Paper2025
Material reviewed: AbstractThe authors propose a non-zero-sum game theoretical model to represent strategic interactions between cyber attackers and defenders, incorporating payoff functions that consider exploit probabilities and costs, network node values, and honeypot deployment costs. Through simulations, they derive Nash equilibria to inform strategic defense decisions, finding that high-probability, low-cost exploits like phishing require prioritized defense mechanisms.
NetworkHoneypot
Paper2025
Material reviewed: AbstractThis paper introduces an automated cloud defense framework that leverages medium- to high-interaction honeypot telemetry to dynamically update firewall rules in real time. According to the authors, the system integrates the Cowrie honeypot, Azure-native automation tools, and MITRE ATT&CK-aligned classification within a closed-loop feedback mechanism. The authors report an average Mean Time to Block of 0.86 seconds and classification of over 12,000 SSH attempts in experimental testing.
CloudNetworkHoneypotAdversary engagement
Paper2025
Material reviewed: AbstractAccording to the abstract, the authors propose a honeypot-based guardrail system that fine-tunes a bait model to generate ambiguous, non-actionable responses used as lures to probe user intent during multi-turn interactions with LLMs. The work introduces metrics (HUS and DER) to evaluate bait attractiveness and the safety-usability tradeoff, with initial experiments on a multi-turn jailbreak dataset applied to GPT-4o.
ApplicationHoneypotAdversary engagement
Paper2025
Material reviewed: AbstractThe authors present a simulated Gym-based environment for adversarial reinforcement learning in network security, where attacker and defender agents trained with DQN compete under a zero-sum reward framework. The environment models brute-force attacks and reactive defenses, including honeypot traps and adaptive rate-limiting, and the authors report that defender observability and trap effectiveness create substantial barriers to successful attacks.
NetworkHoneypotAdversary engagement
Paper2025
Material reviewed: AbstractThe paper describes an intrusion detection system based on machine learning, enhanced by integrating the Cowrie honeypot to capture attacker behavioral data and thereby improve detection of indicators of compromise and attack patterns. The authors present an isolated multi-VM architecture, supervised and unsupervised models (Random Forest, Logistic Regression, Isolation Forest), a Flask API for real-time classification, and Kibana and Power BI dashboards, aiming to detect both known and unknown threats.
NetworkHoneypot
Paper2025
Material reviewed: AbstractThe authors propose ADLAH, a conceptual adaptive honeynet architecture using reinforcement learning to decide in real time when to escalate sessions from low-interaction sensors to dynamically provisioned high-interaction honeypots. It is described as a functional prototype of the central decision mechanism, without field-scale validation due to insufficient live data.
NetworkHoneypotAdversary engagement
Paper2025
Material reviewed: AbstractThe authors present ADIRDS, an online monitoring system that models the real system as a graph and monitors critical assets, deploying realistic honeypots with business context similar to the real system to trap attackers and collect evidence when logs are insufficient. According to the authors, they applied the system to a real case, capturing 38 unique attacker IP addresses.
NetworkHoneypotDecoy
Paper2025
Material reviewed: Public pageThe paper studies files uploaded by attackers to a cloud honeypot and uses them to compare signature-based detection by antivirus programs.
CloudHoneypot
Paper2025
Material reviewed: AbstractThe study analyzes malicious actors' patterns and tactics using a modified T-Pot Honeypot, with multiple honeypots in Docker containers emulating vulnerable services. It aims to collect and analyze exploitation, evasion and credential attempts to characterize threats and inform cyberdefense adjustments.
NetworkHoneypot
Paper2025
Material reviewed: AbstractAccording to the authors, this paper proposes a bi-level cyber warfare game framework for designing defensive deception mechanisms that exploit the cognitive vulnerabilities of Advanced Persistent Threat (APT) attackers. The approach combines strategic-level deception design with tactical and operational actions, and the authors report numerical improvements in defender rewards through strategically timed deception deployment.
NetworkAdversary engagement
Open software2025
Material reviewed: Repository metadataEditor contributionExperimental framework generating fictitious user profiles and activity for decoy environments; the repository documents narratives, profiles and language-model integration.
EndpointNetworkDecoyAdversary engagement
Paper2025
Material reviewed: AbstractThis work presents a longitudinal analysis of attacker behavior using HoneyTrap, an adaptive honeypot framework deployed across geographically distributed nodes to emulate vulnerable services. According to the authors, more than 60.3 million events were collected over a 24-day window, with data transformed into Parquet format for scalable analytics. The authors report that HTTP/HTTPS traffic and SSH brute-force attacks were predominant, alongside activity targeting less common services like Minecraft and SMB.
NetworkIoTHoneypot
Paper2025
Material reviewed: AbstractThe work addresses classifying CVE vulnerabilities by which are most frequently exploited, using data collected from a T-pot honeypot. The authors describe a data-collection and analysis plan using Elasticsearch, Kibana and Suricata, aimed at identifying vulnerabilities attractive to malicious actors and the risk they pose to Universidad Politécnica Estatal del Carchi.
NetworkHoneypot
Paper2025
Material reviewed: AbstractThe authors present D3O-IIoT, a reinforcement learning model that dynamically coordinates deception techniques such as honeypot deployment, moving target defense, fake telemetry injection, and node isolation, driven by real-time threat monitoring. The defense problem is formulated as a Markov Decision Process, in which a Dueling Deep Q-Network agent maximizes a multi-objective reward to balance attack mitigation, deception engagement, false positive control, and resource cost.
IoTOT/ICSHoneypotMoving target defense
Paper2025
Material reviewed: AbstractAccording to the authors, this work proposes the design and implementation of an LLM-based honeypot simulating an LDAP server, a protocol critical to identity and access management in organizations. The proposed solution aims to offer a flexible and realistic tool capable of convincingly interacting with attackers, contributing to early detection and threat analysis.
IdentityNetworkHoneypot
Paper2025
Material reviewed: AbstractThis work presents a machine learning-driven methodology combining cryptic and mimetic cyber deception principles to protect integrated circuits against reverse engineering attacks, using a variational autoencoder (AIG-VAE) and new covert gate variants. The authors report that experiments show effectiveness in maintaining functionality while achieving high camouflage and similarity scores.
EndpointDecoy
Open software2025
Material reviewed: Repository metadataRepository about DNS simulation; documentation and maintenance require further review.
NetworkHoneypot
Paper2025
Material reviewed: AbstractAccording to the authors, this work introduces EtherBee, a global dataset integrating Ethereum node metrics, network traffic metadata, and honeypot interaction logs collected from ten geographically diverse vantage points over three months. The stated purpose is to correlate node data with network sessions and security events to study benign and malicious activity, node stability, and network-level threats, as well as a case study on geographic concentration from client optimizations.
NetworkHoneypot
Paper2025
Material reviewed: AbstractThe study compares proposed metrics for honeyfile attributes—Common Token Count and Topic Semantic Matching for enticement, and coherence and cohesion for realism—against human users' perceptions as they judged text samples in a simulated data breach scenario on a crowd-sourcing platform. The authors report that Topic Semantic Matching aligned with perceived enticement, whereas results for Common Token Count were inconsistent and inconclusive, and coherence and cohesion did not consistently align with perceived realism.
HoneytokenDecoy
Paper2025
Material reviewed: Public pageThe study evaluates LLMs for cybersecurity tasks, including honeypot generation, combining knowledge questions with automated assessment of security artifacts.
NetworkHoneypot
Paper2025
Material reviewed: AbstractThis work uses HackIT, a cybersecurity simulation tool, and a human-subject experiment with 88 computer science students to examine how attacker behavior varies across network topologies (ring vs. star) and honeypot densities (50% vs. 75%). The reported outcomes indicate that increased honeypot density maximized decoy interaction but also led to more real-system attacks in centralized (star) networks, whereas decentralized (ring) networks were more robust with fewer honeypots.
NetworkHoneypotDecoy
Paper2025
Material reviewed: Full textBibliographic record on honeypot integration in industrial IoT. The abstract and findings still require review.
OT/ICSHoneypot
Open software2025
Material reviewed: Public pageGenPot is a generative honeypot architecture integrating fine-tuned language models, OpenCanary HTTP skins and a FastAPI service for deployment, evaluation and research. It is an educational and experimental project.
NetworkHoneypot
Open software2025
Material reviewed: Repository metadataHellPot is a cross-platform portal to endless suffering meant to punish unruly HTTP bots.
ApplicationHoneypot