What are the advantages of using a large language model to implement a virtual honeypot?

[StarrYMSkY]

The virtual honeypot based on LLM is a fantastic idea. However, the deployment cost of large language models is relatively high. From an engineering perspective, what are the practical benefits of using a large language model as a honeypot? Or, looking at it from the perspective of writing a research paper, how can I convince reviewers that using a large language model to implement a virtual honeypot is a great solution? Can the high interactivity and a closer approximation to real devices brought by large language models compensate for their significant performance overhead?

[mariocandela]

Hi @StarrYMSkY,

Nice to meet you :)

1. However, the deployment cost of large language models is relatively high -> Used as a production honeypot in a cluster or internal network, the number of attacks approaches zero, but used as a research honeypot the costs are high due to the large number of attacks.
2. What are the practical benefits of using a large language model as a honeypot? -> Works like high interaction honeypot! But is a low interaction honeypot: more secure, you don't have to supervise it.

Here you find a very interesting paper: https://arxiv.org/pdf/2301.03771.pdf

I hope I have answered all your questions.

Thanks for your time

Mario