Honeyfile Camouflage: Hiding Fake Files in Plain Sight
<|reference_start|>Honeyfile Camouflage: Hiding Fake Files in Plain Sight: Honeyfiles are a particularly useful type of honeypot: fake files deployed to detect and infer information from malicious behaviour. This paper considers the challenge of naming honeyfiles so they are camouflaged when placed amongst real files in a file system. Based on cosine distances in semantic vector spaces, we develop two metrics for filename camouflage: one based on simple averaging and one on clustering with mixture fitting. We evaluate and compare the metrics, showing that both perform well on a publicly available GitHub software repository dataset.<|reference_end|>
@article{timmer2024honeyfile,
    title={Honeyfile Camouflage: Hiding Fake Files in Plain Sight},
    author={Roelien C. Timmer, David Liebowitz, Surya Nepal, Salil S. Kanhere},
    journal={arXiv preprint arXiv:2405.04758},
    year={2024},
    doi={10.1145/3660354.3660355},
    archivePrefix={arXiv},
    eprint={2405.04758},
    primaryClass={cs.CR cs.AI cs.CL}
}