deception

Cowrie SSH/Telnet Honeypot https://cowrie.readthedocs.io

Seccome Teamer积累十几年的安全经验，都将对外逐步开放，首开的Ehoney欺骗防御系统，该系统是基于云原生的欺骗防御系统，也是业界唯一开源的对标商业系统的产品，欺骗防御系统通过部署高交互高仿真蜜罐及流量代理转发，再结合自研密签及诱饵，将攻击者攻击引导到蜜罐中达到扰乱引导以及延迟攻击的效果，可以很大程度上保护业务的安全。护网必备良药

honeyλ - a simple, serverless application designed to create and monitor fake HTTP endpoints (i.e. URL honeytokens) automatically, on top of AWS Lambda and Amazon API Gateway

Credentials catching honeypot

DejaVU - Open Source Deception Framework

Deception based detection techniques mapped to the MITRE’s ATT&CK framework

A PoC tool designed to enhance the effectiveness of your traps by spreading breadcrumbs & honeytokens across your systems to lure the attacker toward your honeypots

OWASP Honeypot, Automated Deception Framework.

A PowerShell module to deploy active directory decoy objects.

Cowrie Docker GitHub repository

HellPot is an endless honeypot that sends bots to hell. Based on Heffalump.

A Heroku-based web honeypot that can be used to create and monitor fake HTTP endpoints (i.e. honeytokens).

This project is designed to create deceptive webpages to deceive and redirect attackers away from real websites.

Distributed Honeypot

A repository dedicated to terminal escape injections.

Designed to be installed on a fresh install of raspbian on a raspberry pi, by combining Respounder (Responder detection) and Artillery (port and service spoofing) for network deception, this tool allows you to detect an attacker on the network quickly by weeding out general noisy alerts with only those that matter.

WebLogic Honeypot is a low interaction honeypot to detect CVE-2017-10271 in the Oracle WebLogic Server component of Oracle Fusion Middleware. This is a Remote Code Execution vulnerability.

DICOM Honepot

Windows version of honeybits - a PoC tool to create breadcrumbs and honeytokens, to lead the attackers to your honeypots!

MITRE Shield website

MICROS Honeypot is a low interaction honeypot to detect CVE-2018-2636 in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (MICROS). This is a directory traversal vulnerability.

Voice stress analysis (VSA) aims to differentiate between stressed and non-stressed outputs in response to stimuli (e.g., questions posed), with high stress seen as an indication of deception. In this work, we propose a deep learning-based psychological stress detection model using speech signals. With increasing demands for communication between humans and intelligent systems, automatic stress detection is becoming an interesting research topic. Stress can be reliably detected by measuring the level of specific hormones (e.g., cortisol), but this is not a convenient method for the detection of stress in human- machine interactions. The proposed algorithm first extracts Mel- filter bank coefficients using pre-processed speech data and then predicts the status of stress output using a binary decision criterion (i.e., stressed or unstressed) using CNN (Convolutional Neural Network) and dense fully connected layer networks.

Proof-of-concept cyber deception utility emulating Samba and LibSSH

A console multiplayer town of salem / throne of lies deception game

Deception Detection project website

CITapp: a response time-based Concealed Information Test lie detector web application. This method aims to reveal whether or not a certain information detail (e.g. a photo taken from the scene of a recent burglary) is known to the tested person.

1st International Workshop on Deceptive AI @ECAI2020

This is a computational framework to analyze raw biological data generated from a polygraph test for the purpose of making psychophysiological inferences.

An easy-to-use smartphone app for the response time concealed information test.

Presentation slides and code samples of my talks