Towards Agentic Honeynet Configuration

2026-03-14

AI Summary

Static honeypots struggle to adapt to dynamic attacker behaviors and suffer from inefficient resource utilization. This work proposes an AI-driven autonomous agent architecture that, for the first time, integrates intelligent agents into honeynet configuration. By fusing intrusion detection system (IDS) alerts with models for attack stage inference and target prediction, the system dynamically infers attacker intent in real time and adaptively adjusts honeypot exposure strategies and network topology. Experimental results demonstrate that the proposed approach significantly enhances threat intelligence collection efficiency under resource-constrained conditions while effectively sustaining deception capabilities against attackers.

Technology Category

• Cognitive Modeling & Cognitive Systems: Agent Architectures
• Multiagent Systems: Agent/AI Theories and Architectures
• Humans and AI: Human-Aware Planning and Behavior Prediction

Application Category

• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications
• Responsible Web: Machine-in-the-loop, human agency and autonomy
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

Honeypots are deception systems that emulate vulnerable services to collect threat intelligence. While deploying many honeypots increases the opportunity to observe attacker behaviour, in practise network and computational resources limit the number of honeypots that can be exposed. Hence, practitioners must select the assets to deploy, a decision that is typically made statically despite attackers' tactics evolving over time. This work investigates an AI-driven agentic architecture that autonomously manages honeypot exposure in response to ongoing attacks. The proposed agent analyses Intrusion Detection System (IDS) alerts and network state to infer the progression of the attack, identify compromised assets, and predict likely attacker targets. Based on this assessment, the agent dynamically reconfigures the system to maintain attacker engagement while minimizing unnecessary exposure. The approach is evaluated in a simulated environment where attackers execute Proof-of-Concept exploits for known CVEs. Preliminary results indicate that the agent can effectively infer the intent of the attacker and improve the efficiency of exposure under resource constraints

Problem

• honeypot
• resource constraints
• dynamic reconfiguration
• attacker behavior
• threat intelligence

Innovation

• Agentic Honeynet
• Dynamic Honeypot Configuration
• AI-driven Cyber Deception
• Attack Intent Inference
• Resource-constrained Security