The advent of Large Language Models (LLMs) promised to resolve the long-standing paradox in honeypot design: achieving high-fidelity deception with low operational risk. Since late 2022, a flurry of research has demonstrated steady progress from ideation to prototype implementation. While promising, evaluations show only incremental progress in real-world deployments, and the field still lacks a cohesive understanding of emerging architectural patterns, core challenges, and evaluation paradigms. To fill this gap, we provide the first comprehensive overview and analysis of this new domain, focusing on three critical, intersecting research areas: we provide a taxonomy of honeypot detection vectors, mapped to how LLM-based simulation can or cannot aid deception; we synthesize the emerging literature on LLM-powered honeypots, identifying a canonical architecture, an evaluation tetrad, and an attacker trichotomy mapped to honeypot requirements; and we chart the evolution of honeypot log analysis into automated intelligence generation. Finally, we synthesize these findings into a forward-looking research roadmap, arguing that the true potential of this technology lies in creating autonomous, self-improving deception systems to counter the emerging threat of intelligent, automated attackers.

翻译：大语言模型（LLM）的出现，曾承诺解决蜜罐设计中长期存在的悖论：以低操作风险实现高保真欺骗。自2022年底以来，一系列研究展示了从概念构思到原型实现的稳步进展。尽管前景乐观，但评估显示其在现实部署中仅取得渐进式提升，该领域仍缺乏对新兴架构模式、核心挑战及评估范式的统一理解。为填补这一空白，我们首次对这一新兴领域进行系统性概述与分析，聚焦三个关键且相互交叉的研究方向：提出蜜罐检测向量的分类体系，并映射至基于LLM的模拟在何种程度上能够（或不能）辅助欺骗；综合现有关于LLM驱动的蜜罐研究文献，识别出标准架构、评估四元组及映射至蜜罐需求的三元攻击者分类；梳理蜜罐日志分析向自动化情报生成的演变路径。最终，我们将这些发现整合为前瞻性研究路线图，论证该技术的真正潜力在于构建自主进化的欺骗系统，以应对新兴的智能化自动化攻击者威胁。