Current State of Honeypots and Deception Strategies in Cybersecurity

Zobal, Lukáš; Kolář, Dušan; Fujdiak, Radek

doi:10.1109/icumt48472.2019.8970921

Cited by 22 publications

(13 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Honeypots and honeynets can be classified in various ways. In order to classify the honeypots and honeynets for IoT, IIoT, and CPS in this survey, we build upon prior surveys [12], [24], [25], [28]. However, our classification in this work improves the existing works by identifying some of the recurring key characteristics of the surveyed works.…”

Section: Classification Methodologymentioning

confidence: 99%

“…Classification by Purpose: Honeypots can be categorized Fig. 2: Classification categories of honeypots and honeynets for IoT, IIoT, and CPS in which some of the items in the categorization build upon [12], [24], [25], [28]. Details of works corresponding to each category are tabulated in Tables I, II, and III.…”

Section: Classification Methodologymentioning

confidence: 99%

“…In 2018, Fan et al [12] expanded on their earlier research and proposed a taxonomy of decoy systems with respect to decoys and captors. There also exist other survey studies on general honeypot and honeynet solutions, which include but are not limited to [23], [24], and [25]. In addition, privacy and liability issues when honeypots are deployed were analyzed by Sokol et al [26], [27].…”

Section: Related Workmentioning

confidence: 99%

See 2 more Smart Citations

A Survey of Honeypots and Honeynets for Internet of Things, Industrial Internet of Things, and Cyber-Physical Systems

Franco¹,

Arış²,

Canberk³

et al. 2021

Preprint

View full text Add to dashboard Cite

The Internet of Things (IoT), the Industrial Internet of Things (IIoT), and Cyber-Physical Systems (CPS) have become essential for our daily lives in contexts such as our homes, buildings, cities, health, transportation, manufacturing, infrastructure, and agriculture. However, they have become popular targets of attacks, due to their inherent limitations which create vulnerabilities. Honeypots and honeynets can prove essential to understand and defend against attacks on IoT, IIoT, and CPS environments by attracting attackers and deceiving them into thinking that they have gained access to the real systems. Honeypots and honeynets can complement other security solutions (i.e., firewalls, Intrusion Detection Systems -IDS) to form a strong defense against malicious entities. This paper provides a comprehensive survey of the research that has been carried out on honeypots and honeynets for IoT, IIoT, and CPS. It provides a taxonomy and extensive analysis of the existing honeypots and honeynets, states key design factors for the state-of-the-art honeypot/honeynet research and outlines open issues for future honeypots and honeynets for IoT, IIoT, and CPS environments.

show abstract

Section: Classification Methodologymentioning

confidence: 99%

Section: Classification Methodologymentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

A Survey of Honeypots and Honeynets for Internet of Things, Industrial Internet of Things, and Cyber-Physical Systems

Franco¹,

Arış²,

Canberk³

et al. 2021

Preprint

View full text Add to dashboard Cite

show abstract

“…Por su parte, en (Zobal, Kolář, & Fujdiak, 2019) se analiza la problemática de los honeypot y las estrategias defensivas basadas en el engaño en el mundo cibernético. En primer lugar, se define el fenómeno honeypot y se resume sus ventajas y desventajas, así como las cuestiones legales y éticas.…”

Section: Los Honeypots En La Detección De Amenazasunclassified

Análisis de intrusiones cibernéticas con el uso del Honeypots. Una revisión sistemática / Análise de invasões cibernéticas usando Honeypots. Uma revisão sistemática

Macias¹,

Márquez²,

Cabrera³

et al. 2021

Braz. Ap. Sci. Rev.

View full text Add to dashboard Cite

Honeypot o sistema señuelo diseñado para ser el objetivo de un atacante en las intrusiones cibernéticas además puede recopilar información sobre técnicas y comportamientos de ataque. Se ha realizado una gran cantidad de trabajo en el campo de la detección de intrusiones en la red durante las últimas tres décadas. Con las redes cada vez más rápidas y con la creciente dependencia de Internet tanto a nivel personal como comercial, la detección de intrusos se convierte en un proceso desafiante. El desafío aquí no es solo poder monitorear activamente un gran número de sistemas, sino también poder reaccionar rápidamente a diferentes eventos. Antes de desplegar un honeypot es recomendable tener una idea clara de lo que debe y no debe hacer el honeypot. Debe haber una comprensión clara de los sistemas operativos que se utilizarán y los servicios (como un servidor web, servidor ftp, etc.) que ejecutará un honeypot. Se deben tener en cuenta los riesgos involucrados y se deben comprender los métodos para abordar o reducir estos riesgos. También es recomendable tener un plan sobre qué hacer en caso de que el honeypot se vea comprometido. La presente revisión sistemática aborda el estado actual de la investigación ligada a la detección de intrusiones usando honeypots. La recopilación de información científica se apoyó en el sistema Mendeley, seleccionándose 32 artículos luego de la evaluación de calidad que tuvo como base criterios de inclusión y exclusión previamente establecidos.

show abstract

“…Zuzcak M, Sochor T. [24] propose an FTP honeypot which based on port 22 in SSH mode. Zobal L, Kolar D, Fujdiak R. [25] survey honeypot problematics and deception-based defensive strategies in the cyberworld.…”

Section: Honeypot and Ipv6mentioning

confidence: 99%

A Web-Based Honeypot in IPv6 to Enhance Security

et al. 2020

View full text Add to dashboard Cite

IPv6 is a next-generation IP protocol that replaces IPv4. It not only expands the number of network address resources but also solves the problem of multiple access devices connected to the Internet. While IPv6 has brought excellent convenience to the public, related security issues have gradually emerged, and an assessment of the security situation in IPv6 has also become more important. Unlike passive defense, the honeypot is a security device for active defense. The real network application and the fake network application, disguised by the honeypot, are located on a similar subnet, and provide a network application service; but, in both cases, behavior logs from unauthorized users are caught. In this manner, and to protect web-based applications from attacks, this article introduces the design and implementation of a web-based honeypot that includes a weak password module and an SQL inject module, which supports the IPv6 network to capture unauthorized access behavior. We also propose the Security Situation Index (SSI), which can measure the security situation of the network application environment. The value of SSI is established according to the different parameters that are based on honeypots. There is a firewall outside the test system environment, so the obtained data should be used as the real invasion data, and the captured behavior is not a false positive. Threats can be spotted smartly by deploying honeypots; this paper demonstrates that the honeypot is an excellent method of capturing malicious requests and can be measured with the SSI of the whole system. According to the information, the administrator can modify the current security policy, which can improve the security level of a whole IPv6 network system.

show abstract

Current State of Honeypots and Deception Strategies in Cybersecurity

Cited by 22 publications

References 18 publications

A Survey of Honeypots and Honeynets for Internet of Things, Industrial Internet of Things, and Cyber-Physical Systems

A Survey of Honeypots and Honeynets for Internet of Things, Industrial Internet of Things, and Cyber-Physical Systems

Análisis de intrusiones cibernéticas con el uso del Honeypots. Una revisión sistemática / Análise de invasões cibernéticas usando Honeypots. Uma revisão sistemática

A Web-Based Honeypot in IPv6 to Enhance Security

Contact Info

Product

Resources

About