%!TEX encoding = IsoLatin
%!TEX main = honeypot_and_generative_ai.tex

In this appendix chapter, we explore the implementation of \textbf{tab auto-completion} in a simulated Linux terminal environment, part of a honeypot system integrated with generative AI. The purpose of this feature is to mimic the behaviour of a typical Linux terminal, allowing users to type partial commands and have the system suggest or complete the input automatically. The concept of tab auto-completion is widely adopted in many command-line interfaces (CLIs), particularly in Unix-like operating systems, where it aids users by suggesting possible commands, file names, or options based on the initial input. This improves efficiency and reduces the likelihood of user error. In the context of a honeypot, tab auto-completion can play a dual role. It enhances the realism of the simulated environment and allows the system to analyse user behaviour in real-time, using the generative AI component to provide dynamic responses. The honeypot can gather valuable data for analysis, such as command usage patterns and potential malicious activities, by tracking the user's interaction with the auto-completion feature.

\section{readline Module}

The ``readline'' module is a core Python library that provides line-editing and history capabilities to interactive command-line interfaces. It enables advanced input handling, allowing users to navigate through input history, edit lines, and use shortcuts. A crucial aspect of readline is its ability to provide tab auto-completion, which offers suggestions for commands, filenames, or parameters, creating a seamless and user-friendly experience. The primary mechanism of tab auto-completion in readline involves binding the ``tab'' key to trigger a ``completer'' function, which generates possible suggestions based on the current input. By leveraging the readline module, we can simulate the experience of an actual Linux terminal, allowing users to dynamically type partially completed commands and receive intelligent suggestions.

\subsection{input()}

In Python, the ``input'' function captures user input from the command line. By default, it waits for user input and returns the typed string once the user presses the enter key. However, without additional features, \textit{input()} lacks the sophisticated line-editing and auto-completion functionalities that users expect in a terminal environment. This is where the readline module enhances its functionality. We enable extended features by integrating readline with input(), making the terminal more interactive and user-friendly. This is especially important in a honeypot terminal simulation, where we aim to recreate a realistic environment to encourage typical user behaviour, which the system can monitor and analyse.

\subsection{set\_completer() and completer}

A vital feature of the readline module is its ability to allow for custom tab auto-completion through the \textit{set\_completer()} function. It accepts a Python function as its argument, known as the ``completer'', that will determine the suggestions provided to the user when they press the tab key. It takes two parameters:

\begin{itemize}
    \item \textbf{Current Text}: the partial input the user is trying to complete.
    \item \textbf{State}: an integer used to cycle through possible completions.
\end{itemize}

The completer function returns a list of possible completions based on the user input and state. This is how \textit{set\_completer()} and \textit{completer()} are bound:

\begin{verbatim}
    readline.set_completer(completer)
\end{verbatim}

\subsection{parse\_and\_bind()}

The \textit{parse\_and\_bind()} function in the readline module is used to bind specific keys to commands or functions. In our case, it binds the tab key to the completion function, allowing users to trigger auto-completion by pressing the tab. This function takes a string argument in the format \textit{key: action}, where ``key'' is the key to be bound and ``action'' is the function or command to be executed. For instance:

\begin{verbatim}
    readline.parse_and_bind(`tab: complete')
\end{verbatim}

binds the tab key to the completion function. As a result, when the user presses the tab key while typing a command in the terminal, the \textit{set\_completer()} function is triggered, and the terminal suggests possible completions. Binding keys like this is crucial for creating an intuitive terminal simulation. It ensures that the simulated environment behaves as a user would expect in an actual Linux terminal, thereby enhancing the realism of the honeypot.

\section{Integration with Generative AI}

Implementing tab auto-completion in a simulated honeypot environment introduces several unique challenges. The goal is to replicate the behaviour of a Linux terminal as closely as possible while integrating generative AI to provide intelligent, context-aware suggestions. One key challenge is creating an auto-completion system that balances realism with functionality. In a natural environment, the system suggests commands, file names, or arguments based on the current context. In the honeypot, we can enhance this by using generative AI to offer dynamic suggestions based on user behaviour, the current session, or even anticipated malicious activity. For example, the AI might recognise when a user attempts to execute a series of related commands and offer completions that guide them toward specific actions. This creates a more engaging and believable experience for the user while also providing the honeypot system with valuable data about the user's behaviour.

\subsection{SYNAPSE implementation}

In the case of SYNAPSE, the implementation of tab auto-completion has been achieved with partial success. SYNAPSE utilises a custom completer function that integrates generative AI to simulate the auto-completion process. The system begins with a prompt feeding the AI, such as

\textit{Emulate the tab auto-completion of a Linux terminal \dots}

Which follows the principles of ``Persona Prompting''. This method allows the AI to generate suggestions when the user types a partial command or word. However, the current implementation only works in a limited capacity. Specifically, the AI generates a single completion based on the starting fragment of the word provided by the user. While this does enable essential word completion, it lacks a deeper contextual awareness. The AI cannot access or know the simulated environment's dynamically generated directories, files, or content structures. Without this context-linking mechanism, SYNAPSE's AI provides only generic word completions rather than precise suggestions related to the user's immediate environment. For example, it cannot complete directories or file names based on the simulated environment's state, which is a significant limitation compared to a fully realised tab auto-completion system.

To enhance the functionality and make the AI completions more accurate and context-aware, the system would need to be expanded to include details about the dynamically generated directories and files in the prompt. By integrating this information into the AI's prompt, the system could provide relevant completions that reflect the current state of the simulated terminal. This would create a more robust and realistic simulation, offering a more immersive user experience and increasing the utility of the auto-completion feature. In summary, while SYNAPSE has successfully implemented a basic version of tab auto-completion using generative AI, further integration of contextual data from the simulated environment would be necessary to achieve complete, accurate, and context-sensitive completions. This is a potential avenue for future development to enhance the realism and effectiveness of the simulated terminal experience.