DICOMHawk: A Cyber Deception Framework for Medical Imaging Infrastructure
Abstract
Cyber-attacks against exposed healthcare infrastructure threaten sensitive patient data and clinical operations, yet existing defensive tools for DICOM-based medical imaging systems provide limited interaction and are easily fingerprinted. We introduce DICOMHawk, a cyber-deception framework that emulates DICOM and PACS services using realistic interactions, dynamically populated medical records, and embedded honeytokens. In an 86-day comparison and a 347-day deployment across multiple networks, DICOMHawk attracted more valid sessions than Dicompot, avoided honeypot detection, and captured 49 medical-related attacks. The results show that realistic, long-term, multi-location deception improves visibility into threats targeting medical imaging systems.
Cite
@article{arxiv.2607.15754,
title = {DICOMHawk: A Cyber Deception Framework for Medical Imaging Infrastructure},
author = {Karina Elzer and Alberto Mongardini and Ricardo Yaben and Georgios Theodoridis and Alexandra Babanuta and Nawras Mouala and Emmanouil Vasilomanolakis},
journal= {arXiv preprint arXiv:2607.15754},
year = {2026}
}
Comments
10 pages, 3 figures