Adaptive Deception Architectures: Conceptual Foundations for LLM-Powered Honeypot Systems
Abstract
Conventional honeypot systems lack the dynamic adaptability required to counter evolving cyber threats, necessitating innovative approaches to automated deception. Building on foundational research from my diploma work in adaptive defense mechanisms, this paper proposes a conceptual architecture integrating large language models with next-generation honeypot systems. The framework establishes three pillars of intelligent deception: context-aware interaction through multi-modal dialogue processing that maintains service-specific personas, dynamic environment morphing guided by real-time attacker behavior analysis, and automated artifact generation creating credible system fingerprints. Security safeguards embedded in the design include adversarial prompt hardening and operational sandboxing to mitigate model exploitation risks. Experimental evaluations show marked improvements in attacker engagement compared to conventional rule-based systems, with generated responses demonstrating high plausibility during simulated advanced threat scenarios. This architecture advances adaptive cyber deception by enabling autonomous response calibration while addressing fingerprinting vulnerabilities inherent in traditional honeypot implementations, laying groundwork for intelligent defense systems capable of organic interaction with malicious actors.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
LLM-LDAP honeypots and adaptive deception architectures use LLM-driven response generation to sustain attacker engagement orders of magnitude longer than traditional honeypots.
“LLM-LDAP honeypots and adaptive deception architectures [126,128] use LLMdriven response generation to sustain attacker engagement orders of magnitude longer than traditional honeypots.”
From Agentic AI and Large Language Models for Autonomous IoT Cybersecurity: A Systematic Survey, Taxonomy, and Research Roadmap (2026) · cites this paper as [126]
LLM-powered honeypots generate context-aware, dynamic responses that sustain attacker engagement orders of magnitude longer than their predecessors.
“LLM-powered honeypots generate context-aware, dynamic responses that sustain attacker engagement orders of magnitude longer than their predecessors [126,127].”
From Agentic AI and Large Language Models for Autonomous IoT Cybersecurity: A Systematic Survey, Taxonomy, and Research Roadmap (2026) · cites this paper as [126]
Cites
Evaluating large language models trained on code
Chen, M. (2024) · TIB Data Manager · doi:10.57702/wbv3e61b · Cited by 737 · see citing works
Measuring Mathematical Problem Solving With the MATH Dataset
Hendrycks, D., Burns, C., Kadavath, S., Arora, A., Basart, S., Tang, E., Song, D., & Steinhardt, J. (2021) · arXiv · doi:10.48550/arxiv.2103.03874 · Cited by 306 · see citing works
Threat Defense: Cyber Deception Approach and Education for Resilience in Hybrid Threats Model
Steingartner, W., Galinec, D., & Kozina, A. (2021) · Symmetry · doi:10.3390/sym13040597 · Cited by 99 · see citing works
LLM in the Shell: Generative Honeypots
Sladić, M., Valeros, V., Catania, C., & Garcia, S. (2024) · 2024 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) · doi:10.1109/eurospw61312.2024.00054 · Cited by 70 · see citing works
LLM Honeypot: Leveraging Large Language Models as Advanced Interactive Honeypot Systems
Otal, H. T., & Canbaz, M. A. (2024) · IEEE Conference on Communications and Network Security · doi:10.1109/cns62487.2024.10735607 · Cited by 42 · see citing works
Intelligent Threat Detection—AI-Driven Analysis of Honeypot Data to Counter Cyber Threats
Lanka, P., Gupta, K., & Varol, C. (2024) · Electronics · doi:10.3390/electronics13132465 · Cited by 40 · see citing works
On Designing Low-Risk Honeypots Using Generative Pre-Trained Transformer Models With Curated Inputs
Ragsdale, J., & Boppana, R. V. (2023) · IEEE Access · doi:10.1109/access.2023.3326104 · Cited by 36 · see citing works
A Comparison of an Adaptive Self-Guarded Honeypot with Conventional Honeypots
Touch, S., & Colin, J.-N. (2022) · Applied Sciences · doi:10.3390/app12105224 · Cited by 26 · see citing works
HoneyLLM: A Large Language Model-Powered Medium-Interaction Honeypot
Fan, W., Yang, Z., Liu, Y., Qin, L., & Liu, J. (2025) · Lecture Notes in Computer Science · doi:10.1007/978-981-97-8801-9_13 · Cited by 24 · see citing works
Naik, N., Shang, C., Jenkins, P., & Shen, Q. (2020) · IEEE Transactions on Emerging Topics in Computational Intelligence · doi:10.1109/tetci.2020.3023447 · Cited by 23 · see citing works
Tick, A., & Mai, P. T. (2024) · Acta Polytechnica Hungarica · doi:10.12700/aph.21.12.2024.12.7 · Cited by 15 · see citing works
Enhancing IT Security with LLM-Powered Predictive Threat Intelligence
Bokkena, B. (2024) · International Conference on Smart Electronics and Communication (ICOSEC) · doi:10.1109/icosec61587.2024.10722712 · Cited by 15 · see citing works
A Modular Generative Honeypot Shell
Johnson, S., Hassing, R., Pijpker, J., & Loves, R. (2024) · IEEE International Conference on Cyber Security and Resilience (CSR) · doi:10.1109/csr61664.2024.10679411 · Cited by 13 · see citing works
Improving CTF Event Organization: A Case Study on Utilizing Open Source Technologies
Érsok, M., Erdődi, L., Balogh, Á., & Bánáti, A. (2024) · IEEE World Symposium on Applied Machine Intelligence and Informatics (SAMI) · doi:10.1109/sami60510.2024.10432885 · Cited by 6 · see citing works
Self-citationHoneypot optimization based on CTF game
Balogh, Á., Érsok, M., Erdődi, L., Szarvák, A., Kail, E., & Bánáti, A. (2022) · IEEE World Symposium on Applied Machine Intelligence and Informatics (SAMI) · doi:10.1109/sami54271.2022.9780835 · Cited by 6 · see citing works
Self-citationThe power of generative AI in cybersecurity: Opportunities and challenges
Wen, S. (2024) · Applied and Computational Engineering · doi:10.54254/2755-2721/48/20241095 · Cited by 5 · see citing works
Security Implications of Computer Botnets
Gyányi, S. (2024) · Acta Polytechnica Hungarica · doi:10.12700/aph.21.3.2024.3.11 · Cited by 5 · see citing works
Measuring Honeypots based on CTF game
Érsok, M., Balogh, Á., Erdődi, L., Kozlovszky, M., Kail, E., & Bánáti, A. (2022) · IEEE International Conference on Computational Cybernetics (ICCC) · doi:10.1109/iccc202255925.2022.9922853 · Cited by 2 · see citing works
Self-citationConsumption of Technical Threat Intel Indicators
Gyebnár, G., & Magyar, S. (2025) · IEEE World Symposium on Applied Machine Intelligence and Informatics (SAMI) · doi:10.1109/sami63904.2025.10883294 · Cited by 1 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Nageshwaran, V., & Ezekiel, S. (2026) · Electronics · doi:10.3390/electronics15122740 · Cited by 4 · see citing works
“LLM-powered honeypots generate context-aware, dynamic responses that sustain attacker engagement orders of magnitude longer than their predecessors [126,127].”
Kashyapi, Y. V., & Yamini, B. (2026) · International Conference on Augmented Intelligence and Sustainable Systems (ICAISS) · doi:10.1109/icaiss68683.2026.11526463
- Authors
- Érsok, M., Balogh, Á., Kail, E., & Bánáti, A.
- Affiliations
- Eötvös Loránd University (HU)
- Venue
- 2025 IEEE 19th International Symposium on Applied Computational Intelligence and Informatics (SACI)
- Publisher
- IEEE
- Published
- 2025-05-19
- Pages
- 01-06
- OpenAlex
- W4411552797
- Cited by
- 2
- References
- 19
- Citations by year
- 2026: 2
- FWCI
- 2.49
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- IEEE International Symposium on Applied Computational Intelligence and Informatics (SACI) (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Keywords
- large language models, adaptive defense, attacker behavior analysis, sandboxing
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
