{"id":"https://openalex.org/W7154566273","doi":"https://doi.org/10.1109/tnse.2026.3683862","title":"HoneyLLMd: A Large Language Model-Powered Adaptive Honeypot System","display_name":"HoneyLLMd: A Large Language Model-Powered Adaptive Honeypot System","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7154566273","doi":"https://doi.org/10.1109/tnse.2026.3683862"},"language":null,"primary_location":{"id":"doi:10.1109/tnse.2026.3683862","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnse.2026.3683862","pdf_url":null,"source":{"id":"https://openalex.org/S2484352698","display_name":"IEEE Transactions on Network Science and Engineering","issn_l":"2327-4697","issn":["2327-4697","2334-329X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network Science and Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5058487069","display_name":"Wenjun Fan","orcid":"https://orcid.org/0000-0002-7363-9695"},"institutions":[{"id":"https://openalex.org/I4210150356","display_name":"University of Washington Tacoma","ror":"https://ror.org/05n8t2628","country_code":"US","type":"education","lineage":["https://openalex.org/I201448701","https://openalex.org/I4210150356"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Wenjun Fan","raw_affiliation_strings":["School of Engineering and Technology, University of Washington, Tacoma, WA, USA"],"raw_orcid":"https://orcid.org/0000-0002-7363-9695","affiliations":[{"raw_affiliation_string":"School of Engineering and Technology, University of Washington, Tacoma, WA, USA","institution_ids":["https://openalex.org/I4210150356"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133817004","display_name":"Fei Du","orcid":null},"institutions":[{"id":"https://openalex.org/I146655781","display_name":"University of Liverpool","ror":"https://ror.org/04xs57h96","country_code":"GB","type":"education","lineage":["https://openalex.org/I146655781"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Fei Du","raw_affiliation_strings":["Department of Computer Science, University of Liverpool, Liverpool, U.K"],"raw_orcid":"https://orcid.org/0000-0003-2655-9307","affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Liverpool, Liverpool, U.K","institution_ids":["https://openalex.org/I146655781"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133800849","display_name":"Zhihui Wang","orcid":null},"institutions":[{"id":"https://openalex.org/I79576946","display_name":"University of Pennsylvania","ror":"https://ror.org/00b30xv10","country_code":"US","type":"education","lineage":["https://openalex.org/I79576946"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zhihui Wang","raw_affiliation_strings":["Department of Electrical and Systems Engineering, University of Pennsylvania, Philadelphia, PA, USA"],"raw_orcid":"https://orcid.org/0009-0007-9097-2186","affiliations":[{"raw_affiliation_string":"Department of Electrical and Systems Engineering, University of Pennsylvania, Philadelphia, PA, USA","institution_ids":["https://openalex.org/I79576946"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5043716122","display_name":"Qiyu Cao","orcid":null},"institutions":[{"id":"https://openalex.org/I69356397","display_name":"Xi\u2019an Jiaotong-Liverpool University","ror":"https://ror.org/03zmrmn05","country_code":"CN","type":"education","lineage":["https://openalex.org/I69356397"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qiyu Cao","raw_affiliation_strings":["School of Advanced Technology, Xi’an Jiaotong-Liverrpool University, Suzhou, China"],"raw_orcid":"https://orcid.org/0009-0009-8738-8856","affiliations":[{"raw_affiliation_string":"School of Advanced Technology, Xi’an Jiaotong-Liverrpool University, Suzhou, China","institution_ids":["https://openalex.org/I69356397"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133822364","display_name":"Lekun Liu","orcid":null},"institutions":[{"id":"https://openalex.org/I69356397","display_name":"Xi\u2019an Jiaotong-Liverpool University","ror":"https://ror.org/03zmrmn05","country_code":"CN","type":"education","lineage":["https://openalex.org/I69356397"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Lekun Liu","raw_affiliation_strings":["School of Advanced Technology, Xi’an Jiaotong-Liverpool University, Suzhou, China"],"raw_orcid":"https://orcid.org/0009-0009-3488-9710","affiliations":[{"raw_affiliation_string":"School of Advanced Technology, Xi’an Jiaotong-Liverpool University, Suzhou, China","institution_ids":["https://openalex.org/I69356397"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5006042817","display_name":"Kejing Chang","orcid":null},"institutions":[{"id":"https://openalex.org/I165932596","display_name":"National University of Singapore","ror":"https://ror.org/01tgyzw49","country_code":"SG","type":"education","lineage":["https://openalex.org/I165932596"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Kejing Chang","raw_affiliation_strings":["School of Computing, National University of Singapore, Singapore"],"raw_orcid":"https://orcid.org/0000-0003-3264-6466","affiliations":[{"raw_affiliation_string":"School of Computing, National University of Singapore, Singapore","institution_ids":["https://openalex.org/I165932596"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5025389734","display_name":"Sang\u2010Yoon Chang","orcid":"https://orcid.org/0000-0002-5736-5823"},"institutions":[{"id":"https://openalex.org/I888729015","display_name":"University of Colorado Colorado Springs","ror":"https://ror.org/054spjc55","country_code":"US","type":"education","lineage":["https://openalex.org/I888729015"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Sang-Yoon Chang","raw_affiliation_strings":["Computer Science Department, University of Colorado, Colorado Springs, CO, USA"],"raw_orcid":"https://orcid.org/0000-0002-5736-5823","affiliations":[{"raw_affiliation_string":"Computer Science Department, University of Colorado, Colorado Springs, CO, USA","institution_ids":["https://openalex.org/I888729015"]}]}],"institutions":[],"countries_distinct_count":4,"institutions_distinct_count":7,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.56043177,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"13","issue":null,"first_page":"8646","last_page":"8665"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10181","display_name":"Natural Language Processing Techniques","score":0.11969999969005585,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10181","display_name":"Natural Language Processing Techniques","score":0.11969999969005585,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10201","display_name":"Speech Recognition and Synthesis","score":0.08879999816417694,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.07109999656677246,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/honeypot","display_name":"Honeypot","score":0.604200005531311},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.2685000002384186},{"id":"https://openalex.org/keywords/natural-language","display_name":"Natural language","score":0.25220000743865967},{"id":"https://openalex.org/keywords/work","display_name":"Work (physics)","score":0.24320000410079956},{"id":"https://openalex.org/keywords/perspective","display_name":"Perspective (graphical)","score":0.23430000245571136}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7164999842643738},{"id":"https://openalex.org/C191267431","wikidata":"https://www.wikidata.org/wiki/Q911932","display_name":"Honeypot","level":2,"score":0.604200005531311},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.32249999046325684},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.27649998664855957},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.2685000002384186},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.2538999915122986},{"id":"https://openalex.org/C195324797","wikidata":"https://www.wikidata.org/wiki/Q33742","display_name":"Natural language","level":2,"score":0.25220000743865967},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.24320000410079956},{"id":"https://openalex.org/C12713177","wikidata":"https://www.wikidata.org/wiki/Q1900281","display_name":"Perspective (graphical)","level":2,"score":0.23430000245571136},{"id":"https://openalex.org/C2983448237","wikidata":"https://www.wikidata.org/wiki/Q1078276","display_name":"Language understanding","level":2,"score":0.23389999568462372}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tnse.2026.3683862","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnse.2026.3683862","pdf_url":null,"source":{"id":"https://openalex.org/S2484352698","display_name":"IEEE Transactions on Network Science and Engineering","issn_l":"2327-4697","issn":["2327-4697","2334-329X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network Science and Engineering","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":67,"referenced_works":["https://openalex.org/W1128523153","https://openalex.org/W1508823302","https://openalex.org/W1997916162","https://openalex.org/W2050547830","https://openalex.org/W2070352186","https://openalex.org/W2100294994","https://openalex.org/W2107011304","https://openalex.org/W2133217855","https://openalex.org/W2373555819","https://openalex.org/W2404532944","https://openalex.org/W2599320555","https://openalex.org/W2607460355","https://openalex.org/W2755588949","https://openalex.org/W2766365590","https://openalex.org/W2766939734","https://openalex.org/W2897846265","https://openalex.org/W2909540406","https://openalex.org/W2966366601","https://openalex.org/W2991580804","https://openalex.org/W2996378475","https://openalex.org/W3018350789","https://openalex.org/W3027887783","https://openalex.org/W3108707471","https://openalex.org/W3110991402","https://openalex.org/W3195892385","https://openalex.org/W4213074563","https://openalex.org/W4225674133","https://openalex.org/W4231945399","https://openalex.org/W4250600388","https://openalex.org/W4283650315","https://openalex.org/W4285049279","https://openalex.org/W4288057765","https://openalex.org/W4315630155","https://openalex.org/W4317952722","https://openalex.org/W4320560161","https://openalex.org/W4323363593","https://openalex.org/W4323655724","https://openalex.org/W4381745097","https://openalex.org/W4382396215","https://openalex.org/W4385187421","https://openalex.org/W4385269996","https://openalex.org/W4385755118","https://openalex.org/W4387415129","https://openalex.org/W4387870108","https://openalex.org/W4388212264","https://openalex.org/W4391093234","https://openalex.org/W4391136507","https://openalex.org/W4391724785","https://openalex.org/W4391725269","https://openalex.org/W4399337393","https://openalex.org/W4400233803","https://openalex.org/W4402157666","https://openalex.org/W4402811816","https://openalex.org/W4403937491","https://openalex.org/W4403937515","https://openalex.org/W4404991844","https://openalex.org/W4405729564","https://openalex.org/W4406738283","https://openalex.org/W4408402324","https://openalex.org/W4408732522","https://openalex.org/W4409724246","https://openalex.org/W4414410671","https://openalex.org/W4416416750","https://openalex.org/W7133214447","https://openalex.org/W7139985584","https://openalex.org/W7140102743","https://openalex.org/W7150218660"],"related_works":[],"abstract_inverted_index":{"A":[0],"honeypot":[1,120,175],"is":[2,166],"a":[3,16,28,114,141,161],"cybersecurity":[4],"mechanism":[5],"designed":[6],"to":[7,20,33,40,71,168],"lure":[8],"attackers":[9,35,153],"by":[10,136],"emulating":[11],"vulnerabilities":[12],"and":[13,22,37,80,127,157,172,190],"serving":[14],"as":[15],"decoy,":[17],"intentionally":[18],"crafted":[19],"detect":[21],"analyze":[23],"malicious":[24],"activities.":[25],"However,":[26],"achieving":[27],"balance":[29],"between":[30],"the":[31,38,65,72,103,137,184],"ability":[32],"engage":[34],"extensively":[36],"need":[39],"minimize":[41],"exposure":[42,74],"of":[43,67,75,105,123],"system":[44,106,121,186],"resources":[45],"remains":[46],"an":[47],"enduring":[48],"challenge.":[49],"High-interaction":[50],"honeypots":[51,82],"(HIHs)":[52],"provide":[53],"in-depth":[54],"system-level":[55],"observation":[56],"through":[57],"full":[58],"operating":[59],"systems,":[60],"yet":[61],"they":[62],"inherently":[63],"increase":[64],"risk":[66,104],"being":[68],"compromised":[69],"due":[70],"extensive":[73],"functionalities.":[76],"In":[77],"contrast,":[78],"low-":[79],"medium-interaction":[81],"(LIHs/MIHs)":[83],"emulate":[84],"only":[85],"minimal":[86],"or":[87,95],"disguised":[88],"services,":[89],"which":[90,152],"cannot":[91],"spawn":[92],"reverse":[93,128],"shells":[94],"execute":[96],"real":[97,142],"command":[98],"responses,":[99],"but":[100],"significantly":[101],"reduce":[102],"intrusion.":[107],"To":[108],"overcome":[109],"this":[110],"limitation,":[111],"we":[112],"present":[113],"large":[115],"language":[116],"model":[117,169],"(LLM)-powered":[118],"adaptive":[119],"capable":[122],"supporting":[124],"both":[125],"bind":[126],"shell":[129],"interactions":[130,150],"with":[131],"authentic":[132],"shell-like":[133],"responses":[134],"generated":[135],"LLM":[138],"rather":[139],"than":[140],"OS.":[143],"This":[144],"design":[145],"enables":[146],"convincing,":[147],"continuous":[148],"\u201crequest\u2014response\u201d":[149],"in":[151],"unintentionally":[154],"reveal":[155],"behavioral":[156],"intent":[158],"data.":[159],"Furthermore,":[160],"hierarchical":[162],"probabilistic":[163],"automaton":[164],"(HPA)":[165],"employed":[167],"attack":[170],"transitions":[171],"dynamically":[173],"adapt":[174],"strategies.":[176],"Experimental":[177],"validation":[178],"on":[179],"real-world":[180],"attacks":[181],"demonstrates":[182],"that":[183],"proposed":[185],"achieves":[187],"superior":[188],"engagement":[189],"data":[191],"capture":[192],"while":[193],"maintaining":[194],"low":[195],"security":[196],"risk.":[197]},"counts_by_year":[],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2026-04-17T00:00:00"}