Adaptive AI-Driven Honeypot for Evolving Network Threats

Abstract

Traditional SSH honeypots are effective for collecting brute-force attempts and post-login shell activity, but their research value is often limited by three connected challenges: restricted interaction realism, limited threat-intelligence extraction from attacker interactions and limited analyst-facing interpretation of captured data. Many conventional SSH honeypots rely on predefined filesystems, scripted command handlers, and static logging workflows. As a result, they may fail to sustain meaningful interaction when attackers issue commands outside the expected behavior of the decoy, and they often leave defenders with raw logs that require substantial manual analysis. To address the above limitations, this thesis investigates how an SSH honeypot can be extended from a passive command-logging mechanism into an adaptive threat-intelligence workflow. The central contribution of this thesis is a research approach for connecting adaptive SSH interaction, structured behavioral interpretation, and analyst-facing visualization. The research contribution is threefold: a hybrid interaction approach for improving SSH honeypot interaction continuity, a novel enrichment layer for converting raw shell activity into structured threat intelligence, and an analyst-facing workflow for presenting enriched telemetry through live visualization. To validate the proposed approach, an AI-enhanced SSH honeypot was designed, implemented, and evaluated. The system maintains a controlled virtual shell environment, handles common commands through deterministic emulation, uses language-model assistance for selected fallback responses, and exposes enriched telemetry through a backend API and SOC-style dashboard. The dashboard supports live monitoring, severity triage, IOC inspection, and source-centric investigation. The evaluation includes a comparison with Cowrie in a conventional emulated-shell configuration and an assessment of the enrichment pipeline using a manually labeled evaluation set. The results show that the proposed system maintains interaction quality comparable to a mature SSH honeypot baseline while adding built-in intelligence enrichment and dashboard-based interpretation. The enrichment evaluation further shows that the system can produce useful behavior, risk, and IOC outputs for analyst-facing triage. Overall, this thesis contributes a research approach for combining adaptive SSH interaction, structured threat-intelligence enrichment, and live visualization into a single workflow for improving the practical value of honeypot telemetry.