Case study2025
Material reviewed: Public pageCritical readingInstitutional report on deception trials involving UK organizations and providers.
NetworkCloudHoneypotDecoy
Paper2025
Material reviewed: AbstractThe article explores Dirichlet distribution topic models for clustering terminal session commands collected from honeypots, aiming to find groups of attacks sharing a common intent and to identify outliers. The authors introduce primary and secondary topics, and session-level and command-level topics, and extend the methods in a Bayesian nonparametric fashion to allow unbounded vocabulary size and number of latent intents.
NetworkHoneypot
Paper2025
Material reviewed: AbstractThis paper models honeypot deployment in cyber-physical systems (CPS) as a signaling game with a fixed gamma ratio, deriving perfect Bayesian-Nash equilibria and proposing a fictitious-play algorithm to determine the optimal honeypot ratio that maximizes defense utility. The authors report numerical results that, as they state, confirm the method's effectiveness.
Honeypot
Paper2025
Material reviewed: AbstractThe authors describe designing and implementing an active defense system on a DATANET server that combines a honeypot to lure and monitor attacker activity with network obfuscation to mask the real network structure and redirect suspicious traffic. They report that the system detected and diverted attacks without disrupting the main service.
NetworkHoneypot
Dataset or lab2025
Material reviewed: Public pageCritical readingRecord of access and attack data against a VSAT honeynet.
OT/ICSHoneypot
Paper2025
Material reviewed: AbstractThe study integrates a honeypot into an SD-WAN architecture to combine traffic management and threat observation. The proposal routes anomalous activity into a decoy environment that simulates vulnerable services.
NetworkHoneypotDecoy
Paper2025
Material reviewed: AbstractThis paper presents, according to the authors, the first large-scale real-world evaluation of an LLM-based scambaiting system, designed as a conversational honeypot to engage scammers and extract actionable threat intelligence such as mule bank accounts. Over a five-month deployment, the system initiated thousands of engagements, reporting an information disclosure rate and strong alignment between LLM-generated responses and human operator preferences.
IdentityNetworkHoneypotAdversary engagement
Paper2025
Material reviewed: AbstractThe authors present ShadowKube, an active defense framework for Kubernetes that integrates behavioral monitoring with shadow honeypots to detect and neutralize anomalous behavior. The approach establishes behavioral baselines to identify deviations and converts compromised nodes into honeypots, with the stated purpose of isolating and trapping attackers in intrusions targeting container orchestration.
CloudApplicationHoneypotDecoy
Open software2025
Material reviewed: Repository metadataSpam Honeypot with Intelligent Virtual Analyzer
NetworkHoneypot
Paper2025
Material reviewed: Public pageThe authors review social engineering and describe, among other defenses, honeypots that simulate human interaction, such as email responses or chatbot interactions, to lure and log attack attempts.
NetworkApplicationHoneypot
Paper2025
Material reviewed: AbstractThis study, as described by the authors, explores the use of AI agents to automate the analysis of logs generated by the Cowrie honeypot, addressing the scarcity of real-world attack data in cybersecurity research. The proposed approach uses AI agents to parse, summarize, and extract insights from unstructured data, while also considering the security implications of deploying such an autonomous system.
NetworkHoneypot
Paper2024
Material reviewed: AbstractThe authors present a generative model-based honeypot (using an LSTM network) designed to mimic industrial OPC UA communication in operational technology (OT) systems. The model learns the characteristics of a cyclic mechatronic system from recorded state space trajectories. The work proposes a proof-of-concept and publishes a dataset of a cyclic industrial process to support future research.
OT/ICSHoneypot
Paper2024
Material reviewed: AbstractThe authors address the difficulty that traditional honeypot implementations are evaded by advanced adversaries such as APT groups, and propose designing and deploying a customized honeypot network based on adaptive camouflaging techniques. The work describes orchestrating a behavioral honeypot network tailored to three APT groups, with attack paths aligned with their tactics, techniques, and procedures, and includes a camouflaged chatterbox application deployed for 100 days; according to the deposited abstract, the setup recorded 13,906,945 hits from 4,238 unique IP addresses and was used to categorize attackers.
NetworkApplicationHoneypotDecoy
Paper2024
Material reviewed: Public pageThe paper proposes a honeypot layer to support security in an optical network with cloud services. The decoys simulate vulnerable resources to attract attackers and observe their behavior.
NetworkHoneypotDecoy
Paper2024
Material reviewed: Public pageProposes using hardware honeypots as an additional defensive layer to detect and mitigate hardware Trojans in IoT devices, aiming to protect them from operational failures, denial of service, or data leakage.
IoTHoneypot
Open software2024
Material reviewed: Repository metadataMulti-head SSH honeypot system.
NetworkHoneypot
Paper2024
Material reviewed: AbstractAccording to the authors, this paper introduces IndisUAT, a new method for generating universal adversarial triggers (UAT) against NLP models that bypasses DARCY, a honeypot-based defense that baits multiple trapdoors to detect adversarial examples. The authors state that IndisUAT produces adversarial examples whose feature distribution is indistinguishable from benign examples, reducing DARCY's detection effectiveness and that of other defenses across several models.
ApplicationHoneypot
Paper2024
Material reviewed: AbstractThe authors analyze robocall data from multiple independent vantage points, including academic and industry voice honeypots, to study the effectiveness of telephone spam prevention and mitigation efforts. The work compares disparate data sources over more than 5 years, including audio and transcripts from millions of calls, to assess trends and spammer adaptation to authentication schemes like STIR/SHAKEN.
NetworkHoneypot
Paper2024
Material reviewed: AbstractThis paper addresses automated content generation for honeyfiles, decoy documents designed to detect intruders. The authors focus on generating realistic charts within such documents, combining a multitask Transformer for captions and plot text with a specialized autoencoder for underlying tabular data. They also introduce a new dataset and a metric (Keyword Semantic Matching) to evaluate semantic consistency of generated content.
EndpointHoneypotDecoy
Dataset or lab2024
Material reviewed: Public pageCritical readingZeek traffic record from geographically distributed low-interaction sensors; the page says no conventional honeypot software was used.
NetworkHoneypot
Paper2024
Material reviewed: AbstractAccording to the authors, this paper proposes a cyber deception mechanism that stealthily redirects TCP communications to an on-demand honeypot server cloned to resemble the victim asset. The stated goal is to make attackers focus on the decoy server, enabling threat intelligence collection while protecting the real asset.
NetworkHoneypotDecoy
Paper2024
Material reviewed: Public pageThe article connects strategic principles from Chanakya's Arthashastra with digital defense and presents honeypots as a means of attracting attackers into controlled environments to observe their tactics.
Honeypot
Paper2024
Material reviewed: Public pageIt proposes simulating, transforming and integrating synthetic honeypot logs into a graph database using the STIX model, aiming to convert attack data into interconnected threat intelligence objects for visualization and exploration. The purpose is to provide security operations centers with a standardized platform that enhances situational awareness and decision-making support.
NetworkHoneypot
Open software2024
Material reviewed: Repository metadataEditor contributionOpen framework for planning deception operations and deploying decoys and services with Python and Docker, according to its repository and documentation.
NetworkApplicationDecoyHoneypot