Paper2024
Material reviewed: AbstractThe authors address a scenario where a defender of a networked control system has isolated an intruder and redirects them toward a honeypot emulating the real system without connection to a physical plant. They propose an adversary engagement strategy within this decoy environment to increase the attacker's information-processing costs by spoofing sensor readings based on cyber threat intelligence. They perform a numerical comparison between cases of perfect and imperfect threat intelligence.
OT/ICSNetworkHoneypotAdversary engagement
Paper2024
Material reviewed: AbstractAccording to the authors, this paper reviews the use of large language models (LLMs) in malware detection, including applications to malware honeypots, text-based threat identification, code analysis, and trend detection. The authors propose a classification scheme, performance metrics, and an LLM-based risk mitigation framework, evaluating its performance against LLM-enabled malware.
EndpointHoneypot
Paper2024
Material reviewed: AbstractThis work, according to its authors, addresses security in Advanced Metering Infrastructure (AMI) for smart grids using honeypots combined with federated learning. They propose FedPot, which includes a data quality measure and a fair incentive mechanism allowing small power suppliers to share locally trained models with traditional retailers without exposing confidential data. The authors report, via simulations on realistic microgrid log datasets, improvements over state-of-the-art techniques in both the security model and reward distribution.
OT/ICSIoTHoneypot
Open software2024
Material reviewed: Repository metadataCredentials catching honeypot
NetworkHoneypot
Paper2024
Material reviewed: AbstractAccording to the authors, this paper explores the use of Generative Adversarial Networks (GANs) to generate decoy configurations for cyber defense. They note that existing approaches rely on maintained lists of configurations or pre-configured images with limited adaptability, and present what they describe as the first attempt to use GANs specifically for generating decoy configurations, aiming to provide defenders with a tool to strengthen network defenses.
NetworkHoneypotDecoy
Paper2024
Material reviewed: Full textCritical readingPresents a language-model terminal honeypot architecture and describes a field evaluation.
NetworkHoneypot
Open software2024
Material reviewed: Repository metadataHoneyHTTPD is a Python-based web server honeypot/service imitation builder. Great for honeypots or faking HTTP services.
ApplicationHoneypot
Open software2024
Material reviewed: Repository metadataFTP Honeypot
NetworkHoneypot
Paper2024
Material reviewed: AbstractReview of the honeypot as a decoy system simulating an isolated real system on a network to entice attackers and detect, block or foresee attempts at unauthorized access. The authors describe a monitoring arrangement linking honeypot, main network and system-admin so hostile activity is detected before the main network is affected.
NetworkHoneypot
Open software2024
Material reviewed: Repository metadataScript for turning a Raspberry Pi into a Honey Pot Pi
NetworkHoneypot
Paper2024
Material reviewed: AbstractThe paper assesses a specific group of honeypot systems based on criteria such as detection range, emulation accuracy, data quality, dependability, scalability, and ease of setup, and draws conclusions about their relative effectiveness in different situations. It also discusses recent developments in honeypot technology, including machine learning enhancements, increased automation, integration with other security tools, cloud-based honeypots, and deception technology, using simulated attacks to demonstrate how these systems log and record attack information.
NetworkCloudHoneypotDecoy
Paper2024
Material reviewed: AbstractThe work addresses automating honeypot deployment using Ansible and a web application that also monitors the process. The authors describe their purpose of reducing the time and resources of manual deployment and report tests on sensors running on Google Cloud Platform.
CloudHoneypot
Paper2024
Material reviewed: AbstractThe authors investigate whether peer-to-peer (P2P) overlay network nodes, specifically Ethereum network nodes, attract heightened reconnaissance attacks due to their visibility and sustained uptime. They deploy a series of honeypots alongside real Ethereum nodes across globally distributed vantage points. The authors report findings on specific attack types targeting particular ports and services, extending the analysis through port scans on other reachable peers.
NetworkHoneypot
Paper2024
Material reviewed: AbstractThe study proposes a malware detection system that combines Particle Swarm Optimization (PSO) with a fuzzyKNN model, using PSO to select a feature set from a malware dataset and employing a honeypot as a controlled environment for collecting samples and training the model. The authors compare their method against standard detection techniques and report that the PSO-fuzzyKNN approach enhances malware detection accuracy.
EndpointHoneypot
Paper2024
Material reviewed: AbstractThe authors propose a network design for honeypot placement and an intrusion detection system aimed at identifying and alerting on illicit access, using traffic logs. They use datasets derived from a honeypot implementation and KDD-99, trained with generative adversarial networks, a deep learning-based generative model.
NetworkHoneypot
Paper2024
Material reviewed: Public pageThe review examines AI integration with SOAR, including dynamic orchestration of honeypots that present an apparent vulnerability and collect intelligence on attacker methods.
NetworkOT/ICSHoneypot
Paper2024
Material reviewed: AbstractThe authors present LLM Honeypot, a system that augments a standard SSH honeypot with prompt injection and time-based analysis techniques to distinguish autonomous AI agents among attackers. Over a roughly three-month trial deployment in a public environment, they recorded millions of hacking attempts and identified a small number of potential AI agents. The work aims to serve as an early warning of malicious LLM agent usage in the wild.
NetworkHoneypot
Paper2024
Material reviewed: Full textCritical readingPresents an interactive honeypot using a language model fine-tuned with attacker command data.
NetworkHoneypot
Paper2024
Material reviewed: Full textOf 184 responses judged plausible by experts, participants also classified 167 as plausible (90.8%). This measures responses in this test, not deception of real attackers.
NetworkHoneypot
Paper2024
Material reviewed: AbstractThe authors propose LLMPot, an approach for designing honeypots in Industrial Control System (ICS) networks using large language models (LLMs). The goal is to automate the creation of realistic, vendor-agnostic honeypots capable of emulating industrial protocols and PLC control logic, reducing the manual effort traditionally required in this domain.
OT/ICSNetworkHoneypotDecoy
Open software2024
Material reviewed: Repository metadataA honeypot for the Log4Shell vulnerability (CVE-2021-44228).
NetworkHoneypot
Open software2024
Material reviewed: Repository metadataSimple TCP/UDP honeypot implemented in Perl
NetworkHoneypot
Open software2024
Material reviewed: Repository metadataHL7 / FHIR honeypot
NetworkHoneypot
Open software2024
Material reviewed: Repository metadataRepository about modular web honeypot framework; documentation and maintenance require further review.
ApplicationHoneypot