Paper2026
Material reviewed: AbstractThis work proposes Federated TGCN-A2C, an architecture integrating temporal graph convolutional networks, LSTM-based digital twins, and a federated actor-critic agent to decide between allowing, isolating, or redirecting traffic to honeypots in IoT/IoMT devices. The authors report evaluations on public cybersecurity datasets along with explainability analysis supporting the system's decision-making.
IoTNetworkHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe work describes the design and implementation of a high-interaction LLM honeypot system intended to detect and analyze the behavior of LLM-based attacks. The authors propose a strategy that embeds hidden puzzles in webpage source code to consume LLM tokens, alongside multi-dimensional heuristic detection and token heatmap visualization.
ApplicationHoneypot
Paper2026
Material reviewed: AbstractThe authors discuss applying reinforcement learning to improve response generation in honeypots and propose Q-Cowrie, a customization of the medium-interaction Cowrie honeypot intended to increase deception and support adaptive decisions while interacting with attackers. They report two experimental studies, one deploying Cowrie to capture attacks and model attacker decision-making with a Markov decision process, and another using Q-Cowrie to support adaptive interaction.
NetworkHoneypotAdversary engagement
Paper2026
Material reviewed: AbstractThe study proposes QuantumGuard, a proactive cybersecurity framework that combines cognitive honeynets, post-quantum-secured intelligence channels and reinforcement-learning-driven deception adaptation across 6G-enabled cyber-physical environments. The authors aim to integrate a cognitive honeynet orchestrator, a deception policy engine operating under partial observability, a transformer-based MITRE ATT&CK attribution network and a post-quantum federated intelligence bus into a single closed-loop control architecture, and they report a preliminary evaluation on benchmark datasets and a 320-endpoint testbed.
NetworkIoTHoneypotDecoy
Paper2026
Material reviewed: AbstractThe paper describes a hybrid intrusion detection system combining a supervised classifier trained on the NSL-KDD dataset with a Docker-based honeypot that deploys automatically when suspicious activity is detected. Traffic is classified into five categories, with a voting ensemble of three classifiers producing the detection.
NetworkHoneypot
Paper2026
Material reviewed: AbstractThe article presents SAGE, an adaptive Internet of Things (IoT) honeypot that combines Finite-State Machine (FSM)-driven protocol emulation with GraphRAG-enhanced retrieval to model stateful IoT protocols and generate responses using a Large Language Model (LLM). The authors also describe a fact-checking engine and a feedback mechanism intended to refine responses and progressively expand state-response mappings based on observed adversarial interactions.
IoTHoneypotAdversary engagement
Paper2026
Material reviewed: Public pageThe authors propose SecuPi, a compact Raspberry Pi-based system that combines real-time traffic monitoring, hybrid intrusion detection (signature-based and machine learning) and automated threat response. As deception and proactive defense mechanisms, they propose the use of honeypots together with automatic firewall updates and Moving Target Defense (MTD).
NetworkIoTHoneypotMoving target defense
Paper2026
Material reviewed: AbstractThis paper presents ShellGames, an SSH shell simulator based on large language models (LLMs) designed to sustain credible interactive deception sessions with adversaries. According to the authors, the system combines techniques such as chain-of-thought reasoning, memory management, speculative command execution, sandbox routing, and subversion detection to address common LLM limitations. The authors report improvements in accuracy, consistency, and state tracking over baselines, along with a user study indicating perceived realism comparable to a real shell.
NetworkEndpointHoneypotMoving target defense
Paper2026
Material reviewed: AbstractThe authors introduce HoneyMed, a protocol-aware honeypot framework that simulates healthcare and IoT services in order to collect malicious interactions, transform them into machine-learning tabular features, and classify attack types in real time. Its stated purpose is to provide threat visibility for IoMT security testbeds using decoys, feature extraction and lightweight classifiers, without interacting with production medical assets.
IoTNetworkHoneypotDecoy
Paper2026
Material reviewed: Public pageThe manuscript proposes coordinating agents and threat flows through zones in a computational world, including honeypots, deception regions, and classification and quarantine routes.
ApplicationHoneypot
Paper2026
Material reviewed: AbstractThis paper presents a method to estimate a lower bound on the number of networks generating spoofed traffic in DRDoS attacks, using a global deployment of anycast amplification honeypots. The authors develop two estimators based on honeypot reception patterns and TTL variations, analyzing 287 days of amplification attacks. According to the authors, at least 21.0% of attacks originate from multiple network locations.
NetworkHoneypot
Open software2026
Material reviewed: Repository metadataA low/zero interaction ssh authentication logging honeypot
NetworkHoneypot
Open software2026
Material reviewed: Repository metadataA low-interaction SSH honeypot written in C
NetworkHoneypot
Paper2026
Material reviewed: AbstractThe authors use an interactive voice honeypot with language-model personas on real U.S. numbers to measure the prevalence of automated and synthetic voices in unwanted inbound calls, combining audio fingerprinting, a commercial synthetic-speech detector, and blinded listeners to characterize call traffic.
NetworkHoneypot
Open software2026
Material reviewed: Repository metadataModern honeypot supporting multiple services, realistic website cloning, and AI-powered features
ApplicationHoneypot
Paper2026
Material reviewed: AbstractThe paper presents TrustFed-Honeypot, a hybrid federated-retraining framework for honeypot-based IDS. Clients train locally, and the server retrains a global logistic model on samples weighted by a multi-signal behavioral trust model, aiming to reshape the retraining distribution.
NetworkHoneypot
Open software2026
Material reviewed: Repository metadataSimple DNS honeypot script
NetworkHoneypot
Paper2026
Material reviewed: AbstractThe study proposes an unsupervised detection system built on autoencoder-family models that learn normal traffic behavior and flag anomalies through reconstruction error (MSE), applied to multi-source metadata (Wireshark, firewall logs, and a T-Pot honeypot) collected over fifteen days from a real enterprise VLAN. The authors incorporate external threat intelligence (AbuseIPDB, OTX) and a multi-dimensional scoring system (MDSS) to convert raw detections into prioritized risk scores, and validate anomalies through two MITRE ATT&CK pipelines.
NetworkIoTHoneypot
Paper2025
Material reviewed: AbstractThe authors propose a non-zero-sum game theoretical model to represent strategic interactions between cyber attackers and defenders, incorporating payoff functions that consider exploit probabilities and costs, network node values, and honeypot deployment costs. Through simulations, they derive Nash equilibria to inform strategic defense decisions, finding that high-probability, low-cost exploits like phishing require prioritized defense mechanisms.
NetworkHoneypot
Paper2025
Material reviewed: AbstractThis paper introduces an automated cloud defense framework that leverages medium- to high-interaction honeypot telemetry to dynamically update firewall rules in real time. According to the authors, the system integrates the Cowrie honeypot, Azure-native automation tools, and MITRE ATT&CK-aligned classification within a closed-loop feedback mechanism. The authors report an average Mean Time to Block of 0.86 seconds and classification of over 12,000 SSH attempts in experimental testing.
CloudNetworkHoneypotAdversary engagement
Paper2025
Material reviewed: AbstractAccording to the abstract, the authors propose a honeypot-based guardrail system that fine-tunes a bait model to generate ambiguous, non-actionable responses used as lures to probe user intent during multi-turn interactions with LLMs. The work introduces metrics (HUS and DER) to evaluate bait attractiveness and the safety-usability tradeoff, with initial experiments on a multi-turn jailbreak dataset applied to GPT-4o.
ApplicationHoneypotAdversary engagement
Paper2025
Material reviewed: AbstractThe authors present a simulated Gym-based environment for adversarial reinforcement learning in network security, where attacker and defender agents trained with DQN compete under a zero-sum reward framework. The environment models brute-force attacks and reactive defenses, including honeypot traps and adaptive rate-limiting, and the authors report that defender observability and trap effectiveness create substantial barriers to successful attacks.
NetworkHoneypotAdversary engagement
Paper2025
Material reviewed: AbstractThe paper describes an intrusion detection system based on machine learning, enhanced by integrating the Cowrie honeypot to capture attacker behavioral data and thereby improve detection of indicators of compromise and attack patterns. The authors present an isolated multi-VM architecture, supervised and unsupervised models (Random Forest, Logistic Regression, Isolation Forest), a Flask API for real-time classification, and Kibana and Power BI dashboards, aiming to detect both known and unknown threats.
NetworkHoneypot
Paper2025
Material reviewed: AbstractThe authors propose ADLAH, a conceptual adaptive honeynet architecture using reinforcement learning to decide in real time when to escalate sessions from low-interaction sensors to dynamically provisioned high-interaction honeypots. It is described as a functional prototype of the central decision mechanism, without field-scale validation due to insufficient live data.
NetworkHoneypotAdversary engagement