HoneyGPT: Breaking the Trilemma in Terminal Honeypots with Large Language Model
Fuente:
arXiv
Guardado en:
| Autores principales: | , , , , , , |
|---|---|
| Formato: | Preprint |
| Publicado: |
2024
|
| Materias: | |
| Acceso en línea: | |
| Etiquetas: |
Agregar Etiqueta
Sin Etiquetas, Sea el primero en etiquetar este registro!
|
| _version_ | 1866917923840327680 |
|---|---|
| author | Wang, Ziyang You, Jianzhou Wang, Haining Yuan, Tianwei Lv, Shichao Wang, Yang Sun, Limin |
| author_facet | Wang, Ziyang You, Jianzhou Wang, Haining Yuan, Tianwei Lv, Shichao Wang, Yang Sun, Limin |
| contents | Honeypots, as a strategic cyber-deception mechanism designed to emulate authentic interactions and bait unauthorized entities, often struggle with balancing flexibility, interaction depth, and deception. They typically fail to adapt to evolving attacker tactics, with limited engagement and information gathering. Fortunately, the emergent capabilities of large language models and innovative prompt-based engineering offer a transformative shift in honeypot technologies. This paper introduces HoneyGPT, a pioneering shell honeypot architecture based on ChatGPT, characterized by its cost-effectiveness and proactive engagement. In particular, we propose a structured prompt engineering framework that incorporates chain-of-thought tactics to improve long-term memory and robust security analytics, enhancing deception and engagement. Our evaluation of HoneyGPT comprises a baseline comparison based on a collected dataset and a three-month field evaluation. The baseline comparison demonstrates HoneyGPT's remarkable ability to strike a balance among flexibility, interaction depth, and deceptive capability. The field evaluation further validates HoneyGPT's superior performance in engaging attackers more deeply and capturing a wider array of novel attack vectors. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2406_01882 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | HoneyGPT: Breaking the Trilemma in Terminal Honeypots with Large Language Model Wang, Ziyang You, Jianzhou Wang, Haining Yuan, Tianwei Lv, Shichao Wang, Yang Sun, Limin Cryptography and Security Artificial Intelligence Emerging Technologies Software Engineering Honeypots, as a strategic cyber-deception mechanism designed to emulate authentic interactions and bait unauthorized entities, often struggle with balancing flexibility, interaction depth, and deception. They typically fail to adapt to evolving attacker tactics, with limited engagement and information gathering. Fortunately, the emergent capabilities of large language models and innovative prompt-based engineering offer a transformative shift in honeypot technologies. This paper introduces HoneyGPT, a pioneering shell honeypot architecture based on ChatGPT, characterized by its cost-effectiveness and proactive engagement. In particular, we propose a structured prompt engineering framework that incorporates chain-of-thought tactics to improve long-term memory and robust security analytics, enhancing deception and engagement. Our evaluation of HoneyGPT comprises a baseline comparison based on a collected dataset and a three-month field evaluation. The baseline comparison demonstrates HoneyGPT's remarkable ability to strike a balance among flexibility, interaction depth, and deceptive capability. The field evaluation further validates HoneyGPT's superior performance in engaging attackers more deeply and capturing a wider array of novel attack vectors. |
| title | HoneyGPT: Breaking the Trilemma in Terminal Honeypots with Large Language Model |
| topic | Cryptography and Security Artificial Intelligence Emerging Technologies Software Engineering |
| url | https://arxiv.org/abs/2406.01882 |