LLM-Based Penetration Testing in the Presence of Honeypots
Studies honeypot-aware budget allocation for LLM attack agents, showing detector-guided policies let agents skip deception and compromise real hosts efficiently.
The paper formalizes LLM attacker behavior against honeypots as a budgeted decision process, where agents choose to continue or skip targets when honeypot suspicion arises. A detector-guided policy lets LLM agents allocate execution budget effectively across a mixed host pool in a controlled testbed. Findings show LLM-driven attackers can reason about heterogeneous artifacts and use honeypot suspicion to guide target selection, challenging traditional deception defenses that rely on realism and obscurity against human or script-driven attackers.
- Formalizes honeypot interaction as a budgeted continue-or-skip decision process
- Shows LLM agents reason about artifacts and suspicion to guide target selection
- Detector-guided policy improves budget allocation in a mixed-host testbed
- Discusses implications for adversarially resilient adaptive honeypot design
From the original article
1 min read at arxiv.orgLarge language model (LLM) agents are increasingly employed for offensive cybersecurity tasks such as automated vulnerability discovery, reconnaissance, and penetration testing. This new capability also threatens one of the defender's most valuable tools: deception.
By Xinhong Xie · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.