CyberdeceptionAtlas · Question → testES

Library / Paper

Paper

AdvancedShelLM: A Stateful Multi-Agent LLM Honeypot for SSH Deception

The authors present AdvancedShelLM, an LLM-based SSH honeypot using a multi-agent architecture (Manager and Worker) intended to improve command understanding and deceptive capability over its predecessor shelLM. According to the abstract, the system was evaluated through unit tests, an AI attacker, human attackers, and an Internet deployment.

HoneypotDecoyAdversary engagementNetworkEndpoint

What we know

The authors present AdvancedShelLM, an LLM-based SSH honeypot using a multi-agent architecture (Manager and Worker) intended to improve command understanding and deceptive capability over its predecessor shelLM. According to the abstract, the system was evaluated through unit tests, an AI attacker, human attackers, and an Internet deployment.

Evidence limits

This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the reported effectiveness has not been independently validated.

Reviewed: author abstract. Full-text results were not analyzed.

Sources and provenance

  1. AdvancedShelLM: A Stateful Multi-Agent LLM Honeypot for SSH Deception
    abstract · 2026-10-04

Reviewed: 2026-10-04. This record may change when new evidence is found.

RIS · BibTeX