{"id":"https://openalex.org/W7223369646","doi":"https://doi.org/10.12720/jait.17.10.2032-2048","title":"Phase-adaptive Model Routing in LLM-driven SSH Honeypots: A Systematic Mapping Review","display_name":"Phase-adaptive Model Routing in LLM-driven SSH Honeypots: A Systematic Mapping Review","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7223369646","doi":"https://doi.org/10.12720/jait.17.10.2032-2048"},"language":"en","primary_location":{"id":"doi:10.12720/jait.17.10.2032-2048","doi":"https://doi.org/10.12720/jait.17.10.2032-2048","is_oa":true,"landing_page_url":"https://doi.org/10.12720/jait.17.10.2032-2048","pdf_url":"https://www.jait.us/articles/2026/JAIT-V17N10-2032.pdf","source":{"id":"https://openalex.org/S136819581","display_name":"Journal of Advances in Information Technology","issn_l":"1798-2340","issn":["1798-2340"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj","dongbi-d","poland-20","russia-white-list-2"],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Advances in Information Technology","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://www.jait.us/articles/2026/JAIT-V17N10-2032.pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5114982527","display_name":"Raiymbek Magazov","orcid":"https://orcid.org/0009-0000-4105-2331","observed_orcids":["https://orcid.org/0009-0000-4105-2331"]},"institutions":[{"id":"https://openalex.org/I185571130","display_name":"Al-Farabi Kazakh National University","ror":"https://ror.org/03q0vrn42","country_code":"KZ","type":"education","lineage":["https://openalex.org/I185571130"]},{"id":"https://openalex.org/I204275683","display_name":"Satbayev University","ror":"https://ror.org/020cpsb96","country_code":"KZ","type":"education","lineage":["https://openalex.org/I204275683"]}],"countries":["KZ"],"is_corresponding":false,"raw_author_name":"Raiymbek Magazov","raw_affiliation_strings":["Department of Cybersecurity , Institute of Automation and Information Technology , Satbayev University , Almaty , Kazakhstan","Department of Cybersecurity and Cryptology , Faculty of Information Technology and Artificial Intelligence , Al-Farabi Kazakh National University , Almaty , Kazakhstan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Cybersecurity , Institute of Automation and Information Technology , Satbayev University , Almaty , Kazakhstan","institution_ids":["https://openalex.org/I204275683"]},{"raw_affiliation_string":"Department of Cybersecurity and Cryptology , Faculty of Information Technology and Artificial Intelligence , Al-Farabi Kazakh National University , Almaty , Kazakhstan","institution_ids":["https://openalex.org/I185571130"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5116852442","display_name":"Fatima Uralova","orcid":"https://orcid.org/0009-0003-4159-2049","observed_orcids":["https://orcid.org/0009-0003-4159-2049"]},"institutions":[{"id":"https://openalex.org/I204275683","display_name":"Satbayev University","ror":"https://ror.org/020cpsb96","country_code":"KZ","type":"education","lineage":["https://openalex.org/I204275683"]}],"countries":["KZ"],"is_corresponding":false,"raw_author_name":"Fatima Uralova","raw_affiliation_strings":["Department of Cybersecurity , Institute of Automation and Information Technology , Satbayev University , Almaty , Kazakhstan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Cybersecurity , Institute of Automation and Information Technology , Satbayev University , Almaty , Kazakhstan","institution_ids":["https://openalex.org/I204275683"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5045786300","display_name":"Kuanysh Abeshev","orcid":"https://orcid.org/0000-0003-1140-7431","observed_orcids":["https://orcid.org/0000-0003-1140-7431"]},"institutions":[{"id":"https://openalex.org/I105208703","display_name":"Almaty Management University","ror":"https://ror.org/00rhgqg04","country_code":"KZ","type":"education","lineage":["https://openalex.org/I105208703"]}],"countries":["KZ"],"is_corresponding":false,"raw_author_name":"Kuanysh Abeshev","raw_affiliation_strings":["School of Digital Technologies , Almaty Management University , Almaty , Kazakhstan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Digital Technologies , Almaty Management University , Almaty , Kazakhstan","institution_ids":["https://openalex.org/I105208703"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5066353730","display_name":"Bagdat Yagaliyeva","orcid":"https://orcid.org/0000-0003-4644-2261","observed_orcids":["https://orcid.org/0000-0003-4644-2261"]},"institutions":[{"id":"https://openalex.org/I204275683","display_name":"Satbayev University","ror":"https://ror.org/020cpsb96","country_code":"KZ","type":"education","lineage":["https://openalex.org/I204275683"]}],"countries":["KZ"],"is_corresponding":false,"raw_author_name":"Bagdat Yagaliyeva","raw_affiliation_strings":["Department of Cybersecurity , Institute of Automation and Information Technology , Satbayev University , Almaty , Kazakhstan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Cybersecurity , Institute of Automation and Information Technology , Satbayev University , Almaty , Kazakhstan","institution_ids":["https://openalex.org/I204275683"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5012696402","display_name":"\u0416\u0443\u043b\u0434\u044b\u0437 \u0410\u043b\u0438\u043c\u0441\u0435\u0438\u0442\u043e\u0432\u0430","orcid":"https://orcid.org/0000-0002-1907-8997","observed_orcids":["https://orcid.org/0000-0002-1907-8997"]},"institutions":[{"id":"https://openalex.org/I204275683","display_name":"Satbayev University","ror":"https://ror.org/020cpsb96","country_code":"KZ","type":"education","lineage":["https://openalex.org/I204275683"]}],"countries":["KZ"],"is_corresponding":false,"raw_author_name":"Zhuldyz Alimseitova","raw_affiliation_strings":["Department of Cybersecurity , Institute of Automation and Information Technology , Satbayev University , Almaty , Kazakhstan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Cybersecurity , Institute of Automation and Information Technology , Satbayev University , Almaty , Kazakhstan","institution_ids":["https://openalex.org/I204275683"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5139135967","display_name":"Yernar Shamuratov","orcid":"https://orcid.org/0009-0006-7507-3863","observed_orcids":["https://orcid.org/0009-0006-7507-3863"]},"institutions":[{"id":"https://openalex.org/I204275683","display_name":"Satbayev University","ror":"https://ror.org/020cpsb96","country_code":"KZ","type":"education","lineage":["https://openalex.org/I204275683"]}],"countries":["KZ"],"is_corresponding":false,"raw_author_name":"Yernar Shamuratov","raw_affiliation_strings":["Department of Cybersecurity , Institute of Automation and Information Technology , Satbayev University , Almaty , Kazakhstan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Cybersecurity , Institute of Automation and Information Technology , Satbayev University , Almaty , Kazakhstan","institution_ids":["https://openalex.org/I204275683"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"17","issue":"10","first_page":"2032","last_page":"2048"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9423999786376953,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9423999786376953,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.03909999877214432,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.004900000058114529,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ssh-honeypot","display_name":"SSH honeypot","score":0.8849999904632568},{"id":"https://openalex.org/keywords/model-routing","display_name":"model routing","score":0.843999981880188},{"id":"https://openalex.org/keywords/mixture-of-experts","display_name":"mixture of experts","score":0.7760000228881836},{"id":"https://openalex.org/keywords/intrusion-detection","display_name":"intrusion detection","score":0.5410000085830688},{"id":"https://openalex.org/keywords/retrieval-augmented-generation","display_name":"retrieval-augmented generation","score":0.9480000138282776},{"id":"https://openalex.org/keywords/llm-based-agents","display_name":"LLM agents","score":0.7390000224113464},{"id":"https://openalex.org/keywords/security-operations","display_name":"security operations","score":0.7919999957084656},{"id":"https://openalex.org/keywords/capacity-allocation","display_name":"capacity allocation","score":0.3779999911785126}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.739300012588501},{"id":"https://openalex.org/C191267431","wikidata":"https://www.wikidata.org/wiki/Q911932","display_name":"Honeypot","level":2,"score":0.5479999780654907},{"id":"https://openalex.org/C74172769","wikidata":"https://www.wikidata.org/wiki/Q1446839","display_name":"Routing (electronic design automation)","level":2,"score":0.5268999934196472},{"id":"https://openalex.org/C2777615720","wikidata":"https://www.wikidata.org/wiki/Q11888847","display_name":"Prioritization","level":2,"score":0.4413999915122986},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.4410000145435333},{"id":"https://openalex.org/C42475967","wikidata":"https://www.wikidata.org/wiki/Q194292","display_name":"Operations research","level":1,"score":0.41690000891685486},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.40549999475479126},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.40119999647140503},{"id":"https://openalex.org/C94124525","wikidata":"https://www.wikidata.org/wiki/Q912550","display_name":"Categorization","level":2,"score":0.385699987411499},{"id":"https://openalex.org/C104954878","wikidata":"https://www.wikidata.org/wiki/Q1648707","display_name":"Routing protocol","level":3,"score":0.3619999885559082},{"id":"https://openalex.org/C189708586","wikidata":"https://www.wikidata.org/wiki/Q1504425","display_name":"Systematic review","level":3,"score":0.35030001401901245},{"id":"https://openalex.org/C2779227376","wikidata":"https://www.wikidata.org/wiki/Q6505497","display_name":"Layer (electronics)","level":2,"score":0.34779998660087585},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.3456999957561493},{"id":"https://openalex.org/C185429906","wikidata":"https://www.wikidata.org/wiki/Q1130160","display_name":"Estimator","level":2,"score":0.3312000036239624},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.319599986076355},{"id":"https://openalex.org/C39890363","wikidata":"https://www.wikidata.org/wiki/Q36108","display_name":"Generative grammar","level":2,"score":0.3158000111579895},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.30809998512268066},{"id":"https://openalex.org/C121704057","wikidata":"https://www.wikidata.org/wiki/Q352070","display_name":"Collision","level":2,"score":0.3066999912261963},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.299699991941452},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2915000021457672},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.2897999882698059},{"id":"https://openalex.org/C14224292","wikidata":"https://www.wikidata.org/wiki/Q13600188","display_name":"Conceptual framework","level":2,"score":0.27649998664855957},{"id":"https://openalex.org/C44280652","wikidata":"https://www.wikidata.org/wiki/Q104837","display_name":"Phase (matter)","level":2,"score":0.26339998841285706},{"id":"https://openalex.org/C100776233","wikidata":"https://www.wikidata.org/wiki/Q2532492","display_name":"Bridge (graph theory)","level":2,"score":0.2630000114440918},{"id":"https://openalex.org/C61904560","wikidata":"https://www.wikidata.org/wiki/Q1148359","display_name":"Grey literature","level":3,"score":0.262800008058548},{"id":"https://openalex.org/C2778805511","wikidata":"https://www.wikidata.org/wiki/Q1713","display_name":"Citation","level":2,"score":0.2597000002861023},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.2578999996185303}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.12720/jait.17.10.2032-2048","doi":"https://doi.org/10.12720/jait.17.10.2032-2048","is_oa":true,"landing_page_url":"https://doi.org/10.12720/jait.17.10.2032-2048","pdf_url":"https://www.jait.us/articles/2026/JAIT-V17N10-2032.pdf","source":{"id":"https://openalex.org/S136819581","display_name":"Journal of Advances in Information Technology","issn_l":"1798-2340","issn":["1798-2340"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj","dongbi-d","poland-20","russia-white-list-2"],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Advances in Information Technology","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.12720/jait.17.10.2032-2048","doi":"https://doi.org/10.12720/jait.17.10.2032-2048","is_oa":true,"landing_page_url":"https://doi.org/10.12720/jait.17.10.2032-2048","pdf_url":"https://www.jait.us/articles/2026/JAIT-V17N10-2032.pdf","source":{"id":"https://openalex.org/S136819581","display_name":"Journal of Advances in Information Technology","issn_l":"1798-2340","issn":["1798-2340"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj","dongbi-d","poland-20","russia-white-list-2"],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Advances in Information Technology","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[{"id":"https://openalex.org/study-designs/systematic-review","display_name":"Systematic Review"}],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7223369646.pdf","grobid_xml":"https://content.openalex.org/works/W7223369646.grobid-xml"},"referenced_works_count":48,"referenced_works":["https://openalex.org/W3209536064","https://openalex.org/W4251778520","https://openalex.org/W4382396215","https://openalex.org/W4391272493","https://openalex.org/W4392364798","https://openalex.org/W4402157666","https://openalex.org/W4402955413","https://openalex.org/W4403937491","https://openalex.org/W4403937515","https://openalex.org/W4403995323","https://openalex.org/W4404306444","https://openalex.org/W4406549104","https://openalex.org/W4407128941","https://openalex.org/W4407570965","https://openalex.org/W4411120282","https://openalex.org/W4412887902","https://openalex.org/W4413640429","https://openalex.org/W4413679487","https://openalex.org/W4413886649","https://openalex.org/W4413886697","https://openalex.org/W4414170898","https://openalex.org/W4414487500","https://openalex.org/W4414580533","https://openalex.org/W4414937542","https://openalex.org/W4415252545","https://openalex.org/W4415252604","https://openalex.org/W4415604434","https://openalex.org/W4416231654","https://openalex.org/W4416407614","https://openalex.org/W4416692606","https://openalex.org/W7077855359","https://openalex.org/W7083828117","https://openalex.org/W7128038698","https://openalex.org/W7130642838","https://openalex.org/W7130824376","https://openalex.org/W7131118024","https://openalex.org/W7134921078","https://openalex.org/W7135232160","https://openalex.org/W7139985584","https://openalex.org/W7153167298","https://openalex.org/W7154993088","https://openalex.org/W7155559904","https://openalex.org/W7161676664","https://openalex.org/W7165006634","https://openalex.org/W7167216183","https://openalex.org/W7168262180","https://openalex.org/W7171874871","https://openalex.org/W7197038558"],"related_works":["https://openalex.org/W7168262180","https://openalex.org/W7166824143","https://openalex.org/W4416692606","https://openalex.org/W7212079940","https://openalex.org/W7166550578","https://openalex.org/W4408955453","https://openalex.org/W7214779632","https://openalex.org/W7171874871","https://openalex.org/W7131118024","https://openalex.org/W7167572935"],"abstract_inverted_index":{"Large":[0],"Language":[1],"Model":[2],"(LLM)-driven":[3],"Secure":[4],"Shell":[5],"(SSH)":[6],"honeypots":[7,43],"have":[8],"rapidly":[9],"displaced":[10],"static,":[11],"templated":[12],"decoys,":[13],"yet":[14],"they":[15],"share":[16],"a":[17,20,24,55,98,111,128,186,211,235,242,247],"structural":[18],"limitation:":[19],"single":[21,25],"model":[22,82],"and":[23,62,78,84,87,91,127,154,181,195,202,209,221,246],"policy":[26,153],"serve":[27],"every":[28],"turn":[29],"of":[30,69],"an":[31,217,222,228,238],"intrusion,":[32],"from":[33,75,255],"low-stakes":[34],"reconnaissance":[35],"to":[36,49,137,257],"high-value":[37],"persistence.":[38],"This":[39],"review":[40,68,233],"asks":[41],"whether":[42],"can":[44],"instead":[45],"adapt":[46],"their":[47],"inference":[48],"the":[50,117,134,138,144,152,160,163,190,252],"attacker\u2019s":[51],"phase.":[52],"We":[53,205],"conduct":[54],"Preferred":[56],"Reporting":[57],"Items":[58],"for":[59],"Systematic":[60],"Reviews":[61],"Meta-Analyses":[63],"(PRISMA)":[64],"2020-guided":[65],"systematic":[66],"mapping":[67,113],"fifty":[70],"influential":[71,120],"studies":[72],"(2020\u20132026)":[73],"drawn":[74],"three":[76],"strands\u2014honeypots":[77],"generative":[79],"deception,":[80],"cost-aware":[81],"routing":[83,164],"mixture-of-experts":[85],"inference,":[86],"LLM":[88],"agents,":[89],"embeddings,":[90],"retrieval-augmented":[92],"generation":[93,155],"in":[94],"security":[95],"operations\u2014assembled":[96],"under":[97],"disclosed,":[99],"purposive":[100],"top-50":[101],"prioritization":[102,109],"ranked":[103],"by":[104,185],"age-normalized":[105,239],"citation":[106],"velocity.":[107],"That":[108],"is":[110,193],"deliberate":[112],"strategy:":[114],"it":[115],"surfaces":[116],"field\u2019s":[118],"most":[119],"work":[121],"rather":[122],"than":[123],"claiming":[124],"exhaustive":[125],"coverage,":[126],"sensitivity":[129],"analysis":[130],"tests":[131],"how":[132],"robust":[133],"conclusions":[135],"are":[136,199],"cap.":[139],"Three":[140],"findings":[141],"emerge.":[142],"Across":[143],"reviewed":[145],"literature,":[146],"honeypot":[147],"adaptivity":[148],"has":[149,166],"advanced":[150],"at":[151,159],"layers":[156],"but":[157,170],"not":[158,176],"inference-allocation":[161],"layer;":[162],"literature":[165],"solved":[167],"capacity":[168],"allocation":[169],"conditions":[171],"only":[172],"on":[173,177],"query-intrinsic":[174],"signals,":[175],"adversarial":[178],"session":[179],"phase;":[180],"embedding-based":[182,218],"analytics,":[183],"corroborated":[184],"production":[187],"deployment,":[188],"show":[189],"phase":[191,219],"signal":[192],"observable":[194],"reliable.":[196],"The":[197],"strands":[198],"individually":[200],"mature":[201],"mutually":[203],"disconnected.":[204],"formalize":[206],"this":[207],"gap":[208,244],"propose":[210],"phase-adaptive,":[212],"agent-oriented":[213],"framework":[214],"that":[215,250],"pairs":[216],"estimator":[220],"O(1)":[223],"phase-to-model":[224],"dispatch":[225],"layer":[226],"with":[227],"unprivileged,":[229],"campaign-level":[230],"observation":[231],"substrate.The":[232],"contributes":[234],"reproducible":[236],"corpus,":[237],"bibliometric":[240],"ranking,":[241],"formal":[243],"analysis,":[245],"conceptual":[248],"architecture":[249],"operationalizes":[251],"maturation":[253],"arc":[254],"static":[256],"phase-adaptive":[258],"honeypots.":[259]},"counts_by_year":[],"updated_date":"2026-11-04T10:54:05.112534","created_date":"2026-10-24T00:00:00"}