Agentic Honeypot Intelligent API Interaction Monitoring System
Keywords:
Adaptive honeypot, Agentic AI, API monitoring, Cyber deception, Cybersecurity, Honeypot, Intrusion detectionAbstract
Cybersecurity threats have become increasingly sophisticated due to the rapid growth of web applications, cloud computing, Application Programming Interfaces (APIs), and automated attack tools. Recent advances in Artificial Intelligence (AI), Machine Learning (ML), Large Language Models (LLMs), and intelligent cyber-deception technologies have enabled the development of adaptive honeypot systems capable of interacting dynamically with attackers. These systems employ attack monitoring, malicious payload analysis, shell emulation, attacker behavior modeling, LLM-generated responses, and adaptive deception strategies to collect detailed threat intelligence while minimizing exposure of real computing resources. This survey reviews recent research on intelligent honeypot systems, focusing on traditional interaction-based honeypots, machine-learning-based approaches, LLM-powered honeypots, adaptive attack modeling, and intelligent API interaction. The study compares existing approaches, identifies their strengths and limitations, and discusses future research directions toward developing secure, adaptive, and intelligent agentic honeypot systems for monitoring malicious API interactions.
References
F. Setianto, E. Tsani, F. Sadiq, G. Domalis, D. Tsakalidis, and P. Kostakos, “GPT-2C: A parser for honeypot logs using large pre-trained language models,” in Proceedings of the 2021 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining, Jan. 2022, pp. 649–653.
M. Boffa, G. Milan, L. Vassio, I. Drago, M. Mellia and Z. Ben Houidi, “Towards NLP-based processing of honeypot logs,” 2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), Genoa, Italy, 2022, pp. 314–321.
P. Balasubramanian, J. Seby, and P. Kostakos, “CYGENT: A cybersecurity conversational agent with log summarization powered by GPT-3,” 2024 3rd International Conference on Artificial Intelligence For Internet of Things (AIIoT), Vellore, India, 2024, pp. 1–6.
M. Sladić, V. Valeros, C. Catania, and S. Garcia, “LLM in the Shell: Generative honeypots,” 2024 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), Vienna, Austria, 2024, pp. 430–435.
S. Johnson, R. Hassing, J. Pijpker, and R. Loves, “A modular generative honeypot shell,” 2024 IEEE International Conference on Cyber Security and Resilience (CSR), London, United Kingdom, 2024, pp. 387–394.
J. Shi, S. Jiang, B. Xu, J. Liang, Y. Xiao, and W. Wang, “ShellGPT: Generative pre-trained transformer model for shell language understanding,” 2023 IEEE 34th International Symposium on Software Reliability Engineering (ISSRE), Florence, Italy, 2023, pp. 671–682.
A. Sezgin and A. Boyacı, “DecoyPot: A large language model-driven web API honeypot for realistic attacker engagement,” Computers & Security, vol. 154, Jul. 2025.
U. Raut, A. Nagarkar, C. Talnikar, M. Mokashi and R. Sharma, “Engaging attackers with a highly interactive honeypot system using ChatGPT,” 2023 7th International Conference On Computing, Communication, Control And Automation (ICCUBEA), Pune, India, 2023, pp. 1–5.
W. Fan et al., “HoneyLLMd: A large language model-powered adaptive honeypot system,” in IEEE Transactions on Network Science and Engineering, vol. 13, pp. 8646–8665, 2026.
T. Luo, Z. Xu, X. Jin, Y. Jia, and X. Ouyang, “Intelligent-interaction honeypot for IoT devices,” U.S. Patent 10,986,126 B2, Apr. 20, 2021.
C. Guan, H. Liu, G. Cao, S. Zhu, and T. La Porta, “Honeyiot: Adaptive high-interaction honeypot for IoT devices through reinforcement learning,” in Proceedings of the 16th ACM Conference on Security and Privacy in Wireless and Mobile Networks, Jun. 2023, pp. 49–59.
S. Chamotra and F. Barbhuiya, “SAGE: An adaptive IoT honeypot with FSM-driven protocol emulation and GraphRAG-powered response generation,” ACM Transactions on Internet of Things, vol. 7, no. 2, Apr. 2026, pp. 1–34.
H. T. Otal and M. A. Canbaz, “LLM Honeypot: Leveraging large language models as advanced interactive honeypot systems,” 2024 IEEE Conference on Communications and Network Security (CNS), Taipei, Taiwan, 2024, pp. 1–6.
W. Fan, Z. Yang, Y. Liu, L. Qin, J. Liu, “Honeyllm: A large language model-powered medium-interaction honeypot,” in International Conference on Information and Communications Security, Dec. 2024, pp. 253–272.
P. Prasad, N. Girish, S. V, A. Vh and P. K. S, “Generative AI SSH honeypot with reinforcement learning,” 2025 IEEE 14th International Conference on Communication Systems and Network Technologies (CSNT), Bhopal, India, 2025, pp. 770–775.
López PB, Pérez MG, Vasilomanolakis E, and Nespoli P., “Reactive cyber deception: Stealth-based adaptive redirection to on-demand honeypots with AI-driven data generation,” Computer Networks. Vol. 281, Mar. 2026.
R. A. Bridges, T. R. Mitchell, M. Muñoz and T. Henriksson, "SoK: Honeypots & LLMs, More Than the Sum of Their Parts?," 2026 IEEE 11th European Symposium on Security and Privacy (EuroS&P), Lisbon, Portugal, 2026, pp. 910-928.
