Command Pattern Recognition in Linux-Based Cyber Incidents Using Large Language Models for Intelligent Honeypot Systems

Linux servers exposed via Secure Shell (SSH) remain a major target in command-driven cyber intrusions, yet conventional low- and medium-interaction honeypots often provide unrealistic responses and limited session state, causing attackers to terminate sessions before later attack stages can be observed. This paper proposes an intelligent SSH honeypot based on large language models that maintains context-aware terminal interaction while simultaneously supporting semantic analysis of attacker command streams. The system combines an SSH front-end, an LLM processing layer, centralized logging, and an embedding-based analytics pipeline for clustering commands and mapping them to attack stages such as reconnaissance, exploitation, and persistence. The language model is fine-tuned for Linux command understanding and realistic response generation, and the proposed method is evaluated against token-based and ngram baselines. Results from a six-month distributed deployment with approximately four million interaction events show that the LLM-enhanced approach improves command recognition performance to an F1-score of 0.90 and increases attacker engagement by extending session depth and duration. The findings indicate that LLM-assisted honeypots can provide more realistic deception and richer threatintelligence telemetry from Linux-based cyber incidents.