Publikation
Position Paper: Development of an Automated Vulnerability Placement Framework for IaC-Based Honeynets
Marvin Sinnwell; Daniel Reti; Hans Dieter Schotten
In: Proceedings of the 5th Workshop on Active Defense and Deception. Workshop on Active Defense and Deception (AD&D-2026), located at 31st European Symposium on Research in Computer Security (ESORICS) 2026, September 18, Rome, Italy, IEEE Explore, 2026.
Zusammenfassung
Studying how adversaries behave once they gain a foothold requires realistic,
customisable honeynets, yet building such environments is rarely reproducible, leaving experiments hard to share or compare. Existing
cyber ranges do not close this gap: they centre on training rather than the
automated, shareable placement of vulnerabilities that cyber deception research needs.
We present an automated vulnerability-placement framework built from two
deliberately decoupled parts: a portable, CWE-indexed vulnerability corpus,
packaged as a single shareable file independent of any range engine, and a cyber range
engine that turns a web-based topology specification into a fully provisioned,
instrumented honeynet with no manual configuration and with attacker-interaction
logging enabled by default. The corpus spans 1,102 unique CVEs across seven
widely deployed software products together with common misconfigurations and
decoy artefacts, grounded in Shodan exposure data, the edgescan 2025
Vulnerability Statistics Report, and the OWASP Top~10, and covers 58.85% of the
web vulnerabilities edgescan reports. A scalability evaluation shows the
provisioning pipeline scales sub-linearly, deploying 75 VMs in roughly 413,
and a single-operator case study captured 88.3GB of multi-stage attacker
interaction, including tool fingerprints and lateral movement, at a fidelity
useful for downstream behaviour and threat-detection research.
