Open software2025
Material reviewed: Repository metadataSignature based honeypot detector tool written in Golang
NetworkHoneypot
Paper2025
Material reviewed: AbstractThe authors propose HoneyFL, a run-time defense against diverse backdoor attacks in federated learning that uses honeypot clients and differential prediction to handle adaptive attacks. The work reports comparative experiments against five state-of-the-art defense baselines, with detection and false-positive rates reported by the authors and an impact on main-task aggregation described as negligible.
Honeypot
Dataset or lab2025
Material reviewed: Public pageCritical readingCSV of seven days of Suricata events from T-Pot, according to the Zenodo record.
NetworkHoneypot
Paper2025
Material reviewed: AbstractAccording to the authors, this work proposes a defense paradigm called 'attack as defense' against model extraction attacks. They introduce HoneypotNet, which replaces the victim model's classification layer with a honeypot layer fine-tuned via bi-level optimization to poison any substitute model trained on its outputs, while preserving original performance.
ApplicationHoneypotDecoy
Open software2025
Material reviewed: Repository metadataAn uploader honeypot designed to look like poor website security.
ApplicationHoneypot
Paper2025
Material reviewed: AbstractThe authors present the Hybrid Cyber Deception System (HCDS), described as a Python-developed proactive tool that combines honeypots and honeytokens in a dynamically adaptive mode to simulate realistic services and redirect attackers in controlled, instrumented settings. The system integrates a deception-driven alerts correlation engine built on Python, Pandas and Scikit-learn, along with Moving Target Defense principles for continuous modulation of network parameters and decoy distribution, and was tested in a simulated environment with Windows and Ubuntu servers to profile attackers and detect complex attack vectors.
NetworkEndpointHoneypotHoneytoken
Paper2025
Material reviewed: Public pageThe authors describe a web-based classroom reservation system in which they implement a hidden honeypot field in the booking form: invisible to humans but fillable by bots, so submissions with that field completed are rejected.
ApplicationDecoy
Paper2025
Material reviewed: AbstractThis paper presents the implementation of a honeynet in which a honeypot acts as a real resource within a production network environment, aiming to divert and mislead attackers and analyze their behavior. According to the authors, the honeypot mimics both scanners and attackers within a simulated, production-level environment.
NetworkHoneypotDecoy
Paper2025
Material reviewed: Public pageProposal describing the addition of a CamouflageNet honeynet and machine learning techniques into the SCADA architecture of an ICS system, aiming to improve defense and the ability to gather information about attackers.
OT/ICSHoneypot
Paper2025
Material reviewed: AbstractThe authors present Koney, a Kubernetes operator that orchestrates cyber deception technology deployment through deception policy documents described as code. Using cloud-native technologies such as service meshes and eBPF, the system adds traps to containerized applications without source code access, facilitating setup, rotation, monitoring, and removal of traps, emphasizing maintainability, scalability, and operational simplicity.
CloudApplicationDecoyAdversary engagement
Open software2025
Material reviewed: Repository metadataRepository about fake applications for attacker diversion; documentation and maintenance require further review.
ApplicationDecoy
Paper2025
Material reviewed: AbstractThe authors present LLMHoney, an SSH honeypot that uses large language models (LLMs) to generate realistic, dynamic command outputs in real time, combining a dictionary-based virtual file system with LLMs for novel inputs. According to the abstract, the system was evaluated on 138 representative Linux commands across 13 LLM variants, reporting accuracy, latency, and memory metrics, while discussing challenges such as occasional hallucinated outputs.
NetworkEndpointHoneypotDecoy
Dataset or lab2025
Material reviewed: Public pageCritical readingData from a T-Pot honeynet spread across Azure regions, according to its Zenodo record.
CloudHoneypot
Case study2025
Material reviewed: Public pageCritical readingInstitutional report on deception trials involving UK organizations and providers.
NetworkCloudHoneypotDecoy
Paper2025
Material reviewed: AbstractThe article explores Dirichlet distribution topic models for clustering terminal session commands collected from honeypots, aiming to find groups of attacks sharing a common intent and to identify outliers. The authors introduce primary and secondary topics, and session-level and command-level topics, and extend the methods in a Bayesian nonparametric fashion to allow unbounded vocabulary size and number of latent intents.
NetworkHoneypot
Paper2025
Material reviewed: AbstractThe authors propose a neuro-symbolic fusion approach for cognitive threat reasoning in cyber deception environments. It combines deep neural networks with symbolic reasoning, using knowledge graphs, probabilistic logic, and reinforcement learning to identify, predict, and respond to adversaries and to optimize deception strategies.
NetworkDecoyAdversary engagement
Paper2025
Material reviewed: AbstractThis paper models honeypot deployment in cyber-physical systems (CPS) as a signaling game with a fixed gamma ratio, deriving perfect Bayesian-Nash equilibria and proposing a fictitious-play algorithm to determine the optimal honeypot ratio that maximizes defense utility. The authors report numerical results that, as they state, confirm the method's effectiveness.
Honeypot
Paper2025
Material reviewed: AbstractThe authors describe designing and implementing an active defense system on a DATANET server that combines a honeypot to lure and monitor attacker activity with network obfuscation to mask the real network structure and redirect suspicious traffic. They report that the system detected and diverted attacks without disrupting the main service.
NetworkHoneypot
Dataset or lab2025
Material reviewed: Public pageCritical readingRecord of access and attack data against a VSAT honeynet.
OT/ICSHoneypot
Paper2025
Material reviewed: AbstractThe study integrates a honeypot into an SD-WAN architecture to combine traffic management and threat observation. The proposal routes anomalous activity into a decoy environment that simulates vulnerable services.
NetworkHoneypotDecoy
Paper2025
Material reviewed: AbstractThis paper presents, according to the authors, the first large-scale real-world evaluation of an LLM-based scambaiting system, designed as a conversational honeypot to engage scammers and extract actionable threat intelligence such as mule bank accounts. Over a five-month deployment, the system initiated thousands of engagements, reporting an information disclosure rate and strong alignment between LLM-generated responses and human operator preferences.
IdentityNetworkHoneypotAdversary engagement
Paper2025
Material reviewed: AbstractThe authors present ShadowKube, an active defense framework for Kubernetes that integrates behavioral monitoring with shadow honeypots to detect and neutralize anomalous behavior. The approach establishes behavioral baselines to identify deviations and converts compromised nodes into honeypots, with the stated purpose of isolating and trapping attackers in intrusions targeting container orchestration.
CloudApplicationHoneypotDecoy
Open software2025
Material reviewed: Repository metadataSpam Honeypot with Intelligent Virtual Analyzer
NetworkHoneypot
Paper2025
Material reviewed: Public pageThe authors review social engineering and describe, among other defenses, honeypots that simulate human interaction, such as email responses or chatbot interactions, to lure and log attack attempts.
NetworkApplicationHoneypot