Abracadabra Labs / resource directory

Topic · 58 links

Cyber deception

Honeypots, honeytokens, decoys, denial-and-deception doctrine, and the empirical work measuring whether any of it changes attacker behaviour.

This topic covers honeypots, honeytokens, decoys, the doctrine that organises them, and the experiments that tried to measure whether any of it changes attacker behaviour. The empirical base is narrower than the volume of writing suggests: a large share of efficacy claims trace back to one experiment and its follow-ups, which the annotations note where it applies. Counter-deception is included deliberately, because material on how attackers spot decoys is the correction to deployment literature that assumes they do not.

Start here

Six links, roughly four hours. Starts with whether deception works at all, then how it is organised, then how to get a signal today, then how it fails. The line under each step says why it comes at that point; the full set of paths is on Paths.

  1. Imposing a Cyber Penalty Against Attackers with Cyber Deception

    Start with the evidence, not the theory: a short practitioner summary of the one experiment everyone cites.

    Readable summary of the Tularosa findings for practitioners: 52% of attacker commands targeted decoys, and exploit failures doubled under deception. Read this before the two formal papers.

  2. Deception Techniques in Computer Security: A Research Perspective

    Now get the vocabulary. Four axes that let you place any technique you meet later.

    Classifies deception along four orthogonal axes: goal, unit, layer, and deployment mode. The cleanest taxonomy in the literature; the ACM version is paywalled, so the authors' copy is linked first.

  3. MITRE Engage

    The vocabulary again, but in the form organisations and vendors actually use to talk to each other.

    MITRE's adversary engagement framework: prepare, operate and understand phases over a goal/approach/activity matrix, with a starter kit. Successor to MITRE Shield, and the common vocabulary most deception programmes end up using.

  4. Canarytokens

    Stop reading and plant something. Fifteen minutes to a working detection with no infrastructure.

    Hosted honeytoken generator, free: files, URLs, credentials, cloud keys that alert when touched.

  5. Examining the Efficacy of Decoy-based and Psychological Cyber Deception

    Back to the evidence, this time the full experimental design and what the four conditions actually showed.

    The results paper from the Tularosa data: a four-condition design finding that decoys plus telling attackers deception is present changes behaviour most. The strongest peer-reviewed evidence that deception imposes real cost.

  6. A Review of Honeypots: Fingerprinting Techniques, Detection, and Evasion Mechanisms

    Finish with the other side: how attackers spot decoys, so you do not over-trust what you just deployed.

    The counter-deception side: how attackers fingerprint honeypots through behavioural and protocol tells, and how weak existing anti-fingerprinting defences are. The corrective to optimistic deployment literature.

Everything in this topic

Grouped by subtopic, then by source type within each subtopic.

Honeypots and honeynets 13

Decoy systems built to be attacked and observed.

  • Cyber-Physical Deception Through Coordinated IoT Honeypots

    Coordinates multiple IoT honeypots so their simulated physical and network dependencies stay consistent under multi-source probing, closing a detection channel single decoys leave open. Free PDF and talk video.

  • Shadowkube: enhancing Kubernetes security with behavioral monitoring and honeypot integration

    Converts compromised Kubernetes nodes into shadow honeypots in place, reporting 97.7% true-positive detection over 43 CVEs and 635 real attack attempts during public deployment. Open access, with live-deployment numbers rather than simulation.

  • HoneyFactory: Container-Based Comprehensive Cyber Deception Honeynet Architecture

    Container-based honeynet that deploys honeypots dynamically as an intrusion progresses, using a Gaussian hidden Markov model to estimate attack stage. Open access; evaluation is simulation-based.

  • LLM in the Shell: Generative Honeypots

    shelLM, an LLM-backed Linux shell honeypot reporting a 0.90 true negative rate against security experts asked to tell it from a real host. The paper that started the generative-honeypot line.

  • Container Orchestration Honeypot: Observing Attacks in the Wild

    High-interaction honeypot for exposed Docker and Kubernetes endpoints that drew attackers within minutes and produced 94 days of attack data, shared with the community. Free PDF from the authors' lab.

    open version
  • A Virtual Honeypot Framework

    Honeyd: simulating whole virtual hosts at the network level so one machine can present thousands. The foundational low-interaction honeypot paper, and still the mental model most tooling inherits.

    datedseminal
  • Know Your Enemy: Learning about Security Threats, 2nd Edition

    The Honeynet Project's collective account of running honeynets and reading what walked in. Badly dated. Out of print, though two sample chapters and the CD contents are still free.

    datedseminal
  • cowrie/cowrie

    The default SSH and Telnet honeypot. Emulated shell, a proxy mode fronting a real host, an experimental LLM backend. Python, actively developed.

    livingopen version
  • mushorg/conpot

    ICS/SCADA honeypot emulating industrial protocol stacks. Python, GPL-2.0. The usual starting point for OT deception.

    living
  • paralax/awesome-honeypots

    The long-running index of honeypot software by protocol and environment, with a section on anti-honeypot detection tools. Breadth over curation.

    living
  • telekom-security/tpotce

    Around thirty honeypot daemons bundled with Elasticsearch, Kibana and Suricata behind one installer. GPL-3.0.

    living
  • thinkst/opencanary

    Multi-protocol honeypot daemon light enough for a Raspberry Pi. BSD-3-Clause. The open counterpart to Thinkst's commercial Canary.

    living
  • The Honeynet Project

    501(c)(3) running since 1999. Institutional home of most of the open honeypot software listed here.

    livingopen version

Honeytokens 2

Planted credentials, files and records that alert when touched.

LLM-backed honeypots 4

Decoys whose responses are generated by a language model rather than scripted.

  • LLM Honeypot: Leveraging Large Language Models as Advanced Interactive Honeypot Systems

    Fine-tunes an open-weights model on captured attacker sessions to generate honeypot responses, then evaluates realism and deploys it live. Preprint; evaluation is thinner than shelLM's.

    preprint
  • SoK: Honeypots & LLMs, More Than the Sum of Their Parts?

    Systematizes both directions at once: LLMs used to build honeypots, and honeypots built for LLM attackers. Includes a taxonomy of honeypot detection vectors and a critique of how the area evaluates itself.

    preprint
  • 0x4D31/galah

    LLM-powered web honeypot: generates a plausible HTTP response to whatever arrives instead of emulating fixed applications. Go, Apache-2.0.

    living
  • beelzebub-labs/beelzebub

    Low-code deception runtime, Go, GPL-3.0. The interesting part is the MCP bait tooling: decoys aimed at AI agents rather than human intruders. A commercial product sits on top.

    livingvendor-authoredopen version

Deception against machine attackers 4

Deception designed for automated adversaries rather than human ones.

Counter-deception 1

Detecting, fingerprinting and evading deception from the attacker's side.

Empirical efficacy 4

Experiments and trials measuring whether deception imposes real cost.

  • Examining the Efficacy of Decoy-based and Psychological Cyber Deception

    The results paper from the Tularosa data: a four-condition design finding that decoys plus telling attackers deception is present changes behaviour most. The strongest peer-reviewed evidence that deception imposes real cost.

    seminal
  • The Tularosa Study: An Experimental Design and Implementation to Quantify the Effectiveness of Cyber Deception

    Over 130 red-team professionals in a two-day penetration task, with presence and disclosure of deception manipulated independently, plus questionnaires and physiological measures. The design paper that most later efficacy claims trace back to.

    seminalopen version
  • Cyber deception trials: what we've learned so far

    NCSC's December 2025 interim findings, from trials across 121 UK organisations and 14 commercial providers. Deception does surface hidden compromise. It is also not plug-and-play, and needs deliberate configuration to produce anything — which is the finding most vendor material omits.

  • Imposing a Cyber Penalty Against Attackers with Cyber Deception

    Readable summary of the Tularosa findings for practitioners: 52% of attacker commands targeted decoys, and exploit failures doubled under deception. Read this before the two formal papers.

Adversary cognition 4

Modelling attacker psychology, bias and decision making under deception.

Denial and deception theory 1

The pre-cyber literature on deception that the field keeps reimporting.

  • Cheating and Deception

    The deception typology cyber work keeps reimporting, often without citing it: masking, repackaging, dazzling, mimicking, inventing, decoying. Predates the field. Strong on structure, thin on evidence.

    datedpaywalledseminal

Frameworks and doctrine 6

Structured references for planning and running deception programmes.

  • Planning and Integrating Deception into Computer Security Defenses

    Three-phase model for planning deception that makes attacker bias an explicit design input and carries Bell and Whaley's six techniques into computer security. Widely borrowed from, rarely credited.

    seminalopen version
  • NIST SP 800-160 Vol. 2 Rev. 1: Developing Cyber-Resilient Systems: A Systems Security Engineering Approach

    The cyber resiliency engineering framework. Cite this when a deception programme has to map to recognised controls.

    open version
  • MITRE Engage

    MITRE's adversary engagement framework: prepare, operate and understand phases over a goal/approach/activity matrix, with a starter kit. Successor to MITRE Shield, and the common vocabulary most deception programmes end up using.

    open version
  • 0x4D31/deception-as-detection

    Crosswalk from deception-based detections to ATT&CK techniques across Windows, Linux and macOS, with a worked deception story for each. MIT. Dormant for years, and nothing has replaced the mapping.

    datedliving
  • mitre/engage

    The Engage matrix as machine-readable data, plus the site tooling. Apache-2.0.

    living
  • HADES creates alternate reality to mislead hackers

    Moves an intruder into an altered environment to induce doubt rather than ejecting them. A press release, not a paper, and dated.

    dated

Moving target defense 4

Changing the attack surface over time; adjacent discipline to deception.

Datasets 2

Captured attack data released for reuse.

Foundations 3

The works everything else in the area cites.

  • Foundations of Cyber Deception: Modeling, Analysis, Design, Human Factors, and Their Convergence

    Twelve chapters across theory, human factors and application domains including ICS and UAV networks. Pitched at students entering the area.

    paywalled
  • Cyber Deception: Building the Scientific Foundation

    Thirteen chapters — adversary modelling, honeypotting, anonymity, forum analysis — assembled as a graduate seminar text. The first serious attempt to give the area a scientific spine.

    paywalled
  • Introduction to Cyberdeception

    The only general textbook on the subject. Impersonation, delays, fakes, camouflage, false excuses, on both offence and defence, with sustained attention to industrial control systems throughout rather than in one token chapter.

    paywalled

Trust and deception 1

Quantum-like treatments of trust, credibility and adversarial judgment.

  • A formulation of computational trust based on quantum decision theory

    Splits trust into objective and subjective components and uses interference terms to model how evaluations shift between isolated and comparative judgment. One of very few quantum-cognition papers aimed at a security-adjacent problem.

    paywalled

Surveys and taxonomies 4

The fastest way into a literature.

Courses 1

Structured teaching material.

  • Building Intrusion Detection Honeypots Training

    Twelve-plus hours on HTTP, SSH and RDP honeypots, honey tokens, and the monitoring around them. $497 with the companion book. Listed despite the price because free material at this depth does not appear to exist.

    livingpaywalled

Venues 3

Where this work is published and presented.

People 1

Researchers with substantial public bodies of work.

  • Curriculum Vitae for Neil C. Rowe

    Naval Postgraduate School; around 300 publications on deception in system defence, fake honeypots, and the ethics of deceptive operations. The CV links straight to full texts, which is why it is here rather than a departmental bio.

    livingopen version