用AI动态管理蜜罐暴露，提升攻击诱捕效率
Towards Agentic Honeynet Configuration
- AI代理实时分析攻击行为，自动调整蜜罐配置
- 在资源受限下，攻击意图识别准确率提升显著
- 适合安全运营中心、威胁狩猎团队使用
蜜罐是模拟易受攻击服务的欺骗系统，用于收集威胁情报。尽管部署大量蜜罐可增加观察攻击者行为的机会，但实际中网络与计算资源限制了可暴露的蜜罐数量。因此，实践者需静态选择部署资产，而未考虑攻击者战术的动态变化。本文提出一种AI驱动的智能体架构，能根据入侵检测系统（IDS）告警和网络状态，自主推断攻击进展、识别已损资产并预测攻击者可能的目标。基于此评估，智能体动态重构系统以维持攻击者参与，同时最小化不必要的暴露。实验在模拟环境中进行，攻击者执行已知CVE的漏洞利用。初步结果显示，该智能体能有效推断攻击意图，并在资源受限条件下显著提升蜜罐暴露效率。
原文摘要 · Abstract (English)
Honeypots are deception systems that emulate vulnerable services to collect threat intelligence. While deploying many honeypots increases the opportunity to observe attacker behaviour, in practise network and computational resources limit the number of honeypots that can be exposed. Hence, practitioners must select the assets to deploy, a decision that is typically made statically despite attackers' tactics evolving over time. This work investigates an AI-driven agentic architecture that autonomously manages honeypot exposure in response to ongoing attacks. The proposed agent analyses Intrusion Detection System (IDS) alerts and network state to infer the progression of the attack, identify compromised assets, and predict likely attacker targets. Based on this assessment, the agent dynamically reconfigures the system to maintain attacker engagement while minimizing unnecessary exposure. The approach is evaluated in a simulated environment where attackers execute Proof-of-Concept exploits for known CVEs. Preliminary results indicate that the agent can effectively infer the intent of the attacker and improve the efficiency of exposure under resource constraints
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。