Paper2026
Material reviewed: AbstractThe paper proposes a framework combining game theory with transformer-based components to quantify, model, and optimize cyber deception. The authors define deception attack-surface metrics and embed them in a signaling game, aiming to guide adaptive deception strategies.
NetworkDecoyMoving target defense
Paper2026
Material reviewed: AbstractThe authors propose an antifragile framework that uses cyber deception with adaptive decoys and dynamic network movements to generate adversarial signals, infer threat actor profiles and support proactive decisions. A cyber threat intelligence ontology and a knowledge graph with semantic attributes represent tactical and strategic relationships between attackers and targets.
NetworkDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThis paper, according to its authors, reviews AI-based solutions for building network- and device-level cyber deception methods in contested environments. It focuses on combining large language models (LLMs) and reinforcement learning (RL) to optimize deception strategies such as honeypots and honeynets, and examines their validation against stealthy attacks on operational technology (OT) systems reported in the literature.
NetworkOT/ICSHoneypotDecoy
Paper2026
Material reviewed: Public pageThe authors propose SecuPi, a compact Raspberry Pi-based system that combines real-time traffic monitoring, hybrid intrusion detection (signature-based and machine learning) and automated threat response. As deception and proactive defense mechanisms, they propose the use of honeypots together with automatic firewall updates and Moving Target Defense (MTD).
NetworkIoTHoneypotMoving target defense
Paper2026
Material reviewed: AbstractThe authors propose a proactive cyber-defense system that combines cyber deception, adversarial environment simulation and deep reinforcement learning, with GAN-generated attack vectors emulating zero-day and polymorphic threats. The aim is to train context-aware defense policies that detect malicious behavior, re-route detection vectors and trigger deceptive traps, evaluated with benign and adversarial traffic on a synthetic smart-grid network.
NetworkOT/ICSDecoyAdversary engagement
Paper2026
Material reviewed: AbstractThis paper presents ShellGames, an SSH shell simulator based on large language models (LLMs) designed to sustain credible interactive deception sessions with adversaries. According to the authors, the system combines techniques such as chain-of-thought reasoning, memory management, speculative command execution, sandbox routing, and subversion detection to address common LLM limitations. The authors report improvements in accuracy, consistency, and state tracking over baselines, along with a user study indicating perceived realism comparable to a real shell.
NetworkEndpointHoneypotMoving target defense
Paper2025
Material reviewed: AbstractThe authors present D3O-IIoT, a reinforcement learning model that dynamically coordinates deception techniques such as honeypot deployment, moving target defense, fake telemetry injection, and node isolation, driven by real-time threat monitoring. The defense problem is formulated as a Markov Decision Process, in which a Dueling Deep Q-Network agent maximizes a multi-objective reward to balance attack mitigation, deception engagement, false positive control, and resource cost.
IoTOT/ICSHoneypotMoving target defense
Paper2025
Material reviewed: AbstractThe authors present the Hybrid Cyber Deception System (HCDS), described as a Python-developed proactive tool that combines honeypots and honeytokens in a dynamically adaptive mode to simulate realistic services and redirect attackers in controlled, instrumented settings. The system integrates a deception-driven alerts correlation engine built on Python, Pandas and Scikit-learn, along with Moving Target Defense principles for continuous modulation of network parameters and decoy distribution, and was tested in a simulated environment with Windows and Ubuntu servers to profile attackers and detect complex attack vectors.
NetworkEndpointHoneypotHoneytoken
Paper2024
Material reviewed: AbstractAccording to the authors, this chapter examines the combined use of game-theoretic models and foundation models (FMs) to analyze, design, and implement cyber deception tactics across tactical, operational, and strategic warfare levels. It proposes MANSCOL (multi-agent neurosymbolic conjectural learning) to let defenders predict adversarial behaviors and design adaptive deceptive defenses, and discusses challenges of applying FMs in cybersecurity.
NetworkAdversary engagementDecoy
Paper2024
Material reviewed: AbstractThis work-in-progress paper studies the implementation of deception-in-depth strategies with three initial logical layers: network, host, and data. The authors draw on ideas from military deception, network orchestration, software deception, file deception, fake honeypots, and moving-target defenses, and are building a prototype to test in adversarial environments. According to the authors, the goal is to show that deploying a broad range of deception techniques can better protect systems than single techniques, with a focus on discouraging attacks rather than encouraging attacker engagement.
NetworkEndpointHoneypotDecoy
Paper2023
Material reviewed: AbstractThe authors propose a framework combining moving target defense (MTD), deception, and attribute-based access control (ABAC) to make unauthorized insider access more difficult and costly. They introduce correlated attributes into ABAC and generate mutated policies from them. According to the authors, evaluation results show the framework effectively identifies correlated attributes and produces adequate mutated policies without affecting system usability.
IdentityApplicationMoving target defenseAdversary engagement
Paper2023
Material reviewed: Full textCritical readingProposes a simulation method for evaluating honeypots and moving target defense in networks.
NetworkHoneypotMoving target defense
Paper2023
Material reviewed: AbstractThe authors present a method for selecting cyber deception strategies using a multi-stage Flipit game, aiming to account for defense timing alongside spatial strategy selection. The approach constructs a spatiotemporal decision-making model, introduces a discount factor and transition probabilities, and applies a Proximal Policy Optimization algorithm to compute defender strategies.
NetworkDecoyMoving target defense
Paper2023
Material reviewed: AbstractThe authors propose a game-theoretic approach for optimal honeypot allocation in tactical networks with dynamic connectivity. They model a two-player dynamic game accounting for future network state evolution, aiming to maximize the attacker's likelihood of hitting a honeypot while minimizing reconfiguration costs. They present an iterative algorithm to find Nash equilibrium strategies and evaluate its scalability through simulations.
NetworkHoneypotDecoy
Paper2022
Material reviewed: AbstractThe authors propose a cyber deception defense method based on a signal game, aimed at dealing with network intrusions. The work describes a moving target defense (MTD) enhanced deception mechanism and a signal game model with an equilibrium solution method to guide defense strategy selection, evaluated by the authors through experimental results.
NetworkMoving target defenseDecoy
Paper2022
Material reviewed: AbstractThis work proposes EVHS, an elastic virtual honeypot system for SDNFV-based networks, aimed at flexibly managing and controlling honeypots. The system uses a network intrusion detection system at the network border to detect attacks, leverages SDN and NFV to generate honeypots, and employs a moving-target defense mechanism to connect attackers to these honeypots, while also reusing available honeypots after attacks are handled.
NetworkHoneypotMoving target defense
Paper2022
Material reviewed: AbstractThis survey reviews and categorizes honey-X-based defense strategies, such as honeypots and honeytokens, which use deception to gather threat intelligence and protect networks. The authors also examine their combination with moving target defense, game theory and machine learning, and outline security quantification, challenges and future directions.
NetworkHoneypotHoneytoken
Paper2022
Material reviewed: AbstractThis paper studies the joint deployment of moving target defense (MTD) and deception against multi-stage cyberattacks. The authors propose a two-step optimization approach to allocate intrusion detectors (observable by the attacker) and stealthy sensors (unobservable), aiming to optimize attack detection rate. They illustrate the method's effectiveness through a cyber defense example.
NetworkDecoyMoving target defense
Paper2021
Material reviewed: AbstractThe authors propose a multiphase dynamic deployment mechanism for virtualized honeypots (MD2VH) based on intelligent attack path prediction, modeling attack and defense characteristics with a Bayesian state attack graph and a multiphase deployment optimization model based on an extended Markov decision process, and generating deployment strategies by combining online and offline reinforcement learning. They implement a prototype system on software-defined networking and virtualization containers and report experiments on capture rate under simple and complex topologies.
NetworkHoneypotMoving target defense
Paper2021
Material reviewed: AbstractThe work addresses the protection of vulnerable components in Internet-of-Things (IoT) networks through an intrusion prevention technique that combines cyberdeception (a decoy system) and moving target defense (network topology shuffling). The authors analytically evaluate effectiveness and efficiency using a graphical security model in an SDN-based IoT network, defining strategies for when and how to perform topology shuffling to pursue goals such as prolonging system lifetime, increasing attack complexity on critical nodes, or maintaining service availability.
IoTNetworkDecoyMoving target defense
Paper2021
Material reviewed: AbstractThis work reviews the literature on using reinforcement learning (RL) as a feedback architecture for cyber-resilient mechanisms. The authors discuss resilience against posture-related, information-related, and human-related vulnerabilities, introducing three application domains: moving target defense, defensive cyber deception, and assistive human security technologies. They also examine vulnerabilities of RL itself to attacks on rewards, state observations, and action commands.
NetworkMoving target defenseAdversary engagement
Paper2021
Material reviewed: Full textHistorical review of honeypots, honeytokens and moving target defense from the late 1980s through 2021.
NetworkEndpointHoneypotHoneytoken
Paper2020
Material reviewed: AbstractThe authors present a differentially private game theoretic approach to cyber deception, aiming to overcome limitations of prior approaches that assume a fixed number of systems and simplified attackers. The defender uses differential privacy mechanisms to strategically change the number of systems and obfuscate configurations, while the attacker uses Bayesian inference. According to the authors, experimental results demonstrate the effectiveness of the proposed approach.
NetworkDecoyMoving target defense
Paper2020
Material reviewed: AbstractThe authors propose a formal-methods approach to synthesize reactive defense strategies in networks equipped with decoy systems. They generalize attack graphs to incorporate defender countermeasures in an attack-defend game model, and introduce a class of hypergames to model asymmetric information created by decoys. According to the authors, this framework enables synthesis of effective defense strategies exploiting the attacker's misperception.
NetworkDecoyMoving target defense