SavedAdd your journal

Journals / Yenilikçi Mühendislik ve Doğa Bilimleri / 2026 / Volume: 6 Issue: 2

AURA: Agent-based unified response architecture for retrieval-augmented cyber deception

Anıl Sezgin(İSTANBUL AREL ÜNİVERSİTESİ)0000-0002-5754-1380
Pages
—
Publication Date
2026-07-30
🏛️Bibliographic metadata and full text access for this article are provided via DergiPark.
DergiPark Record ↗
✨

AI Summary & Key Takeaways

AI Insight
⚡ TL;DR(Too Long; Didn't Read)

In the experiment, all agents of the AURA honeypot system used the Llama 3.1 8B model as the reasoning engine, which shows the effectiveness of the model in providing a secure means of implementing autonomous deception systems using a multi-agent architecture, which can be used to implement next-generation autonomous honeypots.

📌 3 Key Takeaways

🎯
Objective & Hypothesis:The accelerated development of large language models (LLMs) has redefined the security defense landscape by providing the means to implement adaptive deception systems that can be contextually aware of the environment in which the deception must be implemented.
📊
Key Findings & Data:In this paper, the authors propose a multi-agent honeypot system, AURA, which incorporates a new form of deception using a Retrieval-Augmented Generation (RAG) model to mimic command-line interfaces in an adversarial environment.
💡
Conclusion & Impact:In the experiment, all agents of the AURA honeypot system used the Llama 3.1 8B model as the reasoning engine, which shows the effectiveness of the model in providing a secure means of implementing autonomous deception systems using a multi-agent architecture, which can be used to implement next-generation autonomous honeypots.
🔬Design:Modeling & Simulation
📍Scope:Comprehensive Sample
⚙️Variables:Large language models · Honeypot · Multi-agent systems

Abstract

The accelerated development of large language models (LLMs) has redefined the security defense landscape by providing the means to implement adaptive deception systems that can be contextually aware of the environment in which the deception must be implemented. In this paper, the authors propose a multi-agent honeypot system, AURA, which incorporates a new form of deception using a Retrieval-Augmented Generation (RAG) model to mimic command-line interfaces in an adversarial environment. A dataset of 1,500 command-response pairs, implemented using a Linux environment, was used to test the effectiveness of the model, which was evaluated over 10 different experimental configurations. The results of the experiment show a marked improvement in the effectiveness of the model, which was augmented using the RAG model, over the traditional model used as a baseline. The BLEU score was raised from 0.1455 to 0.4621, the ROUGE-L (F1) score was raised from 0.2665 to 0.5740, the METEOR score was raised from 0.2441 to 0.5282, and the Jaccard similarity was raised from 0.2244 to 0.5189, which represent an increase of over 100% in the effectiveness of the model over the traditional model used as a baseline. In the experiment, all agents of the AURA honeypot system used the Llama 3.1 8B model as the reasoning engine, which shows the effectiveness of the model in providing a secure means of implementing autonomous deception systems using a multi-agent architecture, which can be used to implement next-generation autonomous honeypots.

🔖

Cite This Article

Sezgin, A. (2026). AURA: Agent-based unified response architecture for retrieval-augmented cyber deception. Yenilikçi Mühendislik ve Doğa Bilimleri, Volume: 6 Issue: 2. https://doi.org/10.61112/jiens.1856246

📄 Full Text PDF Viewer

📄

PDF görüntüleyici hazırlanıyor...

References (41)

  1. Amal MR, Venkadesh P (2023) H-DOCTOR: Honeypot based firewall tuning for attack prevention. Measurement: Sensors 25:1–7. https://doi.org/10.1016/j.measen.2022.100664
  2. Alani MM (2024) HoneyTwin: Securing smart cities with machine learning-enabled SDN edge and cloud-based honeypots. J Parallel Distrib Comput 188:1–9. https://doi.org/10.1016/j.jpdc.2024.104866
  3. Lanz S, Pignol SL, Schmitt P, Wang H, Papaioannou M, Choudhary G, Dragoni N (2025) Optimizing Internet of Things honeypots with machine learning: A review. Appl Sci 15:1–30. https://doi.org/10.3390/app15105251
  4. Sezgin A, Boyacı A (2025) DecoyPot: A large language model-driven web API honeypot for realistic attacker engagement. Comput Secur 154:1–9. https://doi.org/10.1016/j.cose.2025.104458
  5. Yang G, Sun Z, Wang Y (2025) ShellBox: Adversarially enhanced LLM-interactive honeypot framework. IEEE Access 13:143618–143630. https://doi.org/10.1109/ACCESS.2025.3598779
  6. Morić Z, Dakić V, Regvart D (2025) Advancing cybersecurity with honeypots and deception strategies. Informatics 12:1–37. https://doi.org/10.3390/informatics12010014
  7. Yang X, Yuan J, Yang H, Kong Y, Zhang H, Zhao J (2023) A highly interactive honeypot-based approach to network threat management. Future Internet 15:1–31. https://doi.org/10.3390/fi15040127
  8. Visalom R, Mihăilescu M, Rughiniș R, Țurcanu D (2025) Intercepting and monitoring potentially malicious payloads with web honeypots. Future Internet 17:1–32. https://doi.org/10.3390/fi17090422
  9. Sarang AD, Alawami MA, Park K (2024) MV-Honeypot: Security threat analysis by deploying avatar as a honeypot in COTS metaverse platforms. CMES Comput Model Eng Sci 141(1):655–669. https://doi.org/10.32604/cmes.2024.053434
  10. AlQahtan N, AlOlayan A, AlAjaji A, Almaslukh A (2025) HoneyLite: A lightweight honeypot security solution for SMEs. Sensors 25:1–17. https://doi.org/10.3390/s25165207
  11. Heluany JB (2024) PLC honeypots: Enhancing interaction-level assessment. Electronics 13:1–18. https://doi.org/10.3390/electronics13204024
  12. Rocha A, Pereira FSF (2025) What is the most targeted database? Using honeypots to characterize attacks on relational databases. Procedia Comput Sci 256:114–121. https://doi.org/10.1016/j.procs.2025.02.103
  13. Javadpour A, Ja’fari F, Taleb T, Shojafar M, Benzaïd C (2024) A comprehensive survey on cyber deception techniques to improve honeypot performance. Comput Secur 140:1–39. https://doi.org/10.1016/j.cose.2024.103792
  14. Li D, Tian S, Jin W, Peng J, Duan M (2025) Towards a moving target defense based on stochastic games and honeypots. Inf Sci 720:1–25. https://doi.org/10.1016/j.ins.2025.122488
  15. Yu X, He L, Geng J, Liang Z, Gan Z, Zhao H (2025) Dynamic defense strategy selection through reinforcement learning in heterogeneous redundancy systems for critical data protection. Appl Sci 15:1–20. https://doi.org/10.3390/app15169111
  16. d’Ambrosio N, Lista C, Perrone G, Romano SP (2025) SMASH: An SDN-MTD framework for efficient honeypot deployment and insider threat mitigation. Comput Netw 269:1–29. https://doi.org/10.1016/j.comnet.2025.111327
  17. Chen Q, Liu Y, Tan R, Jin Z, Xiao J, Wang X, Zhang F, Liu Q (2025) Shadowkube: Enhancing Kubernetes security with behavioral monitoring and honeypot integration. Cybersecurity 8:1–19. https://doi.org/10.1186/s42400-025-00372-7
  18. Miao S, Li Y, Pan Q (2023) Honeypot game theory against DoS attack in UAV cyber. Comput Mater Continua 76(3):2745–2762. https://doi.org/10.32604/cmc.2023.037257
  19. Rabah MAO, Drid H, Medjadba Y, Rahouti M (2024) Detection and mitigation of distributed denial of service attacks using ensemble learning and honeypots in a novel SDN-UAV network architecture. IEEE Access 12:128929–128940. https://doi.org/10.1109/ACCESS.2024.3443142
  20. Omar AHE, Soubra H, Moulla DK, Abran A (2024) An innovative honeypot architecture for detecting and mitigating hardware trojans in IoT devices. IoT 5:730–755. https://doi.org/10.3390/iot5040033
  21. Al Abdulwahid A (2025) AI-driven identification of attack precursors: A machine learning approach to predictive cybersecurity. Comput Mater Continua 85(1):1751–1777. https://doi.org/10.32604/cmc.2025.066892
  22. Yigit Y, Ferrag MA, Ghanem MC, Sarker IH, Maglaras LA, Chrysoulas C, Moradpoor N, Tihanyi N, Janicke H (2025) Generative AI and LLMs for critical infrastructure protection: Evaluation benchmarks, agentic AI, challenges, and opportunities. Sensors 25:1–40. https://doi.org/10.3390/s25061666
  23. Wu Q, Wen S, Li F, Liu B, Zhong W (2024) Web attack detection based on honeypots and logistic regression algorithm. J Electr Syst 20(3):814–822. https://doi.org/10.52783/jes.3013
  24. Naeini SRG, Shameli-Sendi A, Jabbarifar M (2025) Protecting industrial control systems from Shodan exploitation through advanced traffic analysis. IEEE Access 13:45985–45997. https://doi.org/10.1109/ACCESS.2025.3544906
  25. Alatawi E, Albalawi U (2025) Harnessing AI for cyber defense: Honeypot-driven intrusion detection systems. Symmetry 17:1–15. https://doi.org/10.3390/sym17050628
  26. Guo W, Xue J, Lin Y, Du W, Hu J, Shi N, Han W (2025) MalFSLDF: A few-shot learning-based malware family detection framework. Int J Intell Syst 2025(1):1–20. https://doi.org/10.1155/int/7390905
  27. Agbedanu PR, Yang SJ, Musabe R, Gatare I, Rwigema J (2025) A scalable approach to IoT and IIoT security: Evaluating adaptive self-adjusting memory KNN for zero-day attack detection. Sensors 25:1–35. https://doi.org/10.3390/s25010216
  28. Abdelmaguid MA, Hussanein HS, Zulkernine M (2025) Securing the unforeseen: Enhancing VANET security with dynamic honeypots and attack rate analysis. Veh Commun 55:1–10. https://doi.org/10.1016/j.vehcom.2025.100946
  29. Spyros A, Koritsas I, Papoutsis A, Panagiotou P, Chatzakou D, Kavallieros D, Tsikrika T, Vrochidis S, Kompatsiaris I (2025) AI-based holistic framework for cyber threat intelligence management. IEEE Access 13:20820–20846. https://doi.org/10.1109/ACCESS.2025.3533084
  30. Sahraoui Y, Hadjkouider AM, Kerrache CA, Calafate CT (2025) TwinFedPot: Honeypot intelligence distillation into digital twin for persistent smart traffic security. Sensors 25:1–16. https://doi.org/10.3390/s25154725
  31. Albaseer A, Abdi N, Abdallah M, Qarage M, Al-Kuwari S (2024) FedPot: A quality-aware collaborative and incentivized honeypot-based detector for smart grid networks. IEEE Trans Netw Serv Manag 21(4):4844–4860. https://doi.org/10.1109/TNSM.2024.3387710
  32. Jaffal NO, Alkhanafseh M, Mohaisen D (2025) Large language models in cybersecurity: A survey of applications, vulnerabilities, and defense techniques. AI 6:1–45. https://doi.org/10.3390/ai6090216
  33. Lanka P, Gupta K, Varol C (2024) Intelligent threat detection—AI-driven analysis of honeypot data to counter cyber threats. Electronics 13:1–28. https://doi.org/10.3390/electronics13132465
  34. DeCusatis C, Tomo R, Singh A, Khoury E, Masone A (2025) Cybersecurity applications of near-term large language models. Electronics 14:1–14. https://doi.org/10.3390/electronics14132704
  35. Weber SB, Feger M, Pilgermann M (2024) Don’t stop believin’: A unified evaluation approach for LLM honeypots. IEEE Access 12:144579–144587. https://doi.org/10.1109/ACCESS.2024.3472460
  36. Ilg N, Germek D, Duplys P, Menth M (2025) Beekeeper: Accelerating honeypot analysis with LLM-driven feedback. IEEE Access 13:168034–168054. https://doi.org/10.1109/ACCESS.2025.3613118
  37. Sezgin A (2025) Natural language interfaces for structured query generation in IoD platforms. Drones 9:1–20. https://doi.org/10.3390/drones9060444
  38. Loumachi FY, Ghanem MC, Ferrag MA (2025) Advancing cyber incident timeline analysis through retrieval-augmented generation and large language models. Computers 14:1–42. https://doi.org/10.3390/computers14020067
  39. Coppolino L, Iannaccone A, Nardone R, Petruolo A (2025) Asset discovery in critical infrastructures: An LLM-based approach. Electronics 14:1–24. https://doi.org/10.3390/electronics14163267
  40. Wang Z, Wang Y, Xiong X, Ren Q, Huang J (2025) A novel framework for enhancing decision-making in autonomous cyber defense through graph embedding. Entropy 27:1–24. https://doi.org/10.3390/e27060622
  41. Yang Q, Sun L, Pan H, Qiu C, Li P, Fang B, Liu Y, Tian Z (2025) Multistage-signaling-game-based camouflage defense strategy using reinforcement learning to mitigate the anti-honeypot attack. IEEE Internet Things J 15:41451–41464. https://doi.org/10.1109/JIOT.2025.3591024