation considering heterogeneous node valuations by attackers and defenders, proposing contagion-path-based risk measures and analyzing cyber deception effects through numerical experiments.
NetworkDecoy
Open software2026
Material reviewed: Repository metadatanodejs ftp honeypot
NetworkHoneypot
Paper2026
Material reviewed: AbstractThe paper proposes a password-leak detection method based on Pythagorean triples, generating honeywords from a special graph-structure sequence built using number-theoretic properties of those triples. The authors describe a generation algorithm with a flat distribution and report a security proof and comparative experiments aimed at brute-force resistance and storage efficiency.
IdentityHoneytoken
Paper2026
Material reviewed: AbstractThis paper presents Ollure, a low- and medium-interaction honeypot that emulates the Ollama API without a backend LLM, as described by the authors. Deployed across four locations over 84 days, it recorded hundreds of thousands of interactions from thousands of source IP addresses. The study documents automated discovery and fingerprinting activity, as well as concrete exploitation attempts against both the infrastructure and LLM layers.
NetworkApplicationHoneypotDecoy
Paper2026
Material reviewed: AbstractThis paper introduces PHANTOM, a framework for generating honeytokens that encode organisation-specific knowledge (domain names, naming conventions, technology idioms, and secret-value distributions) through a multi-component generation pipeline. The authors propose a four-component Believability Score and use it to compare PHANTOM against a template-based baseline across several token types and organisational contexts.
NetworkApplicationHoneytoken
Paper2026
Material reviewed: AbstractThe work describes the design of a portable wireless honeypot using a Raspberry Pi to detect and analyze SSH brute-force attacks. By simulating a vulnerable SSH service with the Cowrie honeypot, the system logs login attempts and attacker behavior in real time to study attack patterns and improve security measures.
NetworkHoneypot
Open software2026
Material reviewed: Repository metadataPort listener / honeypot in Rust with protocol guessing and safe string display
NetworkHoneypot
Open software2026
Material reviewed: Repository metadataHoneypot detection toolkit
NetworkHoneypot
Paper2026
Material reviewed: AbstractThis thesis proposes game-theoretic and optimisation-based models for hardening Active Directory attack graphs. According to the authors, it introduces a honeypot/decoy placement model that minimises shortest paths and Domain Admin-reachable nodes, along with strategies accounting for the dynamic nature of the graph and adaptive prioritisation models incorporating administrator feedback. The authors note that the underlying problems are computationally intractable.
IdentityNetworkHoneypotDecoy
Paper2026
Material reviewed: AbstractThis work proposes Federated TGCN-A2C, an architecture integrating temporal graph convolutional networks, LSTM-based digital twins, and a federated actor-critic agent to decide between allowing, isolating, or redirecting traffic to honeypots in IoT/IoMT devices. The authors report evaluations on public cybersecurity datasets along with explainability analysis supporting the system's decision-making.
IoTNetworkHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe work describes the design and implementation of a high-interaction LLM honeypot system intended to detect and analyze the behavior of LLM-based attacks. The authors propose a strategy that embeds hidden puzzles in webpage source code to consume LLM tokens, alongside multi-dimensional heuristic detection and token heatmap visualization.
ApplicationHoneypot
Paper2026
Material reviewed: AbstractThe authors discuss applying reinforcement learning to improve response generation in honeypots and propose Q-Cowrie, a customization of the medium-interaction Cowrie honeypot intended to increase deception and support adaptive decisions while interacting with attackers. They report two experimental studies, one deploying Cowrie to capture attacks and model attacker decision-making with a Markov decision process, and another using Q-Cowrie to support adaptive interaction.
NetworkHoneypotAdversary engagement