VelLMes: A high-interaction AI-based deception framework

• URL: http://arxiv.org/abs/2510.06975v1
• Date: Wed, 08 Oct 2025 13:00:23 GMT
• Title: VelLMes: A high-interaction AI-based deception framework
• Abstract summary: This paper presents an AI-based deception framework called VelLMes.<n>VelLMes is designed to be attacked by humans, so interactivity and realism are key for its performance.<n>We evaluate the generative capabilities and the deception capabilities.
• Score: 0.3499870393443268
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: There are very few SotA deception systems based on Large Language Models. The existing ones are limited only to simulating one type of service, mainly SSH shells. These systems - but also the deception technologies not based on LLMs - lack an extensive evaluation that includes human attackers. Generative AI has recently become a valuable asset for cybersecurity researchers and practitioners, and the field of cyber-deception is no exception. Researchers have demonstrated how LLMs can be leveraged to create realistic-looking honeytokens, fake users, and even simulated systems that can be used as honeypots. This paper presents an AI-based deception framework called VelLMes, which can simulate multiple protocols and services such as SSH Linux shell, MySQL, POP3, and HTTP. All of these can be deployed and used as honeypots, thus VelLMes offers a variety of choices for deception design based on the users' needs. VelLMes is designed to be attacked by humans, so interactivity and realism are key for its performance. We evaluate the generative capabilities and the deception capabilities. Generative capabilities were evaluated using unit tests for LLMs. The results of the unit tests show that, with careful prompting, LLMs can produce realistic-looking responses, with some LLMs having a 100% passing rate. In the case of the SSH Linux shell, we evaluated deception capabilities with 89 human attackers. The results showed that about 30% of the attackers thought that they were interacting with a real system when they were assigned an LLM-based honeypot. Lastly, we deployed 10 instances of the SSH Linux shell honeypot on the Internet to capture real-life attacks. Analysis of these attacks showed us that LLM honeypots simulating Linux shells can perform well against unstructured and unexpected attacks on the Internet, responding correctly to most of the issued commands.

Related papers

• AdvancedShelLM: A Stateful Multi-Agent LLM Honeypot for SSH Deception [0.3262230127283452]
  We present a new LLM-based honeypot design that uses a multi-agent, multi-LLM architecture to address the limitations of the previous shelLM LLM honeypot.<n>Our honeypot, called AdvancedShelLM, uses two LLM agents, a Manager and a Worker, that better understand the commands while reducing incorrect responses and increasing deception.
  arXiv  Detail & Related papers  (2026-06-26T11:39:05Z)
• Honeyval: A Comprehensive Evaluation Framework for LLM-powered HTTP Honeypots [22.377298744054954]
  Honeypots are decoy systems mimicking real system components designed to defend against cyber attacks.<n>Recently, LLMs increasingly serve as simulation backbones for honeypots.<n>Honeyval is a comprehensive evaluation framework for LLM-powered HTTP honeypots.
  arXiv  Detail & Related papers  (2026-05-28T14:02:27Z)
• Analysis of LLMs Against Prompt Injection and Jailbreak Attacks [7.685814179879813]
  This work evaluates prompt-injection and jailbreak vulnerability using a large, manually curated dataset.<n>We observe significant behavioural variation across models, including refusal responses and complete silent non-responsiveness triggered by internal safety mechanisms.
  arXiv  Detail & Related papers  (2026-02-24T12:32:11Z)
• Assessing Spear-Phishing Website Generation in Large Language Model Coding Agents [0.10195618602298682]
  Large Language Models are increasingly being used in computer programming.<n>This work compares different LLMs in their ability and willingness to produce potentially dangerous code bases.<n>Our analysis shows which metrics of LLMs are more and less correlated with performance in generating spear-phishing sites.
  arXiv  Detail & Related papers  (2026-02-13T12:12:53Z)
• LLM-in-Sandbox Elicits General Agentic Intelligence [142.7174116109795]
  We introduce LLM-in-Sandbox, enabling LLMs to explore within a code sandbox (i.e., a virtual computer) to elicit general intelligence in non-code domains.<n>We show that strong LLMs, without additional training, exhibit generalization capabilities to leverage the code sandbox for non-code tasks.<n>Experiments demonstrate that LLM-in-Sandbox, in both training-free and post-trained settings, achieves robust generalization spanning mathematics, physics, chemistry, biomedicine, long-context understanding, and instruction following.
  arXiv  Detail & Related papers  (2026-01-22T18:57:09Z)
• Can LLMs effectively provide game-theoretic-based scenarios for cybersecurity? [51.96049148869987]
  Large Language Models (LLMs) offer new tools and challenges for the security of computer systems.<n>We investigate whether classical game-theoretic frameworks can effectively capture the behaviours of LLM-driven actors and bots.
  arXiv  Detail & Related papers  (2025-08-04T08:57:14Z)
• SecAlign: Defending Against Prompt Injection with Preference Optimization [52.48001255555192]
  Adversarial prompts can be injected into external data sources to override the system's intended instruction and execute a malicious instruction.<n>We propose a new defense called SecAlign based on the technique of preference optimization.<n>Our method reduces the success rates of various prompt injections to 10%, even against attacks much more sophisticated than ones seen during training.
  arXiv  Detail & Related papers  (2024-10-07T19:34:35Z)
• Human-Interpretable Adversarial Prompt Attack on Large Language Models with Situational Context [49.13497493053742]
  This research explores converting a nonsensical suffix attack into a sensible prompt via a situation-driven contextual re-writing. We combine an independent, meaningful adversarial insertion and situations derived from movies to check if this can trick an LLM. Our approach demonstrates that a successful situation-driven attack can be executed on both open-source and proprietary LLMs.
  arXiv  Detail & Related papers  (2024-07-19T19:47:26Z)
• BadRobot: Jailbreaking Embodied LLMs in the Physical World [20.96351292684658]
  Embodied AI represents systems where AI is integrated into physical entities.<n>Large Language Model (LLM) exhibits powerful language understanding abilities.<n>We introduce BadRobot, a novel attack paradigm aiming to make embodied LLMs violate safety and ethical constraints through typical voice-based user-system interactions.
  arXiv  Detail & Related papers  (2024-07-16T13:13:16Z)
• AutoAttacker: A Large Language Model Guided System to Implement Automatic Cyber-attacks [13.955084410934694]
  Large language models (LLMs) have demonstrated impressive results on natural language tasks. As LLMs inevitably advance, they may be able to automate both the pre- and post-breach attack stages. This research can help defensive systems and teams learn to detect novel attack behaviors preemptively before their use in the wild.
  arXiv  Detail & Related papers  (2024-03-02T00:10:45Z)
• Coercing LLMs to do and reveal (almost) anything [80.8601180293558]
  It has been shown that adversarial attacks on large language models (LLMs) can "jailbreak" the model into making harmful statements. We argue that the spectrum of adversarial attacks on LLMs is much larger than merely jailbreaking.
  arXiv  Detail & Related papers  (2024-02-21T18:59:13Z)
• SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks [99.23352758320945]
  We propose SmoothLLM, the first algorithm designed to mitigate jailbreaking attacks on large language models (LLMs) Based on our finding that adversarially-generated prompts are brittle to character-level changes, our defense first randomly perturbs multiple copies of a given input prompt, and then aggregates the corresponding predictions to detect adversarial inputs.
  arXiv  Detail & Related papers  (2023-10-05T17:01:53Z)
• LLM in the Shell: Generative Honeypots [0.26249027950824505]
  Honeypots are essential tools in cybersecurity for early detection, threat intelligence gathering, and analysis of attacker's behavior. This work introduces shelLM, a dynamic and realistic software honeypot based on Large Language Models that generates Linux-like shell output.
  arXiv  Detail & Related papers  (2023-08-31T22:05:46Z)
• Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection [64.67495502772866]
  Large Language Models (LLMs) are increasingly being integrated into various applications. We show how attackers can override original instructions and employed controls using Prompt Injection attacks. We derive a comprehensive taxonomy from a computer security perspective to systematically investigate impacts and vulnerabilities.
  arXiv  Detail & Related papers  (2023-02-23T17:14:38Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.