Honeypots are essential tools in cybersecurity. However, most of them (even the high-interaction ones) lack the required realism to engage and fool human attackers. This limitation makes them easily discernible, hindering their effectiveness. This work introduces a novel method to create dynamic and realistic software honeypots based on Large Language Models. Preliminary results indicate that LLMs can create credible and dynamic honeypots capable of addressing important limitations of previous honeypots, such as deterministic responses, lack of adaptability, etc. We evaluated the realism of each command by conducting an experiment with human attackers who needed to say if the answer from the honeypot was fake or not. Our proposed honeypot, called shelLM, reached an accuracy of 0.92. The source code and prompts necessary for replicating the experiments have been made publicly available.
翻译:蜜罐是网络安全中的重要工具。然而,现有大多数蜜罐(甚至包括高交互型蜜罐)缺乏与人类攻击者周旋并欺骗对方所需的真实性。这种局限性使其容易被识破,从而削弱了有效性。本文提出一种基于大语言模型创建动态、真实软件蜜罐的新方法。初步实验表明,LLM能够生成可信且动态的蜜罐,可有效克服传统蜜罐的确定性响应、缺乏适应性等关键缺陷。我们通过组织人类攻击者判断蜜罐回复真实性的实验,评估了每条命令的真实度。所提出的蜜罐系统shelLM达到了0.92的准确率。用于复现实验的源代码和提示词已公开发布。