Newest papers

HydraPoT: A Configurable Multi-Agent Framework for Cost-Aware LLM-Assisted Honeypots

Kamolchanok Saengtong, Chutirat Saengyingyongwattana, Sasin Janpuangtong, Norrathep Rattanavipanon · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.27722 · cited by 0 works (OpenAlex) · open-access PDF

French

Les grands modèles linguistiques (LLM) peuvent améliorer le réalisme du honeypot en générant des réponses dynamiques et contextuelles, mais les puissants modèles cloud ont un coût et une latence considérables, tandis que les modèles légers peuvent fournir une tromperie plus faible. Cela oblige les praticiens à choisir entre l'efficacité opérationnelle et la fidélité de l'interaction. Dans ce travail, nous présentons HydraPoT, un cadre de honeypot multi-agent configurable qui intègre une émulation traditionnelle, des LLM légers et des LLM de cloud puissants. HydraPoT dirige chaque commandement de l'attaquant vers un agent approprié selon une politique de complexité configurable, tout en maintenant l'état de session partagé pour préserver

Machine translation (Meta M2M100); the English original follows.

Abstract

Large language models (LLMs) can improve honeypot realism by generating dynamic, context-aware responses, but powerful cloud models incur substantial cost and latency, while lightweight models may provide weaker deception. This forces practitioners to choose between operational efficiency and interaction fidelity. In this work, we present HydraPoT, a configurable multi-agent honeypot framework that integrates traditional emulation, lightweight LLMs, and powerful cloud LLMs. HydraPoT routes each attacker command to an appropriate agent according to a configurable complexity-based policy, while maintaining shared session state to preserve consistency across agent transitions. We evaluate HydraPoT through an architectural-overhead analysis, a cross-agent context-preservation benchmark, and a three-agent case study. HydraPoT introduces less than 5% runtime overhead, preserves context across heterogeneous agents, and achieves fidelity close to a cloud-LLM-only honeypot. Under our case-study policy, it reduces cloud-processed tokens by 72.6% and operational cost by 3.7x. These results demonstrate that configurable multi-agent routing can make realistic LLM-assisted honeypots more practical under limited operational budgets.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Honeypot, Computer science, Cloud computing, Consistency (knowledge bases), Context (archaeology), State (computer science)

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange