Deployment environment
Decoy objects, permissions and workloads distributed across cloud services and hybrid integrations.
Research question
Definitions and technical considerations should be checked against the primary source. Atlas records are a selection tagged with this topic; a matching tag does not demonstrate operational outcomes.
Cross-reference
These counts describe tagged Atlas records, not the worldwide number of studies or offerings.
Linked library
The authors propose a dynamic honeypot framework combining a reinforcement-learning deception agent (tabular Q-learning, formalized as an MDP), threat-intelligence fusion via indicators of compromise, and automated containment actions. Its purpose is to adapt the honeypot's exposed persona and guide deception decisions, evaluated in an isolated virtualized testbed.
The study compares, under homogeneous conditions, the technical performance, resource consumption and operational costs of traditional honeypots versus honeypots that incorporate machine learning to improve realism and hinder fingerprinting. The authors deployed six open-source honeypots simultaneously (three traditional and three ML-enhanced) for 60 days on Hetzner Cloud infrastructure, reporting differences in useful interaction, fingerprinting and return on investment.
Presents the design, implementation, and evaluation of a honeypot monitoring system deployed on AWS that emulates SSH, HTTP, and HTTPS services on EC2 instances within an isolated virtual private cloud. The system aims to attract, record, and analyze malicious interactions, using a Python/Flask backend and a React/D3.js dashboard for attack visualization.
The paper describes the design of a honeypot framework deployed in a cloud environment to support threat detection and incident response. According to the authors, it integrates Microsoft Azure services to monitor and analyze malicious behavior, using telemetry, threat intelligence and automated workflows.
This data article presents MURHCAD, a high-resolution honeynet dataset collected over 72 hours in June 2025 on Microsoft Azure, using three honeypots (Cowrie, Dionaea, and SentryPeer) deployed across four geographically dispersed virtual machines. According to the authors, the dataset comprises 132,425 attack events with enriched metadata (timestamps, IPs, geolocation, ports, and protocols) intended to support anomaly detection, protocol-misuse studies, and threat intelligence research.
This report addresses the challenge of detecting AI-driven offensive cyber agents, proposing a strategic 'detection-in-depth' framework. According to the authors, five detection mechanisms are presented, including agent identifiers and agent honeypots, intended to support policymakers and industry against this emerging threat.