Integrating LLMs with Honeypots and IPS for Advanced Cybercrime Detection

الملخص

This study presents an advanced cybersecurity framework that leverages Honeypot technology integrated with a fine-tuned Large Language Model (LLM) and an Intrusion Prevention System (IPS) to combat cybercrime. The proposed system emulates an SSH server environment to attract malicious actors, capturing and analyzing their activities using a custom-trained LLM based on 617 Linux command-response pairs obtained from Cowrie logs and public datasets. Optimization techniques such as LoRA and QLoRA were employed to enhance model efficiency while minimizing computational overhead. Concurrently, the IPS component monitors and blocks suspicious traffic in real time, further strengthening the defense posture. Experimental validation through brute-force simulations using Kali Linux and Nmap demonstrated the system’s capacity to realistically imitate server behavior and effectively extract actionable intelligence from attacker interactions. Despite integration and maintenance challenges, the proposed solution offers a robust mechanism for proactive threat detection and response.