  Attacks by Advanced Persistent Threats (APTs) have been shown to be difficult
to detect using traditional signature- and anomaly-based intrusion detection
approaches. Deception techniques such as decoy objects, often called honey
items, may be deployed for intrusion detection and attack analysis, providing
an alternative to detect APT behaviours. This work explores the use of honey
items to classify intrusion interactions, differentiating automated attacks
from those which need some human reasoning and interaction towards APT
detection. Multiple decoy items are deployed on honeypots in a virtual honey
network, some as breadcrumbs to detect indications of a structured manual
attack. Monitoring functionality was created around Elastic Stack with a Kibana
dashboard created to display interactions with various honey items. APT type
manual intrusions are simulated by an experienced pentesting practitioner
carrying out simulated attacks. Interactions with honey items are evaluated in
order to determine their suitability for discriminating between automated tools
and direct human intervention. The results show that it is possible to
differentiate automatic attacks from manual structured attacks; from the nature
of the interactions with the honey items. The use of honey items found in the
honeypot, such as in later parts of a structured attack, have been shown to be
successful in classification of manual attacks, as well as towards providing an
indication of severity of the attacks
