Paper

LLM Honeypot: Leveraging Large Language Models as Advanced Interactive Honeypot Systems

Presents an interactive honeypot using a language model fine-tuned with attacker command data.

HoneypotNetwork

Evidence limits

The evaluation is limited and does not establish long-term fingerprint resistance or production cost.

Reviewed: Full text.

Full-text review · 2026-09-16

Design and scope

SSH honeypot prototype using an open model fine-tuned on malicious commands.

Main finding

Shows a route to interactive responses and richer session recording.

Evidence limits

The evaluation is limited and does not establish long-term fingerprint resistance or production cost.

Sources and provenance

  1. LLM Honeypot: Leveraging Large Language Models as Advanced Interactive Honeypot Systems
    Full text · 2026-09-16

Reviewed: 2026-09-16. This record may change when new evidence is found.

RIS · BibTeX

Related resources

Open software—

Cowrie

Material reviewed: Repository metadataCritical reading

SSH and Telnet honeypot that records login attempts and attacker sessions.

NetworkHoneypot
Open software—

Galah

Material reviewed: Repository metadataCritical reading

Web honeypot using a language model to generate interactions.

ApplicationHoneypot