Paper2024
Material reviewed: AbstractAccording to the authors, this paper explores the use of Generative Adversarial Networks (GANs) to generate decoy configurations for cyber defense. They note that existing approaches rely on maintained lists of configurations or pre-configured images with limited adaptability, and present what they describe as the first attempt to use GANs specifically for generating decoy configurations, aiming to provide defenders with a tool to strengthen network defenses.
NetworkHoneypotDecoy
Paper2024
Material reviewed: Full textCritical readingPresents a language-model terminal honeypot architecture and describes a field evaluation.
NetworkHoneypot
Open software2024
Material reviewed: Repository metadataHoneyHTTPD is a Python-based web server honeypot/service imitation builder. Great for honeypots or faking HTTP services.
ApplicationHoneypot
Open software2024
Material reviewed: Repository metadataFTP Honeypot
NetworkHoneypot
Paper2024
Material reviewed: AbstractReview of the honeypot as a decoy system simulating an isolated real system on a network to entice attackers and detect, block or foresee attempts at unauthorized access. The authors describe a monitoring arrangement linking honeypot, main network and system-admin so hostile activity is detected before the main network is affected.
NetworkHoneypot
Open software2024
Material reviewed: Repository metadataScript for turning a Raspberry Pi into a Honey Pot Pi
NetworkHoneypot
Paper2024
Material reviewed: AbstractThe paper assesses a specific group of honeypot systems based on criteria such as detection range, emulation accuracy, data quality, dependability, scalability, and ease of setup, and draws conclusions about their relative effectiveness in different situations. It also discusses recent developments in honeypot technology, including machine learning enhancements, increased automation, integration with other security tools, cloud-based honeypots, and deception technology, using simulated attacks to demonstrate how these systems log and record attack information.
NetworkCloudHoneypotDecoy
Paper2024
Material reviewed: AbstractThe work addresses automating honeypot deployment using Ansible and a web application that also monitors the process. The authors describe their purpose of reducing the time and resources of manual deployment and report tests on sensors running on Google Cloud Platform.
CloudHoneypot
Paper2024
Material reviewed: AbstractThe authors investigate whether peer-to-peer (P2P) overlay network nodes, specifically Ethereum network nodes, attract heightened reconnaissance attacks due to their visibility and sustained uptime. They deploy a series of honeypots alongside real Ethereum nodes across globally distributed vantage points. The authors report findings on specific attack types targeting particular ports and services, extending the analysis through port scans on other reachable peers.
NetworkHoneypot
Paper2024
Material reviewed: AbstractThe study proposes a malware detection system that combines Particle Swarm Optimization (PSO) with a fuzzyKNN model, using PSO to select a feature set from a malware dataset and employing a honeypot as a controlled environment for collecting samples and training the model. The authors compare their method against standard detection techniques and report that the PSO-fuzzyKNN approach enhances malware detection accuracy.
EndpointHoneypot
Paper2024
Material reviewed: AbstractThe authors propose a network design for honeypot placement and an intrusion detection system aimed at identifying and alerting on illicit access, using traffic logs. They use datasets derived from a honeypot implementation and KDD-99, trained with generative adversarial networks, a deep learning-based generative model.
NetworkHoneypot
Paper2024
Material reviewed: Public pageThe review examines AI integration with SOAR, including dynamic orchestration of honeypots that present an apparent vulnerability and collect intelligence on attacker methods.
NetworkOT/ICSHoneypot
Paper2024
Material reviewed: AbstractThis paper proposes a reinforcement learning (RL) approach to simulate ransomware attacks within an environment mirroring real-world networks, aiming to streamline traditional red teaming exercises. According to the authors, experimental results on a 152-host example network show the RL agent's capability to discover and orchestrate attacks on high-value targets while evading honeyfiles (decoy files placed to detect unauthorized access).
NetworkEndpointDecoyAdversary engagement
Paper2024
Material reviewed: AbstractThe authors present LLM Honeypot, a system that augments a standard SSH honeypot with prompt injection and time-based analysis techniques to distinguish autonomous AI agents among attackers. Over a roughly three-month trial deployment in a public environment, they recorded millions of hacking attempts and identified a small number of potential AI agents. The work aims to serve as an early warning of malicious LLM agent usage in the wild.
NetworkHoneypot
Paper2024
Material reviewed: Full textCritical readingPresents an interactive honeypot using a language model fine-tuned with attacker command data.
NetworkHoneypot
Paper2024
Material reviewed: Full textOf 184 responses judged plausible by experts, participants also classified 167 as plausible (90.8%). This measures responses in this test, not deception of real attackers.
NetworkHoneypot
Paper2024
Material reviewed: AbstractThe authors propose LLMPot, an approach for designing honeypots in Industrial Control System (ICS) networks using large language models (LLMs). The goal is to automate the creation of realistic, vendor-agnostic honeypots capable of emulating industrial protocols and PLC control logic, reducing the manual effort traditionally required in this domain.
OT/ICSNetworkHoneypotDecoy
Open software2024
Material reviewed: Repository metadataA honeypot for the Log4Shell vulnerability (CVE-2021-44228).
NetworkHoneypot
Open software2024
Material reviewed: Repository metadataSimple TCP/UDP honeypot implemented in Perl
NetworkHoneypot
Open software2024
Material reviewed: Repository metadataHL7 / FHIR honeypot
NetworkHoneypot
Paper2024
Material reviewed: AbstractThe work presents and evaluates Mirage, an experimentation system in both emulation and simulation forms that allows for the implementation and testing of cyber deceptions designed to counter adversaries using AI search and planning capabilities. The authors frame cyber deception as a possible defensive mechanism against future AI-enabled adversaries.
NetworkDecoyAdversary engagement
Open software2024
Material reviewed: Repository metadataRepository about modular web honeypot framework; documentation and maintenance require further review.
ApplicationHoneypot
Paper2024
Material reviewed: AbstractAccording to the authors, this paper initiates a systematic study of a new honeypot deployment paradigm that blends honeypot computers into production computers. They formalize the Honeypot Deployment (HD) problem as a combinatorial optimization problem, prove its NP-hardness, propose a near-optimal algorithm (a polynomial-time approximation scheme), and conduct simulations to assess the impact of attacker capabilities.
NetworkHoneypot
Paper2024
Material reviewed: AbstractThis work aims to develop a drone-based surveillance mission system when Denial-of-Service (DoS) attacks disrupt normal operations. The authors introduce cyber deception via honey drones (HDs) that exhibit fake vulnerabilities and use stronger signal strengths to lure DoS attacks, formulate an optimization problem over HD and mission drone signal strengths, and solve it using deep reinforcement learning (DRL) with the Asynchronous Advantage Actor-Critic (A3C) algorithm, evaluated in a physical engine-based simulation testbed.
HoneypotDecoy