HoneyGuard: A Lightweight Honeytoken-Based Behavioural Ransomware Early-Warning and Controlled…

A conceptual and empirical cybersecurity study on honeytoken-assisted ransomware detection, behavioural risk scoring, and controlled endpoint response.

DISSANAYAKE D M H W, Heshan S.H.H, KAIF M.N.M, Imsara S.A.L Department of Cybersecurity, Sri Lanka Institute of Information Technology (SLIIT)

Full Research Paper (PDF):https://drive.google.com/file/d/14EjH5qXl5Dveq_WgyvMqtvZed_VjSEy_/view?usp=drive_link

Abstract

Ransomware remains one of the most disruptive cybersecurity threats because it can encrypt large numbers of files within a very short period of time. Traditional signature-based antivirus solutions are effective against known malware but may fail to identify new, modified, or previously unseen ransomware variants during the early stages of an attack.

HoneyGuard was developed as a lightweight ransomware early-warning and controlled containment system that combines honeytoken-based deception with behavioural monitoring. The system deploys realistic decoy files, continuously monitors protected directories, analyses suspicious filesystem activity, calculates a weighted risk score, generates alerts, and records incident-response actions.

The prototype was implemented using Python, the Watchdog filesystem monitoring framework, psutil for process-related telemetry, MySQL/MariaDB for persistence, and a PHP-based Security Operations Center dashboard. Evaluation was performed using seven controlled test scenarios, five trials per scenario, producing 35 empirical benchmark runs and 140 telemetry measurements. The final automated test suite contained 30 tests, all of which passed successfully. The results demonstrate that HoneyGuard can provide a practical additional layer of ransomware detection for controlled endpoint environments while maintaining a relatively lightweight operational footprint.

Keywords: Ransomware, Honeytokens, Canary Files, Behavioural Detection, Cyber Deception, Endpoint Security, Incident Response, HoneyGuard

1. Introduction

Ransomware attacks can cause significant financial and operational damage by encrypting files and preventing organisations from accessing critical information. One of the main challenges in ransomware defence is identifying malicious activity early enough to respond before large-scale encryption occurs.

Traditional endpoint security products commonly rely on malware signatures, hashes, known indicators of compromise, and threat intelligence. Although these techniques remain important, they can become less effective when ransomware binaries are modified, repackaged, or newly developed.

Behaviour-based ransomware detection attempts to solve this problem by observing what a process does rather than only identifying what the executable looks like. Indicators may include rapid file modification, repeated renaming, suspicious extension changes, abnormal content entropy, and interaction with important files.

HoneyGuard extends this idea by introducing honeytokens, also referred to as canary or decoy files. These are synthetic files deliberately placed inside protected directories. Legitimate users and applications should normally have no reason to interact with them. Therefore, unexpected access or modification of a decoy can provide an early and high-value security signal.

The objective of HoneyGuard is not to replace antivirus, EDR, backups, or existing incident-response mechanisms. Instead, it is designed to operate as an additional lightweight detection layer capable of identifying suspicious filesystem behaviour and supporting early response.

2. Research Problem and Gap

Signature-based security mechanisms are highly effective when the malware is already known. However, they may not always provide sufficient early-stage protection against zero-day or heavily modified ransomware.

General behavioural monitoring can detect previously unknown attacks, but monitoring every system activity may generate large volumes of telemetry and increase false positives.

Honeytoken-only solutions provide a strong security indicator because legitimate processes should not normally modify decoys. However, a honeytoken alert alone may provide limited behavioural context.

HoneyGuard addresses this gap by combining:

• honeytoken interaction,
• rapid filesystem activity,
• rename or extension-change behaviour,
• entropy-related indicators,
• weighted risk scoring, and
• controlled, auditable incident response.

The research therefore investigates whether a lightweight combination of deception and behavioural analysis can provide useful ransomware early warning without requiring a complex enterprise endpoint platform.

3. Research Questions

The project was developed around four main research questions:

RQ1: How effectively can honeytokens identify ransomware-like filesystem activity at an early stage?

RQ2: How accurately can the system distinguish ransomware-like behaviour from legitimate file activity?

RQ3: What detection time and endpoint resource overhead are produced by the proposed approach?

RQ4: How effectively can the response mechanism reduce or control further file modification during a controlled ransomware-like simulation?

4. Methodology

HoneyGuard follows a closed detection-and-response lifecycle:

Decoy Generation → Protected Directory Monitoring → Behaviour Analysis → Risk Scoring → Alert Generation → Response → Incident Logging

4.1 Honeytoken Generation

HoneyGuard creates realistic synthetic decoy files that resemble normal organisational documents.

During the final demonstration environment, eight canaries were deployed across four example business areas:

• Finance
• Human Resources
• Legal
• General

Example decoys included files such as:

• Employee_Salary_2026.xlsx
• Financial_Forecast_2027.xlsx
• Bank_Account_Summary.xlsx
• Confidential_HR_Report.docx
• Legal_Agreement_Draft.pdf
• Management_Notes.txt

These files contain synthetic data only and do not contain real confidential information.

4.2 Real-Time Filesystem Monitoring

The monitoring layer was implemented using Python and the Watchdog library.

It captures filesystem events such as:

• create,
• modify,
• rename,
• move, and
• delete.

Each security-relevant event is recorded in the MySQL database and displayed through the HoneyGuard SOC interface.

A benign test demonstrated that normal file modifications were successfully logged with a risk contribution of zero rather than being automatically classified as ransomware.

4.3 Behavioural Risk Scoring

HoneyGuard evaluates multiple behavioural indicators and combines them into a weighted score.

The prototype uses the following conceptual weights:

• Honeytoken interaction: 40
• High-frequency file activity: 25
• Suspicious rename or extension change: 20
• High-entropy content behaviour: 18

A configured threshold of 70 is used to distinguish high-risk events.

For example, during the controlled TC06 simulation, all four indicators contributed to a composite score of:

40 + 25 + 20 + 18 = 103

Because the score exceeded the threshold, HoneyGuard generated a CRITICAL security alert.

4.4 Alerting and Incident Response

When the calculated risk exceeds the configured threshold, an alert is generated and stored in the database.

The alert record contains information including:

• alert ID,
• risk level,
• risk score,
• target process,
• PID,
• affected file or canary,
• matched indicators,
• timestamp, and
• status.

For safe academic testing, containment was performed in a controlled LOG_ONLY mode during benchmark scenarios. This allowed the complete detection and response workflow to be demonstrated without terminating legitimate processes on the test machine.

Each confirmed incident was also assigned a unique forensic incident identifier and stored in the incident log.

5. System Architecture

HoneyGuard consists of several integrated components:

1. Decoy Generation Layer Creates and registers synthetic honeytoken files.

2. Filesystem Monitoring Layer Captures real-time file events from protected directories.

3. Detection and Risk Engine Evaluates behavioural indicators and computes the overall risk score.

4. Alert and Response Layer Generates security alerts and performs controlled response actions.

5. MySQL Persistence Layer Stores decoys, filesystem events, alerts, incidents, response actions, and benchmark measurements.

6. SOC Web Interface Provides the administrator with dashboards for file monitoring, alerts, decoys, incident logs, and empirical benchmarks.

Insert HoneyGuard architecture diagram here

6. Experimental Evaluation

HoneyGuard was evaluated inside a controlled demonstration environment using synthetic files only.

Seven test scenarios were defined:

TC01 — Single Decoy Modification Tests direct canary tampering.

TC02 — Multiple Decoy Rapid Access Simulates sequential interaction with several decoy files.

TC03 — High-Entropy Rapid File Renaming Simulates ransomware-like extension and rename behaviour.

TC04 — Legitimate Batch Processing Acts as a false-positive test using benign high-volume filesystem activity.

TC05 — Slow/Stealthy Ransomware Decoy Probing Tests whether lower-frequency suspicious activity can still be identified.

TC06 — Mass File Encryption and Containment Simulates high-risk ransomware-like behaviour and response.

TC07 — Resource Overhead and Baseline Stress Test Evaluates the operational performance of the prototype.

Each test case was executed five times, resulting in:

• 35 benchmark runs
• 140 telemetry measurements

7. Results

The final clean benchmark execution produced the following key results.

Detection Timing

The measured scenario timings included:

• TC04 Legitimate Batch Processing: approximately 147.60 ms
• TC05 Stealthy Ransomware Decoy Probing: approximately 180.04 ms
• TC06 Mass File Encryption and Containment: approximately 455.00 ms

The dashboard reported an overall mean detection-related timing of approximately 196 ms for the evaluated benchmark set.

Resource Usage

The memory footprint during the clean benchmark was approximately:

83.3–83.4 MB

Measured scenario CPU utilisation remained low, with observed mean CPU usage reaching approximately:

0.62%

These results support the objective of developing a lightweight endpoint-oriented prototype.

Alert Generation

During the controlled ransomware-like scenario, HoneyGuard generated a CRITICAL alert with a risk score of:

103

The alert included the associated python.exe process, PID, affected canary, matched behavioural indicators, timestamp, and active status.

Incident Logging

The generated alert was also persisted as a forensic incident containing:

• unique incident ID,
• detection timestamp,
• severity,
• affected path,
• process and PID,
• containment status.

This provides an auditable trail that can support later investigation.

Automated Testing

The final automated test suite contained:

30 tests

The tests covered:

• database connectivity,
• decoy persistence,
• file-event persistence,
• alert insertion,
• incident and response transactions,
• foreign-key enforcement,
• SQL-injection defence,
• end-to-end detection,
• TC01–TC07 scenarios,
• containment safeguards,
• TXT/PDF/DOCX/XLSX decoy generation,
• file integrity validation,
• entropy detection,
• honeytoken detection,
• suspicious extension detection,
• risk calculation,
• sandbox path validation, and
• incident-ID sanitisation.

Final result:

30/30 tests passed successfully in 7.31 seconds.

Insert benchmark graph here

8. Discussion

The results demonstrate that honeytoken interaction can act as a strong signal when combined with behavioural context.

A normal file modification test was successfully recorded by the monitoring subsystem without generating ransomware risk. This is important because an effective ransomware detection system must not classify every filesystem change as malicious.

In contrast, the controlled TC06 scenario combined several indicators, including decoy interaction, high-frequency activity, suspicious extension behaviour, and entropy-related signals. This produced a composite risk score of 103, resulting in a critical alert.

The benchmark results also indicate that the prototype can operate with relatively low resource consumption in the evaluated environment. The approximately 83 MB memory footprint and low measured CPU utilisation suggest that the design is suitable for further development as a lightweight endpoint-security add-on.

However, the prototype should not be interpreted as a replacement for commercial EDR or antivirus platforms. Its primary contribution is the integration of targeted deception, behavioural scoring, alerting, and auditable response within a lightweight student-developed security architecture.

9. Security and Ethical Considerations

All ransomware-related experiments were performed using safe synthetic simulations.

No real ransomware was executed against production systems.

Testing was restricted to:

• the HoneyGuard project workspace,
• synthetic documents,
• controlled Python simulation scripts, and
• authorized local test environments.

The containment workflow was also designed to support safe testing through LOG_ONLY response modes.

This approach reduced the risk of accidental damage while still allowing the full detection and incident-management pipeline to be evaluated.

10. Limitations

HoneyGuard currently has several limitations.

First, it is a prototype evaluated primarily in a controlled single-host environment rather than a large enterprise network.

Second, ransomware that completely avoids deployed decoy files could reduce the value of the honeytoken signal.

Third, behavioural thresholds may require additional tuning to support different systems and organisational workloads.

Fourth, process attribution is dependent on operating-system telemetry and may not always identify the source process for every filesystem event.

Finally, the current SOC platform is designed for local deployment and would require additional development for centralized enterprise monitoring.

11. Future Work

Future versions of HoneyGuard can be extended through:

• centralized multi-endpoint monitoring,
• SIEM integration,
• EDR integration,
• adaptive honeytoken placement,
• machine-learning-based behavioural scoring,
• dynamic risk thresholds,
• improved process attribution,
• automated quarantine,
• alert notification through email or messaging services, and
• enterprise policy management.

Further evaluation should also include a larger range of benign workloads and authorized ransomware-behaviour datasets.

12. Conclusion

HoneyGuard demonstrates how honeytoken deception and lightweight behavioural monitoring can be combined to create an early-warning ransomware defence prototype.

The system successfully integrates realistic canary documents, real-time filesystem monitoring, behavioural indicators, weighted risk scoring, alert generation, forensic incident logging, MySQL persistence, and a web-based SOC dashboard.

The final implementation was validated through 35 empirical benchmark runs, 140 telemetry measurements, and 30 automated tests, all of which passed successfully.

The controlled ransomware-like evaluation produced a critical risk score of 103, while benign activity was monitored without automatically receiving ransomware risk. The clean benchmark reported approximately 196 ms overall mean detection-related timing, approximately 83 MB memory usage, and low measured CPU overhead.

These findings indicate that HoneyGuard provides a promising conceptual foundation for a low-cost, lightweight ransomware early-warning layer for small organisations, laboratories, educational institutions, and other resource-constrained environments.

References

Medium eke full references danna nam me short list eka use karanna puluwan:

[1] Cybersecurity and Infrastructure Security Agency (CISA), StopRansomware Guide.

[2] National Institute of Standards and Technology (NIST), guidance on ransomware risk management, prevention, response and recovery.

[3] MITRE ATT&CK, T1486: Data Encrypted for Impact.

[4] S. Alshamrani et al., "R-Sentry: Deception based ransomware detection using file access patterns," Computers & Electrical Engineering, 2022.

[5] N. Scaife et al., "CryptoLock (and Drop It): Stopping Ransomware Attacks on User Data," IEEE International Conference on Distributed Computing Systems, 2016.

[6] A. Kharraz et al., "UNVEIL: A Large-Scale, Automated Approach to Detecting Ransomware," USENIX Security Symposium, 2016.