CyberdeceptionAtlas · Question → testES

Library / Paper

Paper

A Practical Honeypot-Based Threat Intelligence Framework for Cyber Defence in the Cloud

This paper introduces an automated cloud defense framework that leverages medium- to high-interaction honeypot telemetry to dynamically update firewall rules in real time. According to the authors, the system integrates the Cowrie honeypot, Azure-native automation tools, and MITRE ATT&CK-aligned classification within a closed-loop feedback mechanism. The authors report an average Mean Time to Block of 0.86 seconds and classification of over 12,000 SSH attempts in experimental testing.

HoneypotAdversary engagementCloudNetwork

What we know

This paper introduces an automated cloud defense framework that leverages medium- to high-interaction honeypot telemetry to dynamically update firewall rules in real time. According to the authors, the system integrates the Cowrie honeypot, Azure-native automation tools, and MITRE ATT&CK-aligned classification within a closed-loop feedback mechanism. The authors report an average Mean Time to Block of 0.86 seconds and classification of over 12,000 SSH attempts in experimental testing.

Evidence limits

This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the reported effectiveness has not been independently validated.

Reviewed: author abstract. Full-text results were not analyzed.

Sources and provenance

  1. A Practical Honeypot-Based Threat Intelligence Framework for Cyber Defence in the Cloud
    abstract · 2026-10-04

Reviewed: 2026-10-04. This record may change when new evidence is found.

RIS · BibTeX