%!TEX encoding = IsoLatin
%!TEX main = honeypot_and_generative_ai.tex

Before diving into the specifics of SYNAPSE, it is essential to review the existing literature on key concepts such as information security, cybersecurity, honeypots, generative artificial intelligence (AI), machine learning (ML), and the MITRE ecosystem. These areas provide the foundational context for understanding the challenges and innovations that SYNAPSE addresses. By exploring the existing research in these domains, this review will set the stage for a deeper examination of how SYNAPSE builds upon and contributes to these critical areas of study.

\section{Information Security and Cybersecurity}

Security has become a paramount concern for companies. As organisations increasingly rely on digital systems to manage operations, store sensitive data, and interact with customers, the risk of cyber threats has grown exponentially. The consequences of security breaches can be devastating. Beyond the financial impact, the long-term damage to the reputation can be irreparable. Customers and stakeholders expect businesses to safeguard their data, and a failure to do so can lead to a loss of confidence that is difficult to rebuild. Cyberattacks disrupt business operations and expose confidential information, leading to severe regulatory penalties, especially with stringent data protection laws like GDPR.
Moreover, the fact that global business ecosystems are connected means that a security breach in one organisation can have a ripple effect, impacting partners, suppliers, and customers.

In this context, security is a fundamental business priority that requires robust security measures, continuous monitoring, and an organisation-wide awareness. Investing in cybersecurity is, therefore, not just about protecting assets; it's about ensuring the business's trustworthiness and future growth in an increasingly digital world. Companies prioritising security can differentiate themselves, demonstrating their commitment to safeguarding their customers' and stakeholders' interests.

\subsection{Definitions and Comparison}

Information Security and Cybersecurity are critical fields that protect assets and sensitive data from unauthorised access, damage, and other malicious activities. While the terms are often used interchangeably, they have distinct scopes (see \ref{fig:infosec_vs_cybersec}). As the National Institute of Standards and Technology (NIST) reports, information security is concerned with ``\textit{the protection of information and systems from unauthorised access, use, disclosure, disruption, modification, or destruction to provide confidentiality, integrity, and availability}'' \cite{infosec}. Cybersecurity, a broader term, encompasses protecting systems, networks, and data from cyber threats. We could state that the second is a subset of the first, protecting online or internet-connected devices, systems and technologies from cyberattacks \cite{infosec_vs_cybsec}.

\begin{figure}[tbh]
    \centerline{\includegraphics[width=0.3\textwidth]{figures/infosec_vs_cybsec.png}}
    \caption{Information Security and Cybersecurity (source: \href{https://www.geeksforgeeks.org/cybersecurity-vs-network-security-vs-information-security/}{GeeksforGeeks}).\label{fig:infosec_vs_cybersec}}
\end{figure}

\subsection{Core Principles of Information Security}

The foundation of information security is built on the CIA triad (see Figure \ref{fig:cia_triad}):

\begin{itemize}
    \item \textbf{Confidentiality}: guarantees that confidential data can only be accessed by authorized individuals, usually through encryption, access controls, and authentication methods.
    \item \textbf{Integrity}: securing data integrity is crucial throughout its lifecycle to prevent unauthorized changes or deletion. This is typically accomplished through checksums, version control, and data validation.
    \item \textbf{Availability}: guaranteeing that authorized users access necessary information and resources at all times demands backup solid solutions, disaster recovery plans, and fault-tolerant systems.
\end{itemize}

\begin{figure}[tbh]
    \centerline{\includegraphics[width=0.5\textwidth]{figures/cia_triad.png}}
    \caption{The CIA Triad (source: \href{https://www.f5.com/labs/learning-center/what-is-the-cia-triad}{F5 Labs}).\label{fig:cia_triad}}
\end{figure}

\subsection{The Cybersecurity Threat Landscape}\label{subsec:cyb_threat_landscape}

The rapidly evolving threat landscape poses significant challenges to cybersecurity and information security. Threats can be broadly categorised into:

\begin{itemize}
    \item \textbf{Malware}: including viruses, worms, and ransomware, malware disrupts, damages, or gains unauthorised access to information systems.
    \item \textbf{Phishing and Social Engineering}: attackers use deceptive tactics to trick individuals into divulging sensitive information, bypassing technical security measures.
    \item \textbf{Insider Threats}: employees with access to information systems may pose a risk if they misuse their access maliciously or negligently.
    \item \textbf{Advanced Persistent Threats (APTs)}: prolonged and targeted cyberattacks to steal sensitive data or disrupt critical infrastructures, often by nations, states or highly organised criminal groups.
\end{itemize}

The complexity of these threats necessitates a layered security approach, integrating both technical controls and human factors. Among the innovative defensive strategies being developed, honeypots have gained relevance as an effective way to study attack methods and protect critical assets. The role of honeypots in the modern cybersecurity ecosystem will be discussed in greater detail in the upcoming sections (see Section \ref{sec:honeypot}).

\subsection{Emerging Trends in Cybersecurity}\label{subsec:emerging-trends}

As the digital landscape continues to evolve, so does the cybersecurity field, which is increasingly characterised by sophisticated threats and innovative defensive strategies. The dynamic nature of cybersecurity necessitates a continuous adaptation to emerging trends, with a particular focus on integrating advanced technologies, revisiting traditional security principles, and addressing new challenges in the digital realm.

\subsubsection{Artificial Intelligence and Machine Learning}

One of the most significant emerging trends in cybersecurity is the integration of Artificial Intelligence (AI) and Machine Learning (ML). These technologies have revolutionised threat detection and response by enabling systems to analyse vast amounts of data at unprecedented speeds, identify patterns, and predict potential threats before they materialise. AI-driven tools can automatically detect anomalies, reduce false positives, and prioritise the most critical threats, thereby enhancing the efficiency and effectiveness of cybersecurity efforts. Machine learning algorithms can adapt to new types of attacks by learning from previous incidents, making defence mechanisms more resilient over time. Moreover, the advent of generative AI, a subset of AI focused on creating new content or data, presents both opportunities and challenges in the cybersecurity landscape. In subsequent sections, these aspects will be explored in more detail (see Section \ref{sec:generative_ai}).

\subsubsection{Zero Trust Architecture}

The traditional perimeter-based security model, which assumed that threats primarily came from outside the network, is increasingly being replaced by the Zero Trust architecture. It is based on the principle that threats can exist inside and outside the network, and thus, no user or device should be trusted by default. This approach requires continuous verification of every access request, regardless of origin. It emphasises the least privilege principle, where users are granted only the minimal access necessary to perform their tasks. By implementing Zero Trust, organisations can better protect against insider threats, lateral movement within the network, and other sophisticated attack strategies.

\subsubsection{The Defender's Dilemma}

The concept of the defender's dilemma is central to the challenges faced by cybersecurity professionals. This principle highlights the asymmetry in the cybersecurity battle, where defenders must protect all possible entry points, while attackers only need to find a single vulnerability to succeed. This imbalance makes defending networks and systems inherently more difficult as the attack surface expands with the proliferation of devices, cloud services, and remote work environments. The defender's dilemma underscores the need for a proactive and layered security approach, where multiple defensive measures work to minimise the chances of a successful attack.

\subsubsection{Security in Depth}

Security in Depth is a foundational principle in cybersecurity that emphasises using multiple layers of defence to protect information systems and data. It is critical in addressing the Defender's Dilemma. Implementing multiple layers of defence ensures that even if an attacker penetrates one layer, additional barriers will protect the system, making it less likely that they will succeed. This strategy acknowledges that no security solution is foolproof and that a combination of defences is more effective in mitigating risks.

\subsubsection{Future Directions and Evolution}

The emerging trends in cybersecurity reflect the growing complexity of the digital world and the need for adaptive, proactive approaches to defence. The integration of AI and ML, the shift to zero-trust architectures, and the recognition of the defender's dilemma are all shaping the future of cybersecurity strategy. As threats evolve, so must the technologies, methodologies, and principles organisations use to protect their data and systems. Staying ahead of these trends is necessary for maintaining security and is critical to modern businesses' broader success and resilience. In the future, we can expect security in-depth to incorporate more advanced measures, further enhancing its effectiveness in protecting against sophisticated cyber threats.

The need for specialised tools and innovative approaches becomes increasingly evident as the cybersecurity landscape evolves. In particular, technologies such as honeypots and generative AI have emerged as crucial components in the arsenal against cyber threats. The subsequent sections of this review will delve deeper into the literature surrounding these technologies, exploring their roles, effectiveness, and the challenges they present in the context of modern cybersecurity (see Sections \ref{sec:honeypot}, \ref{sec:generative_ai}).

\section{Honeypot}\label{sec:honeypot}

In an exponentially increasing digital world where malicious attackers can be considered bees ready to sting good actors, a pot of honey able to attract them, consume their time, study them more closely, and extract information about their behaviour could be a precious resource, allowing victims to better prepare for and defend against their attacks. In this analogy, the ``pot of honey'' represents a strategically designed system or environment miming a vulnerable target, deliberately set up to attract malicious attackers, also known as a ``honeypot'' in cybersecurity.

A \textbf{honeypot} is a decoy computer system whose functioning resides in being attacked or compromised \cite{nawrocki2016surveyhoneypotsoftwaredata}, luring cybercriminals in with the promise of an easy target. Once the attackers engage, the honeypot captures detailed information about their methods, tools, and behaviour, producing logs that can be meticulously analysed to understand the nature of the threat. Honeypots are usually an integral part of a layered security approach, often deployed in conjunction with other security measures such as firewalls, intrusion detection systems (IDS), and antivirus software (see Section \ref{subsec:emerging-trends}). This combination enhances the overall defence strategy, with the honeypot acting as both a detection tool and a source of intelligence. In summary, while honeypots are a valuable tool in the cybersecurity arsenal, they are most effective when combined with other security technologies and practices, forming a comprehensive defence-in-depth strategy.

\subsection{Objectives}\label{subsec:honeypot-objectives}

The primary objectives of a honeypot are multi-faceted. First of all, they are designed to extract valuable and detailed information about attackers' tactics, techniques, and procedures (TTPs), where

\begin{itemize}
    \item \textbf{tactics} refer to the overall strategy or goal of the attacker,
    \item \textbf{techniques} are the specific methods or approaches used to accomplish these tactics,
    \item \textbf{procedures} are the detailed, step-by-step processes attackers follow to execute their techniques involving specific tools or commands.
\end{itemize}

By observing and recording the actions of malicious actors in a controlled environment, security teams can be alerted and gain insights into new and emerging threats. This means acting as a general early warning system before critical structures are impacted, also identifying zero-day vulnerabilities that are previously unknown security flaws that attackers might target. Honeypots can lure bad actors into exposing these vulnerabilities before showing them in real-world scenarios.
Moreover, they divert attackers from genuine systems and data, delay their progress, and consume their resources. By drawing attention away from tangible assets, honeypots reduce the risk of successful breaches, buying time for the organisation to respond and mitigate potential damage by studying attack tactics in a controlled environment. Indeed, honeypots can be used as a practical tool for training cybersecurity professionals, allowing them to practice detecting and responding to attacks in a supervised setting and test and evaluate the effectiveness of existing security measures. Lastly, captured data can also be used in forensic investigations to trace the origins of an attack, understand its impact, and support legal proceedings against cyber criminals.

\subsection{Honeynets}

A honeynet is a network of honeypots designed to simulate a larger, more complex environment that attracts and studies malicious activity. Unlike a single honeypot, an isolated decoy system, a honeynet consists of multiple interconnected pots representing different network parts. The purpose is to create a more realistic and enticing target for attackers, allowing security teams to observe how they interact with various systems, detect coordinated attacks, and gather comprehensive intelligence on their tactics and behaviours.

While honeynets could provide a more complex and realistic scenario, it is essential to note that they will not be the subject of this thesis. Instead, the focus will remain on the specific applications and benefits of individual honeypots within cybersecurity.

\subsection{Classifications}

Honeypot classification goes hand in hand with the multi-faceted nature of its objectives. Depending on the purpose, deployment environment, and the type of interaction they are designed to have with attackers, honeypots can be categorised in various ways \cite{nawrocki2016surveyhoneypotsoftwaredata}. Understanding these classifications is crucial for selecting the correct type of pot to meet specific security needs, whether the goal is to gather intelligence, detect intrusions, or divert malicious activity away from critical systems. The following subsections will explore the types of honeypots and the criteria used to categorise them, highlighting their unique features and applications (see Table \ref{table:honeypot_classification}).

\subsubsection{Field of operation}

Depending on the context in which they are used, honeypots could be classified as either production or research, each designed to address specific needs.

\textbf{Production} honeypots are typically deployed within live (production) environments to protect genuine systems, of which they will run the same services. Their primary objective is to detect and deflect attacks in real-time, often by diverting malicious traffic away from critical systems. They are more straightforward in design, focusing on minimising risks to the production environment while capturing basic information about threats \cite{prod_vs_res}.

In contrast, \textbf{research} honeypots are more complex and are primarily used in controlled environments by cybersecurity researchers. They aim to acquire information on new attack techniques, tools, and behavioural patterns. They allow for an in-depth study of malicious methodologies and trends, providing insights that can be used to develop more robust defences. Differently from production ones, they act in the broader world context, contributing to the long-term understanding of emerging threats \cite{prod_vs_res}.

\subsubsection{Degree of interaction}

Honeypots can be categorised based on the level of interaction they allow with attackers, directly impacting the general complexity and the depth of information they can gather. The degree of interaction ranges from low to high, with each level serving different purposes in cybersecurity:

\begin{itemize}
    \item \textbf{Low-interaction}: simulates only a limited set of services, providing minimal interaction to lure in attackers and gather basic information with low risk. 
    \item \textbf{Medium-interaction}: offers more complexity, engaging attackers with a broader range of simulated services to collect more detailed data without fully emulating a natural system.
    \item \textbf{High-interaction}: mimics entire systems with their operating environments, allowing attackers to engage deeply. This provides the most comprehensive insights into their methods and tactics but carries a higher risk and complexity.
\end{itemize}

\subsubsection{Type of interaction}

Honeypots can be further categorised based on their type of interaction or role within the network, specifically as either server or client honeypots. This distinction is crucial for understanding how these tools interact with attackers and what threats they are designed to attract and analyse.

\textbf{Server} honeypots mimic vulnerable servers or services that attackers commonly target. These honeypots wait passively for attackers to initiate contact, simulating services like web servers, email servers, or databases. The primary objective is to lure attackers who scan for or directly attack these exposed services, capturing their methods and gathering intelligence on the types of exploits they attempt. This is the direction of interaction usually adopted by traditional honeypots.

On the other hand, \textbf{client} honeypots operate more proactively. Instead of waiting for attackers to initiate contact, they seek out malicious servers or websites by simulating the behaviour of a typical user or client application. They are often used to detect malicious web content or phishing sites. They are essential for understanding threats that target end-users, such as malware or exploits delivered through compromised websites.

\subsubsection{Deployment Environment}

Another classification is based on the deployment environment, which is the form in which the honeypot is implemented.

\textbf{Physical} honeypots are hardware devices configured to act as decoy systems within a network. They simulate real machines and are usually fully equipped with an operating system, applications, and services, making them highly realistic targets for attackers. Because they operate on dedicated hardware, they can provide more accurate insights into how attacks might affect natural systems, but they also come with higher costs and complexity.

In contrast, \textbf{virtual} honeypots are software-based systems that run on virtual machines (VMs). They are more flexible and cost-effective, allowing multiple instances to be deployed on a single physical server. Virtual honeypots can be quickly scaled, modified, or reset, making them ideal for dynamic and evolving environments.

\begin{table}[tbh]
    \begin{center}
        \begin{tabular}{|l|l|p{5cm}|}
        \hline
        \textbf{Classification} & \textbf{Categories} & \textbf{Description} \\ \hline
        \textbf{Field of Operation} & Production & Deployed in live environments to protect genuine systems by detecting and deflecting attacks in real-time. \\ \cline{2-3} 
                                      & Research & Used in controlled environments for gathering detailed information on attack techniques and trends, often by researchers. \\ \hline
        \textbf{Degree of Interaction} & Low-interaction & Simulates limited services, providing minimal interaction to gather basic information with low risk. \\ \cline{2-3} 
                                      & Medium-interaction & Engages attackers with a broader range of simulated services, collecting more detailed data without fully emulating a real system. \\ \cline{2-3} 
                                      & High-interaction & Mimics entire systems, allowing deep attacker engagement and providing comprehensive insights, but carries higher risks and complexity. \\ \hline
        \textbf{Type of Interaction}  & Server & Mimics vulnerable servers and waits for attackers to initiate contact, capturing methods used against server-based services. \\ \cline{2-3} 
                                      & Client & Proactively seeks out malicious servers or websites by simulating typical user behaviour, useful for detecting threats like malware or phishing targeting end-users. \\ \hline
        \textbf{Deployment Environment} & Physical & Hardware devices acting as decoy systems, simulating real machines with operating systems and services, providing accurate but costly and complex insights. \\ \cline{2-3} 
                                      & Virtual & Software-based systems running on virtual machines are more flexible and cost-effective, allowing for easy scaling and deployment in dynamic environments. \\ \hline
        \end{tabular}
        \caption{Honeypots Classification}\label{table:honeypot_classification}
    \end{center}
\end{table}

\subsection{Placement}

Honeypot placement is a critical aspect of network security strategy, designed to lure and monitor malicious activities effectively (see Table \ref{table:honeypot_placement}). One of the primary locations for deploying a honeypot is within the \textbf{Demilitarized Zone (DMZ)} of a network. The DMZ is a subnet isolated from the internal network, typically exposing public services to the internet. By placing a honeypot in the DMZ, it is possible to attract attackers attempting to access these public services. This approach allows for monitoring intrusion attempts while minimising the risk to the internal network.

Another strategic location for a honeypot is within the \textbf{internal network}, where it attracts and identifies attackers who have already breached the external defences. This is useful for detecting insider threats or identifying lateral movement within the network by providing insights into the techniques and tactics employed by the attackers.

In \textbf{wireless networks}, honeypots can be configured as fake wireless access points. These decoys are designed to capture unauthorised access attempts and gather data from nearby devices, thereby enhancing the security of the wireless environment.

Cloud environments also present an opportunity for honeypot deployment. Organisations can attract attacks targeting cloud services and applications by placing a honeypot within a \textbf{cloud infrastructure}. This enables the analysis of unique attack techniques in cloud environments, offering valuable information for enhancing cloud security.

Finally, they can be strategically placed near \textbf{critical access points}, such as servers, databases, or industrial control systems (ICS). In these scenarios, honeypots serve as early warning tools, providing insights into attempts to access high-value systems and enabling rapid responses to potential threats.

However, when deploying a honeypot, it is crucial to ensure it is completely isolated from the rest of the network. This isolation prevents attackers from using the honeypot as a starting point to launch broader attacks. Additionally, constant monitoring is essential to analyse the collected data and respond swiftly to emerging threats. Without proper isolation and diligent monitoring, the effectiveness of a honeypot can be significantly compromised, potentially introducing new risks rather than mitigating them.

\begin{table}[tbh]
    \begin{center}
        \begin{tabular}{|l|p{8cm}|}
        \hline
        \textbf{Placement Location} & \textbf{Description} \\ \hline
        \textbf{Demilitarized Zone (DMZ)} & Honeypots placed in the DMZ attract attackers targeting public services exposed to the internet. This allows for monitoring intrusion attempts while minimising risk to the internal network. \\ \hline
        \textbf{Internal Network} & Honeypots within the internal network are useful for identifying attackers who have already breached external defences, such as insider threats or lateral movement. \\ \hline
        \textbf{Wireless Networks} & Configured as fake wireless access points, honeypots in wireless networks can capture unauthorised access attempts and gather data from nearby devices to enhance wireless security. \\ \hline
        \textbf{Cloud Infrastructure} & Honeypots in cloud environments attract attacks targeting cloud services and applications, offering valuable insights into unique attack techniques in the cloud. \\ \hline
        \textbf{Critical Access Points} & Placed near high-value systems like servers real-time or industrial control systems (ICS), these honeypots serve as early warning tools for potential threats, enabling rapid responses. \\ \hline
        \textbf{Key Considerations} & Honeypots must be isolated from the rest of the network to avoid exploitation. Constant monitoring is essential to analyse collected data and respond to threats in real-time. \\ \hline
        \end{tabular}
        \caption{Honeypot Placement Strategies}\label{table:honeypot_placement}
    \end{center}
\end{table}

\subsection{Legal and Ethical Considerations}\label{subsec:honeypot_legal_ethical}

When discussing honeypots, we must consider the complex landscape of legal and ethical considerations. While they are powerful tools for detecting and analysing malicious activity, their use raises questions about the legality and morality of specific actions \cite{oshea2007cyberlaw}.

Honeypots can capture detailed information about attackers, including IP addresses, login attempts, and personal data if compromised accounts or stolen credentials are used. Depending on the jurisdiction, this data could be subject to privacy laws such as the General Data Protection Regulation (GDPR) in the European Union. Organisations must ensure that their honeypot operations comply with them, especially when discussing personal or sensitive information. In addition, honeypots might interact with systems and attackers from various countries. This can raise complex issues as countries have varying laws regarding data collection, cybersecurity practices, and data sharing. 
Moreover, there's a potential risk that deploying a honeypot could be interpreted as entrapment, mainly if it interacts with attackers in ways that could be seen as encouraging illegal behaviour. If a honeypot is compromised and used to launch attacks on other systems, the organisation could also be liable for damages.

Talking about ethics, we can't help but start with privacy. Honeypots are designed to collect data on malicious actors, but in doing so, they may also capture information from innocent users who inadvertently interact with them. This raises ethical questions about the right to privacy and the extent to which monitoring and recording activities on a network without explicit consent is justifiable. Another issue in this context is the concept of informed consent. Typically, individuals interacting with a honeypot are unaware that their actions are monitored and recorded. This lack of transparency can be viewed as deceptive, leading to questions about whether it is ethical to lure attackers into a trap without their knowledge. The potential for harm is another critical ethical consideration. The consequences can be severe if a honeypot is compromised and used to launch attacks on other systems. This could lead to damage or disruption for third parties and undermine trust in cybersecurity practices if it becomes known that defensive measures like honeypots can inadvertently cause harm. Lastly, there is the question of the proportionality of response. Honeypots, particularly those that are interactive or aggressive, may escalate conflict with attackers. This would provoke more sophisticated or retaliatory attacks, potentially leading to a cycle of escalation that causes more harm than good.

\subsubsection{Possible Solutions}

Several potential solutions and best practices can be considered to address the legal and ethical concerns associated with honeypot use. These solutions aim to mitigate risks, enhance compliance, and promote ethical standards while still maintaining the utility of honeypots as practical tools for cybersecurity.

One of the most pressing legal concerns is ensuring they comply with data protection laws like the GDPR or other relevant regulations. Honeypots should be designed to collect the minimum amount of personal data necessary for security purposes. Organisations can anonymise or pseudonymise data to protect personal information and reduce the risk of breaching privacy laws. Then, engaging with legal professionals to understand the specific regulatory requirements for honeypots in different jurisdictions is crucial. This helps organisations navigate the complexities of cross-border data handling, ensuring that their operations comply with various laws regarding personal data, cyber activity monitoring, and data sharing. Moreover, honeypot data should be stored only as long as necessary and securely disposed of afterwards. By limiting the retention period, organisations can further protect themselves from compliance risks related to the over-collection of sensitive data.

While honeypots are, by nature, designed to be deceptive, transparency could be improved in certain situations to avoid ethical dilemmas. Organisations could inform network users of ongoing security monitoring for specific internal networks or environments where they might unintentionally capture data from legitimate users. This approach strikes a balance between the need for security and respecting user privacy. Including honeypot use in an organisation's broader privacy and cybersecurity policies can help set expectations. Transparency in the intent to use advanced threat detection methods like honeypots can mitigate the ethical concerns related to deception.

Organisations can limit the interactivity of their honeypots to avoid the risk of entrapment or provoking escalatory actions. Low-interaction ones will be less likely to engage attackers in ways construed as encouraging illegal behaviour. Interactive ones should not communicate directly with malicious actors in ways that could be interpreted as luring them into more complex offences. They should focus on passive observation and data collection. Honeypots should be part of a broader cybersecurity strategy that includes firewalls, intrusion detection systems (IDS), and other non-deceptive tools, diversifying security methods.

To address ethical concerns, the cybersecurity community could benefit from clear moral guidelines for honeypot deployment. Organisations can follow established ethical frameworks to ensure their actions align with societal expectations. Adopting the principles of respected ethical guidelines could help assess whether using honeypots is responsible and proportionate to the threats to mitigate. Large organisations or those that frequently use these systems could establish internal ethics committees to review and assess the implications of their cybersecurity practices. Such committees would ensure that the honeypot's use is justified and that the potential harm to third parties or innocent users is minimised.

A key ethical issue is the potential to harm third parties if the system is compromised. Honeypots should be set up so they cannot be easily used as launching points for further attacks. They should be isolated from an organisation's core systems to limit the damage if they are compromised. Honeypots should be regularly updated and monitored to ensure attackers do not exploit them to launch new cyber threats. Deploying pots with outdated or known vulnerabilities can increase the risk of harm, undermining their utility as a security tool. A rapid incident response plan can mitigate damage if one is compromised. Organisations should have automated triggers that deactivate the tool or alert security personnel when unusual activity is detected.

The cross-border nature of cyberattacks often makes it challenging to manage the legal implications of honeypot use, especially in cases involving multiple jurisdictions. The international collaboration between governments and cybersecurity agencies can help harmonise laws and policies concerning deployment. Promoting and adhering to international standards such as those proposed by the International Organization for Standardization (ISO) can help create a unified approach to managing the legal risks of cybersecurity tools, including honeypots. Engaging law enforcement agencies during the planning and deployment can help ensure their use complies with legal norms. Cooperation with authorities can also be crucial in cases where honeypots uncover evidence of significant criminal activity.

\subsection{Real-World Examples}

To better understand the practical applications and effectiveness of honeypots, this subsection proposes real-world examples implemented in various contexts.

\subsubsection{The Honeynet Project}

One of the most well-known examples is ``The Honeynet Project''\footnote{\url{https://www.honeynet.org/}}, a non-profit global research organisation dedicated to improving cybersecurity by providing resources and tools for deploying honeypots \cite{honeynet_project}. Established in 1999, the Honeynet Project has developed various open-source tools that organisations and researchers use worldwide. Their technologies, such as Honeyd and Dionaea, are designed to emulate vulnerable systems and capture a wide range of attack data. The project has been fundamental in advancing the understanding of cyber threats and has contributed significantly to developing new security strategies.

\begin{figure}[tbh]
    \centerline{\includegraphics[width=0.3\textwidth]{figures/the_honeynet_project.png}}
    \caption{The Honeynet Project (source: \href{https://github.com/honeynet}{The Honeynet Project - Github}).\label{fig:honeynet_project}}
\end{figure}

\subsubsection{Honeyd}

``Honeyd''\footnote{\url{https://www.honeyd.org/}} is a low-interaction honeypot that allows users to create virtual hosts on a network, simulating various operating systems and services. It helps researchers observe how attackers probe and exploit different vulnerabilities \cite{honeyd}. By emulating different network topologies, Honeyd enables the detection of scanning techniques, unauthorised access attempts, and specific attack patterns targeting emulated services. Its flexibility and wide adoption have made it a foundational tool for understanding common network attacks.

\subsubsection{Dionaea}

``Dionaea''\footnote{\url{https://github.com/DinoTools/dionaea}} is a medium-interaction honeypot designed to capture malware. It mimics vulnerable services to attract and capture exploits and malicious binaries that spread through vulnerabilities in standard network services \cite{dionaea}. Dionaea's ability to collect and categorise malware samples makes it a valuable tool for cybersecurity researchers studying evolving tactics, techniques, and procedures (TTPs). It has been instrumental in generating actionable threat intelligence by providing insights into new malware variants and their propagation methods.

\subsubsection{Cowrie}

``Cowrie''\footnote{\url{https://github.com/cowrie/cowrie}} is a popular medium to high interaction honeypot designed to simulate SSH and Telnet services. It is widely used to detect and analyse brute-force attacks and capture data on the commands executed by attackers once they gain access \cite{cowrie}. Cowrie logs all interactions in detail, providing valuable insights into the behaviour and methods of attackers targeting SSH-enabled devices. Many organisations and researchers use Cowrie to monitor and understand SSH-based attacks, making it a useful tool for threat intelligence.

\section{Generative Artificial Intelligence (AI)}\label{sec:generative_ai}

The advent of \textbf{Artificial Intelligence (AI)} marks a pivotal shift in how technology interacts with the world around us. At its essence, AI refers to the ``\textit{technology that enables computers and machines to simulate human learning, comprehension, problem-solving, decision making, creativity and autonomy}'', standing to the definition proposed by IBM \cite{ai_definition}. As AI has evolved, it has transcended the concept of traditional computational systems, creating new paradigms, automation, and problem-solving that permeate every aspect of modern life, from industry and healthcare to entertainment and communication. AI is not a singular entity or technology but a broad spectrum of methodologies and approaches that enable machines to simulate human intelligence (see Figure \ref{fig:ai_vs_generative_ai}). Its foundation lies in processing large datasets, identifying patterns, and adapting to new information, allowing systems to make decisions and improve their performance over time. The profound capabilities of AI have redefined industries, enabling everything from autonomous vehicles to personalised medicine to more intelligent infrastructure.

Within this exponentially growing field, \textbf{Generative AI} has emerged as a particularly innovative branch, built upon the fundamental principles of artificial intelligence. Unlike traditional AI models that primarily analyse, classify, or predict based on existing information, generative AI can generate new data almost indistinguishable from human-produced outputs \cite{Feuerriegel2024}. Learning underlying patterns and structures can produce novel outputs that mimic real-world data, whether generating human-like text, images, videos, or even complex simulations.

\begin{figure}[tbh]
    \centerline{\includegraphics[width=0.4\textwidth]{figures/AI_vs_generative_AI.png}}
    \caption{AI landscape (source: \href{https://medium.com/@amol-wagh/whats-generative-ai-explore-underlying-layers-of-machine-learning-and-deep-learning-8f99272e0b0d}{Medium}).\label{fig:ai_vs_generative_ai}}
\end{figure}

\subsection{Large Language Models (LLMs)}\label{subsec:llms}

Large Language Models (LLMs) represent a significant advancement within the broader field of artificial intelligence. These models are designed to understand, generate, and manipulate human language by training on vast amounts of text data powered by deep learning architectures. They process language, catching its intricacies such as grammar, semantics, and context-dependent meanings. LLMs develop a sophisticated understanding of linguistic patterns by being pre-trained on massive datasets, often comprising billions of words. Fine-tuning (see \ref{subsubsec:fine-tuning}) these models enable them to perform specific tasks such as translation, summarisation, question-answering, and even creative writing \cite{naveed2024comprehensiveoverviewlargelanguage}.

The relationship between LLMs and generative AI is particularly profound, as LLMs represent one of its most powerful applications. LLMs excel at generating human-like text. For instance, models like GPT-3 and GPT-4 use their training on extensive datasets to predict and create paragraphs or pages of coherent, creative text. This capability is critical to applications such as automated content creation, real-time conversation systems, and personalised language-based services \cite{maestre2024generativeartificialintelligenceroadmap}.
Moreover, LLMs rely on the transformer architecture, a foundational innovation in generative AI, allowing them to process language in parallel and understand dependencies within text. This architecture significantly enhances their ability to produce contextually aware and semantically rich outputs, which is critical for dialogue generation, machine translation, and creative writing. The ability of LLMs to generate not only grammatically correct but also context-sensitive and nuanced text exemplifies their central role in advancing generative AI, aligning them closely to simulate or enhance human creativity and intelligence.

\subsubsection{Fine-Tuning}\label{subsubsec:fine-tuning}

Fine-tuning is a crucial process in training Large Language Models (LLMs) that allows them to specialise in specific tasks. The model is first pre-trained on a large dataset that covers a wide range of topics and language uses but is still not task-specific. A dataset relevant to the specific task or domain is curated for fine-tuning. It is typically much smaller than the one used in pre-training but is closely aligned with the intended use case. For example, the dataset would consist of labelled text with positive, neutral, and negative sentiments for a sentiment analysis model. Later, the pre-trained model is further trained on this task-specific dataset. Performance is then evaluated on a validation set to ensure the adjustments improve the overall result. After fine-tuning, the model is better suited for the specialised task and can be deployed in applications requiring task-specific language generation or understanding.

\subsubsection{Tokenisation}\label{subsubsec:tokenisation}

Tokenisation is breaking down a text stream into smaller, more manageable units called \textbf{tokens} \cite{tokenization}. These are essential because LLMs cannot process raw text directly; instead, they must be presented numerically, such as vectors. Tokenisation transforms words, subwords, or even individual characters into tokens, which the model then uses to understand and generate language. The input to the tokeniser is a string of text, such as a sentence or paragraph. The tool breaks down the text into units whose granularity depends on the tokeniser type. Each token is later assigned a unique integer identifier from the model's vocabulary. After tokenisation, the integer tokens are transformed into vectors of numbers, ``embeddings'', which capture the semantic relationships between them. These are then passed to the LLM, enabling the model to process and generate coherent text.

\subsubsection{State of the Art}

Large Language Models (LLMs) have seen rapid advancement, with various cutting-edge models being developed to push the boundaries of natural language understanding, generation, and interaction. These models are characterised by their impressive scale in parameters and training data and their capacity to generate highly coherent and contextually aware outputs. In this section, we will explore five of the leading LLMs currently shaping the AI landscape (see Table \ref{table:llms}):

\begin{itemize}
    \item \textbf{GPT (Generative Pre-trained Transformer)}\footnote{\url{https://platform.openai.com/docs/models}}: GPT, developed by OpenAI, remains one of the most widely recognised and powerful LLMs available. Initially introduced with GPT-2 and later expanded with GPT-3 and GPT-4, this series has set the standard for text generation capabilities. GPT-4 introduced improved contextual understanding and the ability to handle more complex prompts. The model has found applications in various areas, from creative writing to professional tasks like coding and data analysis. This is an honourable mention to GPT-4o, a recent model optimised for faster and more efficient operations while maintaining high-quality text generation, making it highly suitable for real-time applications.
    \item \textbf{Llama (Large Language Model Meta AI)}\footnote{\url{https://llama.meta.com/}}: Llama, developed by Meta AI, is designed to provide high performance with a focus on accessibility and efficiency. Llama 3.1, with a staggering 405 billion parameters, is among the latest advancements in this model series. Honourable mention to Llama 3.1 405B, one of the most significant models in terms of parameters, focusing on efficient performance at scale.
    \item \textbf{Claude}\footnote{\url{https://docs.anthropic.com/en/docs/about-claude/models}}: Claude, developed by Anthropic, is known for its focus on safety and alignment in AI systems. The Claude series of LLMs emphasises creating powerful and robust models to ensure the ethical use of AI. The Claude Sonnet 3.5 release represents the latest iteration, an advanced version emphasising safety and alignment in AI, with improved task handling.
    \item \textbf{Gemini}\footnote{\url{https://deepmind.google/technologies/gemini/}}: Gemini, developed by Google DeepMind, is another state-of-the-art LLM focused on multimodal capabilities, meaning it integrates both text and image processing in a unified framework. Honourable mention to Gemini 1.5 Pro, which brings an enhanced processing power and better integration between textual and visual data, improving its ability to generate more accurate and relevant outputs across multimodal tasks.
    \item \textbf{Grok}\footnote{\url{https://x.ai/blog/grok-2}}: Grok, developed by xAI, is a newcomer to the LLM scene but quickly gaining attention. Grok 2, the latest release, enhances context handling and adaptability, making it suitable for various innovative and complex tasks.
\end{itemize}

\begin{table}[tbh]
    \begin{center}
        \begin{tabular}{|l|l|l|p{5.5cm}|}
            \hline
            \textbf{LLM} & \textbf{Developer} & \textbf{Recent Release} & \textbf{Key Features} \\ \hline
            GPT & OpenAI  & GPT-4o  & Optimized for speed, efficiency, and complex tasks. \\ \hline
            Llama & Meta AI & Llama 3.1 (405B) & 405B parameters, efficient performance, scalability. \\ \hline
            Claude & Anthropic & Claude Sonnet 3.5 & Safety-focused, improved task handling, ethical AI. \\ \hline
            Gemini & Google DeepMind & Gemini 1.5 Pro & Enhanced multimodal capabilities (text and images). \\ \hline
            Grok & xAI & Grok 2 & Improved contextual depth and creative adaptability. \\ \hline
        \end{tabular}
        \caption{Summary of Leading LLMs and Their Recent Releases (source: \href{https://lmarena.ai/?leaderboard}{lmarena})}\label{table:llms}
    \end{center}
\end{table}

\subsection{Prompt Engineering}

Every time we engage with a generative AI model, such as ChatGPT\footnote{\url{https://openai.com/chatgpt/}}, through a browser or application, we are unwittingly performing a task central to the functionality of these systems: writing a prompt. This simple input, a question, a statement, or a command, sets off a complex chain of computational processes. The AI interprets the text, drawing on its vast database of learned information, and produces an output tailored to the prompt. However, inputting text does not guarantee the output's quality, relevance, and usefulness. Instead, it depends on the design of the prompt itself. For example, asking a model a vague or open-ended question may bring an equally ambiguous answer, while a carefully constructed prompt, which is clear and specific, can generate a highly accurate and contextually appropriate response. This introduces the concept of \textbf{prompt engineering}, the deliberate and strategic crafting of prompts to guide AI in producing the desired outcome.

Prompt engineering is the art and science of developing and optimising inputs to achieve precise, relevant, and reliable outputs from generative models \cite{prompt_engineering}. Much like instructing a human to complete a task, the more detailed and unambiguous the instructions, the better the result. By following specific prompt engineering techniques, users can manipulate the model's outputs to be more coherent, focused, and aligned with their expectations, making this practice indispensable for leveraging the full potential of generative AI.

\subsubsection{Techniques}

Optimising the interaction with generative AI models requires various techniques that help users craft prompts for more accurate and targeted outputs. These techniques are designed to minimise ambiguity, enhance the relevance of the response, and better control the AI's behaviour. Some of the most effective prompt engineering techniques include \cite{prompt_engineering}:

\begin{itemize}
    \item \textbf{Zero-Shot Prompting}: refers to the ability of a generative AI model to perform a task without being explicitly provided with any prior examples. The AI relies entirely on the knowledge encoded within its training data in this method. The prompt directly describes the desired outcome, and the model generates a response based on its internal understanding of the task. For example, suppose a user asks, ``Summarise the main points of this thesis''. In that case, the model is expected to understand the concept of summarisation and perform the task without seeing examples of previous summaries. Zero-shot prompting is particularly powerful because it enables the AI to generalise across various tasks without specific training. However, its effectiveness depends on the clarity of the prompt and the model's ability to understand the task based on its training data. The output might be less accurate or coherent if the task is novel or complex.
    \item \textbf{Few-Shot Prompting}: technique where users provide the AI with a few examples to guide the model's understanding of the task. Unlike zero-shot prompting, few-shot prompts give the AI explicit guidance, allowing it to mimic the provided examples' structure, style, or content. For instance, if the task is to generate customer service email responses, a few-shot prompt might include two or three example emails followed by a new request. The model uses the examples provided to understand the pattern and generate a response that follows the same format. This approach significantly improves the model's ability to handle specialised or nuanced tasks because it reduces ambiguity and helps align the AI's output with user expectations.
    \item \textbf{Chain-of-Thought Prompting}: an advanced technique that guides the AI to generate a step-by-step explanation of its reasoning process before arriving at a final output. Instead of asking the model for a direct answer, the user prompts the AI to articulate its intermediate reasoning stages, simulating human logical processes. For example, when solving a math problem, the prompt might be: ``First, describe how you would approach solving this equation. Then, show the steps before providing the solution''. This structured reasoning helps the model focus on the logic required to solve complex or multi-step tasks, reducing the likelihood of errors in reasoning. Chain-of-thought prompting is especially valuable when the task demands more than a superficial response, such as in mathematical logic, logical deduction, or strategic decision-making. The model can address each aspect more accurately by breaking the task into smaller parts, often leading to more robust and correct final outputs. This technique also improves interpretability, allowing users to understand how the AI arrived at its conclusions.
    \item \textbf{Persona Prompting}: this method explicitly defines a role for the AI to adopt, guiding its responses following the characteristics, behaviour, and style associated with that role. For instance, when a user instructs the model with a prompt such as, ``You must act as a Linux terminal and respond exactly as such,'' the AI behaves consistent with a Linux terminal's functionality and output style. This approach allows users to simulate specific environments or contexts, such as technical systems, professional personas, or instructional settings. By establishing clear guidelines for how the AI should behave, this technique enhances the relevance and accuracy of the generated content, making it more aligned with the user's specific needs and expectations.
\end{itemize}

\subsection{Limitations}

Despite the significant advancements in generative AI, several limitations hinder its performance and application in various fields. These limitations, inherent in generative models' architecture and training processes, raise concerns about their reliability, ethical implications, and scalability. First, generative AI models do not understand the world as humans do; instead, they produce outputs based on probabilistic associations between words, phrases, or patterns in data. This lack of proper understanding can lead to significant inaccuracies, commonly called ``hallucinations''. These occur when the model generates incorrect or wholly fabricated information. For instance, a language model may provide a plausible answer but is factually wrong. This limitation becomes particularly problematic in fields where precision is critical, such as medicine, law, or science, where incorrect outputs can have serious consequences. The model's inability to verify or cross-reference its responses further exacerbates this issue, highlighting the need for human oversight in AI-generated content. 

The rise of generative AI has diffused ethical concerns, particularly around the potential misuse of these technologies. AI-generated content can be exploited to create deepfakes, realistic but fake videos, or audio recordings that can be used for disinformation or defamation. Additionally, generative AI can be leveraged to produce fake news or manipulate public opinion, leading to the spread of misinformation at an unprecedented scale. These ethical concerns pose significant challenges for regulation, as there is no universally accepted framework for addressing the risks posed by AI-generated content. Balancing innovation with responsible use is a critical issue that remains unresolved as generative AI technologies advance. Another ethical concern involves the amplification of biases. Generative AI models are trained on vast datasets, which often contain underlying biases reflective of societal inequalities. These models can unintentionally reproduce and even amplify discriminatory content related to race, gender, and other identity factors. This poses a serious ethical dilemma, mainly when AI is used for decision-making where biased outcomes can perpetuate inequalities. Developers and organisations must carefully curate training data and implement fairness measures to mitigate these risks, though eliminating bias remains a significant challenge \cite{Feuerriegel_2023}.
Ownership and intellectual property (IP) rights present further complications. Generative AI models can produce original text, music, or art content, blurring the lines between human and machine creativity. This raises questions about who owns the rights to AI-generated works. Current copyright laws, which are designed for human creators, may not adequately address the issue of machine-generated content. If an AI creates a work based on data it was trained on, should the creators of the original datasets be entitled to some form of acknowledgement? This grey area in IP law is still largely unexplored, and new legal frameworks are needed to address the ownership of AI-generated intellectual property. Finally, concerns around accountability and transparency are critical. If an AI model generates harmful or misleading content, it can be difficult to assign responsibility. Should the creators of the AI system be held liable, or should the users who deploy it have the consequences? The opacity of many AI models, often called ``black-box'' systems, further complicates the issue. These systems are so complex that even their developers may not fully understand how specific outputs are generated, making accountability challenging to enforce.

Among the other limitations, developing, training, and running large-scale generative AI models requires immense computational resources. These models, particularly those with billions of parameters, such as GPT-3 or its successors, demand substantial energy, processing power, and time to train. This creates accessibility barriers for smaller companies, organisations, or individuals who lack the necessary infrastructure to develop or deploy generative AI on a large scale. Additionally, the environmental impact of these resource-intensive processes raises concerns about the sustainability of generative AI, especially as the demand for increasingly larger models continues to grow \cite{Feuerriegel_2023}.

Generative AI models often also struggle with ``overfitting'' where they become too attuned to the training data and fail to generalise effectively to new, unseen inputs. This limitation hampers their ability to produce novel or creative outputs, as they tend to replicate the patterns learned from training data rather than generate original content. The challenge lies in balancing the ability to memorise training data with the need to generalise well to diverse inputs. Achieving this balance is essential for improving the model's creativity and utility in real-world applications with dynamic conditions, where data can vary significantly.

Despite their capabilities, generative AI models often require significant human supervision, mainly when applied in sensitive or high-stakes domains. Human intervention is necessary to correct errors, ensure outputs are factually accurate, and avoid unintended ethical or social consequences. This reliance on human oversight limits the extent to which AI systems can be fully autonomous, as users must constantly monitor and evaluate the outputs generated. Additionally, this supervision requirement reduces the efficiency gains promised by AI, as human operators are still needed to guide the systems, particularly in complex or critical scenarios.

\section{Machine Learning (ML)}

Machine learning (ML) is a subfield of artificial intelligence (see Figure \ref{fig:ai_vs_generative_ai}) that focuses on developing algorithms that allow computers to learn from problem-specific training data and make decisions or predictions without being explicitly programmed, automating the process of model building to solve associated tasks \cite{Janiesch_2021}. ML identifies patterns and structures within vast datasets to make informed decisions. This process mimics the human ability to learn from experience and improve decision-making over time. As a critical component of modern AI, machine learning has evolved rapidly over the past decades, influencing various industries, including finance, healthcare, marketing, and cybersecurity. Also, it has become foundational in developing generative models, such as those used in generative AI systems (see Section \ref{subsec:llms}).

\subsection{Types}\label{subsec:ml_types}

The learning process in machine learning is often categorised into three main types, where each one is designed to solve specific problems and operates differently based on the nature of the available data and desired outcomes:

\begin{itemize}
    \item \textbf{Supervised Learning}: involves training a model on a labelled dataset, where the input and the corresponding output are known. The model aims to generalise from the training data and predict new, unseen data outcomes. Once the model has been successfully trained, it can indicate a target variable given the input features' new or unseen data points \cite{Janiesch_2021}.
    \item \textbf{Unsupervised Learning}: works with data that has no labels. The aim is to uncover hidden patterns or intrinsic structures within the data. Thus, the training set only consists of variables to find structural information of interest, such as groups of elements that share common properties, also known as ``clustering'' \cite{Janiesch_2021}.
    \item \textbf{Reinforcement Learning}: the model learns through trial and error, receiving feedback as rewards or penalties based on the actions it takes in a given environment. This is particularly useful in robotics or game AI tasks, where decisions must be made sequentially.
\end{itemize}

\subsection{Training of a Model}

Training a machine learning model is a multi-step process that transforms raw data into actionable insights, allowing the model to learn from patterns in the data. The ultimate goal is for the model to generalise from the training information to make accurate predictions on unseen data.

\subsubsection{Data Collection and Preprocessing}

The first step in training any machine learning model is acquiring and preparing the dataset. The latter must be relevant to the problem and represent the diversity of scenarios the model will encounter in the real world. Raw data often contains noise, missing values, or inconsistencies in real-world applications, which can negatively impact the model's performance if mishandled. For this reason, data preprocessing involves several vital tasks:

\begin{itemize}
    \item \textbf{Cleaning the data}: removing or imputing missing values, handling outliers, and ensuring consistency in the dataset.
    \item \textbf{Normalization or standardization}: bringing features onto a common scale. This is especially important when using distance-based algorithms or neural networks like MLP, where feature values of different scales can skew the model's learning process.
    \item \textbf{Feature engineering}: creating new features or transforming existing ones to enhance the model's ability to learn important patterns. For example, combining several weak features into a single, more meaningful one.
\end{itemize}

Once preprocessing is complete, the dataset is typically split into training, validation, and test sets. The training set is used to fit the model, the validation set helps tun the model's hyperparameters, and the test set evaluates the model's performance on unseen data.

\subsubsection{Model Training Process}

Training a machine learning model involves feeding data through it and iteratively adjusting parameters to minimise the difference between the predicted output and the actual outcome. At the beginning of training, the model is initialised with random values for its parameters (e.g., weights in the case of neural networks). These parameters will be updated iteratively to improve the predictions. In each iteration, or ``epoch'', the training data is passed through the model in a forward-pass process, producing a prediction. The model's architecture, whether a simple decision tree, a linear model, or a neural network like MLP, dictates how these predictions are made.

The next step is calculating how far off these predictions are from the target values. This is done using a loss function, which quantifies the error. After calculating the loss, the model's parameters must be updated to minimise it. In neural networks, including MLP, this is done through ``backpropagation'', which calculates the loss gradient concerning each parameter. Then, an optimisation algorithm updates the model's weights in the direction that reduces the loss. Forwarding the input, calculating the loss, and updating the weights is repeated over multiple epochs. The model is said to ``converge'' when the loss no longer decreases significantly, indicating that it has learned the essential patterns in the training data.

\subsubsection{Algorithms}

When training a machine learning model, the choice of algorithm plays a crucial role in making predictions accurately. Different algorithms are suited to other tasks, each with strengths and weaknesses. In this section, it is possible to find some of the most relevant examples:

\begin{itemize}
    \item \textbf{Decision Trees}: versatile models that split data into subsets based on feature values to form a tree-like structure. They work well for classification and regression tasks and are easy to interpret. However, decision trees can overfit the training data if not carefully controlled.
    \item \textbf{Random Forest}: ensemble learning method that improves upon decision trees by creating multiple trees and averaging their predictions. Combining the outputs of various trees reduces overfitting and generally performs better than a single one. Random forests are robust and effective on multiple tasks but can become computationally expensive as the number of trees grows.
    \item \textbf{K-Nearest Neighbours (KNN)}: classifies data points by looking at the nearest neighbours in the training data. It's simple and non-parametric, making no assumptions about the underlying data distribution. KNN can work well for small datasets but becomes inefficient and less effective as the dataset grows or becomes high-dimensional.
    \item \textbf{Naive Bayes}: a probabilistic classifier based on Bayes' Theorem, assuming that features are independent given the class label, hence ``naive''. Despite this simplifying assumption, Naive Bayes can perform surprisingly well for specific tasks, particularly in text classification. However, it may struggle when the independence assumption between features does not hold, leading to reduced accuracy.
    \item \textbf{Multi-Layer Perceptron (MLP)}: a type of neural network well-suited for handling complex, non-linear relationships. MLP consists of an input, hidden, and output layer. Each layer of neurons transforms the input through learned weights and activation functions. MLP is particularly powerful in classification tasks where simpler models like decision trees may fail, as it can model complex interactions between features. Training an MLP involves forward propagation, where input data is passed through the network to produce a prediction, followed by backpropagation, where errors are propagated backwards through the network to adjust the weights. This iterative process allows the model to improve over time. While MLP is highly flexible and powerful, it requires more computational resources and training data than simpler models.
\end{itemize}

\subsection{Classification}

Classification is one of the core tasks in machine learning, where the objective is to assign input data to predefined categories or labels. It is a form of supervised learning (see Section \ref{subsec:ml_types}), meaning that the model is trained using labelled data, where the correct category for each input is known. The model learns from these labelled examples and then generalises this knowledge to classify new, unseen data.

In a typical classification problem, the dataset consists of input features, like object or scenario characteristics, and corresponding labels, such as categories like ``spam'' or ``not spam''. The model is trained on a labelled dataset where it observes input-output pairs. During this phase, it learns the patterns and relationships between the input features and the corresponding labels. Once trained, the model can classify new data points by assigning the label that best fits the learned patterns. This is done by using the learned weights or rules to compute the probability or score for each class, later assigning the one with the highest score.

\subsubsection{Performance Evaluation}

Various evaluation metrics measure how effectively the model assigns data points to the correct categories to ensure the classification performs well. The most common metrics include:

\begin{itemize}
    \item \textbf{Accuracy}: the most straightforward metric representing the ratio of correct predictions (true positives and negatives) to the total number of predictions.
    \[
    \text{Accuracy} = \frac{TP + TN}{TP + TN + FP + FN}
    \]
    Where:
    \begin{itemize}
        \item \( TP \) = True Positives (correct positive predictions)
        \item \( TN \) = True Negatives (correct negative predictions)
        \item \( FP \) = False Positives (incorrect positive predictions)
        \item \( FN \) = False Negatives (incorrect negative predictions)
    \end{itemize}
    Although accuracy is widely used, it can be misleading if the dataset is imbalanced, meaning one class is significantly more frequent than the other.

    \item \textbf{Precision}: it measures the proportion of correctly predicted positive instances out of all the cases predicted as positive. It is beneficial when the cost of false positives is high.
    \[
    \text{Precision} = \frac{TP}{TP + FP}
    \]
    A high precision means that it is usually correct when the model predicts a positive class.
    
    \item \textbf{Recall}: also known as ``sensitivity'' or ``true positive rate'', measures the proportion of actual positive instances correctly identified by the model. It is relevant when false negatives, such as medical diagnoses, are costly.
    \[
    \text{Recall} = \frac{TP}{TP + FN}
    \]
    High recall indicates that the model can identify most of the actual positives.
    
    \item \textbf{F1 score}: the harmonic mean of precision and recall, providing a balanced measure between the two. It is useful when an uneven class distribution or precision and recall are essential.
    \[
    \text{F1\,Score} = 2 \times \frac{\text{Precision} \times \text{Recall}}{\text{Precision} + \text{Recall}}
    \]
    The F1 score ranges from 0 to 1, with 1 being the best possible value.
    
    \item \textbf{Confusion Matrix}: it provides a more detailed view of the model's classification performance by showing the counts of true positives, true negatives, false positives, and false negatives:
    \[
    \begin{array}{|c|c|c|}
    \hline
     & \text{Predicted Positive} & \text{Predicted Negative} \\
    \hline
    \text{Actual Positive} & TP & FN \\
    \hline
    \text{Actual Negative} & FP & TN \\
    \hline
    \end{array}
    \]
    The confusion matrix is handy for analysing the errors a model makes (e.g., false positives vs. false negatives).
\end{itemize}

\subsubsection{Multi-Class Classification} 
These metrics can be extended to multi-class classification, where multiple categories are predicted instead of binary classes. Metrics like precision, recall, and F1 score can be computed for each class independently and then averaged using either ``macro-averaging'' (treating each class equally) or ``weighted averaging'' (giving more importance to frequent classes). Similarly, a ``multi-class confusion matrix'' expands to include each class's counts of true positives, false positives, and false negatives, providing a comprehensive view of classification performance.

\subsection{Natural Language Processing (NLP)}\label{subsec:nlp}

Natural Language Processing (NLP) is a subfield of artificial intelligence (AI) focused on the interaction between computers and human language. It enables machines to understand, interpret, and generate human language meaningfully and helpfully. It involves several critical tasks, including:

\begin{itemize}
    \item \textbf{Tokenisation}: the process of splitting text into smaller units, such as words or phrases, for easier processing (see Section \ref{subsubsec:tokenisation}).
    \item \textbf{Part-of-Speech Tagging (POS)}: assigning parts of speech, such as nouns, verbs, and adjectives, to each word in a sentence to better understand its grammatical structure.
    \item \textbf{Named Entity Recognition (NER)}: identifying and classifying entities such as people, places, and organizations within the text.
    \item \textbf{Sentence or Text Classification}: categorizing entire sentences or documents into predefined categories, such as spam detection in emails or topic classification in news articles.
    \item \textbf{Sentiment Analysis}: determining the sentiment or emotional tone behind a piece of text, whether positive, negative, or neutral.
    \item \textbf{Language Modeling}: predicting the next word in a sentence based on the previous words is crucial for applications like autocomplete and text generation.
\end{itemize}

Recent advancements in NLP have been driven by deep learning models, particularly transformer-based architectures like BERT (Bidirectional Encoder Representations from Transformers) and GPT (Generative Pre-trained Transformer). These models have significantly improved the ability of machines to understand context and generate human-like text by leveraging large-scale datasets and unsupervised learning techniques. NLP is particularly impactful in fields such as customer service, healthcare, and marketing, where it automates text analysis, enhances customer interactions through chatbots, and provides valuable insights through sentiment and trend analysis.


\section{MITRE ATT\&CK}\label{sec:mitre_attack}

The \textbf{MITRE Corporation} is a not-for-profit organisation that operates federally funded research and development centres (FFRDCs) in the United States. Established in 1958, MITRE's mission is to tackle some of the most complex problems facing government agencies and other institutions, particularly national security, defence, and cybersecurity. Over the decades, MITRE has become a pivotal player in the cybersecurity landscape, known for its rigorous research, innovative solutions, and comprehensive frameworks that guide cybersecurity professionals in understanding, detecting, and mitigating various threats. MITRE's role in security is multi-faceted, from developing standards and methodologies to collaborating with public and private entities on cybersecurity initiatives. The organisation's approach is characterised by its emphasis on creating practical tools and frameworks that security teams can widely adopt to enhance their defence mechanisms \cite{mitre}.

One of MITRE's most influential contributions to the cybersecurity field is the development of the \textbf{MITRE ATT\&CK}\footnote{\url{https://attack.mitre.org/}} (Adversarial Tactics, Techniques, and Common Knowledge) framework, ``\textit{a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. With the creation of ATT\&CK, MITRE is fulfilling its mission to solve problems for a safer world - by bringing communities together to develop more effective cybersecurity.}'' \cite{mitre_attack}. This framework has become a globally recognised cornerstone for cybersecurity strategies. ATT\&CK was initially developed to document the tactics and techniques used by threat actors as observed in real-world cyber incidents. Over the years, it has evolved into a comprehensive knowledge base that helps organisations understand how attackers operate, allowing them to better anticipate and defend against potential threats.

\subsection{Matrices}\label{subsec:mitre-matrices}

The MITRE ATT\&CK framework is organised into three distinct \textbf{technology domains} or matrices\footnote{\url{https://attack.mitre.org/matrices/}}, each representing the ecosystems in which adversaries operate \cite{mitre_mapping}, with the possibility of having multiple platforms or operating systems for each domain.

\begin{itemize}
    \item \textbf{Enterprise}: this domain covers a wide range of platforms, including operating systems such as Windows, Linux, and macOS, as well as cloud environments like Azure AD, Office 365, Google Workspace, Software-as-a-Service (SaaS), and Infrastructure-as-a-Service (IaaS). It also includes network infrastructure devices and container technologies. See Figure \ref{fig:mitre_enterprise_matrix} for a visual example of the matrix.
    \item \textbf{Mobile}: this domain models adversarial tactics and techniques specific to Android and iOS platforms. It includes a separate matrix outlining techniques an adversary can use without direct access to the mobile device.
    \item \textbf{Industrial Control Systems (ICS)}: This domain is dedicated to adversarial tactics and techniques to disrupt industrial control processes.
\end{itemize}

These domains provide tailored frameworks for different environments, helping defenders understand and mitigate specific threats in each context.

\subsection{Levels}

As CISA (.gov) reports in its publication ``Best Practices for MITRE ATT\&CK Mapping'' \cite{mitre_mapping}, the MITRE ATT\&CK framework describes the adversarial TTPs (see Section \ref{subsec:honeypot-objectives}) adopting a structure of four increasingly granular levels: \textbf{tactics}, \textbf{techniques}, \textbf{sub-techniques}, and \textbf{procedures}. These elements are organised within one of the three MITRE ATT\&CK Matrices described in Section \ref{subsec:mitre-matrices}, which visually map out the relationships between them. A matrix is structured as a table where each column represents a tactic, the ``why'' of an adversary's actions, defining their high-level goals or objectives, such as gaining credential access to infiltrate a network. These tactics provide insight into what the adversary aims to achieve. Still, the matrix does not enforce a linear sequence, meaning an adversary can use varying tactics at different stages of their attack without needing all of them to meet their goal.

Under each tactic in the matrix, specific techniques are listed (see Figure \ref{fig:mitre_enterprise_matrix}), representing the ``how'' behind achieving a tactic by detailing concrete actions, such as dumping credentials to fulfil the credential access goal. Techniques may apply to multiple tactics and often involve leveraging legitimate system functions for malicious purposes, a concept known as ``living off the land''. Some techniques are further broken down into sub-techniques, providing more granular, platform-specific descriptions of how a technique might be implemented. For example, dumping credentials by accessing LSASS memory [\href{https://attack.mitre.org/versions/v12/techniques/T1003/001/}{T1003.001}] or accessing the ``/etc/passwd'' and ``/etc/shadow'' files [\href{https://attack.mitre.org/versions/v12/techniques/T1003/008/}{T1003.008}]. Not all techniques require sub-techniques, but those that do offer additional specificity about the method.

Lastly, procedures describe the ``what'', the specific actions an adversary took to use a technique or sub-technique, offering real-world examples of attacks. For instance, multiple procedures exist for dumping LSASS memory, each using different tools and methods. They aid in adversary emulation and incident detection, allowing security professionals to understand how attackers have used these techniques in real-world scenarios.

\begin{figure}[tbh]
    \centerline{\includegraphics[width=1\textwidth]{figures/mitre_enterprise_matrix.png}}
    \caption{MITRE ATT\&CK Enterprise Matrix fragment (source: \href{https://attack.mitre.org/matrices/enterprise/}{MITRE ATT\&CK}).\label{fig:mitre_enterprise_matrix}}
\end{figure}

\subsection{Advantages and Evolutions}

The MITRE ATT\&CK framework provides numerous advantages for cybersecurity teams, making it a valuable tool for threat detection, incident response, and threat intelligence. First, it offers a common language to describe adversarial behaviour. This standardisation makes it easier for cybersecurity professionals across industries and geographies to collaborate, share information, and enhance collective security. ATT\&CK provides a detailed view of how adversaries operate across various environments, from enterprise networks to mobile platforms and industrial control systems, by documenting real-world attack techniques. Moreover, unlike theoretical models, the framework is based on actual observations of threat actors, making it highly relevant to real-world cybersecurity operations. Security teams can prioritise defence mechanisms based on adversaries' most commonly observed tactics, techniques, and procedures (TTPs) and tailor their strategies to specific attack vectors. Given its flexibility, ATT\&CK can be adapted for multiple use cases. Security teams can simulate adversary behaviour or integrate the framework into various security platforms, including Security Information and Event Management (SIEM) systems and threat intelligence ones. This opens the doors for automated mapping of events and logs to ATT\&CK techniques, making the framework actionable in real-time defence (see Section \ref{subsec:automatic_mapping}).

One of the standout features of MITRE ATT\&CK is its continuous evolution and improvement. The cybersecurity landscape constantly changes, with new threat actors, techniques, and vulnerabilities emerging regularly. MITRE addresses this dynamic environment by periodically updating its framework to incorporate the latest knowledge on adversary behaviour, including new tactics, techniques, sub-techniques, and procedures. Each version reflects the latest TTPs observed in the field, ensuring that organisations using the framework always work with up-to-date intelligence. In addition, initially focused on enterprise environments, MITRE ATT\&CK has expanded to cover other vital domains, such as mobile and industrial control systems (ICS). This enhancement reflects the growing complexity of the threat landscape and MITRE's commitment to protecting all potential environments.
Moreover, the ATT\&CK framework thrives on collaboration with the global cybersecurity community. Many of the updates and improvements are informed by insights from security practitioners, vendors, and researchers. This collaborative approach not only keeps ATT\&CK relevant but also helps the framework grow in depth and accuracy. Lastly, as new technologies like cloud computing, artificial intelligence, and IoT become integral to enterprise operations, MITRE ATT\&CK continuously adapts to include tactics and techniques relevant to these areas. For example, as AI-generated content becomes more prevalent, future iterations of ATT\&CK may address how generative AI could be used by adversaries or how defenders can leverage AI to detect complex threats.

\subsection{Automatic Mapping}\label{subsec:automatic_mapping}

One of the challenges cybersecurity professionals face is the time-consuming and error-prone process of manually mapping cyber threat intelligence (CTI) to the MITRE ATT\&CK framework. Modern organisations receive vast amounts of cyber threat intelligence from various sources, including reports, alerts, and logs. Nonetheless, CTI reports are often written in natural language, with varying levels of detail and specificity. Security analysts must interpret this unstructured information and align it with the appropriate ATT\&CK techniques, which can be subjective and inconsistent across different analysts. Moreover, given the vast number of techniques and sub-techniques in the MITRE ATT\&CK matrix, manually mapping every relevant action or indicator can take considerable time. Organisations may lack sufficient resources or expertise to continuously perform this task at scale, particularly when faced with frequent updates to ATT\&CK.

This is where automatic mapping tools leveraging natural language processing (NLP) and machine learning come to hand. These technologies can quickly analyse unstructured CTI reports and map relevant behaviours to MITRE ATT\&CK techniques. Instead of spending hours or even days manually analysing reports, security teams can leverage automation to complete the task in a fraction of the time. As organisations receive more CTI data, the ability to automatically map it becomes essential. Automation allows processing large datasets in real-time, ensuring no critical intelligence is overlooked. Automated systems also apply consistent logic and criteria when mapping CTI to MITRE ATT\&CK. This reduces the subjectivity and variability of manual associations, leading to more reliable and repeatable results. NLP-based tools can analyse large quantities of unstructured data, extracting relevant information and matching it to the appropriate ATT\&CK techniques with greater precision. As these tools learn and improve, they can even identify new strategies that may not be immediately apparent to human analysts.

An excellent example of the potential for automatic mapping comes from the work of dessertlab\footnote{\url{https://github.com/dessertlab/cti-to-mitre-with-nlp}}, which presents a dataset for automatically mapping unstructured cyber threat intelligence to the MITRE ATT\&CK framework using natural language processing. Their project uses advanced NLP techniques to analyse threat reports and map the relevant tactics and methods to the corresponding elements in the framework matrix \cite{CTI-to-MITRE}. This integration of NLP and ATT\&CK mapping is a robust advancement in threat intelligence processing, highlighting the growing role of artificial intelligence and machine learning in cybersecurity operations. As more organisations adopt these technologies, the threat analysis and response process will become faster, more efficient, and more aligned with adversary behaviours described in real-time intelligence reports.

\section{AI Applications in Cybersecurity}

Artificial intelligence (AI) has become an essential tool in modern cybersecurity strategies because it processes vast amounts of data, detects patterns, and makes decisions faster than traditional methods. The growing complexity and sophistication of cyberattacks, including the rise of advanced persistent threats (APTs) (see Section \ref{subsec:cyb_threat_landscape}) and zero-day vulnerabilities, have made it clear that conventional security tools are no longer sufficient. They are reactive by nature, often only identifying threats after they have been detected and catalogued.
In contrast, AI-based systems offer a more proactive defence mechanism. They can learn from data, adapt to new threats, and improve over time without relying solely on human intervention. This adaptive nature is crucial in an environment where attackers constantly innovate and evolve their techniques. As organizations accumulate vast amounts of data, AI's ability to process and analyze it quickly becomes critical to identifying threats, mitigating risks, and securing systems more effectively.

\subsubsection{AI for Threat Detection and Response}

One of the key areas where AI has proven impactful is threat detection and response. Traditional security systems often struggle to detect new or subtle threats because they rely on predefined signatures and rule sets. AI systems, by contrast, can analyze large datasets and recognize patterns of behaviour that may signal the presence of malicious activity. These systems can continuously improve their detection capabilities through machine learning algorithms, identifying new threats even if they have never been encountered before. AI-powered detection often relies on anomaly detection, where systems monitor baseline network behaviour and flag unusual deviations. For instance, an AI system might detect abnormal data flows or unusual login times, indicating a possible breach. These systems are precious in large networks where human analysts would struggle to identify threats in real-time \cite{ferrag2024generativeailargelanguage}. In addition to detection, AI is increasingly being used to automate responses to specific threats. For example, suppose a system detects suspicious activity, such as a potential ransomware attack. In that case, it can immediately isolate the affected systems, prevent data exfiltration, or block the malicious IP addresses. This rapid response can significantly limit the damage caused by cyberattacks, reducing the time attackers have to exploit vulnerabilities.

\subsubsection{AI in Malware Detection}

Malware, one of the most prevalent and evolving cybersecurity threats (see Section \ref{subsec:cyb_threat_landscape}), has also been impacted by AI. Traditional malware detection systems, such as antivirus software, depend on signatures that are digital fingerprints of known malware. However, these signature-based systems fall short as cybercriminals create new malware variants, exceptionally polymorphic malware that changes its code to evade detection. AI changes the game by enabling systems to detect malware based on behaviour rather than signatures. By analyzing how a program behaves in a system, AI can identify suspicious activities associated with malware, such as unauthorized file access or unexpected system modifications, even if it is entirely new. This allows for efficiently detecting zero-day threats \cite{Hossain_Faruk_2021}.

\subsubsection{AI for Phishing Prevention}

Phishing, where attackers impersonate legitimate entities to trick users into revealing sensitive information, has long been a significant problem in cybersecurity. While traditional email filters can block relevant phishing attempts, more sophisticated attacks, particularly those involving social engineering, can evade these defences. AI is helping to bridge this gap by employing advanced techniques to detect and block phishing attempts \cite{ferrag2024generativeailargelanguage}. AI systems use natural language processing (NLP) (see Section \ref{subsec:nlp}) to analyze the content of emails and identify phishing attacks, even when the attacker uses carefully crafted language to appear legitimate. This analysis goes beyond simple keyword detection and involves understanding the context and intent behind the communication.
Furthermore, as AI systems learn from new phishing attempts, they evolve and become more effective at identifying novel tactics attackers employ. For example, Google's use of AI in Gmail has significantly reduced the number of phishing emails reaching users, with over 99.9\% accuracy in filtering these threats \cite{gmail}.

\subsubsection{AI in Vulnerability Management}

Another crucial application of AI in cybersecurity is vulnerability management. Cybercriminals constantly search for weaknesses in software, networks, or systems they can exploit. Identifying and addressing these vulnerabilities before they are exploited is a race against time, one that AI can help win. AI can analyze historical data and detect patterns that suggest potential breaches, even those that have not yet been discovered. Predictive analysis, powered by machine learning, helps organizations prioritize vulnerabilities by predicting the likelihood of exploiting them. This ensures that the most critical ones are addressed first. In addition, AI-driven tools can automate the process of patch management, identifying vulnerable systems and deploying necessary updates before attackers can take advantage of the weaknesses.

AI is also being employed in bug detection. Scanning codebases can identify potential security flaws and suggest fixes, greatly enhancing the security of software development processes. This is particularly important for organizations developing their software or using third-party code, where hidden vulnerabilities can introduce serious risks.

\subsubsection{Future of AI in Cybersecurity}

Looking ahead, the role of AI in cybersecurity is likely to expand as both cyberattacks and defence mechanisms grow more sophisticated. One promising development is the rise of autonomous defence systems, where AI could operate with minimal human intervention to detect, respond to, and even prevent cyberattacks. These systems could continuously learn from new data, adapt to changing threats, and act decisively in real-time. As AI algorithms continue to improve, we may see more advanced applications, such as AI being used to predict the methods attackers will use, enabling organizations to stay ahead of the curve. Rather than replacing human analysts, AI will increasingly augment their abilities, allowing them to focus on more strategic tasks while it handles the more routine aspects.

This growing role of AI in cybersecurity also intersects with the advancements in honeypot technology, where AI is being increasingly utilized to enhance the efficiency and effectiveness of honeypot systems. Integrating AI with honeypots marks a significant development in cybersecurity, forming the basis of cutting-edge approaches to deception-based security strategies.

\subsection{Honeypot and AI: State of the Art}

Honeypots have long been a crucial tool in cybersecurity, functioning as decoy systems to lure attackers and analyze their behaviour (see Section \ref{sec:honeypot}). Traditionally, they were static systems designed to attract specific attacks or gather intelligence on malicious actors' tactics, techniques, and procedures (TTPs). However, with the increasing complexity and scale of cyberattacks, there is a growing need for more dynamic and intelligent honeypot systems. AI and machine learning are crucial in advancing honeypot technology and adapting it to modern security challenges. Integrating them with honeypots represents a significant leap forward, enabling more dynamic, intelligent, and responsive systems to detect better and analyse cyber threats.

\subsubsection{LLM in the Shell}

A cutting-edge example of AI-enhanced honeypot technology is the shelLM project \cite{Sladic_SheLLM_2023}, developed by the Stratosphere Laboratory at the Czech Technical University in Prague. The shelLM project focuses on creating a honeypot that mimics natural system shells, providing an interactive environment for attackers while collecting valuable information about their methods \cite{sladic2024llmshellgenerativehoneypots}. Unlike traditional honeypots, which experienced attackers may more quickly detect, shelLM leverages generative AI to continuously adapt its behaviour, making it indistinguishable from legitimate systems. This adaptability not only enhances the realism of the honeypot but also ensures that attackers remain engaged, allowing the system to gather more detailed intelligence about their behaviour. The dynamic nature of shelLM will enable it to react in real-time to attackers' actions, making the honeypot more effective at trapping sophisticated cybercriminals. The shelLM project exemplifies the power of combining honeypot technology with AI to enhance cybersecurity, offering a more responsive, adaptive, and effective defence mechanism against increasingly complex network threats.

\subsubsection{Industry 4.0}

One notable real-world application of AI in honeypots is presented by Lee, Abdullah, Jhanjhi, and Kok (2021) in their study titled ``Classification of botnet attacks in IoT smart factory using honeypot combined with machine learning'' \cite{Lee2021}. Their work demonstrates the effectiveness of combining honeypots with machine learning to classify and analyze botnet attacks within an Internet of Things (IoT) environment, specifically a smart factory. The researchers deployed honeypots to simulate vulnerable IoT devices, allowing attackers to interact with them. AI-based machine learning algorithms were then used to analyze the traffic data generated by these interactions, resulting in accurate classification of botnet attacks. This study highlights how the integration of AI can significantly enhance honeypot capabilities in complex, connected environments like IoT-based smart factories. AI's ability to process large amounts of data in real-time enables these honeypots to detect known attack patterns and identify novel or evolving threats. The machine learning models used in the study allowed the system to adapt dynamically, adjusting to new forms of botnet activity and improving the accuracy of threat detection over time.

\subsubsection{Adaptive Honeypot Deployment}

In their paper titled ``An Adaptive Honeypot Configuration, Deployment and Maintenance Strategy'', Daniel Fraunholz, Marc Zimmermann, and Hans D. Schotten propose a solution to a longstanding challenge in honeypot technology: the complex and resource-intensive nature of manual deployment and maintenance. Traditional honeypots require configuration and constant oversight from network administrators, making them difficult to scale and maintain in modern cybersecurity environments. Their method eliminates manual configuration by featuring an automated identification mechanism for devices and machines within a network. These entities are analyzed and clustered based on their characteristics, allowing the honeypot to be intelligently deployed where it can be most effective \cite{fraunholz2021adaptivehoneypotconfigurationdeployment}. This adaptive method ensures the honeypot remains relevant and functional without ongoing maintenance, significantly improving traditional, manually configured honeypot systems.

\subsection{Comparison with Traditional Honeypots}

Traditional honeypots have played a crucial role in cybersecurity for years. However, they have several limitations (see Table \ref{table:honeypot_comparison}). First, their configuration is mainly manual, requiring significant time and effort from network administrators. Each honeypot must be tailored to the network's specific conditions, making the process prone to human error. Furthermore, once deployed, traditional honeypots need constant maintenance to stay relevant as attack strategies evolve and change over time.
In contrast, AI-integrated honeypots bring automation to configuration and maintenance processes. AI techniques, especially machine learning, allow honeypots to adjust based on real-time data dynamically, eliminating manual intervention. AI models analyze network traffic, detect changes in threat landscapes, and reconfigure honeypots to optimize their deployment and effectiveness. This reduces the administrative burden and ensures the honeypot remains functional and relevant without frequent updates. Regarding deployment, traditional honeypots rely on the network administrator's knowledge and experience. They are typically deployed in fixed environments, where attackers are expected to target specific vulnerabilities. This static nature limits their flexibility and ability to adapt to cyber threats. On the other hand, AI-integrated honeypots are far more scalable and flexible. They can analyze the network and cluster machines, intelligently deploying honeypots in areas where they will be most effective.

Traditional honeypots are also limited in their ability to respond to emerging threats. These systems often rely on predefined signatures or behaviours to detect attacks, making them less effective against zero-day or advanced persistent threats (APTs). However, AI-enhanced honeypots can learn from new data and recognise anomalous behaviours, enabling them to detect and mitigate novel attack vectors in real-time. Another key difference lies in data analysis. Traditional honeypots passively log interactions with attackers, requiring manual analysis by cybersecurity teams, which can be time-consuming. In contrast, AI-integrated honeypots automatically analyze the data collected during attacks, using machine learning algorithms to detect patterns, classify threats, and provide real-time insights. This speeds up the response to attacks and reduces the likelihood of human error during analysis.

Moreover, AI-integrated honeypots are more difficult for attackers to detect. Skilled malicious actors often identify traditional ones due to their static and predictable nature. AI-based continuously adapt and simulate natural systems, making it much harder to distinguish them from legitimate targets. As a result, these AI-driven systems can engage attackers for extended periods, capturing more valuable data on their tactics, techniques, and procedures (TTPs). In terms of cost and resource efficiency, traditional honeypots are expensive in the long run due to the high human resource costs for configuration, monitoring, and maintenance. Although AI-enhanced honeypots may require a significant initial investment, particularly in AI model development, they offer substantial long-term savings by automating many processes and reducing the need for constant human oversight.

\begin{table}[tbh]
    \begin{center}
        \begin{tabular}{|p{4cm}|p{4.5cm}|p{4.5cm}|}
        \hline
        \textbf{Feature} & \textbf{Traditional Honeypots} & \textbf{AI-Integrated Honeypots} \\ \hline
        \textbf{Configuration} & Manual, static, and time-consuming. & Automated, dynamic, and self-adjusting using machine learning. \\ \hline
        \textbf{Maintenance} & Requires constant manual updates. & Automated maintenance with minimal human intervention. \\ \hline
        \textbf{Deployment Strategy} & Fixed, based on administrator knowledge. & Intelligent deployment using real-time data analysis. \\ \hline
        \textbf{Scalability} & Limited by manual effort. & Highly scalable due to automation. \\ \hline
        \textbf{Response to Emerging Threats} & Limited to known threats with predefined signatures. & Adaptive, capable of detecting new and novel attack patterns. \\ \hline
        \textbf{Attack Detection} & Passive logging for post-attack analysis. & Active engagement, real-time detection, and response. \\ \hline
        \textbf{Anomaly Detection} & Static detection rules. & AI-driven, based on pattern recognition and behaviour analysis. \\ \hline
        \textbf{Data Analysis} & Manual analysis of logs and behaviour. & Automated, real-time data analysis using AI. \\ \hline
        \textbf{Attractiveness to Attackers} & Can be detected by experienced attackers. & Harder to detect due to continuous adaptation and realism. \\ \hline
        \textbf{Cost and Resource Efficiency} & High resource costs for manual processes. & More cost-effective in the long term due to automation. \\ \hline
        \end{tabular}
        \caption{Comparison between Traditional and AI-Integrated Honeypots}\label{table:honeypot_comparison}
    \end{center}
\end{table}

\subsection{Advantages and Limitations of Honeypots integrated with AI}

Integrating generative AI into honeypot systems represents a significant advancement in cybersecurity, offering numerous benefits across various dimensions. These AI-enhanced honeypots provide advanced attack detection, real-time analysis, and automation while improving adaptability and scalability. However, as with any technological advancement, they come with certain limitations that must be considered alongside their advantages.

\subsubsection{Advanced Attack Detection}
One of the most prominent advantages of AI-integrated honeypots is their real-time analysis capabilities. Generative AI can process and analyse vast amounts of data instantaneously, enabling immediate detection of cyberattacks. This rapid response is critical in preventing widespread network damage and reducing attackers' dwell time.
Moreover, generative AI excels in anomaly detection, identifying unusual patterns of behaviour that traditional signature-based detection methods might miss. AI algorithms can detect subtle deviations in system behaviour or communication traffic, allowing for the identification of novel attack vectors or previously unknown threats. While AI's real-time capabilities are a significant strength, detection accuracy relies heavily on the quality and diversity of the training data. If an AI system has not been adequately trained on a wide range of attack behaviours, there is a risk that new types of attacks could still go unnoticed.

\subsubsection{Automation and Efficiency}
Generative AI can dramatically enhance data collection and analysis automation, significantly reducing the need for human intervention. This frees cybersecurity professionals to focus on higher-level strategy and decision-making rather than routine tasks. Another key benefit is the reduction of false positives. By leveraging advanced machine learning techniques, AI-integrated honeypots can more accurately distinguish between legitimate activity and malicious behaviour. This reduces the volume of false alarms and allows security teams to prioritise actual threats, leading to more efficient threat management. Despite the improved accuracy, AI systems are not infallible. In some instances, false positives may still occur, particularly in environments with unusual but legitimate activity that AI algorithms may misclassify as a threat. Furthermore, while AI reduces manual workload, it may introduce the need for highly skilled personnel to manage and interpret AI-generated insights, which can be a resource challenge for smaller organisations.

\subsubsection{Adaptability and Continuous Learning}
One of the critical advantages of AI-driven honeypots is their continuous learning capability. Machine learning algorithms improve over time as they process more data from cyberattacks, making them increasingly proficient at detecting and responding to threats. Unlike traditional systems, which require manual updates to remain effective, AI honeypots can adapt to new forms of cyberattacks, keeping network security up to date without significant manual input. AI also provides superior adaptability to new threats. As attackers develop novel techniques, AI-powered honeypots can quickly learn and adjust, maintaining a robust security posture despite rapidly evolving cyber threats. While AI offers the ability to learn and adapt, its effectiveness depends on the availability of sufficient, high-quality data to train the system. If AI models are not exposed to various attack vectors during the learning phase, they may struggle to adapt effectively to new or highly sophisticated threats. Additionally, adversarial attacks can be launched to exploit vulnerabilities in AI models, misleading the system and compromising its defensive capabilities.

\subsubsection{Detailed Attack Analysis}
Generative AI also enables detailed profiling of attackers using the data collected during honeypot interactions. By analysing methods and tactics, AI can help security teams build comprehensive profiles of threat actors, including their preferred techniques and objectives. This detailed insight supports the creation of more effective countermeasures and defensive strategies. Another significant benefit is the ability of AI to map tactics, techniques, and procedures (TTPs) to frameworks like the MITRE ATT\&CK matrix (see Section \ref{sec:mitre_attack}). This helps organisations better understand attack patterns and improve their preparedness for similar threats in the future. While AI can provide detailed analysis, there is the risk of over-reliance on automated insights. Human oversight remains crucial to interpret the data effectively and apply it strategically. In some cases, AI-generated profiles might be too generic or incomplete without human verification, potentially leading to gaps in security coverage.

\subsubsection{Improved Network Security}
AI can also enhance proactive protection. Through predictive analysis, AI can anticipate potential attack scenarios based on patterns observed in the data. This allows organisations to adopt preventive measures, such as patching vulnerabilities or adjusting firewall settings, before an attack occurs. Furthermore, AI's ability to integrate with security systems such as Security Information and Event Management (SIEM) or Intrusion Detection Systems (IDS) provides a layered defence mechanism. While AI offers advanced protection, it can sometimes lead to false confidence. Organisations might assume that AI-powered systems are infallible, reducing manual vigilance. Moreover, integration with existing systems requires careful configuration to ensure seamless operation, and misconfigurations can introduce new vulnerabilities.

\subsubsection{Scalability}
Generative AI significantly improves the scalability of honeypot systems. Artificial intelligence enables honeypots to handle and analyse vast amounts of data, making them suitable for organisations of any size. This makes AI-powered honeypots particularly effective in large, distributed environments such as cloud infrastructures and IoT ecosystems.
Moreover, the ease of implementation and maintenance offered by AI reduces the workload on IT teams. Although scalability is a clear advantage, the initial setup costs and the need for advanced AI expertise can be prohibitive for smaller organisations or those with limited resources. Furthermore, AI-powered honeypots may require significant computational power as the system scales, increasing infrastructure costs.

\subsubsection{Support for Research and Development}
AI-enhanced honeypots can collect large amounts of data on cyberattacks, which is invaluable for cybersecurity research. This data can be used to develop new defensive techniques, improve existing security tools, and foster innovation in the field. The continuous learning capabilities of AI also contribute to ongoing innovation, as the system constantly enhances its understanding of the threat landscape. While the data collected is valuable, it may also introduce privacy concerns if sensitive information is inadvertently captured and not adequately anonymised (see Section \ref{subsec:honeypot_legal_ethical}). Additionally, organisations may face challenges in securely storing and managing the large datasets required for AI training and research.

\subsubsection{Reduced Operational Costs}
The operational efficiency brought by automation helps reduce the costs associated with manual system management. AI can detect and respond to threats more quickly, reducing downtime and minimising the financial impact of successful attacks. Automating data analysis and threat detection also decreases the need for a large security team, providing further savings. While AI-driven systems may reduce long-term operational costs, the upfront investment in AI infrastructure and expertise can be significant. As already said, smaller organisations may struggle with these initial costs, which can offset the savings realised from reduced manual intervention.