Paper2021
Material reviewed: AbstractAccording to the authors, this work studies two-sided deception in cybersecurity by manipulating the observable configuration of both honeypots and real machines. Using an experiment with a 40-machine network (20 honeypots) and an experimental testbed, the authors compare three feature-concealment conditions against human attackers.
NetworkHoneypotDecoy
Paper2021
Material reviewed: Public pageThe linked preprint abstract describes DARLH, a honeypot system that uses deep reinforcement learning-based and deep recurrent neural network-based IDS agents to detect internal and external runtime DoS attacks. Its purpose is to provide dynamic intrusion detection and event validation for monitoring DoS attacks in the honeypot environment.
NetworkHoneypotDecoy
Paper2021
Material reviewed: Full textBibliographic record on design thinking for cyber deception. The abstract and findings still require review.
NetworkDecoy
Paper2021
Material reviewed: AbstractThis paper presents an approach to container-based honeypots that simulate container escapes as a deception technique in the context of cloud computing virtualization. According to the authors, it investigates the possibilities of container-based honeypots to imitate legitimate network targets and raise alerts on attacker interactions, allowing study of attacker techniques.
NetworkCloudHoneypotDecoy
Paper2021
Material reviewed: AbstractAccording to the abstract, the authors propose a hypergame framework between an attacker and a defender where each can interpret the situation differently based on asymmetric beliefs, applied to advanced persistent threats (APT) across the cyber kill chain. The work evaluates through simulations how defensive deception strategies can manipulate attacker beliefs.
NetworkAdversary engagementDecoy
Paper2021
Material reviewed: AbstractThis paper is a survey examining defensive deception approaches grounded in game theory and machine learning within cyber defense research. According to the authors, it analyzes key components, underlying principles, and tradeoffs of different approaches across various problem settings. The work compiles insights, lessons, and limitations from prior research and proposes future directions to address existing gaps.
NetworkAdversary engagementDecoy
Paper2021
Material reviewed: AbstractAccording to the authors, HoneyCar is a decision support framework for configuring honeypots in the Internet of Vehicles, based on known vulnerabilities from the NVD/CVE database. The approach models adversarial interaction as a repeated imperfect-information zero-sum game, aiming to compute optimal honeypot configuration strategies for threat intelligence collection.
IoTNetworkHoneypotDecoy
Paper2021
Material reviewed: AbstractThis paper describes the incorporation of deceptive elements, including honeypots and decoys, into Microsoft's CyberBattleSim experimentation platform. According to the authors, they tested the defensive capabilities of these elements against reinforcement-learning-based attackers in a capture-the-flag environment, finding that attacker progress depended on the number and location of deceptive elements.
NetworkHoneypotDecoy
Paper2021
Material reviewed: AbstractThe authors extend their anti-ransomware tool R-Locker to Windows, relying on a honeyfile-based approach in which 'infinite' trap files are disseminated around the target filesystem for early detection and to block ransomware action. The Windows version addresses differences in FIFO handling and adds improved global management of honeyfiles and (semi)automated blocking of suspicious ransomware through the dynamic use of white-/black-lists.
EndpointHoneytokenDecoy
Paper2021
Material reviewed: AbstractThe work addresses the protection of vulnerable components in Internet-of-Things (IoT) networks through an intrusion prevention technique that combines cyberdeception (a decoy system) and moving target defense (network topology shuffling). The authors analytically evaluate effectiveness and efficiency using a graphical security model in an SDN-based IoT network, defining strategies for when and how to perform topology shuffling to pursue goals such as prolonging system lifetime, increasing attack complexity on critical nodes, or maintaining service availability.
IoTNetworkDecoyMoving target defense
Paper2021
Material reviewed: AbstractThis work examines how decoy generation can slow the decision process of automated agents in adversary emulation scenarios. The authors show, according to their study, that the degree of inhibition greatly depends on the types of decoy objects used, pointing to the need to explicitly evaluate decoy generation and placement strategies against fast-moving automated adversaries.
NetworkDecoyAdversary engagement
Paper2021
Material reviewed: Full textBibliographic record on self-adaptive deception. The abstract and findings still require review.
NetworkDecoy
Paper2020
Material reviewed: AbstractThe authors present a differentially private game theoretic approach to cyber deception, aiming to overcome limitations of prior approaches that assume a fixed number of systems and simplified attackers. The defender uses differential privacy mechanisms to strategically change the number of systems and obfuscate configurations, while the attacker uses Bayesian inference. According to the authors, experimental results demonstrate the effectiveness of the proposed approach.
NetworkDecoyMoving target defense
Paper2020
Material reviewed: AbstractAccording to the abstract, the authors propose DARCY, a defense framework adapting the honeypot concept from cybersecurity to detect Universal Trigger textual adversarial attacks. DARCY injects multiple trapdoors into a neural network model to bait and detect such attacks, reporting high detection rates in experiments across four public datasets.
ApplicationHoneypotDecoy
Paper2020
Material reviewed: AbstractThe authors propose a formal-methods approach to synthesize reactive defense strategies in networks equipped with decoy systems. They generalize attack graphs to incorporate defender countermeasures in an attack-defend game model, and introduce a class of hypergames to model asymmetric information created by decoys. According to the authors, this framework enables synthesis of effective defense strategies exploiting the attacker's misperception.
NetworkDecoyMoving target defense
Paper2020
Material reviewed: Publisher metadataBibliographic record on an adaptive deception framework. The abstract and findings still require review.
ApplicationDecoy
Paper2020
Material reviewed: AbstractThis paper, according to its authors, presents an adaptive agent that uses active deception to recognize a cyber attacker's intent, modeling the problem as a two-agent sequential decision process via factored I-POMDPs. The authors describe using honeypots and decoys across multiple attack phases to refine predictions about attacker behavior, rather than merely delaying or confusing attackers.
NetworkEndpointHoneypotDecoy
Paper2020
Material reviewed: Full textBibliographic record on adaptive signaling for cyber defense. The abstract and findings still require review.
NetworkDecoy
Paper2020
Material reviewed: AbstractThe study presents an exploratory experiment with 30 human participants acting as attackers to test a masking strategy (compared with a random masking strategy) aimed at reducing attackers' utility during network reconnaissance. The authors observed that attackers appeared more successful in launching attacks in the optimal condition, that the attackers' total score did not differ between masking strategies, and a generalized tendency to act according to certainty bias or risk aversion.
NetworkDecoy
Paper2020
Material reviewed: AbstractThe paper proposes an anti-reconnaissance model for host fingerprints based on virtual nodes. The model constructs periodically reconfigurable virtual nodes to dynamically camouflage host fingerprint information and redirects attack traffic targeting virtual nodes to honeypots; the authors also introduce probabilistic models to examine how parameters such as the number of probes or honeypot mapping rules affect attack success probability, and they describe a prototype using SDN and DPDK intended to verify the model against reconnaissance.
NetworkHoneypotDecoy
Paper2020
Material reviewed: Full textCritical readingSurvey of defensive deception models and techniques in networks, hosts and cryptographic mechanisms.
NetworkEndpointDecoy
Paper2020
Material reviewed: AbstractAccording to the authors, this study proposes a time-expanded random network to model adversarial lateral movement in enterprise networks, along with dynamic cognitive honeypots placed at idle production nodes and honey links disguised as service links. The authors describe an approach aimed at reducing long-term vulnerability through honeypot policies whose location changes randomly.
NetworkHoneypotDecoy
Paper2020
Material reviewed: Publisher metadataBibliographic record on personalized web-application deception. The abstract and findings still require review.
ApplicationDecoy
Paper2020
Material reviewed: AbstractAccording to the authors, this paper introduces 'Primer', a tool for priming and evaluating dynamic honeypots against previously developed measures of effectiveness related to environment fingerprinting, capturing adversary data, deception, and self-monitoring. The authors state they provide quantitative calibration results as a step toward automated effectiveness testing.
NetworkHoneypotDecoy