# LLM Honeypot: Leveraging Large Language Models as Advanced Interactive Honeypot Systems

arXiv: https://arxiv.org/abs/2409.08234 · HTML: https://mlsanity.com/paper/2409.08234/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- Builds on 11 of its 25 references that are in the map.
- First posted on arXiv 12 Sep 2024.

## Builds on (most cited first, 11 of 11)

- [LoRA: Low-Rank Adaptation of Large Language Models](https://mlsanity.com/paper/2106.09685/) (2021)
- [Llama 2: Open Foundation and Fine-Tuned Chat Models](https://mlsanity.com/paper/2307.09288/) (2023)
- [FlashAttention-2: Faster Attention with Better Parallelism and Work Partitioning](https://mlsanity.com/paper/2307.08691/) (2023)
- [Phi-3 Technical Report: A Highly Capable Language Model Locally on Your Phone](https://mlsanity.com/paper/2404.14219/) (2024)
- [LlamaFactory: Unified Efficient Fine-Tuning of 100+ Language Models](https://mlsanity.com/paper/2403.13372/) (2024)
- [Harnessing the Power of LLMs in Practice: A Survey on ChatGPT and Beyond](https://mlsanity.com/paper/2304.13712/) (2023)
- [NEFTune: Noisy Embeddings Improve Instruction Finetuning](https://mlsanity.com/paper/2310.05914/) (2023)
- [LLM in the Shell: Generative Honeypots](https://mlsanity.com/paper/2309.00155/) (2023)
- [Chatbots in a Honeypot World](https://mlsanity.com/paper/2301.03771/) (2023)
- [U-PoT: A Honeypot Framework for UPnP-Based IoT Devices](https://mlsanity.com/paper/1812.05558/) (2018)
- [Attacker Behaviour Profiling using Stochastic Ensemble of Hidden Markov Models](https://mlsanity.com/paper/1905.11824/) (2019)

## Built on by (most cited first, 10 of 10)

- [A Survey on Large Language Models for Communication, Network, and Service Management: Application Insights, Challenges, and Future Directions](https://mlsanity.com/paper/2412.19823/) (2024)
- [VelLMes: A high-interaction AI-based deception framework](https://mlsanity.com/paper/2510.06975/) (2025)
- [Let Them Steal: Trapping Large Language Model Extraction Attacks with Knowledge Honeypot](https://mlsanity.com/paper/2606.15810/) (2026)
- [Towards Production-Worthy Simulation for Autonomous Cyber Operations](https://mlsanity.com/paper/2508.19278/) (2025)
- [Honeyval: A Comprehensive Evaluation Framework for LLM-powered HTTP Honeypots](https://mlsanity.com/paper/2605.29963/) (2026)
- [AdvancedShelLM: A Stateful Multi-Agent LLM Honeypot for SSH Deception](https://mlsanity.com/paper/2606.27990/) (2026)
- [ShIOEnv: A Command Evaluation Environment for Grammar-Constrained Synthesis and Execution Behavior Modeling](https://mlsanity.com/paper/2505.18374/) (2025)
- [Design and Development of an Intelligent LLM-based LDAP Honeypot](https://mlsanity.com/paper/2509.16682/) (2025)
- [Towards Agentic Honeynet Configuration](https://mlsanity.com/paper/2603.14122/) (2026)
- [Honeypot Protocol](https://mlsanity.com/paper/2604.13301/) (2026)

## Abstract (arXiv)

The rapid evolution of cyber threats necessitates innovative solutions for detecting and analyzing malicious activity. Honeypots, which are decoy systems designed to lure and interact with attackers, have emerged as a critical component in cybersecurity. In this paper, we present a novel approach to creating realistic and interactive honeypot systems using Large Language Models (LLMs). By fine-tuning a pre-trained open-source language model on a diverse dataset of attacker-generated commands and responses, we developed a honeypot capable of sophisticated engagement with attackers. Our methodology involved several key steps: data collection and processing, prompt engineering, model selection, and supervised fine-tuning to optimize the model's performance. Evaluation through similarity metrics and live deployment demonstrated that our approach effectively generates accurate and informative responses. The results highlight the potential of LLMs to revolutionize honeypot technology, providing cybersecurity professionals with a powerful tool to detect and analyze malicious activity, thereby enhancing overall security infrastructure.