Paper2025
Material reviewed: AbstractThis study proposes SPADE, a framework that uses generative AI models alongside structured prompt engineering to automate the creation of adaptive cyber deception strategies against dynamic malware. According to the authors, the framework addresses challenges of large language models such as generalized outputs, ambiguity, and scalability constraints, and was evaluated across diverse malware scenarios using metrics like Recall, Exact Match, BLEU, and expert quality assessments, identifying ChatGPT-4o as the top performer.
EndpointNetworkAdversary engagementDecoy
Paper2025
Material reviewed: AbstractThis study, as described by the authors, explores the use of AI agents to automate the analysis of logs generated by the Cowrie honeypot, addressing the scarcity of real-world attack data in cybersecurity research. The proposed approach uses AI agents to parse, summarize, and extract insights from unstructured data, while also considering the security implications of deploying such an autonomous system.
NetworkHoneypot
Paper2025
Material reviewed: AbstractAccording to the authors, this study proposes a Stackelberg game-based framework for strategically timing cyber deception, combining a tactical layer modeling attacker-defender dynamics via a one-sided information Markov game with a strategic layer optimizing deception timing and selection through a stopping-time decision process. Numerical experiments, as reported by the authors, suggest that strategically timed deception can improve the defender's expected utility compared to baseline strategies.
NetworkAdversary engagementDecoy
Paper2024
Material reviewed: AbstractThe authors present a generative model-based honeypot (using an LSTM network) designed to mimic industrial OPC UA communication in operational technology (OT) systems. The model learns the characteristics of a cyclic mechatronic system from recorded state space trajectories. The work proposes a proof-of-concept and publishes a dataset of a cyclic industrial process to support future research.
OT/ICSHoneypot
Paper2024
Material reviewed: Publisher metadataDOI-identified publication on language-model honeytoken generation; text analysis is pending.
IdentityHoneytoken
Paper2024
Material reviewed: AbstractThe authors address the difficulty that traditional honeypot implementations are evaded by advanced adversaries such as APT groups, and propose designing and deploying a customized honeypot network based on adaptive camouflaging techniques. The work describes orchestrating a behavioral honeypot network tailored to three APT groups, with attack paths aligned with their tactics, techniques, and procedures, and includes a camouflaged chatterbox application deployed for 100 days; according to the deposited abstract, the setup recorded 13,906,945 hits from 4,238 unique IP addresses and was used to categorize attackers.
NetworkApplicationHoneypotDecoy
Paper2024
Material reviewed: Public pageThe paper proposes a honeypot layer to support security in an optical network with cloud services. The decoys simulate vulnerable resources to attract attackers and observe their behavior.
NetworkHoneypotDecoy
Paper2024
Material reviewed: Public pageProposes using hardware honeypots as an additional defensive layer to detect and mitigate hardware Trojans in IoT devices, aiming to protect them from operational failures, denial of service, or data leakage.
IoTHoneypot
Paper2024
Material reviewed: Full textBibliographic record on application-layer deception. The abstract and findings still require review.
ApplicationDecoy
Open software2024
Material reviewed: Repository metadataMulti-head SSH honeypot system.
NetworkHoneypot
Paper2024
Material reviewed: AbstractAccording to the authors, this paper introduces IndisUAT, a new method for generating universal adversarial triggers (UAT) against NLP models that bypasses DARCY, a honeypot-based defense that baits multiple trapdoors to detect adversarial examples. The authors state that IndisUAT produces adversarial examples whose feature distribution is indistinguishable from benign examples, reducing DARCY's detection effectiveness and that of other defenses across several models.
ApplicationHoneypot
Paper2024
Material reviewed: AbstractThe authors analyze robocall data from multiple independent vantage points, including academic and industry voice honeypots, to study the effectiveness of telephone spam prevention and mitigation efforts. The work compares disparate data sources over more than 5 years, including audio and transcripts from millions of calls, to assess trends and spammer adaptation to authentication schemes like STIR/SHAKEN.
NetworkHoneypot
Open software2024
Material reviewed: Repository metadataRepository about cloud-application decoys; documentation and maintenance require further review.
CloudDecoy
Paper2024
Material reviewed: AbstractThis paper addresses automated content generation for honeyfiles, decoy documents designed to detect intruders. The authors focus on generating realistic charts within such documents, combining a multitask Transformer for captions and plot text with a specialized autoencoder for underlying tabular data. They also introduce a new dataset and a metric (Keyword Semantic Matching) to evaluate semantic consistency of generated content.
EndpointHoneypotDecoy
Dataset or lab2024
Material reviewed: Public pageCritical readingZeek traffic record from geographically distributed low-interaction sensors; the page says no conventional honeypot software was used.
NetworkHoneypot
Paper2024
Material reviewed: AbstractAccording to the authors, this paper proposes a cyber deception mechanism that stealthily redirects TCP communications to an on-demand honeypot server cloned to resemble the victim asset. The stated goal is to make attackers focus on the decoy server, enabling threat intelligence collection while protecting the real asset.
NetworkHoneypotDecoy
Paper2024
Material reviewed: Full textCritical readingSurvey proposing a taxonomy and comparing cyber deception research lines, including AI-based work.
NetworkCloudAdversary engagement
Paper2024
Material reviewed: Public pageThe article connects strategic principles from Chanakya's Arthashastra with digital defense and presents honeypots as a means of attracting attackers into controlled environments to observe their tactics.
Honeypot
Paper2024
Material reviewed: Public pageIt proposes simulating, transforming and integrating synthetic honeypot logs into a graph database using the STIX model, aiming to convert attack data into interconnected threat intelligence objects for visualization and exploration. The purpose is to provide security operations centers with a standardized platform that enhances situational awareness and decision-making support.
NetworkHoneypot
Open software2024
Material reviewed: Repository metadataEditor contributionOpen framework for planning deception operations and deploying decoys and services with Python and Docker, according to its repository and documentation.
NetworkApplicationDecoyHoneypot
Paper2024
Material reviewed: AbstractThe authors address a scenario where a defender of a networked control system has isolated an intruder and redirects them toward a honeypot emulating the real system without connection to a physical plant. They propose an adversary engagement strategy within this decoy environment to increase the attacker's information-processing costs by spoofing sensor readings based on cyber threat intelligence. They perform a numerical comparison between cases of perfect and imperfect threat intelligence.
OT/ICSNetworkHoneypotAdversary engagement
Paper2024
Material reviewed: AbstractAccording to the authors, this paper reviews the use of large language models (LLMs) in malware detection, including applications to malware honeypots, text-based threat identification, code analysis, and trend detection. The authors propose a classification scheme, performance metrics, and an LLM-based risk mitigation framework, evaluating its performance against LLM-enabled malware.
EndpointHoneypot
Paper2024
Material reviewed: AbstractThis work, according to its authors, addresses security in Advanced Metering Infrastructure (AMI) for smart grids using honeypots combined with federated learning. They propose FedPot, which includes a data quality measure and a fair incentive mechanism allowing small power suppliers to share locally trained models with traditional retailers without exposing confidential data. The authors report, via simulations on realistic microgrid log datasets, improvements over state-of-the-art techniques in both the security model and reward distribution.
OT/ICSIoTHoneypot
Open software2024
Material reviewed: Repository metadataCredentials catching honeypot
NetworkHoneypot