Topic · 58 links
Cyber deception
Honeypots, honeytokens, decoys, denial-and-deception doctrine, and the empirical work measuring whether any of it changes attacker behaviour.
This topic covers honeypots, honeytokens, decoys, the doctrine that organises them, and the experiments that tried to measure whether any of it changes attacker behaviour. The empirical base is narrower than the volume of writing suggests: a large share of efficacy claims trace back to one experiment and its follow-ups, which the annotations note where it applies. Counter-deception is included deliberately, because material on how attackers spot decoys is the correction to deployment literature that assumes they do not.
Start here
Six links, roughly four hours. Starts with whether deception works at all, then how it is organised, then how to get a signal today, then how it fails. The line under each step says why it comes at that point; the full set of paths is on Paths.
-
Imposing a Cyber Penalty Against Attackers with Cyber Deception
Start with the evidence, not the theory: a short practitioner summary of the one experiment everyone cites.
Readable summary of the Tularosa findings for practitioners: 52% of attacker commands targeted decoys, and exploit failures doubled under deception. Read this before the two formal papers.
-
Deception Techniques in Computer Security: A Research Perspective
Now get the vocabulary. Four axes that let you place any technique you meet later.
Classifies deception along four orthogonal axes: goal, unit, layer, and deployment mode. The cleanest taxonomy in the literature; the ACM version is paywalled, so the authors' copy is linked first.
-
The vocabulary again, but in the form organisations and vendors actually use to talk to each other.
MITRE's adversary engagement framework: prepare, operate and understand phases over a goal/approach/activity matrix, with a starter kit. Successor to MITRE Shield, and the common vocabulary most deception programmes end up using.
-
Stop reading and plant something. Fifteen minutes to a working detection with no infrastructure.
Hosted honeytoken generator, free: files, URLs, credentials, cloud keys that alert when touched.
-
Examining the Efficacy of Decoy-based and Psychological Cyber Deception
Back to the evidence, this time the full experimental design and what the four conditions actually showed.
The results paper from the Tularosa data: a four-condition design finding that decoys plus telling attackers deception is present changes behaviour most. The strongest peer-reviewed evidence that deception imposes real cost.
-
A Review of Honeypots: Fingerprinting Techniques, Detection, and Evasion Mechanisms
Finish with the other side: how attackers spot decoys, so you do not over-trust what you just deployed.
The counter-deception side: how attackers fingerprint honeypots through behavioural and protocol tells, and how weak existing anti-fingerprinting defences are. The corrective to optimistic deployment literature.
Everything in this topic
Grouped by subtopic, then by source type within each subtopic.
Nothing matches those filters. Try clearing one of them.
Honeypots and honeynets 13
Decoy systems built to be attacked and observed.
-
Cyber-Physical Deception Through Coordinated IoT Honeypots
Coordinates multiple IoT honeypots so their simulated physical and network dependencies stay consistent under multi-source probing, closing a detection channel single decoys leave open. Free PDF and talk video.
-
Shadowkube: enhancing Kubernetes security with behavioral monitoring and honeypot integration
Converts compromised Kubernetes nodes into shadow honeypots in place, reporting 97.7% true-positive detection over 43 CVEs and 635 real attack attempts during public deployment. Open access, with live-deployment numbers rather than simulation.
-
HoneyFactory: Container-Based Comprehensive Cyber Deception Honeynet Architecture
Container-based honeynet that deploys honeypots dynamically as an intrusion progresses, using a Gaussian hidden Markov model to estimate attack stage. Open access; evaluation is simulation-based.
-
LLM in the Shell: Generative Honeypots
shelLM, an LLM-backed Linux shell honeypot reporting a 0.90 true negative rate against security experts asked to tell it from a real host. The paper that started the generative-honeypot line.
-
Container Orchestration Honeypot: Observing Attacks in the Wild
High-interaction honeypot for exposed Docker and Kubernetes endpoints that drew attackers within minutes and produced 94 days of attack data, shared with the community. Free PDF from the authors' lab.
-
Honeyd: simulating whole virtual hosts at the network level so one machine can present thousands. The foundational low-interaction honeypot paper, and still the mental model most tooling inherits.
-
Know Your Enemy: Learning about Security Threats, 2nd Edition
The Honeynet Project's collective account of running honeynets and reading what walked in. Badly dated. Out of print, though two sample chapters and the CD contents are still free.
-
The default SSH and Telnet honeypot. Emulated shell, a proxy mode fronting a real host, an experimental LLM backend. Python, actively developed.
-
ICS/SCADA honeypot emulating industrial protocol stacks. Python, GPL-2.0. The usual starting point for OT deception.
living# -
The long-running index of honeypot software by protocol and environment, with a section on anti-honeypot detection tools. Breadth over curation.
living# -
Around thirty honeypot daemons bundled with Elasticsearch, Kibana and Suricata behind one installer. GPL-3.0.
living# -
Multi-protocol honeypot daemon light enough for a Raspberry Pi. BSD-3-Clause. The open counterpart to Thinkst's commercial Canary.
living# -
501(c)(3) running since 1999. Institutional home of most of the open honeypot software listed here.
Honeytokens 2
Planted credentials, files and records that alert when touched.
-
Generates honeytokens carrying organisation-specific naming and technology conventions, scoring 0.778 believability against 0.576 for templates. The authors concede the evaluation is 32 tokens scored by rules, not humans.
contested# -
Hosted honeytoken generator, free: files, URLs, credentials, cloud keys that alert when touched.
LLM-backed honeypots 4
Decoys whose responses are generated by a language model rather than scripted.
-
LLM Honeypot: Leveraging Large Language Models as Advanced Interactive Honeypot Systems
Fine-tunes an open-weights model on captured attacker sessions to generate honeypot responses, then evaluates realism and deploys it live. Preprint; evaluation is thinner than shelLM's.
preprint# -
SoK: Honeypots & LLMs, More Than the Sum of Their Parts?
Systematizes both directions at once: LLMs used to build honeypots, and honeypots built for LLM attackers. Includes a taxonomy of honeypot detection vectors and a critique of how the area evaluates itself.
preprint# -
LLM-powered web honeypot: generates a plausible HTTP response to whatever arrives instead of emulating fixed applications. Go, Apache-2.0.
living# -
Low-code deception runtime, Go, GPL-3.0. The interesting part is the MCP bait tooling: decoys aimed at AI agents rather than human intruders. A commercial product sits on top.
Deception against machine attackers 4
Deception designed for automated adversaries rather than human ones.
-
Honeyquest for LLMs: Rethinking Cyber Deception for AI Attackers
Twenty-one models against 174 reconnaissance queries, finding LLMs take deceptive bait far more often than humans, show no attention-diversion effect, and act on traps 73.4% of the time despite naming them in their reasoning.
preprint# -
Four cooperating agents divert jailbreak attempts into decoy responses, reporting a 68.77% average reduction in attack success while leaving legitimate queries intact. Preprint; the threat model is model-level, not network-level.
preprint# -
Hacking Back the AI-Hacker: Prompt Injection as a Defense Against LLM-driven Cyberattacks
Plants adversarial text in responses an attacking agent will read, disrupting it or compromising the attacker's own machine, with over 95% reported effectiveness. The cleanest statement of deception aimed at machines rather than people.
-
The Mantis decoys as running code: tarpitted FTP, deliberately vulnerable web apps, weak telnet, injection payloads, reverse-shell listeners.
living#
Counter-deception 1
Detecting, fingerprinting and evading deception from the attacker's side.
-
A Review of Honeypots: Fingerprinting Techniques, Detection, and Evasion Mechanisms
The counter-deception side: how attackers fingerprint honeypots through behavioural and protocol tells, and how weak existing anti-fingerprinting defences are. The corrective to optimistic deployment literature.
Empirical efficacy 4
Experiments and trials measuring whether deception imposes real cost.
-
Examining the Efficacy of Decoy-based and Psychological Cyber Deception
The results paper from the Tularosa data: a four-condition design finding that decoys plus telling attackers deception is present changes behaviour most. The strongest peer-reviewed evidence that deception imposes real cost.
seminal# -
Over 130 red-team professionals in a two-day penetration task, with presence and disclosure of deception manipulated independently, plus questionnaires and physiological measures. The design paper that most later efficacy claims trace back to.
-
Cyber deception trials: what we've learned so far
NCSC's December 2025 interim findings, from trials across 121 UK organisations and 14 commercial providers. Deception does surface hidden compromise. It is also not plug-and-play, and needs deliberate configuration to produce anything — which is the finding most vendor material omits.
-
Imposing a Cyber Penalty Against Attackers with Cyber Deception
Readable summary of the Tularosa findings for practitioners: 52% of attacker commands targeted decoys, and exploit failures doubled under deception. Read this before the two formal papers.
Adversary cognition 4
Modelling attacker psychology, bias and decision making under deception.
-
Cyber expert feedback: Experiences, expectations, and opinions about cyber deception
Questionnaire study of professional attackers finding they rarely expect deception, and that those who encounter it diverge sharply, some escalating effort and some abandoning it. Useful counterweight to averaged effect sizes.
paywalled# -
Exploratory Analysis of Decision-Making Biases of Professional Red Teamers in a Cyber-Attack Dataset
Re-analysis of red-team data for confirmation bias and framing effects, reporting that framing reduced attacker interaction with the network. Exploratory by the authors' own description, and behind a subscription.
paywalled# -
Cyber Deception: Techniques, Strategies, and Human Aspects
Ten chapters across game theory, AI and cognitive science — honeyfiles, ICS deception, breach detection. Two are open; the rest are behind Springer.
paywalled# -
ReSCIND: Reimagining Security with Cyberpsychology-Informed Network Defenses
US intelligence-community programme funding defences that exploit attacker cognitive biases. Began 2023, three phases; solicitation closed.
Denial and deception theory 1
The pre-cyber literature on deception that the field keeps reimporting.
-
The deception typology cyber work keeps reimporting, often without citing it: masking, repackaging, dazzling, mimicking, inventing, decoying. Predates the field. Strong on structure, thin on evidence.
Frameworks and doctrine 6
Structured references for planning and running deception programmes.
-
Planning and Integrating Deception into Computer Security Defenses
Three-phase model for planning deception that makes attacker bias an explicit design input and carries Bell and Whaley's six techniques into computer security. Widely borrowed from, rarely credited.
-
The cyber resiliency engineering framework. Cite this when a deception programme has to map to recognised controls.
-
MITRE's adversary engagement framework: prepare, operate and understand phases over a goal/approach/activity matrix, with a starter kit. Successor to MITRE Shield, and the common vocabulary most deception programmes end up using.
-
Crosswalk from deception-based detections to ATT&CK techniques across Windows, Linux and macOS, with a worked deception story for each. MIT. Dormant for years, and nothing has replaced the mapping.
-
The Engage matrix as machine-readable data, plus the site tooling. Apache-2.0.
living# -
HADES creates alternate reality to mislead hackers
Moves an intruder into an altered environment to induce doubt rather than ejecting them. A press release, not a paper, and dated.
dated#
Moving target defense 4
Changing the attack surface over time; adjacent discipline to deception.
-
Effectiveness Evaluation Method for Hybrid Defense of Moving Target Defense and Cyber Deception
Combines queuing theory and evolutionary game theory to price security against reliability and overhead when deception and MTD run together. Addresses the cost side that most efficacy work ignores; evaluation is analytical.
-
Toward Proactive, Adaptive Defense: A Survey on Moving Target Defense
The standard MTD survey: design principles, classifications, algorithms, evaluation metrics and applications in one place. Free on arXiv and thorough, though it predates the cloud-native and agentic work entirely.
dated# -
Moving Target Defense II: Application of Game Theory and Adversarial Modeling
Game-theoretic and adversarial modelling of surface randomisation. Read it with the GameSec proceedings for the formal treatment.
-
Moving Target Defense: Creating Asymmetric Uncertainty for Cyber Threats
The volume that named moving target defence as a research area. Pre-cloud; read it as an origin document.
Datasets 2
Captured attack data released for reuse.
-
A 4-Month Dataset of SSH Botnet Interactions and Command Payloads
145,425 events from an SSH honeypot over four months. Command payloads, credential patterns, attack sequences. CC BY 4.0.
-
Cowrie captures from ~50 nodes at EU and US universities and companies, May 2019 to February 2020.
dated#
Foundations 3
The works everything else in the area cites.
-
Foundations of Cyber Deception: Modeling, Analysis, Design, Human Factors, and Their Convergence
Twelve chapters across theory, human factors and application domains including ICS and UAV networks. Pitched at students entering the area.
paywalled# -
Cyber Deception: Building the Scientific Foundation
Thirteen chapters — adversary modelling, honeypotting, anonymity, forum analysis — assembled as a graduate seminar text. The first serious attempt to give the area a scientific spine.
paywalled# -
Introduction to Cyberdeception
The only general textbook on the subject. Impersonation, delays, fakes, camouflage, false excuses, on both offence and defence, with sustained attention to industrial control systems throughout rather than in one token chapter.
paywalled#
Trust and deception 1
Quantum-like treatments of trust, credibility and adversarial judgment.
-
A formulation of computational trust based on quantum decision theory
Splits trust into objective and subjective components and uses interference terms to model how evaluations shift between isolated and comparative judgment. One of very few quantum-cognition papers aimed at a security-adjacent problem.
paywalled#
Surveys and taxonomies 4
The fastest way into a literature.
-
Intelligent interactive honeypots: A systematization of AI-driven cyber deception
Systematizes forty studies on AI-driven interactive honeypots, mapping interaction level to attack stage and calling out unstandardised datasets and evaluation as the field's main weaknesses. Carries a 2027 issue date.
-
A comprehensive survey on cyber deception techniques to improve honeypot performance
Open-access survey classifying techniques as advanced mimicking, fake cooperation and honeytoken bait, and proposing evaluation metrics plus a mathematical model for honeynet design. More current than Han et al.
-
Deception Techniques in Computer Security: A Research Perspective
Classifies deception along four orthogonal axes: goal, unit, layer, and deployment mode. The cleanest taxonomy in the literature; the ACM version is paywalled, so the authors' copy is linked first.
-
tracebit-com/awesome-deception
Curated list of deception articles, papers, talks and tools, CC0. Maintained by a deception vendor, so weigh the selection accordingly. Still the best jumping-off point.
Courses 1
Structured teaching material.
-
Building Intrusion Detection Honeypots Training
Twelve-plus hours on HTTP, SSH and RDP honeypots, honey tokens, and the monitoring around them. $497 with the companion book. Listed despite the price because free material at this depth does not appear to exist.
Venues 3
Where this work is published and presented.
-
DEF CON community track on adversary simulation, emulation tactics and purple teaming. The programme page links no recordings at all, so it is hard to follow remotely.
living# -
GameSec: Conference on Game Theory and AI for Security
Where the formal game-theoretic treatment of deception and signalling gets published. Proceedings as Springer LNCS.
-
Workshop on Active Defense and Deception (AD&D)
Fifth edition, Rome, 18 September 2026, co-located with ESORICS. Note that it explicitly excludes offensive counter-attack work.
living#
People 1
Researchers with substantial public bodies of work.
-
Curriculum Vitae for Neil C. Rowe
Naval Postgraduate School; around 300 publications on deception in system defence, fake honeypots, and the ethics of deceptive operations. The CV links straight to full texts, which is why it is here rather than a departmental bio.