%!TEX encoding = IsoLatin
%!TEX main = honeypot_and_generative_ai.tex

The constantly evolving landscape of cybersecurity demands more sophisticated and adaptive defence strategies. This thesis explored the intersection of honeypot technology and generative AI to address the limitations of traditional static defences, proposing a dynamic system capable of evolving in real-time. This research's core is SYNAPSE (Synthetic AI Pot for Security Enhancement), an innovative AI-driven honeypot designed to simulate realistic environments and interact with attackers dynamically. By integrating machine learning technologies and automatic log mapping to the MITRE ATT\&CK framework leveraging its SYNAPSE-to-MITRE extension, SYNAPSE significantly enhances the capability to detect, map, and respond to cyber threats in real-time. Throughout this work, experiments were conducted to evaluate the effectiveness of SYNAPSE compared to traditional honeypot systems. The findings demonstrate how combining AI with honeypots strengthens cybersecurity defences and shifts the paradigm from passive monitoring to active, anticipatory threat detection.

Chapter \ref{chap:introduction} introduced the thesis by examining the challenges of the modern cybersecurity landscape, where the evolving nature of threats renders static defence strategies insufficient. It discusses the Defender's Dilemma, highlighting the imbalance between attackers who exploit single vulnerabilities and defenders who must protect all entry points. The chapter argues for the necessity of a dynamic approach and sets the stage for SYNAPSE.

Chapter \ref{chap:literature_review} comprehensively reviewed this thesis's foundational concepts. It discusses information security and cybersecurity, highlighting core principles, the evolving threat landscape, and emerging trends. The chapter then delves into the role of honeypots in cybersecurity, covering their objectives, classifications, ethical considerations, and real-world examples. The following sections explore generative artificial intelligence (AI), particularly large language models (LLMs) and prompt engineering, which are crucial to SYNAPSE's dynamic capabilities. The review also addresses machine learning (ML), focusing on types of models, training methods, and their application in natural language processing (NLP). Finally, the chapter discusses the MITRE ATT\&CK framework, detailing its structure, advantages, and relevance to SYNAPSE's automatic log mapping. The literature review concludes by examining AI applications in cybersecurity, focusing on integrating honeypots and AI, comparing this approach with traditional honeypots, and identifying the advantages and limitations of generative AI-enhanced honeypot systems.

Chapter \ref{chap:methodology} outlined the methods used to develop and implement SYNAPSE. It is a Python-based system that simulates a Linux OS terminal and critical services such as SSH and MySQL servers, leveraging generative AI. The chapter begins by describing the classification and setup of SYNAPSE. Although primarily categorized as a low-interaction honeypot, it incorporates features typically found in higher-interaction systems, allowing attackers to engage more deeply while remaining in a controlled environment. SYNAPSE was deployed in a virtual environment, offering scalability and flexibility while optimizing resource use for better performance during simulations. The methodology section also outlines the development of SYNAPSE, tracing its evolution from the initial shelLM project to its current form. Its main features include prompt engineering techniques and large language models (LLMs) to simulate realistic interactions. How the AI processes requests is detailed, illustrating how it computes responses in real-time based on attacker behaviour.
Additionally, SYNAPSE maintains a memory of user interactions, allowing multiple sessions for the same user to enhance the realism of the simulated environment. The system collects extensive data from attacker interactions, including command logs, IP addresses and reputations, ports used, geolocation information, and connection numbers and duration. This data is vital for analyzing and understanding attacker behaviour patterns. One of the most significant innovations in SYNAPSE's methodology is the SYNAPSE-to-MITRE extension, which automates the mapping of attack logs to the MITRE ATT\&CK framework. This feature leverages machine learning techniques to quickly identify attack tactics and provide real-time insights for defenders. The methodology describes how, starting from an existing dataset, this has been enhanced to include the most recent knowledge from the MITRE ATT\&CK database. It is then used to train a machine learning model that can classify unstructured cyber threat intelligence (CTI) sentences into mappings over the MITRE ATT\&CK framework, allowing for more accurate and up-to-date analysis of attack strategies.
Additionally, the methodology outlines how the model training and mapping processes work, explaining the workflow that enables SYNAPSE to classify and map attack patterns efficiently. Case studies were also conducted, including AI vs AI scenarios where SYNAPSE interacted with AI-driven attack tools. Additionally, the methodology presents DENDRITE, a traditional honeypot system, explaining its design and functionality. It details how DENDRITE has been developed to be equivalent to SYNAPSE in structure and configuration, allowing for direct comparative analysis.

Chapter \ref{chap:results} presented the experiments to evaluate SYNAPSE's performance. Three distinct experiments have been discussed, each designed to assess different capabilities. The first experiment focuses on real-world attackers interacting with SYNAPSE. It analyzes data such as IP addresses and reputations, geolocations, the number of connections, and connection duration. These findings provide a global perspective on attack origins, illustrating effectiveness in capturing critical intelligence. The second experiment involved controlled user interactions, comparing SYNAPSE with its static counterpart, DENDRITE. It measured how effectively the honeypot integrated with AI deceives attackers by simulating a natural environment. The results of this comparative analysis highlighted SYNAPSE's superior ability to mimic realistic system behaviour, making it more difficult for attackers to distinguish between the honeypot and a legitimate system. The third experiment examined AI-driven attacks. This scenario tested SYNAPSE's adaptability and ability to map complex attack techniques to the MITRE ATT\&CK framework. The results demonstrated that the SYNAPSE-to-MITRE extension effectively and accurately classified attack techniques, providing defenders with actionable insights. Together, these experiments underscore the advantages of integrating AI into honeypots, showcasing SYNAPSE's ability to dynamically respond to and analyze a wide range of cyber threats. The results confirm that SYNAPSE enhances cybersecurity by transforming passive monitoring systems into proactive defence mechanisms.

\section{Broader Implications of AI in Cybersecurity}

In addition to the immediate benefits demonstrated by SYNAPSE, integrating AI into cybersecurity holds vast potential across various domains. This research advances honeypot technology and establishes a strong precedent for future developments in AI-driven defence mechanisms. AI's ability to learn and adapt in real-time offers applications in areas such as intrusion detection systems (IDS), automated vulnerability scanning, and threat hunting, where traditional security tools often struggle to keep up with rapidly evolving threats. Through the experiments conducted in this thesis, it has been demonstrated that incorporating AI into cybersecurity defences brings distinct advantages. AI can autonomously process vast amounts of data, recognize patterns, and adjust strategies faster than manual or static methods.

Furthermore, automatically mapping logs and unstructured cyber threat intelligence (CTI) to structured frameworks such as MITRE ATT\&CK significantly enhances operational efficiency. The ability of SYNAPSE to classify attacker tactics and techniques in real-time, using machine learning models trained on the latest MITRE ATT\&CK datasets, illustrates how AI can reduce the time required for threat analysis and response. Traditionally, mapping attacker behaviour to frameworks like MITRE ATT\&CK is a manual, time-consuming process, requiring skilled analysts to examine logs and CTI. By automating this process, SYNAPSE saves time, enabling defenders to focus on response strategies rather than being engaged by data processing. This shift to automation can accelerate the speed at which organizations can detect, understand, and mitigate attacks, reducing the overall impact of a breach. The implications extend beyond SYNAPSE, offering a vision for AI-integrated security architectures that can evolve with the threats they face. As AI becomes more advanced, it could be applied to various cybersecurity functions, such as automated incident response, where AI-driven systems take predefined actions based on specific attack patterns.
Additionally, AI could enhance behavioural analysis and predictive threat modelling, providing security teams with real-time alerts based on detecting anomalies that indicate potential threats. The successful demonstration of these concepts through SYNAPSE paves the way for future innovations in integrating AI with established cybersecurity frameworks like MITRE ATT\&CK.

\section{Challenges or Limitations}

While SYNAPSE demonstrated significant advancements in integrating AI with honeypot technology, some notable challenges and limitations must be considered when deploying AI in critical cybersecurity applications. One primary concern is the risk of AI ``hallucinations'', where generative models produce incorrect or misleading outputs that do not correspond to the input data. Critical applications requiring precise and reliable outputs can lead to errors in analysis, potentially causing misclassifications or overlooking key attack details. The consequences of such mistakes in cybersecurity, where accuracy is paramount, could result in misinformed defence strategies, delayed responses, or even undetected threats. Another limitation is the context window of AI models. Large language models (LLMs) are typically constrained by the context they can retain, which becomes problematic in long-running sessions where the prompt grows excessively large. Over time, as attackers interact with SYNAPSE over extended periods, the accumulated interactions may cause the AI to lose track of earlier context, leading to response inaccuracies. This loss can severely impact the continuity and consistency of AI-generated responses, limiting the effectiveness of the honeypot in understanding and adapting to evolving attacker strategies across multiple sessions.
Moreover, the response time required for AI to compute answers poses a potential risk in time-sensitive applications. While AI can process and generate responses quickly, there is still an inherent delay, especially when the task involves complex computations. Systems that depend on instantaneous reactions, such as real-time attack mitigation or incident response, may find AI's processing speed inadequate, creating a bottleneck that could allow threats to escalate.

A further challenge lies in training AI models to achieve high-performance metrics. Training a machine learning model, which maps unstructured data to structured frameworks like MITRE ATT\&CK, requires a well-curated and large dataset. In the context of SYNAPSE, the AI must generate sentences summarising logs to align with the patterns in the data used for training. Any inconsistency between the generated data and the training set can negatively impact the model's ability to map accurately. Obtaining and preparing such high-quality datasets is a resource-intensive task that demands significant expertise and time.
Furthermore, ensuring the generated sentences are semantically and structurally similar to the training data is challenging, especially in real-world scenarios where attack patterns vary widely. Given the variability in unstructured cyber threat intelligence (CTI) data structure, ensuring that the AI consistently maps these logs to the correct tactics and techniques requires advanced training and rigorous testing. Achieving high precision and recall in these mappings is crucial for providing actionable insights but remains challenging due to the diversity of CTI formats and evolving attacker strategies.

Finally, managing ethical and legal considerations is another challenge when deploying AI in cybersecurity. As AI systems interact with attackers and collect data, there are concerns about data privacy, consent, and handling sensitive information. Additionally, deploying AI-driven honeypots raises questions about the ethical use of deception in cybersecurity defence. Navigating these moral and legal landscapes requires a clear understanding of regulations regarding how AI can be used and how data should be handled. Striking a balance between collecting valuable intelligence and maintaining ethical and legal compliance is an ongoing challenge in AI-based cybersecurity systems.

\section{Applications of SYNAPSE in Cybersecurity}

The findings of this thesis demonstrate how SYNAPSE can be applied in real-world cybersecurity environments, particularly in industries that are frequent targets of advanced persistent threats (APTs) or sophisticated cyberattacks. Sectors such as finance, healthcare, energy, and government agencies, where attackers often employ advanced and evolving tactics, would benefit from SYNAPSE's adaptive capabilities. Organizations could deploy SYNAPSE as part of their threat intelligence and monitoring strategies, using its generative AI-driven functionality to engage attackers, gather valuable data, and continuously improve their defences. SYNAPSE's integration with the MITRE ATT\&CK framework offers an efficient approach for real-time mapping of adversary tactics, techniques, and procedures (TTPs). This mapping enables security teams to recognize attack patterns as they unfold, providing immediate insights into potential attack vectors. By automating the mapping process, SYNAPSE significantly reduces the time required for human analysts to interpret attack data, thereby enhancing the speed and efficiency of response strategies. This feature is precious in large-scale enterprise environments, where manual threat analysis may delay critical responses to complex cyberattacks.
Additionally, SYNAPSE's ability to simulate realistic environments makes it an invaluable tool for deception-based security strategies. Unlike traditional honeypots, SYNAPSE can dynamically evolve based on attacker behaviour, making it more difficult for adversaries to identify and evade the honeypot. In real-world settings, this capability can delay and divert attackers from actual production systems, buying valuable time for security teams to respond.

SYNAPSE's flexibility as a cloud-based or on-premises system makes it scalable to a wide range of organizations. It can be deployed in cloud environments for greater scalability, allowing multiple instances to monitor distributed networks or cloud-based applications. Alternatively, it can be implemented in on-premises infrastructures where strict compliance, privacy, or legal requirements must be adhered to, such as in regulated industries like banking or healthcare. Another potential application of SYNAPSE lies in its ability to be integrated into security operations centres (SOCs). Within a SOC, SYNAPSE could function as an active component of a cyber threat intelligence platform, autonomously engaging with and analyzing attacks and delivering high-fidelity intelligence that can be acted upon quickly. The data SYNAPSE collects could also be invaluable for forensic analysis post-breach, providing detailed logs and timelines that help investigators understand the full scope and methodology of the attack.

Beyond organizational security, SYNAPSE could also be applied in educational settings as a training tool. Its AI-driven adaptability allows for creating simulated cyberattack environments where cybersecurity professionals can practice and refine their incident response strategies. By exposing trainees to various attack vectors, including AI-driven adversaries, SYNAPSE can help build more robust security teams capable of responding to complex, evolving threats in real-time. In summary, SYNAPSE represents a next-generation security tool that can be effectively applied in various real-world scenarios. Its adaptive AI capabilities and automated threat intelligence mapping make it a powerful asset in protecting against current and future cyber threats, enhancing organizational resilience and reducing response times in critical incidents.

\section{Advancing SYNAPSE: Future Improvements}

Regarding future improvements, SYNAPSE can evolve in several critical areas to enhance its efficiency, adaptability, and realism. One potential avenue is leveraging more advanced AI models, such as the forthcoming ``GPT-5'', or specialized AI models that can be run locally. Running models locally could theoretically reduce latency by minimizing data transmission times and offering faster, more immediate responses. However, this benefit must be weighed against the significantly lower computational power available on local systems compared to cloud-based infrastructure. Local environments, especially for smaller organizations, typically lack the hardware necessary to run highly complex AI models efficiently, leading to limitations in the size and complexity of the models that can be deployed. For example, a locally deployed model might reduce latency. Still, its overall performance could suffer if the system cannot handle the computational load, resulting in less accurate responses or slower processing times. Moreover, the energy consumption and hardware costs associated with running advanced AI models locally would likely be substantial, making this approach more suitable for large enterprises with robust infrastructures.

Another essential upgrade would involve addressing AI ``hallucinations'', where the model generates incorrect outputs. Future iterations of SYNAPSE could incorporate better model fine-tuning or error-detection algorithms to minimize these inaccuracies. Additionally, increasing the model's context window would improve SYNAPSE's capacity to handle long sessions with attackers without losing track of prior interactions. This is especially important in advanced cyberattacks that span extended periods, requiring the AI to maintain context over multiple stages of the engagement. In terms of functionality, expanding the number of simulated services beyond SSH and MySQL would make SYNAPSE more attractive to a broader range of attackers. Adding popular services like FTP, HTTP, or SMTP would increase the honeypot's appeal and provide richer data for analysis. Feedback from experiment two (see Section \ref{sec:experiment_two}) also indicated that SYNAPSE's terminal simulation could benefit from usability improvements, such as introducing a coloured terminal interface and tab completion. These are standard features in real-world terminal environments and would significantly enhance SYNAPSE's realism, making it even harder for attackers to distinguish it from legitimate systems.

Another critical area for future development is improving mapping accuracy to the MITRE ATT\&CK framework. The current setup generates multiple mappings to increase coverage, but future versions of SYNAPSE should focus on developing the precise number of mappings based on the attack's characteristics. By tailoring the mapping process, SYNAPSE could better account for attacks correlating to multiple techniques within MITRE ATT\&CK, ensuring that only relevant tactics are highlighted. Furthermore, adopting a more advanced machine learning model could help enhance classification accuracy, allowing for better alignment between unstructured logs and MITRE techniques. To maintain the relevance of its mappings, SYNAPSE would also benefit from automating and updating its dataset with the latest information from the MITRE ATT\&CK framework. As new tactics, techniques, and procedures (TTPs) are identified and added to the database, SYNAPSE's model should be continuously updated to reflect these changes. Automating this update process ensures that SYNAPSE remains current with the latest attack strategies, allowing for accurate and up-to-date threat intelligence analysis.

In conclusion, SYNAPSE's future evolution lies in its ability to integrate more advanced AI models, improve operational speed and accuracy, simulate a more comprehensive set of services, and refine its threat mapping capabilities. Enhancing the system's realism, responsiveness, and adaptability will allow SYNAPSE to continue being a cutting-edge cybersecurity defence tool while ensuring it remains effective in the face of evolving cyber threats. With ongoing improvements, SYNAPSE could outperform traditional honeypots and redefine how organizations approach cybersecurity, making it a proactive and intelligent component of any defence strategy.