Skip to main content Skip to main navigation

Publikation

Position Paper: Development of an Automated Vulnerability Placement Framework for IaC-Based Honeynets

Marvin Sinnwell; Daniel Reti; Hans Dieter Schotten
In: Proceedings of the 5th Workshop on Active Defense and Deception. Workshop on Active Defense and Deception (AD&D-2026), located at 31st European Symposium on Research in Computer Security (ESORICS) 2026, September 18, Rome, Italy, IEEE Explore, 2026.

Zusammenfassung

Studying how adversaries behave once they gain a foothold requires realistic, customisable honeynets, yet building such environments is rarely reproducible, leaving experiments hard to share or compare. Existing cyber ranges do not close this gap: they centre on training rather than the automated, shareable placement of vulnerabilities that cyber deception research needs. We present an automated vulnerability-placement framework built from two deliberately decoupled parts: a portable, CWE-indexed vulnerability corpus, packaged as a single shareable file independent of any range engine, and a cyber range engine that turns a web-based topology specification into a fully provisioned, instrumented honeynet with no manual configuration and with attacker-interaction logging enabled by default. The corpus spans 1,102 unique CVEs across seven widely deployed software products together with common misconfigurations and decoy artefacts, grounded in Shodan exposure data, the edgescan 2025 Vulnerability Statistics Report, and the OWASP Top~10, and covers 58.85% of the web vulnerabilities edgescan reports. A scalability evaluation shows the provisioning pipeline scales sub-linearly, deploying 75 VMs in roughly 413, and a single-operator case study captured 88.3GB of multi-stage attacker interaction, including tool fingerprints and lateral movement, at a fidelity useful for downstream behaviour and threat-detection research.