Generative AI for cybersecurity: Building intelligent honeypots to trap hackers

Abstract

The feasibility of employing cyber deception to counter increasingly complex and interconnected adversarial exploits in the increasingly heterogeneous digital environment is falling into a rapidlyapproaching crisis. Traditional static, rule-based honeypots can no longer work as a legitimate deception when under the scrutiny of ever more intelligent human adversaries or fully-automated persistent threat actors. This paper explores the changes brought about by Artificial Intelligence (AI – Large Language Models (LLMs) and Machine Learning (ML), as a new foundation for the architecture of cyber deception. With 15 of the most recent papers on themes of Internet of Things (IoT), predictive behavior prediction, and generative text at the UNIX shell prompt as a macrocosm, we suggest a multi-tiered security architecture. While this type of honeynet, by design, is unable to address the granularity of heterogeneity in 21 st-century networks, its legacy provides the fundamental advantage of translating the science of cyber deception into a realm heretofore deemed impossible. Using syntax generation, adaptive protocols, and a maximal range of Operating System and Industrial Control System simulation, LLM-enabled cyber deception could conceivably extend the dwell times of real-time threat actors. But this creates an inherent tension in cost, latency, and fidelity of interaction.