HoneyLLMd: A Large Language Model-Powered Adaptive Honeypot System

A honeypot is a cybersecurity mechanism designed to lure attackers by emulating vulnerabilities and serving as a decoy, intentionally crafted to detect and analyze malicious activities. However, achieving a balance between the ability to engage attackers extensively and the need to minimize exposure of system resources remains an enduring challenge. High-interaction honeypots (HIHs) provide in-depth system-level observation through full operating systems, yet they inherently increase the risk of being compromised due to the extensive exposure of functionalities. In contrast, low- and medium-interaction honeypots (LIHs/MIHs) emulate only minimal or disguised services, which cannot spawn reverse shells or execute real command responses, but significantly reduce the risk of system intrusion. To overcome this limitation, we present a large language model (LLM)-powered adaptive honeypot system capable of supporting both bind and reverse shell interactions with authentic shell-like responses generated by the LLM rather than a real OS. This design enables convincing, continuous “request—response” interactions in which attackers unintentionally reveal behavioral and intent data. Furthermore, a hierarchical probabilistic automaton (HPA) is employed to model attack transitions and dynamically adapt honeypot strategies. Experimental validation on real-world attacks demonstrates that the proposed system achieves superior engagement and data capture while maintaining low security risk.