arXiv:2509.16682cs.CRcs.AI2025-09被引 1

用大模型打造能骗人的LDAP蜜罐,逼真互动防入侵

Design and Development of an Intelligent LLM-based LDAP Honeypot

  • 用LLM模拟真实LDAP服务器行为,动态响应攻击者
  • 可主动交互并收集攻击者手法,提升威胁洞察力
  • 适合安全研究者和防御团队用于实战攻防演练

网络安全威胁持续上升,每年涌现出大量未知攻击,针对大型企业和中小机构均构成威胁。为应对这一挑战,需部署先进防御措施以减轻损害并预判新兴攻击趋势。在此背景下,欺骗性工具成为关键策略,可用于检测、威慑和诱骗潜在攻击者,同时收集其战术信息。其中,蜜罐已被证明有效,但传统蜜罐存在灵活性差、配置复杂等问题,难以适应动态环境。随着人工智能特别是通用大语言模型(LLM)的发展,新型欺骗解决方案应运而生,具备更强适应性和易用性。本文提出设计并实现一种基于LLM的蜜罐,用于模拟LDAP服务器——该协议在多数组织中至关重要,承担身份与访问管理核心功能。所提方案旨在构建一个灵活且高度真实的交互式工具,能有效与攻击者进行逼真对话,助力早期发现威胁并分析攻击模式,从而增强基础设施对针对此服务的入侵攻击的防御能力。

原文摘要 · Abstract (English)

Cybersecurity threats continue to increase, with a growing number of previously unknown attacks each year targeting both large corporations and smaller entities. This scenario demands the implementation of advanced security measures, not only to mitigate damage but also to anticipate emerging attack trends. In this context, deception tools have become a key strategy, enabling the detection, deterrence, and deception of potential attackers while facilitating the collection of information about their tactics and methods. Among these tools, honeypots have proven their value, although they have traditionally been limited by rigidity and configuration complexity, hindering their adaptability to dynamic scenarios. The rise of artificial intelligence, and particularly general-purpose Large Language Models (LLMs), is driving the development of new deception solutions capable of offering greater adaptability and ease of use. This work proposes the design and implementation of an LLM-based honeypot to simulate an LDAP server, a critical protocol present in most organizations due to its central role in identity and access management. The proposed solution aims to provide a flexible and realistic tool capable of convincingly interacting with attackers, thereby contributing to early detection and threat analysis while enhancing the defensive capabilities of infrastructures against intrusions targeting this service.

蜜罐LLMLDAP欺骗防御

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。