Problem
Research questions and friction points this paper is trying to address.
LLM
Penetration Testing
Honeypots
Budget Allocation
LLM-Based Penetration Testing in the Presence of Honeypots
๐ค AI Summary
็ ็ฉถ้่ฟๆๅปบ้ข็ฎๅณ็ญๆจกๅ๏ผๆๅฏผLLMๆปๅปไปฃ็ๅจๅญๅจ่็ฝ็ๆ
ๅตไธๆๆๅ้
่ตๆบไปฅ่ฟ่กๆธ้ๆต่ฏใ
๐ Abstract
Large language model (LLM) agents are increasingly employed for offensive cybersecurity tasks such as automated vulnerability discovery, reconnaissance, and penetration testing. This new capability also threatens one of the defender's most valuable tools: deception. Traditional honeypots rely on realism and obscurity to lure human or script-driven attackers into revealing tactics, techniques, and procedures (TTPs), but LLM-driven attackers can reason about heterogeneous artifacts and use the honeypot suspicion to guide target-selection decisions. We present a systematic study of honeypot-aware budget allocation for LLM attack agents. We formalize the attacker's problem as a budgeted decision process: an agent interacts with potential targets, consuming LLM execution budget during reconnaissance and exploitation, and must decide whether to (continue exploitation) or (skip) when honeypot suspicion arises. Our findings show that with the proposed detector-guided policy, LLM agent attackers can effectively allocate budget to compromise hosts in a host pool, highlighting the importance of dynamically allocating budget in a controlled mixed-host testbed. While defenses are beyond our present scope, we discuss implications for future adversarially resilient and adaptive honeypot design.
Innovation
Methods, ideas, or system contributions that make the work stand out.
LLM-based penetration testing
honeypot-aware budget allocation
budgeted decision process
detector-guided policy
๐ Similar Papers
No similar papers found.
