HydraPoT routes honeypot commands across mixed LLM agents to cut cost
Original title: HydraPoT: A Configurable Multi-Agent Framework for Cost-Aware LLM-Assisted Honeypots
A case-study policy cut cloud-processed tokens by 72.6% and cost by 3.7x, with under 5% runtime overhead.
Researchers present HydraPoT, a configurable multi-agent honeypot that combines traditional emulation, lightweight LLMs and cloud LLMs. Each attacker command is routed by a complexity policy while shared session state keeps responses consistent. Architectural tests, a context-preservation benchmark and a three-agent case study found fidelity close to a cloud-only honeypot at much lower token use.
- Cloud-processed tokens fell 72.6% under the case-study policy.
- Operational cost was 3.7 times lower than a cloud-LLM-only setup.
- Runtime overhead was reported at less than 5%.
- Shared session state is used when control moves between agents.
- Products
- HydraPoT
From the original article
1 min read at arxiv.orgLarge language models (LLMs) can improve honeypot realism by generating dynamic, context-aware responses, but powerful cloud models incur substantial cost and latency, while lightweight models may provide weaker deception. This forces practitioners to choose between operational efficiency and interaction fidelity.
By Kamolchanok Saengtong · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.