PHANTOM: polymorphic honeytoken adaptation with narrative-tailored organisational mimicry contextually convincing cyber deception at scale

Abstract

Honeytokens, decoy digital assets planted to detect and attribute unauthorised access, are a well-established primitive in cyber deception. Existing generation tools produce static, template-based tokens that lack organisational specificity and are identifiable by statistical, syntactic, and semantic analysis. We introduce PHANTOM (polymorphic honeytoken adaptation with narrative-tailored organisational mimicry), a framework that generates contextually convincing honeytokens by encoding organisation-specific knowledge—domain names, service naming conventions, technology-stack idioms, and realistic secret-value distributions—into a multi-component generation pipeline. We formalise honeytoken quality through a four-component Believability Score that captures syntactic validity, semantic coherence, statistical plausibility, and human acceptance. We use this metric to evaluate PHANTOM across 8 token types and 4 organisational contexts against a template-based baseline. PHANTOM achieves $$B = 0.778 \pm 0.057$$ versus $$B = 0.576 \pm 0.058$$ for templates ( $$\Delta = +0.203$$ , $$t = 14.07$$ , $$p < 0.001$$ , Cohen’s $$d = 3.52$$ ). A heuristic human-acceptance proxy rises from $$6.2\%$$ to $$100\%$$ under a rule-based scoring threshold rather than an actual human-subjects study, and detection resistance (DR $$= 1 - P_d$$ ) improves from 0.609 to 0.870 across three simulated scanner models (regex, entropy analysis, and ML classifier), each with $$p < 0.001$$ . The semantic coherence gap ( $$\Delta S_c = +0.309$$ , $$d = 4.52$$ ) is the dominant driver, confirming the hypothesis that organisational context is the critical missing ingredient in current approaches. All results are reproduced without external API calls, making the pipeline fully deployable in air-gapped environments. The current evaluation is based on $$n=32$$ tokens per method (8 types $$\times $$ 4 organisational profiles, one instance per type—organisation pair); future work will extend this to larger, independently-replicated cohorts, real human-subject studies, and adversarial LLM-based scanners.