{"id":"https://openalex.org/W7220654762","doi":"https://doi.org/10.1038/s41598-026-72812-4","title":"Multi-service honeypot framework for high-fidelity cyber-attack data collection and machine learning-based threat detection in cloud environments","display_name":"Multi-service honeypot framework for high-fidelity cyber-attack data collection and machine learning-based threat detection in cloud environments","publication_year":2026,"publication_date":"2026-10-06","ids":{"openalex":"https://openalex.org/W7220654762","doi":"https://doi.org/10.1038/s41598-026-72812-4"},"language":"en","primary_location":{"id":"doi:10.1038/s41598-026-72812-4","doi":"https://doi.org/10.1038/s41598-026-72812-4","is_oa":true,"landing_page_url":"https://doi.org/10.1038/s41598-026-72812-4","pdf_url":"https://www.nature.com/articles/s41598-026-72812-4_reference.pdf","source":{"id":"https://openalex.org/S196734849","display_name":"Scientific Reports","issn_l":"2045-2322","issn":["2045-2322"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-class-a","anvur-scientific","cwts-core","doaj","dongbi-c","doyens","jufo-1","ki-jl-1","medline","norway-1","poland-140","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310319908","host_organization_name":"Nature Portfolio","host_organization_lineage":["https://openalex.org/P4310319908","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Nature Portfolio","Springer Nature"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Scientific Reports","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.nature.com/articles/s41598-026-72812-4_reference.pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5133484551","display_name":"Sridhar Govardhan","orcid":"https://orcid.org/0000-0002-2099-9283","observed_orcids":["https://orcid.org/0000-0002-2099-9283"]},"institutions":[{"id":"https://openalex.org/I83737708","display_name":"REVA University","ror":"https://ror.org/03gtcxd54","country_code":"IN","type":"education","lineage":["https://openalex.org/I83737708"]}],"countries":["IN"],"is_corresponding":true,"raw_author_name":"G. Sridhar","raw_affiliation_strings":["School of Computer Science and Application, REVA University, Bengaluru, Karnataka, 560064, India"],"raw_orcid":"https://orcid.org/0000-0002-2099-9283","affiliations":[{"raw_affiliation_string":"School of Computer Science and Application, REVA University, Bengaluru, Karnataka, 560064, India","institution_ids":["https://openalex.org/I83737708"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5110969478","display_name":"Jay Bharateesh Simha","orcid":"https://orcid.org/0000-0002-6733-7535","observed_orcids":["https://orcid.org/0000-0002-6733-7535"]},"institutions":[{"id":"https://openalex.org/I83737708","display_name":"REVA University","ror":"https://ror.org/03gtcxd54","country_code":"IN","type":"education","lineage":["https://openalex.org/I83737708"]}],"countries":["IN"],"is_corresponding":true,"raw_author_name":"J. B. Simha","raw_affiliation_strings":["RACE, REVA University, Bengaluru, Karnataka, 560064, India"],"raw_orcid":"https://orcid.org/0000-0002-6733-7535","affiliations":[{"raw_affiliation_string":"RACE, REVA University, Bengaluru, Karnataka, 560064, India","institution_ids":["https://openalex.org/I83737708"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5023646723","display_name":"Rashmi Agarwal","orcid":"https://orcid.org/0000-0003-1778-7519","observed_orcids":["https://orcid.org/0000-0003-1778-7519"]},"institutions":[{"id":"https://openalex.org/I83737708","display_name":"REVA University","ror":"https://ror.org/03gtcxd54","country_code":"IN","type":"education","lineage":["https://openalex.org/I83737708"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"Rashmi Agarwal","raw_affiliation_strings":["RACE, REVA University, Bengaluru, Karnataka, 560064, India"],"raw_orcid":"https://orcid.org/0000-0003-1778-7519","affiliations":[{"raw_affiliation_string":"RACE, REVA University, Bengaluru, Karnataka, 560064, India","institution_ids":["https://openalex.org/I83737708"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5110969478","https://openalex.org/A5133484551"],"corresponding_institution_ids":["https://openalex.org/I83737708"],"apc_list":{"value":2690,"currency":"USD","value_usd":2690},"apc_paid":{"value":2690,"currency":"USD","value_usd":2690},"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.72702614,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"16","issue":"1","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9970999956130981,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9970999956130981,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.00039999998989515007,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.00019999999494757503,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/cloud-security","display_name":"cloud security","score":0.7229999899864197},{"id":"https://openalex.org/keywords/intrusion-detection","display_name":"intrusion detection","score":0.9070000052452087},{"id":"https://openalex.org/keywords/human-in-the-loop-annotation","display_name":"human-in-the-loop annotation","score":0.671999990940094},{"id":"https://openalex.org/keywords/inter-annotator-agreement","display_name":"inter-annotator agreement","score":0.7760000228881836},{"id":"https://openalex.org/keywords/random-forest","display_name":"random forest","score":0.6119999885559082},{"id":"https://openalex.org/keywords/feature-leakage","display_name":"feature leakage","score":0.44699999690055847},{"id":"https://openalex.org/keywords/adversarial-robustness","display_name":"adversarial robustness","score":0.32100000977516174},{"id":"https://openalex.org/keywords/adversarial-examples","display_name":"adversarial examples","score":0.42800000309944153},{"id":"https://openalex.org/keywords/adversarial-training","display_name":"adversarial training","score":0.5509999990463257},{"id":"https://openalex.org/keywords/adversarial-perturbations","display_name":"adversarial perturbations","score":0.33799999952316284}],"concepts":[{"id":"https://openalex.org/C191267431","wikidata":"https://www.wikidata.org/wiki/Q911932","display_name":"Honeypot","level":2,"score":0.8690000176429749},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7459999918937683},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.6251999735832214},{"id":"https://openalex.org/C133462117","wikidata":"https://www.wikidata.org/wiki/Q4929239","display_name":"Data collection","level":2,"score":0.6090999841690063},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.37880000472068787},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.3449999988079071},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.30070000886917114},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.28290000557899475},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.23319999873638153},{"id":"https://openalex.org/C3018127295","wikidata":"https://www.wikidata.org/wiki/Q5246046","display_name":"Research article","level":2,"score":0.22120000422000885}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1038/s41598-026-72812-4","doi":"https://doi.org/10.1038/s41598-026-72812-4","is_oa":true,"landing_page_url":"https://doi.org/10.1038/s41598-026-72812-4","pdf_url":"https://www.nature.com/articles/s41598-026-72812-4_reference.pdf","source":{"id":"https://openalex.org/S196734849","display_name":"Scientific Reports","issn_l":"2045-2322","issn":["2045-2322"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-class-a","anvur-scientific","cwts-core","doaj","dongbi-c","doyens","jufo-1","ki-jl-1","medline","norway-1","poland-140","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310319908","host_organization_name":"Nature Portfolio","host_organization_lineage":["https://openalex.org/P4310319908","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Nature Portfolio","Springer Nature"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Scientific Reports","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1038/s41598-026-72812-4","doi":"https://doi.org/10.1038/s41598-026-72812-4","is_oa":true,"landing_page_url":"https://doi.org/10.1038/s41598-026-72812-4","pdf_url":"https://www.nature.com/articles/s41598-026-72812-4_reference.pdf","source":{"id":"https://openalex.org/S196734849","display_name":"Scientific Reports","issn_l":"2045-2322","issn":["2045-2322"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-class-a","anvur-scientific","cwts-core","doaj","dongbi-c","doyens","jufo-1","ki-jl-1","medline","norway-1","poland-140","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310319908","host_organization_name":"Nature Portfolio","host_organization_lineage":["https://openalex.org/P4310319908","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Nature Portfolio","Springer Nature"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Scientific Reports","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7220654762.pdf","grobid_xml":"https://content.openalex.org/works/W7220654762.grobid-xml"},"referenced_works_count":42,"referenced_works":["https://openalex.org/W2109026747","https://openalex.org/W2164777277","https://openalex.org/W2512166484","https://openalex.org/W2607460355","https://openalex.org/W2884019276","https://openalex.org/W3014732532","https://openalex.org/W3152342827","https://openalex.org/W3180062783","https://openalex.org/W3207029297","https://openalex.org/W4252684946","https://openalex.org/W4285227013","https://openalex.org/W4383619745","https://openalex.org/W4385658612","https://openalex.org/W4386865612","https://openalex.org/W4387998273","https://openalex.org/W4399973658","https://openalex.org/W4403760382","https://openalex.org/W4404716900","https://openalex.org/W4405444728","https://openalex.org/W4406902302","https://openalex.org/W4407128941","https://openalex.org/W4409052567","https://openalex.org/W4409566604","https://openalex.org/W4409681853","https://openalex.org/W4409800460","https://openalex.org/W4409904252","https://openalex.org/W4410225732","https://openalex.org/W4410246017","https://openalex.org/W4410965754","https://openalex.org/W4411845063","https://openalex.org/W4415528061","https://openalex.org/W4417500862","https://openalex.org/W7125161716","https://openalex.org/W7125203466","https://openalex.org/W7127182858","https://openalex.org/W7128192062","https://openalex.org/W7128405242","https://openalex.org/W7130944294","https://openalex.org/W7131112976","https://openalex.org/W7132845283","https://openalex.org/W7139985584","https://openalex.org/W7168571271"],"related_works":["https://openalex.org/W7216882288","https://openalex.org/W7162848176","https://openalex.org/W7162662484","https://openalex.org/W4285280209","https://openalex.org/W7206162987","https://openalex.org/W2245372675","https://openalex.org/W7154445616","https://openalex.org/W7162208195","https://openalex.org/W7203811729","https://openalex.org/W4416004722"],"abstract_inverted_index":{"Modern":[0],"computing":[1,15],"systems":[2,60],"are":[3,36,114],"increasingly":[4],"vulnerable":[5,27],"owing":[6],"to":[7,56,337],"their":[8],"development":[9],"using":[10,147,157],"distributed":[11],"techniques,":[12],"such":[13],"as":[14,143,291,308,368],"infrastructure,":[16],"and":[17,32,69,85,113,131,145,161,172,204,209,236,282,346,364],"the":[18,64,72,134,153,158,181,185,233,247,260,279,301,309,318,328,360],"growing":[19,54],"reliance":[20],"on":[21,196,201,206,341,359],"cloud":[22,93,344],"computing.":[23],"Intruders":[24],"frequently":[25],"breach":[26],"network":[28],"services,":[29],"authentication":[30],"schemes,":[31],"applications.":[33],"Traditional":[34],"IDSs":[35],"largely":[37],"signature-based,":[38],"making":[39],"them":[40],"less":[41],"effective":[42],"in":[43,71,91,110,317],"detecting":[44],"new":[45],"or":[46,311],"unknown":[47],"attack":[48],"patterns.":[49],"Consequently,":[50],"there":[51,322],"is":[52,102,288],"a":[53,81,87,92,148,167,197,221,355,369],"need":[55],"develop":[57],"smart":[58],"adaptive":[59],"that":[61,108,258],"can":[62,334],"understand":[63],"realistic":[65,118],"behavior":[66],"of":[67,137,152,224,253,320],"attackers":[68],"assist":[70],"automatic":[73],"threat":[74],"detection.":[75],"In":[76],"this":[77],"study,":[78],"we":[79],"present":[80],"framework":[82,101,333],"for":[83,95,116,133,166,376],"designing":[84],"deploying":[86],"multi-service":[88],"honeypot":[89,106,362],"environment":[90],"infrastructure":[94],"high-fidelity":[96],"cyber-attack":[97],"data":[98,119,160,340],"collection.":[99],"The":[100,150,175,270,332,351],"built":[103],"around":[104],"ten":[105,234],"services":[107,235],"vary":[109],"many":[111],"aspects":[112],"well-suited":[115],"collecting":[117],"from":[120],"external":[121],"attackers.":[122],"Over":[123],"21":[124],"days,":[125],"10,900":[126],"interaction":[127],"sessions":[128,226],"were":[129,141,155],"received":[130],"labelled":[132],"proposed":[135],"environment;":[136],"these,":[138],"5406":[139],"(49.6%)":[140],"classified":[142],"malicious":[144],"validated":[146],"human-in-the-loop.":[149],"capabilities":[151],"models":[154],"assessed":[156],"collected":[159],"12":[162,186],"machine":[163],"learning":[164],"algorithms":[165],"binary":[168],"classification":[169],"task":[170],"(malicious":[171],"Benign-Noise":[173],"sessions).":[174],"Random":[176],"Forest":[177],"(RF)":[178],"classifier":[179],"was":[180,323,365],"top-ranked":[182],"model":[183,248],"among":[184],"models.":[187],"Under":[188],"leakage-controlled":[189],"evaluation,":[190],"it":[191],"achieved":[192,249],"F1":[193,210,251,267],"=":[194,211,245,268],"84.3%":[195],"temporal":[198],"holdout":[199],"(trained":[200],"days":[202,207],"1\u201317":[203],"tested":[205],"18\u201321)":[208],"85.9%":[212],"under":[213,273],"source":[214,286],"IP":[215],"grouped":[216],"(group":[217],"K-fold)":[218],"validation.":[219],"On":[220],"blinded":[222],"relabelling":[223],"500":[225],"(sampled":[227],"by":[228,239,285,300],"stratified":[229,276],"random":[230],"selection":[231],"across":[232],"both":[237],"classes)":[238],"two":[240,261],"independent":[241],"annotators":[242],"(inter-annotator":[243],"\u03ba":[244],"0.84),":[246],"an":[250,292],"score":[252],"84.1%.":[254],"A":[255],"further":[256],"control":[257],"removes":[259],"rule-overlapping":[262],"features":[263,281],"(suspicious_keyword_hits,":[264],"ip_reputation_score)":[265],"yields":[266],"83.8%.":[269],"87.5%":[271],"obtained":[272],"standard":[274],"10-fold":[275],"cross-validation":[277],"(retaining":[278],"rule":[280],"without":[283],"grouping":[284],"IP)":[287],"reported":[289],"only":[290],"optimistic":[293],"upper":[294],"bound,":[295],"approximately":[296],"3.2":[297],"pp":[298],"inflated":[299],"same":[302],"campaign":[303],"session":[304],"overlap,":[305],"rather":[306],"than":[307,373],"primary":[310],"baseline":[312,370],"figure.":[313],"After":[314],"Bonferroni":[315],"correction":[316],"spirit":[319],"Nadeau\u2013Bengio,":[321],"no":[324],"significant":[325],"difference":[326],"between":[327],"best":[329],"ensemble":[330],"trees.":[331],"be":[335],"reproduced":[336],"collect":[338],"real":[339],"attacks":[342],"against":[343],"honeypots":[345],"assess":[347],"intelligent":[348],"intrusion-detection":[349],"approaches.":[350],"system":[352,372],"also":[353],"recorded":[354],"10.4%":[356],"false-negative":[357],"rate":[358],"near-balanced":[361],"dataset":[363],"designed":[366],"more":[367],"research":[371],"one":[374],"intended":[375],"production":[377],"use.":[378]},"counts_by_year":[],"updated_date":"2026-11-08T12:12:28.789561","created_date":"2026-10-07T00:00:00"}