Paper ID: 2405.04758

Honeyfile Camouflage: Hiding Fake Files in Plain Sight

Roelien C. Timmer, David Liebowitz, Surya Nepal, Salil S. Kanhere

Honeyfiles are a particularly useful type of honeypot: fake files deployed to detect and infer information from malicious behaviour. This paper considers the challenge of naming honeyfiles so they are camouflaged when placed amongst real files in a file system. Based on cosine distances in semantic vector spaces, we develop two metrics for filename camouflage: one based on simple averaging and one on clustering with mixture fitting. We evaluate and compare the metrics, showing that both perform well on a publicly available GitHub software repository dataset.

Submitted: May 8, 2024