自适应蜜罐通过智能伪装和动态响应,让攻击者难以察觉并大幅降低部署成本。
Chameleon: An Adaptive AI-Driven Honeypot Architecture Using Threat-Calibrated Particle Swarm Optimization and Semantic Deception Rapidly-Exploring Random Trees

- 用双向LSTM分类器+语言模型实时判断威胁,快速生成欺骗行为。
- 优化算法使蜜罐连接延迟可变,欺骗效果提升近260%,内存减少25%。
- 开源低成本部署,月耗仅17美元,适合安全研究与实战防护团队使用。
传统蜜罐因行为模式固定易被识别,而高成本商业产品缺乏实时反馈机制。本文提出Chameleon开源自适应蜜罐平台,集成双向长短期记忆(BiLSTM)分类器(7类威胁分类准确率99.61%,延迟约2毫秒)、本地部署的Qwen3.5-0.8B语言模型(上下文生成准确率90%,平均延迟4.5毫秒),以及两个专用元启发式引擎:威胁校准粒子群优化(TC-PSO)根据异常输出动态调整连接保持延迟;语义欺骗快速探索随机树(S-RRT)基于语言模型评估结果进行指数级信息素更新,深度衰减因子控制记忆规模。在五轮基准测试(种子42–46)中,TC-PSO相较标准PSO平均适应度提升48.1%(2.60→3.85),收敛速度提高32.7%;S-RRT最佳运行适应度达1,615.8,较标准RRT提升258.9%,关键严重性下增益329.2%,内存减少24.9%(p < 0.01)。系统月运营成本约17美元,相比商用方案降低约490倍。
原文摘要 · Abstract (English)
An invariant behavioral profile is the defining vulnerability of traditional honeypot installations: a skilled adversary can confirm the presence of a deception environment within only a few diagnostic commands, limiting its intelligence value. High-cost commercial deception products (USD 100,000--150,000 per year) share a related weakness in that their response engines are not coupled to real-time model-driven feedback. Chameleon is an openly distributed adaptive honeypot platform introduced here to address both shortcomings. Three core components are integrated: a bidirectional long short-term memory (BiLSTM) classifier achieving 99.61% accuracy across seven threat categories at approximately two milliseconds CPU latency; a locally deployed Qwen3.5-0.8B language model (Qwen Team, 2026; Unsloth, 2026) delivering 90% contextual generation accuracy at 4.5 milliseconds average latency; and two domain-specific meta-heuristic engines. Threat-Calibrated Particle Swarm Optimization (TC-PSO) dynamically reshapes swarm inertia and objective amplification in proportion to the classifier's anomaly output, enabling real-time adjustment of connection-holding delays. Semantic Deception Rapidly-Exploring Random Trees (S-RRT) drives deception schema evolution via exponentially scaled pheromone updates derived from a language-model severity assessment, while a depth-decay multiplier enforces a finite memory footprint. Across five benchmark runs (seeds 42--46), TC-PSO outperformed standard PSO by 48.1% in mean fitness (2.60 to 3.85) with a 32.7% convergence gain, and S-RRT exceeded standard RRT by 258.9% in best-run fitness (450.2 to 1,615.8), achieving a 329.2% gain at critical severity and a 24.9% memory reduction (p < 0.01). Operating costs are approximately USD 17 per month, a roughly 490-fold reduction versus commercial alternatives.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。