These labels were automatically added by AI and may be inaccurate. For details, see About Literature Database.
Abstract
Question-and-answer agents like ChatGPT offer a novel tool for use as a
potential honeypot interface in cyber security. By imitating Linux, Mac, and
Windows terminal commands and providing an interface for TeamViewer, nmap, and
ping, it is possible to create a dynamic environment that can adapt to the
actions of attackers and provide insight into their tactics, techniques, and
procedures (TTPs). The paper illustrates ten diverse tasks that a
conversational agent or large language model might answer appropriately to the
effects of command-line attacker. The original result features feasibility
studies for ten model tasks meant for defensive teams to mimic expected
honeypot interfaces with minimal risks. Ultimately, the usefulness outside of
forensic activities stems from whether the dynamic honeypot can extend the
time-to-conquer or otherwise delay attacker timelines short of reaching key
network assets like databases or confidential information. While ongoing
maintenance and monitoring may be required, ChatGPT's ability to detect and
deflect malicious activity makes it a valuable option for organizations seeking
to enhance their cyber security posture. Future work will focus on
cybersecurity layers, including perimeter security, host virus detection, and
data security.