What we know
The authors present Mirage Mesh, a lightweight cyber deception framework for Linux environments that applies deception-in-depth across four layers: an SSH decoy built on Cowrie, a system-layer decoy administrative account, a fake Flask web administration interface, and a data-layer honeytoken credential file. The work proposes a shared DecoyAlertEvent schema to normalize observations from these layers, process them through a Wazuh-based detection and active-response pipeline with Python orchestration, map them to cyber kill-chain stages and MITRE ATT&CK techniques, and evaluate them with a Deception Effectiveness Metric (DEM).
Evidence limits
This entry is based only on the title and abstract deposited with Crossref; the full text was not reviewed and results were not independently validated. The abstract itself states that the current prototype implements all four deception layers and passes 96 automated tests, with two layers confirmed operating live end-to-end and remaining live verification in progress.
Reviewed: author abstract. Full-text results were not analyzed.
Sources and provenance
- Mirage Mesh: A Multi-Layer Cyber Deception Framework for Linux Environments
abstract · 2026-10-11
Reviewed: 2026-10-16. This record may change when new evidence is found.