{"id":"https://openalex.org/W4399337393","doi":"https://doi.org/10.1145/3655693.3655716","title":"Honeypot's Best Friend? Investigating ChatGPT's Ability to Evaluate Honeypot Logs","display_name":"Honeypot's Best Friend? Investigating ChatGPT's Ability to Evaluate Honeypot Logs","publication_year":2024,"publication_date":"2024-06-04","ids":{"openalex":"https://openalex.org/W4399337393","doi":"https://doi.org/10.1145/3655693.3655716"},"language":"en","primary_location":{"id":"doi:10.1145/3655693.3655716","doi":"https://doi.org/10.1145/3655693.3655716","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3655693.3655716","pdf_url":null,"source":{"id":"https://openalex.org/S7407088847","display_name":"European Interdisciplinary Cybersecurity Conference (EICC)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"European Interdisciplinary Cybersecurity Conference","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1145/3655693.3655716","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5099016490","display_name":"Meryem Berfin Ozkok","orcid":"https://orcid.org/0009-0007-3261-4911","observed_orcids":["https://orcid.org/0009-0007-3261-4911"]},"institutions":[{"id":"https://openalex.org/I134235054","display_name":"Sabanc\u0131 \u00dcniversitesi","ror":"https://ror.org/049asqa32","country_code":"TR","type":"education","lineage":["https://openalex.org/I134235054"]}],"countries":["TR"],"is_corresponding":false,"raw_author_name":"Meryem Berfin Ozkok","raw_affiliation_strings":["Sabanci University, Turkey"],"raw_orcid":"https://orcid.org/0009-0007-3261-4911","affiliations":[{"raw_affiliation_string":"Sabanci University, Turkey","institution_ids":["https://openalex.org/I134235054"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5099016491","display_name":"Baturay Birinci","orcid":"https://orcid.org/0009-0006-1224-7336","observed_orcids":["https://orcid.org/0009-0006-1224-7336"]},"institutions":[{"id":"https://openalex.org/I134235054","display_name":"Sabanc\u0131 \u00dcniversitesi","ror":"https://ror.org/049asqa32","country_code":"TR","type":"education","lineage":["https://openalex.org/I134235054"]}],"countries":["TR"],"is_corresponding":false,"raw_author_name":"Baturay Birinci","raw_affiliation_strings":["Sabanci University, Turkey","Sabanci University Istanbul, TR"],"raw_orcid":"https://orcid.org/0009-0006-1224-7336","affiliations":[{"raw_affiliation_string":"Sabanci University, Turkey","institution_ids":["https://openalex.org/I134235054"]},{"raw_affiliation_string":"Sabanci University Istanbul, TR","institution_ids":["https://openalex.org/I134235054"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5005365576","display_name":"Or\u00e7un \u00c7etin","orcid":"https://orcid.org/0000-0001-9670-0295","observed_orcids":["https://orcid.org/0000-0001-9670-0295"]},"institutions":[{"id":"https://openalex.org/I134235054","display_name":"Sabanc\u0131 \u00dcniversitesi","ror":"https://ror.org/049asqa32","country_code":"TR","type":"education","lineage":["https://openalex.org/I134235054"]}],"countries":["TR"],"is_corresponding":false,"raw_author_name":"Orcun Cetin","raw_affiliation_strings":["Sabanci University, Turkey","Sabanci University Istanbul, TR"],"raw_orcid":"https://orcid.org/0000-0001-9670-0295","affiliations":[{"raw_affiliation_string":"Sabanci University, Turkey","institution_ids":["https://openalex.org/I134235054"]},{"raw_affiliation_string":"Sabanci University Istanbul, TR","institution_ids":["https://openalex.org/I134235054"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5025663670","display_name":"Budi Arief","orcid":"https://orcid.org/0000-0002-1830-1587","observed_orcids":["https://orcid.org/0000-0002-1830-1587"]},"institutions":[{"id":"https://openalex.org/I20581793","display_name":"University of Kent","ror":"https://ror.org/00xkeyj56","country_code":"GB","type":"education","lineage":["https://openalex.org/I20581793"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Budi Arief","raw_affiliation_strings":["University of Kent, United Kingdom"],"raw_orcid":"https://orcid.org/0000-0002-1830-1587","affiliations":[{"raw_affiliation_string":"University of Kent, United Kingdom","institution_ids":["https://openalex.org/I20581793"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5059422128","display_name":"Julio Cesar Hernandez-Castro","orcid":"https://orcid.org/0000-0002-6432-5328","observed_orcids":["https://orcid.org/0000-0002-6432-5328"]},"institutions":[{"id":"https://openalex.org/I88060688","display_name":"Universidad Polit\u00e9cnica de Madrid","ror":"https://ror.org/03n6nwv02","country_code":"ES","type":"education","lineage":["https://openalex.org/I88060688"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Julio Hernandez-Castro","raw_affiliation_strings":["Universidad Politecnica de Madrid, Spain"],"raw_orcid":"https://orcid.org/0000-0002-6432-5328","affiliations":[{"raw_affiliation_string":"Universidad Politecnica de Madrid, Spain","institution_ids":["https://openalex.org/I88060688"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":3.1179,"has_fulltext":false,"cited_by_count":10,"citation_normalized_percentile":{"value":0.92613611,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"128","last_page":"135"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9702000021934509,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9702000021934509,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.007499999832361937,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.004100000020116568,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/chatgpt","display_name":"ChatGPT","score":0.9739999771118164},{"id":"https://openalex.org/keywords/large-language-models","display_name":"large language models","score":0.9700000286102295},{"id":"https://openalex.org/keywords/automated-log-analysis","display_name":"automated log analysis","score":0.8180000185966492},{"id":"https://openalex.org/keywords/mitre-att-ck","display_name":"MITRE ATT&CK","score":0.8090000152587891},{"id":"https://openalex.org/keywords/obfuscation-detection","display_name":"obfuscation detection","score":0.8600000143051147},{"id":"https://openalex.org/keywords/deobfuscation","display_name":"deobfuscation","score":0.9490000009536743},{"id":"https://openalex.org/keywords/ssh-honeypot","display_name":"SSH honeypot","score":0.9980000257492065},{"id":"https://openalex.org/keywords/false-positive-results","display_name":"false positives","score":0.7609999775886536},{"id":"https://openalex.org/keywords/attack-attribution","display_name":"attack attribution","score":0.45500001311302185},{"id":"https://openalex.org/keywords/threat-intelligence","display_name":"threat intelligence","score":0.36899998784065247},{"id":"https://openalex.org/keywords/artificial-intelligence-in-cybersecurity","display_name":"artificial intelligence in cybersecurity","score":0.42399999499320984}],"concepts":[{"id":"https://openalex.org/C191267431","wikidata":"https://www.wikidata.org/wiki/Q911932","display_name":"Honeypot","level":2,"score":0.9911500215530396},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5107908248901367},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3881543278694153}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1145/3655693.3655716","doi":"https://doi.org/10.1145/3655693.3655716","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3655693.3655716","pdf_url":null,"source":{"id":"https://openalex.org/S7407088847","display_name":"European Interdisciplinary Cybersecurity Conference (EICC)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"European Interdisciplinary Cybersecurity Conference","raw_type":"proceedings-article"},{"id":"pmh:oai:kar.kent.ac.uk:106254","doi":null,"is_oa":false,"landing_page_url":"https://doi.org/10.1145/3655693.3655716>)","pdf_url":null,"source":{"id":"https://openalex.org/S4377196264","display_name":"Kent Academic Repository (University of Kent)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I20581793","host_organization_name":"University of Kent","host_organization_lineage":["https://openalex.org/I20581793"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"acceptedVersion","is_accepted":true,"is_published":false,"raw_source_name":null,"raw_type":"Conference proceeding"},{"id":"pmh:oai:research.sabanciuniv.edu:49551","doi":null,"is_oa":false,"landing_page_url":"https://research.sabanciuniv.edu/id/eprint/49551/","pdf_url":null,"source":{"id":"https://openalex.org/S4306402254","display_name":"Sabanci University","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I134235054","host_organization_name":"Sabanc\u0131 \u00dcniversitesi","host_organization_lineage":["https://openalex.org/I134235054"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"PeerReviewed"}],"best_oa_location":{"id":"doi:10.1145/3655693.3655716","doi":"https://doi.org/10.1145/3655693.3655716","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3655693.3655716","pdf_url":null,"source":{"id":"https://openalex.org/S7407088847","display_name":"European Interdisciplinary Cybersecurity Conference (EICC)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"European Interdisciplinary Cybersecurity Conference","raw_type":"proceedings-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":15,"referenced_works":["https://openalex.org/W2151584216","https://openalex.org/W3149084432","https://openalex.org/W4213074563","https://openalex.org/W4315705880","https://openalex.org/W4353042446","https://openalex.org/W4378554228","https://openalex.org/W4380187196","https://openalex.org/W4380994471","https://openalex.org/W4385452929","https://openalex.org/W4385621806","https://openalex.org/W4387610430","https://openalex.org/W4388483129","https://openalex.org/W4393141466","https://openalex.org/W4399631359","https://openalex.org/W4402157666"],"related_works":["https://openalex.org/W7170091016","https://openalex.org/W4403059070","https://openalex.org/W4315705880","https://openalex.org/W4399406048","https://openalex.org/W4414404744","https://openalex.org/W7138855876","https://openalex.org/W7160754775","https://openalex.org/W7117452054","https://openalex.org/W4387917900","https://openalex.org/W7212059063"],"abstract_inverted_index":{"Honeypots":[0],"can":[1,50,104,179,308,357],"gather":[2],"substantial":[3],"data":[4,91,134],"from":[5,53,126],"intruders,":[6],"but":[7,383],"many":[8],"honeypots":[9,140],"lack":[10],"the":[11,18,30,35,45,54,59,81,163,172,201,204,227,249,255,275,286,289,318,349,373,387],"necessary":[12],"features":[13],"to":[14,88,95,138,220,264,298,345,363,381],"analyse":[15],"and":[16,34,99,109,122,141,176,242,252,291,330],"explain":[17,105],"nature":[19],"of":[20,83,166,203,248,254,269,288,320,348,351,389,391],"these":[21,305],"potential":[22,164,315],"attacks.":[23],"Typically,":[24],"honeypot":[25,55,90,124,277,322],"analysis":[26,102,154],"reports":[27],"only":[28],"highlight":[29],"attacking":[31],"IP":[32],"addresses":[33],"malicious":[36],"requests.":[37],"As":[38],"such,":[39],"analysts":[40],"might":[41,185],"miss":[42],"out":[43],"on":[44,130,157,304],"more":[46,223],"useful":[47],"insights":[48],"that":[49,103,184,192,310,377],"be":[51,186,346,364],"derived":[52],"data,":[56,278],"such":[57,74],"as":[58,75,261],"attackers\u2019":[60],"plan":[61],"or":[62,222],"emerging":[63],"threats.":[64],"Meanwhile,":[65],"recent":[66],"advances":[67],"in":[68,120,169,198,215,235,326,331,366],"large":[69],"language":[70],"models":[71],"(LLM)":[72],"\u2013":[73,77],"ChatGPT":[76,178,193,210,232,311],"have":[78],"opened":[79],"up":[80],"possibility":[82,350],"using":[84],"artificial":[85],"intelligence":[86],"(AI)":[87],"comprehend":[89],"better,":[92],"for":[93,272,295,316,369],"instance,":[94],"perform":[96],"an":[97],"automated":[98],"intelligent":[100],"log":[101],"consequences,":[106],"provide":[107],"labels,":[108],"deal":[110],"with":[111,171],"obfuscation.":[112,273],"In":[113],"this":[114,392],"study,":[115],"we":[116,279,307],"probed":[117],"ChatGPT\u2019s":[118,159],"proficiency":[119,325],"understanding":[121],"explaining":[123,200,285,327],"logs":[125],"actual":[127],"recorded":[128],"attacks":[129,143,290],"our":[131],"honeypots.":[132],"Our":[133,153],"encompassed":[135],"627":[136],"requests":[137],"Elasticsearch":[139,207],"73":[142],"detected":[144],"by":[145,188,226,240,371],"SSH":[146,276],"honeypots,":[147],"collected":[148],"over":[149],"a":[150,195,212,217,265,281,292],"two-week":[151],"period.":[152],"was":[155,233],"focused":[156],"evaluating":[158],"explanation":[160],"ability":[161],"regarding":[162],"consequences":[165,202,287,329],"each":[167],"attack,":[168],"alignment":[170],"MITRE":[173,228,299,336],"ATT&CK":[174,229,300,337],"Framework,":[175],"whether":[177],"identify":[180],"any":[181],"obfuscation":[182,237,333],"techniques":[183,224,238,338,376],"used":[187],"attackers.":[189],"We":[190],"found":[191],"achieved":[194,211,280],"96.65%":[196],"accuracy":[197,214,283,294],"correctly":[199,296],"attack":[205,219,328],"targeting":[206],"servers.":[208],"Furthermore,":[209],"72.46%":[213],"matching":[216],"given":[218],"one":[221],"listed":[225],"Framework.":[230],"Similarly,":[231],"excellent":[234],"identifying":[236],"employed":[239],"attackers":[241],"offering":[243],"deobfuscation":[244],"solutions.":[245],"However,":[246],"30.46%":[247],"request":[250],"body":[251],"7.5%":[253],"targeted":[256],"URI":[257],"were":[258,378],"falsely":[259],"identified":[260],"obfuscated,":[262],"leading":[263],"very":[266],"high":[267,352],"score":[268],"false":[270,353],"positive":[271,354],"With":[274],"97.26%":[282],"while":[284],"98.84%":[293],"mapping":[297],"Framework":[301],"techniques.":[302],"Based":[303],"results,":[306],"say":[309],"has":[312],"shown":[313],"great":[314],"automating":[317],"process":[319],"analysing":[321],"data.":[323],"Its":[324],"managing":[332],"through":[334],"implementing":[335],"is":[339,343],"impressive.":[340],"Nevertheless,":[341],"it":[342],"essential":[344],"mindful":[347],"rates,":[355],"which":[356],"cause":[358],"some":[359],"issues.":[360],"This":[361],"needs":[362],"addressed":[365],"future":[367],"research,":[368],"example":[370],"leveraging":[372],"advanced":[374],"fine-tuning":[375],"recently":[379],"introduced":[380],"ChatGPT,":[382],"not":[384],"available":[385],"at":[386],"time":[388],"writing":[390],"paper.":[393]},"counts_by_year":[{"year":2026,"cited_by_count":9},{"year":2025,"cited_by_count":1}],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2024-06-05T00:00:00"}