# Chatbots in a Honeypot World

arXiv: https://arxiv.org/abs/2301.03771 · HTML: https://mlsanity.com/paper/2301.03771/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- Builds on 4 of its 28 references that are in the map.
- First posted on arXiv 10 Jan 2023.

## Builds on (most cited first, 4 of 4)

- [Reasoning with Language Model Prompting: A Survey](https://mlsanity.com/paper/2212.09597/) (2022)
- [Targeted Phishing Campaigns using Large Scale Language Models](https://mlsanity.com/paper/2301.00665/) (2022)
- [Chatbots in a Botnet World](https://mlsanity.com/paper/2212.11126/) (2022)
- [A Survey on Honeypot Software and Data Analysis](https://mlsanity.com/paper/1608.06249/) (2016)

## Built on by (most cited first, 9 of 9)

- [Summary of ChatGPT-Related Research and Perspective Towards the Future of Large Language Models](https://mlsanity.com/paper/2304.01852/) (2023)
- [Large Language Models in Cybersecurity: State-of-the-Art](https://mlsanity.com/paper/2402.00891/) (2024)
- [LLM in the Shell: Generative Honeypots](https://mlsanity.com/paper/2309.00155/) (2023)
- [Evaluation of LLM Chatbots for OSINT-based Cyber Threat Awareness](https://mlsanity.com/paper/2401.15127/) (2024)
- [LLM Honeypot: Leveraging Large Language Models as Advanced Interactive Honeypot Systems](https://mlsanity.com/paper/2409.08234/) (2024)
- [Numeracy from Literacy: Data Science as an Emergent Skill from Large Language Models](https://mlsanity.com/paper/2301.13382/) (2023)
- [Scamming the Scammers: Using ChatGPT to Reply Mails for Wasting Time and Resources](https://mlsanity.com/paper/2303.13521/) (2023)
- [Grading Conversational Responses Of Chatbots](https://mlsanity.com/paper/2303.12038/) (2023)
- [AdvancedShelLM: A Stateful Multi-Agent LLM Honeypot for SSH Deception](https://mlsanity.com/paper/2606.27990/) (2026)

## Abstract (arXiv)

Question-and-answer agents like ChatGPT offer a novel tool for use as a potential honeypot interface in cyber security. By imitating Linux, Mac, and Windows terminal commands and providing an interface for TeamViewer, nmap, and ping, it is possible to create a dynamic environment that can adapt to the actions of attackers and provide insight into their tactics, techniques, and procedures (TTPs). The paper illustrates ten diverse tasks that a conversational agent or large language model might answer appropriately to the effects of command-line attacker. The original result features feasibility studies for ten model tasks meant for defensive teams to mimic expected honeypot interfaces with minimal risks. Ultimately, the usefulness outside of forensic activities stems from whether the dynamic honeypot can extend the time-to-conquer or otherwise delay attacker timelines short of reaching key network assets like databases or confidential information. While ongoing maintenance and monitoring may be required, ChatGPT's ability to detect and deflect malicious activity makes it a valuable option for organizations seeking to enhance their cyber security posture. Future work will focus on cybersecurity layers, including perimeter security, host virus detection, and data security.