%!TEX encoding = IsoLatin
%!TEX main = honeypot_and_generative_ai.tex

In cybersecurity, one principle stands indisputable: the field is inherently dynamic and ever-evolving. There's no opportunity to be static; everything needs to change fast to compete with the mutable nature of cyber threats; they continuously morph, adapt, and increase in complexity as new vulnerabilities are discovered and exploited. This exponential evolution means that defensive strategies must also be equally fluid, capable of adapting in real-time to counteract new and unforeseen risks. The Defender's Dilemma is a well-known challenge in the ongoing battle between cyber attackers and defenders. While an attacker needs to find just one vulnerability to exploit, the defender must secure all potential entry points, making defence a far more complex and exhaustive task. An enhanced level of dynamicity in security strategies is essential to address this asymmetry. Static or reactive solutions are no longer sufficient, while effective to a certain extent. They often struggle to keep pace with the rapidly evolving landscape. Traditional cybersecurity technologies can become obsolete almost as soon as they are deployed, undermined by attackers who are always seeking new ways to penetrate them. This dynamic nature requires the implementation of more advanced and flexible defence mechanisms that can evolve with the threats they are designed to counteract.

One critical component of modern cybersecurity strategies is using honeypots. These systems are intentionally deployed to attract attackers, allowing security professionals to monitor and analyze malicious activities and capture their tactics and strategies. They are not static barriers; they are interactive environments for intruders, making them an essential tool for gathering threat intelligence. 
However, as attackers become more experienced, there is a growing need for honeypots to evolve. Advancements in cybersecurity are occurring alongside the emergence of artificial intelligence (AI), incredibly generative AI, demonstrating significant potential in various fields. It consists of algorithms that generate new content, such as text, images, or code, by learning from existing data. In cybersecurity, generative AI has opened new possibilities for attackers and defenders. Malicious actors may use it to create more convincing phishing attacks or to automate the discovery of vulnerabilities. Defenders can leverage the same technology to enhance security measures.

This is where the intersection of honeypots with generative AI becomes particularly promising. By integrating the adaptive capabilities of AI with the deceptive nature of honeypots, it is possible to create more intelligent, resilient, mutable, and responsive security systems that are harder to detect and evade. Honeypots can be designed to deceive attackers more effectively and learn and evolve in response to the tactics used against them, thereby providing a more proactive defence mechanism in contraposition to the purely reactive one. These dynamic systems will have the power to continuously alter their behaviour and structure to stay one step ahead of attackers, thus alleviating the Defender's Dilemma by making it harder to predict and exploit security measures.

The ability to quickly and accurately interpret data from security systems is paramount in the ever-evolving cybersecurity landscape. Honeypots, which capture extensive logs of attacker activities, generate valuable insights into the methods and tactics employed by adversaries. However, manually analyzing these logs can be time-consuming and prone to oversight, especially given the vast volume and complexity of data. To enhance the effectiveness of honeypots, it is crucial to automatically map the collected logs to the MITRE ATT\&CK framework, a comprehensive and widely recognized knowledge base of adversary tactics and techniques. By making this mapping process dynamic, security teams can immediately contextualize the activities observed in honeypot logs, identifying specific attack patterns and understanding the broader strategy behind the intrusion attempts. This accelerates the analysis process and improves threat detection accuracy, enabling defenders to prioritize their responses based on the identified tactics. Furthermore, automatic mapping to the MITRE ATT\&CK framework allows for continuously updating defence strategies in line with emerging threats.

The convergence of AI-driven dynamic honeypots with automatic log mapping to frameworks like MITRE ATT\&CK gives birth to a new era of evolved cybersecurity. These complex systems can grow by integrating generative AI into honeypots, creating interactions that challenge even the most experienced attackers. This dynamic evolution transforms honeypots from passive lures into active participants in the defence strategy, continuously reshaping the attack surface and introducing unpredictable elements that trick adversaries. Furthermore, automating log mapping through the integration with standardized frameworks like MITRE ATT\&CK ensures that these honeypots' vast amounts of data are immediately actionable. This strategic combination accelerates incident response, enabling defenders to recognize patterns, attribute attacks, and refine defensive measures in real-time. As a result, organizations gain a more resilient defence and a more anticipatory security posture that preemptively mitigates risks before they escalate into crises. The defensive paradigm is redefined, shifting the balance of power towards the defenders in the arms race of cybersecurity.

This thesis centres on the development and implementation of SYNAPSE (Synthetic AI Pot for Security Enhancement)\footnote{\url{https://github.com/eneagizzarelli/SYNAPSE}}, a cutting-edge dynamic honeypot designed to address the evolving challenges in cybersecurity. SYNAPSE is a sophisticated honeypot that simulates a Linux OS terminal and leverages the power of generative AI. Unlike traditional honeypots that rely on fundamental terminal interactions, SYNAPSE generates realistic outputs using AI, creating an immersive and deceptive environment for attackers. The current iteration of SYNAPSE includes simulations of two critical services: an SSH server and a MySQL server. These services are engineered to respond to attacker commands as if operating on a natural system, utilizing advanced prompt engineering techniques to enhance realism.
Furthermore, SYNAPSE incorporates the SYNAPSE-to-MITRE extension, which automatically maps the logs collected by SYNAPSE to the MITRE ATT\&CK framework, leveraging machine learning technologies. By combining the adaptive capabilities of AI with the strategic intelligence of the MITRE ATT\&CK framework, SYNAPSE offers a robust and forward-thinking solution to modern cybersecurity challenges, improving both the detection and analysis of cyber threats. This research aims to validate SYNAPSE's effectiveness and explore its potential to transform and enhance the landscape of cybersecurity defence.

\section{Objectives}

The primary objective of this thesis is to explore how the combination of honeypot technology and generative AI can transform cybersecurity defence systems, focusing on the development and evaluation of SYNAPSE, a dynamic AI-powered honeypot. This research will examine how SYNAPSE can evolve traditional honeypots, making them more effective in real-time interactions with attackers and enhancing the overall defence strategy. The thesis also compares SYNAPSE and DENDRITE, a traditional, static system, to highlight the strengths and limitations of incorporating AI into honeypots. The comparative analysis will be essential to evaluate SYNAPSE's ability to simulate a real-world system convincingly while operating in parallel with DENDRITE. This research also assesses SYNAPSE's ability to map its logs to the MITRE ATT\&CK framework. By automating this log mapping, SYNAPSE aims to accelerate the identification and classification of attack patterns, offering security teams real-time insights and improving their ability to respond to ongoing threats.

Furthermore, the thesis will validate the functionality of SYNAPSE through extensive experimentation, including both controlled scenarios and real-world use cases. One such experiment will involve SYNAPSE interacting with AI-driven attack tools to test its ability to detect, respond to, and mitigate advanced AI-generated threats. In these AI vs AI scenarios, the adaptability and robustness of SYNAPSE will be tested to measure how well it can counteract automated attack strategies and map logs to the MITRE ATT\&CK framework. The research will also explore the system's performance in real-world conditions by setting up environments where SYNAPSE engages with genuine attackers or users, providing invaluable insights into its effectiveness under authentic threat conditions.

Ultimately, this thesis aims to contribute to the evolution of cybersecurity defence mechanisms by demonstrating how AI-driven technologies like SYNAPSE can enhance honeypot resilience, allowing for more proactive and dynamic responses to cyber threats. Through real-world experimentation and a comparative analysis with traditional systems, the research seeks to validate the effectiveness of AI-enhanced honeypots and propose innovative strategies for strengthening cybersecurity defences.

\section{Collaboration with Spike Reply}

The successful completion of this thesis was made possible through the collaboration with ``Security Reply Srl'', specifically within its ``Spike Reply'' division, under the ``Detection and Response'' team. The company provided essential resources and support throughout the research process, enabling the project to be conducted effectively and rigorously. Under the expert supervision of Dr. Davide Manco and Dr. Enrico Cavicchini, the research was guided by their extensive knowledge and commitment to excellence. Their continuous feedback and mentorship ensured that all phases of the project were aligned with academic rigour and industry best practices, enhancing the overall quality and relevance of the work. ``Spike Reply'' contributed technical and material support and offered a dynamic environment conducive to practical learning and professional development. Participation in the ``Detection and Response'' team facilitated the integration of advanced cybersecurity tools and methodologies, bridging theoretical knowledge with real-world applications. This collaboration greatly enriched the research, ensuring the outcome was academically sound and practically significant within cybersecurity.