Paper2024
Material reviewed: AbstractAccording to the authors, this paper initiates a systematic study of a new honeypot deployment paradigm that blends honeypot computers into production computers. They formalize the Honeypot Deployment (HD) problem as a combinatorial optimization problem, prove its NP-hardness, propose a near-optimal algorithm (a polynomial-time approximation scheme), and conduct simulations to assess the impact of attacker capabilities.
NetworkHoneypot
Paper2024
Material reviewed: AbstractThis work aims to develop a drone-based surveillance mission system when Denial-of-Service (DoS) attacks disrupt normal operations. The authors introduce cyber deception via honey drones (HDs) that exhibit fake vulnerabilities and use stronger signal strengths to lure DoS attacks, formulate an optimization problem over HD and mission drone signal strengths, and solve it using deep reinforcement learning (DRL) with the Asynchronous Advantage Actor-Critic (A3C) algorithm, evaluated in a physical engine-based simulation testbed.
HoneypotDecoy
Paper2024
Material reviewed: AbstractPilot study exploring a deception-based honeypot using deep learning, integrated via an injection approach on web servers, aiming to minimize security breaches and detect intrusive malware activity. The authors report identification capabilities as the system learns and defends a user system against intrusive actions.
ApplicationHoneypot
Paper2024
Material reviewed: AbstractThe study describes a two-tier deception-driven security model intended to mislead potential attackers and protect network resources using decoys, honeypots, and deceptive network segments. The authors report on deploying and testing the model to assess its efficacy and feasibility in practice, and argue that integrating deception techniques into cybersecurity frameworks can provide a protective layer.
NetworkHoneypotDecoy
Paper2024
Material reviewed: AbstractAccording to the authors, this work proposes a reconfigurable and scalable honeynet for cyber-physical systems, focused on industrial control systems (ICS). The approach includes automatic generation of attacks to test and validate the honeynet, aiming to serve as a basis for producing datasets to train attack detection and classification algorithms.
OT/ICSHoneypot
Paper2024
Material reviewed: AbstractThe work addresses security in Internet of Things (IoT) ecosystems in smart cities by using honeypot data and machine learning and neural network algorithms for attack detection. The authors set out to identify datasets from IoT-targeted honeypots, evaluate threat detection algorithms, and propose security solutions, analyzing real-world cyber-attack data from diverse honeypots simulating IoT devices.
IoTHoneypot
Paper2024
Material reviewed: AbstractThe paper examines the origin of trust in trust management systems by linking it to the network attack rate, aiming to refine trust assessments and predict new attacks. The authors describe a strategy combining machine learning and dynamic honeypots to detect prepared-for attacks and predict unprepared-for attacks in vehicular ad hoc networks (VANETs).
NetworkHoneypot
Paper2024
Material reviewed: AbstractAccording to the authors, this paper presents a self-adaptive traffic anomaly detection system for IoT smart home environments, consisting of a honeypot server and a gateway. The honeypot continuously captures traffic and adaptively generates a detection model used by the gateway to identify anomalous traffic, including unknown attacks.
IoTNetworkHoneypot
Open software2024
Material reviewed: Repository metadataAn easy to set up and use SSH honeypot, a fake SSH server that lets anyone in and logs their activity
NetworkHoneypot
Paper2024
Material reviewed: AbstractThe authors formulate a two-player dynamic game to model honeypot allocation in tactical networks whose connectivity changes with node mobility. They propose an iterative algorithm to find Nash equilibria and assess scalability through compact states and sensitivity analysis under imperfect information.
NetworkHoneypot
Paper2024
Material reviewed: AbstractThe authors present a side-channel method for covertly identifying industrial control system (ICS) honeypots using time-to-live (TTL) values in the ICMP protocol. In a study of over 8,000 devices presenting as ICS systems, they compare their approach to existing honeypot detection methods and describe what their methodology reveals about the current population of live ICS honeypots.
OT/ICSNetworkHoneypot
Paper2024
Material reviewed: AbstractThis work-in-progress paper studies the implementation of deception-in-depth strategies with three initial logical layers: network, host, and data. The authors draw on ideas from military deception, network orchestration, software deception, file deception, fake honeypots, and moving-target defenses, and are building a prototype to test in adversarial environments. According to the authors, the goal is to show that deploying a broad range of deception techniques can better protect systems than single techniques, with a focus on discouraging attacks rather than encouraging attacker engagement.
NetworkEndpointHoneypotDecoy
Paper2023
Material reviewed: AbstractThis paper proposes an adaptive experimental design (AD) method, inspired by randomized clinical trials, to study causal relationships between the design of intrusion data collection environments (such as honeypots) and the data observed. The authors state they conducted the first controlled and adaptive honeypot deployment study to measure how an SSH vulnerability affects server exploitation rates, reporting reductions in deployment time and resources needed.
NetworkHoneypot
Paper2023
Material reviewed: AbstractThis work examines adversarial reconnaissance mitigation techniques, including deception strategies such as honeypots, and reviews the literature on deception games from the perspective of modeling adversarial reconnaissance. The authors highlight aspects of reconnaissance they state have not been adequately captured in prior work, and present a probability-theory based model of adversaries' belief formation, illustrated with numerical examples.
NetworkHoneypotAdversary engagement
Paper2023
Material reviewed: AbstractThe authors propose a honeypot for IoT devices that uses machine learning techniques to automatically learn and interact with attackers, aiming to overcome the limitations of manually crafting low- and high-interaction honeypots given device heterogeneity. According to the abstract, evaluation of the proposed model indicates improvements in session length with attackers and in capturing more attacks on the IoT network.
IoTHoneypot
Paper2023
Material reviewed: AbstractThis study examines how different probing costs affect adversarial decision-making in a deception game, using an IBLT model with delayed feedback to simulate human behavior. According to the authors, probing slightly decreased as its cost increased, while the proportion of attacks remained relatively stable. The authors conclude that different probing costs do not significantly affect the proportion of attacks but have a slight impact on the proportion of probing.
NetworkHoneypotAdversary engagement
Paper2023
Material reviewed: AbstractThis paper examines attack patterns in a large public dataset of geographically distributed honeypots, addressing methodological questions and building attacker behavioural profiles. According to the authors, results show honeypot location helps identify attack patterns and profiles, concluding that not all collected intelligence is equally valuable and that an effective early warning system may be built with only two distributed honeypots and a production server.
NetworkHoneypot
Paper2023
Material reviewed: AbstractThe paper proposes a honeypot-based deception approach for Internet-connected video cameras. Its abstract places the proposal in the security and privacy risks of cameras and other video-capable IoT devices.
IoTHoneypot
Paper2023
Material reviewed: AbstractAccording to its authors, this paper studies a Stackelberg game between attacker and defender over large, dynamic Active Directory (AD) attack graphs, where the defender deploys honeypots to prevent the attacker from reaching high-value targets. The authors propose a mixed-integer programming (MIP) formulation and a clustering-based approach (dyMIP(m)) to handle large dynamic graph instances, reporting near-optimal results under realistic conditions.
IdentityNetworkHoneypot
Paper2023
Material reviewed: AbstractThis paper explores using ChatGPT-style conversational agents as a dynamic honeypot interface, imitating Linux, Mac, and Windows terminal commands and tools like TeamViewer, nmap, and ping. The authors present ten feasibility tasks intended for defensive teams to simulate honeypot interfaces with minimal risk, aiming to delay or understand attacker tactics, techniques, and procedures.
NetworkEndpointHoneypot
Paper2023
Material reviewed: AbstractThe work describes the deployment of an ensemble of research honeypot detectors to analyze and evaluate attackers' behavior. The authors present an outline of a containerized cloud honeypot deployment that they state is portable, durable, and simple to deploy and administer, and they describe instrumented monitoring that generated data points from which inferences about malicious users' activities and purpose could be drawn.
CloudNetworkHoneypotDecoy
Paper2023
Material reviewed: AbstractThe study addresses social engineering attacks, which the authors say exploit human psychology and user awareness, and proposes an automated prevention mechanism that combines honeypots with artificial intelligence and an intrusion prevention system. The stated aim is to detect such attacks, threaten the attacker and restrict his session to keep users away from these manipulation tactics.
NetworkHoneypot
Paper2023
Material reviewed: AbstractThe paper describes implementing a honeypot on Azure Services as a supplement to customary cloud security measures, listing advantages such as prompt attack detection, recognition of attack methods, and safeguarding critical data. The authors outline steps including selecting a virtual machine, installing and configuring honeypot software, deploying monitoring and logging, establishing security groups, running a penetration test, and consistently monitoring the honeypot.
CloudHoneypot
Open software2023
Material reviewed: Repository metadataEthereum honey pot
NetworkHoneypot