Dynamic Honeypot Deployment in SDN: Integrating Moving Target Defense and Deception Mechanisms for Enhanced Cybersecurity.
Harman Yousif Ibrahim Khalid, Najla Badie Al Dabagh · Zanin Journal of Science and Engineering · 2026
Deception mechanisms such as honeypots proved to be effective security mechanisms that lure cyber attackers to fake services away from real services, log their behavior to be analyzed in order to extract knowledge about their operation. Honeypots have been adopted by the research community since they can detect passive scanning attacks, which attackers usually perform to collect knowledge about the current network to prepare for larger attacks. However, the static deployment of honeypots makes them easier to be exposed by skilled attackers. Therefore, it is necessary to make honeypot deployments in the network dynamically and proactively. To overcome this shortcoming, Moving Target Defense (MTD) is a solution technology that changes network configuration parameters efficiently, either reactively or proactively, to falsify the details collected by attackers in order to disrupt the intended cyber-attack. In this paper, we present a review of the current work on MTD techniques in Software Defined Networking (SDN) environment and highlight some important requirements for MTD applications and their issues. Moreover, we present a theoretical model of a cyber security mechanism combining MTD with a deception mechanism implemented as an SDN controller.