Work

LLM-SSHH: An LLM-Powered SSH Honeypot Framework via State Snapshot

Year: 2026

Type: article

Abstract: SSH honeypots serve as critical infrastructure for cyber threat intelligence, but existing LLM-based systems suffer from context window limitations causing state loss and hallucination-driven inconsistencies, making them easily detectable through simple verification tests. To address these limitations, we propose LLM-SSHH, a framework combining explicit state management with LLM generation to achieve long-term interaction consistency. The system maintains a persistent state snapshot organized as a three-component tuple capturing file system state, runtime context, and system metadata. The framework serializes the current state into LLM prompts and validates generated responses against state constraints to reject hallucinations. Validated responses update the state snapshot, forming a closed loop that ensures consistent state evolution throughout extended interactions. Experimental results demonstrate that LLM-SSHH achieves a mean detection rate of 0.150, representing a 3 to 4 times improvement over existing methods, significantly extending honeypot survivability for threat intelligence collection.

Source: Applied System Innovation

DOI: 10.3390/asi9050101

Authors: Xiang Li, Nanfang Li, Zongrong Li, Lijun Yan, Denghui Ma, Haishan Cao, Xu Wang, Yu Liu

Institutions: State Grid Corporation of China (China), Central China Normal University

Language: English

Topic: Network Security and Intrusion Detection

Subfield: Computer Networks and Communications

Field: Computer Science

Domain: Physical Sciences

Open Access status: gold

Estimated APC paid: $1,689

OpenAlex ID: W7161563473

FWCI:

Cites:

Cited by:

Related to: