Imagine creating a fake website, a decoy to attract hackers. But it's not a static site: it's an intelligent system that learns from every intrusion attempt. This is ADLAH: a 'honeytrap' that uses artificial intelligence to decide in real time when to draw attention and when to stay quiet.
ADLAH is an adaptive honeypot system integrating deep learning and reinforcement learning for threat behavior analysis. The central mechanism uses an RL agent to manage escalation between low-interaction sensors and dynamically provisioned high-interaction honeypots, balancing fidelity and cost. The functional prototype demonstrates real-time decision-making, but field-scale validation is pending. The architecture also includes a module for automated extraction, clustering, and versioning of bot attack chains, addressing the dominance of automated traffic on exposed services. These elements outline a practical roadmap for high-value adversary behavior capture, automated bot classification, and actionable threat intelligence production.
