Defensive technique
Planned operations to observe adversary decisions and learn from them while maintaining defensive control.
Research question
Definitions and technical considerations should be checked against the primary source. Atlas records are a selection tagged with this topic; a matching tag does not demonstrate operational outcomes.
Cross-reference
These counts describe tagged Atlas records, not the worldwide number of studies or offerings.
Linked library
The authors propose TAB-DEN, a framework for IoT healthcare systems that combines a permissioned blockchain with Proof of Authority consensus for decentralized authentication, a hierarchical edge architecture of primary and secondary edge servers that compute trust scores in real time and redirect traffic according to trustworthiness, and deception-based edge nodes acting as honeypot-like environments to attract, isolate and profile attackers. The stated aim is to provide scalable and quantum-resistant security, recording intrusion events through a lattice-based post-quantum signature scheme so that attack records are immutable and verifiable on the distributed ledger.
The authors present a multi-attacker Bayesian Stackelberg framework for allocating honeypots in a directed network, modeling each attacker as a follower with a latent type and the defender as replanning via a DOBSS-style mixed-integer linear program under posterior beliefs. They aim to scale defense to realistic graphs using layered structures and pruning.
The authors present AdvancedShelLM, an LLM-based SSH honeypot using a multi-agent architecture (Manager and Worker) intended to improve command understanding and deceptive capability over its predecessor shelLM. According to the abstract, the system was evaluated through unit tests, an AI attacker, human attackers, and an Internet deployment.
The work proposes AEGIS-AI, a framework combining honeypots with reinforcement learning and deep neural networks to automate deception and detection of malicious activity. The authors describe real-time adaptive deception strategies via Markov Decision Processes and federated learning, and present formulas for evaluating deception effectiveness.
The authors propose a dynamic honeypot framework combining a reinforcement-learning deception agent (tabular Q-learning, formalized as an MDP), threat-intelligence fusion via indicators of compromise, and automated containment actions. Its purpose is to adapt the honeypot's exposed persona and guide deception decisions, evaluated in an isolated virtualized testbed.
This study examines how anchoring effects influence attackers' decisions in specific cyberattack scenarios through two experiments. Experiment 1 compares anchoring measurement methods in Crontab and Hostname tasks; Experiment 2 embeds bias triggers within an end-to-end cyber kill chain scenario.