Exploring the Landscape of Honeypots in the Fight Against Cyber Threats: A Systematic Mapping of Literature

The steady increase in cyber threats highlights the need to strengthen cybersecurity defenses. In this context, honeypots emerge as crucial tools for detecting and mitigating such threats. A honeypot is a computer decoy that simulates having certain vulnerabilities that are attractive to a cybercriminal, allowing observation and analysis of the attack and the techniques used on the decoy. This article presents a systematic literature review of honeypots, analyzing the most commonly used characteristics and protocols following the PRISMA guidelines. A total of 258 scientific articles were reviewed, with 17 of them analyzed in depth. The results showed that the most commonly used protocols were HTTP and HTTPS, and the areas with the most available honeypots are those related to web applications and IoT devices. Additionally, lists have been compiled grouping honeypots by field of action, type of interaction, and protocol, with the aim of identifying aspects of honeypot development that require further investigation in future researches.