Paper2026
Material reviewed: AbstractThe study proposes QuantumGuard, a proactive cybersecurity framework that combines cognitive honeynets, post-quantum-secured intelligence channels and reinforcement-learning-driven deception adaptation across 6G-enabled cyber-physical environments. The authors aim to integrate a cognitive honeynet orchestrator, a deception policy engine operating under partial observability, a transformer-based MITRE ATT&CK attribution network and a post-quantum federated intelligence bus into a single closed-loop control architecture, and they report a preliminary evaluation on benchmark datasets and a 320-endpoint testbed.
NetworkIoTHoneypotDecoy
Paper2026
Material reviewed: AbstractThe paper describes a hybrid intrusion detection system combining a supervised classifier trained on the NSL-KDD dataset with a Docker-based honeypot that deploys automatically when suspicious activity is detected. Traffic is classified into five categories, with a voting ensemble of three classifiers producing the detection.
NetworkHoneypot
Paper2026
Material reviewed: Full textEditor contributionPacheco and Staino present BUDA as an approach to simulating fictitious-user activity and strengthening decoy credibility, aligned with MITRE Engage.
EndpointNetworkDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThe article presents SAGE, an adaptive Internet of Things (IoT) honeypot that combines Finite-State Machine (FSM)-driven protocol emulation with GraphRAG-enhanced retrieval to model stateful IoT protocols and generate responses using a Large Language Model (LLM). The authors also describe a fact-checking engine and a feedback mechanism intended to refine responses and progressively expand state-response mappings based on observed adversarial interactions.
IoTHoneypotAdversary engagement
Paper2026
Material reviewed: Public pageThe authors propose SecuPi, a compact Raspberry Pi-based system that combines real-time traffic monitoring, hybrid intrusion detection (signature-based and machine learning) and automated threat response. As deception and proactive defense mechanisms, they propose the use of honeypots together with automatic firewall updates and Moving Target Defense (MTD).
NetworkIoTHoneypotMoving target defense
Paper2026
Material reviewed: AbstractThe authors propose a proactive cyber-defense system that combines cyber deception, adversarial environment simulation and deep reinforcement learning, with GAN-generated attack vectors emulating zero-day and polymorphic threats. The aim is to train context-aware defense policies that detect malicious behavior, re-route detection vectors and trigger deceptive traps, evaluated with benign and adversarial traffic on a synthetic smart-grid network.
NetworkOT/ICSDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThis paper presents ShellGames, an SSH shell simulator based on large language models (LLMs) designed to sustain credible interactive deception sessions with adversaries. According to the authors, the system combines techniques such as chain-of-thought reasoning, memory management, speculative command execution, sandbox routing, and subversion detection to address common LLM limitations. The authors report improvements in accuracy, consistency, and state tracking over baselines, along with a user study indicating perceived realism comparable to a real shell.
NetworkEndpointHoneypotMoving target defense
Paper2026
Material reviewed: AbstractThe authors introduce HoneyMed, a protocol-aware honeypot framework that simulates healthcare and IoT services in order to collect malicious interactions, transform them into machine-learning tabular features, and classify attack types in real time. Its stated purpose is to provide threat visibility for IoMT security testbeds using decoys, feature extraction and lightweight classifiers, without interacting with production medical assets.
IoTNetworkHoneypotDecoy
Paper2026
Material reviewed: Public pageThe manuscript proposes coordinating agents and threat flows through zones in a computational world, including honeypots, deception regions, and classification and quarantine routes.
ApplicationHoneypot
Paper2026
Material reviewed: AbstractThis paper presents a method to estimate a lower bound on the number of networks generating spoofed traffic in DRDoS attacks, using a global deployment of anycast amplification honeypots. The authors develop two estimators based on honeypot reception patterns and TTL variations, analyzing 287 days of amplification attacks. According to the authors, at least 21.0% of attacks originate from multiple network locations.
NetworkHoneypot
Open software2026
Material reviewed: Repository metadataA low/zero interaction ssh authentication logging honeypot
NetworkHoneypot
Open software2026
Material reviewed: Repository metadataA low-interaction SSH honeypot written in C
NetworkHoneypot
Paper2026
Material reviewed: AbstractAccording to the authors, this work presents SysEvolve, a system integrating three co-designed components (SysField, SysSpear, and SysArmor) to create a self-driven adversarial loop between LLM-based attack and defense agents. The authors describe the construction of realistic multi-host cyber ranges, attack scheme generation, and real-time interpretable defense. They also note that decoy endpoints deployed in the range affect LLM agent behavior.
NetworkDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThe authors use an interactive voice honeypot with language-model personas on real U.S. numbers to measure the prevalence of automated and synthetic voices in unwanted inbound calls, combining audio fingerprinting, a commercial synthetic-speech detector, and blinded listeners to characterize call traffic.
NetworkHoneypot
Paper2026
Material reviewed: Publisher metadataBibliographic record on realism and efficiency of deception. The abstract and findings still require review.
NetworkDecoy
Case study2026
Material reviewed: Public pageCritical readingIBM X-Force and Deception.Pro recorded two incidents in simulated organizations, observing reconnaissance, malware deployment and fake-document exfiltration.
EndpointOT/ICSDecoyAdversary engagement
Open software2026
Material reviewed: Repository metadataModern honeypot supporting multiple services, realistic website cloning, and AI-powered features
ApplicationHoneypot
Paper2026
Material reviewed: AbstractThe authors introduce Trident, an agentic LLM red teaming framework for evaluating the robustness of Deep Reinforcement Learning (DRL)-based cyber defenses. The work includes a dynamic benchmark, a dataset of red-blue interaction trajectories, and an agentic architecture that generates attack strategies and translates them into executable policies against DRL defenders. According to the authors, Trident substantially reduces defensive performance and uncovers emergent behaviors such as decoy avoidance.
NetworkDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThe paper presents TrustFed-Honeypot, a hybrid federated-retraining framework for honeypot-based IDS. Clients train locally, and the server retrains a global logistic model on samples weighted by a multi-signal behavioral trust model, aiming to reshape the retraining distribution.
NetworkHoneypot
Open software2026
Material reviewed: Repository metadataSimple DNS honeypot script
NetworkHoneypot
Paper2026
Material reviewed: AbstractThe study proposes an unsupervised detection system built on autoencoder-family models that learn normal traffic behavior and flag anomalies through reconstruction error (MSE), applied to multi-source metadata (Wireshark, firewall logs, and a T-Pot honeypot) collected over fifteen days from a real enterprise VLAN. The authors incorporate external threat intelligence (AbuseIPDB, OTX) and a multi-dimensional scoring system (MDSS) to convert raw detections into prioritized risk scores, and validate anomalies through two MITRE ATT&CK pipelines.
NetworkIoTHoneypot
Open software2026
Material reviewed: Repository metadataWebDecoy Bot Detection — zero-config WordPress plugin for bot protection, spam prevention, and WooCommerce carding defense
ApplicationDecoy
Paper2026
Material reviewed: Full textFormal analysis of honeytoken limits when trusted agents and attackers share memory or policies.
ApplicationIdentityHoneytoken
Paper2025
Material reviewed: AbstractAccording to the abstract, the authors present a descriptive model incorporating psychological and strategic factors (belief, scepticism, deception fidelity, reconnaissance, and experience) to explain an attacker's initial decision to engage or withdraw from cyber-deception techniques. The authors state they have designed experiments using Capture the Flag activities and biometric observations to evaluate the model, but explicitly clarify that these experiments have not yet been conducted and no experimental findings are presented in the paper.
NetworkDecoyAdversary engagement