DICOMHawk: A Cyber Deception Framework for Medical Imaging Infrastructure

Alberto Mongardini; Alexandra Babanuta; Emmanouil Vasilomanolakis; Georgios Theodoridis; Karina Elzer; Nawras Mouala; Ricardo Yaben

REVIEW 4 major objections 4 minor 16 references

DICOMHawk: A Cyber Deception Framework for Medical Imaging Infrastructure

T0 review · 4 major / 4 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A DICOM honeypot that mimics legitimate PACS software attracts more genuine attacker sessions than earlier low-interaction tools and surfaced 49 medical-specific attacks over a year.

desk verdict A credible, open-source DICOM honeypot with a year of field data, but the headline session-superiority claim is weakened by an asymmetric filter and tiny counts. read the letter →

arxiv 2607.15754 v1 pith:N3SG4EUK submitted 2026-07-17 cs.CR

Karina Elzer , Alberto Mongardini , Ricardo Yaben , Georgios Theodoridis , Alexandra Babanuta , Nawras Mouala , Emmanouil Vasilomanolakis This is my paper · ORCID

classification cs.CR

keywords DICOMhoneypotcyberdeceptionPACSmedicalimagingsecurityhoneytokenthreatintelligencehealthcareinfrastructure

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

DICOMHawk is a cyber-deception framework that poses as a hospital imaging (DICOM/PACS) server while actually observing attackers. The paper argues that realistic interaction—filling in a legitimate-looking DICOM signature, serving real but re-personalized medical images, and adding a PACS web interface with leaked credentials—makes the deception credible enough to attract more genuine DICOM sessions than the earlier Dicompot honeypot. Across an 86-day side-by-side comparison and a 347-day deployment in multiple locations, the authors report 47.52% more daily sessions in the cloud, 18.35% more locally, no honeypot fingerprinting by Shodan, and 49 medical-related attacks from 12 IPs. If right, this gives defenders a reproducible way to see how attackers probe medical imaging systems and shifts the field from low-interaction, easily detected honeypots to long-term, multi-vantage-point deception.

What carries the argument

The load-bearing object is the legitimate DICOM signature combined with a shared database between the DICOM server and the PACS web viewer. The signature fills the UserInfo fields—ImplementationClassUID and ImplementationVersionName—that Dicompot omits, letting the service pass association-time checks and evade automated fingerprinting. The shared database means an attacker querying via DIMSE and an attacker logging into the web UI see the same patient records, reinforcing the illusion. On top of this sit three active-deception mechanisms: dynamically rotated honeyrecords (real publicly available medical images with fake personas), PDF canary tokens embedded through Encapsulated PDF Storage

What would settle it

Run the 86-day comparison a second time while recording Dicompot sessions using the same valid-DICOM-request criterion DICOMHawk uses, and see whether the 47.52% (cloud) and 18.35% (local) session advantages persist; separately, deliberately open a canary-embedded PDF and visit a honeyURL to confirm the tracking pixel and landing server fire.

Watch

Extended reading notes

Core claim

The paper's central claim is that a deception system for DICOM can be built to be essentially indistinguishable from production imaging infrastructure while remaining instrumented enough to log high-fidelity attacker behavior. DICOMHawk does this by answering DICOM associations with a legitimate signature (real ImplementationClassUID and ImplementationVersionName, masquerading as a Fujifilm Synapse service), implementing the core DIMSE-C services so attackers can C-ECHO, C-FIND, C-GET, C-MOVE, and C-STORE, serving a PACS web interface seeded with honeycredentials and decoy paths, and populating storage with real-looking medical images re-tagged with fake personas and embedded PDF canary toke

Load-bearing premise

The session-count comparison rests on discarding Dicompot sessions that lack a client Implementation Version Name while counting DICOMHawk sessions that pass its own DICOM parser; if meaningful pre-DICOM reconnaissance or real queries can omit that optional field, the reported advantage partly reflects the counting rule rather than attacker preference.

Editorial extensions

If this is right

Deploying this open-source framework gives a healthcare defender a DICOM/PACS service that looks like production software—legitimate association signature, shared database, realistic images—without needing custom fake data, so deception can become a routine monitoring layer.
The year-long logs show the observed DICOM attack pattern is dominated by reconnaissance: 53 C-ECHO pings, 22 wildcard C-FIND queries across four IPs, and one targeted C-GET; no C-STORE or C-MOVE attempts were recorded during the deployment.
Multi-location deployment is not optional for coverage: unique-IP overlap was under roughly 17% between any two locations and about 12% between the DICOM and PACS endpoints, so a single vantage point sees only a small slice of the adversary population.
Medical-context credential pairs appear in real traffic (for example nurse/nurse@2020 and ortho/1234), and half of the distinct password clusters were medical-flavored, so this kind of deception separates healthcare-specific threats from generic internet noise.
Because the canary tokens and honeyURLs were never triggered during the deployment, their exfiltration-alerting value is demonstrated as a design capability rather than as an observed event.
A defender can now build a DICOM/PACS deception layer that looks like production software—legitimate association signature, shared database, realistic images—without custom fake data, making deception a routine monitoring option.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A normalized re-analysis is the first thing I would try: apply Dicompot's original per-connection logging rule to both honeypots and DICOMHawk's parse-based rule to both, to bracket how much of the 47.52%/18.35% advantage is measurement and how much is attacker preference.
The two endpoints catch essentially disjoint attacker sets (roughly 11.5% IP overlap), which hints that DIMSE-wire attackers and web-UI attackers are different populations; planting the same honeyrecord in both surfaces would test whether any single adversary works both.
Since the deployment saw no canary triggers, an obvious next experiment is a controlled red-team session that extracts an embedded PDF and follows a honeyURL, measuring trigger latency and false-alarm rate before relying on these tokens in production.
The credential clustering shows the vast majority of PACS login attempts were generic proxy/panel brute-forcing; filtering those clusters first in a future version would let defenders focus on the small set of medical-specific attempts, which is where the signal lives.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

DICOMHawk is a real piece of work with an honest skeleton: a higher-interaction DICOM/PACS honeypot, open-source implementation, and 347 days of field data. The parts that make it worth reading are the engineering choices — rotating records from TCIA, embedding PDF canaries, honeyURLs, a PACS facade, and a legitimate DICOM signature — and the fact that they actually deployed it in three places and compared against Dicompot. That is more than most honeypot papers do.

The central claim — that DH draws more valid sessions than DP — is plausible but not proven by the numbers. The stress-test concern is real: DP's logs are filtered by removing sessions that lack a client Implementation Version Name, while DH only counts sessions after it parses a valid DICOM request. That asymmetric filter is applied only to DP, and it is exactly the load-bearing piece for the 47% and 18% differences. If a meaningful share of DP's raw sessions were legitimate DICOM associations that happened to omit that optional field, the gap shrinks or disappears. The authors call it a heuristic, but they don't show how sensitive the comparison is to the filter. That is the main thing a referee should push on.

Also in proportion: the sample sizes are small (daily sessions 1–19; 4 C-ECHO and 4 C-FIND for DP in the comparison window), so the percentage differences have wide error bars even if the filtering is fair. No confidence intervals or tests. And the "49 medical-related attacks" is a mix of wildcard C-FINDs and 26 login attempts, with the authors themselves admitting one major contributor is likely an internet-wide research study. That tempers the threat narrative, though it doesn't erase the few genuinely interesting incidents, like the RadiAnt user from a residential ISP.

What the paper does well is transparency: they admit no canary fired, no honeycredentials were used, and the limitation section is honest. The Shodan finding is a nice concrete data point. The dataset and code are released, which makes this independently checkable — and that raises the paper above most in this niche.

Bottom line: this is a competent empirical systems paper, not a breakthrough, and not a fraud. A serious referee should take it, with specific requests: re-analyze DP's raw logs under a symmetric session definition, add sensitivity analysis for the filter, and report counts with intervals. I'd send it to peer review and be willing to cite the system and dataset in my own work.

Referee Report

4 major / 4 minor

Summary. The paper presents DICOMHawk (DH), an open-source deception framework that emulates a DICOM server and a PACS web interface, with dynamic honeyrecords, honeycredentials, canary tokens, and honeyURLs. The authors deployed DH and Dicompot (DP) on local and cloud networks for 347 days, including an 86-day side-by-side comparison, and report that DH attracted more valid sessions than DP (47.52% more daily sessions in cloud, 18.35% locally), avoided automated fingerprinting by Shodan/Censys, and captured 49 medical-related attacks. The paper also describes attacker behavior: C-FIND wildcard queries, medical-themed PACS login attempts, and low overlap between endpoints and locations.

Significance. If the measurement claims survive scrutiny, the paper is a useful contribution: it provides a long-term, multi-location dataset for medical-imaging honeypots, an open-source implementation, and a comparison against the previous state of the art. The observation that both automated and human adversaries interact with DICOM/PACS services is of interest to the healthcare security community. The authors are honest about several limitations, and the release of code and data is a clear strength that supports reproducibility. However, the central quantitative claims rely on small counts and an asymmetric session-definition filter, so the magnitude of the reported advantage is not yet established.

major comments (4)

[§5.1, Table 2] The headline comparison of valid sessions relies on an asymmetric session definition. DP logs are filtered to remove sessions lacking a client Implementation Version Name, whereas DH counts a session only after "receiving and successfully parsing a valid DICOM request." The Implementation Version Name is an optional User Information item in DICOM A-ASSOCIATE; legitimate clients may omit it, and the paper gives no evidence about its presence/absence across real DICOM implementations. Because the 47.52% and 18.35% deltas in Table 2 are the main quantitative evidence for DH superiority, this filter must be justified or applied symmetrically (e.g., run the same DICOM parser on raw DP logs, or report DH raw session counts before parser validation). With daily session counts of 1–19 and no confidence intervals, the percentage changes may not be statistically distinguishable.
[§6, Tables 5 and 8] The abstract/conclusion claim of "49 medical-related attacks" is computed from 23 DIMSE-C commands (Table 5) plus 26 medical-related failed login attempts (Table 8). This conflates low-level events with attacks: a single brute-force campaign can produce many attempts, and repeated identical credential pairs are each counted as a separate attack. The paper needs an explicit attack definition, deduplication per IP/campaign, and separation of automated reconnaissance, brute-force attempts, and any successful compromise. Without this, the headline number overstates the observed adversarial activity.
[§5.2–5.3, Tables 2–4] All cross-design and cross-location comparisons are reported without uncertainty or statistical testing. The session counts are tiny (1–19 daily sessions), DP logged only 4 C-ECHO and 4 C-FIND in the comparison window, and IP-overlap percentages in Table 4 are raw unique-IP overlaps with no consideration of scanning background. Statements such as "this disparity suggests that higher interaction fidelity ... significantly increase the likelihood of attacker engagement" are not yet supported. The authors should provide confidence intervals or a bootstrap/permutation-based test, and temper causal language.
[§7, Deployment Limitations] The paper's own limitations section concedes that neither the honeytokens were triggered nor the hidden credentials were used. As a result, the active-deception features (PDF canary tokens, honeyURLs, honeycredentials) are not validated by field observation; their detection value is currently speculative rather than demonstrated. The design is interesting, but the paper should not imply these features contributed to the measured outcomes.

minor comments (4)

[§3.1] Typographical and formatting issues: "legimitate" should be "legitimate"; "UserInfomandatory" is missing a space; the sentence about "values included in the UserInfo mandatory field" is unclear and should be rewritten.
[§4] The deployment timeline would benefit from a clearer statement of which instances were active at which times, especially the November–December 2025 logging gap and the exact relation between the 347-day total and the 86-day comparison window. Figure 2's shading is helpful but the text should make the intervals explicit.
[§5.2, Table 3] The term "attack" is used inconsistently across DIMSE commands, login attempts, and scanner traffic. The table also labels attacker/count fields with informal names (e.g., "University", "ISP DE") that should be defined or replaced with neutral identifiers in the main text.
[References] Several references appear incomplete or nonstandard (e.g., the Censys citation, the European Commission web citation, and the DICOM security web citation lack full bibliographic detail). The authors should align the reference list with the venue's citation guidelines.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the comparison is empirical and no prediction reduces to its input by construction.

full rationale

The paper's central claims—more valid sessions than Dicompot, scanner evasion, and 49 medical-related attacks—are obtained from long-term deployment measurements, not from a derivation in which an output is defined to be its own input. The main potential concern is the asymmetric session definition in Section 5.1: DH counts a session only after successfully parsing a valid DICOM request, while DP's raw logs are filtered by removing sessions lacking a client Implementation Version Name. This asymmetry is a genuine measurement-validity caveat for the headline 47.52%/18.35% session-superiority numbers, but it is not circularity: the filter is an external heuristic applied to DP data, and the comparison could in principle have gone the other way. The 'attacks' count is a classification of observed commands and credential patterns (e.g., C-FIND/C-GET as malicious, clustering of login dictionaries), not a fitted parameter or a quantity defined in terms of the conclusion. The only self-citation is the open dataset release (Elzer et al. 2026), which is not load-bearing for any technical claim. The paper also explicitly reports limitations—honeytokens were never triggered and hidden credentials were never used—which weaken the attack-capture evidence but do not indicate definitional circularity. No fitted input is presented as a prediction, no uniqueness theorem is imported from the authors' prior work, and no ansatz is smuggled in via self-citation. Under the stated rubric, the appropriate finding is no significant circularity.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The ledger is modest for an empirical systems paper: no physical invented entities, but the central comparison and attack labeling rest on a handful of domain assumptions and two ad hoc analytical thresholds (DP filtering, clustering distance).

free parameters (2)

DP noise filter heuristic = presence of client Implementation Version Name
Section 5.1: sessions without this parameter are removed from the DP dataset as non-DICOM noise; this threshold is applied only to DP and directly shapes the central session-count comparison.
Clustering distance threshold = 0.8
Section 6.2: agglomerative clustering with Jaccard similarity and distance threshold 0.8 is used to group password dictionaries into attack-pattern clusters, affecting the medical-related attack counts.

assumptions (4)

ad hoc to paper DICOM sessions lacking a client Implementation Version Name are non-DICOM noise and can be removed from comparison.
Section 5.1 introduces this heuristic to clean DP logs; its validity is assumed and is load-bearing for the headline comparison.
domain assumption Shodan/Censys classification is a reliable proxy for whether real adversaries can fingerprint a honeypot.
Section 5.4 uses Shodan tagging DP as 'Honeypot' and DH as 'Medical' to support the claim of avoiding detection, but scanner heuristics are not equivalent to adversary capability.
domain assumption TCIA records with injected fake metadata are indistinguishable from real patient records to attackers.
Section 3.3 assumes that dynamically populated honeyrecords increase realism and prevent fingerprinting; no direct test of indistinguishability is provided.
domain assumption Every DIMSE operation other than C-ECHO is an attack.
Section 6.1 states 'Except for C-ECHO, all other DIMSE commands can expose sensitive medical data; as such, we classify their execution as an attack.' This conflates reconnaissance and research scanning with malicious intent.

how reviews work

0 comments

Cite this review

Pith. "Pith review of DICOMHawk: A Cyber Deception Framework for Medical Imaging Infrastructure." pith.science (2026). https://pith.science/paper/N3SG4EUK

@misc{pith2026260715754,
  author       = {Pith},
  title        = {Pith review of: DICOMHawk: A Cyber Deception Framework for Medical Imaging Infrastructure},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/N3SG4EUK}},
  note         = {Machine review of arXiv:2607.15754}
}

read the original abstract

Cyber-attacks against exposed healthcare infrastructure threaten sensitive patient data and clinical operations, yet existing defensive tools for DICOM-based medical imaging systems provide limited interaction and are easily fingerprinted. We introduce DICOMHawk, a cyber-deception framework that emulates DICOM and PACS services using realistic interactions, dynamically populated medical records, and embedded honeytokens. In an 86-day comparison and a 347-day deployment across multiple networks, DICOMHawk attracted more valid sessions than Dicompot, avoided honeypot detection, and captured 49 medical-related attacks. The results show that realistic, long-term, multi-location deception improves visibility into threats targeting medical imaging systems.

Figures

Figures reproduced from arXiv: 2607.15754 by the authors.

**Figure 1.** DICOMHawk’s architecture, composed of a DICOM server, PACS interface, and database storage. Records are dynamically collected from TCIA and injected with PDF canary tokens and honey URLs [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗

**Figure 2.** Timelines showing the number of sessions observed per week over the year-long period by the different [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

16 extracted references

[1]

(2026, May)

Alder, S. (2026, May). Healthcare data breach statistics. https : / / www. hipaajournal . com / healthcare - data-breach-statistics/ Beltr´an-L´opez, P., Gil P´erez, M., & Nespoli, P. (2026). Cyber deception: Taxonomy, state of the art, frameworks, trends, and open challenges.IEEE Communications Surveys & Tutorials,28, 1520–1556

2026
[2]

Renuka, A. (2019). Security of medical big data images using decoy technique. 2019 International Conference on Automation, Computational and Technology Management (ICACTM), 310–314

2019
[3]

Bythwood, W., Bentley, J., & Vakilinia, I. (2023). Analyses of automated malicious internet traffic using open-source honeypots. SoutheastCon 2023, 68–75

2023
[4]

Cartwright, A. J. (2023). The elephant in the room: Cybersecurity in healthcare.Journal of Clinical Monitoring and Computing,37(5), 1123–1132

2023
[5]

Dragoni, N. (2026). A review of honeypots: Fingerprinting techniques, detection, and evasion mechanisms.Future Internet,18(4)

2026
[6]

(2025, January)

Commission, E. (2025, January). Cybersecurity in healthcare. https : / / commission . europa . eu / topics / digital - economy - and - society / cybersecurity-healthcare en

2025
[7]

Coventry, L., & Branley, D. (2018). Cybersecurity in healthcare: A narrative review of trends, threats and ways forward.Maturitas,113, 48–52

2018
[8]

Tarbox, L., Horn, R., & Horii, S. C. (2020). Dicom images have been hacked! now what? [PMID: 31770023].American Journal of Roentgenology,214(4), 727–735. Dicom security. (2026, January). https : / / www . dicomstandard.org/using/security

2020

Show all 16 references

[9]

Durumeric, Z., Clark, H., Cody, J., Cubit, E., Ellison, M., Izhikevich, L., & Mirian, A. (2025). Censys: A map of internet hosts and services. Proceedings of the ACM SIGCOMM 2025 Conference, 147–163

2025
[10]

Eichelberg, M., Kleber, K., & K ¨ammerer, M. (2020). Cybersecurity in pacs and medical imaging: An overview.Journal of Digital Imaging,33(6), 1527–1542

2020
[11]

Babanuta, A., Mouala, N., & Vasilomanolakis, E. (2026). Dataset for ”DICOMHawk: A Cyber Deception Framework for Medical Imaging Infrastructure”. https : / / doi . org / 10 . 5281 / zenodo.20698626

2026
[12]

Ihanus, J., & Kokkonen, T. (2020). Modelling medical devices with honeypots.Internet of Things, Smart Spaces, and Next Generation Networks and Systems: 20th International Conference, NEW2AN 2020, and 13th Conference, RuSMART 2020, St. Petersburg, Russia, August 26–28, 2020, Pr...

2020
[13]

R., Lim, C., & Silaen, K

Saputra, D. R., Lim, C., & Silaen, K. E. (2025). Improving threat intelligence in healthcare through a high interaction dicom honeypot. 2025 IEEE 2nd International Conference on

2025
[14]

Z., Ikram, M., Asghar, H., & Kaafar, D

Shah, Z. Z., Ikram, M., Asghar, H., & Kaafar, D. (2025). Deception meets diagnostics: Deception-based real-time threat detection in healthcare web systems.28th International Symposium on Research in Attacks, Intrusions and Defenses RAID 2025, 391–410

2025
[15]

Javadpour, A. (2022). Using honeypots to model botnet attacks on the internet of medical things.Computers and Electrical Engineering, 102, 108212

2022
[16]

Yazdanmehr, S. (2023). Millions of patient records at risk: The perils of legacy protocols. https : / / blackhat . com / eu - 23 / briefings / schedule / #millions - of - patient - records - at - risk - the - perils-of-legacy-protocols-34188

2023

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.

[1] [1]

(2026, May)

Alder, S. (2026, May). Healthcare data breach statistics. https : / / www. hipaajournal . com / healthcare - data-breach-statistics/ Beltr´an-L´opez, P., Gil P´erez, M., & Nespoli, P. (2026). Cyber deception: Taxonomy, state of the art, frameworks, trends, and open challenges.IEEE Communications Surveys & Tutorials,28, 1520–1556

2026

[2] [2]

Renuka, A. (2019). Security of medical big data images using decoy technique. 2019 International Conference on Automation, Computational and Technology Management (ICACTM), 310–314

2019

[3] [3]

Bythwood, W., Bentley, J., & Vakilinia, I. (2023). Analyses of automated malicious internet traffic using open-source honeypots. SoutheastCon 2023, 68–75

2023

[4] [4]

Cartwright, A. J. (2023). The elephant in the room: Cybersecurity in healthcare.Journal of Clinical Monitoring and Computing,37(5), 1123–1132

2023

[5] [5]

Dragoni, N. (2026). A review of honeypots: Fingerprinting techniques, detection, and evasion mechanisms.Future Internet,18(4)

2026

[6] [6]

(2025, January)

Commission, E. (2025, January). Cybersecurity in healthcare. https : / / commission . europa . eu / topics / digital - economy - and - society / cybersecurity-healthcare en

2025

[7] [7]

Coventry, L., & Branley, D. (2018). Cybersecurity in healthcare: A narrative review of trends, threats and ways forward.Maturitas,113, 48–52

2018

[8] [8]

Tarbox, L., Horn, R., & Horii, S. C. (2020). Dicom images have been hacked! now what? [PMID: 31770023].American Journal of Roentgenology,214(4), 727–735. Dicom security. (2026, January). https : / / www . dicomstandard.org/using/security

2020