Now our honeypot is able to dynamically create systems and files as the LLM demands. That is, as the LLM responds to commands such as “ls”, the corresponding directories and files are created inside the honeypot. This then facilitates us to “lay the track before the cart” in that we create new directories and files just in time when a potential attacker would come across them.

Our next steps will be to investigate just what commands are best to re-route to the LLM. We are also looking at refining the LLM generations and making sure that the context of an attackers previous actions is preserved.