Paper2020
Material reviewed: AbstractThe authors propose an integrated defense technique combining cyberdeception via decoy systems with moving target defense through network topology shuffling, applied to SDN-based IoT networks. According to the abstract, they develop and compare several strategies for deciding when and how to reshuffle network topology in the presence of decoys, analytically evaluating effectiveness through a graphical security model. The authors report that their approach prolongs system lifetime, increases attack complexity, and maintains service availability compared to a network without the technique.
IoTNetworkMoving target defenseDecoy
Paper2020
Material reviewed: AbstractThe paper reviews the use of deception technology, specifically honeypot systems, to address threats against IoT devices. The authors compare the most popular existing honeypot systems, identify their strengths and weaknesses, and attempt to adapt them to operate at the level of Internet of things devices.
IoTHoneypotDecoy
Paper2020
Material reviewed: AbstractThis paper addresses the synthesis of active deception strategies in networks using two-player games with asymmetric information and temporal logic objectives, incorporating decoy systems and high-fidelity honeypots. The authors use a level-2 hypergame framework to model the attacker's incomplete perception and assess whether the defender can guarantee security properties.
NetworkDecoyHoneypot
Paper2019
Material reviewed: AbstractAccording to the authors, this work proposes AnonTokens, an approach applying the honeytoken concept to the data privacy domain to trace re-identification attacks. High re-identification-risk decoy records are inserted into anonymized datasets to detect malicious users. The authors evaluate their approach using large-scale population datasets.
ApplicationHoneytokenDecoy
Paper2019
Material reviewed: AbstractThe article discusses how cyber deception can change an attacker's perception of the network environment and lead attackers to false beliefs about which systems contain critical information. The authors introduce game theory models and discuss techniques combining artificial intelligence algorithms with those models to estimate hidden states of the attacker using feedback through payoffs, in order to learn how best to defend the system using cyber deception.
NetworkDecoyAdversary engagement
Paper2019
Material reviewed: AbstractAccording to the abstract, this work develops inference techniques to detect organic click fraud in advertising networks. The authors note that malware detection systems, including honeypots, fail to stop click fraud apps, and propose two defenses: a mimicry defence based on detecting click reuse patterns, and a bait-click defence that injects decoy clicks to trigger fraudulent app behavior.
NetworkApplicationHoneypotDecoy
Paper2019
Material reviewed: AbstractThe authors present an overview of cyber deception games across three environments, extending baseline signaling game models to include evidence via side-channel knowledge acquisition. They analyze deception in binary and continuous information spaces and explore a multi-stage incomplete-information Bayesian game model for defensive deception against advanced persistent threats, using perfect Bayesian Nash equilibrium as the solution concept.
NetworkAdversary engagementDecoy
Paper2019
Material reviewed: AbstractAndrew Bushby's article describes the use of deception technology as a mechanism for active, post-breach defence aimed at luring, detecting and defending against malware and intruders moving laterally within the network. It notes that such approaches come with misconceptions and argues that defences need to move beyond detecting bad activity within an ocean of good activity.
NetworkDecoyAdversary engagement
Paper2019
Material reviewed: AbstractAccording to the authors, this paper presents a user study with 40 participants evaluating HoneyBot, a hybrid-interaction honeypot designed for networked robotic systems that simulates unsafe actions while performing safe physical ones. The authors report that participants could not distinguish simulated sensor values from real ones.
IoTOT/ICSHoneypotDecoy
Paper2019
Material reviewed: AbstractAccording to the authors, this paper proposes an SDN-based in-network honeypot that reroutes traffic from suspicious nodes and intelligently spoofs it with misleading information to confuse attackers in IoT environments, without requiring dedicated hardware. The authors state preliminary evaluations show little impact on network performance.
IoTNetworkHoneypotDecoy
Paper2019
Material reviewed: AbstractThe authors present experimental tests of common attacks on wired IPv6 networks and describe the design and implementation of a Honeynet with different operating systems. They use tools such as 6Guard, Snort and Wireshark to attract, detect and analyze attacker behavior.
NetworkHoneypotDecoy
Paper2018
Material reviewed: Publisher metadataBibliographic record on cyber deception overview and challenges. The abstract and findings still require review.
NetworkDecoy
Paper2018
Material reviewed: AbstractThis work proposes applying a cyber deception strategy in wireless local area networks, using decoys that are honeypots, to detect and characterize malicious activity such as the evil twin access point. The authors further describe how the same approach can be used to gather attacker activity information and to detect SSL stripping and DNS spoofing attacks.
NetworkHoneypotDecoy
Paper2018
Material reviewed: Publisher metadataBibliographic record on ransomware tracing through deception. The abstract and findings still require review.
EndpointDecoy
Paper2018
Material reviewed: AbstractThe authors describe the use of honeypots as a decoy-based technology deployed in a network, aimed at defending IoT devices from attacks and gathering information about the attacker's device. The paper presents how honeypots, acting as cost-effective deception models, entice attackers in order to preserve information against attacks.
IoTNetworkHoneypotDecoy
Paper2018
Material reviewed: Publisher metadataBibliographic record on visual modeling of deception. The abstract and findings still require review.
NetworkDecoy
Paper2017
Material reviewed: Publisher metadataBibliographic record on probabilistic logic of deception. The abstract and findings still require review.
NetworkDecoy
Paper2017
Material reviewed: Publisher metadataBibliographic record on technologies enabling deception. The abstract and findings still require review.
NetworkDecoy
Paper2016
Material reviewed: Publisher metadataBibliographic record on an adaptive deception system. The abstract and findings still require review.
NetworkDecoy
Case study—
Material reviewed: Public pageShadowPlex selection and pilot story published by Acalvio for a consumer goods company.
CloudIdentityDecoy
Case study—
Material reviewed: Public pageIndustrial manufacturer story published by Acalvio; recorded as a vendor case.
OT/ICSDecoy
Product—
Material reviewed: Public pageCritical readingPrimarily a microsegmentation product whose documentation includes dynamic redirection into a deception environment; this related capability is recorded.
NetworkOT/ICSDecoyMoving target defense
Open software—
Material reviewed: Repository documentationA honeypot project (now outdated) that deploys decoy clients and services to detect compromise via traffic discrepancies and honeytoken credential reuse.
NetworkIdentityHoneypotHoneytoken
Case study—
Material reviewed: Public pageCritical readingVendor-published story of Fidelis Deception use at a North American children’s hospital.
NetworkIdentityDecoy