Development and Simulation of a Deception-Based Honeynet Framework for Cyber Threat Hunting
Author
Abdulkadir. Akinsola, Francisca N. Ogwueleka, and Uche M. Mbanaso
Abstract
Cyber threat hunting is a proactive approach to identifying suspicious activity that may evade conventional security controls. However, defenders may have limited visibility into how external sources interact with exposed services, and the volume of security events can make activity analysis challenging. This study develops and simulates a deception-based honeynet framework that integrates the T-Pot honeynet with Wazuh and the Elastic Stack. The framework deploys decoy services to record external interactions, forwards relevant honeypot logs for monitoring and analysis, and presents the collected events through dashboards. The study examines the resulting telemetry using descriptive analysis of event volumes, honeypot distribution, destination ports, observed source IP addresses, and Suricata alerts, alongside qualitative review of selected log records. The results demonstrate the framework's ability to collect and visualise activity directed at the deployed decoy services and to provide data for examining activity patterns. The study does not establish comparative detection accuracy or response-time improvements; these require further controlled evaluation.
Keywords
Threat hunting, decoys, honeypots, vulnerabilities
Full Text:
References
Abu Sayed, M., Anwar, A. H., Kiekintveld, C., Bosansky, B., & Kamhoua, C. (2023). Cyber Deception against Zero-day Attacks: A Game Theoretic Approach. arXiv e-prints, arXiv-2307.
Almeshekah, M., & Spafford, E. H. (2025). Design principles for cyber deception systems. Computers & Security, 138, 103012. https://doi.org/10.1016/j.cose.2024.103012
Al-Shaer, E., Duan, Q., & Liu, J. (2019). Automated Deception for Cyber Defence. Springer.
Bienzobas, Á. C., & Sánchez-Macián, A. (2023). Threat Trekker: An approach to cyber threat hunting. arXiv preprint arXiv:2310.04197.
Behl, A., & Behl, K. (2025). Proactive cyber threat hunting: Techniques, tools, and future directions. Journal of Information Security and Applications, 78, 103645. https://doi.org/10.1016/j.jisa.2024.103645
Chakraborty, T., Jajodia, S., Park, N., Pugliese, A., Serra, E., & Subrahmanian, V. S. (2018). Hybrid adversarial defense: Merging honeypots and traditional security methods. Journal of Computer Security, 26(5), 615-645.
Cranford, T. W., Gonzalez, C., & Lebiere, C. (2021). Towards a cognitive theory of cyber deception. Cognitive Science, 45(2), e13013. https://doi.org/10.1111/cogs.13013
Creswell, J. W., & Creswell, J. D. (2018). Research Design: Qualitative, Quantitative, and Mixed Methods Approaches (5th ed.). SAGE Publications.
Deep Threat Analytics. "Deception Technology in Cyber Defense: Enhancing Network Security." Deep Threat Analytics, 2023, https://www.deepthreatanalytics.com/network-security/deception-technology-cyber-defense-enhancing/.
Dowling, S., Schukat, M., & Barrett, E. (2020). New framework for adaptive and agile honeypots. Etri Journal, 42(6), 965-975.
Ferguson-Walter, Kimberly J., Maxine M. Major, Chelsea K. Johnson, and Daniel H. Muhleman. "Examining the Efficacy of Decoy-based and Psychological Cyber Deception." 30th USENIX Security Symposium (USENIX Security 21), USENIX Association, Aug. 2021, pp. 1127–1144.
Fang, F., Xu, H., & Hayel, Y. (2023). Decision and Game Theory for Security.
Fugate, M., Ferguson-Walter, K., & Lamont, G.s (2019). Artificial intelligence and game theory models for defending critical networks with cyber deception. AI Magazine, 40(1), 31–43. https://doi.org/10.1609/aimag.v40i1.2849
Fidelis Security. "Applications of Deception Technology in Cybersecurity." Fidelis Security, 2023, https://fidelissecurity.com/cybersecurity-101/deception/deception-technology-applications/.
https://www.researchgate.net/publication/353779928_Incorporating_Deception_into_CyberBattleSim_for_Autonomous_Defense
Jajodia, S., Ghosh, A., Subrahmanian, V. S., Swarup, V., Wang, C., & Wang, X. S. (2016). Cyber deception: Building the scientific foundation. Springer.
Kahlhofer, M., Achleitner, S., Rass, S., & Mayrhofer, R. (2024, September). Honeyquest: Rapidly measuring the enticingness of cyber deception techniques with code-based questionnaires. In Proceedings of the 27th International Symposium on Research in Attacks, Intrusions and Defenses (pp. 317-336).
Karuna, P., Hemberg, E., O'Reilly, U. M., & Rutar, N. (2021). Automating cyber threat hunting using NLP, automated query generation, and genetic perturbation. arXiv preprintarXiv:2104.11576.
Li, Y., Chen, X., & Luo, X. (2025). Honeynet-based cyber threat intelligence generation. Future Generation Computer Systems, 150, 12–27. https://doi.org/10.1016/j.future.2024.12.018
Mbanaso, U. M., Abrahams, L., & Okafor, K. C. (2023). Research techniques for computer science, information systems and cybersecurity. Springer.
Mohammed, M. A., and A. M. Abdulazeez. "Cyber Threat Hunting: Proactive Techniques for Identifying Hidden Threats." Journal of Network and Computer Applications, 2024, https://www.sciencedirect.com/science/article/pii/S1084804524001814.
Puzis, R., Zilberman, P., & Elovici, Y. (2020). ATHAFI: Agile threat hunting and forensic investigation. arXiv preprint arXiv:2003.03663.
POMDPs to recognize cyber attacker's intent. arXiv preprint arXiv:2007.09512. https://arxiv.org/abs/2007.09512
Sayed, Md Abu, Ahmed H. Anwar, Christopher Kiekintveld, Branislav Bosansky, and Charles Kamhoua. "Cyber Deception Against Zero-Day Attacks: A Game Theoretic Approach."
Smith, J. D., & Johnson, A. B. (2022). "Advancing Cyber Threat Hunting through Deception Technologies." Journal of Cybersecurity, 5(1), tyaa005.
Shokri, R., & Kantarcioglu, M. (2025).
Adversarial behavior modeling in cyber defense systems. ACM Computing Surveys, 57(2), 1–36. https://doi.org/10.1145/3664567
Scarfone, K., & Mell, P. (2025). Guidelines for threat hunting and advanced detection (NIST Special Publication 800-92 Rev. 2, Draft). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-92r2-draft
Shinde, A., Doshi, P., & Setayeshfar, O. (2020). Active deception using factored interactive Turner, M. J., Carenzo, M., Lasky, J., Morris-King, J., & Ross, J. (2025). Technique Inference Engine: A Recommender Model to Support Cyber Threat Hunting. arXiv preprint arXiv:2503.04819.
Walter, E. C., Ferguson-Walter, K. J., & Ridley, A. D. (2021). Incorporating deception into CyberBattleSim for autonomous defense. In IJCAI-21 1st International Workshop on Adaptive Cyber Defense.
Wan, Z., Cho, J.-H., Zhu, M., Anwar, A. H., Kamhoua, C., & Singh, M. P. (2021). Foureye: Defensive deception based on hypergame theory against advanced persistent threats. arXiv preprint arXiv:2101.02863. https://arxiv.org/abs/2101.02863
Zhou, R., Shi, H., & Zhou, W. (2020). "Deception for Cybersecurity Defence: A Survey." IEEETransactions on Dependable and Secure Computing, 18(1), 250-266.
Zhu, Q. (2019). Game theory for cyber deception: A tutorial. arXiv preprint arXiv:1903.01442. https://arxiv.org/abs/1903.01442
Zhang, L., & Thing, V. L. (2021). Three decades of deception techniques in active cyber defense-retrospect and outlook. Computers & Security, 106, 102288.
Fraunholz, D., Krohmer, D., Anton, S. D., & Schotten, H. D. (2017). A survey of honeypots and honeynets: Issues of deployment, challenges, and research directions. 2017 12th International Conference on Availability, Reliability and Security (ARES), 1-10.
Pouget, F., & Dacier, M. (2004). Honeypot-based forensics. AusCERT Asia Pacific Information Technology Security Conference.
Almeshekah, M. H., & Spafford, E. H. (2016). Planning and integrating deception into computer security defenses. Proceedings of the 2016 New Security Paradigms Workshop, 127-138.
Egele, M., Scholte, T., Kirda, E., & Kruegel, C. (2008). A survey on automated dynamic malware-analysis techniques and tools. ACM Computing Surveys, 44(2), 1–42.
MITRE ATT&CK Framework (2023). Adversarial Tactics, Techniques, and Common Knowledge. Retrieved from https://attack.mitre.org
Sittig, D. F., & Singh, H. (2020). A socio-technical perspective on cyber threat detection and response architectures. Journal of Biomedical Informatics, 108, 103500.